diff --git a/.do/gitnexus/Dockerfile b/.do/gitnexus/Dockerfile
index 58a79e087e7..8b7e538726e 100644
--- a/.do/gitnexus/Dockerfile
+++ b/.do/gitnexus/Dockerfile
@@ -7,13 +7,18 @@
 
 FROM node:24.16.0-slim
 
-ARG GITNEXUS_VERSION=1.5.3
+ARG GITNEXUS_VERSION=1.6.7
+# Pin the native DB to match the index workflow; gitnexus's ^0.17.0 range
+# would otherwise let the served image drift from the CI-produced index.
+ARG LADYBUG_VERSION=0.17.1
 
 # 1. Build native addons with Bookworm toolchain, then remove build tools.
 #    curl stays for the docker healthcheck; Caddy lives in its own container.
+#    LadybugDB is pinned nested under gitnexus so step 3's require() resolves it.
 RUN apt-get update \
     && apt-get install -y --no-install-recommends python3 make g++ curl \
     && npm install -g gitnexus@${GITNEXUS_VERSION} \
+    && npm install --no-save --prefix /usr/local/lib/node_modules/gitnexus "@ladybugdb/core@${LADYBUG_VERSION}" \
     && apt-get purge -y --auto-remove python3 make g++ \
     && rm -rf /var/lib/apt/lists/* /root/.npm
 
@@ -26,17 +31,13 @@ RUN echo "deb http://deb.debian.org/debian trixie main" > /etc/apt/sources.list.
     && rm -rf /var/lib/apt/lists/*
 
 # 3. Pre-install LadybugDB FTS + vector extensions so ~/.kuzu/extension/
-#    is baked into the image. Workaround for upstream GitNexus 1.5.3 bug.
+#    is baked into the image. gitnexus serve loads extensions with a
+#    load-only policy and never installs them at runtime, so the cache
+#    must already exist. (GitNexus loads the vector extension itself
+#    via loadVectorExtension — no adapter patch needed.)
 COPY install-extensions.js /tmp/install-extensions.js
 RUN node /tmp/install-extensions.js && rm -rf /tmp/install-extensions.js /tmp/lbug-ext-install
 
-# 4. Patch lbug-adapter.js to also LOAD EXTENSION vector after FTS.
-RUN LBUG_ADAPTER=/usr/local/lib/node_modules/gitnexus/dist/mcp/core/lbug-adapter.js \
-    && grep -q "LOAD EXTENSION fts" "$LBUG_ADAPTER" \
-    && sed -i "s|await available\[0\]\.query('LOAD EXTENSION fts');|await available[0].query('LOAD EXTENSION fts'); try { await available[0].query('LOAD EXTENSION vector'); } catch (e) { /* vector extension may not be installed */ }|g" "$LBUG_ADAPTER" \
-    && grep -c "LOAD EXTENSION vector" "$LBUG_ADAPTER" \
-    && echo "lbug-adapter.js patched to load vector extension"
-
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
diff --git a/.env.example b/.env.example
index 6971a47c372..430fb8179e7 100644
--- a/.env.example
+++ b/.env.example
@@ -108,6 +108,10 @@ NODE_MAX_OLD_SPACE_SIZE=6144
 
 # CONFIG_PATH="/alternative/path/to/librechat.yaml"
 
+# Deployment skills are loaded read-only at startup and exposed to all users
+# with the Skills capability enabled. Defaults to project root ./skill.
+# DEPLOYMENT_SKILLS_DIR=./skill
+
 #==================#
 # Langfuse Tracing #
 #==================#
@@ -134,6 +138,8 @@ NODE_MAX_OLD_SPACE_SIZE=6144
 # OTEL_TRACES_SAMPLER=parentbased_always_on
 # OTEL_LOG_LEVEL=INFO
 # OTEL_SDK_DISABLED=false
+# Enable Redis command-level spans. Disabled by default to keep backend traces high-level.
+# OTEL_IOREDIS_TRACING_ENABLED=false
 
 #===============================#
 # Real User Monitoring (Browser) #
@@ -175,9 +181,13 @@ NODE_MAX_OLD_SPACE_SIZE=6144
 
 # ENDPOINTS=openAI,assistants,azureOpenAI,google,anthropic
 
-# Optional outbound proxy for server-side requests, including remote MCP HTTP/SSE transports.
-# Remote MCP transports also honor HTTP_PROXY, HTTPS_PROXY, and NO_PROXY when PROXY is unset.
+# Optional outbound proxy for server-side requests.
+# PROXY applies to both HTTP and HTTPS targets. When PROXY is unset, LibreChat honors
+# HTTP_PROXY, HTTPS_PROXY, and NO_PROXY/no_proxy for supported server-side clients.
 PROXY=
+# HTTP_PROXY=
+# HTTPS_PROXY=
+# NO_PROXY=
 
 #===================================#
 # Known Endpoints - librechat.yaml  #
@@ -205,7 +215,7 @@ PROXY=
 #============#
 
 ANTHROPIC_API_KEY=user_provided
-# ANTHROPIC_MODELS=claude-opus-4-8,claude-opus-4-7,claude-sonnet-4-6,claude-opus-4-6,claude-opus-4-20250514,claude-3-7-sonnet-20250219,claude-3-5-sonnet-20241022,claude-3-5-haiku-20241022,claude-3-opus-20240229,claude-3-sonnet-20240229,claude-3-haiku-20240307
+# ANTHROPIC_MODELS=claude-fable-5,claude-opus-4-8,claude-opus-4-7,claude-sonnet-4-6,claude-opus-4-6,claude-opus-4-20250514,claude-3-7-sonnet-20250219,claude-3-5-sonnet-20241022,claude-3-5-haiku-20241022,claude-3-opus-20240229,claude-3-sonnet-20240229,claude-3-haiku-20240307
 # ANTHROPIC_REVERSE_PROXY=
 
 # Set to true to use Anthropic models through Google Vertex AI instead of direct API
@@ -271,8 +281,8 @@ ANTHROPIC_API_KEY=user_provided
 # BEDROCK_AWS_BEARER_TOKEN=yourBedrockApiKey
 
 # Note: This example list is not meant to be exhaustive. If omitted, all known, supported model IDs will be included for you.
-# BEDROCK_AWS_MODELS=anthropic.claude-opus-4-8,anthropic.claude-opus-4-7,anthropic.claude-sonnet-4-6,anthropic.claude-opus-4-6-v1,anthropic.claude-3-5-sonnet-20240620-v1:0,meta.llama3-1-8b-instruct-v1:0
-# Cross-region inference model IDs: us.anthropic.claude-opus-4-8,us.anthropic.claude-opus-4-7,us.anthropic.claude-sonnet-4-6,us.anthropic.claude-opus-4-6-v1,global.anthropic.claude-opus-4-6-v1
+# BEDROCK_AWS_MODELS=anthropic.claude-fable-5,anthropic.claude-opus-4-8,anthropic.claude-opus-4-7,anthropic.claude-sonnet-4-6,anthropic.claude-opus-4-6-v1,anthropic.claude-3-5-sonnet-20240620-v1:0,meta.llama3-1-8b-instruct-v1:0
+# Cross-region inference model IDs: us.anthropic.claude-fable-5,us.anthropic.claude-opus-4-8,us.anthropic.claude-opus-4-7,us.anthropic.claude-sonnet-4-6,us.anthropic.claude-opus-4-6-v1,global.anthropic.claude-opus-4-6-v1
 
 # See all Bedrock model IDs here: https://docs.aws.amazon.com/bedrock/latest/userguide/model-ids.html#model-ids-arns
 
@@ -283,6 +293,10 @@ ANTHROPIC_API_KEY=user_provided
 # The following models are not support due to not supporting conversation history:
 # ai21.j2-ultra-v1, cohere.command-text-v14, cohere.command-light-text-v14
 
+# Claude Mythos-class models (anthropic.claude-fable-5, anthropic.claude-mythos-5) are inference-profile
+# only on Bedrock — use a profile ID (e.g. us.anthropic.claude-fable-5) — and require opting into Anthropic
+# data sharing via the Bedrock Data Retention API/console before they can be invoked.
+
 #============#
 # Google     #
 #============#
@@ -637,7 +651,9 @@ OPENID_NAME_CLAIM=
 # Set to determine which user info claim to use as the email/identifier for user matching (e.g., "upn" for Entra ID)
 # When not set, defaults to: email -> preferred_username -> upn
 OPENID_EMAIL_CLAIM=
-# Optional audience parameter for OpenID authorization requests
+# Optional audience parameter for OpenID authorization requests and JWT validation.
+# If comma-separated values are provided, JWT validation accepts all values and
+# authorization requests use the first non-empty value.
 OPENID_AUDIENCE=
 # Optional audience parameter for OpenID refresh token requests.
 # Some providers, such as Auth0 custom APIs, require this to preserve
@@ -654,6 +670,12 @@ OPENID_AUTO_REDIRECT=false
 OPENID_USE_PKCE=false
 #Set to true to reuse openid tokens for authentication management instead of using the mongodb session and the custom refresh token.
 OPENID_REUSE_TOKENS=
+#Max age a reused OpenID session token is served before LibreChat forces an IdP refresh. Default 900000 ms (15 min).
+#Accepts an arithmetic expression like SESSION_EXPIRY (e.g. 60 * 60 * 24 * 1000 for 24h).
+#Raise toward the IdP access-token lifetime when the IdP revokes the previous access token on refresh, so a still-valid token
+#is not rotated/revoked out from under downstream consumers (e.g. MCP servers that introspect the bearer).
+#When OPENID_REUSE_TOKENS=true, the OpenID session cookie maxAge is extended to at least this value.
+OPENID_REUSE_MAX_SESSION_AGE_MS=
 #By default, signing key verification results are cached in order to prevent excessive HTTP requests to the JWKS endpoint.
 #If a signing key matching the kid is found, this will be cached and the next time this kid is requested the signing key will be served from the cache.
 #Default is true.
@@ -824,6 +846,9 @@ ALLOW_SHARED_LINKS_PUBLIC=false
 # If you have another service in front of your LibreChat doing compression, disable express based compression here
 # DISABLE_COMPRESSION=true
 
+# Serve precompressed Brotli versions of static app assets when available.
+# ENABLE_STATIC_ASSET_BROTLI=true
+
 # If you have gzipped version of uploaded image images in the same folder, this will enable gzip scan and serving of these images
 # Note: The images folder will be scanned on startup and a ma kept in memory. Be careful for large number of images.
 # ENABLE_IMAGE_OUTPUT_GZIP_SCAN=true
@@ -978,6 +1003,12 @@ OPENWEATHER_API_KEY=
 # Timeout for OAuth detection requests in milliseconds
 # MCP_OAUTH_DETECTION_TIMEOUT=5000
 
+# How long to wait (ms) for a user to complete the OAuth flow before timing out (default: 10 minutes)
+# MCP_OAUTH_HANDLING_TIMEOUT=600000
+
+# TTL (ms) for OAuth flow state; must outlive MCP_OAUTH_HANDLING_TIMEOUT (default: 15 minutes)
+# MCP_OAUTH_FLOW_TTL=900000
+
 # Cache connection status checks for this many milliseconds to avoid expensive verification
 # MCP_CONNECTION_CHECK_TTL=60000
 
diff --git a/.github/playwright.yml b/.github/playwright.yml
index 28eca14d581..27f026a525b 100644
--- a/.github/playwright.yml
+++ b/.github/playwright.yml
@@ -39,7 +39,7 @@
 #       - uses: actions/checkout@v4
 #       - uses: actions/setup-node@v4
 #         with:
-#           node-version: 18
+#           node-version: 24.16.0
 #           cache: 'npm'
 
 #       - name: Install global dependencies
diff --git a/.github/workflows/backend-review.yml b/.github/workflows/backend-review.yml
index e25e884feeb..46a698cd5ac 100644
--- a/.github/workflows/backend-review.yml
+++ b/.github/workflows/backend-review.yml
@@ -46,7 +46,7 @@ jobs:
         uses: actions/cache@v4
         with:
           path: packages/data-provider/dist
-          key: build-data-provider-${{ runner.os }}-${{ hashFiles('packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/rollup.config.js', 'packages/data-provider/package.json') }}
+          key: build-data-provider-${{ runner.os }}-${{ hashFiles('packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/tsdown.config.mjs', 'packages/data-provider/package.json') }}
 
       - name: Build data-provider
         if: steps.cache-data-provider.outputs.cache-hit != 'true'
@@ -57,7 +57,7 @@ jobs:
         uses: actions/cache@v4
         with:
           path: packages/data-schemas/dist
-          key: build-data-schemas-${{ runner.os }}-${{ hashFiles('packages/data-schemas/src/**', 'packages/data-schemas/tsconfig*.json', 'packages/data-schemas/rollup.config.js', 'packages/data-schemas/package.json', 'packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/rollup.config.js', 'packages/data-provider/package.json') }}
+          key: build-data-schemas-${{ runner.os }}-${{ hashFiles('packages/data-schemas/src/**', 'packages/data-schemas/tsconfig*.json', 'packages/data-schemas/tsdown.config.mjs', 'packages/data-schemas/package.json', 'packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/tsdown.config.mjs', 'packages/data-provider/package.json') }}
 
       - name: Build data-schemas
         if: steps.cache-data-schemas.outputs.cache-hit != 'true'
@@ -68,7 +68,7 @@ jobs:
         uses: actions/cache@v4
         with:
           path: packages/api/dist
-          key: build-api-${{ runner.os }}-${{ hashFiles('packages/api/src/**', 'packages/api/tsconfig*.json', 'packages/api/server-rollup.config.js', 'packages/api/package.json', 'packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/rollup.config.js', 'packages/data-provider/package.json', 'packages/data-schemas/src/**', 'packages/data-schemas/tsconfig*.json', 'packages/data-schemas/rollup.config.js', 'packages/data-schemas/package.json') }}
+          key: build-api-${{ runner.os }}-${{ hashFiles('packages/api/src/**', 'packages/api/tsconfig*.json', 'packages/api/tsdown.config.mjs', 'packages/api/package.json', 'packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/tsdown.config.mjs', 'packages/data-provider/package.json', 'packages/data-schemas/src/**', 'packages/data-schemas/tsconfig*.json', 'packages/data-schemas/tsdown.config.mjs', 'packages/data-schemas/package.json') }}
 
       - name: Build api
         if: steps.cache-api.outputs.cache-hit != 'true'
@@ -215,10 +215,14 @@ jobs:
           fi
 
   test-api:
-    name: 'Tests: api'
+    name: 'Tests: api (shard ${{ matrix.shard }}/3)'
     needs: build
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2, 3]
     env:
       MONGO_URI: ${{ secrets.MONGO_URI }}
       OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
@@ -278,8 +282,8 @@ jobs:
       - name: Prepare .env.test file
         run: cp api/test/.env.test.example api/test/.env.test
 
-      - name: Run unit tests
-        run: cd api && npm run test:ci
+      - name: Run unit tests (shard ${{ matrix.shard }}/3)
+        run: cd api && npm run test:ci -- --shard=${{ matrix.shard }}/3
 
   test-data-provider:
     name: 'Tests: data-provider'
@@ -364,14 +368,18 @@ jobs:
         run: cd packages/data-schemas && npm run test:ci
 
   test-packages-api:
-    name: 'Tests: @librechat/api'
+    name: 'Tests: @librechat/api (shard ${{ matrix.shard }}/4)'
     needs: build
     runs-on: ubuntu-latest
     # Suite typically completes in ~5 min on a warm runner, but tail-latency
     # cancellations have started showing up: tests are actively passing right
-    # up to the timeout, then the job is killed mid-suite. Bump headroom to
-    # absorb GitHub Actions runner variance.
+    # up to the timeout, then the job is killed mid-suite. Sharding splits the
+    # suite across runners; per-shard headroom still absorbs runner variance.
     timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2, 3, 4]
     steps:
       - uses: actions/checkout@v4
 
@@ -414,5 +422,5 @@ jobs:
           name: build-api
           path: packages/api/dist
 
-      - name: Run unit tests
-        run: cd packages/api && npm run test:ci
+      - name: Run unit tests (shard ${{ matrix.shard }}/4)
+        run: cd packages/api && npm run test:ci -- --shard=${{ matrix.shard }}/4
diff --git a/.github/workflows/cache-integration-tests.yml b/.github/workflows/cache-integration-tests.yml
index 3e4c5418ae7..1a70e4b6b0e 100644
--- a/.github/workflows/cache-integration-tests.yml
+++ b/.github/workflows/cache-integration-tests.yml
@@ -32,7 +32,6 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: '24.16.0'
-          cache: 'npm'
 
       - name: Install Redis tools
         run: |
@@ -57,14 +56,54 @@ jobs:
           redis-cli -p 7002 cluster info || exit 1
           redis-cli -p 7003 cluster info || exit 1
 
+      - name: Restore node_modules cache
+        id: cache-node-modules
+        uses: actions/cache@v4
+        with:
+          path: |
+            node_modules
+            api/node_modules
+            packages/api/node_modules
+            packages/data-provider/node_modules
+            packages/data-schemas/node_modules
+          key: node-modules-backend-${{ runner.os }}-24.16.0-${{ hashFiles('package-lock.json') }}
+
       - name: Install dependencies
+        if: steps.cache-node-modules.outputs.cache-hit != 'true'
         run: npm ci
 
-      - name: Build packages
-        run: |
-          npm run build:data-provider
-          npm run build:data-schemas
-          npm run build:api
+      - name: Restore data-provider build cache
+        id: cache-data-provider
+        uses: actions/cache@v4
+        with:
+          path: packages/data-provider/dist
+          key: build-data-provider-${{ runner.os }}-${{ hashFiles('packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/tsdown.config.mjs', 'packages/data-provider/package.json') }}
+
+      - name: Build data-provider
+        if: steps.cache-data-provider.outputs.cache-hit != 'true'
+        run: npm run build:data-provider
+
+      - name: Restore data-schemas build cache
+        id: cache-data-schemas
+        uses: actions/cache@v4
+        with:
+          path: packages/data-schemas/dist
+          key: build-data-schemas-${{ runner.os }}-${{ hashFiles('packages/data-schemas/src/**', 'packages/data-schemas/tsconfig*.json', 'packages/data-schemas/tsdown.config.mjs', 'packages/data-schemas/package.json', 'packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/tsdown.config.mjs', 'packages/data-provider/package.json') }}
+
+      - name: Build data-schemas
+        if: steps.cache-data-schemas.outputs.cache-hit != 'true'
+        run: npm run build:data-schemas
+
+      - name: Restore api build cache
+        id: cache-api
+        uses: actions/cache@v4
+        with:
+          path: packages/api/dist
+          key: build-api-${{ runner.os }}-${{ hashFiles('packages/api/src/**', 'packages/api/tsconfig*.json', 'packages/api/tsdown.config.mjs', 'packages/api/package.json', 'packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/tsdown.config.mjs', 'packages/data-provider/package.json', 'packages/data-schemas/src/**', 'packages/data-schemas/tsconfig*.json', 'packages/data-schemas/tsdown.config.mjs', 'packages/data-schemas/package.json') }}
+
+      - name: Build api
+        if: steps.cache-api.outputs.cache-hit != 'true'
+        run: npm run build:api
 
       - name: Run all cache integration tests (Single Redis Node)
         working-directory: packages/api
diff --git a/.github/workflows/config-review.yml b/.github/workflows/config-review.yml
new file mode 100644
index 00000000000..fc25989aa87
--- /dev/null
+++ b/.github/workflows/config-review.yml
@@ -0,0 +1,88 @@
+name: Config Migration Tests
+on:
+  pull_request:
+    paths:
+      - 'config/**'
+      - 'api/models/**'
+      - 'api/db/**'
+      - 'packages/data-schemas/src/**'
+      - 'packages/data-provider/src/**'
+      - 'packages/api/src/acl/**'
+      - 'packages/api/src/shared-links/**'
+
+env:
+  NODE_ENV: CI
+  NODE_OPTIONS: '--max-old-space-size=${{ secrets.NODE_MAX_OLD_SPACE_SIZE || 6144 }}'
+
+jobs:
+  test-config:
+    name: 'Tests: config migrations'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Use Node.js 24.16.0
+        uses: actions/setup-node@v4
+        with:
+          node-version: '24.16.0'
+
+      - name: Restore node_modules cache
+        id: cache-node-modules
+        uses: actions/cache@v4
+        with:
+          path: |
+            node_modules
+            api/node_modules
+            packages/api/node_modules
+            packages/data-provider/node_modules
+            packages/data-schemas/node_modules
+          key: node-modules-backend-${{ runner.os }}-20.19-${{ hashFiles('package-lock.json') }}
+
+      - name: Install dependencies
+        if: steps.cache-node-modules.outputs.cache-hit != 'true'
+        run: npm ci
+
+      - name: Restore data-provider build cache
+        id: cache-data-provider
+        uses: actions/cache@v4
+        with:
+          path: packages/data-provider/dist
+          key: build-data-provider-${{ runner.os }}-${{ hashFiles('packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/tsdown.config.mjs', 'packages/data-provider/package.json') }}
+
+      - name: Build data-provider
+        if: steps.cache-data-provider.outputs.cache-hit != 'true'
+        run: npm run build:data-provider
+
+      - name: Restore data-schemas build cache
+        id: cache-data-schemas
+        uses: actions/cache@v4
+        with:
+          path: packages/data-schemas/dist
+          key: build-data-schemas-${{ runner.os }}-${{ hashFiles('packages/data-schemas/src/**', 'packages/data-schemas/tsconfig*.json', 'packages/data-schemas/tsdown.config.mjs', 'packages/data-schemas/package.json', 'packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/tsdown.config.mjs', 'packages/data-provider/package.json') }}
+
+      - name: Build data-schemas
+        if: steps.cache-data-schemas.outputs.cache-hit != 'true'
+        run: npm run build:data-schemas
+
+      - name: Restore api build cache
+        id: cache-api
+        uses: actions/cache@v4
+        with:
+          path: packages/api/dist
+          key: build-api-${{ runner.os }}-${{ hashFiles('packages/api/src/**', 'packages/api/tsconfig*.json', 'packages/api/tsdown.config.mjs', 'packages/api/package.json', 'packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/tsdown.config.mjs', 'packages/data-provider/package.json', 'packages/data-schemas/src/**', 'packages/data-schemas/tsconfig*.json', 'packages/data-schemas/tsdown.config.mjs', 'packages/data-schemas/package.json') }}
+
+      - name: Build api
+        if: steps.cache-api.outputs.cache-hit != 'true'
+        run: npm run build:api
+
+      - name: Create empty auth.json file
+        run: |
+          mkdir -p api/data
+          echo '{}' > api/data/auth.json
+
+      - name: Prepare .env.test file
+        run: cp api/test/.env.test.example api/test/.env.test
+
+      - name: Run config migration tests
+        run: npm run test:config
diff --git a/.github/workflows/docker-smoke.yml b/.github/workflows/docker-smoke.yml
index d3f313b5716..3780959d8bf 100644
--- a/.github/workflows/docker-smoke.yml
+++ b/.github/workflows/docker-smoke.yml
@@ -9,12 +9,22 @@ on:
       - 'Dockerfile.multi'
       - 'package.json'
       - 'package-lock.json'
+      - 'api/**'
+      - 'client/**'
+      - 'config/**'
+      - 'skill/**'
+      - 'packages/api/**'
       - 'packages/client/**'
       - 'packages/data-provider/**'
+      - 'packages/data-schemas/**'
 
 permissions:
   contents: read
 
+concurrency:
+  group: docker-smoke-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   client-package-target:
     name: Build Docker client package target
@@ -34,3 +44,85 @@ jobs:
           platforms: linux/amd64
           push: false
           target: client-package-build
+
+  api-runtime-smoke:
+    name: API runtime smoke (production image boots)
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      # Build the real production image (final `api-build` stage), which installs
+      # with `npm ci --omit=dev` — the same prune that, in prod, exposed runtime
+      # dependencies the tsdown bundle externalizes but were never declared.
+      - name: Build production image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: Dockerfile.multi
+          platforms: linux/amd64
+          push: false
+          load: true
+          tags: librechat-api-smoke:ci
+          cache-from: type=gha,scope=docker-smoke-api
+          cache-to: type=gha,mode=max,scope=docker-smoke-api
+
+      # Loads the entire externalized require graph of the built @librechat/api
+      # bundle inside the pruned production image. A missing or ESM-incompatible
+      # runtime dependency (e.g. the `get-stream` regression) fails here with a
+      # non-zero exit — deterministically, with no database required.
+      - name: Verify production image resolves all runtime modules
+        run: |
+          docker run --rm librechat-api-smoke:ci \
+            node -e "require('@librechat/api'); require('@librechat/api/telemetry'); console.log('module resolution OK')"
+
+      # Boot the real entrypoint against a real MongoDB so the *entire* server
+      # require graph loads (api/db throws at module scope without MONGO_URI, and
+      # is imported before models/services/routes), then gate on /readyz AND the
+      # container staying alive. /readyz only returns 200 after the post-listen
+      # startup (initializeMCPs + checkMigrations) sets serverReady, and those
+      # steps process.exit(1) on failure — so ANY startup crash (missing module,
+      # ReferenceError, bad config, post-listen failure) fails the smoke.
+      - name: Boot production image against MongoDB and poll /readyz
+        run: |
+          set -u
+          docker network create lc-smoke
+          docker run -d --name lc-mongo --network lc-smoke mongo:8.0.20
+          docker run -d --name lc-api --network lc-smoke -p 3080:3080 \
+            -e HOST=0.0.0.0 -e PORT=3080 \
+            -e NODE_ENV=production \
+            -e MONGO_URI=mongodb://lc-mongo:27017/LibreChat \
+            -e CREDS_KEY=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef \
+            -e CREDS_IV=0123456789abcdef0123456789abcdef \
+            -e JWT_SECRET=docker-smoke-jwt-secret \
+            -e JWT_REFRESH_SECRET=docker-smoke-jwt-refresh-secret \
+            -e SEARCH=false \
+            librechat-api-smoke:ci
+
+          healthy=""
+          for i in $(seq 1 60); do
+            if [ "$(docker inspect -f '{{.State.Running}}' lc-api 2>/dev/null)" != "true" ]; then
+              echo "::error::API container exited during startup (exit code $(docker inspect -f '{{.State.ExitCode}}' lc-api 2>/dev/null))"
+              break
+            fi
+            if [ "$(curl -sS -o /dev/null -w '%{http_code}' http://localhost:3080/readyz 2>/dev/null || true)" = "200" ]; then
+              healthy="yes"
+              echo "/readyz returned 200 — server fully booted (post-listen startup complete)."
+              break
+            fi
+            sleep 2
+          done
+
+          echo "----- last 100 lines of api container logs -----"
+          docker logs lc-api 2>&1 | tail -100 || true
+          echo "------------------------------------------------"
+          docker rm -f lc-api lc-mongo >/dev/null 2>&1 || true
+          docker network rm lc-smoke >/dev/null 2>&1 || true
+
+          if [ -z "$healthy" ]; then
+            echo "::error::Production image failed to reach a ready /readyz within timeout"
+            exit 1
+          fi
diff --git a/.github/workflows/eslint-ci.yml b/.github/workflows/eslint-ci.yml
index 3710f8a02ee..3ab8528b042 100644
--- a/.github/workflows/eslint-ci.yml
+++ b/.github/workflows/eslint-ci.yml
@@ -94,3 +94,35 @@ jobs:
             echo "::error::Or rely on the lint-staged pre-commit hook (do not bypass with --no-verify)."
             exit 1
           fi
+
+      # Verify import ordering on the same set of changed files. The script
+      # only sorts files under known source roots, so unrelated changed files
+      # (configs, etc.) are ignored. Matches the lint-staged pre-commit hook.
+      - name: Check import sorting on changed files
+        run: |
+          BASE_SHA=$(jq --raw-output .pull_request.base.sha "$GITHUB_EVENT_PATH")
+          mapfile -d '' -t CHANGED_FILES < <(
+            git diff -z --name-only --diff-filter=ACMRTUXB "$BASE_SHA" HEAD |
+              grep -zE '^(api|client|packages)/.*\.(js|jsx|ts|tsx)$' || true
+          )
+
+          if [[ ${#CHANGED_FILES[@]} -eq 0 ]]; then
+            echo "No matching files changed. Skipping import-sort check."
+            exit 0
+          fi
+
+          echo "Files to check:"
+          printf '%s\n' "${CHANGED_FILES[@]}"
+
+          # `--check` lists offending files and exits non-zero without writing.
+          if ! node scripts/sort-imports.mts --check "${CHANGED_FILES[@]}"; then
+            echo ""
+            echo "::error::Import order drift detected. Fix locally with:"
+            echo "::error::  npm run sort-imports"
+            echo "::error::For specific files:"
+            echo "::error::  npm run sort-imports -- packages/api/src/app/metrics.ts packages/api/src/rum/proxy.ts"
+            echo "::error::To check without writing files:"
+            echo "::error::  npm run sort-imports:check"
+            echo "::error::Or rely on the lint-staged pre-commit hook (do not bypass with --no-verify)."
+            exit 1
+          fi
diff --git a/.github/workflows/frontend-review.yml b/.github/workflows/frontend-review.yml
index b84d145bee2..a3f31efba63 100644
--- a/.github/workflows/frontend-review.yml
+++ b/.github/workflows/frontend-review.yml
@@ -4,7 +4,9 @@ on:
   pull_request:
     paths:
       - 'client/**'
+      - 'packages/client/**'
       - 'packages/data-provider/**'
+      - '.github/workflows/frontend-review.yml'
 
 permissions:
   contents: read
@@ -45,7 +47,7 @@ jobs:
         uses: actions/cache@v4
         with:
           path: packages/data-provider/dist
-          key: build-data-provider-${{ runner.os }}-${{ hashFiles('packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/rollup.config.js', 'packages/data-provider/package.json') }}
+          key: build-data-provider-${{ runner.os }}-${{ hashFiles('packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/tsdown.config.mjs', 'packages/data-provider/package.json') }}
 
       - name: Build data-provider
         if: steps.cache-data-provider.outputs.cache-hit != 'true'
@@ -56,7 +58,7 @@ jobs:
         uses: actions/cache@v4
         with:
           path: packages/client/dist
-          key: build-client-package-${{ runner.os }}-${{ hashFiles('packages/client/src/**', 'packages/client/tsconfig*.json', 'packages/client/rollup.config.js', 'packages/client/package.json', 'packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/rollup.config.js', 'packages/data-provider/package.json') }}
+          key: build-client-package-${{ runner.os }}-${{ hashFiles('packages/client/src/**', 'packages/client/tsconfig*.json', 'packages/client/tsdown.config.mjs', 'packages/client/package.json', 'packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/tsdown.config.mjs', 'packages/data-provider/package.json') }}
 
       - name: Build client-package
         if: steps.cache-client-package.outputs.cache-hit != 'true'
@@ -76,11 +78,59 @@ jobs:
           path: packages/client/dist
           retention-days: 2
 
+  typecheck:
+    name: TypeScript type checks (client)
+    needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Use Node.js 24.16.0
+        uses: actions/setup-node@v4
+        with:
+          node-version: '24.16.0'
+
+      - name: Restore node_modules cache
+        id: cache-node-modules
+        uses: actions/cache@v4
+        with:
+          path: |
+            node_modules
+            client/node_modules
+            packages/client/node_modules
+            packages/data-provider/node_modules
+          key: node-modules-frontend-${{ runner.os }}-24.16.0-${{ hashFiles('package-lock.json') }}
+
+      - name: Install dependencies
+        if: steps.cache-node-modules.outputs.cache-hit != 'true'
+        run: npm ci
+
+      - name: Download data-provider build
+        uses: actions/download-artifact@v4
+        with:
+          name: build-data-provider
+          path: packages/data-provider/dist
+
+      - name: Download client-package build
+        uses: actions/download-artifact@v4
+        with:
+          name: build-client-package
+          path: packages/client/dist
+
+      - name: Type check client
+        run: npm run typecheck
+        working-directory: client
+
   test-ubuntu:
-    name: 'Tests: Ubuntu'
+    name: 'Tests: Ubuntu (shard ${{ matrix.shard }}/4)'
     needs: build
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2, 3, 4]
     steps:
       - uses: actions/checkout@v4
 
@@ -116,15 +166,19 @@ jobs:
           name: build-client-package
           path: packages/client/dist
 
-      - name: Run unit tests
-        run: npm run test:ci --verbose
+      - name: Run unit tests (shard ${{ matrix.shard }}/4)
+        run: npm run test:ci -- --shard=${{ matrix.shard }}/4
         working-directory: client
 
   test-windows:
-    name: 'Tests: Windows'
+    name: 'Tests: Windows (shard ${{ matrix.shard }}/4)'
     needs: build
     runs-on: windows-latest
     timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2, 3, 4]
     steps:
       - uses: actions/checkout@v4
 
@@ -160,8 +214,8 @@ jobs:
           name: build-client-package
           path: packages/client/dist
 
-      - name: Run unit tests
-        run: npm run test:ci --verbose
+      - name: Run unit tests (shard ${{ matrix.shard }}/4)
+        run: npm run test:ci -- --shard=${{ matrix.shard }}/4
         working-directory: client
 
   build-verify:
diff --git a/.github/workflows/gitnexus-deploy.yml b/.github/workflows/gitnexus-deploy.yml
index 203138c706a..dc62068a6ca 100644
--- a/.github/workflows/gitnexus-deploy.yml
+++ b/.github/workflows/gitnexus-deploy.yml
@@ -2,14 +2,10 @@
 #
 # Architecture:
 #   GitHub Actions (deploy)
-#     1. Resolves latest successful index runs for main, dev, and every
-#        open PR that already has an index artifact (contributor-gated
-#        upstream by the index workflow's author_association check)
+#     1. Resolves latest successful index runs for main and dev
 #     2. Downloads each matching .gitnexus/ artifact
 #     3. Rsyncs them into /opt/gitnexus/indexes/<name>/ on the droplet
-#     4. Removes any stale folders on the droplet for PRs that closed
-#        (even though gitnexus-cleanup-pr.yml also handles that path,
-#        this is a safety net in case the close event was missed)
+#     4. Removes any stale folders on the droplet that are not main/dev
 #     5. Pulls latest image, force-recreates gitnexus, reloads Caddy,
 #        and polls docker health until the container reports healthy
 #   The caddy container is untouched — no TLS churn.
@@ -58,14 +54,14 @@ on:
   workflow_dispatch:
     inputs:
       pr_number:
-        description: 'Optional PR number to post completion comment on (set by bot-triggered dispatches from gitnexus-index.yml)'
+        description: 'Optional PR number for status comments from bot-triggered dispatches'
         type: string
         default: ''
 
 permissions:
   actions: read
   contents: read
-  pull-requests: write # post completion comments on served PR indexes
+  pull-requests: write # post status comments on PR command dispatches
 
 # Global serialization. Earlier versions used per-ref concurrency with
 # cancel-in-progress so rapid pushes to the same ref coalesced but deploys
@@ -84,7 +80,7 @@ concurrency:
   cancel-in-progress: false
 
 env:
-  GITNEXUS_VERSION: '1.5.3'
+  GITNEXUS_VERSION: '1.6.7'
   IMAGE_NAME: ghcr.io/${{ github.repository_owner }}/librechat-gitnexus
 
 jobs:
@@ -93,7 +89,12 @@ jobs:
   build-image:
     if: |
       github.event_name == 'workflow_dispatch' ||
-      github.event.workflow_run.conclusion == 'success'
+      (
+        github.event.workflow_run.conclusion == 'success' &&
+        github.event.workflow_run.event == 'push' &&
+        (github.event.workflow_run.head_branch == 'main' ||
+         github.event.workflow_run.head_branch == 'dev')
+      )
     runs-on: ubuntu-latest
     timeout-minutes: 20
     permissions:
@@ -158,7 +159,7 @@ jobs:
     permissions:
       actions: read
       contents: read
-      pull-requests: write # post deploy-complete comments on served PR indexes
+      pull-requests: write # post deploy-complete comments on PR command dispatches
     steps:
       - name: Checkout deploy config
         uses: actions/checkout@v4
@@ -217,62 +218,7 @@ jobs:
               core.info(`${branch}: run ${fresh.workflow_run.id} -> ${name}`);
             }
 
-            // --- open PRs with at least one successful index run ---
-            // github.paginate handles the 100-per-page ceiling automatically
-            // so the resolution works on repos with 200+ concurrent open PRs.
-            const openPrs = await github.paginate(github.rest.pulls.list, {
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              state: 'open',
-              per_page: 100,
-            });
-            core.info(`Found ${openPrs.length} open PRs`);
-
-            // Parallelize artifact lookups in fixed-size batches so the
-            // resolve step runs in seconds instead of minutes on big repos,
-            // without burning the GitHub API rate limit all at once.
-            const BATCH_SIZE = 10;
-            const prMatches = [];
-            for (let i = 0; i < openPrs.length; i += BATCH_SIZE) {
-              const batch = openPrs.slice(i, i + BATCH_SIZE);
-              const results = await Promise.all(
-                batch.map(async (pr) => {
-                  const artifactName = `gitnexus-index-pr-${pr.number}`;
-                  const fresh = await latestArtifact(artifactName);
-                  return fresh ? { pr, artifactName, fresh } : null;
-                }),
-              );
-              for (const hit of results) {
-                if (hit) prMatches.push(hit);
-              }
-            }
-
-            // Cap to the N most recent PR indexes by artifact creation time.
-            // On a 10GB droplet each index is ~130MB; 3 PRs + main + dev ≈
-            // 650MB of index data, leaving headroom for the ~700MB Docker image
-            // and OS. Older PR indexes are evicted by the prune step.
-            const MAX_PR_INDEXES = 3;
-            prMatches.sort(
-              (a, b) => new Date(b.fresh.created_at) - new Date(a.fresh.created_at),
-            );
-            const keptPrs = prMatches.slice(0, MAX_PR_INDEXES);
-            const evictedPrs = prMatches.slice(MAX_PR_INDEXES);
-
-            for (const { pr, artifactName, fresh } of keptPrs) {
-              serve.push({
-                name: `LibreChat-pr-${pr.number}`,
-                artifactName,
-                runId: fresh.workflow_run.id,
-              });
-              core.info(`PR #${pr.number}: run ${fresh.workflow_run.id} -> LibreChat-pr-${pr.number}`);
-            }
-            if (evictedPrs.length) {
-              core.info(
-                `Evicted ${evictedPrs.length} older PR indexes (cap=${MAX_PR_INDEXES}): ` +
-                  evictedPrs.map((e) => `#${e.pr.number}`).join(', '),
-              );
-            }
-            core.info(`Serving ${keptPrs.length} PR indexes out of ${prMatches.length} with artifacts (${openPrs.length} open PRs total)`);
+            core.info('PR index deploys are paused; serving main and dev only.');
 
             if (!serve.length) {
               core.setFailed('No indexes to serve');
@@ -387,7 +333,7 @@ jobs:
           # ── Step 1: prune FIRST ────────────────────────────────
           # Remove any folders on the droplet that aren't in the active set.
           # This frees disk BEFORE rsyncing new data, which matters on a
-          # 10GB disk where each index is ~130MB.
+          # 10GB disk where each current index is ~400MB.
           echo "Pruning stale indexes (keeping: $ACTIVE_NAMES)"
           ssh -i ~/.ssh/deploy_key "$SSH_USER@$SSH_HOST" \
             ACTIVE_NAMES="$ACTIVE_NAMES" bash <<'REMOTE'
@@ -415,8 +361,8 @@ jobs:
           # it into place. If rsync fails, the old index survives intact
           # and the partial temp dir is cleaned up — no production data
           # is lost. The brief period where both old + new exist costs
-          # ~130MB of extra disk, but the prune step already freed
-          # space from evicted PR indexes so this fits on a 10GB disk.
+          # ~400MB of extra disk, but the prune step already freed
+          # space from evicted indexes so this fits on a 10GB disk.
           for dir in staging/*/; do
             [ -d "$dir" ] || continue
             name=$(basename "$dir")
@@ -460,10 +406,11 @@ jobs:
 
             # ── Disk cleanup ──────────────────────────────────────
             # Docker accumulates old image layers, dangling images, and
-            # build cache across deploys. On a 60GB droplet with a 700MB+
-            # gitnexus image, this fills the disk after ~40 deploys.
-            # Prune everything not used by currently-running containers
-            # BEFORE pulling the new image so the extract has room.
+            # build cache across deploys. This droplet is only ~8.7GB
+            # usable with a 700MB+ gitnexus image, so disk pressure is
+            # constant. Prune everything not used by currently-running
+            # containers BEFORE pulling the new image so the extract has
+            # room; the post-recreate prune below reclaims the old image.
             echo "Disk before cleanup:"
             df -h / | tail -1
             # Omit --volumes: Caddy's caddy-data and caddy-config volumes
@@ -475,9 +422,13 @@ jobs:
             echo "Disk after cleanup:"
             df -h / | tail -1
 
-            # Fail fast if disk is critically low even after prune
+            # Fail fast if disk is critically low even after prune. The
+            # gitnexus image is ~700MB and shares most layers with the
+            # running one, so an incremental pull needs well under 1GB.
+            # 1536MB leaves headroom on this small droplet without the
+            # over-conservative 2GB guard aborting on a healthy box.
             AVAIL_MB=$(df --output=avail -m / | tail -1 | tr -d ' ')
-            if [ "$AVAIL_MB" -lt 2048 ]; then
+            if [ "$AVAIL_MB" -lt 1536 ]; then
               echo "::error::Disk critically low (${AVAIL_MB}MB free). Aborting deploy."
               exit 1
             fi
@@ -485,6 +436,13 @@ jobs:
             docker compose pull gitnexus
             docker compose up -d --force-recreate gitnexus
 
+            # The previous gitnexus image is now dangling (the running
+            # container was recreated onto the freshly pulled image). The
+            # pre-pull prune above couldn't touch it because it was still
+            # in use at that point. Reclaim it now so the old generation
+            # doesn't accumulate — critical on this 10GB droplet.
+            docker image prune -f 2>/dev/null || true
+
             # Reload Caddy in-place so a changed Caddyfile takes effect
             # without losing TLS certs or restarting connections. If caddy
             # isn't running yet (first-time bootstrap), bring it up.
@@ -555,15 +513,41 @@ jobs:
           DEPLOY_STATUS: ${{ job.status }}
         with:
           script: |
+            const deployUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
+            const matrix = JSON.parse(process.env.MATRIX || '[]');
             let prNum = null;
 
             // Case 1: dispatched directly with pr_number (bot-fallback path)
             if (process.env.DISPATCH_PR_NUMBER && process.env.DISPATCH_PR_NUMBER !== '') {
-              prNum = parseInt(process.env.DISPATCH_PR_NUMBER, 10);
+              const dispatchPrRaw = process.env.DISPATCH_PR_NUMBER;
+              if (!/^\d+$/.test(dispatchPrRaw)) {
+                core.setFailed(`Invalid PR number: ${dispatchPrRaw}`);
+                return;
+              }
+
+              const dispatchPrNum = Number(dispatchPrRaw);
+              const servedPr = matrix.some((m) => m.name === `LibreChat-pr-${dispatchPrNum}`);
+
+              if (!servedPr) {
+                const body = [
+                  '### GitNexus: PR deploy skipped',
+                  '',
+                  'PR-specific deploys are paused; only `LibreChat` and `LibreChat-dev` are currently served.',
+                  `[Deploy run](${deployUrl})`,
+                ].join('\n');
+                await github.rest.issues.createComment({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: dispatchPrNum,
+                  body,
+                });
+                return;
+              }
+
+              prNum = dispatchPrNum;
             }
             // Case 2: workflow_run trigger from a PR index run
             else if (context.eventName === 'workflow_run') {
-              const matrix = JSON.parse(process.env.MATRIX || '[]');
               const triggerRunId = Number(process.env.TRIGGER_RUN_ID);
               const match = matrix.find(
                 (m) => m.runId === triggerRunId && m.name.startsWith('LibreChat-pr-'),
@@ -578,7 +562,6 @@ jobs:
               return;
             }
 
-            const deployUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
             const ok = process.env.DEPLOY_STATUS === 'success';
             const body = [
               `### GitNexus: ${ok ? '🚀 deployed' : '❌ deploy failed'}`,
diff --git a/.github/workflows/gitnexus-index.yml b/.github/workflows/gitnexus-index.yml
index 21c3f693213..ef368261bd9 100644
--- a/.github/workflows/gitnexus-index.yml
+++ b/.github/workflows/gitnexus-index.yml
@@ -43,7 +43,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  GITNEXUS_VERSION: '1.5.3'
+  GITNEXUS_VERSION: '1.6.7'
 
 jobs:
   index:
@@ -63,7 +63,12 @@ jobs:
       github.event_name != 'pull_request' ||
       github.event.pull_request.user.login == 'danny-avila'
     runs-on: ubuntu-latest
-    timeout-minutes: 25
+    # Embedding generation dominates the budget: ~45 min worst case on
+    # standard runners since the 1.6.x graph (~23k nodes) doubled vs 1.5.x.
+    timeout-minutes: 60
+    # Best-effort index: a tool-internal crash must not block PRs. Fail soft on
+    # PR events; push/dispatch runs still fail loudly so regressions stay visible.
+    continue-on-error: ${{ github.event_name == 'pull_request' }}
     steps:
       - name: Validate dispatch inputs
         if: github.event_name == 'workflow_dispatch'
@@ -162,7 +167,7 @@ jobs:
             --no-save \
             --no-package-lock \
             "gitnexus@${{ env.GITNEXUS_VERSION }}" \
-            "@ladybugdb/core@0.15.2"
+            "@ladybugdb/core@0.17.1"
           test -x "$RUNNER_TEMP/gitnexus-cli/node_modules/.bin/gitnexus"
 
       - name: Checkout repository
@@ -177,12 +182,29 @@ jobs:
           fetch-depth: 1
           persist-credentials: false
 
+      # HuggingFace throttles anonymous model downloads from shared GHA
+      # runner IPs (429s or stalled transfers). Cache the embedding model
+      # across runs so warm runs never touch HF at all.
+      - name: Cache HuggingFace embedding model
+        if: steps.flags.outputs.enable_embeddings == 'true'
+        uses: actions/cache@v4
+        with:
+          path: ${{ runner.temp }}/hf-cache
+          key: hf-model-snowflake-arctic-embed-xs-v1
+
       - name: Run GitNexus Analyze
         working-directory: ${{ runner.temp }}
         env:
           ENABLE_EMBEDDINGS: ${{ steps.flags.outputs.enable_embeddings }}
           FORCE: ${{ inputs.force }}
           GITNEXUS_BIN: ${{ runner.temp }}/gitnexus-cli/node_modules/.bin/gitnexus
+          # Fail soft in ~2 min on stalled downloads instead of eating the
+          # 25-min job budget; HF_TOKEN lifts the anonymous rate limit on
+          # cold-cache runs (empty when the secret is unset — safe no-op).
+          HF_DOWNLOAD_TIMEOUT_MS: '60000'
+          HF_HOME: ${{ runner.temp }}/hf-cache
+          HF_MAX_ATTEMPTS: '2'
+          HF_TOKEN: ${{ secrets.HF_TOKEN }}
           NPM_CONFIG_AUDIT: false
           NPM_CONFIG_CACHE: ${{ runner.temp }}/gitnexus-npm-cache
           NPM_CONFIG_FUND: false
@@ -245,35 +267,27 @@ jobs:
       pull-requests: write # post completion comments for /gitnexus command runs
     steps:
       # GitHub suppresses workflow_run events for workflow runs triggered
-      # by GITHUB_TOKEN (to prevent recursive chaining). Command-triggered
-      # index runs opt into a deploy by setting deploy_after=true.
-      - name: Trigger deploy workflow after command-triggered runs
-        if: inputs.deploy_after && needs.index.result == 'success'
+      # by GITHUB_TOKEN (to prevent recursive chaining). Dispatches without
+      # a PR number can still opt into a deploy by setting deploy_after=true.
+      - name: Trigger deploy workflow after non-PR dispatches
+        if: inputs.deploy_after && inputs.pr_number == '' && needs.index.result == 'success'
         uses: actions/github-script@v7
-        env:
-          PR_NUMBER: ${{ inputs.pr_number }}
         with:
           script: |
             core.info('deploy_after=true; dispatching gitnexus-deploy.yml manually.');
-            // Pass pr_number through so the deploy workflow knows which
-            // PR to post its completion comment on (for /gitnexus
-            // command runs this will be set; for other bot dispatches
-            // it's empty and the deploy step falls back to matrix match).
             await github.rest.actions.createWorkflowDispatch({
               owner: context.repo.owner,
               repo: context.repo.repo,
               workflow_id: 'gitnexus-deploy.yml',
               ref: 'main',
               inputs: {
-                pr_number: process.env.PR_NUMBER || '',
+                pr_number: '',
               },
             });
 
       # Reply on the PR when the /gitnexus command path runs so the
       # requester knows the index step finished. This fires when
-      # inputs.pr_number is set and reports the index job result. A
-      # separate comment posts from the deploy workflow when the live
-      # server has the fresh index.
+      # inputs.pr_number is set and reports the index job result.
       - name: Comment on PR — index complete
         if: inputs.pr_number != ''
         uses: actions/github-script@v7
@@ -299,7 +313,7 @@ jobs:
               `[Index run](${runUrl})`,
               '',
               indexSucceeded
-                ? '⏳ Waiting for deploy to serve the fresh index…'
+                ? 'PR-specific deploys are paused; only `LibreChat` and `LibreChat-dev` are currently served.'
                 : '_Index run failed — the previous index (if any) continues to be served._',
             ].join('\n');
             await github.rest.issues.createComment({
diff --git a/.github/workflows/playwright-mock.yml b/.github/workflows/playwright-mock.yml
index 91a2f9910bf..fc94dc02d64 100644
--- a/.github/workflows/playwright-mock.yml
+++ b/.github/workflows/playwright-mock.yml
@@ -1,4 +1,4 @@
-name: Playwright E2E (Mock LLM)
+name: Playwright E2E Tests
 
 on:
   pull_request:
@@ -22,7 +22,6 @@ env:
 
 jobs:
   e2e:
-    name: Tier-1 smoke (headless Chrome)
     runs-on: ubuntu-latest
     timeout-minutes: 30
     env:
@@ -58,7 +57,7 @@ jobs:
         uses: actions/cache@v4
         with:
           path: packages/data-provider/dist
-          key: build-data-provider-${{ runner.os }}-${{ hashFiles('package-lock.json', 'packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/rollup.config.js', 'packages/data-provider/package.json') }}
+          key: build-data-provider-${{ runner.os }}-${{ hashFiles('package-lock.json', 'packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/tsdown.config.mjs', 'packages/data-provider/package.json') }}
 
       - name: Build data-provider
         if: steps.cache-data-provider.outputs.cache-hit != 'true'
@@ -69,7 +68,7 @@ jobs:
         uses: actions/cache@v4
         with:
           path: packages/data-schemas/dist
-          key: build-data-schemas-${{ runner.os }}-${{ hashFiles('package-lock.json', 'packages/data-schemas/src/**', 'packages/data-schemas/tsconfig*.json', 'packages/data-schemas/rollup.config.js', 'packages/data-schemas/package.json', 'packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/rollup.config.js', 'packages/data-provider/package.json') }}
+          key: build-data-schemas-${{ runner.os }}-${{ hashFiles('package-lock.json', 'packages/data-schemas/src/**', 'packages/data-schemas/tsconfig*.json', 'packages/data-schemas/tsdown.config.mjs', 'packages/data-schemas/package.json', 'packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/tsdown.config.mjs', 'packages/data-provider/package.json') }}
 
       - name: Build data-schemas
         if: steps.cache-data-schemas.outputs.cache-hit != 'true'
@@ -80,7 +79,7 @@ jobs:
         uses: actions/cache@v4
         with:
           path: packages/api/dist
-          key: build-api-${{ runner.os }}-${{ hashFiles('package-lock.json', 'packages/api/src/**', 'packages/api/tsconfig*.json', 'packages/api/server-rollup.config.js', 'packages/api/package.json', 'packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/rollup.config.js', 'packages/data-provider/package.json', 'packages/data-schemas/src/**', 'packages/data-schemas/tsconfig*.json', 'packages/data-schemas/rollup.config.js', 'packages/data-schemas/package.json') }}
+          key: build-api-${{ runner.os }}-${{ hashFiles('package-lock.json', 'packages/api/src/**', 'packages/api/tsconfig*.json', 'packages/api/tsdown.config.mjs', 'packages/api/package.json', 'packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/tsdown.config.mjs', 'packages/data-provider/package.json', 'packages/data-schemas/src/**', 'packages/data-schemas/tsconfig*.json', 'packages/data-schemas/tsdown.config.mjs', 'packages/data-schemas/package.json') }}
 
       - name: Build api
         if: steps.cache-api.outputs.cache-hit != 'true'
@@ -91,7 +90,7 @@ jobs:
         uses: actions/cache@v4
         with:
           path: packages/client/dist
-          key: build-client-package-${{ runner.os }}-${{ hashFiles('package-lock.json', 'packages/client/src/**', 'packages/client/tsconfig*.json', 'packages/client/rollup.config.js', 'packages/client/package.json', 'packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/rollup.config.js', 'packages/data-provider/package.json') }}
+          key: build-client-package-${{ runner.os }}-${{ hashFiles('package-lock.json', 'packages/client/src/**', 'packages/client/tsconfig*.json', 'packages/client/tsdown.config.mjs', 'packages/client/package.json', 'packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/tsdown.config.mjs', 'packages/data-provider/package.json') }}
 
       - name: Build client-package
         if: steps.cache-client-package.outputs.cache-hit != 'true'
@@ -102,7 +101,7 @@ jobs:
         uses: actions/cache@v4
         with:
           path: client/dist
-          key: build-client-app-e2e-${{ runner.os }}-${{ hashFiles('package-lock.json', 'client/src/**', 'client/public/**', 'client/scripts/post-build.cjs', 'client/index.html', 'client/package.json', 'client/vite.config.*', 'client/tsconfig*.json', 'client/tailwind.config.*', 'client/postcss.config.*', 'packages/client/src/**', 'packages/client/tsconfig*.json', 'packages/client/rollup.config.js', 'packages/client/package.json', 'packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/rollup.config.js', 'packages/data-provider/package.json') }}
+          key: build-client-app-e2e-${{ runner.os }}-${{ hashFiles('package-lock.json', 'client/src/**', 'client/public/**', 'client/scripts/post-build.cjs', 'client/index.html', 'client/package.json', 'client/vite.config.*', 'client/tsconfig*.json', 'client/tailwind.config.*', 'client/postcss.config.*', 'packages/client/src/**', 'packages/client/tsconfig*.json', 'packages/client/tsdown.config.mjs', 'packages/client/package.json', 'packages/data-provider/src/**', 'packages/data-provider/tsconfig*.json', 'packages/data-provider/tsdown.config.mjs', 'packages/data-provider/package.json') }}
 
       - name: Build client app
         if: steps.cache-client-app.outputs.cache-hit != 'true'
diff --git a/.husky/lint-staged.config.js b/.husky/lint-staged.config.js
index 482e1f050e0..8aee5fba819 100644
--- a/.husky/lint-staged.config.js
+++ b/.husky/lint-staged.config.js
@@ -1,4 +1,9 @@
 module.exports = {
-  '*.{js,jsx,ts,tsx}': ['prettier --write', 'eslint --fix', 'eslint'],
+  '*.{js,jsx,ts,tsx}': [
+    'node scripts/sort-imports.mts',
+    'prettier --write',
+    'eslint --fix',
+    'eslint',
+  ],
   '*.json': ['prettier --write'],
 };
diff --git a/Dockerfile b/Dockerfile
index 6253913262a..8fb58216130 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-# v0.8.6
+# v0.8.7-rc1
 
 # Base node image
 FROM node:24.16.0-alpine AS node
@@ -35,7 +35,7 @@ RUN \
     # Allow mounting of these files, which have no default
     touch .env ; \
     # Create directories for the volumes to inherit the correct permissions
-    mkdir -p /app/client/public/images /app/logs /app/uploads ; \
+    mkdir -p /app/client/public/images /app/logs /app/uploads /app/skill ; \
     npm config set fetch-retry-maxtimeout 600000 ; \
     npm config set fetch-retries 5 ; \
     npm config set fetch-retry-mintimeout 15000 ; \
diff --git a/Dockerfile.multi b/Dockerfile.multi
index 745e54b8a4c..ecff4370e53 100644
--- a/Dockerfile.multi
+++ b/Dockerfile.multi
@@ -1,5 +1,5 @@
 # Dockerfile.multi
-# v0.8.6
+# v0.8.7-rc1
 
 # Set configurable max-old-space-size with default
 ARG NODE_MAX_OLD_SPACE_SIZE=6144
@@ -109,6 +109,7 @@ RUN attempt=1; \
     done
 COPY api ./api
 COPY config ./config
+COPY skill ./skill
 COPY --from=data-provider-build /app/packages/data-provider/dist ./packages/data-provider/dist
 COPY --from=data-schemas-build /app/packages/data-schemas/dist ./packages/data-schemas/dist
 COPY --from=api-package-build /app/packages/api/dist ./packages/api/dist
diff --git a/README.zh.md b/README.zh.md
index 7f74057413c..61c6d589fa5 100644
--- a/README.zh.md
+++ b/README.zh.md
@@ -1,4 +1,4 @@
-<!-- Last synced with README.md: 2026-03-28 (cae3888) -->
+<!-- Last synced with README.md: 2026-05-12 (947bfa4c40) -->
 
 <p align="center">
   <a href="https://librechat.ai">
@@ -76,6 +76,8 @@
     - 智能体市场：发现并部署社区构建的智能体。
     - 协作共享：与特定用户和群组共享智能体。
     - 灵活且可扩展：支持 MCP 服务器、工具、文件搜索、代码执行等。
+    - [Skills](https://www.librechat.ai/docs/features/skills)：创建可复用的 `SKILL.md` 指令包，用于手动、自动或始终启用的智能体工作流。
+    - [Subagents](https://www.librechat.ai/docs/features/subagents)：将专门任务委派给拥有独立上下文窗口的隔离子智能体运行。
     - 兼容自定义端点、OpenAI, Azure, Anthropic, AWS Bedrock, Google, Vertex AI, Responses API 等。
     - [支持模型上下文协议 (MCP)](https://modelcontextprotocol.io/clients#librechat) 用于工具调用。
 
@@ -139,6 +141,7 @@
 
 - ⚙️ **配置与部署**：  
   - 支持代理、反向代理、Docker 及多种部署选项。  
+  - 使用 [S3 与 CloudFront](https://www.librechat.ai/docs/configuration/cdn/cloudfront) 获得稳定的媒体链接、边缘分发、签名 Cookie 和安全下载。
   - 可完全本地运行或部署在云端。
 
 - 📖 **开源与社区**：  
diff --git a/api/app/clients/BaseClient.js b/api/app/clients/BaseClient.js
index d36e54f0157..03653333b4a 100644
--- a/api/app/clients/BaseClient.js
+++ b/api/app/clients/BaseClient.js
@@ -700,7 +700,6 @@ class BaseClient {
       user,
     );
     this.savedMessageIds.add(responseMessage.messageId);
-    delete responseMessage.tokenCount;
     return responseMessage;
   }
 
@@ -1217,8 +1216,8 @@ class BaseClient {
     const provider = this.options.agent?.provider ?? this.options.endpoint;
     const isBedrock = provider === EModelEndpoint.bedrock;
 
-    if (!this._mergedFileConfig && this.options.req?.config?.fileConfig) {
-      this._mergedFileConfig = mergeFileConfig(this.options.req.config.fileConfig);
+    if (!this._mergedFileConfig) {
+      this._mergedFileConfig = mergeFileConfig(this.options.req?.config?.fileConfig);
       const endpoint = this.options.agent?.endpoint ?? this.options.endpoint;
       this._endpointFileConfig = getEndpointFileConfig({
         fileConfig: this._mergedFileConfig,
diff --git a/api/app/clients/tools/structured/DALLE3.js b/api/app/clients/tools/structured/DALLE3.js
index c36587b0b56..365039485bf 100644
--- a/api/app/clients/tools/structured/DALLE3.js
+++ b/api/app/clients/tools/structured/DALLE3.js
@@ -1,12 +1,14 @@
 const path = require('path');
 const OpenAI = require('openai');
 const { v4: uuidv4 } = require('uuid');
-const { ProxyAgent, fetch } = require('undici');
+const { fetch } = require('undici');
 const { logger } = require('@librechat/data-schemas');
 const { Tool } = require('@librechat/agents/langchain/tools');
 const {
   getImageBasename,
   extractBaseURL,
+  getProxyDispatcher,
+  getEnvProxyDispatcher,
   enforceImageSizeLimit,
   createMinimalRetentionRequest,
 } = require('@librechat/api');
@@ -83,10 +85,10 @@ class DALLE3 extends Tool {
       config.apiKey = process.env.DALLE3_API_KEY;
     }
 
-    if (process.env.PROXY) {
-      const proxyAgent = new ProxyAgent(process.env.PROXY);
+    const proxyDispatcher = getProxyDispatcher();
+    if (proxyDispatcher) {
       config.fetchOptions = {
-        dispatcher: proxyAgent,
+        dispatcher: proxyDispatcher,
       };
     }
 
@@ -187,9 +189,9 @@ Error Message: ${error.message}`);
 
     if (this.isAgent) {
       let fetchOptions = {};
-      if (process.env.PROXY) {
-        const proxyAgent = new ProxyAgent(process.env.PROXY);
-        fetchOptions.dispatcher = proxyAgent;
+      const dispatcher = getEnvProxyDispatcher();
+      if (dispatcher) {
+        fetchOptions.dispatcher = dispatcher;
       }
       const imageResponse = await fetch(theImageUrl, fetchOptions);
       const arrayBuffer = await imageResponse.arrayBuffer();
diff --git a/api/app/clients/tools/structured/FluxAPI.js b/api/app/clients/tools/structured/FluxAPI.js
index 44cec3277d7..66782c9f44b 100644
--- a/api/app/clients/tools/structured/FluxAPI.js
+++ b/api/app/clients/tools/structured/FluxAPI.js
@@ -2,10 +2,13 @@ const axios = require('axios');
 const fetch = require('node-fetch');
 const { v4: uuidv4 } = require('uuid');
 const { logger } = require('@librechat/data-schemas');
-const { HttpsProxyAgent } = require('https-proxy-agent');
-const { enforceImageSizeLimit } = require('@librechat/api');
 const { Tool } = require('@librechat/agents/langchain/tools');
-const { createMinimalRetentionRequest } = require('@librechat/api');
+const {
+  applyAxiosProxyConfig,
+  createMinimalRetentionRequest,
+  getHttpsProxyAgent,
+  enforceImageSizeLimit,
+} = require('@librechat/api');
 const { FileContext, ContentTypes } = require('librechat-data-provider');
 
 const fluxApiJsonSchema = {
@@ -151,10 +154,7 @@ class FluxAPI extends Tool {
 
   getAxiosConfig() {
     const config = {};
-    if (process.env.PROXY) {
-      config.httpsAgent = new HttpsProxyAgent(process.env.PROXY);
-    }
-    return config;
+    return applyAxiosProxyConfig(config, this.baseUrl);
   }
 
   /** @param {Object|string} value */
@@ -308,8 +308,9 @@ class FluxAPI extends Tool {
       try {
         // Fetch the image and convert to base64
         const fetchOptions = {};
-        if (process.env.PROXY) {
-          fetchOptions.agent = new HttpsProxyAgent(process.env.PROXY);
+        const agent = getHttpsProxyAgent(imageUrl);
+        if (agent) {
+          fetchOptions.agent = agent;
         }
         const imageResponse = await fetch(imageUrl, fetchOptions);
         const arrayBuffer = await imageResponse.arrayBuffer();
@@ -546,8 +547,9 @@ class FluxAPI extends Tool {
     if (this.isAgent) {
       try {
         const fetchOptions = {};
-        if (process.env.PROXY) {
-          fetchOptions.agent = new HttpsProxyAgent(process.env.PROXY);
+        const agent = getHttpsProxyAgent(imageUrl);
+        if (agent) {
+          fetchOptions.agent = agent;
         }
         const imageResponse = await fetch(imageUrl, fetchOptions);
         const arrayBuffer = await imageResponse.arrayBuffer();
diff --git a/api/app/clients/tools/structured/GeminiImageGen.js b/api/app/clients/tools/structured/GeminiImageGen.js
index 1a2b88de0d5..72d5371a1eb 100644
--- a/api/app/clients/tools/structured/GeminiImageGen.js
+++ b/api/app/clients/tools/structured/GeminiImageGen.js
@@ -1,7 +1,6 @@
 const path = require('path');
 const sharp = require('sharp');
 const { v4 } = require('uuid');
-const { ProxyAgent } = require('undici');
 const { GoogleGenAI } = require('@google/genai');
 const { logger } = require('@librechat/data-schemas');
 const { tool } = require('@librechat/agents/langchain/tools');
@@ -10,6 +9,7 @@ const {
   geminiToolkit,
   loadServiceKey,
   getBalanceConfig,
+  getEnvProxyDispatcher,
   enforceImageSizeLimit,
   getTransactionsConfig,
 } = require('@librechat/api');
@@ -21,14 +21,14 @@ const { spendTokens, getFiles } = require('~/models');
  * This wraps globalThis.fetch to add a proxy dispatcher only for googleapis.com URLs
  * This is necessary because @google/genai SDK doesn't support custom fetch or httpOptions.dispatcher
  */
-if (process.env.PROXY) {
+const googleApiProxyDispatcher = getEnvProxyDispatcher();
+if (googleApiProxyDispatcher) {
   const originalFetch = globalThis.fetch;
-  const proxyAgent = new ProxyAgent(process.env.PROXY);
 
   globalThis.fetch = function (url, options = {}) {
     const urlString = url.toString();
     if (urlString.includes('googleapis.com')) {
-      options = { ...options, dispatcher: proxyAgent };
+      options = { ...options, dispatcher: googleApiProxyDispatcher };
     }
     return originalFetch.call(this, url, options);
   };
@@ -120,7 +120,7 @@ async function initializeGeminiClient(options = {}) {
   return new GoogleGenAI({
     vertexai: true,
     project: serviceKey.project_id,
-    location: process.env.GOOGLE_LOC || process.env.GOOGLE_CLOUD_LOCATION || 'global',
+    location: process.env.GOOGLE_CLOUD_LOCATION || process.env.GOOGLE_LOC || 'global',
     googleAuthOptions: { credentials: serviceKey },
   });
 }
diff --git a/api/app/clients/tools/structured/OpenAIImageTools.js b/api/app/clients/tools/structured/OpenAIImageTools.js
index 378de56be41..7109043c820 100644
--- a/api/app/clients/tools/structured/OpenAIImageTools.js
+++ b/api/app/clients/tools/structured/OpenAIImageTools.js
@@ -2,15 +2,15 @@ const axios = require('axios');
 const { v4 } = require('uuid');
 const OpenAI = require('openai');
 const FormData = require('form-data');
-const { ProxyAgent } = require('undici');
 const { logger } = require('@librechat/data-schemas');
-const { HttpsProxyAgent } = require('https-proxy-agent');
 const { tool } = require('@librechat/agents/langchain/tools');
 const { ContentTypes, EImageOutputType } = require('librechat-data-provider');
 const {
   logAxiosError,
   oaiToolkit,
   extractBaseURL,
+  getProxyDispatcher,
+  applyAxiosProxyConfig,
   enforceImageSizeLimit,
   resolveImageGenOaiDefaults,
 } = require('@librechat/api');
@@ -128,10 +128,10 @@ function createOpenAIImageTools(fields = {}) {
         throw new Error('Missing required field: prompt');
       }
       const clientConfig = { ...closureConfig };
-      if (process.env.PROXY) {
-        const proxyAgent = new ProxyAgent(process.env.PROXY);
+      const proxyDispatcher = getProxyDispatcher();
+      if (proxyDispatcher) {
         clientConfig.fetchOptions = {
-          dispatcher: proxyAgent,
+          dispatcher: proxyDispatcher,
         };
       }
 
@@ -246,10 +246,10 @@ Error Message: ${error.message}`);
       }
 
       const clientConfig = { ...closureConfig };
-      if (process.env.PROXY) {
-        const proxyAgent = new ProxyAgent(process.env.PROXY);
+      const proxyDispatcher = getProxyDispatcher();
+      if (proxyDispatcher) {
         clientConfig.fetchOptions = {
-          dispatcher: proxyAgent,
+          dispatcher: proxyDispatcher,
         };
       }
 
@@ -372,9 +372,7 @@ Error Message: ${error.message}`);
           baseURL,
         };
 
-        if (process.env.PROXY) {
-          axiosConfig.httpsAgent = new HttpsProxyAgent(process.env.PROXY);
-        }
+        applyAxiosProxyConfig(axiosConfig, baseURL);
 
         if (process.env.IMAGE_GEN_OAI_AZURE_API_VERSION && process.env.IMAGE_GEN_OAI_BASEURL) {
           axiosConfig.params = {
diff --git a/api/app/clients/tools/structured/TavilySearch.js b/api/app/clients/tools/structured/TavilySearch.js
index e45f6d2bf89..a90b75b9f8e 100644
--- a/api/app/clients/tools/structured/TavilySearch.js
+++ b/api/app/clients/tools/structured/TavilySearch.js
@@ -1,6 +1,7 @@
 const { z } = require('zod');
-const { ProxyAgent, fetch } = require('undici');
+const { fetch } = require('undici');
 const { tool } = require('@librechat/agents/langchain/tools');
+const { getEnvProxyDispatcher } = require('@librechat/api');
 const { getApiKey } = require('./credentials');
 
 function createTavilySearchTool(fields = {}) {
@@ -28,8 +29,9 @@ function createTavilySearchTool(fields = {}) {
         body: JSON.stringify(requestBody),
       };
 
-      if (process.env.PROXY) {
-        fetchOptions.dispatcher = new ProxyAgent(process.env.PROXY);
+      const dispatcher = getEnvProxyDispatcher();
+      if (dispatcher) {
+        fetchOptions.dispatcher = dispatcher;
       }
 
       const response = await fetch('https://api.tavily.com/search', fetchOptions);
diff --git a/api/app/clients/tools/structured/TavilySearchResults.js b/api/app/clients/tools/structured/TavilySearchResults.js
index 4d46402c992..9e9aa3d34c8 100644
--- a/api/app/clients/tools/structured/TavilySearchResults.js
+++ b/api/app/clients/tools/structured/TavilySearchResults.js
@@ -1,6 +1,7 @@
-const { ProxyAgent, fetch } = require('undici');
+const { fetch } = require('undici');
 const { Tool } = require('@librechat/agents/langchain/tools');
 const { getEnvironmentVariable } = require('@librechat/agents/langchain/utils/env');
+const { getEnvProxyDispatcher } = require('@librechat/api');
 
 const tavilySearchJsonSchema = {
   type: 'object',
@@ -120,8 +121,9 @@ class TavilySearchResults extends Tool {
       body: JSON.stringify(requestBody),
     };
 
-    if (process.env.PROXY) {
-      fetchOptions.dispatcher = new ProxyAgent(process.env.PROXY);
+    const dispatcher = getEnvProxyDispatcher();
+    if (dispatcher) {
+      fetchOptions.dispatcher = dispatcher;
     }
 
     const response = await fetch('https://api.tavily.com/search', fetchOptions);
diff --git a/api/app/clients/tools/structured/specs/DALLE3-proxy.spec.js b/api/app/clients/tools/structured/specs/DALLE3-proxy.spec.js
index 262842b3c24..b958ed7b5b8 100644
--- a/api/app/clients/tools/structured/specs/DALLE3-proxy.spec.js
+++ b/api/app/clients/tools/structured/specs/DALLE3-proxy.spec.js
@@ -1,7 +1,20 @@
 const DALLE3 = require('../DALLE3');
-const { ProxyAgent } = require('undici');
 
 const processFileURL = jest.fn();
+const proxyEnvKeys = [
+  'PROXY',
+  'proxy',
+  'HTTP_PROXY',
+  'HTTPS_PROXY',
+  'NO_PROXY',
+  'http_proxy',
+  'https_proxy',
+  'no_proxy',
+];
+
+function clearProxyEnv() {
+  proxyEnvKeys.forEach((key) => delete process.env[key]);
+}
 
 describe('DALLE3 Proxy Configuration', () => {
   let originalEnv;
@@ -13,13 +26,14 @@ describe('DALLE3 Proxy Configuration', () => {
   beforeEach(() => {
     jest.resetModules();
     process.env = { ...originalEnv };
+    clearProxyEnv();
   });
 
   afterEach(() => {
     process.env = originalEnv;
   });
 
-  it('should configure ProxyAgent in fetchOptions.dispatcher when PROXY env is set', () => {
+  it('should configure fetchOptions.dispatcher when proxy env is set', () => {
     // Set proxy environment variable
     process.env.PROXY = 'http://proxy.example.com:8080';
     process.env.DALLE_API_KEY = 'test-api-key';
@@ -34,12 +48,10 @@ describe('DALLE3 Proxy Configuration', () => {
     expect(dalleWithProxy.openai._options).toBeDefined();
     expect(dalleWithProxy.openai._options.fetchOptions).toBeDefined();
     expect(dalleWithProxy.openai._options.fetchOptions.dispatcher).toBeDefined();
-    expect(dalleWithProxy.openai._options.fetchOptions.dispatcher).toBeInstanceOf(ProxyAgent);
+    expect(dalleWithProxy.openai._options.fetchOptions.dispatcher).toBeDefined();
   });
 
-  it('should not configure ProxyAgent when PROXY env is not set', () => {
-    // Ensure PROXY is not set
-    delete process.env.PROXY;
+  it('should not configure a dispatcher when proxy env is not set', () => {
     process.env.DALLE_API_KEY = 'test-api-key';
 
     // Create instance
diff --git a/api/app/clients/tools/structured/specs/GeminiImageGen-proxy.spec.js b/api/app/clients/tools/structured/specs/GeminiImageGen-proxy.spec.js
index 027d2659d68..dbdda6e454c 100644
--- a/api/app/clients/tools/structured/specs/GeminiImageGen-proxy.spec.js
+++ b/api/app/clients/tools/structured/specs/GeminiImageGen-proxy.spec.js
@@ -1,5 +1,3 @@
-const { ProxyAgent } = require('undici');
-
 /**
  * These tests verify the proxy wrapper behavior for GeminiImageGen.
  * Instead of loading the full module (which has many dependencies),
@@ -29,14 +27,14 @@ describe('GeminiImageGen Proxy Configuration', () => {
    * This is the same logic from GeminiImageGen.js lines 30-42.
    */
   function applyProxyWrapper() {
-    if (process.env.PROXY) {
+    const proxyDispatcher = process.env.PROXY ? { type: 'proxy-dispatcher' } : undefined;
+    if (proxyDispatcher) {
       const _originalFetch = globalThis.fetch;
-      const proxyAgent = new ProxyAgent(process.env.PROXY);
 
       globalThis.fetch = function (url, options = {}) {
         const urlString = url.toString();
         if (urlString.includes('googleapis.com')) {
-          options = { ...options, dispatcher: proxyAgent };
+          options = { ...options, dispatcher: proxyDispatcher };
         }
         return _originalFetch.call(this, url, options);
       };
@@ -78,7 +76,7 @@ describe('GeminiImageGen Proxy Configuration', () => {
     await globalThis.fetch('https://generativelanguage.googleapis.com/v1/models', {});
 
     expect(capturedOptions).toBeDefined();
-    expect(capturedOptions.dispatcher).toBeInstanceOf(ProxyAgent);
+    expect(capturedOptions.dispatcher).toEqual({ type: 'proxy-dispatcher' });
   });
 
   it('should not add dispatcher to non-googleapis.com URLs', async () => {
@@ -118,7 +116,7 @@ describe('GeminiImageGen Proxy Configuration', () => {
     });
 
     expect(capturedOptions).toBeDefined();
-    expect(capturedOptions.dispatcher).toBeInstanceOf(ProxyAgent);
+    expect(capturedOptions.dispatcher).toEqual({ type: 'proxy-dispatcher' });
     expect(capturedOptions.headers).toEqual(customHeaders);
     expect(capturedOptions.method).toBe('POST');
   });
diff --git a/api/app/clients/tools/structured/specs/TavilySearchResults.spec.js b/api/app/clients/tools/structured/specs/TavilySearchResults.spec.js
index 891a8cdc192..7184e082041 100644
--- a/api/app/clients/tools/structured/specs/TavilySearchResults.spec.js
+++ b/api/app/clients/tools/structured/specs/TavilySearchResults.spec.js
@@ -1,7 +1,11 @@
-const { fetch, ProxyAgent } = require('undici');
+const { fetch } = require('undici');
 const TavilySearchResults = require('../TavilySearchResults');
+const { getEnvProxyDispatcher } = require('@librechat/api');
 
 jest.mock('undici');
+jest.mock('@librechat/api', () => ({
+  getEnvProxyDispatcher: jest.fn(),
+}));
 
 describe('TavilySearchResults', () => {
   let originalEnv;
@@ -46,32 +50,29 @@ describe('TavilySearchResults', () => {
       fetch.mockResolvedValue(mockResponse);
     });
 
-    it('should use ProxyAgent when PROXY env var is set', async () => {
-      const proxyUrl = 'http://proxy.example.com:8080';
-      process.env.PROXY = proxyUrl;
-
-      const mockProxyAgent = { type: 'proxy-agent' };
-      ProxyAgent.mockImplementation(() => mockProxyAgent);
+    it('should use a shared proxy dispatcher when configured', async () => {
+      const mockProxyDispatcher = { type: 'proxy-dispatcher' };
+      getEnvProxyDispatcher.mockReturnValue(mockProxyDispatcher);
 
       const instance = new TavilySearchResults({ TAVILY_API_KEY: mockApiKey });
       await instance._call({ query: 'test query' });
 
-      expect(ProxyAgent).toHaveBeenCalledWith(proxyUrl);
+      expect(getEnvProxyDispatcher).toHaveBeenCalled();
       expect(fetch).toHaveBeenCalledWith(
         'https://api.tavily.com/search',
         expect.objectContaining({
-          dispatcher: mockProxyAgent,
+          dispatcher: mockProxyDispatcher,
         }),
       );
     });
 
-    it('should not use ProxyAgent when PROXY env var is not set', async () => {
-      delete process.env.PROXY;
+    it('should not attach a dispatcher when no proxy is configured', async () => {
+      getEnvProxyDispatcher.mockReturnValue(undefined);
 
       const instance = new TavilySearchResults({ TAVILY_API_KEY: mockApiKey });
       await instance._call({ query: 'test query' });
 
-      expect(ProxyAgent).not.toHaveBeenCalled();
+      expect(getEnvProxyDispatcher).toHaveBeenCalled();
       expect(fetch).toHaveBeenCalledWith(
         'https://api.tavily.com/search',
         expect.not.objectContaining({
diff --git a/api/app/clients/tools/util/handleTools.js b/api/app/clients/tools/util/handleTools.js
index 45623f9a9e6..adeb9f7ca99 100644
--- a/api/app/clients/tools/util/handleTools.js
+++ b/api/app/clients/tools/util/handleTools.js
@@ -41,6 +41,7 @@ const {
   createMCPPermissionContext,
   resolveConfigServers,
 } = require('~/server/services/MCP');
+const { getMCPRequestContext } = require('~/server/services/MCPRequestContext');
 const { createFileSearchTool, primeFiles: primeSearchFiles } = require('./fileSearch');
 const { primeFiles: primeCodeFiles } = require('~/server/services/Files/Code/process');
 const { getUserPluginAuthValue } = require('~/server/services/PluginService');
@@ -451,11 +452,13 @@ const loadTools = async ({
   let index = -1;
   const failedMCPServers = new Set();
   const safeUser = createSafeUser(options.req?.user);
+  const requestScopedConnections =
+    options.requestScopedConnections ?? getMCPRequestContext(options.req, options.res);
 
   for (const [serverName, toolConfigs] of Object.entries(requestedMCPTools)) {
     index++;
     /** @type {LCAvailableTools} */
-    let availableTools;
+    let availableTools = options.mcpAvailableTools?.[serverName];
     for (const config of toolConfigs) {
       try {
         if (failedMCPServers.has(serverName)) {
@@ -468,6 +471,8 @@ const loadTools = async ({
           user: safeUser,
           userMCPAuthMap,
           configServers,
+          requestBody: options.req?.body,
+          requestScopedConnections,
           res: options.res,
           streamId: options.req?._resumableStreamId || null,
           model: agent?.model ?? model,
@@ -488,7 +493,7 @@ const loadTools = async ({
         }
         if (!availableTools) {
           try {
-            availableTools = await getMCPServerTools(safeUser.id, serverName);
+            availableTools = await getMCPServerTools(safeUser.id, serverName, config.config);
           } catch (error) {
             logger.error(`Error fetching available tools for MCP server ${serverName}:`, error);
           }
@@ -502,6 +507,9 @@ const loadTools = async ({
                 ...mcpParams,
                 availableTools,
                 toolKey: config.toolKey,
+                onAvailableTools: (tools) => {
+                  availableTools = tools;
+                },
               });
 
         if (Array.isArray(mcpTool)) {
diff --git a/api/app/clients/tools/util/handleTools.test.js b/api/app/clients/tools/util/handleTools.test.js
index 1adda45c35e..697649e3bde 100644
--- a/api/app/clients/tools/util/handleTools.test.js
+++ b/api/app/clients/tools/util/handleTools.test.js
@@ -6,6 +6,10 @@ const mockPluginService = {
   deleteUserPluginAuth: jest.fn(),
   getUserPluginAuthValue: jest.fn(),
 };
+const mockGetMCPServerTools = jest.fn();
+const mockCreateMCPTool = jest.fn();
+const mockCreateMCPTools = jest.fn();
+const mockGetServerConfig = jest.fn();
 
 jest.mock('~/server/services/PluginService', () => mockPluginService);
 
@@ -28,9 +32,26 @@ jest.mock('~/server/services/Config', () => ({
       },
     },
   }),
+  getMCPServerTools: (...args) => mockGetMCPServerTools(...args),
+}));
+
+jest.mock('~/server/services/MCP', () => ({
+  createMCPTool: (...args) => mockCreateMCPTool(...args),
+  createMCPTools: (...args) => mockCreateMCPTools(...args),
+  createMCPPermissionContext: jest.fn(() => ({
+    canUseServers: jest.fn().mockResolvedValue(true),
+  })),
+  resolveConfigServers: jest.fn().mockResolvedValue({}),
+}));
+
+jest.mock('~/config', () => ({
+  getMCPServersRegistry: jest.fn(() => ({
+    getServerConfig: (...args) => mockGetServerConfig(...args),
+  })),
 }));
 
 const { Calculator } = require('@librechat/agents');
+const { Constants } = require('librechat-data-provider');
 
 const { User } = require('~/db/models');
 const PluginService = require('~/server/services/PluginService');
@@ -282,5 +303,152 @@ describe('Tool Handlers', () => {
       expect(structuredTool).toBeInstanceOf(StructuredSD);
       delete process.env.SD_WEBUI_URL;
     });
+
+    it('passes request body to chat MCP tool creation and skips stale cache for BODY-scoped servers', async () => {
+      const serverName = 'body-scoped';
+      const toolKey = `search${Constants.mcp_delimiter}${serverName}`;
+      const requestBody = { conversationId: 'conv-123', messageId: 'msg-123' };
+      const serverConfig = {
+        type: 'streamable-http',
+        url: 'https://api.example.com/messages/{{LIBRECHAT_BODY_MESSAGEID}}/mcp',
+        source: 'yaml',
+      };
+
+      mockGetServerConfig.mockResolvedValue(serverConfig);
+      mockCreateMCPTool.mockResolvedValue({ name: 'loaded-mcp-tool' });
+
+      const result = await loadTools({
+        user: fakeUser._id.toString(),
+        tools: [toolKey],
+        options: {
+          req: {
+            user: { id: fakeUser._id.toString(), role: 'USER' },
+            body: requestBody,
+          },
+        },
+      });
+
+      expect(result.loadedTools).toEqual([{ name: 'loaded-mcp-tool' }]);
+      expect(mockGetMCPServerTools).toHaveBeenCalledWith(
+        fakeUser._id.toString(),
+        serverName,
+        serverConfig,
+      );
+      expect(mockCreateMCPTool).toHaveBeenCalledWith(
+        expect.objectContaining({
+          requestBody,
+          toolKey,
+          config: serverConfig,
+        }),
+      );
+    });
+
+    it('uses run-scoped MCP tool definitions before cache lookup', async () => {
+      const serverName = 'body-scoped';
+      const toolKey = `search${Constants.mcp_delimiter}${serverName}`;
+      const requestBody = { conversationId: 'conv-123', messageId: 'msg-123' };
+      const serverConfig = {
+        type: 'streamable-http',
+        url: 'https://api.example.com/messages/{{LIBRECHAT_BODY_MESSAGEID}}/mcp',
+        source: 'yaml',
+      };
+      const runScopedTools = {
+        [toolKey]: {
+          function: {
+            name: toolKey,
+            description: 'Run-scoped search',
+            parameters: { type: 'object', properties: {} },
+          },
+        },
+      };
+
+      mockGetServerConfig.mockResolvedValue(serverConfig);
+      mockCreateMCPTool.mockResolvedValue({ name: 'loaded-mcp-tool' });
+
+      const result = await loadTools({
+        user: fakeUser._id.toString(),
+        tools: [toolKey],
+        options: {
+          mcpAvailableTools: {
+            [serverName]: runScopedTools,
+          },
+          req: {
+            user: { id: fakeUser._id.toString(), role: 'USER' },
+            body: requestBody,
+          },
+        },
+      });
+
+      expect(result.loadedTools).toEqual([{ name: 'loaded-mcp-tool' }]);
+      expect(mockGetMCPServerTools).not.toHaveBeenCalled();
+      expect(mockCreateMCPTool).toHaveBeenCalledWith(
+        expect.objectContaining({
+          availableTools: runScopedTools,
+          requestBody,
+          toolKey,
+          config: serverConfig,
+        }),
+      );
+    });
+
+    it('reuses discovered request-scoped MCP tool definitions within a server loop', async () => {
+      const serverName = 'body-scoped';
+      const firstToolKey = `search${Constants.mcp_delimiter}${serverName}`;
+      const secondToolKey = `lookup${Constants.mcp_delimiter}${serverName}`;
+      const requestBody = { conversationId: 'conv-123', messageId: 'msg-123' };
+      const serverConfig = {
+        type: 'streamable-http',
+        url: 'https://api.example.com/messages/{{LIBRECHAT_BODY_MESSAGEID}}/mcp',
+        source: 'yaml',
+      };
+      const discoveredTools = {
+        [firstToolKey]: {
+          function: {
+            description: 'Search',
+            parameters: { type: 'object', properties: {} },
+          },
+        },
+        [secondToolKey]: {
+          function: {
+            description: 'Lookup',
+            parameters: { type: 'object', properties: {} },
+          },
+        },
+      };
+
+      mockGetServerConfig.mockResolvedValue(serverConfig);
+      mockCreateMCPTool
+        .mockImplementationOnce(async ({ onAvailableTools }) => {
+          onAvailableTools(discoveredTools);
+          return { name: 'search-tool' };
+        })
+        .mockImplementationOnce(async ({ availableTools }) => {
+          expect(availableTools).toBe(discoveredTools);
+          return { name: 'lookup-tool' };
+        });
+
+      const result = await loadTools({
+        user: fakeUser._id.toString(),
+        tools: [firstToolKey, secondToolKey],
+        options: {
+          req: {
+            user: { id: fakeUser._id.toString(), role: 'USER' },
+            body: requestBody,
+          },
+        },
+      });
+
+      expect(result.loadedTools).toEqual([{ name: 'search-tool' }, { name: 'lookup-tool' }]);
+      expect(mockGetMCPServerTools).toHaveBeenCalledTimes(1);
+      expect(mockCreateMCPTool).toHaveBeenCalledTimes(2);
+      expect(mockCreateMCPTool).toHaveBeenNthCalledWith(
+        2,
+        expect.objectContaining({
+          availableTools: discoveredTools,
+          requestBody,
+          toolKey: secondToolKey,
+        }),
+      );
+    });
   });
 });
diff --git a/api/config/__tests__/logToFile.spec.js b/api/config/__tests__/logToFile.spec.js
deleted file mode 100644
index 4b3170f95ac..00000000000
--- a/api/config/__tests__/logToFile.spec.js
+++ /dev/null
@@ -1,72 +0,0 @@
-const fs = require('fs');
-
-const ORIGINAL_ENV = process.env;
-
-const mockDataSchemas = () => {
-  jest.doMock('@librechat/data-schemas', () => ({
-    getTenantId: jest.fn(),
-    getUserId: jest.fn(),
-    getRequestId: jest.fn(),
-    SYSTEM_TENANT_ID: 'system',
-  }));
-};
-
-const mockReadOnlyDockerLogDir = () => {
-  const originalExistsSync = fs.existsSync;
-  const originalMkdirSync = fs.mkdirSync;
-
-  jest.spyOn(process, 'cwd').mockReturnValue('/app');
-  jest
-    .spyOn(fs, 'existsSync')
-    .mockImplementation((target) =>
-      target === '/app/logs' ? false : originalExistsSync.call(fs, target),
-    );
-
-  return jest.spyOn(fs, 'mkdirSync').mockImplementation((target, options) => {
-    if (target === '/app/logs') {
-      throw new Error('Attempted to create Docker log directory');
-    }
-    return originalMkdirSync.call(fs, target, options);
-  });
-};
-
-const prepareLoggerWithoutFileLogging = () => {
-  jest.resetModules();
-  jest.clearAllMocks();
-  mockDataSchemas();
-
-  process.env = {
-    ...ORIGINAL_ENV,
-    DEBUG_LOGGING: 'true',
-    LOG_TO_FILE: 'false',
-  };
-
-  return mockReadOnlyDockerLogDir();
-};
-
-describe('LOG_TO_FILE', () => {
-  afterEach(() => {
-    process.env = ORIGINAL_ENV;
-    jest.restoreAllMocks();
-  });
-
-  it('does not create the API log directory when winston file logging is disabled', () => {
-    const mkdirSyncSpy = prepareLoggerWithoutFileLogging();
-
-    expect(() => require('../winston')).not.toThrow();
-
-    const winston = require('winston');
-    expect(winston.transports.DailyRotateFile).not.toHaveBeenCalled();
-    expect(mkdirSyncSpy).not.toHaveBeenCalledWith('/app/logs', expect.anything());
-  });
-
-  it('does not create the API log directory when Meili file logging is disabled', () => {
-    const mkdirSyncSpy = prepareLoggerWithoutFileLogging();
-
-    expect(() => require('../meiliLogger')).not.toThrow();
-
-    const winston = require('winston');
-    expect(winston.transports.DailyRotateFile).not.toHaveBeenCalled();
-    expect(mkdirSyncSpy).not.toHaveBeenCalledWith('/app/logs', expect.anything());
-  });
-});
diff --git a/api/config/__tests__/parsers.spec.js b/api/config/__tests__/parsers.spec.js
deleted file mode 100644
index 4c783609531..00000000000
--- a/api/config/__tests__/parsers.spec.js
+++ /dev/null
@@ -1,430 +0,0 @@
-jest.unmock('winston');
-
-const { formatConsoleMeta, redactMessage, redactFormat, debugTraverse } =
-  jest.requireActual('../parsers');
-const SPLAT_SYMBOL = Symbol.for('splat');
-
-describe('formatConsoleMeta', () => {
-  it('returns empty string when there is no user metadata', () => {
-    expect(
-      formatConsoleMeta({
-        level: 'error',
-        message: 'oops',
-        timestamp: '2026-04-18 02:25:22',
-      }),
-    ).toBe('');
-  });
-
-  it('serializes user-supplied metadata keys', () => {
-    const meta = formatConsoleMeta({
-      level: 'error',
-      message: '[agents:summarize] Summarization LLM call failed',
-      timestamp: '2026-04-18 02:25:22',
-      provider: 'azureOpenAI',
-      model: 'gpt-5.4-mini',
-      messagesToRefineCount: 42,
-    });
-
-    expect(meta).toContain('"provider":"azureOpenAI"');
-    expect(meta).toContain('"model":"gpt-5.4-mini"');
-    expect(meta).toContain('"messagesToRefineCount":42');
-  });
-
-  it('omits the system tenant sentinel from metadata trailers', () => {
-    const meta = formatConsoleMeta({
-      level: 'warn',
-      message: 'system task',
-      timestamp: 'ts',
-      tenantId: '__SYSTEM__',
-      userId: 'user-1',
-    });
-
-    expect(meta).toBe('{"userId":"user-1"}');
-  });
-
-  it('ignores reserved winston keys but preserves legitimate fields like _id', () => {
-    const meta = formatConsoleMeta({
-      level: 'error',
-      message: 'boom',
-      timestamp: 'ts',
-      splat: [1, 2],
-      _id: '507f191e810c19729de860ea',
-      userField: 'keep',
-    });
-
-    expect(meta).toContain('"_id":"507f191e810c19729de860ea"');
-    expect(meta).toContain('"userField":"keep"');
-    expect(meta).not.toContain('"splat"');
-  });
-
-  it('drops numeric-index-like keys (splat artifacts from primitive args)', () => {
-    const meta = formatConsoleMeta({
-      level: 'warn',
-      message: 'Unhandled step:',
-      timestamp: 'ts',
-      0: 'f',
-      1: 'o',
-      2: 'o',
-      realField: 'real',
-    });
-
-    expect(meta).toBe('{"realField":"real"}');
-  });
-
-  it('drops empty, null, undefined, function, and symbol values', () => {
-    const meta = formatConsoleMeta({
-      level: 'warn',
-      message: 'noise',
-      timestamp: 'ts',
-      empty: '',
-      nullish: null,
-      undef: undefined,
-      fn: () => 1,
-      sym: Symbol('x'),
-      kept: 'yes',
-    });
-
-    expect(meta).toBe('{"kept":"yes"}');
-  });
-
-  it('truncates very long string values to avoid console spam', () => {
-    const longString = 'x'.repeat(5000);
-    const meta = formatConsoleMeta({
-      level: 'error',
-      message: 'long',
-      timestamp: 'ts',
-      errorStack: longString,
-    });
-
-    expect(meta.length).toBeLessThan(longString.length);
-    expect(meta).toContain('...');
-  });
-
-  it('preserves non-circular fields when one value is circular', () => {
-    const circular = {};
-    circular.self = circular;
-    const meta = formatConsoleMeta({
-      level: 'error',
-      message: 'circular',
-      timestamp: 'ts',
-      provider: 'openai',
-      model: 'gpt-5.4-mini',
-      circular,
-    });
-
-    expect(meta).toContain('"provider":"openai"');
-    expect(meta).toContain('"model":"gpt-5.4-mini"');
-    expect(meta).toContain('[Circular]');
-  });
-
-  it('falls back to per-field serialization when a value toJSON throws', () => {
-    const meta = formatConsoleMeta({
-      level: 'error',
-      message: 'crash',
-      timestamp: 'ts',
-      provider: 'azure',
-      model: 'gpt-5.4-mini',
-      broken: {
-        toJSON() {
-          throw new Error('nope');
-        },
-      },
-    });
-
-    expect(meta).toContain('"provider":"azure"');
-    expect(meta).toContain('"model":"gpt-5.4-mini"');
-    expect(meta).toContain('[Unserializable]');
-  });
-
-  it('redacts sensitive strings nested inside metadata objects', () => {
-    const meta = formatConsoleMeta({
-      level: 'error',
-      message: 'nested leak',
-      timestamp: 'ts',
-      config: {
-        headers: {
-          authorization: 'Bearer eyJhbGciOi.nestedTokenValue',
-        },
-        query: 'https://example.com/?key=AIzaNested',
-      },
-      openaiKey: 'sk-outerKey123',
-    });
-
-    expect(meta).not.toContain('eyJhbGciOi.nestedTokenValue');
-    expect(meta).not.toContain('AIzaNested');
-    expect(meta).not.toContain('sk-outerKey123');
-    expect(meta).toContain('Bearer [REDACTED]');
-    expect(meta).toContain('key=[REDACTED]');
-    expect(meta).toContain('sk-[REDACTED]');
-  });
-
-  it('redacts the Azure-style mixed-case Api-Key header', () => {
-    const meta = formatConsoleMeta({
-      level: 'error',
-      message: 'azure call',
-      timestamp: 'ts',
-      headers: 'Api-Key: 0123456789abcdef',
-    });
-
-    expect(meta).not.toContain('0123456789abcdef');
-    expect(meta).toContain('Api-Key: [REDACTED]');
-  });
-
-  it('redacts sensitive patterns inside string metadata values', () => {
-    const meta = formatConsoleMeta({
-      level: 'error',
-      message: 'leak test',
-      timestamp: 'ts',
-      openaiKey: 'sk-abc123def456',
-      auth: 'Bearer eyJhbGciOi...tokenvalue',
-      google: 'https://example.com/?key=AIzaSyXX',
-    });
-
-    expect(meta).not.toContain('sk-abc123def456');
-    expect(meta).not.toContain('eyJhbGciOi...tokenvalue');
-    expect(meta).not.toContain('AIzaSyXX');
-    expect(meta).toContain('sk-[REDACTED]');
-    expect(meta).toContain('Bearer [REDACTED]');
-    expect(meta).toContain('key=[REDACTED]');
-  });
-
-  it('redacts multiple occurrences of the same pattern in one value', () => {
-    const meta = formatConsoleMeta({
-      level: 'error',
-      message: 'two keys',
-      timestamp: 'ts',
-      combined: 'first sk-aaa and then sk-bbb',
-    });
-
-    expect(meta).not.toContain('sk-aaa');
-    expect(meta).not.toContain('sk-bbb');
-    expect(meta.match(/sk-\[REDACTED\]/g)?.length).toBe(2);
-  });
-});
-
-describe('redactMessage', () => {
-  it('redacts sk- keys that are not at line start (inside JSON-like text)', () => {
-    const input = '{"apiKey":"sk-abc123"}';
-    expect(redactMessage(input)).toBe('{"apiKey":"sk-[REDACTED]"}');
-  });
-
-  it('redacts all sk- occurrences in a single pass', () => {
-    const input = 'sk-one sk-two sk-three';
-    expect(redactMessage(input)).toBe('sk-[REDACTED] sk-[REDACTED] sk-[REDACTED]');
-  });
-
-  it('trims redacted output when trimLength is provided', () => {
-    const input = 'Bearer supersecretvalue';
-    expect(redactMessage(input, 10)).toBe('Bearer [RE...');
-  });
-
-  it('returns empty string for falsy input', () => {
-    expect(redactMessage('')).toBe('');
-    expect(redactMessage(undefined)).toBe('');
-  });
-
-  it('does not redact ordinary words that contain "sk-" inside them', () => {
-    expect(redactMessage('task-runner failed')).toBe('task-runner failed');
-    expect(redactMessage('mask-value computed')).toBe('mask-value computed');
-    expect(redactMessage('desk-lamp is on')).toBe('desk-lamp is on');
-  });
-
-  it('does not redact words that contain "key=" inside them', () => {
-    expect(redactMessage('monkey=10 bananas')).toBe('monkey=10 bananas');
-  });
-
-  it('still redacts standalone sk- keys at word boundaries', () => {
-    expect(redactMessage('token: sk-abc123def')).toBe('token: sk-[REDACTED]');
-    expect(redactMessage('"sk-abc123def"')).toBe('"sk-[REDACTED]"');
-  });
-});
-
-describe('redactFormat', () => {
-  const runFormat = (info) => redactFormat().transform(info) || info;
-
-  it('redacts info.message for error level before any colorize step runs', () => {
-    const info = runFormat({ level: 'error', message: 'Bearer secretvalue' });
-    expect(info.message).toBe('Bearer [REDACTED]');
-  });
-
-  it('redacts info.message for warn level too (avoids ANSI boundary issues later)', () => {
-    const info = runFormat({ level: 'warn', message: 'apiKey=sk-abc123def' });
-    expect(info.message).toContain('sk-[REDACTED]');
-  });
-
-  it('leaves info.message untouched for info and debug levels', () => {
-    const infoInfo = runFormat({ level: 'info', message: 'Bearer looksSensitive' });
-    expect(infoInfo.message).toBe('Bearer looksSensitive');
-
-    const infoDebug = runFormat({ level: 'debug', message: 'Bearer looksSensitive' });
-    expect(infoDebug.message).toBe('Bearer looksSensitive');
-  });
-});
-
-describe('debugTraverse', () => {
-  const runFormatter = (info) => {
-    const transformed = debugTraverse.transform(info);
-    const MESSAGE = Symbol.for('message');
-    if (transformed && typeof transformed === 'object') {
-      return transformed[MESSAGE] ?? String(transformed);
-    }
-    return String(transformed);
-  };
-
-  const buildInfo = (level, meta) => {
-    const info = {
-      level,
-      message: 'test',
-      timestamp: 'ts',
-      ...meta,
-    };
-    info[SPLAT_SYMBOL] = [meta];
-    return info;
-  };
-
-  it('redacts sensitive strings in metadata for error level', () => {
-    const out = runFormatter(buildInfo('error', { auth: 'Bearer eyJabc123', openai: 'sk-abc123' }));
-    expect(out).not.toContain('eyJabc123');
-    expect(out).not.toContain('sk-abc123');
-    expect(out).toContain('Bearer [REDACTED]');
-    expect(out).toContain('sk-[REDACTED]');
-  });
-
-  it('redacts sensitive strings in metadata for warn level', () => {
-    const out = runFormatter(buildInfo('warn', { header: 'Bearer supersecrettoken' }));
-    expect(out).not.toContain('supersecrettoken');
-    expect(out).toContain('Bearer [REDACTED]');
-  });
-
-  it('preserves debug-level metadata unmodified (existing behavior)', () => {
-    const out = runFormatter(buildInfo('debug', { someField: 'not-sensitive' }));
-    expect(out).toContain('not-sensitive');
-  });
-
-  it('prefers structured metadata over a consumed printf arg in SPLAT[0]', () => {
-    const info = {
-      level: 'warn',
-      message: 'failed for tenant-7',
-      timestamp: 'ts',
-      provider: 'openai',
-      [SPLAT_SYMBOL]: ['tenant-7', { provider: 'openai' }],
-    };
-    const out = runFormatter(info);
-    expect(out).toContain('openai');
-    const tenantMatches = out.match(/tenant-7/g) ?? [];
-    expect(tenantMatches.length).toBeLessThanOrEqual(1);
-  });
-
-  it('does not duplicate a consumed %s arg when there is no structured metadata', () => {
-    const info = {
-      level: 'warn',
-      message: 'failed for tenant-7',
-      timestamp: 'ts',
-      [SPLAT_SYMBOL]: ['tenant-7'],
-    };
-    const out = runFormatter(info);
-    const tenantMatches = out.match(/tenant-7/g) ?? [];
-    expect(tenantMatches.length).toBe(1);
-  });
-
-  it('appends request context metadata for non-debug lines', () => {
-    const out = runFormatter(
-      buildInfo('info', {
-        tenantId: 'tenant-1',
-        userId: 'user-1',
-        requestId: 'req-1',
-      }),
-    );
-
-    expect(out).toContain('"tenantId":"tenant-1"');
-    expect(out).toContain('"userId":"user-1"');
-    expect(out).toContain('"requestId":"req-1"');
-  });
-
-  it('does not append the system tenant sentinel as tenantId', () => {
-    const out = runFormatter(
-      buildInfo('info', {
-        tenantId: '__SYSTEM__',
-        userId: 'user-1',
-        requestId: 'req-1',
-      }),
-    );
-
-    expect(out).not.toContain('__SYSTEM__');
-    expect(out).not.toContain('"tenantId"');
-    expect(out).toContain('"userId":"user-1"');
-    expect(out).toContain('"requestId":"req-1"');
-  });
-
-  it('omits the system tenant sentinel from debug object metadata', () => {
-    const out = runFormatter(
-      buildInfo('debug', {
-        tenantId: '__SYSTEM__',
-        userId: 'user-1',
-      }),
-    );
-
-    expect(out).not.toContain('__SYSTEM__');
-    expect(out).not.toMatch(/tenantId:/);
-    expect(out).toContain('userId');
-  });
-
-  it('appends request context metadata for debug lines without object metadata', () => {
-    const info = {
-      level: 'debug',
-      message: 'prefix:',
-      timestamp: 'ts',
-      tenantId: 'tenant-1',
-      userId: 'user-1',
-      requestId: 'req-1',
-      [SPLAT_SYMBOL]: ['detailValueXYZ'],
-    };
-    const out = runFormatter(info);
-
-    expect(out).toContain('detailValueXYZ');
-    expect(out).toContain('"tenantId":"tenant-1"');
-    expect(out).toContain('"userId":"user-1"');
-    expect(out).toContain('"requestId":"req-1"');
-  });
-
-  it('omits numeric splat-artifact keys from the traversed output', () => {
-    const info = {
-      level: 'error',
-      message: 'boom',
-      timestamp: 'ts',
-      0: 'x',
-      1: 'y',
-      realField: 'keep',
-      [SPLAT_SYMBOL]: [{ realField: 'keep' }],
-    };
-    const out = runFormatter(info);
-    expect(out).toContain('realField');
-    expect(out).toContain('keep');
-    expect(out).not.toMatch(/^\s*0:/m);
-    expect(out).not.toMatch(/^\s*1:/m);
-  });
-
-  it('surfaces unconsumed primitive SPLAT[0] (no %s in message) for debug level', () => {
-    const info = {
-      level: 'debug',
-      message: 'prefix:',
-      timestamp: 'ts',
-      [SPLAT_SYMBOL]: ['detailValueXYZ'],
-    };
-    const out = runFormatter(info);
-    expect(out).toContain('detailValueXYZ');
-  });
-
-  it('still surfaces array metadata in SPLAT[0] when no object is extracted', () => {
-    const info = {
-      level: 'debug',
-      message: 'list',
-      timestamp: 'ts',
-      [SPLAT_SYMBOL]: [['alpha', 'beta', 'gamma']],
-    };
-    const out = runFormatter(info);
-    expect(out).toContain('alpha');
-    expect(out).toContain('beta');
-    expect(out).toContain('gamma');
-  });
-});
diff --git a/api/config/index.js b/api/config/index.js
index 3b6d869332b..6d9f70ecbbe 100644
--- a/api/config/index.js
+++ b/api/config/index.js
@@ -1,38 +1,57 @@
 const { EventSource } = require('eventsource');
 const { Time } = require('librechat-data-provider');
 const {
+  mcpConfig,
   MCPManager,
   FlowStateManager,
   MCPServersRegistry,
   OAuthReconnectionManager,
 } = require('@librechat/api');
-const logger = require('./winston');
 
 global.EventSource = EventSource;
 
-/** @type {MCPManager} */
+/** @type {FlowStateManager} */
 let flowManager = null;
+/** @type {FlowStateManager} */
+let actionFlowManager = null;
 
 /**
+ * Flow manager for MCP OAuth flows. Uses the longer MCP OAuth TTL so the auth
+ * button and flow state outlive the user-completion window.
  * @param {Keyv} flowsCache
  * @returns {FlowStateManager}
  */
 function getFlowStateManager(flowsCache) {
   if (!flowManager) {
     flowManager = new FlowStateManager(flowsCache, {
-      ttl: Time.ONE_MINUTE * 3,
+      ttl: mcpConfig.OAUTH_FLOW_TTL,
     });
   }
   return flowManager;
 }
 
+/**
+ * Flow manager for Action (custom tool) OAuth flows. Kept on the shorter TTL so an
+ * unclicked action login does not leave the tool call waiting for the MCP OAuth window.
+ * @param {Keyv} flowsCache
+ * @returns {FlowStateManager}
+ */
+function getActionFlowStateManager(flowsCache) {
+  if (!actionFlowManager) {
+    actionFlowManager = new FlowStateManager(flowsCache, {
+      ttl: Time.ONE_MINUTE * 3,
+    });
+  }
+  return actionFlowManager;
+}
+
 module.exports = {
-  logger,
   createMCPServersRegistry: MCPServersRegistry.createInstance,
   getMCPServersRegistry: MCPServersRegistry.getInstance,
   createMCPManager: MCPManager.createInstance,
   getMCPManager: MCPManager.getInstance,
   getFlowStateManager,
+  getActionFlowStateManager,
   createOAuthReconnectionManager: OAuthReconnectionManager.createInstance,
   getOAuthReconnectionManager: OAuthReconnectionManager.getInstance,
 };
diff --git a/api/config/parsers.js b/api/config/parsers.js
deleted file mode 100644
index 477e3712535..00000000000
--- a/api/config/parsers.js
+++ /dev/null
@@ -1,388 +0,0 @@
-const { klona } = require('klona');
-const winston = require('winston');
-const traverse = require('traverse');
-
-const SPLAT_SYMBOL = Symbol.for('splat');
-const MESSAGE_SYMBOL = Symbol.for('message');
-const CONSOLE_JSON_STRING_LENGTH = parseInt(process.env.CONSOLE_JSON_STRING_LENGTH) || 255;
-const DEBUG_MESSAGE_LENGTH = parseInt(process.env.DEBUG_MESSAGE_LENGTH) || 150;
-
-const sensitiveKeys = [
-  // OpenAI API key: `sk-` at a word boundary, followed by the documented
-  // charset for keys. `\b` keeps `task-runner`, `mask-value`, etc. from
-  // being mis-redacted.
-  /\b(sk-)[a-zA-Z0-9_-]+/g,
-  /\b(Bearer )[^\s"']+/g, // Header: Bearer token pattern
-  /\b(api-key:? )[^\s"']+/gi, // Header: API key pattern (case-insensitive; covers `Api-Key:`, `API-KEY:`)
-  /\b(key=)[^\s"'&]+/g, // URL query param: sensitive key pattern (Google)
-];
-
-const NUMERIC_KEY_RE = /^\d+$/;
-const LOG_CONTEXT_KEYS = ['tenantId', 'userId', 'requestId'];
-const SYSTEM_TENANT_ID = '__SYSTEM__';
-
-/**
- * Redacts sensitive information from a console message and trims it to a specified length if provided.
- * @param {string} str - The console message to be redacted.
- * @param {number} [trimLength] - The optional length at which to trim the redacted message.
- * @returns {string} - The redacted and optionally trimmed console message.
- */
-function redactMessage(str, trimLength) {
-  if (!str) {
-    return '';
-  }
-
-  let redacted = str;
-  for (const pattern of sensitiveKeys) {
-    redacted = redacted.replace(pattern, '$1[REDACTED]');
-  }
-
-  if (trimLength !== undefined && redacted.length > trimLength) {
-    return `${redacted.substring(0, trimLength)}...`;
-  }
-
-  return redacted;
-}
-
-/**
- * Redacts sensitive information from log messages when the log level is
- * `error` or `warn`. Runs on the raw `info.message` before any colorize /
- * splat transforms so the sensitive-token regexes don't have to contend
- * with ANSI escape sequences (whose trailing `m` would otherwise defeat
- * `\b` anchors).
- *
- * Note: Intentionally mutates the object.
- * @param {Object} info - The log information object.
- * @returns {Object} - The modified log information object.
- */
-const redactFormat = winston.format((info) => {
-  if (info.level === 'error' || info.level === 'warn') {
-    if (typeof info.message === 'string') {
-      info.message = redactMessage(info.message);
-    }
-    if (typeof info[MESSAGE_SYMBOL] === 'string') {
-      info[MESSAGE_SYMBOL] = redactMessage(info[MESSAGE_SYMBOL]);
-    }
-  }
-  return info;
-});
-
-/**
- * Truncates long strings, especially base64 image data, within log messages.
- *
- * @param {any} value - The value to be inspected and potentially truncated.
- * @param {number} [length] - The length at which to truncate the value. Default: 100.
- * @returns {any} - The truncated or original value.
- */
-const truncateLongStrings = (value, length = 100) => {
-  if (typeof value === 'string') {
-    return value.length > length ? value.substring(0, length) + '... [truncated]' : value;
-  }
-
-  return value;
-};
-
-/**
- * An array mapping function that truncates long strings (objects converted to JSON strings).
- * @param {any} item - The item to be condensed.
- * @returns {any} - The condensed item.
- */
-const condenseArray = (item) => {
-  if (typeof item === 'string') {
-    return truncateLongStrings(JSON.stringify(item));
-  } else if (typeof item === 'object') {
-    return truncateLongStrings(JSON.stringify(item));
-  }
-  return item;
-};
-
-const RESERVED_LOG_KEYS = new Set(['level', 'message', 'timestamp', 'splat']);
-
-/**
- * Extracts user-supplied metadata from a winston info object. Filters out:
- * - Reserved winston keys (`level`, `message`, `timestamp`, `splat`).
- * - Numeric-string keys (`"0"`, `"1"`, ...) that `format.splat()` can
- *   synthesize when a primitive is passed as an extra log argument.
- * - Values that are undefined, null, empty strings, functions, or symbols.
- *
- * Underscore-prefixed keys are intentionally preserved so legitimate
- * fields like MongoDB `_id` survive.
- *
- * @param {Record<string, unknown>} source - The object to extract metadata from.
- * @returns {Record<string, unknown> | undefined} - The extracted metadata, or undefined if empty.
- */
-function extractMetaObject(source) {
-  if (source == null || typeof source !== 'object') {
-    return undefined;
-  }
-  const meta = {};
-  for (const key of Object.keys(source)) {
-    if (RESERVED_LOG_KEYS.has(key)) {
-      continue;
-    }
-    if (NUMERIC_KEY_RE.test(key)) {
-      continue;
-    }
-    const value = source[key];
-    if (key === 'tenantId' && value === SYSTEM_TENANT_ID) {
-      continue;
-    }
-    if (value === undefined || value === null || value === '') {
-      continue;
-    }
-    if (typeof value === 'function' || typeof value === 'symbol') {
-      continue;
-    }
-    meta[key] = value;
-  }
-  return Object.keys(meta).length > 0 ? meta : undefined;
-}
-
-/**
- * Formats the metadata portion of a winston info object as a compact
- * single-line JSON trailer, suitable for appending to the console message.
- * Returns an empty string when there is no meaningful metadata.
- *
- * @param {Record<string, unknown>} info - The winston info object.
- * @returns {string} - The serialized metadata, or an empty string.
- */
-function formatConsoleMeta(info) {
-  const meta = extractMetaObject(info);
-  if (!meta) {
-    return '';
-  }
-  const seen = new WeakSet();
-  const replacer = (_key, value) => {
-    if (typeof value === 'string') {
-      const safe = redactMessage(value);
-      return safe.length > CONSOLE_JSON_STRING_LENGTH
-        ? `${safe.substring(0, CONSOLE_JSON_STRING_LENGTH)}...`
-        : safe;
-    }
-    if (value !== null && typeof value === 'object') {
-      if (seen.has(value)) {
-        return '[Circular]';
-      }
-      seen.add(value);
-    }
-    return value;
-  };
-
-  try {
-    return JSON.stringify(meta, replacer);
-  } catch {
-    /*
-     * Fall back to per-field serialization: a single unserializable field
-     * shouldn't drop every other scalar in the trailer. Scalars are emitted
-     * as-is; values that still fail serialization are replaced with a
-     * placeholder so `provider`, `model`, etc. continue to surface.
-     */
-    const parts = [];
-    for (const key of Object.keys(meta)) {
-      const perFieldSeen = new WeakSet();
-      const perFieldReplacer = (k, value) => {
-        if (typeof value === 'string') {
-          return replacer(k, value);
-        }
-        if (value !== null && typeof value === 'object') {
-          if (perFieldSeen.has(value)) {
-            return '[Circular]';
-          }
-          perFieldSeen.add(value);
-        }
-        return value;
-      };
-      try {
-        parts.push(`${JSON.stringify(key)}:${JSON.stringify(meta[key], perFieldReplacer)}`);
-      } catch {
-        parts.push(`${JSON.stringify(key)}:"[Unserializable]"`);
-      }
-    }
-    return parts.length > 0 ? `{${parts.join(',')}}` : '';
-  }
-}
-
-function formatRequestContext(info) {
-  if (info == null || typeof info !== 'object') {
-    return '';
-  }
-  const context = {};
-  for (const key of LOG_CONTEXT_KEYS) {
-    const value = info[key];
-    if (key === 'tenantId' && value === SYSTEM_TENANT_ID) {
-      continue;
-    }
-    if (typeof value === 'string' && value) {
-      context[key] = value;
-    }
-  }
-  return Object.keys(context).length > 0 ? JSON.stringify(context) : '';
-}
-
-/**
- * Formats log messages for file and debug-console transports. Three paths:
- * - `warn` / `error`: append a compact single-line JSON metadata trailer
- *   (via `formatConsoleMeta`) and pass the full line through `redactMessage`
- *   so sensitive patterns are scrubbed.
- * - `debug`: perform the detailed multi-line object traversal of
- *   `SPLAT_SYMBOL[0]`, with long-string truncation and array condensation.
- *   Redaction on this path is not applied here (debug-file consumers
- *   historically accept raw detail).
- * - Other levels: return the truncated `"<timestamp> <level>: <message>"`
- *   line with request context metadata when present.
- *
- * @param {Object} options - The options for formatting log messages.
- * @param {string} options.level - The log level.
- * @param {string} options.message - The log message.
- * @param {string} options.timestamp - The timestamp of the log message.
- * @param {Object} options.metadata - Additional metadata associated with the log message.
- * @returns {string} - The formatted log message.
- */
-const debugTraverse = winston.format.printf(({ level, message, timestamp, ...metadata }) => {
-  if (!message) {
-    return `${timestamp} ${level}`;
-  }
-
-  if (!message?.trim || typeof message !== 'string') {
-    return `${timestamp} ${level}: ${JSON.stringify(message)}`;
-  }
-
-  let msg = `${timestamp} ${level}: ${truncateLongStrings(message?.trim(), DEBUG_MESSAGE_LENGTH)}`;
-  const levelStr = typeof level === 'string' ? level : String(level);
-  const isErrorOrWarn = levelStr.includes('error') || levelStr.includes('warn');
-
-  /*
-   * Warn/error follow a simpler code path: append a single-line JSON
-   * metadata trailer (same shape as the console formatter) and pass the
-   * result through `redactMessage`. The complex object-traversal below is
-   * kept for debug level only, where detailed multi-line output is the
-   * intended behavior and its splat/interpolation interactions were
-   * already tolerated.
-   */
-  if (isErrorOrWarn) {
-    const trailer = formatConsoleMeta(metadata);
-    const line = trailer ? `${msg} ${trailer}` : msg;
-    return redactMessage(line);
-  }
-
-  try {
-    if (level !== 'debug') {
-      const trailer = formatRequestContext(metadata);
-      return trailer ? `${msg} ${trailer}` : msg;
-    }
-
-    if (!metadata) {
-      return msg;
-    }
-
-    const appendMetadataTrailer = (line) => {
-      const trailer = formatRequestContext(metadata);
-      return trailer ? `${line} ${trailer}` : line;
-    };
-
-    const debugValue = metadata[SPLAT_SYMBOL]?.[0];
-
-    if (!debugValue) {
-      return appendMetadataTrailer(msg);
-    }
-
-    if (debugValue && Array.isArray(debugValue)) {
-      msg += `\n${JSON.stringify(debugValue.map(condenseArray))}`;
-      return appendMetadataTrailer(msg);
-    }
-
-    if (typeof debugValue !== 'object') {
-      msg += ` ${debugValue}`;
-      return appendMetadataTrailer(msg);
-    }
-
-    msg += '\n{';
-
-    const copy = klona(metadata);
-    if (copy.tenantId === SYSTEM_TENANT_ID) {
-      delete copy.tenantId;
-    }
-    traverse(copy).forEach(function (value) {
-      if (typeof this?.key === 'symbol') {
-        return;
-      }
-
-      let _parentKey = '';
-      const parent = this.parent;
-
-      if (typeof parent?.key !== 'symbol' && parent?.key) {
-        _parentKey = parent.key;
-      }
-
-      const parentKey = `${parent && parent.notRoot ? _parentKey + '.' : ''}`;
-
-      const tabs = `${parent && parent.notRoot ? '    ' : '  '}`;
-
-      const currentKey = this?.key ?? 'unknown';
-
-      if (this.isLeaf && typeof value === 'string') {
-        const truncatedText = truncateLongStrings(value);
-        msg += `\n${tabs}${parentKey}${currentKey}: ${JSON.stringify(truncatedText)},`;
-      } else if (this.notLeaf && Array.isArray(value) && value.length > 0) {
-        const currentMessage = `\n${tabs}// ${value.length} ${currentKey.replace(/s$/, '')}(s)`;
-        this.update(currentMessage, true);
-        msg += currentMessage;
-        const stringifiedArray = value.map(condenseArray);
-        msg += `\n${tabs}${parentKey}${currentKey}: [${stringifiedArray}],`;
-      } else if (this.isLeaf && typeof value === 'function') {
-        msg += `\n${tabs}${parentKey}${currentKey}: function,`;
-      } else if (this.isLeaf) {
-        msg += `\n${tabs}${parentKey}${currentKey}: ${value},`;
-      }
-    });
-
-    msg += '\n}';
-    return msg;
-  } catch (e) {
-    return (msg += `\n[LOGGER PARSING ERROR] ${e.message}`);
-  }
-});
-
-const jsonTruncateFormat = winston.format((info) => {
-  const truncateLongStrings = (str, maxLength) => {
-    return str.length > maxLength ? str.substring(0, maxLength) + '...' : str;
-  };
-
-  const seen = new WeakSet();
-
-  const truncateObject = (obj) => {
-    if (typeof obj !== 'object' || obj === null) {
-      return obj;
-    }
-
-    // Handle circular references
-    if (seen.has(obj)) {
-      return '[Circular]';
-    }
-    seen.add(obj);
-
-    if (Array.isArray(obj)) {
-      return obj.map((item) => truncateObject(item));
-    }
-
-    const newObj = {};
-    Object.entries(obj).forEach(([key, value]) => {
-      if (typeof value === 'string') {
-        newObj[key] = truncateLongStrings(value, CONSOLE_JSON_STRING_LENGTH);
-      } else {
-        newObj[key] = truncateObject(value);
-      }
-    });
-    return newObj;
-  };
-
-  return truncateObject(info);
-});
-
-module.exports = {
-  redactFormat,
-  redactMessage,
-  debugTraverse,
-  jsonTruncateFormat,
-  formatConsoleMeta,
-};
diff --git a/api/config/winston.js b/api/config/winston.js
deleted file mode 100644
index 983205fc709..00000000000
--- a/api/config/winston.js
+++ /dev/null
@@ -1,224 +0,0 @@
-const path = require('path');
-const fs = require('fs');
-const winston = require('winston');
-require('winston-daily-rotate-file');
-const {
-  getTenantId,
-  getUserId,
-  getRequestId,
-  SYSTEM_TENANT_ID,
-} = require('@librechat/data-schemas');
-const {
-  redactFormat,
-  redactMessage,
-  debugTraverse,
-  jsonTruncateFormat,
-  formatConsoleMeta,
-} = require('./parsers');
-
-/**
- * Determine the log directory.
- * Priority:
- * 1. LIBRECHAT_LOG_DIR environment variable (allows user override)
- * 2. /app/logs if running in Docker (bind-mounted with correct permissions)
- * 3. api/logs relative to this file (local development)
- */
-const getLogDir = () => {
-  if (process.env.LIBRECHAT_LOG_DIR) {
-    return process.env.LIBRECHAT_LOG_DIR;
-  }
-
-  // Check if running in Docker container (cwd is /app)
-  if (process.cwd() === '/app') {
-    const dockerLogDir = '/app/logs';
-    // Ensure the directory exists
-    if (!fs.existsSync(dockerLogDir)) {
-      fs.mkdirSync(dockerLogDir, { recursive: true });
-    }
-    return dockerLogDir;
-  }
-
-  // Local development: use api/logs relative to this file
-  return path.join(__dirname, '..', 'logs');
-};
-
-const {
-  NODE_ENV,
-  DEBUG_LOGGING = true,
-  CONSOLE_JSON = false,
-  DEBUG_CONSOLE = false,
-  LOG_TO_FILE = true,
-} = process.env;
-
-const useConsoleJson =
-  (typeof CONSOLE_JSON === 'string' && CONSOLE_JSON?.toLowerCase() === 'true') ||
-  CONSOLE_JSON === true;
-
-const useDebugConsole =
-  (typeof DEBUG_CONSOLE === 'string' && DEBUG_CONSOLE?.toLowerCase() === 'true') ||
-  DEBUG_CONSOLE === true;
-
-const useDebugLogging =
-  (typeof DEBUG_LOGGING === 'string' && DEBUG_LOGGING?.toLowerCase() === 'true') ||
-  DEBUG_LOGGING === true;
-
-const useFileLogging =
-  (typeof LOG_TO_FILE === 'string' && LOG_TO_FILE?.toLowerCase() !== 'false') ||
-  LOG_TO_FILE === true;
-
-const levels = {
-  error: 0,
-  warn: 1,
-  info: 2,
-  http: 3,
-  verbose: 4,
-  debug: 5,
-  activity: 6,
-  silly: 7,
-};
-
-const LOG_CONTEXT_KEYS = ['tenantId', 'userId', 'requestId'];
-
-const getLogTenantId = () => {
-  const tenantId = getTenantId();
-  return tenantId === SYSTEM_TENANT_ID ? undefined : tenantId;
-};
-
-const requestContextFormat = winston.format((info) => {
-  if (info.tenantId === SYSTEM_TENANT_ID) {
-    delete info.tenantId;
-  }
-  const context = {
-    tenantId: getLogTenantId(),
-    userId: getUserId(),
-    requestId: getRequestId(),
-  };
-  LOG_CONTEXT_KEYS.forEach((key) => {
-    if (context[key] && info[key] == null) {
-      info[key] = context[key];
-    }
-  });
-  return info;
-});
-
-const formatRequestContext = (info) => {
-  const context = {};
-  LOG_CONTEXT_KEYS.forEach((key) => {
-    const value = info[key];
-    if (key === 'tenantId' && value === SYSTEM_TENANT_ID) {
-      return;
-    }
-    if (typeof value === 'string' && value) {
-      context[key] = value;
-    }
-  });
-  return Object.keys(context).length > 0 ? JSON.stringify(context) : '';
-};
-
-winston.addColors({
-  info: 'green', // fontStyle color
-  warn: 'italic yellow',
-  error: 'red',
-  debug: 'blue',
-});
-
-const level = () => {
-  const env = NODE_ENV || 'development';
-  const isDevelopment = env === 'development';
-  return isDevelopment ? 'debug' : 'warn';
-};
-
-const fileFormat = winston.format.combine(
-  redactFormat(),
-  winston.format.timestamp({ format: () => new Date().toISOString() }),
-  winston.format.errors({ stack: true }),
-  winston.format.splat(),
-  requestContextFormat(),
-  // redactErrors(),
-);
-
-const transports = [];
-
-if (useFileLogging) {
-  const logDir = getLogDir();
-
-  transports.push(
-    new winston.transports.DailyRotateFile({
-      level: 'error',
-      filename: `${logDir}/error-%DATE%.log`,
-      datePattern: 'YYYY-MM-DD',
-      zippedArchive: true,
-      maxSize: '20m',
-      maxFiles: '14d',
-      format: fileFormat,
-    }),
-  );
-
-  if (useDebugLogging) {
-    transports.push(
-      new winston.transports.DailyRotateFile({
-        level: 'debug',
-        filename: `${logDir}/debug-%DATE%.log`,
-        datePattern: 'YYYY-MM-DD',
-        zippedArchive: true,
-        maxSize: '20m',
-        maxFiles: '14d',
-        format: winston.format.combine(fileFormat, debugTraverse),
-      }),
-    );
-  }
-}
-
-const consoleFormat = winston.format.combine(
-  redactFormat(),
-  requestContextFormat(),
-  winston.format.colorize({ all: true }),
-  winston.format.timestamp({ format: 'YYYY-MM-DD HH:mm:ss' }),
-  // redactErrors(),
-  winston.format.printf((info) => {
-    const base = `${info.timestamp} ${info.level}: ${info.message}`;
-    const isErrorOrWarn = info.level.includes('error') || info.level.includes('warn');
-    const metaTrailer = isErrorOrWarn ? formatConsoleMeta(info) : formatRequestContext(info);
-    const line = metaTrailer ? `${base} ${metaTrailer}` : base;
-    return isErrorOrWarn ? redactMessage(line) : line;
-  }),
-);
-
-// Determine console log level
-let consoleLogLevel = 'info';
-if (useDebugConsole) {
-  consoleLogLevel = 'debug';
-}
-
-if (useDebugConsole) {
-  transports.push(
-    new winston.transports.Console({
-      level: consoleLogLevel,
-      format: useConsoleJson
-        ? winston.format.combine(fileFormat, jsonTruncateFormat(), winston.format.json())
-        : winston.format.combine(fileFormat, debugTraverse),
-    }),
-  );
-} else if (useConsoleJson) {
-  transports.push(
-    new winston.transports.Console({
-      level: consoleLogLevel,
-      format: winston.format.combine(fileFormat, jsonTruncateFormat(), winston.format.json()),
-    }),
-  );
-} else {
-  transports.push(
-    new winston.transports.Console({
-      level: consoleLogLevel,
-      format: consoleFormat,
-    }),
-  );
-}
-
-const logger = winston.createLogger({
-  level: level(),
-  levels,
-  transports,
-});
-
-module.exports = logger;
diff --git a/api/jest.config.js b/api/jest.config.js
index 47f8b7287bf..07588ea4554 100644
--- a/api/jest.config.js
+++ b/api/jest.config.js
@@ -1,3 +1,13 @@
+const esModules = [
+  'openid-client',
+  'oauth4webapi',
+  'jose',
+  '@langchain/langgraph',
+  '@langchain/langgraph-checkpoint',
+  '@langchain/langgraph-sdk',
+  'uuid',
+].join('|');
+
 module.exports = {
   testEnvironment: 'node',
   clearMocks: true,
@@ -12,5 +22,13 @@ module.exports = {
     '^openid-client/passport$': '<rootDir>/test/__mocks__/openid-client-passport.js',
     '^openid-client$': '<rootDir>/test/__mocks__/openid-client.js',
   },
-  transformIgnorePatterns: ['/node_modules/(?!(openid-client|oauth4webapi|jose)/).*/'],
+  transform: {
+    '\\.[jt]sx?$': [
+      'babel-jest',
+      {
+        presets: [['@babel/preset-env', { targets: { node: 'current' } }]],
+      },
+    ],
+  },
+  transformIgnorePatterns: [`/node_modules/(?!(${esModules})/).*/`],
 };
diff --git a/api/package.json b/api/package.json
index 9c4da2df2ea..74a73add47d 100644
--- a/api/package.json
+++ b/api/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@librechat/backend",
-  "version": "v0.8.6",
+  "version": "v0.8.7-rc1",
   "description": "",
   "scripts": {
     "start": "echo 'please run this from the root directory'",
@@ -44,9 +44,9 @@
     "@azure/identity": "^4.13.1",
     "@azure/search-documents": "^12.0.0",
     "@azure/storage-blob": "^12.30.0",
-    "@google/genai": "^2.0.1",
+    "@google/genai": "^2.8.0",
     "@keyv/redis": "^4.3.3",
-    "@librechat/agents": "^3.2.1",
+    "@librechat/agents": "^3.2.36",
     "@librechat/api": "*",
     "@librechat/data-schemas": "*",
     "@microsoft/microsoft-graph-client": "^3.0.7",
@@ -82,11 +82,13 @@
     "file-type": "^21.3.2",
     "firebase": "^11.0.2",
     "form-data": "^4.0.4",
+    "get-stream": "^6.0.1",
     "handlebars": "^4.7.9",
     "https-proxy-agent": "^7.0.6",
     "ioredis": "^5.3.2",
     "js-yaml": "^4.1.1",
     "jsonwebtoken": "^9.0.0",
+    "jszip": "^3.10.1",
     "jwks-rsa": "^3.2.0",
     "keyv": "^5.3.2",
     "keyv-file": "^5.1.2",
@@ -99,6 +101,7 @@
     "memorystore": "^1.6.7",
     "mime": "^3.0.0",
     "module-alias": "^2.2.3",
+    "mongodb": "^6.14.2",
     "mongoose": "^8.23.1",
     "multer": "^2.1.1",
     "nanoid": "^3.3.7",
@@ -121,7 +124,6 @@
     "rate-limit-redis": "^4.2.0",
     "sanitize-html": "^2.13.0",
     "sharp": "^0.33.5",
-    "traverse": "^0.6.7",
     "ua-parser-js": "^1.0.36",
     "undici": "^7.24.1",
     "winston": "^3.11.0",
@@ -131,6 +133,7 @@
     "zod": "^3.22.4"
   },
   "devDependencies": {
+    "@babel/preset-env": "^7.29.5",
     "@types/sanitize-html": "^2.13.0",
     "jest": "^30.2.0",
     "mongodb-memory-server": "^11.0.1",
diff --git a/api/server/controllers/AuthController.js b/api/server/controllers/AuthController.js
index 527728e98c0..b3743df8280 100644
--- a/api/server/controllers/AuthController.js
+++ b/api/server/controllers/AuthController.js
@@ -3,6 +3,7 @@ const jwt = require('jsonwebtoken');
 const openIdClient = require('openid-client');
 const { logger } = require('@librechat/data-schemas');
 const {
+  math,
   isEnabled,
   findOpenIDUser,
   getOpenIdIssuer,
@@ -28,8 +29,18 @@ const { getOpenIdConfig, getOpenIdEmail } = require('~/strategies');
 
 const AUTH_REFRESH_USER_PROJECTION = '-password -__v -totpSecret -backupCodes -federatedTokens';
 const OPENID_REUSE_EXPIRY_BUFFER_SECONDS = 30;
-/** Mirrors the default SESSION_EXPIRY to bound IdP revocation lag for session-token reuse. */
-const OPENID_REUSE_MAX_SESSION_AGE_MS = 15 * 60 * 1000;
+/**
+ * Max age (ms) LibreChat reuses a cached OpenID session token before forcing an IdP refresh.
+ * Env-overridable (accepts an arithmetic expression, e.g. `60 * 60 * 24 * 1000`, like
+ * `SESSION_EXPIRY`): deployments whose IdP revokes the previous access token on refresh can
+ * widen this to the access-token lifetime so a still-valid token is not rotated/revoked out
+ * from under downstream consumers (e.g. MCP servers that introspect the bearer). Defaults to
+ * 15 minutes.
+ */
+const OPENID_REUSE_MAX_SESSION_AGE_MS = math(
+  process.env.OPENID_REUSE_MAX_SESSION_AGE_MS,
+  15 * 60 * 1000,
+);
 
 const registrationController = async (req, res) => {
   try {
diff --git a/api/server/controllers/AuthController.spec.js b/api/server/controllers/AuthController.spec.js
index 7bed1da33bd..40c20bbbe18 100644
--- a/api/server/controllers/AuthController.spec.js
+++ b/api/server/controllers/AuthController.spec.js
@@ -22,6 +22,7 @@ jest.mock('~/models', () => ({
   findUser: jest.fn(),
 }));
 jest.mock('@librechat/api', () => ({
+  math: jest.fn((value, fallback) => fallback),
   isEnabled: jest.fn(),
   findOpenIDUser: jest.fn(),
   getOpenIdIssuer: jest.fn(() => 'https://issuer.example.com'),
diff --git a/api/server/controllers/ContextProjectionController.js b/api/server/controllers/ContextProjectionController.js
new file mode 100644
index 00000000000..eaf9592e73c
--- /dev/null
+++ b/api/server/controllers/ContextProjectionController.js
@@ -0,0 +1,31 @@
+const { logger } = require('@librechat/data-schemas');
+const { resolveContextProjection } = require('@librechat/api');
+const db = require('~/models');
+
+/**
+ * Returns a server-side context-usage projection for the viewed branch + config
+ * (agents SDK, no model call) — powers the gauge for snapshot-less branches and
+ * after a model/window switch. Resolution lives in `@librechat/api`; this
+ * controller only injects request-scoped model accessors.
+ * @param {ServerRequest} req
+ * @param {ServerResponse} res
+ */
+async function contextProjectionController(req, res) {
+  try {
+    const params = req.body ?? {};
+    if (!params.conversationId || !params.messageId) {
+      res.json(null);
+      return;
+    }
+    const projection = await resolveContextProjection(
+      { userId: req.user?.id, getMessages: db.getMessages },
+      params,
+    );
+    res.json(projection ?? null);
+  } catch (error) {
+    logger.error('[contextProjectionController]', error);
+    res.status(500).json({ error: 'Failed to resolve context projection' });
+  }
+}
+
+module.exports = contextProjectionController;
diff --git a/api/server/controllers/PermissionsController.js b/api/server/controllers/PermissionsController.js
index ffe159a82cc..076de31cf33 100644
--- a/api/server/controllers/PermissionsController.js
+++ b/api/server/controllers/PermissionsController.js
@@ -3,7 +3,7 @@
  */
 
 const mongoose = require('mongoose');
-const { logger } = require('@librechat/data-schemas');
+const { logger, getTenantId, SYSTEM_TENANT_ID } = require('@librechat/data-schemas');
 const { ResourceType, PrincipalType, PermissionBits } = require('librechat-data-provider');
 const { enrichRemoteAgentPrincipals, backfillRemoteAgentPermissions } = require('@librechat/api');
 const {
@@ -21,6 +21,13 @@ const {
 } = require('~/server/services/GraphApiService');
 const db = require('~/models');
 
+const matchesCurrentTenant = (principal, tenantId) => {
+  if (!tenantId || tenantId === SYSTEM_TENANT_ID) {
+    return true;
+  }
+  return principal?.tenantId === tenantId;
+};
+
 /**
  * Generic controller for resource permission endpoints
  * Delegates validation and logic to PermissionService
@@ -134,8 +141,8 @@ const updateResourcePermissions = async (req, res) => {
       revokedPrincipals.push(...removed);
     }
 
-    // If public is disabled, add public to revoked list
-    if (!isPublic) {
+    // If public is explicitly disabled, add public to revoked list
+    if (isPublic === false) {
       revokedPrincipals.push({
         type: PrincipalType.PUBLIC,
         id: null,
@@ -167,7 +174,7 @@ const updateResourcePermissions = async (req, res) => {
       message: 'Permissions updated successfully',
       results: {
         principals: results.granted,
-        public: isPublic || false,
+        ...(isPublic !== undefined ? { public: isPublic } : {}),
         publicAccessRoleId: isPublic ? publicAccessRoleId : undefined,
       },
     };
@@ -191,6 +198,7 @@ const getResourcePermissions = async (req, res) => {
   try {
     const { resourceType, resourceId } = req.params;
     validateResourceType(resourceType);
+    const tenantId = getTenantId();
 
     const results = await db.aggregateAclEntries([
       // Match ACL entries for this resource
@@ -244,14 +252,17 @@ const getResourcePermissions = async (req, res) => {
     let principals = [];
     let publicPermission = null;
 
-    // Process aggregation results
     for (const result of results) {
       if (result.principalType === PrincipalType.PUBLIC) {
         publicPermission = {
           public: true,
           publicAccessRoleId: result.accessRoleId,
         };
-      } else if (result.principalType === PrincipalType.USER && result.userInfo) {
+      } else if (
+        result.principalType === PrincipalType.USER &&
+        result.userInfo &&
+        matchesCurrentTenant(result.userInfo, tenantId)
+      ) {
         principals.push({
           type: PrincipalType.USER,
           id: result.userInfo._id.toString(),
@@ -262,7 +273,11 @@ const getResourcePermissions = async (req, res) => {
           idOnTheSource: result.userInfo.idOnTheSource || result.userInfo._id.toString(),
           accessRoleId: result.accessRoleId,
         });
-      } else if (result.principalType === PrincipalType.GROUP && result.groupInfo) {
+      } else if (
+        result.principalType === PrincipalType.GROUP &&
+        result.groupInfo &&
+        matchesCurrentTenant(result.groupInfo, tenantId)
+      ) {
         principals.push({
           type: PrincipalType.GROUP,
           id: result.groupInfo._id.toString(),
diff --git a/api/server/controllers/SkillStatesController.js b/api/server/controllers/SkillStatesController.js
index 35679d2ac6d..1afeb271413 100644
--- a/api/server/controllers/SkillStatesController.js
+++ b/api/server/controllers/SkillStatesController.js
@@ -5,6 +5,8 @@ const {
   toSkillStatesRecord,
   validateSkillStatesPayload,
   pruneOrphanSkillStates,
+  getDeploymentSkillIds,
+  mergeDeploymentSkillIds,
 } = require('@librechat/api');
 const { ResourceType, PermissionBits } = require('librechat-data-provider');
 const { findAccessibleResources } = require('~/server/services/PermissionService');
@@ -21,15 +23,20 @@ function buildPruneDeps(user) {
       const existing = await Skill.find({ _id: { $in: validIds } })
         .select('_id')
         .lean();
-      return existing.map((doc) => doc._id.toString());
+      const deploymentIds = getDeploymentSkillIds()
+        .map((id) => id.toString())
+        .filter((id) => validIds.includes(id));
+      return [...existing.map((doc) => doc._id.toString()), ...deploymentIds];
     },
-    findAccessibleSkillIds: () =>
-      findAccessibleResources({
-        userId: user.id,
-        role: user.role,
-        resourceType: ResourceType.SKILL,
-        requiredPermissions: PermissionBits.VIEW,
-      }),
+    findAccessibleSkillIds: async () =>
+      mergeDeploymentSkillIds(
+        await findAccessibleResources({
+          userId: user.id,
+          role: user.role,
+          resourceType: ResourceType.SKILL,
+          requiredPermissions: PermissionBits.VIEW,
+        }),
+      ),
   };
 }
 
diff --git a/api/server/controllers/TokenConfigController.js b/api/server/controllers/TokenConfigController.js
new file mode 100644
index 00000000000..059f1447f28
--- /dev/null
+++ b/api/server/controllers/TokenConfigController.js
@@ -0,0 +1,32 @@
+const { logger } = require('@librechat/data-schemas');
+const { resolveTokenConfigMap } = require('@librechat/api');
+const { getModelsConfig } = require('~/server/controllers/ModelController');
+const { getValueKey, getMultiplier, getCacheMultiplier } = require('~/models');
+
+/**
+ * Returns server-resolved context windows (and pricing when
+ * `interface.contextCost` is enabled) for every configured model. Resolution
+ * lives in `@librechat/api`; this controller only supplies request-scoped deps.
+ * @param {ServerRequest} req
+ * @param {ServerResponse} res
+ */
+async function tokenConfigController(req, res) {
+  try {
+    const modelsConfig = await getModelsConfig(req);
+    const tokenConfigMap = await resolveTokenConfigMap(
+      {
+        appConfig: req.config,
+        modelsConfig,
+        userId: req.user.id,
+        tenantId: req.user.tenantId,
+      },
+      { getValueKey, getMultiplier, getCacheMultiplier },
+    );
+    res.json(tokenConfigMap);
+  } catch (error) {
+    logger.error('[tokenConfigController]', error);
+    res.status(500).json({ error: 'Failed to resolve token config' });
+  }
+}
+
+module.exports = tokenConfigController;
diff --git a/api/server/controllers/UserController.js b/api/server/controllers/UserController.js
index ca560389e6a..5fd43b66d1e 100644
--- a/api/server/controllers/UserController.js
+++ b/api/server/controllers/UserController.js
@@ -1,5 +1,5 @@
 const mongoose = require('mongoose');
-const { logger, webSearchKeys } = require('@librechat/data-schemas');
+const { logger, getTenantId, webSearchKeys } = require('@librechat/data-schemas');
 const {
   getNewS3URL,
   needsRefresh,
@@ -7,6 +7,7 @@ const {
   MCPTokenStorage,
   normalizeHttpError,
   extractWebSearchEnvVars,
+  deleteAllSharedLinksWithCleanup,
 } = require('@librechat/api');
 const {
   Tools,
@@ -359,7 +360,7 @@ const deleteUserController = async (req, res) => {
     }
     await deleteUserPluginAuth(user.id, null, true);
     await db.deleteUserById(user.id);
-    await db.deleteAllSharedLinks(user.id);
+    await deleteAllSharedLinksWithCleanup(user.id);
     await deleteUserFiles(req);
     await db.deleteFiles(null, user.id);
     await db.deleteToolCalls(user.id);
@@ -387,7 +388,7 @@ const verifyEmailController = async (req, res) => {
   try {
     const verifyEmailService = await verifyEmail(req);
     if (verifyEmailService instanceof Error) {
-      return res.status(400).json(verifyEmailService);
+      return res.status(400).json({ message: verifyEmailService.message });
     } else {
       return res.status(200).json(verifyEmailService);
     }
@@ -401,9 +402,9 @@ const resendVerificationController = async (req, res) => {
   try {
     const result = await resendVerificationEmail(req);
     if (result instanceof Error) {
-      return res.status(400).json(result);
+      return res.status(400).json({ message: result.message });
     } else {
-      return res.status(200).json(result);
+      return res.status(result.status ?? 200).json({ message: result.message });
     }
   } catch (e) {
     logger.error('[verifyEmailController]', e);
@@ -431,11 +432,24 @@ const clearStoredMCPOAuthState = async (userId, serverName) => {
   try {
     const flowsCache = getLogStores(CacheKeys.FLOWS);
     const flowManager = getFlowStateManager(flowsCache);
-    const flowId = MCPOAuthHandler.generateFlowId(userId, serverName);
-    const results = await Promise.allSettled([
-      flowManager.deleteFlow(flowId, 'mcp_get_tokens'),
-      flowManager.deleteFlow(flowId, 'mcp_oauth'),
-    ]);
+    const baseFlowId = MCPOAuthHandler.generateFlowId(userId, serverName);
+    const tenantId = getTenantId();
+    const tokenFlowId = MCPOAuthHandler.generateTokenFlowId(userId, serverName, tenantId);
+    const oauthFlowId = MCPOAuthHandler.generateFlowId(userId, serverName, tenantId);
+    const flowDeletes = [
+      [tokenFlowId, 'mcp_get_tokens'],
+      [oauthFlowId, 'mcp_oauth'],
+      [baseFlowId, 'mcp_get_tokens'],
+      [baseFlowId, 'mcp_oauth'],
+    ].filter(
+      ([flowId, type], index, deletes) =>
+        deletes.findIndex(([candidateId, candidateType]) => {
+          return candidateId === flowId && candidateType === type;
+        }) === index,
+    );
+    const results = await Promise.allSettled(
+      flowDeletes.map(([flowId, type]) => flowManager.deleteFlow(flowId, type)),
+    );
     for (const result of results) {
       if (result.status === 'rejected') {
         logger.warn(
@@ -516,9 +530,10 @@ const maybeUninstallOAuthMCP = async (userId, pluginKey, appConfig) => {
     serverConfig.oauth?.revocation_endpoint_auth_methods_supported ??
     clientMetadata.revocation_endpoint_auth_methods_supported;
   const oauthHeaders = serverConfig.oauth_headers ?? {};
-  const registry = getMCPServersRegistry();
-  const allowedDomains = registry.getAllowedDomains();
-  const allowedAddresses = registry.getAllowedAddresses();
+  // Use the request's merged (tenant/principal-scoped) allowlists so admin-panel mcpSettings
+  // overrides are honored for OAuth revocation, consistent with inspection/connection.
+  const allowedDomains = appConfig?.mcpSettings?.allowedDomains;
+  const allowedAddresses = appConfig?.mcpSettings?.allowedAddresses;
 
   if (tokens?.access_token) {
     try {
diff --git a/api/server/controllers/UserController.spec.js b/api/server/controllers/UserController.spec.js
index 4dd2efaa7ba..6a165fe7182 100644
--- a/api/server/controllers/UserController.spec.js
+++ b/api/server/controllers/UserController.spec.js
@@ -108,9 +108,49 @@ afterEach(async () => {
   }
 });
 
-const { deleteUserController, getUserController } = require('./UserController');
+const {
+  deleteUserController,
+  getUserController,
+  resendVerificationController,
+  verifyEmailController,
+} = require('./UserController');
 const { Group } = require('~/db/models');
 const { deleteConvos } = require('~/models');
+const { verifyEmail, resendVerificationEmail } = require('~/server/services/AuthService');
+
+describe('verifyEmailController', () => {
+  const mockRes = {
+    status: jest.fn().mockReturnThis(),
+    json: jest.fn().mockReturnThis(),
+  };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('returns the generic verification error message from service failures', async () => {
+    verifyEmail.mockResolvedValue(new Error('Invalid or expired email verification token'));
+
+    await verifyEmailController(
+      { body: { email: 'user%40example.com', token: 'not-the-token' } },
+      mockRes,
+    );
+
+    expect(mockRes.status).toHaveBeenCalledWith(400);
+    expect(mockRes.json).toHaveBeenCalledWith({
+      message: 'Invalid or expired email verification token',
+    });
+  });
+
+  it('uses the service status for resend verification responses', async () => {
+    resendVerificationEmail.mockResolvedValue({ status: 500, message: 'Something went wrong.' });
+
+    await resendVerificationController({ body: { email: 'user@example.com' } }, mockRes);
+
+    expect(mockRes.status).toHaveBeenCalledWith(500);
+    expect(mockRes.json).toHaveBeenCalledWith({ message: 'Something went wrong.' });
+  });
+});
 
 describe('getUserController', () => {
   const mockRes = {
diff --git a/api/server/controllers/__tests__/PermissionsController.spec.js b/api/server/controllers/__tests__/PermissionsController.spec.js
index 6c42ccc59b5..5976f9b29a5 100644
--- a/api/server/controllers/__tests__/PermissionsController.spec.js
+++ b/api/server/controllers/__tests__/PermissionsController.spec.js
@@ -1,12 +1,16 @@
 const mongoose = require('mongoose');
 
 const mockLogger = { error: jest.fn(), warn: jest.fn(), info: jest.fn(), debug: jest.fn() };
+const mockGetTenantId = jest.fn();
 
 jest.mock('@librechat/data-schemas', () => ({
   logger: mockLogger,
+  getTenantId: mockGetTenantId,
+  SYSTEM_TENANT_ID: '__SYSTEM__',
 }));
 
-const { ResourceType, PrincipalType } = jest.requireActual('librechat-data-provider');
+const { AccessRoleIds, ResourceType, PrincipalType } =
+  jest.requireActual('librechat-data-provider');
 
 jest.mock('librechat-data-provider', () => ({
   ...jest.requireActual('librechat-data-provider'),
@@ -32,6 +36,7 @@ jest.mock('~/server/services/PermissionService', () => ({
 const mockRemoveAgentFromUserFavorites = jest.fn();
 
 jest.mock('~/models', () => ({
+  aggregateAclEntries: jest.fn(),
   searchPrincipals: jest.fn(),
   sortPrincipalsByRelevance: jest.fn(),
   calculateRelevanceScore: jest.fn(),
@@ -44,7 +49,11 @@ jest.mock('~/server/services/GraphApiService', () => ({
 }));
 
 const db = require('~/models');
-const { updateResourcePermissions, searchPrincipals } = require('../PermissionsController');
+const {
+  updateResourcePermissions,
+  searchPrincipals,
+  getResourcePermissions,
+} = require('../PermissionsController');
 
 const createMockReq = (overrides = {}) => ({
   params: { resourceType: ResourceType.AGENT, resourceId: '507f1f77bcf86cd799439011' },
@@ -66,6 +75,7 @@ const flushPromises = () => new Promise((resolve) => setImmediate(resolve));
 describe('PermissionsController', () => {
   beforeEach(() => {
     jest.clearAllMocks();
+    mockGetTenantId.mockReturnValue(undefined);
   });
 
   describe('searchPrincipals', () => {
@@ -139,6 +149,108 @@ describe('PermissionsController', () => {
     });
   });
 
+  describe('getResourcePermissions — principal details', () => {
+    const currentTenantId = 'tenant-a';
+    const otherTenantId = 'tenant-b';
+    const userId = new mongoose.Types.ObjectId();
+    const groupId = new mongoose.Types.ObjectId();
+
+    it('omits joined user and group details outside the current request context', async () => {
+      mockGetTenantId.mockReturnValue(currentTenantId);
+      db.aggregateAclEntries.mockResolvedValue([
+        {
+          principalType: PrincipalType.USER,
+          accessRoleId: AccessRoleIds.AGENT_VIEWER,
+          userInfo: {
+            _id: userId,
+            tenantId: otherTenantId,
+            name: 'Outside User',
+            email: 'outside-user@example.com',
+            avatar: 'outside-user.png',
+          },
+        },
+        {
+          principalType: PrincipalType.GROUP,
+          accessRoleId: AccessRoleIds.AGENT_VIEWER,
+          groupInfo: {
+            _id: groupId,
+            tenantId: otherTenantId,
+            name: 'Outside Group',
+            email: 'outside-group@example.com',
+            avatar: 'outside-group.png',
+          },
+        },
+        {
+          principalType: PrincipalType.PUBLIC,
+          accessRoleId: AccessRoleIds.AGENT_VIEWER,
+        },
+      ]);
+
+      const req = createMockReq();
+      const res = createMockRes();
+
+      await getResourcePermissions(req, res);
+
+      expect(res.status).toHaveBeenCalledWith(200);
+      expect(res.json).toHaveBeenCalledWith({
+        resourceType: ResourceType.AGENT,
+        resourceId: req.params.resourceId,
+        principals: [],
+        public: true,
+        publicAccessRoleId: AccessRoleIds.AGENT_VIEWER,
+      });
+      expect(JSON.stringify(res.json.mock.calls[0][0])).not.toContain('outside-user@example.com');
+      expect(JSON.stringify(res.json.mock.calls[0][0])).not.toContain('outside-group@example.com');
+    });
+
+    it('includes joined user and group details in the current request context', async () => {
+      mockGetTenantId.mockReturnValue(currentTenantId);
+      db.aggregateAclEntries.mockResolvedValue([
+        {
+          principalType: PrincipalType.USER,
+          accessRoleId: AccessRoleIds.AGENT_VIEWER,
+          userInfo: {
+            _id: userId,
+            tenantId: currentTenantId,
+            name: 'Current User',
+            email: 'current-user@example.com',
+            avatar: 'current-user.png',
+          },
+        },
+        {
+          principalType: PrincipalType.GROUP,
+          accessRoleId: AccessRoleIds.AGENT_VIEWER,
+          groupInfo: {
+            _id: groupId,
+            tenantId: currentTenantId,
+            name: 'Current Group',
+            email: 'current-group@example.com',
+            avatar: 'current-group.png',
+          },
+        },
+      ]);
+
+      const req = createMockReq();
+      const res = createMockRes();
+
+      await getResourcePermissions(req, res);
+
+      expect(res.status).toHaveBeenCalledWith(200);
+      expect(res.json.mock.calls[0][0].principals).toEqual([
+        expect.objectContaining({
+          type: PrincipalType.USER,
+          id: userId.toString(),
+          email: 'current-user@example.com',
+        }),
+        expect.objectContaining({
+          type: PrincipalType.GROUP,
+          id: groupId.toString(),
+          email: 'current-group@example.com',
+        }),
+      ]);
+    });
+  });
+
   describe('updateResourcePermissions — favorites cleanup', () => {
     const agentObjectId = new mongoose.Types.ObjectId().toString();
     const revokedUserId = new mongoose.Types.ObjectId().toString();
diff --git a/api/server/controllers/__tests__/UserController.mcpOAuth.spec.js b/api/server/controllers/__tests__/UserController.mcpOAuth.spec.js
index ef605beaab7..c5457d468c7 100644
--- a/api/server/controllers/__tests__/UserController.mcpOAuth.spec.js
+++ b/api/server/controllers/__tests__/UserController.mcpOAuth.spec.js
@@ -10,6 +10,7 @@ const mockGetMCPServersRegistry = jest.fn();
 
 jest.mock('@librechat/data-schemas', () => ({
   logger: { error: jest.fn(), info: jest.fn(), warn: jest.fn() },
+  getTenantId: jest.fn(),
   webSearchKeys: [],
 }));
 
@@ -22,7 +23,14 @@ jest.mock('librechat-data-provider', () => ({
 
 jest.mock('@librechat/api', () => ({
   MCPOAuthHandler: {
-    generateFlowId: jest.fn(() => 'user-1:test-server'),
+    generateFlowId: jest.fn((userId, serverName, tenantId) => {
+      const flowId = `${userId}:${serverName}`;
+      return tenantId ? `tenant:${encodeURIComponent(tenantId)}:${flowId}` : flowId;
+    }),
+    generateTokenFlowId: jest.fn((userId, serverName, tenantId) => {
+      const flowId = `${userId}:${serverName}`;
+      return tenantId ? `tenant:${encodeURIComponent(tenantId)}:${flowId}` : flowId;
+    }),
     revokeOAuthToken: jest.fn(),
   },
   MCPTokenStorage: {
@@ -78,7 +86,7 @@ jest.mock('~/cache', () => ({
   getLogStores: (...args) => mockGetLogStores(...args),
 }));
 
-const { logger } = require('@librechat/data-schemas');
+const { logger, getTenantId } = require('@librechat/data-schemas');
 const { MCPTokenStorage, MCPOAuthHandler } = require('@librechat/api');
 const { updateUserPluginsController } = require('~/server/controllers/UserController');
 
@@ -124,7 +132,10 @@ function setupMCPMocks() {
     getAllowedAddresses: jest.fn().mockReturnValue(null),
   };
 
-  mockGetAppConfig.mockResolvedValue({});
+  // Revocation reads the merged config's mcpSettings allowlists (not the registry getters).
+  mockGetAppConfig.mockResolvedValue({
+    mcpSettings: { allowedDomains: [], allowedAddresses: null },
+  });
   mockUpdateUserPlugins.mockResolvedValue();
   mockDeleteUserPluginAuth.mockResolvedValue();
   mockInvalidateCachedTools.mockResolvedValue();
@@ -138,6 +149,7 @@ function setupMCPMocks() {
 
 beforeEach(() => {
   jest.clearAllMocks();
+  getTenantId.mockReturnValue(undefined);
 });
 
 describe('updateUserPluginsController MCP OAuth cleanup', () => {
@@ -231,6 +243,27 @@ describe('updateUserPluginsController MCP OAuth cleanup', () => {
     expect(MCPOAuthHandler.revokeOAuthToken).not.toHaveBeenCalled();
   });
 
+  it('clears tenant-scoped and legacy OAuth flow state when tenant context exists', async () => {
+    const { flowManager } = setupMCPMocks();
+    getTenantId.mockReturnValue('tenant-a');
+    MCPTokenStorage.getClientInfoAndMetadata.mockResolvedValue(null);
+
+    const res = createResponse();
+    await updateUserPluginsController(createRequest(), res);
+
+    expect(res.status).toHaveBeenCalledWith(200);
+    expect(flowManager.deleteFlow).toHaveBeenCalledWith(
+      'tenant:tenant-a:user-1:test-server',
+      'mcp_get_tokens',
+    );
+    expect(flowManager.deleteFlow).toHaveBeenCalledWith(
+      'tenant:tenant-a:user-1:test-server',
+      'mcp_oauth',
+    );
+    expect(flowManager.deleteFlow).toHaveBeenCalledWith('user-1:test-server', 'mcp_get_tokens');
+    expect(flowManager.deleteFlow).toHaveBeenCalledWith('user-1:test-server', 'mcp_oauth');
+  });
+
   it('clears stored OAuth token state when server config is missing', async () => {
     const { flowManager, registry } = setupMCPMocks();
     registry.getServerConfig.mockResolvedValue(undefined);
diff --git a/api/server/controllers/__tests__/deleteUser.spec.js b/api/server/controllers/__tests__/deleteUser.spec.js
index 1d7c8521531..6198122bd05 100644
--- a/api/server/controllers/__tests__/deleteUser.spec.js
+++ b/api/server/controllers/__tests__/deleteUser.spec.js
@@ -3,6 +3,7 @@ const mockDeleteMessages = jest.fn();
 const mockDeleteAllUserSessions = jest.fn();
 const mockDeleteUserById = jest.fn();
 const mockDeleteAllSharedLinks = jest.fn();
+const mockDeleteAllSharedLinksWithCleanup = jest.fn();
 const mockDeletePresets = jest.fn();
 const mockDeleteUserKey = jest.fn();
 const mockDeleteConvos = jest.fn();
@@ -38,6 +39,7 @@ jest.mock('@librechat/api', () => ({
   extractWebSearchEnvVars: jest.fn(),
   needsRefresh: jest.fn(),
   getNewS3URL: jest.fn(),
+  deleteAllSharedLinksWithCleanup: (...args) => mockDeleteAllSharedLinksWithCleanup(...args),
 }));
 
 jest.mock('~/models', () => ({
@@ -126,6 +128,7 @@ function stubDeletionMocks() {
   mockDeleteUserPluginAuth.mockResolvedValue();
   mockDeleteUserById.mockResolvedValue();
   mockDeleteAllSharedLinks.mockResolvedValue();
+  mockDeleteAllSharedLinksWithCleanup.mockResolvedValue({ deletedCount: 0 });
   mockGetFiles.mockResolvedValue([]);
   mockProcessDeleteRequest.mockResolvedValue({ deletedFileIds: [], failedFileIds: [] });
   mockDeleteFiles.mockResolvedValue();
diff --git a/api/server/controllers/__tests__/deleteUserResourceCoverage.spec.js b/api/server/controllers/__tests__/deleteUserResourceCoverage.spec.js
index 78fcfa16b0b..1bd5b2efaa5 100644
--- a/api/server/controllers/__tests__/deleteUserResourceCoverage.spec.js
+++ b/api/server/controllers/__tests__/deleteUserResourceCoverage.spec.js
@@ -16,6 +16,7 @@ const HANDLED_RESOURCE_TYPES = {
   [ResourceType.PROMPTGROUP]: 'deleteUserPrompts',
   [ResourceType.MCPSERVER]: 'deleteUserMcpServers',
   [ResourceType.SKILL]: 'deleteUserSkills',
+  [ResourceType.SHARED_LINK]: 'deleteAllSharedLinksWithCleanup',
 };
 
 /**
diff --git a/api/server/controllers/__tests__/maybeUninstallOAuthMCP.spec.js b/api/server/controllers/__tests__/maybeUninstallOAuthMCP.spec.js
index fd591aa440f..1b8436233a5 100644
--- a/api/server/controllers/__tests__/maybeUninstallOAuthMCP.spec.js
+++ b/api/server/controllers/__tests__/maybeUninstallOAuthMCP.spec.js
@@ -13,9 +13,11 @@ const mockDeleteTokens = jest.fn();
 const mockLoggerInfo = jest.fn();
 const mockLoggerWarn = jest.fn();
 const mockLoggerError = jest.fn();
+const mockGetTenantId = jest.fn();
 
 jest.mock('@librechat/data-schemas', () => ({
   logger: { info: mockLoggerInfo, warn: mockLoggerWarn, error: mockLoggerError },
+  getTenantId: (...args) => mockGetTenantId(...args),
   webSearchKeys: [],
 }));
 
@@ -23,7 +25,14 @@ jest.mock('@librechat/api', () => {
   return {
     MCPOAuthHandler: {
       revokeOAuthToken: (...args) => mockRevokeOAuthToken(...args),
-      generateFlowId: (userId, serverName) => `${userId}:${serverName}`,
+      generateFlowId: (userId, serverName, tenantId) => {
+        const flowId = `${userId}:${serverName}`;
+        return tenantId ? `tenant:${encodeURIComponent(tenantId)}:${flowId}` : flowId;
+      },
+      generateTokenFlowId: (userId, serverName, tenantId) => {
+        const flowId = `${userId}:${serverName}`;
+        return tenantId ? `tenant:${encodeURIComponent(tenantId)}:${flowId}` : flowId;
+      },
     },
     MCPTokenStorage: {
       getTokens: (...args) => mockGetTokens(...args),
@@ -151,6 +160,7 @@ function setupOAuthServerFound() {
 describe('maybeUninstallOAuthMCP', () => {
   beforeEach(() => {
     jest.clearAllMocks();
+    mockGetTenantId.mockReturnValue(undefined);
   });
 
   test('is a no-op when pluginKey is not an MCP key', async () => {
@@ -205,6 +215,20 @@ describe('maybeUninstallOAuthMCP', () => {
     );
   });
 
+  test('clears tenant-scoped and legacy flow state when tenant context exists', async () => {
+    setupOAuthServerFound();
+    mockGetTenantId.mockReturnValue('tenant-a');
+    mockGetClientInfoAndMetadata.mockResolvedValue(null);
+
+    await maybeUninstallOAuthMCP(userId, pluginKey, appConfig);
+
+    expect(mockDeleteFlow).toHaveBeenCalledTimes(4);
+    expect(mockDeleteFlow).toHaveBeenCalledWith('tenant:tenant-a:user-123:acme', 'mcp_get_tokens');
+    expect(mockDeleteFlow).toHaveBeenCalledWith('tenant:tenant-a:user-123:acme', 'mcp_oauth');
+    expect(mockDeleteFlow).toHaveBeenCalledWith('user-123:acme', 'mcp_get_tokens');
+    expect(mockDeleteFlow).toHaveBeenCalledWith('user-123:acme', 'mcp_oauth');
+  });
+
   test('revokes both tokens and runs cleanup on happy path', async () => {
     setupOAuthServerFound();
     mockGetTokens.mockResolvedValue({
diff --git a/api/server/controllers/agents/__tests__/callbacks.spec.js b/api/server/controllers/agents/__tests__/callbacks.spec.js
index 0ba20d409cd..20fcf54a6cd 100644
--- a/api/server/controllers/agents/__tests__/callbacks.spec.js
+++ b/api/server/controllers/agents/__tests__/callbacks.spec.js
@@ -7,6 +7,10 @@ jest.mock('nanoid', () => ({
 
 jest.mock('@librechat/api', () => ({
   sendEvent: jest.fn(),
+  HOST_FILE_AUTHORING_ARTIFACT_KEY: '__librechat_file_authoring',
+  isCodeSessionToolName: jest.fn((name) =>
+    ['execute_code', 'bash_tool', 'read_file'].includes(name),
+  ),
 }));
 
 jest.mock('@librechat/data-schemas', () => ({
@@ -364,12 +368,21 @@ describe('createToolEndCallback', () => {
 
     const { processCodeOutput } = require('~/server/services/Files/Code/process');
 
-    function makeCodeExecutionEvent({ runId, threadId, toolCallId, fileId, name }) {
+    function makeCodeExecutionEvent({
+      runId,
+      threadId,
+      toolCallId,
+      fileId,
+      name,
+      toolName = 'execute_code',
+      hostFileAuthoring = false,
+    }) {
       return {
         output: {
-          name: 'execute_code',
+          name: toolName,
           tool_call_id: toolCallId,
           artifact: {
+            ...(hostFileAuthoring ? { __librechat_file_authoring: true } : {}),
             session_id: 'sess-1',
             files: [{ id: fileId, name, session_id: 'sess-1' }],
           },
@@ -573,6 +586,65 @@ describe('createToolEndCallback', () => {
 
       expect(res.write).toHaveBeenCalledTimes(1);
     });
+
+    it('processes create_file sandbox artifacts like code execution outputs', async () => {
+      res.headersSent = true;
+      processCodeOutput.mockResolvedValue({
+        file: {
+          file_id: 'fid-created',
+          filename: 'created.txt',
+          filepath: '/uploads/created.txt',
+          type: 'text/plain',
+          conversationId: 'thread789',
+          messageId: 'run-create',
+          toolCallId: 'tool-create',
+          status: 'ready',
+        },
+      });
+
+      const toolEndCallback = createToolEndCallback({ req, res, artifactPromises });
+      const event = makeCodeExecutionEvent({
+        runId: 'run-create',
+        threadId: 'thread789',
+        toolCallId: 'tool-create',
+        fileId: 'fid-created',
+        name: 'created.txt',
+        toolName: 'create_file',
+        hostFileAuthoring: true,
+      });
+      await toolEndCallback({ output: event.output }, event.metadata);
+      await Promise.all(artifactPromises);
+
+      expect(processCodeOutput).toHaveBeenCalledWith(
+        expect.objectContaining({
+          id: 'fid-created',
+          name: 'created.txt',
+          messageId: 'run-create',
+          toolCallId: 'tool-create',
+          conversationId: 'thread789',
+        }),
+      );
+      expect(res.write).toHaveBeenCalledTimes(1);
+    });
+
+    it('does not process arbitrary user tool artifacts named create_file as code outputs', async () => {
+      res.headersSent = true;
+      const toolEndCallback = createToolEndCallback({ req, res, artifactPromises });
+      const event = makeCodeExecutionEvent({
+        runId: 'run-user-create',
+        threadId: 'thread789',
+        toolCallId: 'tool-user-create',
+        fileId: 'fid-user-created',
+        name: 'created.txt',
+        toolName: 'create_file',
+      });
+
+      await toolEndCallback({ output: event.output }, event.metadata);
+      await Promise.all(artifactPromises);
+
+      expect(processCodeOutput).not.toHaveBeenCalled();
+      expect(res.write).not.toHaveBeenCalled();
+    });
   });
 });
 
diff --git a/api/server/controllers/agents/__tests__/client.contextMetadata.spec.js b/api/server/controllers/agents/__tests__/client.contextMetadata.spec.js
new file mode 100644
index 00000000000..6df38efb6c5
--- /dev/null
+++ b/api/server/controllers/agents/__tests__/client.contextMetadata.spec.js
@@ -0,0 +1,139 @@
+const AgentClient = require('../client');
+
+/** Minimal post-(maybe-)summary snapshot. baseUsed = maxContextTokens(1000) -
+ *  remainingContextTokens(700) = 300, so the marker (summaryUsedTokens) is 300. */
+const snapshot = (summaryTokens) => ({
+  runId: 'run-1',
+  agentId: 'agent-1',
+  breakdown: {
+    maxContextTokens: 1000,
+    instructionTokens: 50,
+    systemMessageTokens: 50,
+    dynamicInstructionTokens: 0,
+    toolSchemaTokens: 0,
+    summaryTokens,
+    toolCount: 0,
+    messageCount: 1,
+    messageTokens: 20,
+    availableForMessages: 900,
+  },
+  contextBudget: 1000,
+  remainingContextTokens: 700,
+  prePruneContextTokens: 300,
+  effectiveInstructionTokens: 50,
+  calibrationRatio: 1,
+});
+
+const primary = { input_tokens: 10, output_tokens: 5, total_tokens: 15 };
+const summarizationUsage = { ...primary, usage_type: 'summarization' };
+const primaryFor = (runId, output_tokens) => ({
+  input_tokens: 10,
+  output_tokens,
+  total_tokens: 10 + output_tokens,
+  provider: 'openAI',
+  runId,
+});
+
+function buildMeta({ snap, latestUsageIndex, usageEvents }) {
+  const self = {
+    collectedThoughtSignatures: null,
+    usageEmitSink: usageEvents,
+    contextUsageSink: snap
+      ? { latest: snap, count: 1, latestUsageIndex }
+      : { latest: null, count: 0 },
+  };
+  return AgentClient.prototype.buildResponseMetadata.call(self);
+}
+
+describe('AgentClient.buildResponseMetadata — snapshot persistence + summary marker', () => {
+  it('persists the snapshot when a primary usage follows it (normal turn)', () => {
+    const meta = buildMeta({ snap: snapshot(0), latestUsageIndex: 0, usageEvents: [primary] });
+    expect(meta.contextUsage).toBeDefined();
+    expect(meta.summaryUsedTokens).toBeUndefined();
+  });
+
+  it('persists the post-summary snapshot when the only pre-primary usage is the summarization', () => {
+    /** A summarized turn: the summarization usage precedes the post-summary
+     *  snapshot (index 1), then the model's primary usage follows it. The old
+     *  count guard miscounted and dropped this; the new guard keeps it. The
+     *  marker subtracts the summarization output (5): the generated summary is in
+     *  the snapshot baseline (summaryTokens) AND the response tokenCount, so
+     *  300 − 5 = 295 keeps the client estimate from counting it twice. */
+    const meta = buildMeta({
+      snap: snapshot(80),
+      latestUsageIndex: 1,
+      usageEvents: [summarizationUsage, primary],
+    });
+    expect(meta.contextUsage).toBeDefined();
+    expect(meta.summaryUsedTokens).toBe(295);
+  });
+
+  it('still emits the summary marker when the final call emitted no usage', () => {
+    /** Interrupted summarized turn: no primary usage follows the latest snapshot,
+     *  so the snapshot is (correctly) not persisted — but the coarse marker
+     *  survives so the client estimate still caps the discarded history. The
+     *  summarization output (5) is subtracted (300 − 5 = 295). */
+    const meta = buildMeta({
+      snap: snapshot(80),
+      latestUsageIndex: 1,
+      usageEvents: [summarizationUsage],
+    });
+    expect(meta.contextUsage).toBeUndefined();
+    expect(meta.summaryUsedTokens).toBe(295);
+  });
+
+  it('drops the snapshot and emits no marker when the final call had no usage and no summary', () => {
+    const meta = buildMeta({ snap: snapshot(0), latestUsageIndex: 1, usageEvents: [primary] });
+    expect(meta.contextUsage).toBeUndefined();
+    expect(meta.summaryUsedTokens).toBeUndefined();
+  });
+
+  it('does not persist the snapshot when only a parallel run produced post-snapshot usage', () => {
+    /** A snapshot (run-1) → B snapshot (run-1 is latest) but the only following
+     *  usage belongs to a sibling run (run-2). The guard must NOT persist run-1's
+     *  snapshot with run-2's output — it falls back to the per-message estimate. */
+    const meta = buildMeta({
+      snap: snapshot(0),
+      latestUsageIndex: 0,
+      usageEvents: [primaryFor('run-2', 99)],
+    });
+    expect(meta.contextUsage).toBeUndefined();
+  });
+
+  it('persists with the snapshot run output when its own primary usage follows', () => {
+    const meta = buildMeta({
+      snap: snapshot(0),
+      latestUsageIndex: 0,
+      usageEvents: [primaryFor('run-2', 99), primaryFor('run-1', 7)],
+    });
+    expect(meta.contextUsage).toBeDefined();
+    expect(meta.contextUsage.completedOutputTokens).toBe(7);
+  });
+
+  it('subtracts earlier tool-loop output from the summary marker (interrupted turn)', () => {
+    /** Multi-call summarized turn stopped before the final usage: the earlier
+     *  call (output 40) is baked into baseUsed (300), so the marker is 300 − 40 =
+     *  260. No primary follows the snapshot, so the full snapshot is not persisted
+     *  and the client uses this marker — which must not double-count the 40 that
+     *  the response tokenCount also carries. */
+    const meta = buildMeta({
+      snap: snapshot(80),
+      latestUsageIndex: 1,
+      usageEvents: [primaryFor('run-1', 40)],
+    });
+    expect(meta.contextUsage).toBeUndefined();
+    expect(meta.summaryUsedTokens).toBe(260);
+  });
+
+  it('subtracts only this run’s earlier output, not a parallel run’s', () => {
+    const meta = buildMeta({
+      snap: snapshot(80),
+      latestUsageIndex: 2,
+      usageEvents: [primaryFor('run-2', 999), primaryFor('run-1', 40), primaryFor('run-1', 5)],
+    });
+    /** baseUsed 300 − run-1's earlier 40 = 260; run-2's 999 is ignored. */
+    expect(meta.summaryUsedTokens).toBe(260);
+    /** run-1's own primary follows the snapshot → snapshot persisted with output 5. */
+    expect(meta.contextUsage.completedOutputTokens).toBe(5);
+  });
+});
diff --git a/api/server/controllers/agents/__tests__/modelEndHandler.spec.js b/api/server/controllers/agents/__tests__/modelEndHandler.spec.js
index fdd2c88b6c8..07c55e7a547 100644
--- a/api/server/controllers/agents/__tests__/modelEndHandler.spec.js
+++ b/api/server/controllers/agents/__tests__/modelEndHandler.spec.js
@@ -150,6 +150,45 @@ describe('ModelEndHandler — Vertex thoughtSignature capture (issue #13006 foll
     expect(collectedThoughtSignatures).toEqual({});
   });
 
+  it('tags the producing agent on collected + emitted usage for per-endpoint pricing', async () => {
+    const collectedUsage = [];
+    const emitUsage = jest.fn();
+    const handler = new ModelEndHandler(collectedUsage, null, emitUsage);
+    const graph = {
+      getAgentContext: () => ({
+        provider: 'openai',
+        agentId: 'agent_sub',
+        clientOptions: { model: 'gpt-4' },
+      }),
+    };
+
+    await handler.handle(
+      'on_chat_model_end',
+      { output: { usage_metadata: { input_tokens: 10, output_tokens: 5, total_tokens: 15 } } },
+      { ls_model_name: 'gpt-4', run_id: 'r1', user_id: 'u1' },
+      graph,
+    );
+
+    expect(collectedUsage[0].agentId).toBe('agent_sub');
+    expect(emitUsage).toHaveBeenCalledWith(expect.objectContaining({ agentId: 'agent_sub' }));
+  });
+
+  it('leaves usage untagged when the graph context has no agentId (single-endpoint)', async () => {
+    const collectedUsage = [];
+    const emitUsage = jest.fn();
+    const handler = new ModelEndHandler(collectedUsage, null, emitUsage);
+
+    await handler.handle(
+      'on_chat_model_end',
+      { output: { usage_metadata: { input_tokens: 10, output_tokens: 5, total_tokens: 15 } } },
+      { ls_model_name: 'gemini-3.1-flash-lite-preview', run_id: 'r1', user_id: 'u1' },
+      buildGraph(),
+    );
+
+    expect(collectedUsage[0].agentId).toBeUndefined();
+    expect(emitUsage).toHaveBeenCalledWith(expect.objectContaining({ agentId: undefined }));
+  });
+
   it('throws when collectedUsage is not an array (existing contract)', () => {
     expect(() => new ModelEndHandler(null)).toThrow('collectedUsage must be an array');
   });
diff --git a/api/server/controllers/agents/__tests__/openai.spec.js b/api/server/controllers/agents/__tests__/openai.spec.js
index 7638fc2e35d..8b6910fe35b 100644
--- a/api/server/controllers/agents/__tests__/openai.spec.js
+++ b/api/server/controllers/agents/__tests__/openai.spec.js
@@ -11,6 +11,50 @@ const mockRecordCollectedUsage = jest
   .mockResolvedValue({ input_tokens: 100, output_tokens: 50 });
 const mockGetBalanceConfig = jest.fn().mockReturnValue({ enabled: true });
 const mockGetTransactionsConfig = jest.fn().mockReturnValue({ enabled: true });
+const mockBuildSkillPrimedIdsByName = jest.fn((manualSkillPrimes, alwaysApplySkillPrimes) => {
+  const primed = {};
+  for (const skill of alwaysApplySkillPrimes ?? []) {
+    primed[skill.name] = skill._id.toString();
+  }
+  for (const skill of manualSkillPrimes ?? []) {
+    primed[skill.name] = skill._id.toString();
+  }
+  return Object.keys(primed).length > 0 ? primed : undefined;
+});
+const mockEnrichWithSkillConfigurable = jest.fn((result) => result);
+const mockBuildAgentToolContext = jest.fn(({ agent, config }) => ({
+  agent,
+  toolRegistry: config.toolRegistry,
+  userMCPAuthMap: config.userMCPAuthMap,
+  tool_resources: config.tool_resources,
+  actionsEnabled: config.actionsEnabled,
+  accessibleSkillIds: config.accessibleSkillIds,
+  activeSkillNames: config.activeSkillNames,
+  codeEnvAvailable: config.codeEnvAvailable,
+  skillAuthoringAvailable: config.skillAuthoringAvailable,
+  fileAuthoringToolNames: config.fileAuthoringToolNames,
+  skillPrimedIdsByName:
+    mockBuildSkillPrimedIdsByName(config.manualSkillPrimes, config.alwaysApplySkillPrimes) ?? {},
+}));
+const mockEnrichLoadedToolsWithAgentContext = jest.fn(({ result, req, ctx }) =>
+  mockEnrichWithSkillConfigurable({
+    result,
+    context: {
+      req,
+      accessibleSkillIds: ctx.accessibleSkillIds,
+      codeEnvAvailable: ctx.codeEnvAvailable === true,
+      skillPrimedIdsByName: ctx.skillPrimedIdsByName,
+      activeSkillNames: ctx.activeSkillNames,
+      skillAuthoringAvailable: ctx.skillAuthoringAvailable === true,
+      fileAuthoringToolNames: ctx.fileAuthoringToolNames,
+    },
+  }),
+);
+const mockCanAuthorSkillFiles = jest.fn(
+  ({ scopedEditableSkillIds = [], skillCreateAllowed }) =>
+    scopedEditableSkillIds.length > 0 || skillCreateAllowed === true,
+);
+const mockGetSkillToolDeps = jest.fn(() => ({}));
 
 jest.mock('nanoid', () => ({
   nanoid: jest.fn(() => 'mock-nanoid-123'),
@@ -61,6 +105,7 @@ jest.mock('@librechat/api', () => ({
   createErrorResponse: jest.fn(),
   getTransactionsConfig: mockGetTransactionsConfig,
   recordCollectedUsage: mockRecordCollectedUsage,
+  createSubagentUsageSink: jest.fn().mockReturnValue(jest.fn()),
   extractManualSkills: jest.fn().mockReturnValue(undefined),
   injectSkillPrimes: jest.fn().mockReturnValue({
     initialMessages: [],
@@ -88,6 +133,7 @@ jest.mock('@librechat/api', () => ({
   resolveRecursionLimit: jest.fn().mockReturnValue(50),
   createToolExecuteHandler: jest.fn().mockReturnValue({ handle: jest.fn() }),
   isChatCompletionValidationFailure: jest.fn().mockReturnValue(false),
+  findPiiMatchInMessages: jest.fn().mockReturnValue(null),
   discoverConnectedAgents: jest.fn().mockResolvedValue({
     agentConfigs: new Map(),
     edges: [],
@@ -104,6 +150,17 @@ jest.mock('~/server/services/Files/permissions', () => ({
   filterFilesByAgentAccess: jest.fn(),
 }));
 
+jest.mock('~/server/services/Endpoints/agents/skillDeps', () => ({
+  getSkillToolDeps: mockGetSkillToolDeps,
+  getSkillDbMethods: jest.fn(() => ({})),
+  canAuthorSkillFiles: mockCanAuthorSkillFiles,
+  withDeploymentSkillIds: jest.fn((ids = []) => ids),
+  enrichWithSkillConfigurable: mockEnrichWithSkillConfigurable,
+  buildSkillPrimedIdsByName: mockBuildSkillPrimedIdsByName,
+  buildAgentToolContext: mockBuildAgentToolContext,
+  enrichLoadedToolsWithAgentContext: mockEnrichLoadedToolsWithAgentContext,
+}));
+
 jest.mock('~/cache', () => ({
   logViolation: jest.fn(),
 }));
@@ -368,4 +425,87 @@ describe('OpenAIChatCompletionController', () => {
       expect(resolveRecursionLimit).toHaveBeenCalledWith(req.config.endpoints.agents, mockAgent);
     });
   });
+
+  describe('sub-agent skill priming', () => {
+    it('passes the sub-agent primed skill IDs into tool execution', async () => {
+      const {
+        initializeAgent,
+        discoverConnectedAgents,
+        createToolExecuteHandler,
+      } = require('@librechat/api');
+      const { loadToolsForExecution } = require('~/server/services/ToolService');
+      const subAgent = { id: 'agent-sub', name: 'Sub Agent' };
+      const subConfig = {
+        id: 'agent-sub',
+        model: 'gpt-4',
+        model_parameters: {},
+        toolRegistry: new Map(),
+        userMCPAuthMap: { sub: { token: 'sub-token' } },
+        tool_resources: { code_interpreter: { file_ids: ['sub-file'] } },
+        actionsEnabled: true,
+        accessibleSkillIds: ['sub-skill-id'],
+        activeSkillNames: ['sub-hidden-skill'],
+        codeEnvAvailable: true,
+        skillAuthoringAvailable: true,
+        fileAuthoringToolNames: ['create_file', 'edit_file'],
+        manualSkillPrimes: [{ name: 'sub-hidden-skill', _id: { toString: () => 'sub-manual-id' } }],
+        alwaysApplySkillPrimes: [
+          { name: 'sub-always-skill', _id: { toString: () => 'sub-always-id' } },
+        ],
+      };
+
+      initializeAgent.mockResolvedValueOnce({
+        id: 'agent-123',
+        model: 'gpt-4',
+        model_parameters: {},
+        toolRegistry: new Map(),
+        edges: [{ source: 'agent-123', target: 'agent-sub' }],
+        accessibleSkillIds: ['primary-skill-id'],
+        activeSkillNames: ['primary-skill'],
+        codeEnvAvailable: false,
+        skillAuthoringAvailable: false,
+        fileAuthoringToolNames: [],
+        manualSkillPrimes: [{ name: 'primary-skill', _id: { toString: () => 'primary-skill-id' } }],
+      });
+      discoverConnectedAgents.mockImplementationOnce(async (_params, deps) => {
+        deps.onAgentInitialized('agent-sub', subAgent, subConfig);
+        return {
+          agentConfigs: new Map([['agent-sub', subConfig]]),
+          edges: [],
+          skippedAgentIds: new Set(),
+          userMCPAuthMap: undefined,
+        };
+      });
+
+      await OpenAIChatCompletionController(req, res);
+
+      const toolExecuteOptions = createToolExecuteHandler.mock.calls.at(-1)[0];
+      await toolExecuteOptions.loadTools(['read_file'], 'agent-sub');
+
+      expect(loadToolsForExecution).toHaveBeenLastCalledWith(
+        expect.objectContaining({
+          agent: subAgent,
+          toolRegistry: subConfig.toolRegistry,
+          userMCPAuthMap: subConfig.userMCPAuthMap,
+          tool_resources: subConfig.tool_resources,
+          actionsEnabled: true,
+        }),
+      );
+      expect(mockEnrichWithSkillConfigurable).toHaveBeenLastCalledWith({
+        result: expect.anything(),
+        context: {
+          req,
+          accessibleSkillIds: ['sub-skill-id'],
+          codeEnvAvailable: true,
+          skillPrimedIdsByName: {
+            'sub-always-skill': 'sub-always-id',
+            'sub-hidden-skill': 'sub-manual-id',
+          },
+          activeSkillNames: ['sub-hidden-skill'],
+          skillAuthoringAvailable: true,
+          fileAuthoringToolNames: ['create_file', 'edit_file'],
+        },
+      });
+    });
+  });
 });
diff --git a/api/server/controllers/agents/__tests__/request.resumeMetadata.spec.js b/api/server/controllers/agents/__tests__/request.resumeMetadata.spec.js
new file mode 100644
index 00000000000..de07b4ab542
--- /dev/null
+++ b/api/server/controllers/agents/__tests__/request.resumeMetadata.spec.js
@@ -0,0 +1,612 @@
+const { EventEmitter } = require('events');
+
+const mockLogger = {
+  debug: jest.fn(),
+  warn: jest.fn(),
+  error: jest.fn(),
+  info: jest.fn(),
+};
+
+const mockGenerationJobManager = {
+  createJob: jest.fn(),
+  emitError: jest.fn(),
+  completeJob: jest.fn(),
+  getResumeState: jest.fn(),
+  updateMetadata: jest.fn(),
+};
+
+const mockCheckAndIncrementPendingRequest = jest.fn();
+const mockDecrementPendingRequest = jest.fn();
+const mockFilterPersistableAbortContent = jest.fn((content) =>
+  content.filter((part) => part?.type !== 'tool_call'),
+);
+const mockGetConvo = jest.fn();
+const mockGetMessages = jest.fn();
+const mockSaveMessage = jest.fn();
+let mockMCPContexts = new WeakMap();
+
+const mockCreateMCPRequestContext = jest.fn(() => ({
+  connections: new Map(),
+  pending: new Map(),
+  cleanupStarted: false,
+  cleanupOnResponse: false,
+  responseCleanupAttached: false,
+}));
+const mockGetMCPRequestContext = jest.fn((req) => {
+  if (!req) {
+    return undefined;
+  }
+
+  let context = mockMCPContexts.get(req);
+  if (!context) {
+    context = mockCreateMCPRequestContext();
+    mockMCPContexts.set(req, context);
+  }
+
+  return context.cleanupStarted ? undefined : context;
+});
+const mockCleanupMCPRequestContext = jest.fn(async (context) => {
+  if (!context || context.cleanupStarted) {
+    return;
+  }
+
+  context.cleanupStarted = true;
+  const connections = new Set(context.connections.values());
+  const settled = await Promise.allSettled(context.pending.values());
+  for (const result of settled) {
+    if (result.status === 'fulfilled' && result.value) {
+      connections.add(result.value);
+    }
+  }
+
+  await Promise.allSettled(Array.from(connections).map((connection) => connection.disconnect?.()));
+  context.connections.clear();
+  context.pending.clear();
+});
+const mockCleanupMCPRequestContextForReq = jest.fn(async (req) => {
+  const context = mockMCPContexts.get(req);
+  if (!context) {
+    return;
+  }
+
+  try {
+    await mockCleanupMCPRequestContext(context);
+  } finally {
+    mockMCPContexts.delete(req);
+  }
+});
+
+jest.mock('@librechat/data-schemas', () => ({
+  logger: mockLogger,
+}));
+
+jest.mock('@librechat/api', () => ({
+  sendEvent: jest.fn(),
+  getViolationInfo: jest.fn(),
+  buildMessageFiles: jest.fn(() => []),
+  resolveTitleTiming: jest.fn(() => 'immediate'),
+  GenerationJobManager: mockGenerationJobManager,
+  cleanupMCPRequestContext: (...args) => mockCleanupMCPRequestContext(...args),
+  createMCPRequestContext: (...args) => mockCreateMCPRequestContext(...args),
+  getMCPRequestContext: (...args) => mockGetMCPRequestContext(...args),
+  filterPersistableAbortContent: (...args) => mockFilterPersistableAbortContent(...args),
+  cleanupMCPRequestContextForReq: (...args) => mockCleanupMCPRequestContextForReq(...args),
+  decrementPendingRequest: (...args) => mockDecrementPendingRequest(...args),
+  sanitizeMessageForTransmit: jest.fn((message) => message),
+  checkAndIncrementPendingRequest: (...args) => mockCheckAndIncrementPendingRequest(...args),
+  isUnpersistedPreliminaryParent: async ({
+    userId,
+    conversationId,
+    parentMessageId,
+    getMessages,
+  }) => {
+    if (typeof parentMessageId !== 'string' || !parentMessageId.endsWith('_')) {
+      return false;
+    }
+
+    const filter = { user: userId, messageId: parentMessageId };
+    if (conversationId && conversationId !== 'new') {
+      filter.conversationId = conversationId;
+    }
+
+    const messages = await getMessages(filter, '_id');
+    return messages.length === 0;
+  },
+}));
+
+jest.mock('~/server/cleanup', () => ({
+  disposeClient: jest.fn(),
+  clientRegistry: null,
+  requestDataMap: {
+    set: jest.fn(),
+  },
+}));
+
+jest.mock('~/server/middleware', () => ({
+  handleAbortError: jest.fn(() => Promise.resolve()),
+}));
+
+jest.mock('~/cache', () => ({
+  logViolation: jest.fn(),
+}));
+
+jest.mock('~/models', () => ({
+  saveMessage: (...args) => mockSaveMessage(...args),
+  getMessages: (...args) => mockGetMessages(...args),
+  getConvo: (...args) => mockGetConvo(...args),
+}));
+
+const AgentController = require('../request');
+const { getMCPRequestContext } = require('~/server/services/MCPRequestContext');
+
+function createResumableResponse() {
+  const res = new EventEmitter();
+  res.headersSent = false;
+  res.writableEnded = false;
+  res.finished = false;
+  res.destroyed = false;
+  res.json = jest.fn(() => {
+    res.headersSent = true;
+    res.writableEnded = true;
+    res.finished = true;
+    res.emit('finish');
+    return res;
+  });
+  res.status = jest.fn(() => res);
+  return res;
+}
+
+function nextTick() {
+  return new Promise((resolve) => setImmediate(resolve));
+}
+
+describe('ResumableAgentController resume metadata', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockMCPContexts = new WeakMap();
+    mockCheckAndIncrementPendingRequest.mockResolvedValue({ allowed: true });
+    mockDecrementPendingRequest.mockResolvedValue(undefined);
+    mockGetConvo.mockResolvedValue({ createdAt: '2026-06-07T00:00:00.000Z' });
+    mockGetMessages.mockResolvedValue([]);
+    mockGenerationJobManager.createJob.mockResolvedValue({
+      createdAt: 1000,
+      readyPromise: Promise.resolve(),
+      abortController: new AbortController(),
+      emitter: { on: jest.fn() },
+    });
+    mockGenerationJobManager.getResumeState.mockResolvedValue(null);
+    mockGenerationJobManager.updateMetadata.mockResolvedValue(undefined);
+    mockGenerationJobManager.emitError.mockResolvedValue(undefined);
+    mockSaveMessage.mockResolvedValue({});
+  });
+
+  it('rejects an underscore-suffixed parent that is not persisted', async () => {
+    const conversationId = 'conversation-123';
+    const initializeClient = jest.fn();
+    const req = {
+      user: { id: 'user-123' },
+      body: {
+        text: 'Follow up too early.',
+        messageId: 'follow-up-user',
+        parentMessageId: 'pending-response_',
+        conversationId,
+        endpointOption: {
+          endpoint: 'agents',
+          modelOptions: { model: 'gpt-3.5-turbo' },
+        },
+      },
+      config: {},
+    };
+    const res = {
+      json: jest.fn(),
+      status: jest.fn(() => res),
+    };
+
+    await AgentController(req, res, jest.fn(), initializeClient, null);
+
+    expect(mockGetMessages).toHaveBeenCalledWith(
+      { user: 'user-123', messageId: 'pending-response_', conversationId },
+      '_id',
+    );
+    expect(res.status).toHaveBeenCalledWith(409);
+    expect(res.json).toHaveBeenCalledWith(
+      expect.objectContaining({
+        error: expect.stringContaining('selected parent response is still being saved'),
+      }),
+    );
+    expect(mockCheckAndIncrementPendingRequest).not.toHaveBeenCalled();
+    expect(mockGenerationJobManager.createJob).not.toHaveBeenCalled();
+    expect(initializeClient).not.toHaveBeenCalled();
+  });
+
+  it('allows an underscore-suffixed parent when it is already persisted', async () => {
+    const conversationId = 'conversation-123';
+    mockGetMessages.mockResolvedValue([{ _id: 'persisted-parent' }]);
+    const initializeClient = jest.fn().mockRejectedValue(new Error('stop before tool loading'));
+    const req = {
+      user: { id: 'user-123' },
+      body: {
+        text: 'Follow up to persisted underscore id.',
+        messageId: 'follow-up-user',
+        parentMessageId: 'persisted-response_',
+        conversationId,
+        endpointOption: {
+          endpoint: 'agents',
+          modelOptions: { model: 'gpt-3.5-turbo' },
+        },
+      },
+      config: {},
+    };
+    const res = {
+      headersSent: true,
+      json: jest.fn(() => {
+        res.headersSent = true;
+      }),
+      status: jest.fn(() => res),
+    };
+
+    await AgentController(req, res, jest.fn(), initializeClient, null);
+
+    expect(mockGetMessages).toHaveBeenCalledWith(
+      { user: 'user-123', messageId: 'persisted-response_', conversationId },
+      '_id',
+    );
+    expect(res.status).not.toHaveBeenCalledWith(409);
+    expect(mockCheckAndIncrementPendingRequest).toHaveBeenCalledWith('user-123');
+    expect(mockGenerationJobManager.createJob).toHaveBeenCalledWith(
+      conversationId,
+      'user-123',
+      conversationId,
+    );
+  });
+
+  it('stores the in-flight turn before MCP initialization can emit OAuth', async () => {
+    const conversationId = 'conversation-123';
+    const initializeClient = jest.fn().mockRejectedValue(new Error('stop before tool loading'));
+    const req = {
+      user: { id: 'user-123' },
+      body: {
+        text: 'Check Google Workspace availability.',
+        messageId: 'follow-up-user',
+        parentMessageId: 'original-response',
+        conversationId,
+        endpointOption: {
+          endpoint: 'agents',
+          iconURL: 'https://example.com/spec-icon.png',
+          modelOptions: { model: 'gpt-3.5-turbo' },
+        },
+      },
+      config: {},
+    };
+    const res = {
+      headersSent: true,
+      json: jest.fn(() => {
+        res.headersSent = true;
+      }),
+      status: jest.fn(() => res),
+    };
+
+    await AgentController(req, res, jest.fn(), initializeClient, null);
+
+    expect(mockGenerationJobManager.updateMetadata).toHaveBeenCalledWith(
+      conversationId,
+      expect.objectContaining({
+        conversationId,
+        endpoint: 'agents',
+        iconURL: 'https://example.com/spec-icon.png',
+        model: 'gpt-3.5-turbo',
+        responseMessageId: 'follow-up-user_',
+        userMessage: {
+          messageId: 'follow-up-user',
+          parentMessageId: 'original-response',
+          conversationId,
+          text: 'Check Google Workspace availability.',
+        },
+      }),
+    );
+    expect(mockGenerationJobManager.updateMetadata.mock.invocationCallOrder[0]).toBeLessThan(
+      initializeClient.mock.invocationCallOrder[0],
+    );
+  });
+
+  it('keeps request-scoped MCP connections until resumable initialization finishes', async () => {
+    const conversationId = 'conversation-123';
+    const disconnect = jest.fn().mockResolvedValue(undefined);
+    const initializeClient = jest.fn(async ({ req, res }) => {
+      const context = getMCPRequestContext(req, res);
+      context.connections.set('mcp-server', { disconnect });
+
+      await nextTick();
+      expect(disconnect).not.toHaveBeenCalled();
+
+      throw new Error('stop after request-scoped MCP connection');
+    });
+    const req = {
+      user: { id: 'user-123' },
+      body: {
+        text: 'Use a BODY-scoped MCP server.',
+        messageId: 'user-message',
+        parentMessageId: 'parent-message',
+        conversationId,
+        endpointOption: {
+          endpoint: 'agents',
+          modelOptions: { model: 'gpt-4.1' },
+        },
+      },
+      config: {},
+    };
+    const res = createResumableResponse();
+
+    await AgentController(req, res, jest.fn(), initializeClient, null);
+
+    expect(res.json).toHaveBeenCalledWith({
+      streamId: conversationId,
+      conversationId,
+      status: 'started',
+    });
+    expect(disconnect).toHaveBeenCalledTimes(1);
+    expect(disconnect.mock.invocationCallOrder[0]).toBeLessThan(
+      mockDecrementPendingRequest.mock.invocationCallOrder[0],
+    );
+  });
+
+  it('stores model spec icon fallbacks and agent ids in early resume metadata', async () => {
+    const conversationId = 'conversation-123';
+    const initializeClient = jest.fn().mockRejectedValue(new Error('stop before tool loading'));
+    const req = {
+      user: { id: 'user-123' },
+      body: {
+        text: 'Use the resume spec.',
+        messageId: 'follow-up-user',
+        parentMessageId: 'original-response',
+        conversationId,
+        endpointOption: {
+          endpoint: 'agents',
+          spec: 'agent-spec',
+          agent_id: 'agent_resume_spec',
+          model_parameters: { model: 'gpt-4.1' },
+        },
+      },
+      config: {
+        modelSpecs: {
+          list: [
+            {
+              name: 'agent-spec',
+              preset: {
+                endpoint: 'openAI',
+                iconURL: 'https://example.com/preset-icon.png',
+              },
+            },
+          ],
+        },
+      },
+    };
+    const res = {
+      headersSent: true,
+      json: jest.fn(() => {
+        res.headersSent = true;
+      }),
+      status: jest.fn(() => res),
+    };
+
+    await AgentController(req, res, jest.fn(), initializeClient, null);
+
+    expect(mockGenerationJobManager.updateMetadata).toHaveBeenCalledWith(
+      conversationId,
+      expect.objectContaining({
+        iconURL: 'https://example.com/preset-icon.png',
+        model: 'agent_resume_spec',
+      }),
+    );
+  });
+
+  it('falls back to the model spec preset endpoint when no icon URL is configured', async () => {
+    const conversationId = 'conversation-123';
+    const initializeClient = jest.fn().mockRejectedValue(new Error('stop before tool loading'));
+    const req = {
+      user: { id: 'user-123' },
+      body: {
+        text: 'Use the endpoint icon.',
+        messageId: 'follow-up-user',
+        parentMessageId: 'original-response',
+        conversationId,
+        endpointOption: {
+          endpoint: 'agents',
+          spec: 'endpoint-icon-spec',
+          model_parameters: { model: 'gpt-4.1' },
+        },
+      },
+      config: {
+        modelSpecs: {
+          list: [
+            {
+              name: 'endpoint-icon-spec',
+              preset: {
+                endpoint: 'anthropic',
+              },
+            },
+          ],
+        },
+      },
+    };
+    const res = {
+      headersSent: true,
+      json: jest.fn(() => {
+        res.headersSent = true;
+      }),
+      status: jest.fn(() => res),
+    };
+
+    await AgentController(req, res, jest.fn(), initializeClient, null);
+
+    expect(mockGenerationJobManager.updateMetadata).toHaveBeenCalledWith(
+      conversationId,
+      expect.objectContaining({
+        iconURL: 'anthropic',
+        model: 'gpt-4.1',
+      }),
+    );
+  });
+
+  it('filters OAuth prompts before saving partial responses on disconnect', async () => {
+    const conversationId = 'conversation-123';
+    let allSubscribersLeftHandler;
+    mockGenerationJobManager.createJob.mockResolvedValue({
+      createdAt: 1000,
+      readyPromise: Promise.resolve(),
+      abortController: new AbortController(),
+      emitter: {
+        on: jest.fn((event, handler) => {
+          if (event === 'allSubscribersLeft') {
+            allSubscribersLeftHandler = handler;
+          }
+        }),
+      },
+    });
+    mockGenerationJobManager.getResumeState.mockResolvedValue({
+      conversationId,
+      responseMessageId: 'response-message',
+      iconURL: 'https://example.com/spec-icon.png',
+      model: 'gpt-4.1',
+      userMessage: {
+        messageId: 'user-message',
+        parentMessageId: 'parent-message',
+        conversationId,
+        text: 'Use Google Workspace',
+      },
+    });
+
+    const initializeClient = jest.fn().mockRejectedValue(new Error('stop after setup'));
+    const req = {
+      user: { id: 'user-123' },
+      body: {
+        text: 'Use Google Workspace',
+        messageId: 'user-message',
+        parentMessageId: 'parent-message',
+        conversationId,
+        endpointOption: {
+          endpoint: 'agents',
+          iconURL: 'https://example.com/fallback-icon.png',
+          modelOptions: { model: 'gpt-3.5-turbo' },
+        },
+      },
+      config: {},
+    };
+    const res = {
+      headersSent: true,
+      json: jest.fn(() => {
+        res.headersSent = true;
+      }),
+      status: jest.fn(() => res),
+    };
+
+    await AgentController(req, res, jest.fn(), initializeClient, null);
+    expect(allSubscribersLeftHandler).toEqual(expect.any(Function));
+
+    const oauthPart = {
+      type: 'tool_call',
+      tool_call: {
+        name: 'oauth_mcp_Google-Workspace',
+        auth: 'https://auth.example.com/oauth',
+      },
+    };
+    const textPart = { type: 'text', text: 'Partial response...' };
+
+    await allSubscribersLeftHandler([oauthPart, textPart]);
+
+    expect(mockFilterPersistableAbortContent).toHaveBeenCalledWith([oauthPart, textPart]);
+    expect(mockSaveMessage).toHaveBeenCalledWith(
+      expect.objectContaining({ userId: 'user-123' }),
+      expect.objectContaining({
+        content: [textPart],
+        iconURL: 'https://example.com/spec-icon.png',
+        model: 'gpt-4.1',
+        messageId: 'response-message',
+        parentMessageId: 'user-message',
+      }),
+      expect.any(Object),
+    );
+  });
+
+  it('uses model spec and agent fallbacks when saving partial responses on disconnect', async () => {
+    const conversationId = 'conversation-123';
+    let allSubscribersLeftHandler;
+    mockGenerationJobManager.createJob.mockResolvedValue({
+      createdAt: 1000,
+      readyPromise: Promise.resolve(),
+      abortController: new AbortController(),
+      emitter: {
+        on: jest.fn((event, handler) => {
+          if (event === 'allSubscribersLeft') {
+            allSubscribersLeftHandler = handler;
+          }
+        }),
+      },
+    });
+    mockGenerationJobManager.getResumeState.mockResolvedValue({
+      conversationId,
+      responseMessageId: 'response-message',
+      userMessage: {
+        messageId: 'user-message',
+        parentMessageId: 'parent-message',
+        conversationId,
+        text: 'Use fallback metadata',
+      },
+    });
+
+    const initializeClient = jest.fn().mockRejectedValue(new Error('stop after setup'));
+    const req = {
+      user: { id: 'user-123' },
+      body: {
+        text: 'Use fallback metadata',
+        messageId: 'user-message',
+        parentMessageId: 'parent-message',
+        conversationId,
+        endpointOption: {
+          endpoint: 'agents',
+          spec: 'agent-spec',
+          agent_id: 'agent_resume_spec',
+          model_parameters: { model: 'gpt-4.1' },
+        },
+      },
+      config: {
+        modelSpecs: {
+          list: [
+            {
+              name: 'agent-spec',
+              preset: {
+                endpoint: 'openAI',
+                iconURL: 'https://example.com/preset-icon.png',
+              },
+            },
+          ],
+        },
+      },
+    };
+    const res = {
+      headersSent: true,
+      json: jest.fn(() => {
+        res.headersSent = true;
+      }),
+      status: jest.fn(() => res),
+    };
+
+    await AgentController(req, res, jest.fn(), initializeClient, null);
+    expect(allSubscribersLeftHandler).toEqual(expect.any(Function));
+
+    const textPart = { type: 'text', text: 'Partial response...' };
+    await allSubscribersLeftHandler([textPart]);
+
+    expect(mockSaveMessage).toHaveBeenCalledWith(
+      expect.objectContaining({ userId: 'user-123' }),
+      expect.objectContaining({
+        content: [textPart],
+        iconURL: 'https://example.com/preset-icon.png',
+        model: 'agent_resume_spec',
+        messageId: 'response-message',
+        parentMessageId: 'user-message',
+      }),
+      expect.any(Object),
+    );
+  });
+});
diff --git a/api/server/controllers/agents/__tests__/responses.unit.spec.js b/api/server/controllers/agents/__tests__/responses.unit.spec.js
index e5569fbbf57..3e980a057e1 100644
--- a/api/server/controllers/agents/__tests__/responses.unit.spec.js
+++ b/api/server/controllers/agents/__tests__/responses.unit.spec.js
@@ -10,6 +10,50 @@ const mockRecordCollectedUsage = jest
   .mockResolvedValue({ input_tokens: 100, output_tokens: 50 });
 const mockGetBalanceConfig = jest.fn().mockReturnValue({ enabled: true });
 const mockGetTransactionsConfig = jest.fn().mockReturnValue({ enabled: true });
+const mockBuildSkillPrimedIdsByName = jest.fn((manualSkillPrimes, alwaysApplySkillPrimes) => {
+  const primed = {};
+  for (const skill of alwaysApplySkillPrimes ?? []) {
+    primed[skill.name] = skill._id.toString();
+  }
+  for (const skill of manualSkillPrimes ?? []) {
+    primed[skill.name] = skill._id.toString();
+  }
+  return Object.keys(primed).length > 0 ? primed : undefined;
+});
+const mockEnrichWithSkillConfigurable = jest.fn((result) => result);
+const mockBuildAgentToolContext = jest.fn(({ agent, config }) => ({
+  agent,
+  toolRegistry: config.toolRegistry,
+  userMCPAuthMap: config.userMCPAuthMap,
+  tool_resources: config.tool_resources,
+  actionsEnabled: config.actionsEnabled,
+  accessibleSkillIds: config.accessibleSkillIds,
+  activeSkillNames: config.activeSkillNames,
+  codeEnvAvailable: config.codeEnvAvailable,
+  skillAuthoringAvailable: config.skillAuthoringAvailable,
+  fileAuthoringToolNames: config.fileAuthoringToolNames,
+  skillPrimedIdsByName:
+    mockBuildSkillPrimedIdsByName(config.manualSkillPrimes, config.alwaysApplySkillPrimes) ?? {},
+}));
+const mockEnrichLoadedToolsWithAgentContext = jest.fn(({ result, req, ctx }) =>
+  mockEnrichWithSkillConfigurable({
+    result,
+    context: {
+      req,
+      accessibleSkillIds: ctx.accessibleSkillIds,
+      codeEnvAvailable: ctx.codeEnvAvailable === true,
+      skillPrimedIdsByName: ctx.skillPrimedIdsByName,
+      activeSkillNames: ctx.activeSkillNames,
+      skillAuthoringAvailable: ctx.skillAuthoringAvailable === true,
+      fileAuthoringToolNames: ctx.fileAuthoringToolNames,
+    },
+  }),
+);
+const mockCanAuthorSkillFiles = jest.fn(
+  ({ scopedEditableSkillIds = [], skillCreateAllowed }) =>
+    scopedEditableSkillIds.length > 0 || skillCreateAllowed === true,
+);
+const mockGetSkillToolDeps = jest.fn(() => ({}));
 
 jest.mock('nanoid', () => ({
   nanoid: jest.fn(() => 'mock-nanoid-123'),
@@ -63,6 +107,7 @@ jest.mock('@librechat/api', () => ({
   getBalanceConfig: mockGetBalanceConfig,
   getTransactionsConfig: mockGetTransactionsConfig,
   recordCollectedUsage: mockRecordCollectedUsage,
+  createSubagentUsageSink: jest.fn().mockReturnValue(jest.fn()),
   extractManualSkills: jest.fn().mockReturnValue(undefined),
   injectSkillPrimes: jest.fn().mockReturnValue({
     initialMessages: [],
@@ -78,6 +123,7 @@ jest.mock('@librechat/api', () => ({
   buildResponse: jest.fn().mockReturnValue({ id: 'resp_123', output: [] }),
   generateResponseId: jest.fn().mockReturnValue('resp_mock-123'),
   isValidationFailure: jest.fn().mockReturnValue(false),
+  findPiiMatchInMessages: jest.fn().mockReturnValue(null),
   emitResponseCreated: jest.fn(),
   createResponseContext: jest.fn().mockReturnValue({ responseId: 'resp_123' }),
   createResponseTracker: jest.fn().mockReturnValue({
@@ -154,6 +200,17 @@ jest.mock('~/server/services/Files/permissions', () => ({
   filterFilesByAgentAccess: jest.fn(),
 }));
 
+jest.mock('~/server/services/Endpoints/agents/skillDeps', () => ({
+  getSkillToolDeps: mockGetSkillToolDeps,
+  getSkillDbMethods: jest.fn(() => ({})),
+  canAuthorSkillFiles: mockCanAuthorSkillFiles,
+  withDeploymentSkillIds: jest.fn((ids = []) => ids),
+  enrichWithSkillConfigurable: mockEnrichWithSkillConfigurable,
+  buildSkillPrimedIdsByName: mockBuildSkillPrimedIdsByName,
+  buildAgentToolContext: mockBuildAgentToolContext,
+  enrichLoadedToolsWithAgentContext: mockEnrichLoadedToolsWithAgentContext,
+}));
+
 jest.mock('~/cache', () => ({
   logViolation: jest.fn(),
 }));
@@ -458,4 +515,87 @@ describe('createResponse controller', () => {
       );
     });
   });
+
+  describe('sub-agent skill priming', () => {
+    it('passes the sub-agent primed skill IDs into non-streaming tool execution', async () => {
+      const {
+        initializeAgent,
+        discoverConnectedAgents,
+        createToolExecuteHandler,
+      } = require('@librechat/api');
+      const { loadToolsForExecution } = require('~/server/services/ToolService');
+      const subAgent = { id: 'agent-sub', name: 'Sub Agent' };
+      const subConfig = {
+        id: 'agent-sub',
+        model: 'claude-3',
+        model_parameters: {},
+        toolRegistry: new Map(),
+        userMCPAuthMap: { sub: { token: 'sub-token' } },
+        tool_resources: { code_interpreter: { file_ids: ['sub-file'] } },
+        actionsEnabled: true,
+        accessibleSkillIds: ['sub-skill-id'],
+        activeSkillNames: ['sub-hidden-skill'],
+        codeEnvAvailable: true,
+        skillAuthoringAvailable: true,
+        fileAuthoringToolNames: ['create_file', 'edit_file'],
+        manualSkillPrimes: [{ name: 'sub-hidden-skill', _id: { toString: () => 'sub-manual-id' } }],
+        alwaysApplySkillPrimes: [
+          { name: 'sub-always-skill', _id: { toString: () => 'sub-always-id' } },
+        ],
+      };
+
+      initializeAgent.mockResolvedValueOnce({
+        id: 'agent-123',
+        model: 'claude-3',
+        model_parameters: {},
+        toolRegistry: new Map(),
+        edges: [{ source: 'agent-123', target: 'agent-sub' }],
+        accessibleSkillIds: ['primary-skill-id'],
+        activeSkillNames: ['primary-skill'],
+        codeEnvAvailable: false,
+        skillAuthoringAvailable: false,
+        fileAuthoringToolNames: [],
+        manualSkillPrimes: [{ name: 'primary-skill', _id: { toString: () => 'primary-skill-id' } }],
+      });
+      discoverConnectedAgents.mockImplementationOnce(async (_params, deps) => {
+        deps.onAgentInitialized('agent-sub', subAgent, subConfig);
+        return {
+          agentConfigs: new Map([['agent-sub', subConfig]]),
+          edges: [],
+          skippedAgentIds: new Set(),
+          userMCPAuthMap: undefined,
+        };
+      });
+
+      await createResponse(req, res);
+
+      const toolExecuteOptions = createToolExecuteHandler.mock.calls.at(-1)[0];
+      await toolExecuteOptions.loadTools(['read_file'], 'agent-sub');
+
+      expect(loadToolsForExecution).toHaveBeenLastCalledWith(
+        expect.objectContaining({
+          agent: subAgent,
+          toolRegistry: subConfig.toolRegistry,
+          userMCPAuthMap: subConfig.userMCPAuthMap,
+          tool_resources: subConfig.tool_resources,
+          actionsEnabled: true,
+        }),
+      );
+      expect(mockEnrichWithSkillConfigurable).toHaveBeenLastCalledWith({
+        result: expect.anything(),
+        context: {
+          req,
+          accessibleSkillIds: ['sub-skill-id'],
+          codeEnvAvailable: true,
+          skillPrimedIdsByName: {
+            'sub-always-skill': 'sub-always-id',
+            'sub-hidden-skill': 'sub-manual-id',
+          },
+          activeSkillNames: ['sub-hidden-skill'],
+          skillAuthoringAvailable: true,
+          fileAuthoringToolNames: ['create_file', 'edit_file'],
+        },
+      });
+    });
+  });
 });
diff --git a/api/server/controllers/agents/__tests__/usageEvents.integration.spec.js b/api/server/controllers/agents/__tests__/usageEvents.integration.spec.js
new file mode 100644
index 00000000000..caa14f6ea70
--- /dev/null
+++ b/api/server/controllers/agents/__tests__/usageEvents.integration.spec.js
@@ -0,0 +1,477 @@
+const { z } = require('zod');
+const { tool } = require('@langchain/core/tools');
+const { ChatGenerationChunk } = require('@langchain/core/outputs');
+const { HumanMessage, AIMessage, AIMessageChunk } = require('@langchain/core/messages');
+const {
+  Run,
+  Providers,
+  GraphEvents,
+  FakeChatModel,
+  createContentAggregator,
+} = require('@librechat/agents');
+const {
+  GenerationJobManager,
+  aggregateEmittedUsage,
+  resolveAgentTokenConfig,
+  buildPersistedContextUsage,
+} = require('@librechat/api');
+const { getDefaultHandlers } = require('~/server/controllers/agents/callbacks');
+
+jest.mock('nanoid', () => ({
+  nanoid: jest.fn(() => 'mock-nanoid'),
+}));
+
+jest.mock('~/server/services/Files/Citations', () => ({
+  processFileCitations: jest.fn(),
+}));
+
+jest.mock('~/server/services/Files/Code/process', () => ({
+  processCodeOutput: jest.fn(),
+  runPreviewFinalize: jest.fn(),
+}));
+
+jest.mock('~/server/services/Files/process', () => ({
+  saveBase64Image: jest.fn(),
+}));
+
+/** Real pipeline guard: published lib versions without the event skip its assertions */
+const hasContextUsageEvent = GraphEvents.ON_CONTEXT_USAGE != null;
+
+/**
+ * FakeChatModel that attaches provider-style usage_metadata on a final
+ * empty chunk (the OpenAI streaming pattern), so CHAT_MODEL_END carries
+ * aggregated usage through the real @librechat/agents pipeline.
+ */
+class UsageFakeModel extends FakeChatModel {
+  constructor(options, usagePerCall) {
+    super(options);
+    this.usagePerCall = usagePerCall;
+    this.usageCallIndex = 0;
+  }
+
+  async *_streamResponseChunks(messages, options, runManager) {
+    yield* super._streamResponseChunks(messages, options, runManager);
+    const index = Math.min(this.usageCallIndex, this.usagePerCall.length - 1);
+    this.usageCallIndex += 1;
+    yield new ChatGenerationChunk({
+      text: '',
+      message: new AIMessageChunk({ content: '', usage_metadata: this.usagePerCall[index] }),
+    });
+  }
+}
+
+const addTool = tool(async ({ a, b }) => String(a + b), {
+  name: 'add',
+  description: 'Add two numbers',
+  schema: z.object({ a: z.number(), b: z.number() }),
+});
+
+const charCounter = (msg) => {
+  const content = msg.content;
+  if (typeof content === 'string') {
+    return content.length + 3;
+  }
+  if (Array.isArray(content)) {
+    let length = 3;
+    for (const part of content) {
+      if (typeof part === 'string') {
+        length += part.length;
+      } else if (typeof part?.text === 'string') {
+        length += part.text.length;
+      }
+    }
+    return length;
+  }
+  return 3;
+};
+
+function createMockRes() {
+  const events = [];
+  return {
+    events,
+    headersSent: true,
+    writableEnded: false,
+    write(payload) {
+      for (const line of String(payload).split('\n')) {
+        if (line.startsWith('data: ')) {
+          events.push(JSON.parse(line.slice(6)));
+        }
+      }
+      return true;
+    },
+  };
+}
+
+const FIRST_CALL_USAGE = {
+  input_tokens: 100,
+  output_tokens: 20,
+  total_tokens: 120,
+};
+
+const SECOND_CALL_USAGE = {
+  input_tokens: 150,
+  output_tokens: 10,
+  total_tokens: 160,
+  input_token_details: { cache_creation: 30, cache_read: 50 },
+};
+
+const MAX_CONTEXT_TOKENS = 8000;
+
+async function runToolLoop({
+  res,
+  streamId = null,
+  collectedUsage,
+  contextUsageSink = null,
+  usageEmitSink = null,
+  usageCost = null,
+}) {
+  const { contentParts, aggregateContent } = createContentAggregator();
+  const handlers = getDefaultHandlers({
+    res,
+    aggregateContent,
+    toolEndCallback: () => {},
+    collectedUsage,
+    streamId,
+    contextUsageSink,
+    usageEmitSink,
+    usageCost,
+  });
+
+  const run = await Run.create({
+    runId: 'usage-e2e-response',
+    graphConfig: {
+      type: 'standard',
+      llmConfig: {
+        provider: Providers.OPENAI,
+        model: 'gpt-4o-mini',
+        streaming: true,
+        streamUsage: false,
+      },
+      instructions: 'You are a helpful assistant.',
+      maxContextTokens: MAX_CONTEXT_TOKENS,
+      tools: [addTool],
+    },
+    returnContent: true,
+    customHandlers: handlers,
+    tokenCounter: charCounter,
+    indexTokenCountMap: {},
+  });
+
+  run.Graph.overrideModel = new UsageFakeModel(
+    {
+      responses: ['Let me calculate that.', 'The answer is 4.'],
+      toolCalls: [{ name: 'add', args: { a: 2, b: 2 }, id: 'tc_1', type: 'tool_call' }],
+    },
+    [FIRST_CALL_USAGE, SECOND_CALL_USAGE],
+  );
+
+  await run.processStream(
+    { messages: [new HumanMessage('What is 2+2?')] },
+    {
+      configurable: { thread_id: 'usage-e2e-thread', user_id: 'user-1' },
+      streamMode: 'values',
+      version: 'v2',
+    },
+  );
+
+  return { run, contentParts };
+}
+
+describe('usage events through the real agents pipeline', () => {
+  jest.setTimeout(30000);
+
+  afterAll(async () => {
+    await GenerationJobManager.destroy();
+  });
+
+  test('emits on_token_usage per model call with collectedUsage parity', async () => {
+    const res = createMockRes();
+    const collectedUsage = [];
+    const { contentParts } = await runToolLoop({ res, collectedUsage });
+
+    const usageEvents = res.events.filter((e) => e.event === 'on_token_usage');
+    expect(usageEvents).toHaveLength(2);
+
+    expect(usageEvents[0].data).toMatchObject(FIRST_CALL_USAGE);
+    expect(usageEvents[1].data).toMatchObject(SECOND_CALL_USAGE);
+    expect(usageEvents[0].data.provider).toBe(Providers.OPENAI);
+    expect(usageEvents[0].data.model).toBeTruthy();
+    expect(usageEvents[0].data.usage_type).toBeUndefined();
+
+    expect(collectedUsage).toHaveLength(2);
+    expect(collectedUsage[0]).toMatchObject(FIRST_CALL_USAGE);
+    expect(collectedUsage[1]).toMatchObject(SECOND_CALL_USAGE);
+
+    const text = contentParts
+      .filter((part) => part?.type === 'text')
+      .map((part) => part.text)
+      .join('');
+    expect(text).toContain('The answer is 4.');
+  });
+
+  test('emits a context snapshot before each model call', async () => {
+    if (!hasContextUsageEvent) {
+      console.warn('Skipping: installed @librechat/agents predates ON_CONTEXT_USAGE');
+      return;
+    }
+    const res = createMockRes();
+    const { run } = await runToolLoop({ res, collectedUsage: [] });
+    expect(run).toBeDefined();
+
+    const contextEvents = res.events.filter((e) => e.event === 'on_context_usage');
+    expect(contextEvents).toHaveLength(2);
+
+    for (const event of contextEvents) {
+      const { breakdown, contextBudget, remainingContextTokens, effectiveInstructionTokens } =
+        event.data;
+      expect(breakdown.maxContextTokens).toBe(MAX_CONTEXT_TOKENS);
+      expect(contextBudget).toBeGreaterThan(0);
+      expect(contextBudget).toBeLessThanOrEqual(MAX_CONTEXT_TOKENS);
+      expect(effectiveInstructionTokens).toBeGreaterThan(0);
+      expect(remainingContextTokens).toBeGreaterThan(0);
+      expect(remainingContextTokens).toBeLessThan(contextBudget);
+      expect(breakdown.toolTokenCounts.add).toBeGreaterThan(0);
+    }
+
+    /** Tool loop grows the context between calls */
+    expect(contextEvents[1].data.prePruneContextTokens).toBeGreaterThan(
+      contextEvents[0].data.prePruneContextTokens,
+    );
+
+    /** Snapshot precedes the call's usage event */
+    const firstContextIndex = res.events.findIndex((e) => e.event === 'on_context_usage');
+    const firstUsageIndex = res.events.findIndex((e) => e.event === 'on_token_usage');
+    expect(firstContextIndex).toBeGreaterThanOrEqual(0);
+    expect(firstContextIndex).toBeLessThan(firstUsageIndex);
+  });
+
+  test('captures the usage rollup + latest context snapshot for message persistence', () => {
+    const res = createMockRes();
+    const contextUsageSink = { latest: null };
+    const usageEmitSink = [];
+    return runToolLoop({ res, collectedUsage: [], contextUsageSink, usageEmitSink }).then(() => {
+      /** Both model calls' emitted payloads are captured for the rollup */
+      expect(usageEmitSink).toHaveLength(2);
+
+      const usage = aggregateEmittedUsage(usageEmitSink);
+      /** Display units: openAI is cache-subset, so input excludes cache
+       *  (150−30−50=70); output is repaired completion */
+      expect(usage).toEqual({
+        input:
+          FIRST_CALL_USAGE.input_tokens +
+          (SECOND_CALL_USAGE.input_tokens -
+            SECOND_CALL_USAGE.input_token_details.cache_creation -
+            SECOND_CALL_USAGE.input_token_details.cache_read),
+        output: FIRST_CALL_USAGE.output_tokens + SECOND_CALL_USAGE.output_tokens,
+        cacheWrite: SECOND_CALL_USAGE.input_token_details.cache_creation,
+        cacheRead: SECOND_CALL_USAGE.input_token_details.cache_read,
+      });
+      /** contextCost off → no cost folded into the rollup */
+      expect(usage.cost).toBeUndefined();
+
+      if (hasContextUsageEvent) {
+        expect(contextUsageSink.latest).not.toBeNull();
+        const persisted = buildPersistedContextUsage(contextUsageSink.latest);
+        expect(persisted.breakdown.maxContextTokens).toBe(MAX_CONTEXT_TOKENS);
+        /** Zero-valued tool counts are trimmed from the persisted blob */
+        for (const count of Object.values(persisted.breakdown.toolTokenCounts ?? {})) {
+          expect(count).toBeGreaterThan(0);
+        }
+      }
+    });
+  });
+
+  test('folds authoritative per-event cost into the rollup when contextCost is on', async () => {
+    const res = createMockRes();
+    const usageEmitSink = [];
+    /** Stub pricing mirroring getMultiplier/getCacheMultiplier shape */
+    const usageCost = {
+      enabled: true,
+      pricing: {
+        getMultiplier: ({ tokenType }) => (tokenType === 'completion' ? 15 : 3),
+        getCacheMultiplier: ({ cacheType }) => (cacheType === 'write' ? 3.75 : 0.3),
+      },
+    };
+    await runToolLoop({ res, collectedUsage: [], usageEmitSink, usageCost });
+
+    for (const event of usageEmitSink) {
+      expect(typeof event.cost).toBe('number');
+    }
+    const usage = aggregateEmittedUsage(usageEmitSink);
+    expect(usage.cost).toBeGreaterThan(0);
+    expect(usage.cost).toBeCloseTo(usageEmitSink.reduce((sum, e) => sum + e.cost, 0));
+  });
+
+  test('emit path prices each call by its producing agent and strips the agentId tag', () => {
+    const res = createMockRes();
+    const usageEmitSink = [];
+    /** Two endpoints share a model id but bill at different rates. */
+    const primaryConfig = { 'gpt-4': { prompt: 0.01, completion: 0.03, context: 8192 } };
+    const subagentConfig = { 'gpt-4': { prompt: 0.05, completion: 0.15, context: 8192 } };
+    const byAgentId = new Map([
+      ['primary', primaryConfig],
+      ['sub', subagentConfig],
+    ]);
+    const usageCost = {
+      enabled: true,
+      endpointTokenConfig: primaryConfig,
+      pricing: {
+        getMultiplier: ({ tokenType, model, endpointTokenConfig }) =>
+          endpointTokenConfig?.[model]?.[tokenType] ?? 0,
+        getCacheMultiplier: () => 0,
+      },
+      resolveEndpointTokenConfig: (usage) =>
+        resolveAgentTokenConfig({ agentId: usage?.agentId, byAgentId, fallback: primaryConfig }),
+    };
+
+    const { aggregateContent } = createContentAggregator();
+    const handlers = getDefaultHandlers({
+      res,
+      aggregateContent,
+      toolEndCallback: () => {},
+      collectedUsage: [],
+      usageEmitSink,
+      usageCost,
+    });
+    /** The CHAT_MODEL_END handler's emitUsage IS the real emitTokenUsage closure. */
+    const emitUsage = handlers[GraphEvents.CHAT_MODEL_END].emitUsage;
+    const call = { model: 'gpt-4', input_tokens: 100, output_tokens: 50, total_tokens: 150 };
+    emitUsage({ ...call, agentId: 'sub' });
+    emitUsage({ ...call, agentId: 'primary' });
+
+    const events = res.events.filter((e) => e.event === 'on_token_usage');
+    expect(events).toHaveLength(2);
+    /** agentId is an internal pricing tag — never streamed to the client nor
+     *  folded into the persisted rollup. */
+    for (const e of events) {
+      expect(e.data.agentId).toBeUndefined();
+    }
+    for (const entry of usageEmitSink) {
+      expect(entry.agentId).toBeUndefined();
+    }
+    /** Same tokens + model id, but the subagent endpoint's higher rates price
+     *  its call above the primary — proving per-agent emit pricing. The 5× ratio
+     *  ((100·0.05+50·0.15)/(100·0.01+50·0.03)) is scale-independent of credit units. */
+    expect(events[1].data.cost).toBeGreaterThan(0);
+    expect(events[0].data.cost).toBeGreaterThan(events[1].data.cost);
+    expect(events[0].data.cost / events[1].data.cost).toBeCloseTo(5);
+  });
+
+  test('persists usage and context snapshot for resume via GenerationJobManager', async () => {
+    const streamId = `usage-e2e-stream-${Date.now()}`;
+    await GenerationJobManager.createJob(streamId, 'user-1', 'convo-1');
+
+    const res = createMockRes();
+    await runToolLoop({ res, streamId, collectedUsage: [] });
+
+    const resumeState = await GenerationJobManager.getResumeState(streamId);
+    expect(resumeState).not.toBeNull();
+
+    expect(resumeState.collectedUsage).toHaveLength(2);
+    expect(resumeState.collectedUsage[0]).toMatchObject(FIRST_CALL_USAGE);
+    expect(resumeState.collectedUsage[1]).toMatchObject(SECOND_CALL_USAGE);
+
+    if (hasContextUsageEvent) {
+      expect(resumeState.contextUsage.breakdown.maxContextTokens).toBe(MAX_CONTEXT_TOKENS);
+      /** Latest-wins: the persisted snapshot is the second call's */
+      expect(resumeState.contextUsage.prePruneContextTokens).toBeGreaterThan(0);
+      /** Reconciled to the final primary call's actual prompt: openAI folds cache
+       *  into input_tokens (150), so the resume snapshot's used = 150 — the real
+       *  context, not the calibrated estimate. */
+      const used =
+        resumeState.contextUsage.contextBudget - resumeState.contextUsage.remainingContextTokens;
+      expect(used).toBe(SECOND_CALL_USAGE.input_tokens);
+    }
+  });
+
+  /** Drives a real summarization (tight context + padded history); self-summarize
+   *  reuses the overridden fake model so no API key is needed. */
+  async function runSummarizationLoop({ res, collectedUsage, contextUsageSink, usageEmitSink }) {
+    const { aggregateContent } = createContentAggregator();
+    const handlers = getDefaultHandlers({
+      res,
+      aggregateContent,
+      toolEndCallback: () => {},
+      collectedUsage,
+      contextUsageSink,
+      usageEmitSink,
+      summarizationOptions: { enabled: true },
+    });
+
+    const pad = 'context detail to overflow the tiny budget. '.repeat(40);
+    const history = [
+      new HumanMessage(`Turn 1 question. ${pad}`),
+      new AIMessage(`Turn 1 answer. ${pad}`),
+      new HumanMessage(`Turn 2 question. ${pad}`),
+      new AIMessage(`Turn 2 answer. ${pad}`),
+      new HumanMessage(`Final question after a lot of prior history. ${pad}`),
+    ];
+    const indexTokenCountMap = {};
+    history.forEach((message, i) => {
+      indexTokenCountMap[i] = charCounter(message);
+    });
+
+    const run = await Run.create({
+      runId: `summ-e2e-${Date.now()}`,
+      graphConfig: {
+        type: 'standard',
+        llmConfig: {
+          provider: Providers.OPENAI,
+          model: 'gpt-4o-mini',
+          streaming: true,
+          streamUsage: false,
+        },
+        instructions: 'You are a helpful assistant.',
+        maxContextTokens: 700,
+        summarizationEnabled: true,
+        summarizationConfig: { provider: Providers.OPENAI, model: 'gpt-4o-mini' },
+      },
+      returnContent: true,
+      customHandlers: handlers,
+      tokenCounter: charCounter,
+      indexTokenCountMap,
+    });
+
+    run.Graph.overrideModel = new UsageFakeModel(
+      { responses: ['## Summary\nPrior turns compacted.', 'Here is the final answer.'] },
+      [{ input_tokens: 40, output_tokens: 8, total_tokens: 48 }],
+    );
+
+    await run.processStream(
+      { messages: history },
+      {
+        configurable: { thread_id: 'summ-e2e-thread', user_id: 'user-1' },
+        streamMode: 'values',
+        version: 'v2',
+      },
+    );
+    return run;
+  }
+
+  /** A summarized turn compacts the context (summary tokens replace the older
+   *  turns) and the reduced snapshot is persisted — the latest snapshot is
+   *  followed by a primary usage, so the save guard keeps it and the client
+   *  uses the snapshot (not the inflated whole-history estimate). */
+  test('persists the reduced (compacted) snapshot after summarization', async () => {
+    if (!hasContextUsageEvent) {
+      return;
+    }
+    const res = createMockRes();
+    const contextUsageSink = { latest: null, count: 0 };
+    const usageEmitSink = [];
+    await runSummarizationLoop({ res, collectedUsage: [], contextUsageSink, usageEmitSink });
+
+    const snapshot = contextUsageSink.latest;
+    /** Summarization fired: a summary exists and the kept message tokens are
+     *  small (the compacted context, not the full history). */
+    expect(snapshot?.breakdown?.summaryTokens).toBeGreaterThan(0);
+    expect(snapshot?.breakdown?.messageTokens).toBeLessThan(snapshot?.breakdown?.summaryTokens);
+
+    /** The save guard keeps it: a primary usage follows the latest snapshot. */
+    const afterLatest = usageEmitSink.slice(contextUsageSink.latestUsageIndex ?? 0);
+    expect(afterLatest.some((e) => e.usage_type == null)).toBe(true);
+    expect(
+      buildPersistedContextUsage(snapshot, usageEmitSink).breakdown.summaryTokens,
+    ).toBeGreaterThan(0);
+  });
+});
diff --git a/api/server/controllers/agents/__tests__/usageEvents.live.spec.js b/api/server/controllers/agents/__tests__/usageEvents.live.spec.js
new file mode 100644
index 00000000000..ff02c9325f6
--- /dev/null
+++ b/api/server/controllers/agents/__tests__/usageEvents.live.spec.js
@@ -0,0 +1,161 @@
+/**
+ * Live host-layer verification: real Anthropic run through the actual
+ * getDefaultHandlers pipeline, asserting the SSE usage/context events the
+ * client consumes and their resume persistence.
+ *
+ * Run with:
+ * RUN_USAGE_LIVE_TESTS=1 ANTHROPIC_API_KEY=... npx jest usageEvents.live --runInBand
+ */
+const { HumanMessage } = require('@langchain/core/messages');
+const { Run, Providers, GraphEvents } = require('@librechat/agents');
+const { GenerationJobManager } = require('@librechat/api');
+const { getDefaultHandlers } = require('~/server/controllers/agents/callbacks');
+
+jest.mock('nanoid', () => ({
+  nanoid: jest.fn(() => 'mock-nanoid'),
+}));
+
+jest.mock('~/server/services/Files/Citations', () => ({
+  processFileCitations: jest.fn(),
+}));
+
+jest.mock('~/server/services/Files/Code/process', () => ({
+  processCodeOutput: jest.fn(),
+  runPreviewFinalize: jest.fn(),
+}));
+
+jest.mock('~/server/services/Files/process', () => ({
+  saveBase64Image: jest.fn(),
+}));
+
+const shouldRunLive =
+  process.env.RUN_USAGE_LIVE_TESTS === '1' &&
+  process.env.ANTHROPIC_API_KEY != null &&
+  process.env.ANTHROPIC_API_KEY !== '';
+
+const describeIfLive = shouldRunLive ? describe : describe.skip;
+const modelName = process.env.ANTHROPIC_USAGE_LIVE_MODEL ?? 'claude-haiku-4-5';
+const hasContextUsageEvent = GraphEvents.ON_CONTEXT_USAGE != null;
+
+const charCounter = (msg) => {
+  const content = msg.content;
+  if (typeof content === 'string') {
+    return Math.ceil(content.length / 4) + 3;
+  }
+  if (Array.isArray(content)) {
+    let length = 3;
+    for (const part of content) {
+      if (typeof part === 'string') {
+        length += Math.ceil(part.length / 4);
+      } else if (typeof part?.text === 'string') {
+        length += Math.ceil(part.text.length / 4);
+      }
+    }
+    return length;
+  }
+  return 3;
+};
+
+function createMockRes() {
+  const events = [];
+  return {
+    events,
+    headersSent: true,
+    writableEnded: false,
+    write(payload) {
+      for (const line of String(payload).split('\n')) {
+        if (line.startsWith('data: ')) {
+          events.push(JSON.parse(line.slice(6)));
+        }
+      }
+      return true;
+    },
+  };
+}
+
+describeIfLive('live usage events through the host pipeline', () => {
+  jest.setTimeout(120000);
+
+  afterAll(async () => {
+    await GenerationJobManager.destroy();
+  });
+
+  test('streams real provider usage and persists it for resume', async () => {
+    const streamId = `usage-live-${Date.now()}`;
+    await GenerationJobManager.createJob(streamId, 'user-live', 'convo-live');
+
+    /** streamId mode routes events through the job emitter — capture them
+     *  as a subscribed resumable client would, not via res.write */
+    const res = createMockRes();
+    await GenerationJobManager.subscribe(streamId, (event) => {
+      res.events.push(event);
+    });
+    const collectedUsage = [];
+    const handlers = getDefaultHandlers({
+      res,
+      aggregateContent: () => {},
+      toolEndCallback: () => {},
+      collectedUsage,
+      streamId,
+    });
+
+    const run = await Run.create({
+      runId: 'usage-live-response',
+      graphConfig: {
+        type: 'standard',
+        llmConfig: {
+          provider: Providers.ANTHROPIC,
+          model: modelName,
+          apiKey: process.env.ANTHROPIC_API_KEY,
+          temperature: 0,
+          maxTokens: 64,
+          streaming: true,
+          streamUsage: true,
+        },
+        instructions: 'You are concise. Reply with one short sentence.',
+        maxContextTokens: 8000,
+      },
+      returnContent: true,
+      customHandlers: handlers,
+      tokenCounter: charCounter,
+      indexTokenCountMap: {},
+    });
+
+    await run.processStream(
+      { messages: [new HumanMessage('Say hello in five words or fewer.')] },
+      {
+        configurable: { thread_id: 'usage-live-thread', user_id: 'user-live' },
+        streamMode: 'values',
+        version: 'v2',
+      },
+    );
+
+    const usageEvents = res.events.filter((e) => e.event === 'on_token_usage');
+    expect(usageEvents).toHaveLength(1);
+    const usage = usageEvents[0].data;
+    expect(usage.input_tokens).toBeGreaterThan(0);
+    expect(usage.output_tokens).toBeGreaterThan(0);
+    expect(usage.provider).toBe(Providers.ANTHROPIC);
+    expect(usage.model).toBe(modelName);
+    expect(collectedUsage).toHaveLength(1);
+    expect(usage.input_tokens).toBe(collectedUsage[0].input_tokens);
+
+    if (hasContextUsageEvent) {
+      const contextEvents = res.events.filter((e) => e.event === 'on_context_usage');
+      expect(contextEvents).toHaveLength(1);
+      const snapshot = contextEvents[0].data;
+      expect(snapshot.breakdown.maxContextTokens).toBe(8000);
+      const estimatedUsed = snapshot.contextBudget - snapshot.remainingContextTokens;
+      expect(estimatedUsed).toBeGreaterThan(0);
+      expect(estimatedUsed / usage.input_tokens).toBeGreaterThan(0.2);
+      expect(estimatedUsed / usage.input_tokens).toBeLessThan(5);
+    }
+
+    const resumeState = await GenerationJobManager.getResumeState(streamId);
+    expect(resumeState.collectedUsage).toHaveLength(1);
+    expect(resumeState.collectedUsage[0].input_tokens).toBe(usage.input_tokens);
+    if (hasContextUsageEvent) {
+      expect(resumeState.contextUsage.breakdown.maxContextTokens).toBe(8000);
+    }
+  });
+});
diff --git a/api/server/controllers/agents/callbacks.js b/api/server/controllers/agents/callbacks.js
index 314ee481a6c..d0b2ea4aaab 100644
--- a/api/server/controllers/agents/callbacks.js
+++ b/api/server/controllers/agents/callbacks.js
@@ -1,23 +1,39 @@
 const { nanoid } = require('nanoid');
 const { logger } = require('@librechat/data-schemas');
-const { Tools, StepTypes, FileContext, ErrorTypes } = require('librechat-data-provider');
+const {
+  Tools,
+  StepTypes,
+  FileContext,
+  ErrorTypes,
+  UsageEvents,
+} = require('librechat-data-provider');
 const {
   GraphEvents,
   GraphNodeKeys,
   ToolEndHandler,
-  CODE_EXECUTION_TOOLS,
   createContentAggregator,
 } = require('@librechat/agents');
 const {
   sendEvent,
+  computeUsageCostUSD,
   GenerationJobManager,
   writeAttachmentEvent,
   createToolExecuteHandler,
+  HOST_FILE_AUTHORING_ARTIFACT_KEY,
+  isCodeSessionToolName,
 } = require('@librechat/api');
 const { processFileCitations } = require('~/server/services/Files/Citations');
 const { processCodeOutput, runPreviewFinalize } = require('~/server/services/Files/Code/process');
 const { saveBase64Image } = require('~/server/services/Files/process');
 
+function isHostFileAuthoringArtifact(artifact) {
+  return artifact?.[HOST_FILE_AUTHORING_ARTIFACT_KEY] === true;
+}
+
+function isCodeArtifactToolOutput(output) {
+  return isCodeSessionToolName(output.name) || isHostFileAuthoringArtifact(output.artifact);
+}
+
 class ModelEndHandler {
   /**
    * @param {Array<UsageMetadata>} collectedUsage
@@ -32,13 +48,16 @@ class ModelEndHandler {
    *   Optional; when `null`, the handler is a no-op for signatures. Non-Vertex
    *   providers don't emit `additional_kwargs.signatures`, so capture is also
    *   a no-op for them even when the map is provided.
+   * @param {(data: Record<string, unknown>) => Promise<void> | void} [emitUsage] Optional
+   *   callback to stream per-call token usage to the client.
    */
-  constructor(collectedUsage, collectedThoughtSignatures = null) {
+  constructor(collectedUsage, collectedThoughtSignatures = null, emitUsage = null) {
     if (!Array.isArray(collectedUsage)) {
       throw new Error('collectedUsage must be an array');
     }
     this.collectedUsage = collectedUsage;
     this.collectedThoughtSignatures = collectedThoughtSignatures;
+    this.emitUsage = emitUsage;
   }
 
   finalize(errorMessage) {
@@ -90,11 +109,62 @@ class ModelEndHandler {
       if (agentContext.provider) {
         usage.provider = agentContext.provider;
       }
+      /** Tag the producing agent so multi-endpoint graphs can price each call
+       *  with its own endpoint token config (recordCollectedUsage resolver). */
+      if (agentContext.agentId) {
+        usage.agentId = agentContext.agentId;
+      }
 
-      const taggedUsage = markSummarizationUsage(usage, metadata);
+      let taggedUsage = markSummarizationUsage(usage, metadata);
+      /** Hidden intermediate sequential-agent calls are billed but never shown.
+       *  Tag them non-primary on the COLLECTED usage too (not just the emit) so
+       *  recordCollectedUsage excludes their output from the parent's tokenCount
+       *  and the client folds them into cost/totals only — not the live gauge. */
+      if (
+        taggedUsage.usage_type == null &&
+        !checkIfLastAgent(metadata?.last_agent_id, metadata?.langgraph_node) &&
+        metadata?.hide_sequential_outputs === true
+      ) {
+        taggedUsage = { ...taggedUsage, usage_type: 'sequential' };
+      }
 
       this.collectedUsage.push(taggedUsage);
 
+      if (this.emitUsage) {
+        /** Normalize Anthropic/Bedrock-style top-level cache fields into details */
+        const cache_creation =
+          taggedUsage.input_token_details?.cache_creation ??
+          taggedUsage.cache_creation_input_tokens;
+        const cache_read =
+          taggedUsage.input_token_details?.cache_read ?? taggedUsage.cache_read_input_tokens;
+        try {
+          await this.emitUsage({
+            input_tokens: taggedUsage.input_tokens,
+            output_tokens: taggedUsage.output_tokens,
+            total_tokens: taggedUsage.total_tokens,
+            input_token_details:
+              cache_creation != null || cache_read != null
+                ? { cache_creation, cache_read }
+                : undefined,
+            model: taggedUsage.model,
+            provider: taggedUsage.provider,
+            usage_type: taggedUsage.usage_type,
+            /** Producing agent for per-endpoint pricing; consumed by the emit
+             *  cost resolver and not included in the emitted/persisted payload. */
+            agentId: taggedUsage.agentId,
+            runId: metadata?.run_id,
+            /** Per-run sequence so identical payloads from distinct calls
+             *  stay distinguishable during resume dedupe */
+            seq: this.collectedUsage.length,
+          });
+        } catch (err) {
+          /** Best-effort telemetry: a failed emit (closed SSE, Redis publish
+           *  error) must not abort the handler before the thought-signature
+           *  capture below, or resumed tool-call requests lose that metadata */
+          logger.warn('[ModelEndHandler] Failed to emit token usage', err);
+        }
+      }
+
       /**
        * `additional_kwargs.signatures` is a flat array indexed by response
        * part position (text + functionCall interleaved). `tool_calls` is
@@ -211,6 +281,12 @@ function feedSubagentAggregator(aggregator, event) {
  * @param {Array<UsageMetadata>} options.collectedUsage - The list of collected usage metadata.
  * @param {string | null} [options.streamId] - The stream ID for resumable mode, or null for standard mode.
  * @param {ToolExecuteOptions} [options.toolExecuteOptions] - Options for event-driven tool execution.
+ * @param {UsageCostDeps} [options.usageCost] - Pricing context for authoritative per-event cost.
+ * @param {{ latest: TContextUsageEvent | null, count: number }} [options.contextUsageSink] - Mutable
+ *   holder for the latest visible context snapshot + a count of visible snapshots (model calls),
+ *   used to persist the breakdown only when the final call emitted usage.
+ * @param {Array<TTokenUsageEvent>} [options.usageEmitSink] - Array collecting each emitted
+ *   `on_token_usage` payload (incl. cost) so the response's usage rollup can be persisted.
  * @returns {Record<string, t.EventHandler>} The default handlers.
  * @throws {Error} If the request is not found.
  */
@@ -224,14 +300,53 @@ function getDefaultHandlers({
   toolExecuteOptions = null,
   summarizationOptions = null,
   subagentAggregatorsByToolCallId = null,
+  usageCost = null,
+  contextUsageSink = null,
+  usageEmitSink = null,
 }) {
   if (!res || !aggregateContent) {
     throw new Error(
       `[getDefaultHandlers] Missing required options: res: ${!res}, aggregateContent: ${!aggregateContent}`,
     );
   }
+  /**
+   * Emit a token-usage event, attaching the authoritative per-event USD cost
+   * when cost display is enabled. The backend is the single source of truth
+   * for pricing (premium tiers, cache rates) — the client sums these instead
+   * of re-deriving from base rates.
+   * @param {Record<string, unknown>} data
+   */
+  const emitTokenUsage = ({ agentId, ...data }) => {
+    let payload = data;
+    if (usageCost?.enabled === true && usageCost.pricing) {
+      try {
+        /** Price with the producing agent's config (multi-endpoint graphs) so
+         *  the streamed/persisted cost matches the per-agent balance transaction;
+         *  `agentId` is resolved here, not forwarded to the client or rollup. */
+        const endpointTokenConfig = usageCost.resolveEndpointTokenConfig
+          ? usageCost.resolveEndpointTokenConfig({ agentId })
+          : usageCost.endpointTokenConfig;
+        payload = {
+          ...data,
+          cost: computeUsageCostUSD(data, usageCost.pricing, endpointTokenConfig),
+        };
+      } catch (err) {
+        logger.warn('[getDefaultHandlers] Failed to compute usage cost', err);
+      }
+    }
+    /** Collect the same payload the client folds so the response's usage rollup
+     *  persisted on `metadata.usage` reproduces the live branch/total + cost. */
+    if (usageEmitSink) {
+      usageEmitSink.push(payload);
+    }
+    return emitEvent(res, streamId, { event: UsageEvents.ON_TOKEN_USAGE, data: payload });
+  };
   const handlers = {
-    [GraphEvents.CHAT_MODEL_END]: new ModelEndHandler(collectedUsage, collectedThoughtSignatures),
+    [GraphEvents.CHAT_MODEL_END]: new ModelEndHandler(
+      collectedUsage,
+      collectedThoughtSignatures,
+      emitTokenUsage,
+    ),
     [GraphEvents.TOOL_END]: new ToolEndHandler(toolEndCallback, logger),
     [GraphEvents.ON_RUN_STEP]: {
       /**
@@ -416,6 +531,43 @@ function getDefaultHandlers({
 
   handlers[GraphEvents.ON_AGENT_LOG] = { handle: agentLogHandler };
 
+  /** Guarded: no-op when the installed @librechat/agents predates the event */
+  if (GraphEvents.ON_CONTEXT_USAGE) {
+    handlers[GraphEvents.ON_CONTEXT_USAGE] = {
+      /**
+       * Forward per-model-call context usage snapshots to the client,
+       * honoring the same sequential-agent visibility gate as deltas.
+       * @param {string} event - The event name.
+       * @param {StreamEventData} data - The event data.
+       * @param {GraphRunnableConfig['configurable']} [metadata] The runnable metadata.
+       */
+      handle: async (event, data, metadata) => {
+        if (
+          checkIfLastAgent(metadata?.last_agent_id, metadata?.langgraph_node) ||
+          !metadata?.hide_sequential_outputs
+        ) {
+          /** Capture the latest visible snapshot (last-wins) and how many usage
+           *  events preceded it BEFORE awaiting the emit. `emitEvent` can yield
+           *  (resumable SSE / Redis publish); with parallel runs active this
+           *  call's own primary usage could land in `usageEmitSink` during that
+           *  yield, pushing `latestUsageIndex` past the very event that proves the
+           *  snapshot completed — the save path would then slice it away and drop
+           *  a valid breakdown. The recorded index lets the save path persist only
+           *  when a PRIMARY usage follows this snapshot (the snapshot's call
+           *  actually invoked the model); a summarization detour emits a snapshot
+           *  whose only following usage is tagged `summarization`, which a plain
+           *  snapshot-count would over-count and wrongly drop. */
+          if (contextUsageSink) {
+            contextUsageSink.latest = data;
+            contextUsageSink.count = (contextUsageSink.count ?? 0) + 1;
+            contextUsageSink.latestUsageIndex = usageEmitSink?.length ?? 0;
+          }
+          await emitEvent(res, streamId, { event, data });
+        }
+      },
+    };
+  }
+
   return handlers;
 }
 
@@ -623,7 +775,7 @@ function createToolEndCallback({ req, res, artifactPromises, streamId = null })
       return;
     }
 
-    if (!CODE_EXECUTION_TOOLS.has(output.name)) {
+    if (!isCodeArtifactToolOutput(output)) {
       return;
     }
 
@@ -890,7 +1042,7 @@ function createResponsesToolEndCallback({ req, res, tracker, artifactPromises })
       return;
     }
 
-    if (!CODE_EXECUTION_TOOLS.has(output.name)) {
+    if (!isCodeArtifactToolOutput(output)) {
       return;
     }
 
diff --git a/api/server/controllers/agents/client.js b/api/server/controllers/agents/client.js
index 9c85560a668..94d17fa3f51 100644
--- a/api/server/controllers/agents/client.js
+++ b/api/server/controllers/agents/client.js
@@ -9,9 +9,9 @@ const {
   logToolError,
   sanitizeTitle,
   payloadParser,
-  resolveHeaders,
   createSafeUser,
   initializeAgent,
+  resolveConfigHeaders,
   countTokens,
   getBalanceConfig,
   omitTitleOptions,
@@ -21,6 +21,14 @@ const {
   applyContextToAgent,
   isMemoryAgentEnabled,
   recordCollectedUsage,
+  sendEvent,
+  computeUsageCostUSD,
+  aggregateEmittedUsage,
+  resolveAgentTokenConfig,
+  buildPersistedContextUsage,
+  computeSummaryUsedTokens,
+  priorRunOutputTokens,
+  createSubagentUsageSink,
   isDeepSeekReasoningProvider,
   GenerationJobManager,
   getTransactionsConfig,
@@ -30,10 +38,13 @@ const {
   createMultiAgentMapper,
   filterMalformedContentParts,
   countFormattedMessageTokens,
+  prependFileContext,
   hydrateMissingIndexTokenCounts,
   injectSkillPrimes,
+  collectFreshSkillPrimeNames,
   isSkillPrimeMessage,
   collectFileIds,
+  processTextWithTokenLimit,
   buildAgentScopedContext,
   buildSkillPrimeContentParts,
   buildInitialToolSessions,
@@ -48,6 +59,7 @@ const {
 } = require('@librechat/agents');
 const {
   Constants,
+  UsageEvents,
   Permissions,
   VisionModes,
   ContentTypes,
@@ -57,6 +69,7 @@ const {
   isAgentsEndpoint,
   isEphemeralAgentId,
   removeNullishValues,
+  DEFAULT_MEMORY_MAX_INPUT_TOKENS,
 } = require('librechat-data-provider');
 const { filterFilesByAgentAccess } = require('~/server/services/Files/permissions');
 const { encodeAndFormat } = require('~/server/services/Files/images/encode');
@@ -69,6 +82,8 @@ const db = require('~/models');
 
 const loadAgent = (params) => loadAgentFn(params, { getAgent: db.getAgent, getMCPServerTools });
 
+const MEMORY_INPUT_CHARS_PER_TOKEN = 8;
+
 class AgentClient extends BaseClient {
   constructor(options = {}) {
     super(null, options);
@@ -98,11 +113,22 @@ class AgentClient extends BaseClient {
       artifactPromises,
       maxContextTokens,
       subagentAggregatorsByToolCallId,
+      contextUsageSink,
+      usageEmitSink,
       ...clientOptions
     } = options;
 
     this.agentConfigs = agentConfigs;
     this.maxContextTokens = maxContextTokens;
+    /** Latest visible context snapshot for this response, captured live by the
+     *  ON_CONTEXT_USAGE handler; persisted on `metadata.contextUsage`.
+     *  @type {{ latest: import('librechat-data-provider').TContextUsageEvent | null } | undefined} */
+    this.contextUsageSink = contextUsageSink;
+    /** Every emitted `on_token_usage` payload for this response (primary,
+     *  summarization, sequential, and subagent); aggregated into the rollup
+     *  persisted on `metadata.usage`.
+     *  @type {Array<import('librechat-data-provider').TTokenUsageEvent> | undefined} */
+    this.usageEmitSink = usageEmitSink;
     /** @type {MessageContentComplex[]} */
     this.contentParts = contentParts;
     /** @type {Array<UsageMetadata>} */
@@ -121,6 +147,11 @@ class AgentClient extends BaseClient {
      *  harvests `contentParts` onto the matching `subagent` tool_call
      *  so the child's full activity survives a page refresh. */
     this.subagentAggregatorsByToolCallId = subagentAggregatorsByToolCallId ?? new Map();
+    /** In-flight `on_token_usage` emits from subagent child runs. The sink
+     *  fires the emitter without awaiting, so chatCompletion's finally flushes
+     *  these before returning — otherwise job cleanup can race the persist.
+     *  @type {Promise<void>[]} */
+    this.pendingSubagentEmits = [];
     /** @type {AgentClientOptions} */
     this.options = Object.assign({ endpoint: options.endpoint }, clientOptions);
     /** @type {string} */
@@ -135,6 +166,8 @@ class AgentClient extends BaseClient {
     this.usage;
     /** @type {Record<string, number>} */
     this.indexTokenCountMap = {};
+    /** @type {Array<Record<string, unknown>> | null} */
+    this.memoryPayload = null;
     /** @type {(messages: BaseMessage[]) => Promise<void>} */
     this.processMemory;
   }
@@ -209,6 +242,7 @@ class AgentClient extends BaseClient {
         {
           spec: this.options.spec,
           iconURL: this.options.iconURL,
+          chatProjectId: this.options.chatProjectId,
           endpoint: this.options.endpoint,
           agent_id: this.options.agent.id,
           modelLabel: this.options.modelLabel,
@@ -314,39 +348,51 @@ class AgentClient extends BaseClient {
     }
 
     /** @type {Record<number, number>} */
-    const canonicalTokenCountMap = {};
+    const indexTokenCountMap = {};
     /** @type {Record<string, number>} */
     const tokenCountMap = {};
+    const memoryPayload = [];
+    let hasFileContext = false;
     let promptTokenTotal = 0;
+    const encoding = this.getEncoding();
     const formattedMessages = orderedMessages.map((message, i) => {
       const formattedMessage = formatMessage({
         message,
         userName: this.options?.name,
         assistantName: this.options?.modelLabel,
       });
+      const memoryFormattedMessage = formatMessage({
+        message,
+        userName: this.options?.name,
+        assistantName: this.options?.modelLabel,
+      });
 
-      /** For non-latest messages, prepend file context directly to message content */
-      if (message.fileContext && i !== orderedMessages.length - 1) {
-        if (typeof formattedMessage.content === 'string') {
-          formattedMessage.content = message.fileContext + '\n' + formattedMessage.content;
-        } else {
-          const textPart = formattedMessage.content.find((part) => part.type === 'text');
-          textPart
-            ? (textPart.text = message.fileContext + '\n' + textPart.text)
-            : formattedMessage.content.unshift({ type: 'text', text: message.fileContext });
-        }
+      /**
+       * Bind file context to the message it belongs to. Historical attachments
+       * are resent inline, so the current turn's text attachment must be inline
+       * too instead of living only in the dynamic system tail.
+       */
+      if (message.fileContext) {
+        hasFileContext = true;
+        prependFileContext(formattedMessage, message.fileContext);
       }
 
-      const dbTokenCount = orderedMessages[i].tokenCount;
-      const needsTokenCount = !dbTokenCount || message.fileContext;
+      memoryPayload.push(memoryFormattedMessage);
 
-      if (needsTokenCount || (this.isVisionModel && (message.image_urls || message.files))) {
-        orderedMessages[i].tokenCount = countFormattedMessageTokens(
-          formattedMessage,
-          this.getEncoding(),
-        );
+      const dbTokenCount = Number(orderedMessages[i].tokenCount);
+      const hasDbTokenCount = Number.isFinite(dbTokenCount) && dbTokenCount > 0;
+      const needsCanonicalTokenCount =
+        !hasDbTokenCount || (this.isVisionModel && (message.image_urls || message.files));
+
+      let canonicalTokenCount = hasDbTokenCount ? dbTokenCount : 0;
+      if (needsCanonicalTokenCount) {
+        canonicalTokenCount = countFormattedMessageTokens(memoryFormattedMessage, encoding);
       }
 
+      const promptMessageTokenCount = message.fileContext
+        ? countFormattedMessageTokens(formattedMessage, encoding)
+        : canonicalTokenCount;
+
       /* If message has files, calculate image token cost */
       if (this.message_file_map && this.message_file_map[message.messageId]) {
         const attachments = this.message_file_map[message.messageId];
@@ -361,13 +407,19 @@ class AgentClient extends BaseClient {
         }
       }
 
-      const tokenCount = Number(orderedMessages[i].tokenCount);
-      const normalizedTokenCount = Number.isFinite(tokenCount) && tokenCount > 0 ? tokenCount : 0;
-      canonicalTokenCountMap[i] = normalizedTokenCount;
-      promptTokenTotal += normalizedTokenCount;
+      const normalizedCanonicalTokenCount =
+        Number.isFinite(canonicalTokenCount) && canonicalTokenCount > 0 ? canonicalTokenCount : 0;
+      const normalizedPromptTokenCount =
+        Number.isFinite(promptMessageTokenCount) && promptMessageTokenCount > 0
+          ? promptMessageTokenCount
+          : 0;
+
+      orderedMessages[i].tokenCount = normalizedCanonicalTokenCount;
+      indexTokenCountMap[i] = normalizedPromptTokenCount;
+      promptTokenTotal += normalizedPromptTokenCount;
 
       if (message.messageId) {
-        tokenCountMap[message.messageId] = normalizedTokenCount;
+        tokenCountMap[message.messageId] = normalizedCanonicalTokenCount;
       }
 
       if (isEnabled(process.env.AGENT_DEBUG_LOGGING)) {
@@ -376,9 +428,10 @@ class AgentClient extends BaseClient {
           Array.isArray(message.content) && message.content.some((p) => p && p.type === 'summary');
         const suffix = hasSummary ? '[S]' : '';
         const id = (message.messageId ?? message.id ?? '').slice(-8);
-        const recalced = needsTokenCount ? orderedMessages[i].tokenCount : null;
+        const recalced = needsCanonicalTokenCount ? normalizedCanonicalTokenCount : null;
+        const promptRecalced = message.fileContext ? normalizedPromptTokenCount : null;
         logger.debug(
-          `[AgentClient] msg[${i}] ${role}${suffix} id=…${id} db=${dbTokenCount} needsRecount=${needsTokenCount} recalced=${recalced} tokens=${normalizedTokenCount}`,
+          `[AgentClient] msg[${i}] ${role}${suffix} id=…${id} db=${dbTokenCount} needsRecount=${needsCanonicalTokenCount} recalced=${recalced} promptRecalced=${promptRecalced} tokens=${normalizedPromptTokenCount}`,
         );
       }
 
@@ -386,22 +439,18 @@ class AgentClient extends BaseClient {
     });
 
     payload = formattedMessages;
+    this.memoryPayload = hasFileContext ? memoryPayload : null;
     messages = orderedMessages;
     promptTokens = promptTokenTotal;
 
     /**
      * Build shared run context - applies to ALL agents in the run.
-     * This includes file context from the latest message and augmented prompt (RAG).
+     * Request attachment file context is already bound inline to the latest
+     * user message above; only side-channel context belongs here.
      * Memory context is handled separately and applied per-agent based on config.
      */
     const sharedRunContextParts = [];
 
-    /** File context from the latest message (attachments) */
-    const latestMessage = orderedMessages[orderedMessages.length - 1];
-    if (latestMessage?.fileContext) {
-      sharedRunContextParts.push(latestMessage.fileContext);
-    }
-
     /** Augmented prompt from RAG/context handlers */
     if (this.contextHandlers) {
       this.augmentedPrompt = await this.contextHandlers.createContext();
@@ -427,8 +476,8 @@ class AgentClient extends BaseClient {
       tokenCountFn: (text) => countTokens(text),
     });
 
-    /** Preserve canonical pre-format token counts for all history entering graph formatting */
-    this.indexTokenCountMap = canonicalTokenCountMap;
+    /** Preserve prompt token counts for graph formatting and pruning. */
+    this.indexTokenCountMap = indexTokenCountMap;
 
     /** Extract contextMeta from the parent response (second-to-last in ordered chain;
      *  last is the current user message). Seeds the pruner's calibration EMA for this run. */
@@ -741,7 +790,44 @@ class AgentClient extends BaseClient {
 
       const filteredMessages = messagesToProcess.map((msg) => this.filterImageUrls(msg));
       const bufferString = getBufferString(filteredMessages);
-      const bufferMessage = new HumanMessage(`# Current Chat:\n\n${bufferString}`);
+      const configuredMaxInputTokens = Number.isFinite(memoryConfig?.maxInputTokens)
+        ? Math.floor(memoryConfig.maxInputTokens)
+        : undefined;
+      const maxInputTokens =
+        configuredMaxInputTokens != null && configuredMaxInputTokens > 0
+          ? configuredMaxInputTokens
+          : DEFAULT_MEMORY_MAX_INPUT_TOKENS;
+      const maxInputChars = maxInputTokens * MEMORY_INPUT_CHARS_PER_TOKEN;
+      const isCharTruncated = bufferString.length > maxInputChars;
+      const memoryInput = `# Current Chat:\n\n${
+        isCharTruncated
+          ? `[Earlier chat content omitted due to memory input limit]\n\n${bufferString.slice(
+              -maxInputChars,
+            )}`
+          : bufferString
+      }`;
+      const {
+        text: limitedMemoryInput,
+        tokenCount,
+        wasTruncated,
+      } = await processTextWithTokenLimit({
+        text: memoryInput,
+        tokenLimit: maxInputTokens,
+        tokenCountFn: (text) => countTokens(text),
+        preserve: 'end',
+      });
+      if (isCharTruncated || wasTruncated) {
+        logger.warn('[MemoryAgent] Memory input truncated before processing', {
+          tokenCount,
+          messageId: this.responseMessageId,
+          conversationId: this.conversationId,
+          maxInputTokens,
+          wasTruncated,
+          maxInputChars,
+          originalLength: bufferString.length,
+        });
+      }
+      const bufferMessage = new HumanMessage(limitedMemoryInput);
       return await this.processMemory([bufferMessage]);
     } catch (error) {
       logger.error('Memory Agent failed to process memory', error);
@@ -758,11 +844,100 @@ class AgentClient extends BaseClient {
     });
 
     const completion = filterMalformedContentParts(this.contentParts);
+    const metadata = this.buildResponseMetadata();
+    return metadata ? { completion, metadata } : { completion };
+  }
+
+  /**
+   * Assembles the response message `metadata`: Vertex thought signatures plus
+   * the persisted context breakdown (Part A) and the usage/cost rollup (Part B),
+   * which rebuild the gauge breakdown and branch/total cost across reloads.
+   * Returns undefined when nothing was captured.
+   * @returns {{
+   *   thoughtSignatures?: Record<string, string>,
+   *   contextUsage?: import('librechat-data-provider').TContextUsageEvent,
+   *   usage?: import('librechat-data-provider').TResponseUsage,
+   * } | undefined}
+   */
+  buildResponseMetadata() {
+    /** @type {{
+     *   thoughtSignatures?: Record<string, string>,
+     *   contextUsage?: import('librechat-data-provider').TContextUsageEvent,
+     *   usage?: import('librechat-data-provider').TResponseUsage,
+     * }} */
+    const metadata = {};
     const signatures = this.collectedThoughtSignatures;
-    if (!signatures || Object.keys(signatures).length === 0) {
-      return { completion };
+    if (signatures && Object.keys(signatures).length > 0) {
+      metadata.thoughtSignatures = signatures;
+    }
+    const usageEvents = this.usageEmitSink ?? [];
+    /** Persist the breakdown only when the latest snapshot's OWN run completed —
+     *  i.e. a PRIMARY usage event (usage_type == null) from that run's id arrived
+     *  AFTER the snapshot. Matching by run id keeps `completedOutputTokens` a real
+     *  post-snapshot delta even when parallel/direct runs interleave (A snapshot →
+     *  B snapshot → A usage must NOT persist B's snapshot with A's output); an
+     *  interrupted final call that emits no usage falls back to the per-message
+     *  estimate. It still keeps the post-summary snapshot: the summarization detour
+     *  emits an extra snapshot whose following primary usage shares that run's id,
+     *  which the old snapshot-count guard miscounted and wrongly dropped. Events
+     *  without a run id (older lib / resume) match any snapshot for back-compat. */
+    const latestSnapshot = this.contextUsageSink?.latest;
+    const latestSnapshotUsageIndex = this.contextUsageSink?.latestUsageIndex ?? 0;
+    const latestSnapshotRunId = latestSnapshot?.runId;
+    const hasPrimaryAfterSnapshot = usageEvents
+      .slice(latestSnapshotUsageIndex)
+      .some(
+        (event) =>
+          event.usage_type == null &&
+          (latestSnapshotRunId == null ||
+            event.runId == null ||
+            event.runId === latestSnapshotRunId),
+      );
+    if (latestSnapshot && hasPrimaryAfterSnapshot) {
+      metadata.contextUsage = buildPersistedContextUsage(latestSnapshot, usageEvents);
     }
-    return { completion, metadata: { thoughtSignatures: signatures } };
+    /** Lightweight summarization marker — persisted whenever this turn compacted
+     *  the context, INDEPENDENT of the snapshot guard above. When the client has
+     *  no usable snapshot on the branch and falls back to the per-message
+     *  estimate, it caps the discarded pre-summary history at this baseline
+     *  instead of re-summing it (the gauge otherwise reads 100% forever). Shared
+     *  with the abort save path via `computeSummaryUsedTokens`. Subtract the
+     *  response's earlier tool-loop outputs (the primaries that preceded the
+     *  latest snapshot, same run): those tokens are inside the snapshot baseline
+     *  AND in the response `tokenCount` the client estimate adds on top, so
+     *  leaving them in the marker double-counts them on a multi-call turn. */
+    const priorOutputTokens = priorRunOutputTokens(
+      usageEvents,
+      latestSnapshotUsageIndex,
+      latestSnapshotRunId,
+    );
+    const summaryUsedTokens = computeSummaryUsedTokens(latestSnapshot, priorOutputTokens);
+    if (summaryUsedTokens != null) {
+      metadata.summaryUsedTokens = summaryUsedTokens;
+    }
+    const usage = aggregateEmittedUsage(usageEvents);
+    if (usage) {
+      metadata.usage = usage;
+    }
+    return Object.keys(metadata).length > 0 ? metadata : undefined;
+  }
+
+  /**
+   * Resolves the endpoint token config for a usage item by its producing agent
+   * (multi-endpoint graphs: connected agents + subagents). A known agent's
+   * config is authoritative — including `undefined`, which prices with built-in
+   * rates (e.g. a non-custom agent in a custom-primary graph). Only an
+   * untagged/unknown agent falls back to the primary config, so single-endpoint
+   * graphs are unchanged.
+   * @param {UsageMetadata} usage
+   * @returns {import('@librechat/api').EndpointTokenConfig | undefined}
+   */
+  resolveAgentEndpointTokenConfig(usage) {
+    return resolveAgentTokenConfig({
+      agentId: usage?.agentId,
+      byAgentId: this.options.endpointTokenConfigByAgentId,
+      fallback: this.options.endpointTokenConfig,
+    });
   }
 
   /**
@@ -797,6 +972,7 @@ class AgentClient extends BaseClient {
         balance,
         transactions,
         endpointTokenConfig: this.options.endpointTokenConfig,
+        resolveEndpointTokenConfig: (usage) => this.resolveAgentEndpointTokenConfig(usage),
       },
     );
 
@@ -813,6 +989,84 @@ class AgentClient extends BaseClient {
     return this.usage;
   }
 
+  /**
+   * Builds the subagent usage emitter for {@link createSubagentUsageSink}.
+   * Streams each billed child-run usage to the client as an `on_token_usage`
+   * event tagged `subagent` (folds into session cost/totals, not the live
+   * gauge), with the authoritative cost when `interface.contextCost` is on.
+   * Returns undefined when there's no stream to write to.
+   * @param {AppConfig} [appConfig]
+   * @returns {((usage: UsageMetadata) => void) | undefined}
+   */
+  buildSubagentUsageEmitter(appConfig) {
+    const res = this.options.res;
+    const streamId = this.options.req?._resumableStreamId || null;
+    if (!res && !streamId) {
+      return undefined;
+    }
+    const includeCost = appConfig?.interfaceConfig?.contextCost === true;
+    return (usage) => {
+      const data = {
+        input_tokens: usage.input_tokens,
+        output_tokens: usage.output_tokens,
+        total_tokens: usage.total_tokens,
+        input_token_details: this.subagentCacheDetails(usage),
+        model: usage.model,
+        provider: usage.provider,
+        usage_type: 'subagent',
+        runId: this.responseMessageId,
+        /** Unique per collected entry (post-push length) for resume dedupe */
+        seq: this.collectedUsage.length,
+        /** Price with the SUBAGENT's own endpoint token config (its endpoint may
+         *  differ from the parent's); `usage.agentId` is tagged by the sink. */
+        cost: includeCost
+          ? computeUsageCostUSD(
+              usage,
+              { getMultiplier: db.getMultiplier, getCacheMultiplier: db.getCacheMultiplier },
+              this.resolveAgentEndpointTokenConfig(usage),
+            )
+          : undefined,
+      };
+      /** Fold into the response's usage rollup (synchronously, regardless of
+       *  emit success) so the persisted total matches the live session, which
+       *  also folds subagent usage into its cost/totals. */
+      if (this.usageEmitSink) {
+        this.usageEmitSink.push(data);
+      }
+      /** The sink fires this without awaiting, so retain the promise and flush
+       *  it in chatCompletion's finally — emitChunk persists (HSET) before
+       *  publishing, and job cleanup must not race that persist or resumed
+       *  clients miss billed subagent usage. */
+      const emit = (async () => {
+        try {
+          if (streamId) {
+            await GenerationJobManager.emitChunk(streamId, {
+              event: UsageEvents.ON_TOKEN_USAGE,
+              data,
+            });
+          } else {
+            sendEvent(res, { event: UsageEvents.ON_TOKEN_USAGE, data });
+          }
+        } catch (err) {
+          logger.warn('[AgentClient] Failed to emit subagent usage', err);
+        }
+      })();
+      this.pendingSubagentEmits.push(emit);
+      return emit;
+    };
+  }
+
+  /** Normalizes a subagent usage event's cache token details for emission. */
+  subagentCacheDetails(usage) {
+    const cache_creation =
+      usage.input_token_details?.cache_creation ?? usage.cache_creation_input_tokens;
+    const cache_read = usage.input_token_details?.cache_read ?? usage.cache_read_input_tokens;
+    if (cache_creation == null && cache_read == null) {
+      return undefined;
+    }
+    return { cache_creation, cache_read };
+  }
+
   /**
    * @param {TMessage} responseMessage
    * @returns {number}
@@ -893,7 +1147,30 @@ class AgentClient extends BaseClient {
         hasDeepSeekAgent(this.options.agent) ||
         (this.agentConfigs != null &&
           Array.from(this.agentConfigs.values()).some(hasDeepSeekAgent));
-      const formatOptions = needsDeepSeekFormat ? { provider: Providers.DEEPSEEK } : undefined;
+      /**
+       * Skills primed fresh this turn — manual ($ popover) and always-apply
+       * (frontmatter). `injectSkillPrimes` (below) splices their SKILL.md
+       * bodies in, so `formatAgentMessages` must NOT also reconstruct the
+       * same names from a historical `skill` tool_call — otherwise the body
+       * lands twice and a prompt-cache marker can pin to the duplicated
+       * synthetic prefix. Names NOT primed this turn still reconstruct from
+       * history, preserving sticky manual re-priming across turns.
+       */
+      const manualSkillPrimes = this.options.agent?.manualSkillPrimes;
+      const alwaysApplySkillPrimes = this.options.agent?.alwaysApplySkillPrimes;
+      const freshSkillPrimeNames = collectFreshSkillPrimeNames({
+        manualSkillPrimes,
+        alwaysApplySkillPrimes,
+      });
+      const formatOptions =
+        needsDeepSeekFormat || freshSkillPrimeNames.size > 0
+          ? {
+              ...(needsDeepSeekFormat ? { provider: Providers.DEEPSEEK } : {}),
+              ...(freshSkillPrimeNames.size > 0
+                ? { skipSkillBodyNames: freshSkillPrimeNames }
+                : {}),
+            }
+          : undefined;
       let {
         messages: initialMessages,
         indexTokenCountMap,
@@ -924,9 +1201,11 @@ class AgentClient extends BaseClient {
        * agent and multi-agent runs; how primes interact with handoff /
        * added-convo agents' per-agent state is an agents-SDK concern,
        * not this layer's to gate.
+       *
+       * `manualSkillPrimes` / `alwaysApplySkillPrimes` are resolved above
+       * (used to build `freshSkillPrimeNames` for dedupe against historical
+       * skill reconstruction).
        */
-      const manualSkillPrimes = this.options.agent?.manualSkillPrimes;
-      const alwaysApplySkillPrimes = this.options.agent?.alwaysApplySkillPrimes;
       if (
         (manualSkillPrimes && manualSkillPrimes.length > 0) ||
         (alwaysApplySkillPrimes && alwaysApplySkillPrimes.length > 0)
@@ -969,6 +1248,17 @@ class AgentClient extends BaseClient {
         tokenCounter,
       });
 
+      const memoryMessages =
+        this.processMemory && this.memoryPayload
+          ? formatAgentMessages(
+              this.memoryPayload,
+              undefined,
+              toolSet,
+              skillPrimeResult?.skills,
+              formatOptions,
+            ).messages
+          : initialMessages;
+
       /**
        * @param {BaseMessage[]} messages
        */
@@ -1009,7 +1299,7 @@ class AgentClient extends BaseClient {
         // }
 
         if (this.processMemory) {
-          memoryPromise = this.runMemory(messages);
+          memoryPromise = this.runMemory(memoryMessages);
         }
 
         /** Seed calibration state from previous run if encoding matches */
@@ -1040,6 +1330,17 @@ class AgentClient extends BaseClient {
           summarizationConfig: appConfig?.summarization,
           appConfig,
           tokenCounter,
+          /** Bills subagent child-run model calls — child graphs execute
+           *  outside the streamEvents loop, so ModelEndHandler never sees
+           *  them. Entries land in collectedUsage tagged
+           *  `usage_type: 'subagent'` and are spent by recordCollectedUsage.
+           *  The sink also streams each as an `on_token_usage` event so the
+           *  gauge's session cost/totals include billed subagent usage (the
+           *  `subagent` tag keeps it out of the live context meter). */
+          subagentUsageSink: createSubagentUsageSink(
+            this.collectedUsage,
+            this.buildSubagentUsageEmitter(appConfig),
+          ),
         });
 
         if (!run) {
@@ -1156,6 +1457,14 @@ class AgentClient extends BaseClient {
 
       this.finalizeSubagentContent();
 
+      /** Flush subagent usage emits the sink fired without awaiting, so their
+       *  persist/publish completes before we return and the job is cleaned up
+       *  (resumed clients read this persisted usage). */
+      if (this.pendingSubagentEmits.length > 0) {
+        await Promise.allSettled(this.pendingSubagentEmits);
+        this.pendingSubagentEmits = [];
+      }
+
       try {
         const attachments = await this.awaitMemoryWithTimeout(memoryPromise);
         if (attachments && attachments.length > 0) {
@@ -1350,12 +1659,25 @@ class AgentClient extends BaseClient {
       delete clientOptions.modelKwargs.max_output_tokens;
     }
 
+    /** `omitTitleOptions` drops the Anthropic `clientOptions` carrier (thinking,
+     *  streaming, etc.), which would also drop its `defaultHeaders` — preserve the
+     *  original `clientOptions` object so gateway/reverse-proxy metadata still
+     *  reaches title requests (the proxy may require it for auth/routing). Restore
+     *  the SAME object reference, not a copy: the Vertex `createClient` closure from
+     *  `getLLMConfig` closes over this object, so `resolveConfigHeaders` must mutate
+     *  the very object the client is built from. */
+    const anthropicClientOptions = clientOptions?.clientOptions;
+
     clientOptions = Object.assign(
       Object.fromEntries(
         Object.entries(clientOptions).filter(([key]) => !omitTitleOptions.has(key)),
       ),
     );
 
+    if (anthropicClientOptions?.defaultHeaders != null && clientOptions.clientOptions == null) {
+      clientOptions.clientOptions = anthropicClientOptions;
+    }
+
     if (
       provider === Providers.GOOGLE &&
       (endpointConfig?.titleMethod === TitleMethod.FUNCTIONS ||
@@ -1364,20 +1686,19 @@ class AgentClient extends BaseClient {
       clientOptions.json = true;
     }
 
-    /** Resolve request-based headers for Custom Endpoints. Note: if this is added to
-     *  non-custom endpoints, needs consideration of varying provider header configs.
+    /** Resolve request-based headers across provider-specific header locations:
+     *  OpenAI `configuration.defaultHeaders`, Anthropic `clientOptions.defaultHeaders`
+     *  (preserved above), and Google `customHeaders`.
      */
-    if (clientOptions?.configuration?.defaultHeaders != null) {
-      clientOptions.configuration.defaultHeaders = resolveHeaders({
-        headers: clientOptions.configuration.defaultHeaders,
-        user: createSafeUser(this.options.req?.user),
-        body: {
-          messageId: this.responseMessageId,
-          conversationId: this.conversationId,
-          parentMessageId: this.parentMessageId,
-        },
-      });
-    }
+    resolveConfigHeaders({
+      llmConfig: clientOptions,
+      user: createSafeUser(this.options.req?.user),
+      body: {
+        messageId: this.responseMessageId,
+        conversationId: this.conversationId,
+        parentMessageId: this.parentMessageId,
+      },
+    });
 
     try {
       const titleResult = await this.run.generateTitle({
diff --git a/api/server/controllers/agents/client.test.js b/api/server/controllers/agents/client.test.js
index 1c656c125ca..c71ede7b237 100644
--- a/api/server/controllers/agents/client.test.js
+++ b/api/server/controllers/agents/client.test.js
@@ -1,5 +1,5 @@
 const { Providers } = require('@librechat/agents');
-const { Constants, EModelEndpoint } = require('librechat-data-provider');
+const { Constants, ContentTypes, EModelEndpoint } = require('librechat-data-provider');
 const AgentClient = require('./client');
 
 jest.mock('@librechat/agents', () => ({
@@ -225,6 +225,51 @@ describe('AgentClient - titleConvo', () => {
       expect(generateTitleCall.clientOptions.model).toBe('gpt-3.5-turbo');
     });
 
+    it('preserves Anthropic custom headers on title requests despite omitTitleOptions', async () => {
+      const prevKey = process.env.ANTHROPIC_API_KEY;
+      process.env.ANTHROPIC_API_KEY = 'sk-ant-test';
+      try {
+        const req = {
+          user: { id: 'user-123' },
+          body: { model: 'claude-sonnet-4-5', endpoint: EModelEndpoint.anthropic, key: null },
+          config: {
+            endpoints: {
+              [EModelEndpoint.anthropic]: {
+                headers: { 'X-Conversation-Id': '{{LIBRECHAT_BODY_CONVERSATIONID}}' },
+              },
+            },
+          },
+        };
+        const agent = {
+          id: 'agent-anthropic',
+          endpoint: EModelEndpoint.anthropic,
+          provider: EModelEndpoint.anthropic,
+          model_parameters: { model: 'claude-sonnet-4-5' },
+        };
+        const anthropicClient = new AgentClient({ req, res: {}, agent, endpointTokenConfig: {} });
+        anthropicClient.run = mockRun;
+        anthropicClient.responseMessageId = 'response-123';
+        anthropicClient.conversationId = 'convo-123';
+        anthropicClient.contentParts = [{ type: 'text', text: 'Test content' }];
+        anthropicClient.recordCollectedUsage = jest.fn().mockResolvedValue();
+
+        await anthropicClient.titleConvo({ text: 'Hello', abortController: new AbortController() });
+
+        const defaultHeaders =
+          mockRun.generateTitle.mock.calls[0][0].clientOptions?.clientOptions?.defaultHeaders;
+        // Custom header survives the `omitTitleOptions` strip and resolves the conversationId
+        expect(defaultHeaders?.['X-Conversation-Id']).toBe('convo-123');
+        // Provider-managed beta header is preserved alongside it
+        expect(defaultHeaders?.['anthropic-beta']).toBeDefined();
+      } finally {
+        if (prevKey === undefined) {
+          delete process.env.ANTHROPIC_API_KEY;
+        } else {
+          process.env.ANTHROPIC_API_KEY = prevKey;
+        }
+      }
+    });
+
     it('should handle missing endpoint config gracefully', async () => {
       // Remove endpoint config
       mockReq.config = { endpoints: {} };
@@ -1497,9 +1542,23 @@ describe('AgentClient - titleConvo', () => {
       text,
     });
 
+    const makeUploadedFile = (file_id, filename, type) => ({
+      user: 'user-123',
+      file_id,
+      filename,
+      filepath: `/uploads/${filename}`,
+      object: 'file',
+      type,
+      bytes: 128,
+      embedded: false,
+      usage: 0,
+      source: 'local',
+    });
+
     beforeEach(() => {
       jest.clearAllMocks();
       mockFormatInstructions.mockResolvedValue('');
+      require('@librechat/api').countFormattedMessageTokens.mockImplementation(() => 42);
 
       mockAgent = {
         id: 'primary-agent',
@@ -1544,7 +1603,49 @@ describe('AgentClient - titleConvo', () => {
       client.useMemory = jest.fn().mockResolvedValue(undefined);
     });
 
-    it("applies shared request context plus each agent's own context docs only", async () => {
+    it.each([
+      ['CSV', 'csv-file', 'sample.csv', 'text/csv'],
+      [
+        'XLSX',
+        'xlsx-file',
+        'sample.xlsx',
+        'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+      ],
+    ])(
+      'routes default-supported provider uploads like %s as request documents without custom file config',
+      async (_label, file_id, filename, type) => {
+        const currentFile = makeUploadedFile(file_id, filename, type);
+        const message = {
+          messageId: 'msg-1',
+          parentMessageId: null,
+          sender: 'User',
+          text: `Read this ${filename}.`,
+          isCreatedByUser: true,
+        };
+
+        client.addDocuments = jest.fn(async (targetMessage, attachments) => {
+          targetMessage.documents = attachments.map((file) => ({
+            type: 'input_file',
+            filename: file.filename,
+            file_data: `data:${file.type};base64,Y29sMQox`,
+          }));
+          return attachments;
+        });
+
+        const files = await client.processAttachments(message, [currentFile]);
+
+        expect(client.addDocuments).toHaveBeenCalledWith(message, [currentFile]);
+        expect(message.documents).toEqual([
+          expect.objectContaining({
+            type: 'input_file',
+            filename,
+          }),
+        ]);
+        expect(files).toEqual([currentFile]);
+      },
+    );
+
+    it('places request context inline and applies each agent context doc only once', async () => {
       const requestFile = makeTextFile('request-file', 'request.txt', 'Shared request context');
       const primaryContext = makeTextFile(
         'primary-context',
@@ -1574,7 +1675,7 @@ describe('AgentClient - titleConvo', () => {
       ]);
       client.agentConfigs = new Map([['handoff-agent', handoffAgent]]);
 
-      await client.buildMessages(
+      const result = await client.buildMessages(
         [
           {
             messageId: 'msg-1',
@@ -1588,15 +1689,99 @@ describe('AgentClient - titleConvo', () => {
         {},
       );
 
-      expect(mockAgent.additional_instructions).toContain('Shared request context');
+      expect(result.prompt[0].content).toContain('Shared request context');
+
       expect(mockAgent.additional_instructions).toContain('Primary private context');
+      expect(mockAgent.additional_instructions).not.toContain('Shared request context');
       expect(mockAgent.additional_instructions).not.toContain('Handoff private context');
 
-      expect(handoffAgent.additional_instructions).toContain('Shared request context');
       expect(handoffAgent.additional_instructions).toContain('Handoff private context');
+      expect(handoffAgent.additional_instructions).not.toContain('Shared request context');
       expect(handoffAgent.additional_instructions).not.toContain('Primary private context');
     });
 
+    it('places current request file context on the latest user message', async () => {
+      const currentFile = makeTextFile('current-file', 'current.txt', 'Current turn file body');
+      const previousFileContext =
+        'Attached document(s):\n```md\n# "previous.txt"\nPrevious turn file body\n```';
+
+      client.options.attachments = [currentFile];
+
+      const result = await client.buildMessages(
+        [
+          {
+            messageId: 'msg-1',
+            parentMessageId: null,
+            sender: 'User',
+            text: 'What is written here?',
+            isCreatedByUser: true,
+            fileContext: previousFileContext,
+          },
+          {
+            messageId: 'msg-2',
+            parentMessageId: 'msg-1',
+            sender: 'Assistant',
+            text: 'It describes the previous file.',
+            isCreatedByUser: false,
+          },
+          {
+            messageId: 'msg-3',
+            parentMessageId: 'msg-2',
+            sender: 'User',
+            text: 'What is written here?',
+            isCreatedByUser: true,
+          },
+        ],
+        'msg-3',
+        {},
+      );
+
+      expect(result.prompt[0].content).toContain('Previous turn file body');
+      expect(result.prompt[2].content).toContain('Current turn file body');
+      expect(result.prompt[2].content).toContain('What is written here?');
+      expect(result.prompt[2].content).not.toContain('Previous turn file body');
+      expect(client.memoryPayload[2].content).toContain('What is written here?');
+      expect(client.memoryPayload[2].content).not.toContain('Current turn file body');
+      expect(mockAgent.additional_instructions ?? '').not.toContain('Current turn file body');
+      expect(result.prompt[2].content.indexOf('Current turn file body')).toBeLessThan(
+        result.prompt[2].content.indexOf('What is written here?'),
+      );
+    });
+
+    it('persists canonical token counts while counting request file context for the prompt', async () => {
+      const { countFormattedMessageTokens } = require('@librechat/api');
+      const currentFile = makeTextFile('current-file', 'current.txt', 'Current turn file body');
+
+      countFormattedMessageTokens.mockImplementation(({ content }) => {
+        const text = Array.isArray(content)
+          ? content.map((part) => part.text ?? part[ContentTypes.TEXT] ?? '').join('\n')
+          : String(content ?? '');
+        return text.includes('Current turn file body') ? 200 : 20;
+      });
+
+      client.options.attachments = [currentFile];
+
+      const result = await client.buildMessages(
+        [
+          {
+            messageId: 'msg-1',
+            parentMessageId: null,
+            sender: 'User',
+            text: 'What is written here?',
+            isCreatedByUser: true,
+          },
+        ],
+        'msg-1',
+        {},
+      );
+
+      expect(result.prompt[0].content).toContain('Current turn file body');
+      expect(result.tokenCountMap['msg-1']).toBe(20);
+      expect(result.promptTokens).toBe(200);
+      expect(client.indexTokenCountMap[0]).toBe(200);
+      expect(client.memoryPayload[0].content).toBe('What is written here?');
+    });
+
     it('does not duplicate a file that is both request context and scoped context', async () => {
       const sharedFile = makeTextFile('shared-file', 'shared.txt', 'Shared duplicate context');
 
@@ -1604,7 +1789,7 @@ describe('AgentClient - titleConvo', () => {
       client.options.agentContextAttachmentsByAgentId = new Map([['primary-agent', [sharedFile]]]);
       client.agentConfigs = new Map();
 
-      await client.buildMessages(
+      const result = await client.buildMessages(
         [
           {
             messageId: 'msg-1',
@@ -1618,10 +1803,10 @@ describe('AgentClient - titleConvo', () => {
         {},
       );
 
-      const occurrences = (
-        mockAgent.additional_instructions.match(/Shared duplicate context/g) ?? []
-      ).length;
-      expect(occurrences).toBe(1);
+      const inlineOccurrences = (result.prompt[0].content.match(/Shared duplicate context/g) ?? [])
+        .length;
+      expect(inlineOccurrences).toBe(1);
+      expect(mockAgent.additional_instructions ?? '').not.toContain('Shared duplicate context');
     });
 
     it('keeps direct chats with context-doc agents working without request attachments', async () => {
@@ -1870,6 +2055,25 @@ describe('AgentClient - titleConvo', () => {
       expect(processedMessage.content).not.toContain('Response 1');
     });
 
+    it('should cap memory input tokens and preserve recent content', async () => {
+      const { HumanMessage, AIMessage } = require('@librechat/agents/langchain/messages');
+      mockReq.config.memory.maxInputTokens = 12;
+      const messages = [
+        new HumanMessage(`OLDER_CONTENT ${'a'.repeat(600)}`),
+        new AIMessage('Intermediate response'),
+        new HumanMessage('Please remember LATEST_MEMORY_MARKER'),
+      ];
+
+      await client.runMemory(messages);
+
+      expect(mockProcessMemory).toHaveBeenCalledTimes(1);
+      const processedMessage = mockProcessMemory.mock.calls[0][0][0];
+
+      expect(processedMessage.content).toContain('LATEST_MEMORY_MARKER');
+      expect(processedMessage.content).not.toContain('OLDER_CONTENT');
+      expect(Math.ceil(processedMessage.content.length / 4)).toBeLessThanOrEqual(12);
+    });
+
     it('should return early if processMemory is not set', async () => {
       const { HumanMessage } = require('@librechat/agents/langchain/messages');
       client.processMemory = null;
diff --git a/api/server/controllers/agents/openai.js b/api/server/controllers/agents/openai.js
index 7d2395b09f1..3c00b1fce2e 100644
--- a/api/server/controllers/agents/openai.js
+++ b/api/server/controllers/agents/openai.js
@@ -23,8 +23,10 @@ const {
   extractManualSkills,
   createErrorResponse,
   recordCollectedUsage,
+  createSubagentUsageSink,
   getTransactionsConfig,
   resolveRecursionLimit,
+  findPiiMatchInMessages,
   discoverConnectedAgents,
   getRemoteAgentPermissions,
   createToolExecuteHandler,
@@ -47,8 +49,11 @@ const {
 } = require('~/server/services/PermissionService');
 const {
   getSkillToolDeps,
-  enrichWithSkillConfigurable,
-  buildSkillPrimedIdsByName,
+  getSkillDbMethods,
+  canAuthorSkillFiles,
+  withDeploymentSkillIds,
+  buildAgentToolContext,
+  enrichLoadedToolsWithAgentContext,
 } = require('~/server/services/Endpoints/agents/skillDeps');
 const { getModelsConfig } = require('~/server/controllers/ModelController');
 const { logViolation } = require('~/cache');
@@ -174,6 +179,17 @@ const OpenAIChatCompletionController = async (req, res) => {
     );
   }
 
+  const piiHit = findPiiMatchInMessages(request.messages, appConfig?.messageFilter?.pii);
+  if (piiHit != null) {
+    return sendErrorResponse(
+      res,
+      400,
+      `Message contains a ${piiHit.label}. Remove it and try again.`,
+      'invalid_request_error',
+      'message_filter_pii_block',
+    );
+  }
+
   const responseId = `chatcmpl-${nanoid()}`;
   const created = Math.floor(Date.now() / 1000);
 
@@ -228,6 +244,7 @@ const OpenAIChatCompletionController = async (req, res) => {
       endpoint: agent.provider,
       model_parameters: agent.model_parameters ?? {},
     };
+    const skillDbMethods = getSkillDbMethods();
 
     // `filterFilesByAgentAccess` is intentionally omitted: it calls
     // `checkPermission` with `resourceType: AGENT`, but this route
@@ -245,22 +262,35 @@ const OpenAIChatCompletionController = async (req, res) => {
       getUserCodeFiles: db.getUserCodeFiles,
       getToolFilesByIds: db.getToolFilesByIds,
       getCodeGeneratedFiles: db.getCodeGeneratedFiles,
-      listSkillsByAccess: db.listSkillsByAccess,
-      listAlwaysApplySkills: db.listAlwaysApplySkills,
-      getSkillByName: db.getSkillByName,
+      listSkillsByAccess: skillDbMethods.listSkillsByAccess,
+      listAlwaysApplySkills: skillDbMethods.listAlwaysApplySkills,
+      getSkillByName: skillDbMethods.getSkillByName,
     };
 
     const enabledCapabilities = new Set(agentsEConfig?.capabilities);
     const skillsCapabilityEnabled = enabledCapabilities.has(AgentCapabilities.skills);
     const ephemeralSkillsToggle = req.body?.ephemeralAgent?.skills === true;
     const accessibleSkillIds = skillsCapabilityEnabled
+      ? withDeploymentSkillIds(
+          await findAccessibleResources({
+            userId: req.user.id,
+            role: req.user.role,
+            resourceType: ResourceType.SKILL,
+            requiredPermissions: PermissionBits.VIEW,
+          }),
+        )
+      : [];
+    const editableSkillIds = skillsCapabilityEnabled
       ? await findAccessibleResources({
           userId: req.user.id,
           role: req.user.role,
           resourceType: ResourceType.SKILL,
-          requiredPermissions: PermissionBits.VIEW,
+          requiredPermissions: PermissionBits.EDIT,
         })
       : [];
+    const skillCreateAllowed = skillsCapabilityEnabled
+      ? await getSkillToolDeps().canCreateSkill({ req })
+      : false;
 
     const { skillStates, defaultActiveOnShare } = await loadSkillStates({
       userId: req.user.id,
@@ -271,6 +301,19 @@ const OpenAIChatCompletionController = async (req, res) => {
 
     const manualSkills = extractManualSkills(req.body);
 
+    const primaryScopedSkillIds = resolveAgentScopedSkillIds({
+      agent,
+      accessibleSkillIds,
+      skillsCapabilityEnabled,
+      ephemeralSkillsToggle,
+    });
+    const primaryScopedEditableSkillIds = resolveAgentScopedSkillIds({
+      agent,
+      accessibleSkillIds: editableSkillIds,
+      skillsCapabilityEnabled,
+      ephemeralSkillsToggle,
+    });
+
     const primaryConfig = await initializeAgent(
       {
         req,
@@ -283,9 +326,11 @@ const OpenAIChatCompletionController = async (req, res) => {
         endpointOption,
         allowedProviders,
         isInitialAgent: true,
-        accessibleSkillIds: resolveAgentScopedSkillIds({
+        accessibleSkillIds: primaryScopedSkillIds,
+        skillAuthoringAvailable: canAuthorSkillFiles({
           agent,
-          accessibleSkillIds,
+          scopedEditableSkillIds: primaryScopedEditableSkillIds,
+          skillCreateAllowed,
           skillsCapabilityEnabled,
           ephemeralSkillsToggle,
         }),
@@ -304,20 +349,17 @@ const OpenAIChatCompletionController = async (req, res) => {
      * @type {Map<string, {
      *   agent: object,
      *   toolRegistry?: import('@librechat/agents').LCToolRegistry,
+     *   requestScopedConnections?: import('@librechat/api').RequestScopedMCPConnectionStore,
      *   userMCPAuthMap?: Record<string, Record<string, string>>,
      *   tool_resources?: object,
      *   actionsEnabled?: boolean,
      * }>}
      */
     const agentToolContexts = new Map();
-    agentToolContexts.set(primaryConfig.id, {
-      agent,
-      toolRegistry: primaryConfig.toolRegistry,
-      userMCPAuthMap: primaryConfig.userMCPAuthMap,
-      tool_resources: primaryConfig.tool_resources,
-      actionsEnabled: primaryConfig.actionsEnabled,
-      codeEnvAvailable: primaryConfig.codeEnvAvailable,
-    });
+    agentToolContexts.set(
+      primaryConfig.id,
+      buildAgentToolContext({ agent, config: primaryConfig }),
+    );
 
     // Only run BFS discovery (and pay `getModelsConfig` upfront) when the
     // primary has edges to follow — the common API case is single-agent.
@@ -346,6 +388,28 @@ const OpenAIChatCompletionController = async (req, res) => {
           // sub-agent must clear the same sharing boundary, not the looser
           // in-app AGENT one.
           resourceType: ResourceType.REMOTE_AGENT,
+          computeAccessibleSkillIds: (handoffAgent) =>
+            resolveAgentScopedSkillIds({
+              agent: handoffAgent,
+              accessibleSkillIds,
+              skillsCapabilityEnabled,
+              ephemeralSkillsToggle,
+            }),
+          computeSkillAuthoringAvailable: (handoffAgent) =>
+            canAuthorSkillFiles({
+              agent: handoffAgent,
+              scopedEditableSkillIds: resolveAgentScopedSkillIds({
+                agent: handoffAgent,
+                accessibleSkillIds: editableSkillIds,
+                skillsCapabilityEnabled,
+                ephemeralSkillsToggle,
+              }),
+              skillCreateAllowed,
+              skillsCapabilityEnabled,
+              ephemeralSkillsToggle,
+            }),
+          skillStates,
+          defaultActiveOnShare,
           /** @see DiscoverConnectedAgentsParams.codeEnvAvailable */
           codeEnvAvailable: enabledCapabilities.has(AgentCapabilities.execute_code),
         },
@@ -368,14 +432,7 @@ const OpenAIChatCompletionController = async (req, res) => {
           logViolation,
           db: dbMethods,
           onAgentInitialized: (agentId, handoffAgent, config) => {
-            agentToolContexts.set(agentId, {
-              agent: handoffAgent,
-              toolRegistry: config.toolRegistry,
-              userMCPAuthMap: config.userMCPAuthMap,
-              tool_resources: config.tool_resources,
-              actionsEnabled: config.actionsEnabled,
-              codeEnvAvailable: config.codeEnvAvailable,
-            });
+            agentToolContexts.set(agentId, buildAgentToolContext({ agent: handoffAgent, config }));
           },
           initializeAgent,
         },
@@ -420,18 +477,13 @@ const OpenAIChatCompletionController = async (req, res) => {
 
     const toolEndCallback = createToolEndCallback({ req, res, artifactPromises, streamId: null });
 
-    /* Stable for the turn: the prime lists are fixed once
-       `initializeAgent` resolves. Hoisted out of `loadTools` so tool
-       execution doesn't recompute them. `codeEnvAvailable` is read
+    /* Stable for the turn: the primary prime list is fixed once
+       `initializeAgent` resolves and is used as the fallback when a
+       specific agent context is unavailable. `codeEnvAvailable` is read
        per-agent from the stored tool context (admin cap AND that
        agent's `tools` list includes `execute_code`) — a skills-only
        agent never gains sandbox access even if the admin enabled the
        capability globally. */
-    const skillPrimedIdsByName = buildSkillPrimedIdsByName(
-      primaryConfig.manualSkillPrimes,
-      primaryConfig.alwaysApplySkillPrimes,
-    );
-
     const toolExecuteOptions = {
       loadTools: async (toolNames, agentId) => {
         const ctx = agentToolContexts.get(agentId) ?? agentToolContexts.get(primaryConfig.id) ?? {};
@@ -442,17 +494,17 @@ const OpenAIChatCompletionController = async (req, res) => {
           agent: ctx.agent ?? agent,
           signal: abortController.signal,
           toolRegistry: ctx.toolRegistry,
+          mcpAvailableTools: ctx.mcpAvailableTools,
+          requestScopedConnections: ctx.requestScopedConnections,
           userMCPAuthMap: ctx.userMCPAuthMap,
           tool_resources: ctx.tool_resources,
           actionsEnabled: ctx.actionsEnabled,
         });
-        return enrichWithSkillConfigurable(
+        return enrichLoadedToolsWithAgentContext({
           result,
           req,
-          primaryConfig.accessibleSkillIds,
-          ctx.codeEnvAvailable === true,
-          skillPrimedIdsByName,
-        );
+          ctx,
+        });
       },
       toolEndCallback,
       ...getSkillToolDeps(),
@@ -691,6 +743,9 @@ const OpenAIChatCompletionController = async (req, res) => {
         conversationId,
       },
       user: { id: userId },
+      /** Bills subagent child-run model calls (reported outside the
+       *  streamEvents loop) into the same collectedUsage array. */
+      subagentUsageSink: createSubagentUsageSink(collectedUsage),
     });
 
     if (!run) {
diff --git a/api/server/controllers/agents/request.js b/api/server/controllers/agents/request.js
index 39fc215b896..c2bcd5c12e1 100644
--- a/api/server/controllers/agents/request.js
+++ b/api/server/controllers/agents/request.js
@@ -1,19 +1,25 @@
 const { logger } = require('@librechat/data-schemas');
-const { Constants, ViolationTypes } = require('librechat-data-provider');
+const { Constants, ViolationTypes, isEphemeralAgentId } = require('librechat-data-provider');
 const {
   sendEvent,
   getViolationInfo,
   buildMessageFiles,
   resolveTitleTiming,
   GenerationJobManager,
+  filterPersistableAbortContent,
   decrementPendingRequest,
   sanitizeMessageForTransmit,
   checkAndIncrementPendingRequest,
+  isUnpersistedPreliminaryParent,
 } = require('@librechat/api');
 const { disposeClient, clientRegistry, requestDataMap } = require('~/server/cleanup');
+const {
+  getMCPRequestContext,
+  cleanupMCPRequestContextForReq,
+} = require('~/server/services/MCPRequestContext');
 const { handleAbortError } = require('~/server/middleware');
 const { logViolation } = require('~/cache');
-const { saveMessage, getConvo } = require('~/models');
+const { saveMessage, getMessages, getConvo } = require('~/models');
 
 function createCloseHandler(abortController) {
   return function (manual) {
@@ -75,6 +81,83 @@ async function attachConversationCreatedAt(req, { userId, conversationId, isNewC
   }
 }
 
+function getPreliminaryResponseMessageId({ messageId, responseMessageId }) {
+  if (typeof responseMessageId === 'string' && responseMessageId.length > 0) {
+    return responseMessageId;
+  }
+
+  if (typeof messageId !== 'string' || messageId.length === 0) {
+    return null;
+  }
+
+  return `${messageId.replace(/_+$/, '')}_`;
+}
+
+function getPreliminaryUserMessage({ messageId, parentMessageId, text }, conversationId) {
+  if (typeof messageId !== 'string' || messageId.length === 0) {
+    return null;
+  }
+
+  return {
+    messageId,
+    parentMessageId,
+    conversationId,
+    text,
+  };
+}
+
+function getRequestModelSpec(req, endpointOption) {
+  const spec = endpointOption?.spec ?? req.body?.spec;
+  if (typeof spec !== 'string' || spec.length === 0) {
+    return;
+  }
+
+  const list = req.config?.modelSpecs?.list;
+  if (!Array.isArray(list)) {
+    return;
+  }
+
+  return list.find((modelSpec) => modelSpec?.name === spec);
+}
+
+function getModelSpecIconURL(modelSpec) {
+  return modelSpec?.iconURL ?? modelSpec?.preset?.iconURL ?? modelSpec?.preset?.endpoint ?? '';
+}
+
+function getEndpointIconURL(req, endpointOption) {
+  const iconURL =
+    endpointOption?.iconURL ?? getModelSpecIconURL(getRequestModelSpec(req, endpointOption));
+  return iconURL || undefined;
+}
+
+function getEndpointResponseModel(endpointOption) {
+  return endpointOption?.modelOptions?.model || endpointOption?.model_parameters?.model;
+}
+
+function getAgentResponseModel(req, endpointOption) {
+  const agentId = endpointOption?.agent_id || req.body?.agent_id;
+  if (typeof agentId === 'string' && agentId.length > 0 && !isEphemeralAgentId(agentId)) {
+    return agentId;
+  }
+
+  return getEndpointResponseModel(endpointOption);
+}
+
+async function finishResumableRequest(req, userId) {
+  try {
+    await cleanupMCPRequestContextForReq(req);
+  } finally {
+    await decrementPendingRequest(userId);
+  }
+}
+
+function rejectPreliminaryParentMessageId(res) {
+  return res.status(409).json({
+    error:
+      'Cannot submit a follow-up while the selected parent response is still being saved. Please wait and try again.',
+  });
+}
+
 /**
  * Resumable Agent Controller - Generation runs independently of HTTP connection.
  * Returns streamId immediately, client subscribes separately via SSE.
@@ -94,6 +177,17 @@ const ResumableAgentController = async (req, res, next, initializeClient, addTit
 
   const userId = req.user.id;
 
+  if (
+    await isUnpersistedPreliminaryParent({
+      userId,
+      conversationId: reqConversationId,
+      parentMessageId,
+      getMessages,
+    })
+  ) {
+    return rejectPreliminaryParentMessageId(res);
+  }
+
   /** When to generate the conversation title. `immediate` (default) fires title
    *  generation in parallel with the response, from the user's first message;
    *  `final` defers it until the full response completes (legacy behavior).
@@ -127,6 +221,7 @@ const ResumableAgentController = async (req, res, next, initializeClient, addTit
     const job = await GenerationJobManager.createJob(streamId, userId, conversationId);
     const jobCreatedAt = job.createdAt; // Capture creation time to detect job replacement
     req._resumableStreamId = streamId;
+    getMCPRequestContext(req, undefined, { cleanupOnResponse: false });
 
     // Send JSON response IMMEDIATELY so client can connect to SSE stream
     // This is critical: tool loading (MCP OAuth) may emit events that the client needs to receive
@@ -134,6 +229,19 @@ const ResumableAgentController = async (req, res, next, initializeClient, addTit
 
     await attachConversationCreatedAt(req, { userId, conversationId, isNewConvo });
 
+    const endpointIconURL = getEndpointIconURL(req, endpointOption);
+    const responseModel = getAgentResponseModel(req, endpointOption);
+    const preliminaryUserMessage = getPreliminaryUserMessage(req.body, conversationId);
+    const preliminaryResponseMessageId = getPreliminaryResponseMessageId(req.body);
+    await GenerationJobManager.updateMetadata(streamId, {
+      conversationId,
+      endpoint: endpointOption.endpoint,
+      iconURL: endpointIconURL,
+      model: responseModel,
+      responseMessageId: preliminaryResponseMessageId,
+      userMessage: preliminaryUserMessage,
+    });
+
     // Note: We no longer use res.on('close') to abort since we send JSON immediately.
     // The response closes normally after res.json(), which is not an abort condition.
     // Abort handling is done through GenerationJobManager via the SSE stream connection.
@@ -155,6 +263,12 @@ const ResumableAgentController = async (req, res, next, initializeClient, addTit
         return;
       }
 
+      const persistableContent = filterPersistableAbortContent(aggregatedContent);
+      if (persistableContent.length === 0) {
+        logger.debug('[ResumableAgentController] No persistable content to save partial response');
+        return;
+      }
+
       const resumeState = await GenerationJobManager.getResumeState(streamId);
       if (!resumeState?.userMessage) {
         logger.debug('[ResumableAgentController] No user message to save partial response for');
@@ -170,13 +284,14 @@ const ResumableAgentController = async (req, res, next, initializeClient, addTit
           conversationId: responseConversationId,
           parentMessageId: resumeState.userMessage.messageId,
           sender: client?.sender ?? 'AI',
-          content: aggregatedContent,
+          content: persistableContent,
           unfinished: true,
           error: false,
           isCreatedByUser: false,
           user: userId,
           endpoint: endpointOption.endpoint,
-          model: endpointOption.modelOptions?.model || endpointOption.model_parameters?.model,
+          iconURL: resumeState.iconURL || endpointIconURL,
+          model: resumeState.model || responseModel,
         };
 
         if (req.body?.agent_id) {
@@ -194,7 +309,7 @@ const ResumableAgentController = async (req, res, next, initializeClient, addTit
         );
 
         logger.debug(
-          `[ResumableAgentController] Saved partial response for ${streamId}, content parts: ${aggregatedContent.length}`,
+          `[ResumableAgentController] Saved partial response for ${streamId}, content parts: ${persistableContent.length}`,
         );
       } catch (error) {
         logger.error('[ResumableAgentController] Error saving partial response:', error);
@@ -214,7 +329,7 @@ const ResumableAgentController = async (req, res, next, initializeClient, addTit
 
     if (job.abortController.signal.aborted) {
       GenerationJobManager.completeJob(streamId, 'Request aborted during initialization');
-      await decrementPendingRequest(userId);
+      await finishResumableRequest(req, userId);
       return;
     }
 
@@ -274,6 +389,11 @@ const ResumableAgentController = async (req, res, next, initializeClient, addTit
        *  `completeJob` also aborts on *successful* completion and would otherwise
        *  cancel a title that is merely slower than a short response. */
       const titleAbortController = new AbortController();
+      /** Separate from `titleAbortController`: a user Stop cancels the in-flight
+       *  title model call but keeps a title that already finished generating.
+       *  Only a superseded/failed stream aborts this to discard such a title so it
+       *  cannot clobber the conversation now owned by the newer run. */
+      const titleDiscardController = new AbortController();
       const abortTitleOnJobAbort = () => titleAbortController.abort();
       if (job.abortController.signal.aborted) {
         titleAbortController.abort();
@@ -363,6 +483,7 @@ const ResumableAgentController = async (req, res, next, initializeClient, addTit
             immediate: true,
             convoReady,
             signal: titleAbortController.signal,
+            discardSignal: titleDiscardController.signal,
             onTitleGenerated: emitTitleEvent,
           }).catch((err) => {
             logger.error('[ResumableAgentController] Error in immediate title generation', err);
@@ -439,11 +560,12 @@ const ResumableAgentController = async (req, res, next, initializeClient, addTit
           // unblock its persistence wait without letting it save (the newer job
           // owns the conversation now).
           titleAbortController.abort();
+          titleDiscardController.abort();
           job.abortController.signal.removeEventListener('abort', abortTitleOnJobAbort);
           acceptsTitleEvents = false;
           resolveConvoReady();
           // Still decrement pending request since we incremented at start
-          await decrementPendingRequest(userId);
+          await finishResumableRequest(req, userId);
           if (immediateTitlePromise) {
             immediateTitlePromise.finally(() => {
               if (client) {
@@ -493,7 +615,7 @@ const ResumableAgentController = async (req, res, next, initializeClient, addTit
 
           await GenerationJobManager.emitDone(streamId, finalEvent);
           GenerationJobManager.completeJob(streamId);
-          await decrementPendingRequest(userId);
+          await finishResumableRequest(req, userId);
         } else {
           const finalEvent = {
             final: true,
@@ -513,7 +635,7 @@ const ResumableAgentController = async (req, res, next, initializeClient, addTit
 
           await GenerationJobManager.emitDone(streamId, finalEvent);
           GenerationJobManager.completeJob(streamId, 'Request aborted');
-          await decrementPendingRequest(userId);
+          await finishResumableRequest(req, userId);
         }
 
         if (titleTiming === 'immediate') {
@@ -554,6 +676,7 @@ const ResumableAgentController = async (req, res, next, initializeClient, addTit
         // `_waitForRun` would otherwise never resolve, deferring client disposal
         // until the 45s title timeout, and no title should persist for a failed turn.
         titleAbortController.abort();
+        titleDiscardController.abort();
         job.abortController.signal.removeEventListener('abort', abortTitleOnJobAbort);
         acceptsTitleEvents = false;
         resolveConvoReady();
@@ -570,7 +693,7 @@ const ResumableAgentController = async (req, res, next, initializeClient, addTit
           GenerationJobManager.completeJob(streamId, error.message);
         }
 
-        await decrementPendingRequest(userId);
+        await finishResumableRequest(req, userId);
 
         // Defer disposal until any immediate title settles (it holds the run/req).
         if (immediateTitlePromise) {
@@ -594,7 +717,7 @@ const ResumableAgentController = async (req, res, next, initializeClient, addTit
         `[ResumableAgentController] Unhandled error in background generation: ${err.message}`,
       );
       GenerationJobManager.completeJob(streamId, err.message);
-      await decrementPendingRequest(userId);
+      await finishResumableRequest(req, userId);
     });
   } catch (error) {
     logger.error('[ResumableAgentController] Initialization error:', error);
@@ -605,7 +728,7 @@ const ResumableAgentController = async (req, res, next, initializeClient, addTit
       await GenerationJobManager.emitError(streamId, error.message || 'Failed to start generation');
     }
     GenerationJobManager.completeJob(streamId, error.message);
-    await decrementPendingRequest(userId);
+    await finishResumableRequest(req, userId);
     if (client) {
       disposeClient(client);
     }
@@ -653,6 +776,17 @@ const _LegacyAgentController = async (req, res, next, initializeClient, addTitle
   // Match the same logic used for conversationId generation above
   const userId = req.user.id;
 
+  if (
+    await isUnpersistedPreliminaryParent({
+      userId,
+      conversationId: reqConversationId,
+      parentMessageId,
+      getMessages,
+    })
+  ) {
+    return rejectPreliminaryParentMessageId(res);
+  }
+
   await attachConversationCreatedAt(req, { userId, conversationId, isNewConvo });
 
   // Create handler to avoid capturing the entire parent scope
@@ -759,8 +893,8 @@ const _LegacyAgentController = async (req, res, next, initializeClient, addTitle
     // Store endpoint metadata for abort handling
     GenerationJobManager.updateMetadata(streamId, {
       endpoint: endpointOption.endpoint,
-      iconURL: endpointOption.iconURL,
-      model: endpointOption.modelOptions?.model || endpointOption.model_parameters?.model,
+      iconURL: getEndpointIconURL(req, endpointOption),
+      model: getAgentResponseModel(req, endpointOption),
       sender: client?.sender,
     });
 
diff --git a/api/server/controllers/agents/responses.js b/api/server/controllers/agents/responses.js
index b2805fc19fc..abd292fd559 100644
--- a/api/server/controllers/agents/responses.js
+++ b/api/server/controllers/agents/responses.js
@@ -12,18 +12,20 @@ const {
 const {
   createRun,
   buildToolSet,
-  loadSkillStates,
-  resolveAgentScopedSkillIds,
   createSafeUser,
   initializeAgent,
+  loadSkillStates,
   getBalanceConfig,
+  injectSkillPrimes,
+  extractManualSkills,
   recordCollectedUsage,
+  createSubagentUsageSink,
   getTransactionsConfig,
-  extractManualSkills,
-  injectSkillPrimes,
-  createToolExecuteHandler,
+  findPiiMatchInMessages,
   discoverConnectedAgents,
+  createToolExecuteHandler,
   getRemoteAgentPermissions,
+  resolveAgentScopedSkillIds,
   // Responses API
   writeDone,
   buildResponse,
@@ -56,8 +58,11 @@ const {
 } = require('~/server/services/PermissionService');
 const {
   getSkillToolDeps,
-  enrichWithSkillConfigurable,
-  buildSkillPrimedIdsByName,
+  getSkillDbMethods,
+  canAuthorSkillFiles,
+  withDeploymentSkillIds,
+  buildAgentToolContext,
+  enrichLoadedToolsWithAgentContext,
 } = require('~/server/services/Endpoints/agents/skillDeps');
 const { getModelsConfig } = require('~/server/controllers/ModelController');
 const { logViolation } = require('~/cache');
@@ -350,6 +355,7 @@ const createResponse = async (req, res) => {
 
     // Create tool loader
     const loadTools = createToolLoader(abortController.signal);
+    const skillDbMethods = getSkillDbMethods();
 
     // Initialize the agent first to check for disableStreaming
     const endpointOption = {
@@ -373,9 +379,9 @@ const createResponse = async (req, res) => {
       getUserCodeFiles: db.getUserCodeFiles,
       getToolFilesByIds: db.getToolFilesByIds,
       getCodeGeneratedFiles: db.getCodeGeneratedFiles,
-      listSkillsByAccess: db.listSkillsByAccess,
-      listAlwaysApplySkills: db.listAlwaysApplySkills,
-      getSkillByName: db.getSkillByName,
+      listSkillsByAccess: skillDbMethods.listSkillsByAccess,
+      listAlwaysApplySkills: skillDbMethods.listAlwaysApplySkills,
+      getSkillByName: skillDbMethods.getSkillByName,
     };
 
     const enabledCapabilities = new Set(
@@ -384,13 +390,26 @@ const createResponse = async (req, res) => {
     const skillsCapabilityEnabled = enabledCapabilities.has(AgentCapabilities.skills);
     const ephemeralSkillsToggle = req.body?.ephemeralAgent?.skills === true;
     const accessibleSkillIds = skillsCapabilityEnabled
+      ? withDeploymentSkillIds(
+          await findAccessibleResources({
+            userId: req.user.id,
+            role: req.user.role,
+            resourceType: ResourceType.SKILL,
+            requiredPermissions: PermissionBits.VIEW,
+          }),
+        )
+      : [];
+    const editableSkillIds = skillsCapabilityEnabled
       ? await findAccessibleResources({
           userId: req.user.id,
           role: req.user.role,
           resourceType: ResourceType.SKILL,
-          requiredPermissions: PermissionBits.VIEW,
+          requiredPermissions: PermissionBits.EDIT,
         })
       : [];
+    const skillCreateAllowed = skillsCapabilityEnabled
+      ? await getSkillToolDeps().canCreateSkill({ req })
+      : false;
 
     const { skillStates, defaultActiveOnShare } = await loadSkillStates({
       userId: req.user.id,
@@ -401,6 +420,19 @@ const createResponse = async (req, res) => {
 
     const manualSkills = extractManualSkills(req.body);
 
+    const primaryScopedSkillIds = resolveAgentScopedSkillIds({
+      agent,
+      accessibleSkillIds,
+      skillsCapabilityEnabled,
+      ephemeralSkillsToggle,
+    });
+    const primaryScopedEditableSkillIds = resolveAgentScopedSkillIds({
+      agent,
+      accessibleSkillIds: editableSkillIds,
+      skillsCapabilityEnabled,
+      ephemeralSkillsToggle,
+    });
+
     const primaryConfig = await initializeAgent(
       {
         req,
@@ -413,9 +445,11 @@ const createResponse = async (req, res) => {
         endpointOption,
         allowedProviders,
         isInitialAgent: true,
-        accessibleSkillIds: resolveAgentScopedSkillIds({
+        accessibleSkillIds: primaryScopedSkillIds,
+        skillAuthoringAvailable: canAuthorSkillFiles({
           agent,
-          accessibleSkillIds,
+          scopedEditableSkillIds: primaryScopedEditableSkillIds,
+          skillCreateAllowed,
           skillsCapabilityEnabled,
           ephemeralSkillsToggle,
         }),
@@ -434,20 +468,17 @@ const createResponse = async (req, res) => {
      * @type {Map<string, {
      *   agent: object,
      *   toolRegistry?: import('@librechat/agents').LCToolRegistry,
+     *   requestScopedConnections?: import('@librechat/api').RequestScopedMCPConnectionStore,
      *   userMCPAuthMap?: Record<string, Record<string, string>>,
      *   tool_resources?: object,
      *   actionsEnabled?: boolean,
      * }>}
      */
     const agentToolContexts = new Map();
-    agentToolContexts.set(primaryConfig.id, {
-      agent,
-      toolRegistry: primaryConfig.toolRegistry,
-      userMCPAuthMap: primaryConfig.userMCPAuthMap,
-      tool_resources: primaryConfig.tool_resources,
-      actionsEnabled: primaryConfig.actionsEnabled,
-      codeEnvAvailable: primaryConfig.codeEnvAvailable,
-    });
+    agentToolContexts.set(
+      primaryConfig.id,
+      buildAgentToolContext({ agent, config: primaryConfig }),
+    );
 
     // Only run BFS discovery (and pay `getModelsConfig` upfront) when the
     // primary has edges to follow — the common API case is single-agent.
@@ -476,6 +507,28 @@ const createResponse = async (req, res) => {
           // sub-agent must clear the same sharing boundary, not the looser
           // in-app AGENT one.
           resourceType: ResourceType.REMOTE_AGENT,
+          computeAccessibleSkillIds: (handoffAgent) =>
+            resolveAgentScopedSkillIds({
+              agent: handoffAgent,
+              accessibleSkillIds,
+              skillsCapabilityEnabled,
+              ephemeralSkillsToggle,
+            }),
+          computeSkillAuthoringAvailable: (handoffAgent) =>
+            canAuthorSkillFiles({
+              agent: handoffAgent,
+              scopedEditableSkillIds: resolveAgentScopedSkillIds({
+                agent: handoffAgent,
+                accessibleSkillIds: editableSkillIds,
+                skillsCapabilityEnabled,
+                ephemeralSkillsToggle,
+              }),
+              skillCreateAllowed,
+              skillsCapabilityEnabled,
+              ephemeralSkillsToggle,
+            }),
+          skillStates,
+          defaultActiveOnShare,
           /** @see DiscoverConnectedAgentsParams.codeEnvAvailable */
           codeEnvAvailable: enabledCapabilities.has(AgentCapabilities.execute_code),
         },
@@ -498,14 +551,7 @@ const createResponse = async (req, res) => {
           logViolation,
           db: dbMethods,
           onAgentInitialized: (agentId, handoffAgent, config) => {
-            agentToolContexts.set(agentId, {
-              agent: handoffAgent,
-              toolRegistry: config.toolRegistry,
-              userMCPAuthMap: config.userMCPAuthMap,
-              tool_resources: config.tool_resources,
-              actionsEnabled: config.actionsEnabled,
-              codeEnvAvailable: config.codeEnvAvailable,
-            });
+            agentToolContexts.set(agentId, buildAgentToolContext({ agent: handoffAgent, config }));
           },
           initializeAgent,
         },
@@ -532,6 +578,17 @@ const createResponse = async (req, res) => {
       typeof request.input === 'string' ? request.input : request.input,
     );
 
+    const piiHit = findPiiMatchInMessages(inputMessages, appConfig?.messageFilter?.pii);
+    if (piiHit != null) {
+      return sendResponsesErrorResponse(
+        res,
+        400,
+        `Message contains a ${piiHit.label}. Remove it and try again.`,
+        'invalid_request',
+        'message_filter_pii_block',
+      );
+    }
+
     // Merge previous messages with new input
     const allMessages = [...previousMessages, ...inputMessages];
 
@@ -573,19 +630,13 @@ const createResponse = async (req, res) => {
       }
     }
 
-    /* Stable for the turn: the prime lists are fixed once
-       `initializeAgent` resolves. Hoisted here so both the streaming
-       and non-streaming `loadTools` closures below reuse it without
-       recomputing per tool execution. `codeEnvAvailable` is read
+    /* Stable for the turn: the primary prime list is fixed once
+       `initializeAgent` resolves and is used as the fallback when a
+       specific agent context is unavailable. `codeEnvAvailable` is read
        per-agent from the stored tool context (admin cap AND that
        agent's `tools` list includes `execute_code`) — a skills-only
        agent never gains sandbox access even if the admin enabled the
        capability globally. */
-    const skillPrimedIdsByName = buildSkillPrimedIdsByName(
-      manualSkillPrimes,
-      alwaysApplySkillPrimes,
-    );
-
     // Create tracker for streaming or aggregator for non-streaming
     const tracker = actuallyStreaming ? createResponseTracker() : null;
     const aggregator = actuallyStreaming ? null : createResponseAggregator();
@@ -635,17 +686,17 @@ const createResponse = async (req, res) => {
             agent: ctx.agent ?? agent,
             signal: abortController.signal,
             toolRegistry: ctx.toolRegistry,
+            mcpAvailableTools: ctx.mcpAvailableTools,
+            requestScopedConnections: ctx.requestScopedConnections,
             userMCPAuthMap: ctx.userMCPAuthMap,
             tool_resources: ctx.tool_resources,
             actionsEnabled: ctx.actionsEnabled,
           });
-          return enrichWithSkillConfigurable(
+          return enrichLoadedToolsWithAgentContext({
             result,
             req,
-            primaryConfig.accessibleSkillIds,
-            ctx.codeEnvAvailable === true,
-            skillPrimedIdsByName,
-          );
+            ctx,
+          });
         },
         toolEndCallback,
         ...getSkillToolDeps(),
@@ -699,6 +750,9 @@ const createResponse = async (req, res) => {
           conversationId,
         },
         user: { id: userId },
+        /** Bills subagent child-run model calls (reported outside the
+         *  streamEvents loop) into the same collectedUsage array. */
+        subagentUsageSink: createSubagentUsageSink(collectedUsage),
       });
 
       if (!run) {
@@ -811,17 +865,17 @@ const createResponse = async (req, res) => {
             agent: ctx.agent ?? agent,
             signal: abortController.signal,
             toolRegistry: ctx.toolRegistry,
+            mcpAvailableTools: ctx.mcpAvailableTools,
+            requestScopedConnections: ctx.requestScopedConnections,
             userMCPAuthMap: ctx.userMCPAuthMap,
             tool_resources: ctx.tool_resources,
             actionsEnabled: ctx.actionsEnabled,
           });
-          return enrichWithSkillConfigurable(
+          return enrichLoadedToolsWithAgentContext({
             result,
             req,
-            primaryConfig.accessibleSkillIds,
-            ctx.codeEnvAvailable === true,
-            skillPrimedIdsByName,
-          );
+            ctx,
+          });
         },
         toolEndCallback,
         ...getSkillToolDeps(),
@@ -873,6 +927,9 @@ const createResponse = async (req, res) => {
           conversationId,
         },
         user: { id: userId },
+        /** Bills subagent child-run model calls (reported outside the
+         *  streamEvents loop) into the same collectedUsage array. */
+        subagentUsageSink: createSubagentUsageSink(collectedUsage),
       });
 
       if (!run) {
diff --git a/api/server/controllers/agents/v1.js b/api/server/controllers/agents/v1.js
index adb78d1b566..b7f7a9bd29b 100644
--- a/api/server/controllers/agents/v1.js
+++ b/api/server/controllers/agents/v1.js
@@ -77,10 +77,9 @@ const sanitizeViewerSkillScope = (agent, accessibleSkillSet) => {
 
   const configuredSkills = Array.isArray(agent.skills) ? agent.skills : [];
   if (configuredSkills.length === 0) {
+    // Empty allowlist means the viewer's full accessible catalog.
     delete agent.skills;
-    if (accessibleSkillSet.size > 0) {
-      agent.skills_enabled = true;
-    }
+    agent.skills_enabled = true;
     return agent;
   }
 
diff --git a/api/server/controllers/agents/v1.spec.js b/api/server/controllers/agents/v1.spec.js
index f36152abec6..fda2bdd6167 100644
--- a/api/server/controllers/agents/v1.spec.js
+++ b/api/server/controllers/agents/v1.spec.js
@@ -1548,6 +1548,33 @@ describe('Agent Controllers - Mass Assignment Protection', () => {
       expect(response.data[0].skills_enabled).toBeUndefined();
     });
 
+    test('should preserve enabled skill scope for VIEW list callers with an empty allowlist', async () => {
+      await Agent.findByIdAndUpdate(agentA1._id, {
+        skills_enabled: true,
+        skills: [],
+      });
+
+      mockReq.user.id = userB.toString();
+      mockReq.query.requiredPermission = String(PermissionBits.VIEW);
+      findAccessibleResources.mockImplementation(({ resourceType }) => {
+        if (resourceType === ResourceType.AGENT) {
+          return Promise.resolve([agentA1._id]);
+        }
+        if (resourceType === ResourceType.SKILL) {
+          return Promise.resolve([]);
+        }
+        return Promise.resolve([]);
+      });
+      findPubliclyAccessibleResources.mockResolvedValue([]);
+
+      await getListAgentsHandler(mockReq, mockRes);
+
+      const response = mockRes.json.mock.calls[0][0];
+      expect(response.data).toHaveLength(1);
+      expect(response.data[0].skills).toBeUndefined();
+      expect(response.data[0].skills_enabled).toBe(true);
+    });
+
     test('should return raw skill configuration for EDIT list callers', async () => {
       const visibleSkillId = new mongoose.Types.ObjectId();
       const hiddenSkillId = new mongoose.Types.ObjectId();
diff --git a/api/server/controllers/mcp.js b/api/server/controllers/mcp.js
index 02e29d75963..85b840891dc 100644
--- a/api/server/controllers/mcp.js
+++ b/api/server/controllers/mcp.js
@@ -5,9 +5,10 @@
  * @import { MCPServerRegistry } from '@librechat/api'
  * @import { MCPServerDocument } from 'librechat-data-provider'
  */
-const { logger } = require('@librechat/data-schemas');
+const { logger, SystemCapabilities } = require('@librechat/data-schemas');
 const {
   checkAccess,
+  isUserSourced,
   MCPErrorCodes,
   redactServerSecrets,
   redactAllServerSecrets,
@@ -17,9 +18,11 @@ const {
 const {
   Constants,
   Permissions,
+  ResourceType,
+  PermissionBits,
   PermissionTypes,
-  MCPServerUserInputSchema,
   MCP_USER_INPUT_FIELDS,
+  MCPServerUserInputSchema,
 } = require('librechat-data-provider');
 const {
   resolveConfigServers,
@@ -27,6 +30,8 @@ const {
   resolveAllMcpConfigs,
 } = require('~/server/services/MCP');
 const { cacheMCPServerTools, getMCPServerTools } = require('~/server/services/Config');
+const { getResourcePermissionsMap } = require('~/server/services/PermissionService');
+const { hasCapability } = require('~/server/middleware/roles/capabilities');
 const { getMCPManager, getMCPServersRegistry } = require('~/config');
 const db = require('~/models');
 
@@ -96,7 +101,7 @@ const getMCPTools = async (req, res) => {
         try {
           return {
             serverName,
-            tools: await getMCPServerTools(userId, serverName),
+            tools: await getMCPServerTools(userId, serverName, mcpConfig[serverName]),
           };
         } catch (error) {
           logger.error(`[getMCPTools] Error fetching cached tools for ${serverName}:`, error);
@@ -125,7 +130,12 @@ const getMCPTools = async (req, res) => {
 
       if (Object.keys(serverTools).length > 0) {
         // Cache asynchronously without blocking
-        cacheMCPServerTools({ userId, serverName, serverTools }).catch((err) =>
+        cacheMCPServerTools({
+          userId,
+          serverName,
+          serverTools,
+          serverConfig: mcpConfig[serverName],
+        }).catch((err) =>
           logger.error(`[getMCPTools] Failed to cache tools for ${serverName}:`, err),
         );
       }
@@ -191,6 +201,55 @@ const getMCPTools = async (req, res) => {
     res.status(500).json({ message: error.message });
   }
 };
+/** Mirrors canAccessResource's capability bypass plus per-resource ACL EDIT check. */
+async function computeCanEditByServer(req, serverConfigs) {
+  const canEditByServer = new Map();
+  let bypass = false;
+  try {
+    bypass = await hasCapability(req.user, SystemCapabilities.MANAGE_MCP_SERVERS);
+  } catch (err) {
+    logger.warn(`[computeCanEditByServer] Capability bypass check failed: ${err.message}`);
+  }
+  if (bypass) {
+    for (const name of Object.keys(serverConfigs)) {
+      canEditByServer.set(name, true);
+    }
+    return canEditByServer;
+  }
+  const dbIdsToCheck = [];
+  const dbIdToServerName = new Map();
+  for (const [name, config] of Object.entries(serverConfigs)) {
+    if (config.dbId) {
+      dbIdsToCheck.push(config.dbId);
+      dbIdToServerName.set(String(config.dbId), name);
+      continue;
+    }
+    canEditByServer.set(name, isUserSourced(config));
+  }
+  if (dbIdsToCheck.length > 0) {
+    try {
+      const permsMap = await getResourcePermissionsMap({
+        userId: req.user.id,
+        role: req.user.role,
+        resourceType: ResourceType.MCPSERVER,
+        resourceIds: dbIdsToCheck,
+      });
+      for (const [dbIdStr, name] of dbIdToServerName) {
+        const bits = permsMap.get(dbIdStr) ?? 0;
+        canEditByServer.set(name, (bits & PermissionBits.EDIT) !== 0);
+      }
+    } catch (err) {
+      logger.warn(
+        `[computeCanEditByServer] ACL lookup failed, defaulting to no edit: ${err.message}`,
+      );
+      for (const name of dbIdToServerName.values()) {
+        canEditByServer.set(name, false);
+      }
+    }
+  }
+  return canEditByServer;
+}
+
 /**
  * Get all MCP servers with permissions
  * @route GET /api/mcp/servers
@@ -203,7 +262,8 @@ const getMCPServersList = async (req, res) => {
     }
 
     const serverConfigs = await resolveAllMcpConfigs(userId, req.user);
-    return res.json(redactAllServerSecrets(serverConfigs));
+    const canEditByServer = await computeCanEditByServer(req, serverConfigs);
+    return res.json(redactAllServerSecrets(serverConfigs, { canEditByServer }));
   } catch (error) {
     logger.error('[getMCPServersList]', error);
     res.status(500).json({ error: error.message });
@@ -301,7 +361,7 @@ const createMCPServerController = async (req, res) => {
     );
     res.status(201).json({
       serverName: result.serverName,
-      ...redactServerSecrets(result.config),
+      ...redactServerSecrets(result.config, { canEdit: true }),
     });
   } catch (error) {
     logger.error('[createMCPServer]', error);
@@ -334,7 +394,9 @@ const getMCPServerById = async (req, res) => {
       return res.status(404).json({ message: 'MCP server not found' });
     }
 
-    res.status(200).json(redactServerSecrets(parsedConfig));
+    const canEditMap = await computeCanEditByServer(req, { [serverName]: parsedConfig });
+    const canEdit = canEditMap.get(serverName) ?? false;
+    res.status(200).json(redactServerSecrets(parsedConfig, { canEdit }));
   } catch (error) {
     logger.error('[getMCPServerById]', error);
     res.status(500).json({ message: error.message });
@@ -395,7 +457,7 @@ const updateMCPServerController = async (req, res) => {
       userId,
     );
 
-    res.status(200).json(redactServerSecrets(parsedConfig));
+    res.status(200).json(redactServerSecrets(parsedConfig, { canEdit: true }));
   } catch (error) {
     logger.error('[updateMCPServer]', error);
     const mcpErrorResponse = handleMCPError(error, res);
diff --git a/api/server/experimental.js b/api/server/experimental.js
index 8fd94c67232..ac289615a35 100644
--- a/api/server/experimental.js
+++ b/api/server/experimental.js
@@ -16,15 +16,19 @@ const {
   isEnabled,
   apiNotFound,
   ErrorController,
+  QUERY_DEVTOOLS_HEADER,
   performStartupChecks,
   handleJsonParseError,
   initializeFileStorage,
+  maybeInjectQueryDevtoolsBootstrap,
   preAuthTenantMiddleware,
 } = require('@librechat/api');
 const { connectDb, indexSync } = require('~/db');
 const initializeOAuthReconnectManager = require('./services/initializeOAuthReconnectManager');
+const { capabilityContextMiddleware } = require('./middleware/roles/capabilities');
 const createValidateImageRequest = require('./middleware/validateImageRequest');
 const { startExpiredFileSweep } = require('./services/Files/process');
+const { initializeGitHubSkillSync } = require('./services/Skills/sync');
 const { jwtLogin, ldapLogin, passportLogin } = require('~/strategies');
 const { updateInterfacePermissions: updateInterfacePerms } = require('@librechat/api');
 const {
@@ -36,6 +40,7 @@ const {
 const { checkMigrations } = require('./services/start/migration');
 const initializeMCPs = require('./services/initializeMCPs');
 const configureSocialLogins = require('./socialLogins');
+const createSpaFallback = require('./utils/fallback');
 const { getAppConfig } = require('./services/Config');
 const staticCache = require('./utils/staticCache');
 const optionalJwtAuth = require('./middleware/optionalJwtAuth');
@@ -294,6 +299,7 @@ if (cluster.isMaster) {
     /** Initialize app configuration */
     const appConfig = await getAppConfig();
     initializeFileStorage(appConfig);
+    initializeGitHubSkillSync(appConfig);
     expiredFileSweepOptions = { appConfig, loadAppConfig: getAppConfig };
     startExpiredFileSweepOnce();
     await performStartupChecks(appConfig);
@@ -315,6 +321,23 @@ if (cluster.isMaster) {
       }
     }
 
+    const sendIndexHtml = (req, res) => {
+      res.set({
+        'Cache-Control': process.env.INDEX_CACHE_CONTROL || 'no-cache, no-store, must-revalidate',
+        Pragma: process.env.INDEX_PRAGMA || 'no-cache',
+        Expires: process.env.INDEX_EXPIRES || '0',
+      });
+      res.vary(QUERY_DEVTOOLS_HEADER);
+
+      const lang = req.cookies.lang || req.headers['accept-language']?.split(',')[0] || 'en-US';
+      const saneLang = lang.replace(/"/g, '&quot;');
+      let updatedIndexHtml = indexHTML.replace(/lang="en-US"/g, `lang="${saneLang}"`);
+      updatedIndexHtml = maybeInjectQueryDevtoolsBootstrap(updatedIndexHtml, req);
+
+      res.type('html');
+      res.send(updatedIndexHtml);
+    };
+
     /** Health check endpoint */
     app.get('/health', (_req, res) => res.status(200).send('OK'));
 
@@ -348,6 +371,7 @@ if (cluster.isMaster) {
       logger.warn('Response compression has been disabled via DISABLE_COMPRESSION.');
     }
 
+    app.get('/index.html', sendIndexHtml);
     app.use(staticCache(appConfig.paths.dist));
     app.use(staticCache(appConfig.paths.fonts));
     app.use(staticCache(appConfig.paths.assets));
@@ -370,10 +394,13 @@ if (cluster.isMaster) {
       await configureSocialLogins(app);
     }
 
+    app.use(capabilityContextMiddleware);
+
     /** Routes */
     app.use('/oauth', routes.oauth);
     app.use('/api/auth', routes.auth);
     app.use('/api/admin', routes.adminAuth);
+    app.use('/api/admin/skills', routes.adminSkills);
     app.use('/api/actions', routes.actions);
     app.use('/api/keys', routes.keys);
     app.use('/api/api-keys', routes.apiKeys);
@@ -382,6 +409,7 @@ if (cluster.isMaster) {
     app.use('/api/messages', routes.messages);
     app.use('/api/convos', routes.convos);
     app.use('/api/presets', routes.presets);
+    app.use('/api/projects', routes.projects);
     app.use('/api/prompts', routes.prompts);
     app.use('/api/skills', routes.skills);
     app.use('/api/categories', routes.categories);
@@ -405,20 +433,7 @@ if (cluster.isMaster) {
     app.use('/api', apiNotFound);
 
     /** SPA fallback - serve index.html for all unmatched routes */
-    app.use((req, res) => {
-      res.set({
-        'Cache-Control': process.env.INDEX_CACHE_CONTROL || 'no-cache, no-store, must-revalidate',
-        Pragma: process.env.INDEX_PRAGMA || 'no-cache',
-        Expires: process.env.INDEX_EXPIRES || '0',
-      });
-
-      const lang = req.cookies.lang || req.headers['accept-language']?.split(',')[0] || 'en-US';
-      const saneLang = lang.replace(/"/g, '&quot;');
-      let updatedIndexHtml = indexHTML.replace(/lang="en-US"/g, `lang="${saneLang}"`);
-
-      res.type('html');
-      res.send(updatedIndexHtml);
-    });
+    app.use(createSpaFallback(sendIndexHtml));
 
     /** Error handler (must be last - Express identifies error middleware by its 4-arg signature) */
     app.use(ErrorController);
diff --git a/api/server/index.js b/api/server/index.js
index bd2d260e762..501946a4136 100644
--- a/api/server/index.js
+++ b/api/server/index.js
@@ -19,8 +19,11 @@ const {
   performStartupChecks,
   handleJsonParseError,
   GenerationJobManager,
+  QUERY_DEVTOOLS_HEADER,
   createStreamServices,
   initializeFileStorage,
+  initializeDeploymentSkills,
+  maybeInjectQueryDevtoolsBootstrap,
   preAuthTenantMiddleware,
   setupGracefulShutdown,
   updateInterfacePermissions,
@@ -36,11 +39,13 @@ const initializeOAuthReconnectManager = require('./services/initializeOAuthRecon
 const { capabilityContextMiddleware } = require('./middleware/roles/capabilities');
 const createValidateImageRequest = require('./middleware/validateImageRequest');
 const { startExpiredFileSweep } = require('./services/Files/process');
+const { initializeGitHubSkillSync } = require('./services/Skills/sync');
 const { jwtLogin, ldapLogin, passportLogin } = require('~/strategies');
 const { checkMigrations } = require('./services/start/migration');
 const optionalJwtAuth = require('./middleware/optionalJwtAuth');
 const initializeMCPs = require('./services/initializeMCPs');
 const configureSocialLogins = require('./socialLogins');
+const createSpaFallback = require('./utils/fallback');
 const { getAppConfig } = require('./services/Config');
 const staticCache = require('./utils/staticCache');
 const noIndex = require('./middleware/noIndex');
@@ -56,6 +61,30 @@ const trusted_proxy = Number(TRUST_PROXY) || 1; /* trust first proxy by default
 const app = express();
 let serverReady = false;
 
+const SERVER_NOT_READY_CODE = 'SERVER_NOT_READY';
+const CHAT_START_RETRY_AFTER_SECONDS = '1';
+
+const rejectChatStartsUntilReady = (req, res, next) => {
+  if (serverReady || req.method !== 'POST' || req.path === '/abort') {
+    return next();
+  }
+
+  res.set('Retry-After', CHAT_START_RETRY_AFTER_SECONDS);
+  return res.status(503).json({
+    code: SERVER_NOT_READY_CODE,
+    error: 'Server is still starting. Please retry shortly.',
+  });
+};
+
+const configureGenerationStreams = () => {
+  const streamServices = createStreamServices();
+  GenerationJobManager.configure({
+    ...streamServices,
+    cleanupOnComplete: !isEnabled(process.env.STREAM_KEEP_COMPLETED_JOBS),
+  });
+  GenerationJobManager.initialize();
+};
+
 const startServer = async () => {
   const { metricsMiddleware, metricsRouter } = createMetrics();
   if (!process.env.METRICS_SECRET) {
@@ -92,6 +121,8 @@ const startServer = async () => {
   });
   const appConfig = await getAppConfig({ baseOnly: true });
   initializeFileStorage(appConfig);
+  await initializeDeploymentSkills({ projectRoot: path.resolve(__dirname, '../..') });
+  initializeGitHubSkillSync(appConfig);
   startExpiredFileSweep({ appConfig, loadAppConfig: getAppConfig });
   await runAsSystem(async () => {
     await performStartupChecks(appConfig);
@@ -114,6 +145,23 @@ const startServer = async () => {
     }
   }
 
+  const sendIndexHtml = (req, res) => {
+    res.set({
+      'Cache-Control': process.env.INDEX_CACHE_CONTROL || 'no-cache, no-store, must-revalidate',
+      Pragma: process.env.INDEX_PRAGMA || 'no-cache',
+      Expires: process.env.INDEX_EXPIRES || '0',
+    });
+    res.vary(QUERY_DEVTOOLS_HEADER);
+
+    const lang = req.cookies.lang || req.headers['accept-language']?.split(',')[0] || 'en-US';
+    const saneLang = lang.replace(/"/g, '&quot;');
+    let updatedIndexHtml = indexHTML.replace(/lang="en-US"/g, `lang="${saneLang}"`);
+    updatedIndexHtml = maybeInjectQueryDevtoolsBootstrap(updatedIndexHtml, req);
+
+    res.type('html');
+    res.send(updatedIndexHtml);
+  };
+
   app.get('/health', (_req, res) => res.status(200).send('OK'));
   app.get('/livez', (_req, res) => res.status(200).send('OK'));
   app.get('/readyz', (_req, res) => {
@@ -153,6 +201,7 @@ const startServer = async () => {
     console.warn('Response compression has been disabled via DISABLE_COMPRESSION.');
   }
 
+  app.get('/index.html', sendIndexHtml);
   app.use(staticCache(appConfig.paths.dist));
   app.use(staticCache(appConfig.paths.fonts));
   app.use(staticCache(appConfig.paths.assets));
@@ -192,6 +241,7 @@ const startServer = async () => {
   app.use('/api/admin/grants', routes.adminGrants);
   app.use('/api/admin/groups', routes.adminGroups);
   app.use('/api/admin/roles', routes.adminRoles);
+  app.use('/api/admin/skills', routes.adminSkills);
   app.use('/api/admin/users', routes.adminUsers);
   app.use('/api/actions', routes.actions);
   app.use('/api/keys', routes.keys);
@@ -201,6 +251,7 @@ const startServer = async () => {
   app.use('/api/messages', routes.messages);
   app.use('/api/convos', routes.convos);
   app.use('/api/presets', routes.presets);
+  app.use('/api/projects', routes.projects);
   app.use('/api/prompts', routes.prompts);
   app.use('/api/skills', routes.skills);
   app.use('/api/categories', routes.categories);
@@ -213,6 +264,7 @@ const startServer = async () => {
   app.use('/images/', createValidateImageRequest(appConfig.secureImageLinks), routes.staticRoute);
   app.use('/api/share', preAuthTenantMiddleware, routes.share);
   app.use('/api/roles', routes.roles);
+  app.use('/api/agents/chat', rejectChatStartsUntilReady);
   app.use('/api/agents', routes.agents);
   app.use('/api/banner', routes.banner);
   app.use('/api/memories', routes.memories);
@@ -228,20 +280,7 @@ const startServer = async () => {
   app.use('/api', apiNotFound);
 
   /** SPA fallback - serve index.html for all unmatched routes */
-  app.use((req, res) => {
-    res.set({
-      'Cache-Control': process.env.INDEX_CACHE_CONTROL || 'no-cache, no-store, must-revalidate',
-      Pragma: process.env.INDEX_PRAGMA || 'no-cache',
-      Expires: process.env.INDEX_EXPIRES || '0',
-    });
-
-    const lang = req.cookies.lang || req.headers['accept-language']?.split(',')[0] || 'en-US';
-    const saneLang = lang.replace(/"/g, '&quot;');
-    let updatedIndexHtml = indexHTML.replace(/lang="en-US"/g, `lang="${saneLang}"`);
-
-    res.type('html');
-    res.send(updatedIndexHtml);
-  });
+  app.use(createSpaFallback(sendIndexHtml));
 
   /** Record trace errors before the final error controller. */
   if (telemetry.enabled) {
@@ -250,6 +289,8 @@ const startServer = async () => {
   /** Error handler (must be last - Express identifies error middleware by its 4-arg signature) */
   app.use(ErrorController);
 
+  configureGenerationStreams();
+
   const server = app.listen(port, host, async (err) => {
     if (err) {
       logger.error('Failed to start server:', err);
@@ -279,14 +320,6 @@ const startServer = async () => {
       });
       await checkMigrations();
 
-      // Configure stream services (auto-detects Redis from USE_REDIS env var)
-      const streamServices = createStreamServices();
-      GenerationJobManager.configure({
-        ...streamServices,
-        cleanupOnComplete: !isEnabled(process.env.STREAM_KEEP_COMPLETED_JOBS),
-      });
-      GenerationJobManager.initialize();
-
       const inspectFlags = process.execArgv.some((arg) => arg.startsWith('--inspect'));
       if (inspectFlags || isEnabled(process.env.MEM_DIAG)) {
         memoryDiagnostics.start();
diff --git a/api/server/index.spec.js b/api/server/index.spec.js
index 573770e2828..3e0fc07127d 100644
--- a/api/server/index.spec.js
+++ b/api/server/index.spec.js
@@ -83,6 +83,33 @@ describe('Telemetry wiring', () => {
   });
 });
 
+describe('Startup readiness wiring', () => {
+  const source = fs.readFileSync(path.join(__dirname, 'index.js'), 'utf8');
+
+  it('configures generation streams before the server accepts requests', () => {
+    const streamConfigIndex = source.indexOf('configureGenerationStreams();');
+    const listenIndex = source.indexOf('const server = app.listen');
+    const postListenMcpIndex = source.indexOf('await initializeMCPs();');
+
+    expect(streamConfigIndex).toBeGreaterThan(-1);
+    expect(listenIndex).toBeGreaterThan(-1);
+    expect(postListenMcpIndex).toBeGreaterThan(-1);
+    expect(streamConfigIndex).toBeLessThan(listenIndex);
+    expect(streamConfigIndex).toBeLessThan(postListenMcpIndex);
+  });
+
+  it('mounts the chat-start readiness gate before agent routes', () => {
+    const readinessGateIndex = source.indexOf(
+      "app.use('/api/agents/chat', rejectChatStartsUntilReady);",
+    );
+    const agentsRouteIndex = source.indexOf("app.use('/api/agents', routes.agents);");
+
+    expect(readinessGateIndex).toBeGreaterThan(-1);
+    expect(agentsRouteIndex).toBeGreaterThan(-1);
+    expect(readinessGateIndex).toBeLessThan(agentsRouteIndex);
+  });
+});
+
 describe('Server Configuration', () => {
   // Increase the default timeout to allow for Mongo cleanup
   jest.setTimeout(30_000);
@@ -185,6 +212,32 @@ describe('Server Configuration', () => {
     expect(response.headers['content-type']).toMatch(/html/);
   });
 
+  it('should gate React Query Devtools config in SPA HTML by debug header', async () => {
+    const defaultResponse = await request(app).get('/this/does/not/exist');
+    const debugResponse = await request(app)
+      .get('/this/does/not/exist')
+      .set('x-librechat-enable-query-devtools', '1');
+    const directIndexResponse = await request(app)
+      .get('/index.html')
+      .set('x-librechat-enable-query-devtools', '1');
+
+    expect(defaultResponse.status).toBe(200);
+    expect(defaultResponse.headers.vary).toContain('x-librechat-enable-query-devtools');
+    expect(defaultResponse.text).not.toContain('enableQueryDevtools');
+
+    expect(debugResponse.status).toBe(200);
+    expect(debugResponse.headers.vary).toContain('x-librechat-enable-query-devtools');
+    expect(debugResponse.text).toContain('window.__LIBRECHAT_CONFIG__');
+    expect(debugResponse.text).toContain('data-librechat-query-devtools="true"');
+    expect(debugResponse.text).toContain('"enableQueryDevtools":true');
+
+    expect(directIndexResponse.status).toBe(200);
+    expect(directIndexResponse.headers.vary).toContain('x-librechat-enable-query-devtools');
+    expect(directIndexResponse.text).toContain('window.__LIBRECHAT_CONFIG__');
+    expect(directIndexResponse.text).toContain('data-librechat-query-devtools="true"');
+    expect(directIndexResponse.text).toContain('"enableQueryDevtools":true');
+  });
+
   it('should return 500 for unknown errors via ErrorController', async () => {
     // Testing the error handling here on top of unit tests to ensure the middleware is correctly integrated
 
diff --git a/api/server/middleware/__tests__/requireJwtAuth.spec.js b/api/server/middleware/__tests__/requireJwtAuth.spec.js
index 4059be24098..b70f371a941 100644
--- a/api/server/middleware/__tests__/requireJwtAuth.spec.js
+++ b/api/server/middleware/__tests__/requireJwtAuth.spec.js
@@ -43,6 +43,7 @@ jest.mock('@librechat/data-schemas', () => {
     getTenantId: () => tenantStorage.getStore()?.tenantId,
     getUserId: () => tenantStorage.getStore()?.userId,
     getRequestId: () => tenantStorage.getStore()?.requestId,
+    logger: { debug: jest.fn(), info: jest.fn(), warn: jest.fn(), error: jest.fn() },
     tenantStorage,
   };
 });
@@ -53,6 +54,152 @@ jest.mock('@librechat/data-schemas', () => {
 // primitives. The real implementation is covered by packages/api tenant.spec.ts.
 jest.mock('@librechat/api', () => {
   const { tenantStorage } = require('@librechat/data-schemas');
+  const normalizeAuthLogValue = (value) => {
+    if (value == null) {
+      return undefined;
+    }
+    if (Array.isArray(value)) {
+      for (const entry of value) {
+        const normalized = normalizeAuthLogValue(entry);
+        if (normalized) {
+          return normalized;
+        }
+      }
+      return undefined;
+    }
+    if (typeof value === 'string') {
+      const trimmed = value.trim();
+      return trimmed || undefined;
+    }
+    if (typeof value === 'number' || typeof value === 'boolean') {
+      return String(value);
+    }
+    return undefined;
+  };
+  const normalizeAuthLogContextValue = (value) => {
+    if (value == null) {
+      return undefined;
+    }
+    if (Array.isArray(value)) {
+      const values = value
+        .map((entry) => normalizeAuthLogValue(entry))
+        .filter((entry) => entry !== undefined);
+      return values.length > 0 ? values : undefined;
+    }
+    if (typeof value === 'string') {
+      return normalizeAuthLogValue(value);
+    }
+    if (typeof value === 'number') {
+      return Number.isFinite(value) ? value : undefined;
+    }
+    if (typeof value === 'boolean') {
+      return value;
+    }
+    return undefined;
+  };
+  const getAuthFailureField = (source, field) => {
+    if (!source) {
+      return undefined;
+    }
+    if (typeof source === 'string') {
+      return field === 'message' ? source : undefined;
+    }
+    if (typeof source === 'object') {
+      try {
+        return source[field];
+      } catch {
+        return undefined;
+      }
+    }
+    return undefined;
+  };
+  const getAuthFailureReason = (err, info, fallback = 'Unauthorized') =>
+    normalizeAuthLogValue(getAuthFailureField(info, 'message')) ??
+    normalizeAuthLogValue(getAuthFailureField(err, 'message')) ??
+    fallback;
+  const getAuthFailureErrorName = (err, info) =>
+    normalizeAuthLogValue(getAuthFailureField(info, 'name')) ??
+    normalizeAuthLogValue(getAuthFailureField(err, 'name'));
+  const getSafeTokenProvider = (tokenProvider) => {
+    const normalized = normalizeAuthLogValue(tokenProvider);
+    if (!normalized) {
+      return undefined;
+    }
+    return normalized === 'openid' || normalized === 'librechat' ? normalized : 'other';
+  };
+  const normalizeRoutePath = (path) => {
+    if (typeof path === 'string') {
+      return normalizeAuthLogValue(path);
+    }
+    if (Array.isArray(path)) {
+      for (const entry of path) {
+        const normalized = normalizeRoutePath(entry);
+        if (normalized) {
+          return normalized;
+        }
+      }
+    }
+    return undefined;
+  };
+  const joinRoutePath = (baseUrl, routePath) => {
+    const normalizedRoute = routePath === '/' ? '' : routePath;
+    if (!baseUrl) {
+      return normalizedRoute || '/';
+    }
+    if (!normalizedRoute) {
+      return baseUrl;
+    }
+    return `${baseUrl.replace(/\/$/, '')}/${normalizedRoute.replace(/^\//, '')}`;
+  };
+  const bucketConcretePath = (path) => {
+    const queryless = path?.split('?')[0];
+    if (!queryless) {
+      return undefined;
+    }
+    const segments = queryless.split('/').filter(Boolean);
+    if (segments.length === 0) {
+      return '/';
+    }
+    if (segments[0] === 'api' && segments[1]) {
+      return `/${segments.slice(0, 2).join('/')}`;
+    }
+    return `/${segments[0]}`;
+  };
+  const getRequestPath = (req) => {
+    const baseUrl = normalizeAuthLogValue(req.baseUrl);
+    const routePath = normalizeRoutePath(req.route?.path);
+    if (routePath) {
+      return joinRoutePath(baseUrl, routePath);
+    }
+    if (baseUrl) {
+      return baseUrl;
+    }
+    const path =
+      normalizeAuthLogValue(req.path) ?? normalizeAuthLogValue(req.originalUrl ?? req.url);
+    return bucketConcretePath(path);
+  };
+  const compactAuthLogContext = (log) =>
+    Object.fromEntries(
+      Object.entries(log)
+        .map(([key, value]) => [key, normalizeAuthLogContextValue(value)])
+        .filter(([, value]) => value !== undefined),
+    );
+  const buildSafeAuthLogContext = (req, authState, extra = {}) =>
+    compactAuthLogContext({
+      ...extra,
+      request_id:
+        normalizeAuthLogValue(req.requestId) ??
+        normalizeAuthLogValue(req.id) ??
+        normalizeAuthLogValue(req.headers?.['x-request-id']) ??
+        normalizeAuthLogValue(req.headers?.['x-correlation-id']),
+      method: normalizeAuthLogValue(req.method),
+      path: getRequestPath(req),
+      token_provider: getSafeTokenProvider(authState.tokenProvider),
+      openid_reuse_enabled: authState.openidReuseEnabled,
+      openid_jwt_available: authState.openidJwtAvailable,
+      has_openid_reuse_user_id: authState.hasOpenIdReuseUserId,
+    });
+  const formatAuthLogMessage = (message, context) => `${message} ${JSON.stringify(context)}`;
   const normalizeContextValue = (value) => {
     const trimmed = value?.trim?.();
     return trimmed || undefined;
@@ -66,6 +213,11 @@ jest.mock('@librechat/api', () => {
     normalizeContextValue(req.headers?.['x-correlation-id']);
   return {
     isEnabled: jest.fn(() => false),
+    recordRumProxyRequest: jest.fn(),
+    getAuthFailureReason,
+    getAuthFailureErrorName,
+    buildSafeAuthLogContext,
+    formatAuthLogMessage,
     maybeRefreshCloudFrontAuthCookiesMiddleware: jest.fn((req, res, next) => next()),
     tenantContextMiddleware: (req, res, next) => {
       const context = {
@@ -84,8 +236,13 @@ jest.mock('@librechat/api', () => {
 // ── Helpers ─────────────────────────────────────────────────────────────
 
 const requireJwtAuth = require('../requireJwtAuth');
-const { getTenantId, getUserId } = require('@librechat/data-schemas');
-const { isEnabled, maybeRefreshCloudFrontAuthCookiesMiddleware } = require('@librechat/api');
+const { requireRumProxyAuth } = requireJwtAuth;
+const { getTenantId, getUserId, logger } = require('@librechat/data-schemas');
+const {
+  isEnabled,
+  maybeRefreshCloudFrontAuthCookiesMiddleware,
+  recordRumProxyRequest,
+} = require('@librechat/api');
 const passport = require('passport');
 
 const jwtSecret = 'test-refresh-secret';
@@ -99,7 +256,11 @@ function signedOpenIdUserCookie(userId = 'user-openid') {
 }
 
 function mockRes() {
-  return { status: jest.fn().mockReturnThis(), json: jest.fn().mockReturnThis() };
+  return {
+    status: jest.fn().mockReturnThis(),
+    json: jest.fn().mockReturnThis(),
+    end: jest.fn().mockReturnThis(),
+  };
 }
 
 /** Runs requireJwtAuth and returns the tenantId observed inside next(). */
@@ -127,6 +288,11 @@ describe('requireJwtAuth tenant context chaining', () => {
     mockRegisteredStrategies = new Set(['jwt']);
     isEnabled.mockReturnValue(false);
     maybeRefreshCloudFrontAuthCookiesMiddleware.mockClear();
+    logger.debug.mockClear();
+    logger.info.mockClear();
+    logger.warn.mockClear();
+    logger.error.mockClear();
+    recordRumProxyRequest.mockClear();
     passport.authenticate.mockClear();
     passport._strategy.mockClear();
     if (originalJwtSecret === undefined) {
@@ -204,6 +370,207 @@ describe('requireJwtAuth tenant context chaining', () => {
     expect(next).not.toHaveBeenCalled();
     expect(res.status).toHaveBeenCalledWith(401);
     expect(getTenantId()).toBeUndefined();
+    expect(logger.debug).toHaveBeenCalledWith(
+      expect.stringContaining('[requireJwtAuth] Authentication failed after all strategies'),
+      expect.objectContaining({
+        primary_strategy: 'jwt',
+        fallback_attempted: false,
+        fallback_succeeded: false,
+        attempted_strategies: ['jwt'],
+        final_strategy: 'jwt',
+        reason: 'Unauthorized',
+        status: 401,
+      }),
+    );
+    expect(logger.warn).not.toHaveBeenCalled();
+  });
+
+  it('logs OpenID JWT expiry when JWT fallback succeeds', () => {
+    isEnabled.mockReturnValue(true);
+    mockRegisteredStrategies.add('openidJwt');
+    const req = mockReq(undefined, {
+      requestId: 'req-expired-success',
+      method: 'GET',
+      path: '/api/messages',
+      headers: {
+        cookie: `token_provider=openid; openid_user_id=${signedOpenIdUserCookie('user-jwt')}`,
+      },
+      _mockStrategies: {
+        openidJwt: {
+          user: false,
+          info: { message: 'jwt expired', name: 'TokenExpiredError' },
+          status: 401,
+        },
+        jwt: { user: { id: 'user-jwt', tenantId: 'tenant-jwt', role: 'user' } },
+      },
+    });
+    const res = mockRes();
+    const next = jest.fn();
+
+    requireJwtAuth(req, res, next);
+
+    expect(next).toHaveBeenCalled();
+    expect(req.authStrategy).toBe('jwt');
+    expect(res.status).not.toHaveBeenCalled();
+    expect(logger.debug).toHaveBeenCalledWith(
+      expect.stringContaining('[requireJwtAuth] OpenID JWT auth failed; trying fallback'),
+      expect.objectContaining({
+        request_id: 'req-expired-success',
+        method: 'GET',
+        path: '/api/messages',
+        token_provider: 'openid',
+        openid_reuse_enabled: true,
+        openid_jwt_available: true,
+        has_openid_reuse_user_id: true,
+        primary_strategy: 'openidJwt',
+        fallback_strategy: 'jwt',
+        fallback_attempted: true,
+        reason: 'jwt expired',
+        error_name: 'TokenExpiredError',
+        status: 401,
+      }),
+    );
+    expect(logger.debug).toHaveBeenCalledWith(
+      expect.stringContaining('[requireJwtAuth] JWT fallback succeeded after OpenID JWT failure'),
+      expect.objectContaining({
+        request_id: 'req-expired-success',
+        auth_strategy: 'jwt',
+        primary_strategy: 'openidJwt',
+        fallback_strategy: 'jwt',
+        fallback_attempted: true,
+        fallback_succeeded: true,
+        primary_failure_reason: 'jwt expired',
+        reason: 'jwt expired',
+        error_name: 'TokenExpiredError',
+      }),
+    );
+    expect(logger.debug.mock.calls[0][0]).toContain('"reason":"jwt expired"');
+    expect(logger.debug.mock.calls[0][0]).toContain('"fallback_attempted":true');
+    expect(logger.debug.mock.calls[1][0]).toContain('"fallback_succeeded":true');
+    expect(logger.warn).not.toHaveBeenCalled();
+  });
+
+  it('does not let malformed Passport info break JWT fallback logging', () => {
+    isEnabled.mockReturnValue(true);
+    mockRegisteredStrategies.add('openidJwt');
+    const info = {};
+    Object.defineProperties(info, {
+      message: {
+        get() {
+          throw new TypeError('message getter failed');
+        },
+      },
+      name: {
+        get() {
+          throw new TypeError('name getter failed');
+        },
+      },
+    });
+    const req = mockReq(undefined, {
+      requestId: 'req-malformed-info',
+      method: 'GET',
+      path: '/api/messages',
+      headers: {
+        cookie: `token_provider=openid; openid_user_id=${signedOpenIdUserCookie('user-jwt')}`,
+      },
+      _mockStrategies: {
+        openidJwt: {
+          user: false,
+          info,
+          status: 401,
+        },
+        jwt: { user: { id: 'user-jwt', tenantId: 'tenant-jwt', role: 'user' } },
+      },
+    });
+    const res = mockRes();
+    const next = jest.fn();
+
+    expect(() => requireJwtAuth(req, res, next)).not.toThrow();
+
+    expect(next).toHaveBeenCalled();
+    expect(req.authStrategy).toBe('jwt');
+    expect(res.status).not.toHaveBeenCalled();
+    expect(logger.debug).toHaveBeenCalledWith(
+      expect.stringContaining('[requireJwtAuth] OpenID JWT auth failed; trying fallback'),
+      expect.objectContaining({
+        request_id: 'req-malformed-info',
+        fallback_attempted: true,
+        reason: 'Unauthorized',
+        status: 401,
+      }),
+    );
+    expect(logger.debug).toHaveBeenCalledWith(
+      expect.stringContaining('[requireJwtAuth] JWT fallback succeeded after OpenID JWT failure'),
+      expect.objectContaining({
+        request_id: 'req-malformed-info',
+        fallback_succeeded: true,
+        primary_failure_reason: 'Unauthorized',
+      }),
+    );
+  });
+
+  it('logs OpenID JWT expiry when JWT fallback fails', () => {
+    isEnabled.mockReturnValue(true);
+    mockRegisteredStrategies.add('openidJwt');
+    const req = mockReq(undefined, {
+      id: 'req-expired-fail',
+      method: 'POST',
+      originalUrl: '/api/ask?access_token=hidden',
+      headers: {
+        cookie: `token_provider=openid; openid_user_id=${signedOpenIdUserCookie('user-jwt')}`,
+      },
+      _mockStrategies: {
+        openidJwt: {
+          user: false,
+          info: { message: 'jwt expired', name: 'TokenExpiredError' },
+          status: 401,
+        },
+        jwt: {
+          user: false,
+          info: { message: 'invalid signature', name: 'JsonWebTokenError' },
+          status: 401,
+        },
+      },
+    });
+    const res = mockRes();
+    const next = jest.fn();
+
+    requireJwtAuth(req, res, next);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(res.status).toHaveBeenCalledWith(401);
+    expect(logger.debug).toHaveBeenCalledWith(
+      expect.stringContaining('[requireJwtAuth] OpenID JWT auth failed; trying fallback'),
+      expect.objectContaining({
+        request_id: 'req-expired-fail',
+        method: 'POST',
+        path: '/api/ask',
+        fallback_attempted: true,
+        reason: 'jwt expired',
+        error_name: 'TokenExpiredError',
+        status: 401,
+      }),
+    );
+    expect(logger.warn).toHaveBeenCalledWith(
+      expect.stringContaining('[requireJwtAuth] Authentication failed after all strategies'),
+      expect.objectContaining({
+        request_id: 'req-expired-fail',
+        method: 'POST',
+        path: '/api/ask',
+        token_provider: 'openid',
+        attempted_strategies: ['openidJwt', 'jwt'],
+        final_strategy: 'jwt',
+        primary_strategy: 'openidJwt',
+        fallback_strategy: 'jwt',
+        fallback_attempted: true,
+        fallback_succeeded: false,
+        reason: 'invalid signature',
+        error_name: 'JsonWebTokenError',
+        status: 401,
+      }),
+    );
+    expect(logger.warn.mock.calls[0][0]).toContain('"reason":"invalid signature"');
+    expect(logger.warn.mock.calls[0][0]).toContain('"path":"/api/ask"');
   });
 
   it('does not fall back to OpenID JWT for bearer-only reuse requests', () => {
@@ -263,6 +630,98 @@ describe('requireJwtAuth tenant context chaining', () => {
     );
   });
 
+  it('logs OpenID user-id mismatch when JWT fallback succeeds', () => {
+    isEnabled.mockReturnValue(true);
+    mockRegisteredStrategies.add('openidJwt');
+    const req = mockReq(undefined, {
+      requestId: 'req-mismatch-success',
+      method: 'GET',
+      path: '/api/auth/me',
+      headers: {
+        cookie: `token_provider=openid; openid_user_id=${signedOpenIdUserCookie('user-a')}`,
+      },
+      _mockStrategies: {
+        openidJwt: { user: { id: 'user-b', tenantId: 'tenant-openid', role: 'user' } },
+        jwt: { user: { id: 'user-a', tenantId: 'tenant-jwt', role: 'user' } },
+      },
+    });
+    const res = mockRes();
+    const next = jest.fn();
+
+    requireJwtAuth(req, res, next);
+
+    expect(next).toHaveBeenCalled();
+    expect(req.authStrategy).toBe('jwt');
+    expect(logger.debug).toHaveBeenCalledWith(
+      expect.stringContaining('[requireJwtAuth] OpenID JWT auth failed; trying fallback'),
+      expect.objectContaining({
+        request_id: 'req-mismatch-success',
+        primary_strategy: 'openidJwt',
+        fallback_strategy: 'jwt',
+        fallback_attempted: true,
+        reason: 'openid user-id mismatch',
+        status: 401,
+      }),
+    );
+    expect(logger.debug).toHaveBeenCalledWith(
+      expect.stringContaining('[requireJwtAuth] JWT fallback succeeded after OpenID JWT failure'),
+      expect.objectContaining({
+        request_id: 'req-mismatch-success',
+        auth_strategy: 'jwt',
+        fallback_attempted: true,
+        fallback_succeeded: true,
+        primary_failure_reason: 'openid user-id mismatch',
+        reason: 'openid user-id mismatch',
+      }),
+    );
+    expect(logger.warn).not.toHaveBeenCalled();
+  });
+
+  it('logs OpenID user-id mismatch when JWT fallback fails', () => {
+    isEnabled.mockReturnValue(true);
+    mockRegisteredStrategies.add('openidJwt');
+    const req = mockReq(undefined, {
+      requestId: 'req-mismatch-fail',
+      method: 'GET',
+      path: '/api/auth/me',
+      headers: {
+        cookie: `token_provider=openid; openid_user_id=${signedOpenIdUserCookie('user-a')}`,
+      },
+      _mockStrategies: {
+        openidJwt: { user: { id: 'user-b', tenantId: 'tenant-openid', role: 'user' } },
+        jwt: { user: false, info: { message: 'Unauthorized' }, status: 401 },
+      },
+    });
+    const res = mockRes();
+    const next = jest.fn();
+
+    requireJwtAuth(req, res, next);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(res.status).toHaveBeenCalledWith(401);
+    expect(logger.debug).toHaveBeenCalledWith(
+      expect.stringContaining('[requireJwtAuth] OpenID JWT auth failed; trying fallback'),
+      expect.objectContaining({
+        request_id: 'req-mismatch-fail',
+        fallback_attempted: true,
+        reason: 'openid user-id mismatch',
+        status: 401,
+      }),
+    );
+    expect(logger.warn).toHaveBeenCalledWith(
+      expect.stringContaining('[requireJwtAuth] Authentication failed after all strategies'),
+      expect.objectContaining({
+        request_id: 'req-mismatch-fail',
+        attempted_strategies: ['openidJwt', 'jwt'],
+        final_strategy: 'jwt',
+        fallback_attempted: true,
+        fallback_succeeded: false,
+        reason: 'Unauthorized',
+        status: 401,
+      }),
+    );
+  });
+
   it('does not authenticate OpenID JWT when the reuse cookie belongs to another user', () => {
     isEnabled.mockReturnValue(true);
     mockRegisteredStrategies.add('openidJwt');
@@ -388,3 +847,141 @@ describe('requireJwtAuth tenant context chaining', () => {
     expect(getTenantId()).toBeUndefined();
   });
 });
+
+describe('requireRumProxyAuth', () => {
+  const originalJwtSecret = process.env.JWT_REFRESH_SECRET;
+
+  beforeEach(() => {
+    process.env.JWT_REFRESH_SECRET = jwtSecret;
+  });
+
+  afterEach(() => {
+    mockPassportError = null;
+    mockRegisteredStrategies = new Set(['jwt']);
+    isEnabled.mockReturnValue(false);
+    maybeRefreshCloudFrontAuthCookiesMiddleware.mockClear();
+    logger.debug.mockClear();
+    logger.info.mockClear();
+    logger.warn.mockClear();
+    logger.error.mockClear();
+    recordRumProxyRequest.mockClear();
+    passport.authenticate.mockClear();
+    passport._strategy.mockClear();
+    if (originalJwtSecret === undefined) {
+      delete process.env.JWT_REFRESH_SECRET;
+    } else {
+      process.env.JWT_REFRESH_SECRET = originalJwtSecret;
+    }
+  });
+
+  it('authenticates telemetry with the LibreChat JWT strategy without tenant or cookie refresh middleware', () => {
+    const req = mockReq({ id: 'user-jwt', tenantId: 'tenant-jwt', role: 'user' });
+    const res = mockRes();
+    const next = jest.fn();
+
+    requireRumProxyAuth(req, res, next);
+
+    expect(passport.authenticate).toHaveBeenCalledWith(
+      'jwt',
+      { session: false },
+      expect.any(Function),
+    );
+    expect(req.authStrategy).toBe('jwt');
+    expect(maybeRefreshCloudFrontAuthCookiesMiddleware).not.toHaveBeenCalled();
+    // Success is recorded by the proxy.
+    expect(recordRumProxyRequest).not.toHaveBeenCalled();
+    expect(res.status).not.toHaveBeenCalled();
+    expect(next).toHaveBeenCalled();
+  });
+
+  it('authenticates telemetry with OpenID JWT reuse when the reuse cookie is present', () => {
+    isEnabled.mockReturnValue(true);
+    mockRegisteredStrategies.add('openidJwt');
+    const req = mockReq(undefined, {
+      headers: { cookie: `token_provider=openid; openid_user_id=${signedOpenIdUserCookie()}` },
+      _mockStrategies: {
+        openidJwt: { user: { id: 'user-openid', tenantId: 'tenant-openid', role: 'user' } },
+        jwt: { user: false, info: { message: 'invalid signature' }, status: 401 },
+      },
+    });
+    const res = mockRes();
+    const next = jest.fn();
+
+    requireRumProxyAuth(req, res, next);
+
+    expect(passport.authenticate).toHaveBeenCalledWith(
+      'openidJwt',
+      { session: false },
+      expect.any(Function),
+    );
+    expect(req.authStrategy).toBe('openidJwt');
+    expect(maybeRefreshCloudFrontAuthCookiesMiddleware).not.toHaveBeenCalled();
+    expect(recordRumProxyRequest).not.toHaveBeenCalled();
+    expect(res.status).not.toHaveBeenCalled();
+    expect(next).toHaveBeenCalled();
+  });
+
+  it('falls back to LibreChat JWT when OpenID JWT telemetry auth fails', () => {
+    isEnabled.mockReturnValue(true);
+    mockRegisteredStrategies.add('openidJwt');
+    const req = mockReq(undefined, {
+      headers: { cookie: `token_provider=openid; openid_user_id=${signedOpenIdUserCookie()}` },
+      _mockStrategies: {
+        openidJwt: {
+          user: false,
+          info: { message: 'jwt expired', name: 'TokenExpiredError' },
+          status: 401,
+        },
+        jwt: { user: { id: 'user-openid', tenantId: 'tenant-jwt', role: 'user' } },
+      },
+    });
+    const res = mockRes();
+    const next = jest.fn();
+
+    requireRumProxyAuth(req, res, next);
+
+    expect(passport.authenticate).toHaveBeenCalledTimes(2);
+    expect(req.authStrategy).toBe('jwt');
+    expect(recordRumProxyRequest).not.toHaveBeenCalled();
+    expect(res.status).not.toHaveBeenCalled();
+    expect(next).toHaveBeenCalled();
+  });
+
+  it('drops invalid telemetry auth with 204 instead of returning an app auth error', () => {
+    const req = mockReq(undefined, {
+      path: '/v1/traces',
+      _mockStrategies: {
+        jwt: {
+          user: false,
+          info: { message: 'invalid signature', name: 'JsonWebTokenError' },
+          status: 401,
+        },
+      },
+    });
+    const res = mockRes();
+    const next = jest.fn();
+
+    requireRumProxyAuth(req, res, next);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(maybeRefreshCloudFrontAuthCookiesMiddleware).not.toHaveBeenCalled();
+    expect(recordRumProxyRequest).toHaveBeenCalledWith('traces', 'auth_drop');
+    expect(res.status).toHaveBeenCalledWith(204);
+    expect(res.end).toHaveBeenCalled();
+  });
+
+  it('records passport errors separately from ordinary telemetry auth drops', () => {
+    mockPassportError = new Error('passport unavailable');
+    const req = mockReq(undefined, { path: '/v1/logs' });
+    const res = mockRes();
+    const next = jest.fn();
+
+    requireRumProxyAuth(req, res, next);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(logger.warn).not.toHaveBeenCalled();
+    expect(recordRumProxyRequest).toHaveBeenCalledWith('logs', 'auth_error');
+    expect(res.status).toHaveBeenCalledWith(204);
+    expect(res.end).toHaveBeenCalled();
+  });
+});
diff --git a/api/server/middleware/abortMiddleware.js b/api/server/middleware/abortMiddleware.js
index e0c5ae0ff09..8b339b05ba4 100644
--- a/api/server/middleware/abortMiddleware.js
+++ b/api/server/middleware/abortMiddleware.js
@@ -7,6 +7,7 @@ const {
   GenerationJobManager,
   recordCollectedUsage,
   sanitizeMessageForTransmit,
+  buildAbortedResponseMetadata,
 } = require('@librechat/api');
 const { truncateText, smartTruncateText } = require('~/app/clients/prompts');
 const clearPendingReq = require('~/cache/clearPendingReq');
@@ -110,6 +111,14 @@ async function abortMessage(req, res) {
     tokenCount: completionTokens,
   };
 
+  /** Persist the usage/cost rollup + context breakdown for the stopped response
+   *  so its branch/total cost and granular rows survive a reload, matching the
+   *  normal completion path. */
+  const abortMetadata = buildAbortedResponseMetadata(jobData);
+  if (abortMetadata) {
+    responseMessage.metadata = abortMetadata;
+  }
+
   // Spend tokens for ALL models from collectedUsage (handles parallel agents/addedConvo)
   if (collectedUsage && collectedUsage.length > 0) {
     await spendCollectedUsage({
diff --git a/api/server/middleware/accessResources/canAccessSkillResource.js b/api/server/middleware/accessResources/canAccessSkillResource.js
index 1010ca89980..d68612df277 100644
--- a/api/server/middleware/accessResources/canAccessSkillResource.js
+++ b/api/server/middleware/accessResources/canAccessSkillResource.js
@@ -1,6 +1,7 @@
-const { ResourceType } = require('librechat-data-provider');
+const { ResourceType, PermissionBits } = require('librechat-data-provider');
 const { canAccessResource } = require('./canAccessResource');
 const { getSkillById } = require('~/models');
+const { getDeploymentSkillById } = require('@librechat/api');
 
 /**
  * Skill-specific middleware factory that checks skill access permissions.
@@ -19,12 +20,35 @@ const canAccessSkillResource = (options) => {
     throw new Error('canAccessSkillResource: requiredPermission is required and must be a number');
   }
 
-  return canAccessResource({
+  const aclMiddleware = canAccessResource({
     resourceType: ResourceType.SKILL,
     requiredPermission,
     resourceIdParam,
     idResolver: getSkillById,
   });
+
+  return (req, res, next) => {
+    const rawResourceId = req.params[resourceIdParam];
+    const deploymentSkill = rawResourceId ? getDeploymentSkillById(rawResourceId) : null;
+    if (!deploymentSkill) {
+      return aclMiddleware(req, res, next);
+    }
+    if (requiredPermission !== PermissionBits.VIEW) {
+      return res.status(403).json({
+        error: 'Forbidden',
+        message: 'Deployment skills are read-only',
+      });
+    }
+    req.resourceAccess = {
+      resourceType: ResourceType.SKILL,
+      resourceId: deploymentSkill._id,
+      customResourceId: rawResourceId,
+      permission: requiredPermission,
+      userId: req.user?.id,
+      resourceInfo: deploymentSkill,
+    };
+    return next();
+  };
 };
 
 module.exports = {
diff --git a/api/server/middleware/buildEndpointOption.js b/api/server/middleware/buildEndpointOption.js
index 1eaa1ef8d92..a762c153eac 100644
--- a/api/server/middleware/buildEndpointOption.js
+++ b/api/server/middleware/buildEndpointOption.js
@@ -60,7 +60,14 @@ async function buildEndpointOption(req, res, next) {
   if (appConfig.modelSpecs?.list?.length && appConfig.modelSpecs?.enforce) {
     /** @type {{ list: TModelSpec[] }}*/
     const { list } = appConfig.modelSpecs;
-    const { spec } = parsedBody;
+    const rawSpec = req.body.spec;
+    const spec = parsedBody.spec ?? (typeof rawSpec === 'string' ? rawSpec : undefined);
+    const rawChatProjectId = req.body.chatProjectId;
+    const parsedBodyForModelSpec =
+      parsedBody.chatProjectId === undefined &&
+      (typeof rawChatProjectId === 'string' || rawChatProjectId === null)
+        ? { ...parsedBody, chatProjectId: rawChatProjectId }
+        : parsedBody;
 
     if (!spec) {
       return handleError(res, { text: 'No model spec selected' });
@@ -78,7 +85,7 @@ async function buildEndpointOption(req, res, next) {
     try {
       const result = applyModelSpecPreset({
         modelSpec: currentModelSpec,
-        parsedBody: currentModelSpec.preset,
+        parsedBody: parsedBodyForModelSpec,
         endpoint,
         endpointType,
         defaultParamsEndpoint,
@@ -132,7 +139,9 @@ async function buildEndpointOption(req, res, next) {
     req.body.endpointOption = await builder(endpoint, parsedBody, endpointType);
 
     if (req.body.files && !isAgents) {
-      req.body.endpointOption.attachments = updateFilesUsage(req.body.files);
+      req.body.endpointOption.attachments = updateFilesUsage(req.body.files, undefined, {
+        user: req.user.id,
+      });
     }
 
     next();
diff --git a/api/server/middleware/buildEndpointOption.spec.js b/api/server/middleware/buildEndpointOption.spec.js
index 9c353b498ab..c4da3a726ed 100644
--- a/api/server/middleware/buildEndpointOption.spec.js
+++ b/api/server/middleware/buildEndpointOption.spec.js
@@ -35,6 +35,7 @@ jest.mock('~/server/services/Endpoints/agents', () => ({
 jest.mock('~/models', () => ({
   updateFilesUsage: jest.fn(),
 }));
+const { updateFilesUsage } = require('~/models');
 
 const mockGetEndpointsConfig = jest.fn();
 jest.mock('~/server/services/Config', () => ({
@@ -188,6 +189,9 @@ describe('buildEndpointOption - defaultParamsEndpoint parsing', () => {
         endpointType: EModelEndpoint.custom,
         spec: 'claude-opus-4.5',
         model: 'anthropic/claude-opus-4.5',
+        temperature: 0.1,
+        topP: 0.2,
+        chatProjectId: 'project-1',
       },
       {
         modelSpecs: {
@@ -196,6 +200,7 @@ describe('buildEndpointOption - defaultParamsEndpoint parsing', () => {
         },
       },
     );
+    req.baseUrl = '/api/agents/chat';
 
     await buildEndpointOption(req, createRes(), jest.fn());
 
@@ -209,7 +214,50 @@ describe('buildEndpointOption - defaultParamsEndpoint parsing', () => {
     const enforcedResult = parseCompactConvo.mock.results[1].value;
     expect(enforcedResult.maxOutputTokens).toBe(8192);
     expect(enforcedResult.temperature).toBe(0.7);
+    expect(enforcedResult.topP).toBeUndefined();
     expect(enforcedResult.maxContextTokens).toBe(50000);
+    expect(enforcedResult.chatProjectId).toBe('project-1');
+    expect(req.body.endpointOption.chatProjectId).toBe('project-1');
+  });
+
+  it('should rebuild enforced custom specs from the backend preset when compact parsing drops raw fields', async () => {
+    mockGetEndpointsConfig.mockResolvedValue({});
+
+    const modelSpec = {
+      name: 'approved-custom',
+      preset: {
+        endpoint: 'Mock Provider A',
+        endpointType: EModelEndpoint.custom,
+        model: 'mock-model-a',
+        promptPrefix: 'Use the approved custom model spec.',
+      },
+    };
+
+    const req = createReq(
+      {
+        endpoint: 'Mock Provider A',
+        endpointType: EModelEndpoint.custom,
+        spec: 'approved-custom',
+        model: { stale: 'cached-client-value' },
+        agent_id: 'agent_from_cached_client_state',
+        chatProjectId: 'project-1',
+      },
+      {
+        modelSpecs: {
+          enforce: true,
+          list: [modelSpec],
+        },
+      },
+    );
+    req.baseUrl = '/api/agents/chat';
+
+    await buildEndpointOption(req, createRes(), jest.fn());
+
+    expect(parseCompactConvo.mock.results[0].value).toEqual({});
+    expect(req.body.endpointOption.spec).toBe('approved-custom');
+    expect(req.body.endpointOption.model).toBe('mock-model-a');
+    expect(req.body.endpointOption.promptPrefix).toBe('Use the approved custom model spec.');
+    expect(req.body.endpointOption.chatProjectId).toBe('project-1');
   });
 
   it('should restore private model spec preset fields in non-enforced mode', async () => {
@@ -417,6 +465,29 @@ describe('buildEndpointOption - defaultParamsEndpoint parsing', () => {
     expect(parsedResult.max_tokens).toBe(4096);
   });
 
+  it('should scope non-agent chat attachment usage updates to the authenticated user', async () => {
+    const attachments = Promise.resolve([]);
+    updateFilesUsage.mockReturnValueOnce(attachments);
+    mockGetEndpointsConfig.mockResolvedValue({});
+
+    const req = createReq(
+      {
+        endpoint: EModelEndpoint.assistants,
+        assistant_id: 'asst_123',
+        files: [{ file_id: 'forged-file-id' }],
+      },
+      { modelSpecs: null },
+    );
+    req.user = { id: 'user-1' };
+
+    await buildEndpointOption(req, createRes(), jest.fn());
+
+    expect(updateFilesUsage).toHaveBeenCalledWith(req.body.files, undefined, {
+      user: 'user-1',
+    });
+    expect(req.body.endpointOption.attachments).toBe(attachments);
+  });
+
   it('should not enter the enforce branch when modelSpecs.list is empty', async () => {
     mockGetEndpointsConfig.mockResolvedValue({});
 
diff --git a/api/server/middleware/canAccessSharedLink.js b/api/server/middleware/canAccessSharedLink.js
new file mode 100644
index 00000000000..79fd93e486c
--- /dev/null
+++ b/api/server/middleware/canAccessSharedLink.js
@@ -0,0 +1,6 @@
+const mongoose = require('mongoose');
+const { createSharedLinkAccessMiddleware } = require('@librechat/api');
+
+const canAccessSharedLink = createSharedLinkAccessMiddleware({ mongoose });
+
+module.exports = canAccessSharedLink;
diff --git a/api/server/middleware/index.js b/api/server/middleware/index.js
index 64b9fb16185..bc523ff166c 100644
--- a/api/server/middleware/index.js
+++ b/api/server/middleware/index.js
@@ -1,4 +1,5 @@
 const validatePasswordReset = require('./validatePasswordReset');
+const setTwoFactorTempUser = require('./setTwoFactorTempUser');
 const validateRegistration = require('./validateRegistration');
 const buildEndpointOption = require('./buildEndpointOption');
 const validateMessageReq = require('./validateMessageReq');
@@ -10,6 +11,7 @@ const requireLdapAuth = require('./requireLdapAuth');
 const abortMiddleware = require('./abortMiddleware');
 const checkInviteUser = require('./checkInviteUser');
 const requireJwtAuth = require('./requireJwtAuth');
+const { requireRumProxyAuth } = require('./requireJwtAuth');
 const configMiddleware = require('./config/app');
 const validateModel = require('./validateModel');
 const moderateText = require('./moderateText');
@@ -36,6 +38,8 @@ module.exports = {
   moderateText,
   validateModel,
   requireJwtAuth,
+  requireRumProxyAuth,
+  setTwoFactorTempUser,
   checkInviteUser,
   requireLdapAuth,
   requireLocalAuth,
diff --git a/api/server/middleware/limiters/index.js b/api/server/middleware/limiters/index.js
index a38188d2a6b..4a569e2698e 100644
--- a/api/server/middleware/limiters/index.js
+++ b/api/server/middleware/limiters/index.js
@@ -11,6 +11,7 @@ const messageLimiters = require('./messageLimiters');
 const promptUsageLimiter = require('./promptUsageLimiter');
 const verifyEmailLimiter = require('./verifyEmailLimiter');
 const resetPasswordLimiter = require('./resetPasswordLimiter');
+const twoFactorTempLimiter = require('./twoFactorTempLimiter');
 
 module.exports = {
   ...uploadLimiters,
@@ -25,4 +26,5 @@ module.exports = {
   createSTTLimiters,
   verifyEmailLimiter,
   resetPasswordLimiter,
+  twoFactorTempLimiter,
 };
diff --git a/api/server/middleware/limiters/twoFactorTempLimiter.js b/api/server/middleware/limiters/twoFactorTempLimiter.js
new file mode 100644
index 00000000000..97d0861af62
--- /dev/null
+++ b/api/server/middleware/limiters/twoFactorTempLimiter.js
@@ -0,0 +1,101 @@
+const jwt = require('jsonwebtoken');
+const { createHash } = require('crypto');
+const rateLimit = require('express-rate-limit');
+const { ViolationTypes } = require('librechat-data-provider');
+const { limiterCache, removePorts } = require('@librechat/api');
+const { logViolation } = require('~/cache');
+
+const {
+  LOGIN_WINDOW = 5,
+  LOGIN_MAX = 7,
+  LOGIN_VIOLATION_SCORE,
+  TWO_FACTOR_TEMP_WINDOW = LOGIN_WINDOW,
+  TWO_FACTOR_TEMP_MAX = LOGIN_MAX,
+  TWO_FACTOR_TEMP_VIOLATION_SCORE,
+} = process.env;
+const windowMs = TWO_FACTOR_TEMP_WINDOW * 60 * 1000;
+const max = TWO_FACTOR_TEMP_MAX;
+const score = TWO_FACTOR_TEMP_VIOLATION_SCORE ?? LOGIN_VIOLATION_SCORE;
+const windowInMinutes = windowMs / 60000;
+const message = `Too many verification attempts, please try again after ${windowInMinutes} minutes.`;
+
+const hashLimiterKey = (value) => createHash('sha256').update(value).digest('hex');
+
+const getUserLimiterKey = (req) => {
+  const userId = req.user?.id ?? req.user?._id;
+  if (userId) {
+    return `user:${userId.toString()}`;
+  }
+
+  const tempToken = req.body?.tempToken;
+  if (typeof tempToken === 'string' && tempToken) {
+    return `temp:${hashLimiterKey(tempToken)}`;
+  }
+
+  const ip = removePorts(req);
+  return ip ? `ip:${ip}` : 'ip:unknown';
+};
+
+const getTempTokenUserId = (tempToken) => {
+  if (!tempToken) {
+    return null;
+  }
+
+  try {
+    const payload = jwt.verify(tempToken, process.env.JWT_SECRET);
+    return payload?.userId ?? null;
+  } catch {
+    return null;
+  }
+};
+
+const createHandler = (limiter) => async (req, res) => {
+  const type = ViolationTypes.LOGINS;
+  const errorMessage = {
+    type,
+    max,
+    limiter,
+    windowInMinutes,
+  };
+
+  const userId = getTempTokenUserId(req.body?.tempToken);
+  if (userId && !req.user) {
+    req.user = { id: userId };
+  } else if (userId && !req.user.id && !req.user._id) {
+    req.user.id = userId;
+  }
+
+  await logViolation(req, res, type, errorMessage, score);
+  return res.status(429).json({ message });
+};
+
+const ipLimiterOptions = {
+  windowMs,
+  max,
+  handler: createHandler('ip'),
+  keyGenerator: removePorts,
+  store: limiterCache('two_factor_temp_limiter'),
+};
+
+const userLimiterOptions = {
+  windowMs,
+  max,
+  handler: createHandler('user'),
+  keyGenerator: getUserLimiterKey,
+  store: limiterCache('two_factor_temp_user_limiter'),
+};
+
+const twoFactorTempIpLimiter = rateLimit(ipLimiterOptions);
+const twoFactorTempUserLimiter = rateLimit(userLimiterOptions);
+
+const twoFactorTempLimiter = (req, res, next) => {
+  twoFactorTempIpLimiter(req, res, (err) => {
+    if (err) {
+      return next(err);
+    }
+
+    return twoFactorTempUserLimiter(req, res, next);
+  });
+};
+
+module.exports = twoFactorTempLimiter;
diff --git a/api/server/middleware/limiters/twoFactorTempLimiter.test.js b/api/server/middleware/limiters/twoFactorTempLimiter.test.js
new file mode 100644
index 00000000000..37b06c7fdb6
--- /dev/null
+++ b/api/server/middleware/limiters/twoFactorTempLimiter.test.js
@@ -0,0 +1,111 @@
+const jwt = require('jsonwebtoken');
+const express = require('express');
+const request = require('supertest');
+
+const originalEnv = process.env;
+const jwtSecret = 'test-two-factor-secret';
+
+const createToken = (userId) =>
+  jwt.sign({ userId, twoFAPending: true }, jwtSecret, { expiresIn: '5m' });
+
+const createApp = () => {
+  jest.resetModules();
+  process.env = {
+    ...originalEnv,
+    JWT_SECRET: jwtSecret,
+    LOGIN_MAX: '2',
+    LOGIN_WINDOW: '5',
+    TWO_FACTOR_TEMP_MAX: '2',
+    TWO_FACTOR_TEMP_WINDOW: '5',
+  };
+
+  jest.doMock('@librechat/api', () => ({
+    limiterCache: jest.fn(() => undefined),
+    removePorts: (req) => req?.['ip'],
+  }));
+  jest.doMock('~/cache', () => ({
+    logViolation: jest.fn().mockResolvedValue(undefined),
+  }));
+
+  const setTwoFactorTempUser = require('../setTwoFactorTempUser');
+  const twoFactorTempLimiter = require('./twoFactorTempLimiter');
+  const { logViolation } = require('~/cache');
+
+  const app = express();
+  app.set('trust proxy', 1);
+  app.use(express.json());
+  app.post('/verify', setTwoFactorTempUser, twoFactorTempLimiter, (req, res) =>
+    res.status(204).end(),
+  );
+
+  return { app, logViolation };
+};
+
+describe('twoFactorTempLimiter', () => {
+  afterEach(() => {
+    jest.dontMock('@librechat/api');
+    jest.dontMock('~/cache');
+    process.env = originalEnv;
+  });
+
+  it('limits a valid temp-token user across rotating source IPs', async () => {
+    const { app, logViolation } = createApp();
+    const tempToken = createToken('user-1');
+
+    await request(app)
+      .post('/verify')
+      .set('X-Forwarded-For', '203.0.113.1')
+      .send({ tempToken, token: '000000' })
+      .expect(204);
+    await request(app)
+      .post('/verify')
+      .set('X-Forwarded-For', '203.0.113.2')
+      .send({ tempToken, token: '000001' })
+      .expect(204);
+
+    const response = await request(app)
+      .post('/verify')
+      .set('X-Forwarded-For', '203.0.113.3')
+      .send({ tempToken, token: '000002' })
+      .expect(429);
+
+    expect(response.body).toEqual({
+      message: 'Too many verification attempts, please try again after 5 minutes.',
+    });
+    expect(logViolation).toHaveBeenCalledTimes(1);
+    expect(logViolation.mock.calls[0][0].user).toEqual({ id: 'user-1' });
+    expect(logViolation.mock.calls[0][3]).toMatchObject({
+      limiter: 'user',
+      max: '2',
+      windowInMinutes: 5,
+    });
+  });
+
+  it('keeps the existing source IP limit before the user limit', async () => {
+    const { app, logViolation } = createApp();
+
+    await request(app)
+      .post('/verify')
+      .set('X-Forwarded-For', '198.51.100.1')
+      .send({ tempToken: createToken('user-a'), token: '000000' })
+      .expect(204);
+    await request(app)
+      .post('/verify')
+      .set('X-Forwarded-For', '198.51.100.1')
+      .send({ tempToken: createToken('user-b'), token: '000001' })
+      .expect(204);
+
+    await request(app)
+      .post('/verify')
+      .set('X-Forwarded-For', '198.51.100.1')
+      .send({ tempToken: createToken('user-c'), token: '000002' })
+      .expect(429);
+
+    expect(logViolation).toHaveBeenCalledTimes(1);
+    expect(logViolation.mock.calls[0][3]).toMatchObject({
+      limiter: 'ip',
+      max: '2',
+      windowInMinutes: 5,
+    });
+  });
+});
diff --git a/api/server/middleware/requireJwtAuth.js b/api/server/middleware/requireJwtAuth.js
index 935957e913d..9c4d1ca47c9 100644
--- a/api/server/middleware/requireJwtAuth.js
+++ b/api/server/middleware/requireJwtAuth.js
@@ -1,10 +1,16 @@
 const cookies = require('cookie');
 const jwt = require('jsonwebtoken');
 const passport = require('passport');
+const { logger } = require('@librechat/data-schemas');
 const {
   isEnabled,
   tenantContextMiddleware,
+  getAuthFailureReason,
+  getAuthFailureErrorName,
+  buildSafeAuthLogContext,
+  formatAuthLogMessage,
   maybeRefreshCloudFrontAuthCookiesMiddleware,
+  recordRumProxyRequest,
 } = require('@librechat/api');
 
 const hasPassportStrategy = (strategy) =>
@@ -30,6 +36,45 @@ const getAuthenticatedUserId = (user) => user?.id?.toString?.() ?? user?._id?.to
 const refreshCloudFrontCookies =
   maybeRefreshCloudFrontAuthCookiesMiddleware ?? ((_req, _res, next) => next());
 
+const getAuthStrategies = (req) => {
+  const cookieHeader = req.headers.cookie;
+  const parsedCookies = cookieHeader ? cookies.parse(cookieHeader) : {};
+  const tokenProvider = parsedCookies.token_provider;
+  const openidReuseEnabled = isEnabled(process.env.OPENID_REUSE_TOKENS);
+  const openidJwtAvailable = openidReuseEnabled && hasPassportStrategy('openidJwt');
+  const openIdReuseUserId = getValidOpenIdReuseUserId(parsedCookies);
+  const useOpenIdJwt =
+    tokenProvider === 'openid' && openidJwtAvailable && openIdReuseUserId != null;
+
+  return {
+    tokenProvider,
+    openidReuseEnabled,
+    openidJwtAvailable,
+    openIdReuseUserId,
+    strategies: useOpenIdJwt ? ['openidJwt', 'jwt'] : ['jwt'],
+  };
+};
+
+const dropRumTelemetry = (res) => {
+  if (!res.headersSent) {
+    res.status(204).end();
+  }
+};
+
+// Keep in sync with packages/api/src/rum/proxy.ts; auth drops are recorded before proxy code runs.
+const getRumProxyEndpoint = (req) => {
+  if (req.path === '/v1/traces') {
+    return 'traces';
+  }
+  if (req.path === '/v1/logs') {
+    return 'logs';
+  }
+  return 'unknown';
+};
+
+const isOpenIdReuseUser = (strategy, user, openIdReuseUserId) =>
+  strategy !== 'openidJwt' || getAuthenticatedUserId(user) === openIdReuseUserId;
+
 /**
  * Custom Middleware to handle JWT authentication, with support for OpenID token reuse.
  * Switches between JWT and OpenID authentication based on cookies and environment settings.
@@ -39,15 +84,68 @@ const refreshCloudFrontCookies =
  * for downstream Mongoose tenant isolation and structured logging.
  */
 const requireJwtAuth = (req, res, next) => {
-  const cookieHeader = req.headers.cookie;
-  const parsedCookies = cookieHeader ? cookies.parse(cookieHeader) : {};
-  const tokenProvider = parsedCookies.token_provider;
-  const openidReuseEnabled = isEnabled(process.env.OPENID_REUSE_TOKENS);
-  const openidJwtAvailable = openidReuseEnabled && hasPassportStrategy('openidJwt');
-  const openIdReuseUserId = getValidOpenIdReuseUserId(parsedCookies);
-  const useOpenIdJwt =
-    tokenProvider === 'openid' && openidJwtAvailable && openIdReuseUserId != null;
-  const strategies = useOpenIdJwt ? ['openidJwt', 'jwt'] : ['jwt'];
+  const { tokenProvider, openidReuseEnabled, openidJwtAvailable, openIdReuseUserId, strategies } =
+    getAuthStrategies(req);
+  const authLogState = {
+    tokenProvider,
+    openidReuseEnabled,
+    openidJwtAvailable,
+    hasOpenIdReuseUserId: openIdReuseUserId != null,
+  };
+  let primaryFailureReason;
+  let primaryFailureErrorName;
+  let fallbackAttempted = false;
+
+  const logOpenIdFallbackAttempt = ({ fallbackStrategy, reason, errorName, status }) => {
+    primaryFailureReason = reason;
+    primaryFailureErrorName = errorName;
+    fallbackAttempted = true;
+    const message = '[requireJwtAuth] OpenID JWT auth failed; trying fallback';
+    const context = buildSafeAuthLogContext(req, authLogState, {
+      primary_strategy: 'openidJwt',
+      fallback_strategy: fallbackStrategy,
+      fallback_attempted: true,
+      reason,
+      error_name: errorName,
+      status,
+    });
+    logger.debug(formatAuthLogMessage(message, context), context);
+  };
+
+  const logAuthenticationFailure = ({ strategy, info, status, err }) => {
+    const message = '[requireJwtAuth] Authentication failed after all strategies';
+    const context = buildSafeAuthLogContext(req, authLogState, {
+      primary_strategy: strategies[0],
+      fallback_strategy: strategies[1],
+      fallback_attempted: fallbackAttempted,
+      fallback_succeeded: false,
+      attempted_strategies: strategies,
+      final_strategy: strategy,
+      reason: getAuthFailureReason(err, info),
+      error_name: getAuthFailureErrorName(err, info),
+      status: status || 401,
+    });
+    const log = fallbackAttempted ? logger.warn : logger.debug;
+    log.call(logger, formatAuthLogMessage(message, context), context);
+  };
+
+  const logFallbackSuccess = (strategy) => {
+    if (!fallbackAttempted || strategy !== 'jwt') {
+      return;
+    }
+    const message = '[requireJwtAuth] JWT fallback succeeded after OpenID JWT failure';
+    const context = buildSafeAuthLogContext(req, authLogState, {
+      auth_strategy: 'jwt',
+      primary_strategy: 'openidJwt',
+      fallback_strategy: 'jwt',
+      fallback_attempted: true,
+      fallback_succeeded: true,
+      primary_failure_reason: primaryFailureReason,
+      reason: primaryFailureReason,
+      error_name: primaryFailureErrorName,
+    });
+    logger.debug(formatAuthLogMessage(message, context), context);
+  };
 
   const authenticateWithStrategy = (index) => {
     const strategy = strategies[index];
@@ -57,20 +155,34 @@ const requireJwtAuth = (req, res, next) => {
       }
       if (!user) {
         if (index + 1 < strategies.length) {
+          logOpenIdFallbackAttempt({
+            fallbackStrategy: strategies[index + 1],
+            reason: getAuthFailureReason(err, info),
+            errorName: getAuthFailureErrorName(err, info),
+            status: status || 401,
+          });
           return authenticateWithStrategy(index + 1);
         }
+        logAuthenticationFailure({ strategy, info, status, err });
         return res.status(status || 401).json({
           message: info?.message || 'Unauthorized',
         });
       }
       if (strategy === 'openidJwt' && getAuthenticatedUserId(user) !== openIdReuseUserId) {
         if (index + 1 < strategies.length) {
+          logOpenIdFallbackAttempt({
+            fallbackStrategy: strategies[index + 1],
+            reason: 'openid user-id mismatch',
+            status: 401,
+          });
           return authenticateWithStrategy(index + 1);
         }
+        logAuthenticationFailure({ strategy, info, status: 401, err });
         return res.status(401).json({ message: 'Unauthorized' });
       }
       req.user = user;
       req.authStrategy = strategy;
+      logFallbackSuccess(strategy);
       tenantContextMiddleware(req, res, (tenantErr) => {
         if (tenantErr) {
           return next(tenantErr);
@@ -83,4 +195,45 @@ const requireJwtAuth = (req, res, next) => {
   authenticateWithStrategy(0);
 };
 
+const requireRumProxyAuth = (req, res, next) => {
+  const { openIdReuseUserId, strategies } = getAuthStrategies(req);
+  const endpoint = getRumProxyEndpoint(req);
+  let authErrorSeen = false;
+
+  const dropTelemetry = () => {
+    recordRumProxyRequest(endpoint, authErrorSeen ? 'auth_error' : 'auth_drop');
+    dropRumTelemetry(res);
+  };
+
+  const finishAuthentication = (strategy, user) => {
+    req.user = user;
+    req.authStrategy = strategy;
+    next();
+  };
+
+  let nextStrategyIndex = 0;
+  const tryNextStrategy = () => {
+    const strategy = strategies[nextStrategyIndex];
+    nextStrategyIndex += 1;
+
+    if (!strategy) {
+      dropTelemetry();
+      return;
+    }
+
+    passport.authenticate(strategy, { session: false }, (err, user) => {
+      authErrorSeen = authErrorSeen || err != null;
+      if (err || !user || !isOpenIdReuseUser(strategy, user, openIdReuseUserId)) {
+        tryNextStrategy();
+        return;
+      }
+
+      finishAuthentication(strategy, user);
+    })(req, res, next);
+  };
+
+  tryNextStrategy();
+};
+
 module.exports = requireJwtAuth;
+module.exports.requireRumProxyAuth = requireRumProxyAuth;
diff --git a/api/server/middleware/setTwoFactorTempUser.js b/api/server/middleware/setTwoFactorTempUser.js
new file mode 100644
index 00000000000..facbbcba9a2
--- /dev/null
+++ b/api/server/middleware/setTwoFactorTempUser.js
@@ -0,0 +1,25 @@
+const jwt = require('jsonwebtoken');
+
+const setTwoFactorTempUser = (req, _res, next) => {
+  if (req.user?.id || req.user?._id) {
+    return next();
+  }
+
+  const { tempToken } = req.body ?? {};
+  if (!tempToken) {
+    return next();
+  }
+
+  try {
+    const payload = jwt.verify(tempToken, process.env.JWT_SECRET);
+    if (payload?.userId) {
+      req.user = { id: payload.userId };
+    }
+  } catch {
+    return next();
+  }
+
+  return next();
+};
+
+module.exports = setTwoFactorTempUser;
diff --git a/api/server/routes/__test-utils__/convos-route-mocks.js b/api/server/routes/__test-utils__/convos-route-mocks.js
index a3718addff0..a0eb6fe3128 100644
--- a/api/server/routes/__test-utils__/convos-route-mocks.js
+++ b/api/server/routes/__test-utils__/convos-route-mocks.js
@@ -12,6 +12,8 @@ module.exports = {
     })),
     logAxiosError: jest.fn(),
     restoreTenantContextFromReq: jest.fn((req, res, next) => next()),
+    deleteConvoSharedLinksWithCleanup: jest.fn(),
+    deleteAllSharedLinksWithCleanup: jest.fn(),
     ...overrides,
   }),
 
diff --git a/api/server/routes/__tests__/config.spec.js b/api/server/routes/__tests__/config.spec.js
index 606b4ae8a1a..e0fc200486a 100644
--- a/api/server/routes/__tests__/config.spec.js
+++ b/api/server/routes/__tests__/config.spec.js
@@ -327,6 +327,7 @@ describe('GET /api/config', () => {
             {
               name: 'guarded-spec',
               label: 'Guarded Spec',
+              skills: ['private-skill'],
               preset: {
                 endpoint: 'openAI',
                 model: 'gpt-4o',
@@ -352,6 +353,7 @@ describe('GET /api/config', () => {
         model: 'gpt-4o',
         greeting: 'Hello',
       });
+      expect(response.body.modelSpecs.list[0]).not.toHaveProperty('skills');
     });
 
     it('should include full interface config', async () => {
diff --git a/api/server/routes/__tests__/convos.spec.js b/api/server/routes/__tests__/convos.spec.js
index 23978f28e9b..2f766694606 100644
--- a/api/server/routes/__tests__/convos.spec.js
+++ b/api/server/routes/__tests__/convos.spec.js
@@ -21,13 +21,11 @@ jest.mock('~/server/services/Endpoints/assistants', () => require(MOCKS).assista
 describe('Convos Routes', () => {
   let app;
   let convosRouter;
+  const { deleteToolCalls, deleteConvos, saveConvo } = require('~/models');
   const {
-    deleteAllSharedLinks,
-    deleteConvoSharedLink,
-    deleteToolCalls,
-    deleteConvos,
-    saveConvo,
-  } = require('~/models');
+    deleteAllSharedLinksWithCleanup,
+    deleteConvoSharedLinksWithCleanup,
+  } = require('@librechat/api');
 
   beforeAll(() => {
     convosRouter = require('../convos');
@@ -57,7 +55,7 @@ describe('Convos Routes', () => {
 
       deleteConvos.mockResolvedValue(mockDbResponse);
       deleteToolCalls.mockResolvedValue({ deletedCount: 10 });
-      deleteAllSharedLinks.mockResolvedValue({
+      deleteAllSharedLinksWithCleanup.mockResolvedValue({
         message: 'All shared links deleted successfully',
         deletedCount: 3,
       });
@@ -75,12 +73,12 @@ describe('Convos Routes', () => {
       expect(deleteToolCalls).toHaveBeenCalledWith('test-user-123');
       expect(deleteToolCalls).toHaveBeenCalledTimes(1);
 
-      /** Verify deleteAllSharedLinks was called with correct userId */
-      expect(deleteAllSharedLinks).toHaveBeenCalledWith('test-user-123');
-      expect(deleteAllSharedLinks).toHaveBeenCalledTimes(1);
+      /** Verify deleteAllSharedLinksWithCleanup was called with correct userId */
+      expect(deleteAllSharedLinksWithCleanup).toHaveBeenCalledWith('test-user-123');
+      expect(deleteAllSharedLinksWithCleanup).toHaveBeenCalledTimes(1);
     });
 
-    it('should call deleteAllSharedLinks even when no conversations exist', async () => {
+    it('should call deleteAllSharedLinksWithCleanup even when no conversations exist', async () => {
       const mockDbResponse = {
         deletedCount: 0,
         message: 'No conversations to delete',
@@ -88,7 +86,7 @@ describe('Convos Routes', () => {
 
       deleteConvos.mockResolvedValue(mockDbResponse);
       deleteToolCalls.mockResolvedValue({ deletedCount: 0 });
-      deleteAllSharedLinks.mockResolvedValue({
+      deleteAllSharedLinksWithCleanup.mockResolvedValue({
         message: 'All shared links deleted successfully',
         deletedCount: 0,
       });
@@ -96,7 +94,7 @@ describe('Convos Routes', () => {
       const response = await request(app).delete('/api/convos/all');
 
       expect(response.status).toBe(201);
-      expect(deleteAllSharedLinks).toHaveBeenCalledWith('test-user-123');
+      expect(deleteAllSharedLinksWithCleanup).toHaveBeenCalledWith('test-user-123');
     });
 
     it('should return 500 if deleteConvos fails', async () => {
@@ -123,10 +121,10 @@ describe('Convos Routes', () => {
       expect(response.text).toBe('Error clearing conversations');
     });
 
-    it('should return 500 if deleteAllSharedLinks fails', async () => {
+    it('should return 500 if deleteAllSharedLinksWithCleanup fails', async () => {
       deleteConvos.mockResolvedValue({ deletedCount: 5 });
       deleteToolCalls.mockResolvedValue({ deletedCount: 10 });
-      deleteAllSharedLinks.mockRejectedValue(new Error('Shared links deletion failed'));
+      deleteAllSharedLinksWithCleanup.mockRejectedValue(new Error('Shared links deletion failed'));
 
       const response = await request(app).delete('/api/convos/all');
 
@@ -138,12 +136,12 @@ describe('Convos Routes', () => {
       /** First user */
       deleteConvos.mockResolvedValue({ deletedCount: 3 });
       deleteToolCalls.mockResolvedValue({ deletedCount: 5 });
-      deleteAllSharedLinks.mockResolvedValue({ deletedCount: 2 });
+      deleteAllSharedLinksWithCleanup.mockResolvedValue({ deletedCount: 2 });
 
       let response = await request(app).delete('/api/convos/all');
 
       expect(response.status).toBe(201);
-      expect(deleteAllSharedLinks).toHaveBeenCalledWith('test-user-123');
+      expect(deleteAllSharedLinksWithCleanup).toHaveBeenCalledWith('test-user-123');
 
       jest.clearAllMocks();
 
@@ -158,12 +156,12 @@ describe('Convos Routes', () => {
 
       deleteConvos.mockResolvedValue({ deletedCount: 7 });
       deleteToolCalls.mockResolvedValue({ deletedCount: 12 });
-      deleteAllSharedLinks.mockResolvedValue({ deletedCount: 4 });
+      deleteAllSharedLinksWithCleanup.mockResolvedValue({ deletedCount: 4 });
 
       response = await request(app2).delete('/api/convos/all');
 
       expect(response.status).toBe(201);
-      expect(deleteAllSharedLinks).toHaveBeenCalledWith('test-user-456');
+      expect(deleteAllSharedLinksWithCleanup).toHaveBeenCalledWith('test-user-456');
     });
 
     it('should execute deletions in correct sequence', async () => {
@@ -179,15 +177,19 @@ describe('Convos Routes', () => {
         return Promise.resolve({ deletedCount: 10 });
       });
 
-      deleteAllSharedLinks.mockImplementation(() => {
-        executionOrder.push('deleteAllSharedLinks');
+      deleteAllSharedLinksWithCleanup.mockImplementation(() => {
+        executionOrder.push('deleteAllSharedLinksWithCleanup');
         return Promise.resolve({ deletedCount: 3 });
       });
 
       await request(app).delete('/api/convos/all');
 
       /** Verify all three functions were called */
-      expect(executionOrder).toEqual(['deleteConvos', 'deleteToolCalls', 'deleteAllSharedLinks']);
+      expect(executionOrder).toEqual([
+        'deleteConvos',
+        'deleteToolCalls',
+        'deleteAllSharedLinksWithCleanup',
+      ]);
     });
 
     it('should maintain data integrity by cleaning up shared links when conversations are deleted', async () => {
@@ -201,17 +203,17 @@ describe('Convos Routes', () => {
 
       deleteConvos.mockResolvedValue(mockConvosDeleted);
       deleteToolCalls.mockResolvedValue(mockToolCallsDeleted);
-      deleteAllSharedLinks.mockResolvedValue(mockSharedLinksDeleted);
+      deleteAllSharedLinksWithCleanup.mockResolvedValue(mockSharedLinksDeleted);
 
       const response = await request(app).delete('/api/convos/all');
 
       expect(response.status).toBe(201);
 
       /** Verify that shared links cleanup was called for the same user */
-      expect(deleteAllSharedLinks).toHaveBeenCalledWith('test-user-123');
+      expect(deleteAllSharedLinksWithCleanup).toHaveBeenCalledWith('test-user-123');
 
       /** Verify no shared links remain for deleted conversations */
-      expect(deleteAllSharedLinks).toHaveBeenCalledAfter(deleteConvos);
+      expect(deleteAllSharedLinksWithCleanup).toHaveBeenCalledAfter(deleteConvos);
     });
   });
 
@@ -225,7 +227,7 @@ describe('Convos Routes', () => {
 
       deleteConvos.mockResolvedValue(mockDbResponse);
       deleteToolCalls.mockResolvedValue({ deletedCount: 3 });
-      deleteConvoSharedLink.mockResolvedValue({
+      deleteConvoSharedLinksWithCleanup.mockResolvedValue({
         message: 'Shared links deleted successfully',
         deletedCount: 1,
       });
@@ -249,11 +251,14 @@ describe('Convos Routes', () => {
       /** Verify deleteToolCalls was called */
       expect(deleteToolCalls).toHaveBeenCalledWith('test-user-123', mockConversationId);
 
-      /** Verify deleteConvoSharedLink was called */
-      expect(deleteConvoSharedLink).toHaveBeenCalledWith('test-user-123', mockConversationId);
+      /** Verify deleteConvoSharedLinksWithCleanup was called */
+      expect(deleteConvoSharedLinksWithCleanup).toHaveBeenCalledWith(
+        'test-user-123',
+        mockConversationId,
+      );
     });
 
-    it('should not call deleteConvoSharedLink when no conversationId provided', async () => {
+    it('should not call deleteConvoSharedLinksWithCleanup when no conversationId provided', async () => {
       deleteConvos.mockResolvedValue({ deletedCount: 0 });
       deleteToolCalls.mockResolvedValue({ deletedCount: 0 });
 
@@ -266,7 +271,7 @@ describe('Convos Routes', () => {
         });
 
       expect(response.status).toBe(200);
-      expect(deleteConvoSharedLink).not.toHaveBeenCalled();
+      expect(deleteConvoSharedLinksWithCleanup).not.toHaveBeenCalled();
     });
 
     it('should handle deletion of conversation without shared links', async () => {
@@ -274,7 +279,7 @@ describe('Convos Routes', () => {
 
       deleteConvos.mockResolvedValue({ deletedCount: 1 });
       deleteToolCalls.mockResolvedValue({ deletedCount: 0 });
-      deleteConvoSharedLink.mockResolvedValue({
+      deleteConvoSharedLinksWithCleanup.mockResolvedValue({
         message: 'Shared links deleted successfully',
         deletedCount: 0,
       });
@@ -288,7 +293,10 @@ describe('Convos Routes', () => {
         });
 
       expect(response.status).toBe(201);
-      expect(deleteConvoSharedLink).toHaveBeenCalledWith('test-user-123', mockConversationId);
+      expect(deleteConvoSharedLinksWithCleanup).toHaveBeenCalledWith(
+        'test-user-123',
+        mockConversationId,
+      );
     });
 
     it('should return 400 when no parameters provided', async () => {
@@ -299,7 +307,7 @@ describe('Convos Routes', () => {
       expect(response.status).toBe(400);
       expect(response.body).toEqual({ error: 'no parameters provided' });
       expect(deleteConvos).not.toHaveBeenCalled();
-      expect(deleteConvoSharedLink).not.toHaveBeenCalled();
+      expect(deleteConvoSharedLinksWithCleanup).not.toHaveBeenCalled();
     });
 
     it('should return 400 when request body is empty (DoS prevention)', async () => {
@@ -336,12 +344,14 @@ describe('Convos Routes', () => {
       expect(deleteConvos).not.toHaveBeenCalled();
     });
 
-    it('should return 500 if deleteConvoSharedLink fails', async () => {
+    it('should return 500 if deleteConvoSharedLinksWithCleanup fails', async () => {
       const mockConversationId = 'conv-error';
 
       deleteConvos.mockResolvedValue({ deletedCount: 1 });
       deleteToolCalls.mockResolvedValue({ deletedCount: 2 });
-      deleteConvoSharedLink.mockRejectedValue(new Error('Failed to delete shared links'));
+      deleteConvoSharedLinksWithCleanup.mockRejectedValue(
+        new Error('Failed to delete shared links'),
+      );
 
       const response = await request(app)
         .delete('/api/convos')
@@ -369,8 +379,8 @@ describe('Convos Routes', () => {
         return Promise.resolve({ deletedCount: 2 });
       });
 
-      deleteConvoSharedLink.mockImplementation(() => {
-        executionOrder.push('deleteConvoSharedLink');
+      deleteConvoSharedLinksWithCleanup.mockImplementation(() => {
+        executionOrder.push('deleteConvoSharedLinksWithCleanup');
         return Promise.resolve({ deletedCount: 1 });
       });
 
@@ -382,7 +392,11 @@ describe('Convos Routes', () => {
           },
         });
 
-      expect(executionOrder).toEqual(['deleteConvos', 'deleteToolCalls', 'deleteConvoSharedLink']);
+      expect(executionOrder).toEqual([
+        'deleteConvos',
+        'deleteToolCalls',
+        'deleteConvoSharedLinksWithCleanup',
+      ]);
     });
 
     it('should prevent orphaned shared links when deleting single conversation', async () => {
@@ -390,7 +404,7 @@ describe('Convos Routes', () => {
 
       deleteConvos.mockResolvedValue({ deletedCount: 1 });
       deleteToolCalls.mockResolvedValue({ deletedCount: 4 });
-      deleteConvoSharedLink.mockResolvedValue({
+      deleteConvoSharedLinksWithCleanup.mockResolvedValue({
         message: 'Shared links deleted successfully',
         deletedCount: 2,
       });
@@ -406,10 +420,13 @@ describe('Convos Routes', () => {
       expect(response.status).toBe(201);
 
       /** Verify shared links were deleted for the specific conversation */
-      expect(deleteConvoSharedLink).toHaveBeenCalledWith('test-user-123', mockConversationId);
+      expect(deleteConvoSharedLinksWithCleanup).toHaveBeenCalledWith(
+        'test-user-123',
+        mockConversationId,
+      );
 
       /** Verify it was called after the conversation was deleted */
-      expect(deleteConvoSharedLink).toHaveBeenCalledAfter(deleteConvos);
+      expect(deleteConvoSharedLinksWithCleanup).toHaveBeenCalledAfter(deleteConvos);
     });
   });
 
diff --git a/api/server/routes/__tests__/mcp.spec.js b/api/server/routes/__tests__/mcp.spec.js
index 96e8ff9d9e6..5323fa0d0e7 100644
--- a/api/server/routes/__tests__/mcp.spec.js
+++ b/api/server/routes/__tests__/mcp.spec.js
@@ -3,7 +3,7 @@ const express = require('express');
 const request = require('supertest');
 const mongoose = require('mongoose');
 const cookieParser = require('cookie-parser');
-const { getBasePath } = require('@librechat/api');
+const { getBasePath, PENDING_STALE_MS } = require('@librechat/api');
 const { MongoMemoryServer } = require('mongodb-memory-server');
 
 function generateTestCsrfToken(flowId) {
@@ -24,6 +24,11 @@ const mockRegistryInstance = {
   removeServer: jest.fn(),
   getAllowedDomains: jest.fn().mockReturnValue(null),
   getAllowedAddresses: jest.fn().mockReturnValue(null),
+  resolveAllowlists: jest.fn().mockResolvedValue({
+    allowedDomains: null,
+    allowedAddresses: null,
+    useSSRFProtection: true,
+  }),
 };
 let mockMCPUseAllowed = true;
 
@@ -36,6 +41,16 @@ jest.mock('@librechat/api', () => {
       getFlowState: jest.fn(),
       completeOAuthFlow: jest.fn(),
       generateFlowId: jest.fn(),
+      generateTokenFlowId: jest.fn(),
+      parseFlowId: jest.fn(),
+      buildStoredClientMetadata: jest.fn((metadata, resourceMetadata) =>
+        metadata
+          ? {
+              ...metadata,
+              ...(resourceMetadata?.resource && { resource: resourceMetadata.resource }),
+            }
+          : undefined,
+      ),
       resolveStateToFlowId: jest.fn(async (state) => state),
       storeStateMapping: jest.fn(),
       deleteStateMapping: jest.fn(),
@@ -186,6 +201,51 @@ describe('MCP Routes', () => {
     currentUser = undefined;
     mockResolveAllMcpConfigs.mockResolvedValue({});
     mockResolveMcpConfigNames.mockResolvedValue([]);
+    const { MCPOAuthHandler } = require('@librechat/api');
+    const { getTenantId } = require('@librechat/data-schemas');
+    getTenantId.mockReturnValue(undefined);
+    MCPOAuthHandler.generateFlowId.mockImplementation((userId, serverName, tenantId) => {
+      const flowId = `${userId}:${serverName}`;
+      return tenantId ? `tenant:${encodeURIComponent(tenantId)}:${flowId}` : flowId;
+    });
+    MCPOAuthHandler.generateTokenFlowId.mockImplementation((userId, serverName, tenantId) => {
+      const flowId = `${userId}:${serverName}`;
+      return tenantId ? `tenant:${encodeURIComponent(tenantId)}:${flowId}` : flowId;
+    });
+    MCPOAuthHandler.parseFlowId.mockImplementation((flowId) => {
+      const parts = flowId.split(':');
+      if (parts[0] === 'tenant') {
+        if (parts.length < 4 || !parts[1] || !parts[2]) {
+          return null;
+        }
+        let tenantId;
+        try {
+          tenantId = decodeURIComponent(parts[1]);
+        } catch {
+          return null;
+        }
+        return {
+          tenantId,
+          userId: parts[2],
+          serverName: parts.slice(3).join(':'),
+        };
+      }
+      if (parts.length < 2 || !parts[0]) {
+        return null;
+      }
+      return {
+        userId: parts[0],
+        serverName: parts.slice(1).join(':'),
+      };
+    });
+    MCPOAuthHandler.buildStoredClientMetadata.mockImplementation((metadata, resourceMetadata) =>
+      metadata
+        ? {
+            ...metadata,
+            ...(resourceMetadata?.resource && { resource: resourceMetadata.resource }),
+          }
+        : undefined,
+    );
     mockMCPUseAllowed = true;
     /**
      * Reset registry method implementations every test. `clearAllMocks` resets
@@ -203,11 +263,117 @@ describe('MCP Routes', () => {
     const { MCPOAuthHandler } = require('@librechat/api');
     const { getLogStores } = require('~/cache');
 
-    it('should initiate OAuth flow successfully', async () => {
+    it('should reuse stored authorization URL without starting a new OAuth flow', async () => {
+      const mockFlowManager = {
+        getFlowState: jest.fn().mockResolvedValue({
+          status: 'PENDING',
+          createdAt: Date.now(),
+          metadata: {
+            serverName: 'test-server',
+            userId: 'test-user-id',
+            authorizationUrl: 'https://oauth.example.com/auth?state=stored-state',
+          },
+        }),
+      };
+
+      getLogStores.mockReturnValue({});
+      require('~/config').getFlowStateManager.mockReturnValue(mockFlowManager);
+
+      const response = await request(app).get('/api/mcp/test-server/oauth/initiate').query({
+        userId: 'test-user-id',
+        flowId: 'test-user-id:test-server',
+      });
+
+      expect(response.status).toBe(302);
+      expect(response.headers.location).toBe('https://oauth.example.com/auth?state=stored-state');
+      expect(response.headers['set-cookie']?.join('')).toContain('oauth_csrf=');
+      expect(MCPOAuthHandler.initiateOAuthFlow).not.toHaveBeenCalled();
+      expect(MCPOAuthHandler.storeStateMapping).not.toHaveBeenCalled();
+      expect(mockRegistryInstance.getServerConfig).not.toHaveBeenCalled();
+    });
+
+    it('should accept tenant-scoped flow IDs when a tenant is active', async () => {
+      const { getTenantId } = require('@librechat/data-schemas');
+      getTenantId.mockReturnValue('tenant-a');
+      const tenantFlowId = 'tenant:tenant-a:test-user-id:test-server';
+      const mockFlowManager = {
+        getFlowState: jest.fn().mockResolvedValue({
+          status: 'PENDING',
+          createdAt: Date.now(),
+          metadata: {
+            serverName: 'test-server',
+            userId: 'test-user-id',
+            authorizationUrl: 'https://oauth.example.com/auth?state=stored-state',
+          },
+        }),
+      };
+
+      getLogStores.mockReturnValue({});
+      require('~/config').getFlowStateManager.mockReturnValue(mockFlowManager);
+
+      const response = await request(app).get('/api/mcp/test-server/oauth/initiate').query({
+        userId: 'test-user-id',
+        flowId: tenantFlowId,
+      });
+
+      expect(response.status).toBe(302);
+      expect(response.headers.location).toBe('https://oauth.example.com/auth?state=stored-state');
+      expect(mockFlowManager.getFlowState).toHaveBeenCalledWith(tenantFlowId, 'mcp_oauth');
+    });
+
+    it('should reject non-tenant flow IDs when a tenant is active', async () => {
+      const { getTenantId } = require('@librechat/data-schemas');
+      getTenantId.mockReturnValue('tenant-a');
+      const mockFlowManager = { getFlowState: jest.fn() };
+
+      getLogStores.mockReturnValue({});
+      require('~/config').getFlowStateManager.mockReturnValue(mockFlowManager);
+
+      const response = await request(app).get('/api/mcp/test-server/oauth/initiate').query({
+        userId: 'test-user-id',
+        flowId: 'test-user-id:test-server',
+      });
+
+      expect(response.status).toBe(403);
+      expect(response.body).toEqual({ error: 'Flow mismatch' });
+      expect(mockFlowManager.getFlowState).not.toHaveBeenCalled();
+    });
+
+    it('should reject stored authorization URL when flow is no longer pending', async () => {
       const mockFlowManager = {
         getFlowState: jest.fn().mockResolvedValue({
+          status: 'COMPLETED',
+          createdAt: Date.now(),
+          metadata: {
+            serverName: 'test-server',
+            userId: 'test-user-id',
+            authorizationUrl: 'https://oauth.example.com/auth?state=stored-state',
+          },
+        }),
+      };
+
+      getLogStores.mockReturnValue({});
+      require('~/config').getFlowStateManager.mockReturnValue(mockFlowManager);
+
+      const response = await request(app).get('/api/mcp/test-server/oauth/initiate').query({
+        userId: 'test-user-id',
+        flowId: 'test-user-id:test-server',
+      });
+
+      expect(response.status).toBe(400);
+      expect(response.body).toEqual({ error: 'Invalid flow state' });
+      expect(MCPOAuthHandler.initiateOAuthFlow).not.toHaveBeenCalled();
+      expect(MCPOAuthHandler.storeStateMapping).not.toHaveBeenCalled();
+    });
+
+    it('should initiate OAuth flow when stored authorization URL is missing', async () => {
+      const mockFlowManager = {
+        getFlowState: jest.fn().mockResolvedValue({
+          status: 'PENDING',
+          createdAt: Date.now(),
           metadata: {
             serverUrl: 'https://test-server.com',
+            state: 'old-state-value',
             oauth: { clientId: 'test-client-id' },
           },
         }),
@@ -241,6 +407,24 @@ describe('MCP Routes', () => {
         null,
         undefined,
         null,
+        undefined,
+      );
+      expect(MCPOAuthHandler.deleteStateMapping).toHaveBeenCalledWith(
+        'old-state-value',
+        mockFlowManager,
+      );
+      expect(mockFlowManager.initFlow).toHaveBeenCalledWith(
+        'test-user-id:test-server',
+        'mcp_oauth',
+        expect.objectContaining({
+          state: 'random-state-value',
+          authorizationUrl: 'https://oauth.example.com/auth',
+        }),
+      );
+      expect(MCPOAuthHandler.storeStateMapping).toHaveBeenCalledWith(
+        'random-state-value',
+        'test-user-id:test-server',
+        mockFlowManager,
       );
     });
 
@@ -254,6 +438,27 @@ describe('MCP Routes', () => {
       expect(response.body).toEqual({ error: 'User mismatch' });
     });
 
+    it('should return 403 when flowId does not match authenticated user and server', async () => {
+      const response = await request(app).get('/api/mcp/test-server/oauth/initiate').query({
+        userId: 'test-user-id',
+        flowId: 'other-user-id:test-server',
+      });
+
+      expect(response.status).toBe(403);
+      expect(response.body).toEqual({ error: 'Flow mismatch' });
+      expect(getLogStores).not.toHaveBeenCalled();
+    });
+
+    it('should return 403 when flowId query value is not a string', async () => {
+      const response = await request(app)
+        .get('/api/mcp/test-server/oauth/initiate')
+        .query('userId=test-user-id&flowId=test-user-id:test-server&flowId=other-flow');
+
+      expect(response.status).toBe(403);
+      expect(response.body).toEqual({ error: 'Flow mismatch' });
+      expect(getLogStores).not.toHaveBeenCalled();
+    });
+
     it('should return 404 when flow state is not found', async () => {
       const mockFlowManager = {
         getFlowState: jest.fn().mockResolvedValue(null),
@@ -264,7 +469,7 @@ describe('MCP Routes', () => {
 
       const response = await request(app).get('/api/mcp/test-server/oauth/initiate').query({
         userId: 'test-user-id',
-        flowId: 'non-existent-flow-id',
+        flowId: 'test-user-id:test-server',
       });
 
       expect(response.status).toBe(404);
@@ -424,6 +629,26 @@ describe('MCP Routes', () => {
         expect(response.headers.location).toBe(`${basePath}/oauth/error?error=invalid_client`);
         expect(mockFlowManager.failFlow).not.toHaveBeenCalled();
       });
+
+      it('should redirect instead of hanging when OAuth error flow ID is malformed', async () => {
+        const mockFlowManager = {
+          failFlow: jest.fn(),
+        };
+
+        getLogStores.mockReturnValueOnce({});
+        require('~/config').getFlowStateManager.mockReturnValueOnce(mockFlowManager);
+        MCPOAuthHandler.resolveStateToFlowId.mockResolvedValueOnce('malformed-flow-id');
+
+        const response = await request(app).get('/api/mcp/test-server/oauth/callback').query({
+          error: 'invalid_client',
+          state: 'opaque-state',
+        });
+        const basePath = getBasePath();
+
+        expect(response.status).toBe(302);
+        expect(response.headers.location).toBe(`${basePath}/oauth/error?error=invalid_client`);
+        expect(mockFlowManager.failFlow).not.toHaveBeenCalled();
+      });
     });
 
     it('should redirect to error page when code is missing', async () => {
@@ -542,6 +767,69 @@ describe('MCP Routes', () => {
         expect(response.headers.location).toContain(`${basePath}/oauth/success`);
       });
 
+      it('should forward the merged server config so the tool cache gate sees request-scoped servers', async () => {
+        const flowId = 'test-user-id:test-server';
+        const mockFlowManager = {
+          getFlowState: jest.fn().mockResolvedValue({
+            status: 'PENDING',
+            createdAt: Date.now(),
+          }),
+          completeFlow: jest.fn().mockResolvedValue(true),
+          deleteFlow: jest.fn().mockResolvedValue(true),
+        };
+        const mockFlowState = {
+          serverName: 'test-server',
+          userId: 'test-user-id',
+          metadata: {},
+          clientInfo: {},
+          codeVerifier: 'test-verifier',
+        };
+        const mergedServerConfig = {
+          type: 'streamable-http',
+          url: 'https://override.example.com/{{LIBRECHAT_BODY_CONVERSATIONID}}/mcp',
+          source: 'config',
+        };
+        const fetchedTools = [{ name: 'search', inputSchema: { type: 'object' } }];
+
+        getLogStores.mockReturnValue({});
+        require('~/config').getFlowStateManager.mockReturnValue(mockFlowManager);
+        MCPOAuthHandler.getFlowState.mockResolvedValue(mockFlowState);
+        MCPOAuthHandler.completeOAuthFlow.mockResolvedValue({
+          access_token: 'test-token',
+        });
+        MCPTokenStorage.storeTokens.mockResolvedValue();
+        mockRegistryInstance.getServerConfig.mockResolvedValue({});
+        mockResolveAllMcpConfigs.mockResolvedValueOnce({ 'test-server': mergedServerConfig });
+
+        const mockMcpManager = {
+          getUserConnection: jest.fn().mockResolvedValue({
+            fetchTools: jest.fn().mockResolvedValue(fetchedTools),
+          }),
+        };
+        require('~/config').getMCPManager.mockReturnValue(mockMcpManager);
+        require('~/config').getOAuthReconnectionManager.mockReturnValue({
+          clearReconnection: jest.fn(),
+        });
+        const { updateMCPServerTools } = require('~/server/services/Config/mcp');
+        updateMCPServerTools.mockResolvedValue();
+
+        const response = await request(app)
+          .get('/api/mcp/test-server/oauth/callback')
+          .query({ code: 'test-code', state: flowId });
+
+        expect(response.status).toBe(302);
+        expect(mockResolveAllMcpConfigs).toHaveBeenCalledWith('test-user-id');
+        expect(mockMcpManager.getUserConnection).toHaveBeenCalledWith(
+          expect.objectContaining({ serverConfig: mergedServerConfig }),
+        );
+        expect(updateMCPServerTools).toHaveBeenCalledWith({
+          userId: 'test-user-id',
+          serverName: 'test-server',
+          tools: fetchedTools,
+          serverConfig: mergedServerConfig,
+        });
+      });
+
       it('should reject when no PENDING flow exists and no cookies are present', async () => {
         const flowId = 'test-user-id:test-server';
         const mockFlowManager = {
@@ -590,7 +878,7 @@ describe('MCP Routes', () => {
         const mockFlowManager = {
           getFlowState: jest.fn().mockResolvedValue({
             status: 'PENDING',
-            createdAt: Date.now() - 3 * 60 * 1000,
+            createdAt: Date.now() - PENDING_STALE_MS - 60 * 1000,
           }),
         };
 
@@ -700,6 +988,140 @@ describe('MCP Routes', () => {
       );
     });
 
+    it('should clear tenant-scoped token flow state after storing callback tokens', async () => {
+      const mockFlowManager = {
+        getFlowState: jest.fn().mockResolvedValue({ status: 'PENDING' }),
+        completeFlow: jest.fn().mockResolvedValue(),
+        deleteFlow: jest.fn().mockResolvedValue(true),
+      };
+      const mockFlowState = {
+        serverName: 'test-server',
+        userId: 'test-user-id',
+        metadata: {
+          toolFlowId: 'tool-flow-123',
+          token_endpoint: 'https://auth.example.com/token',
+        },
+        resourceMetadata: { resource: 'https://api.example.com/' },
+        clientInfo: {},
+        codeVerifier: 'test-verifier',
+        tenantId: 'tenant-a',
+      };
+      const mockTokens = {
+        access_token: 'test-access-token',
+        refresh_token: 'test-refresh-token',
+      };
+
+      MCPOAuthHandler.getFlowState.mockResolvedValue(mockFlowState);
+      MCPOAuthHandler.completeOAuthFlow.mockResolvedValue(mockTokens);
+      MCPTokenStorage.storeTokens.mockResolvedValue();
+      getLogStores.mockReturnValue({});
+      require('~/config').getFlowStateManager.mockReturnValue(mockFlowManager);
+      require('~/config').getOAuthReconnectionManager.mockReturnValue({
+        clearReconnection: jest.fn(),
+      });
+      require('~/config').getMCPManager.mockReturnValue({
+        getUserConnection: jest.fn().mockResolvedValue({
+          fetchTools: jest.fn().mockResolvedValue([]),
+        }),
+      });
+      const { getCachedTools, setCachedTools } = require('~/server/services/Config');
+      getCachedTools.mockResolvedValue({});
+      setCachedTools.mockResolvedValue();
+
+      const flowId = 'test-user-id:test-server';
+      const csrfToken = generateTestCsrfToken(flowId);
+
+      const response = await request(app)
+        .get('/api/mcp/test-server/oauth/callback')
+        .set('Cookie', [`oauth_csrf=${csrfToken}`])
+        .query({
+          code: 'test-auth-code',
+          state: flowId,
+        });
+
+      expect(response.status).toBe(302);
+      expect(MCPTokenStorage.storeTokens).toHaveBeenCalledWith(
+        expect.objectContaining({
+          metadata: expect.objectContaining({
+            resource: 'https://api.example.com/',
+          }),
+        }),
+      );
+      expect(mockFlowManager.deleteFlow).toHaveBeenCalledWith(
+        'tenant:tenant-a:test-user-id:test-server',
+        'mcp_get_tokens',
+      );
+      expect(mockFlowManager.deleteFlow).toHaveBeenCalledWith(flowId, 'mcp_get_tokens');
+    });
+
+    it('should complete pending token flow waiters after storing callback tokens', async () => {
+      const mockFlowManager = {
+        getFlowState: jest.fn().mockImplementation((id, type) => {
+          if (type === 'mcp_get_tokens' && id === 'tenant:tenant-a:test-user-id:test-server') {
+            return Promise.resolve({
+              type: 'mcp_get_tokens',
+              status: 'PENDING',
+            });
+          }
+          return Promise.resolve({ status: 'PENDING' });
+        }),
+        completeFlow: jest.fn().mockResolvedValue(true),
+        deleteFlow: jest.fn().mockResolvedValue(true),
+      };
+      const mockFlowState = {
+        serverName: 'test-server',
+        userId: 'test-user-id',
+        metadata: {},
+        clientInfo: {},
+        codeVerifier: 'test-verifier',
+        tenantId: 'tenant-a',
+      };
+      const mockTokens = {
+        access_token: 'fresh-access-token',
+        refresh_token: 'fresh-refresh-token',
+      };
+
+      MCPOAuthHandler.getFlowState.mockResolvedValue(mockFlowState);
+      MCPOAuthHandler.completeOAuthFlow.mockResolvedValue(mockTokens);
+      MCPTokenStorage.storeTokens.mockResolvedValue();
+      getLogStores.mockReturnValue({});
+      require('~/config').getFlowStateManager.mockReturnValue(mockFlowManager);
+      require('~/config').getOAuthReconnectionManager.mockReturnValue({
+        clearReconnection: jest.fn(),
+      });
+      require('~/config').getMCPManager.mockReturnValue({
+        getUserConnection: jest.fn().mockResolvedValue({
+          fetchTools: jest.fn().mockResolvedValue([]),
+        }),
+      });
+      const { getCachedTools, setCachedTools } = require('~/server/services/Config');
+      getCachedTools.mockResolvedValue({});
+      setCachedTools.mockResolvedValue();
+
+      const flowId = 'test-user-id:test-server';
+      const csrfToken = generateTestCsrfToken(flowId);
+
+      const response = await request(app)
+        .get('/api/mcp/test-server/oauth/callback')
+        .set('Cookie', [`oauth_csrf=${csrfToken}`])
+        .query({
+          code: 'test-auth-code',
+          state: flowId,
+        });
+
+      expect(response.status).toBe(302);
+      expect(mockFlowManager.completeFlow).toHaveBeenCalledWith(
+        'tenant:tenant-a:test-user-id:test-server',
+        'mcp_get_tokens',
+        mockTokens,
+      );
+      expect(mockFlowManager.deleteFlow).not.toHaveBeenCalledWith(
+        'tenant:tenant-a:test-user-id:test-server',
+        'mcp_get_tokens',
+      );
+      expect(mockFlowManager.deleteFlow).toHaveBeenCalledWith(flowId, 'mcp_get_tokens');
+    });
+
     it('should use oauthHeaders from flow state when present', async () => {
       const mockFlowManager = {
         getFlowState: jest.fn().mockResolvedValue({ status: 'PENDING' }),
@@ -1110,6 +1532,49 @@ describe('MCP Routes', () => {
       });
     });
 
+    it('should return tokens for a tenant-prefixed flow owned by the user', async () => {
+      const { getTenantId } = require('@librechat/data-schemas');
+      const mockFlowManager = {
+        getFlowState: jest.fn().mockResolvedValue({
+          status: 'COMPLETED',
+          result: {
+            access_token: 'tenant-access-token',
+          },
+        }),
+      };
+
+      getTenantId.mockReturnValue('tenant-a');
+      getLogStores.mockReturnValue({});
+      require('~/config').getFlowStateManager.mockReturnValue(mockFlowManager);
+
+      const response = await request(app).get(
+        '/api/mcp/oauth/tokens/tenant:tenant-a:test-user-id:test-server',
+      );
+
+      expect(response.status).toBe(200);
+      expect(response.body).toEqual({
+        tokens: {
+          access_token: 'tenant-access-token',
+        },
+      });
+      expect(mockFlowManager.getFlowState).toHaveBeenCalledWith(
+        'tenant:tenant-a:test-user-id:test-server',
+        'mcp_oauth',
+      );
+    });
+
+    it('should reject tenant-prefixed token flow access from another tenant', async () => {
+      const { getTenantId } = require('@librechat/data-schemas');
+      getTenantId.mockReturnValue('tenant-b');
+
+      const response = await request(app).get(
+        '/api/mcp/oauth/tokens/tenant:tenant-a:test-user-id:test-server',
+      );
+
+      expect(response.status).toBe(403);
+      expect(response.body).toEqual({ error: 'Access denied' });
+    });
+
     it('should return 401 when user is not authenticated', async () => {
       const unauthApp = express();
       unauthApp.use(express.json());
@@ -1202,6 +1667,48 @@ describe('MCP Routes', () => {
       });
     });
 
+    it('should return flow status for a tenant-prefixed flow owned by the user', async () => {
+      const { getTenantId } = require('@librechat/data-schemas');
+      const mockFlowManager = {
+        getFlowState: jest.fn().mockResolvedValue({
+          status: 'PENDING',
+          error: null,
+        }),
+      };
+
+      getTenantId.mockReturnValue('tenant-a');
+      getLogStores.mockReturnValue({});
+      require('~/config').getFlowStateManager.mockReturnValue(mockFlowManager);
+
+      const response = await request(app).get(
+        '/api/mcp/oauth/status/tenant:tenant-a:test-user-id:test-server',
+      );
+
+      expect(response.status).toBe(200);
+      expect(response.body).toEqual({
+        status: 'PENDING',
+        completed: false,
+        failed: false,
+        error: null,
+      });
+      expect(mockFlowManager.getFlowState).toHaveBeenCalledWith(
+        'tenant:tenant-a:test-user-id:test-server',
+        'mcp_oauth',
+      );
+    });
+
+    it('should reject tenant-prefixed status access from another tenant', async () => {
+      const { getTenantId } = require('@librechat/data-schemas');
+      getTenantId.mockReturnValue('tenant-b');
+
+      const response = await request(app).get(
+        '/api/mcp/oauth/status/tenant:tenant-a:test-user-id:test-server',
+      );
+
+      expect(response.status).toBe(403);
+      expect(response.body).toEqual({ error: 'Access denied' });
+    });
+
     it('should return 403 when flowId does not match authenticated user', async () => {
       const response = await request(app).get('/api/mcp/oauth/status/other-user-id:test-server');
 
@@ -1565,6 +2072,7 @@ describe('MCP Routes', () => {
       expect(response.status).toBe(200);
       expect(response.body).toEqual({
         success: true,
+        oauthTimeout: expect.any(Number),
         connectionStatus: {
           server1: {
             connectionState: 'connected',
@@ -2097,11 +2605,13 @@ describe('MCP Routes', () => {
           type: 'sse',
           url: 'http://server1.com/sse',
           title: 'Server 1',
+          source: 'user',
         },
         'server-2': {
           type: 'sse',
           url: 'http://server2.com/sse',
           title: 'Server 2',
+          source: 'user',
         },
       };
 
@@ -2173,7 +2683,7 @@ describe('MCP Routes', () => {
 
       mockRegistryInstance.addServer.mockResolvedValue({
         serverName: 'test-sse-server',
-        config: validConfig,
+        config: { ...validConfig, source: 'user' },
       });
 
       const response = await request(app).post('/api/mcp/servers').send({ config: validConfig });
@@ -2593,6 +3103,7 @@ describe('MCP Routes', () => {
         type: 'sse',
         url: 'https://mcp-server.example.com/sse',
         title: 'Test Server',
+        source: 'user',
       };
 
       mockRegistryInstance.getServerConfig.mockResolvedValue(mockConfig);
@@ -2661,7 +3172,7 @@ describe('MCP Routes', () => {
         description: 'Updated description',
       };
 
-      mockRegistryInstance.updateServer.mockResolvedValue(updatedConfig);
+      mockRegistryInstance.updateServer.mockResolvedValue({ ...updatedConfig, source: 'user' });
 
       const response = await request(app)
         .patch('/api/mcp/servers/test-server')
diff --git a/api/server/routes/__tests__/rum.spec.js b/api/server/routes/__tests__/rum.spec.js
index ad161a75eb7..cdd0ec3e761 100644
--- a/api/server/routes/__tests__/rum.spec.js
+++ b/api/server/routes/__tests__/rum.spec.js
@@ -1,12 +1,12 @@
 const express = require('express');
 const request = require('supertest');
 
-const mockRequireJwtAuth = jest.fn((_req, _res, next) => next());
+const mockRequireRumProxyAuth = jest.fn((_req, _res, next) => next());
 const mockIsRumProxyEnabled = jest.fn();
 const mockProxyRumRequest = jest.fn((_req, res) => res.status(202).send());
 
 jest.mock('~/server/middleware', () => ({
-  requireJwtAuth: (...args) => mockRequireJwtAuth(...args),
+  requireRumProxyAuth: (...args) => mockRequireRumProxyAuth(...args),
 }));
 
 jest.mock('@librechat/api', () => ({
@@ -26,7 +26,7 @@ describe('RUM proxy routes', () => {
   });
 
   beforeEach(() => {
-    mockRequireJwtAuth.mockClear();
+    mockRequireRumProxyAuth.mockClear();
     mockIsRumProxyEnabled.mockReset();
     mockProxyRumRequest.mockClear();
   });
@@ -41,7 +41,7 @@ describe('RUM proxy routes', () => {
 
     expect(response.status).toBe(404);
     expect(response.body).toEqual({ message: 'RUM proxy is not configured' });
-    expect(mockRequireJwtAuth).not.toHaveBeenCalled();
+    expect(mockRequireRumProxyAuth).not.toHaveBeenCalled();
     expect(mockProxyRumRequest).not.toHaveBeenCalled();
   });
 
@@ -54,7 +54,20 @@ describe('RUM proxy routes', () => {
       .send(Buffer.from('payload'));
 
     expect(response.status).toBe(202);
-    expect(mockRequireJwtAuth).toHaveBeenCalledTimes(1);
+    expect(mockRequireRumProxyAuth).toHaveBeenCalledTimes(1);
+    expect(mockProxyRumRequest).toHaveBeenCalledTimes(1);
+  });
+
+  it('uses RUM-specific auth for logs as well as traces', async () => {
+    mockIsRumProxyEnabled.mockReturnValue(true);
+
+    const response = await request(app)
+      .post('/api/rum/v1/logs')
+      .set('Content-Type', 'application/x-protobuf')
+      .send(Buffer.from('payload'));
+
+    expect(response.status).toBe(202);
+    expect(mockRequireRumProxyAuth).toHaveBeenCalledTimes(1);
     expect(mockProxyRumRequest).toHaveBeenCalledTimes(1);
   });
 });
diff --git a/api/server/routes/__tests__/share.spec.js b/api/server/routes/__tests__/share.spec.js
index 541ae451c64..e26dd9be6c3 100644
--- a/api/server/routes/__tests__/share.spec.js
+++ b/api/server/routes/__tests__/share.spec.js
@@ -3,9 +3,18 @@ const request = require('supertest');
 const mongoose = require('mongoose');
 
 const mockGetSharedLinkExpiration = jest.fn();
+const mockGrantCreationPermissions = jest.fn();
+const mockUpdateSharedLinkPermissionsExpiration = jest.fn();
+const mockSharedLinksAccess = jest.fn((_req, _res, next) => next());
 
 jest.mock('@librechat/api', () => ({
   isEnabled: jest.fn(() => true),
+  generateCheckAccess: jest.fn(() => mockSharedLinksAccess),
+  grantCreationPermissions: (...args) => mockGrantCreationPermissions(...args),
+  updateSharedLinkPermissionsExpiration: (...args) =>
+    mockUpdateSharedLinkPermissionsExpiration(...args),
+  ensureLinkPermissions: jest.fn(),
+  deleteSharedLinkWithCleanup: jest.fn(),
   getSharedLinkExpiration: (...args) => mockGetSharedLinkExpiration(...args),
   isActiveExpirationDate: jest.fn((expiredAt) => expiredAt > new Date()),
 }));
@@ -16,6 +25,13 @@ jest.mock('@librechat/data-schemas', () => ({
 }));
 
 jest.mock('librechat-data-provider', () => ({
+  PermissionTypes: {
+    SHARED_LINKS: 'SHARED_LINKS',
+  },
+  Permissions: {
+    CREATE: 'CREATE',
+    SHARE_PUBLIC: 'SHARE_PUBLIC',
+  },
   RetentionMode: {
     ALL: 'all',
     TEMPORARY: 'temporary',
@@ -40,13 +56,22 @@ jest.mock('~/models', () => ({
   deleteSharedLink: jest.fn(),
   getSharedLinks: jest.fn(),
   getSharedLink: jest.fn(),
+  getRoleByName: jest.fn(),
 }));
 
+jest.mock('~/server/middleware/canAccessSharedLink', () => (_req, _res, next) => next());
+jest.mock('~/server/middleware/optionalJwtAuth', () => (req, _res, next) => next());
 jest.mock('~/server/middleware/requireJwtAuth', () => (req, res, next) => next());
 
 const { RetentionMode } = require('librechat-data-provider');
 const { createTempChatExpirationDate, logger } = require('@librechat/data-schemas');
-const { createSharedLink, updateSharedLink } = require('~/models');
+const { deleteSharedLinkWithCleanup } = require('@librechat/api');
+const {
+  getSharedMessages,
+  createSharedLink,
+  updateSharedLink,
+  getRoleByName,
+} = require('~/models');
 const shareRouter = require('../share');
 
 const activeExpiration = new Date('2030-01-01T00:00:00.000Z');
@@ -71,11 +96,28 @@ const buildApp = ({ retentionMode = RetentionMode.TEMPORARY } = {}) => {
 describe('share routes retention', () => {
   beforeEach(() => {
     jest.clearAllMocks();
+    getRoleByName.mockResolvedValue({
+      permissions: {
+        SHARED_LINKS: {
+          SHARE_PUBLIC: true,
+        },
+      },
+    });
+    mockGrantCreationPermissions.mockResolvedValue(undefined);
+  });
+
+  it('prevents successful shared message responses from being cached', async () => {
+    getSharedMessages.mockResolvedValue({ shareId: 'share-123', messages: [] });
+
+    const response = await request(buildApp()).get('/api/share/share-123');
+
+    expect(response.status).toBe(200);
+    expect(response.headers['cache-control']).toBe('private, no-store');
   });
 
   it('expires new shares for retained non-temporary conversations', async () => {
     mockGetSharedLinkExpiration.mockResolvedValue(activeExpiration);
-    createSharedLink.mockResolvedValue({ shareId: 'share-123' });
+    createSharedLink.mockResolvedValue({ _id: 'link-123', shareId: 'share-123' });
 
     const response = await request(buildApp())
       .post('/api/share/convo-123')
@@ -106,11 +148,18 @@ describe('share routes retention', () => {
       'msg-123',
       new Date('2030-01-01T00:00:00.000Z'),
     );
+    expect(mockGrantCreationPermissions).toHaveBeenCalledWith(
+      'link-123',
+      'user-123',
+      true,
+      new Date('2030-01-01T00:00:00.000Z'),
+    );
+    expect(mockSharedLinksAccess).toHaveBeenCalled();
   });
 
   it('rejects new shares when the retained conversation expired', async () => {
     mockGetSharedLinkExpiration.mockResolvedValue(expiredExpiration);
-    createSharedLink.mockResolvedValue({ shareId: 'share-123' });
+    createSharedLink.mockResolvedValue({ _id: 'link-123', shareId: 'share-123' });
 
     const response = await request(buildApp())
       .post('/api/share/convo-123')
@@ -122,7 +171,7 @@ describe('share routes retention', () => {
 
   it('rejects new shares for expired conversations in all retention mode', async () => {
     mockGetSharedLinkExpiration.mockResolvedValue(expiredExpiration);
-    createSharedLink.mockResolvedValue({ shareId: 'share-123' });
+    createSharedLink.mockResolvedValue({ _id: 'link-123', shareId: 'share-123' });
 
     const response = await request(buildApp({ retentionMode: RetentionMode.ALL }))
       .post('/api/share/convo-123')
@@ -135,7 +184,7 @@ describe('share routes retention', () => {
   it('expires updated shares for retained non-temporary conversations', async () => {
     mongoose.models.SharedLink.findOne.mockReturnValue(lean({ conversationId: 'convo-123' }));
     mockGetSharedLinkExpiration.mockResolvedValue(activeExpiration);
-    updateSharedLink.mockResolvedValue({ shareId: 'share-456' });
+    updateSharedLink.mockResolvedValue({ _id: 'link-456', shareId: 'share-456' });
 
     const response = await request(buildApp()).patch('/api/share/share-123');
 
@@ -162,6 +211,10 @@ describe('share routes retention', () => {
       undefined,
       new Date('2030-01-01T00:00:00.000Z'),
     );
+    expect(mockUpdateSharedLinkPermissionsExpiration).toHaveBeenCalledWith(
+      'link-456',
+      new Date('2030-01-01T00:00:00.000Z'),
+    );
   });
 
   it('rejects updated shares when the retained conversation expired', async () => {
@@ -195,12 +248,14 @@ describe('share routes retention', () => {
   it('clears updated share expiration when the conversation is no longer retained', async () => {
     mongoose.models.SharedLink.findOne.mockReturnValue(lean({ conversationId: 'convo-123' }));
     mockGetSharedLinkExpiration.mockResolvedValue(null);
-    updateSharedLink.mockResolvedValue({ shareId: 'share-456' });
+    updateSharedLink.mockResolvedValue({ _id: 'link-456', shareId: 'share-456' });
 
     const response = await request(buildApp()).patch('/api/share/share-123');
 
     expect(response.status).toBe(200);
     expect(updateSharedLink).toHaveBeenCalledWith('user-123', 'share-123', undefined, null);
+    expect(mockUpdateSharedLinkPermissionsExpiration).toHaveBeenCalledWith('link-456', null);
+    expect(mockSharedLinksAccess).not.toHaveBeenCalled();
   });
 
   it('preserves updated share expiration when the conversation cannot be found', async () => {
@@ -212,6 +267,7 @@ describe('share routes retention', () => {
 
     expect(response.status).toBe(200);
     expect(updateSharedLink).toHaveBeenCalledWith('user-123', 'share-123', undefined, undefined);
+    expect(mockUpdateSharedLinkPermissionsExpiration).not.toHaveBeenCalled();
   });
 
   it('clears updated share expiration when creating a new expiration throws', async () => {
@@ -221,7 +277,7 @@ describe('share routes retention', () => {
       dependencies.logger.error('[getSharedLinkExpiration] Error creating expiration date:', error);
       return null;
     });
-    updateSharedLink.mockResolvedValue({ shareId: 'share-456' });
+    updateSharedLink.mockResolvedValue({ _id: 'link-456', shareId: 'share-456' });
 
     const response = await request(buildApp()).patch('/api/share/share-123');
 
@@ -231,6 +287,7 @@ describe('share routes retention', () => {
       error,
     );
     expect(updateSharedLink).toHaveBeenCalledWith('user-123', 'share-123', undefined, null);
+    expect(mockUpdateSharedLinkPermissionsExpiration).toHaveBeenCalledWith('link-456', null);
   });
 
   it('updates share target message while applying retention expiration', async () => {
@@ -259,4 +316,14 @@ describe('share routes retention', () => {
     expect(response.status).toBe(400);
     expect(updateSharedLink).not.toHaveBeenCalled();
   });
+
+  it('allows deleting existing shares without CREATE permission gate', async () => {
+    deleteSharedLinkWithCleanup.mockResolvedValue({ shareId: 'share-123' });
+
+    const response = await request(buildApp()).delete('/api/share/share-123');
+
+    expect(response.status).toBe(200);
+    expect(mockSharedLinksAccess).not.toHaveBeenCalled();
+    expect(deleteSharedLinkWithCleanup).toHaveBeenCalledWith('user-123', 'share-123');
+  });
 });
diff --git a/api/server/routes/accessPermissions.js b/api/server/routes/accessPermissions.js
index e53d0ef1a77..6ef731daba7 100644
--- a/api/server/routes/accessPermissions.js
+++ b/api/server/routes/accessPermissions.js
@@ -1,5 +1,11 @@
+const mongoose = require('mongoose');
 const express = require('express');
-const { ResourceType, PermissionBits } = require('librechat-data-provider');
+const {
+  AccessRoleIds,
+  PrincipalType,
+  ResourceType,
+  PermissionBits,
+} = require('librechat-data-provider');
 const {
   getUserEffectivePermissions,
   getAllEffectivePermissions,
@@ -82,6 +88,12 @@ const checkResourcePermissionAccess = (requiredPermission) => (req, res, next) =
       resourceIdParam: 'resourceId',
       idResolver: getSkillById,
     });
+  } else if (resourceType === ResourceType.SHARED_LINK) {
+    middleware = canAccessResource({
+      resourceType: ResourceType.SHARED_LINK,
+      requiredPermission,
+      resourceIdParam: 'resourceId',
+    });
   } else {
     return res.status(400).json({
       error: 'Bad Request',
@@ -93,6 +105,57 @@ const checkResourcePermissionAccess = (requiredPermission) => (req, res, next) =
   middleware(req, res, next);
 };
 
+const rejectSharedLinkOwnerPermissionChanges = async (req, res, next) => {
+  if (req.params.resourceType !== ResourceType.SHARED_LINK) {
+    return next();
+  }
+
+  const updated = Array.isArray(req.body?.updated) ? req.body.updated : [];
+  const removed = Array.isArray(req.body?.removed) ? req.body.removed : [];
+  const grantsOwner = updated.some(
+    (principal) => principal?.accessRoleId === AccessRoleIds.SHARED_LINK_OWNER,
+  );
+  const grantsPublicOwner = req.body?.publicAccessRoleId === AccessRoleIds.SHARED_LINK_OWNER;
+
+  if (grantsOwner || grantsPublicOwner) {
+    return res.status(400).json({
+      error: 'Bad Request',
+      message: 'Shared link owner permissions cannot be changed',
+    });
+  }
+
+  const userMutations = [...updated, ...removed].filter(
+    (principal) => principal?.type === PrincipalType.USER && principal?.id,
+  );
+
+  if (userMutations.length === 0) {
+    return next();
+  }
+
+  try {
+    const SharedLink = mongoose.models.SharedLink;
+    const link = await SharedLink.findById(req.params.resourceId, 'user').lean();
+    const ownerId = link?.user?.toString();
+    const touchesOwner = ownerId
+      ? userMutations.some((principal) => principal.id?.toString() === ownerId)
+      : false;
+
+    if (touchesOwner) {
+      return res.status(400).json({
+        error: 'Bad Request',
+        message: 'Shared link owner permissions cannot be changed',
+      });
+    }
+  } catch (_error) {
+    return res.status(500).json({
+      error: 'Internal Server Error',
+      message: 'Failed to validate shared link owner permissions',
+    });
+  }
+
+  return next();
+};
+
 /**
  * GET /api/permissions/{resourceType}/{resourceId}
  * Get all permissions for a specific resource
@@ -115,6 +178,7 @@ router.put(
   checkResourcePermissionAccess(PermissionBits.SHARE),
   checkShareAccess,
   checkSharePublicAccess,
+  rejectSharedLinkOwnerPermissionChanges,
   updateResourcePermissions,
 );
 
diff --git a/api/server/routes/accessPermissions.sharePolicy.test.js b/api/server/routes/accessPermissions.sharePolicy.test.js
index 0fc7a90deac..ed17a044529 100644
--- a/api/server/routes/accessPermissions.sharePolicy.test.js
+++ b/api/server/routes/accessPermissions.sharePolicy.test.js
@@ -30,6 +30,7 @@ jest.mock('~/server/controllers/PermissionsController', () => ({
 
 const express = require('express');
 const request = require('supertest');
+const mongoose = require('mongoose');
 const {
   SystemRoles,
   ResourceType,
@@ -48,6 +49,8 @@ const { getRoleByName } = require('~/models');
 
 describe('Access permissions share policy', () => {
   let app;
+  const mockSharedLinkFindById = jest.fn();
+  const originalSharedLinkModel = mongoose.models.SharedLink;
 
   const resourceId = '507f1f77bcf86cd799439011';
   const sharePolicyCases = [
@@ -116,8 +119,30 @@ describe('Access permissions share policy', () => {
     accessRoleId,
   });
 
+  const allowSharedLinkSharing = () => {
+    getRoleByName.mockResolvedValue({
+      permissions: {
+        [PermissionTypes.SHARED_LINKS]: {
+          [Permissions.SHARE]: true,
+          [Permissions.SHARE_PUBLIC]: true,
+        },
+      },
+    });
+  };
+
+  const mockSharedLinkOwner = (ownerId = 'owner-user') => {
+    mockSharedLinkFindById.mockReturnValue({
+      lean: jest.fn().mockResolvedValue({ user: ownerId }),
+    });
+  };
+
   beforeEach(() => {
     jest.clearAllMocks();
+    if (mongoose.models.SharedLink) {
+      mongoose.models.SharedLink.findById = mockSharedLinkFindById;
+    } else {
+      mongoose.models.SharedLink = { findById: mockSharedLinkFindById };
+    }
     hasCapability.mockResolvedValue(false);
 
     app = express();
@@ -129,6 +154,14 @@ describe('Access permissions share policy', () => {
     app.use('/api/permissions', accessPermissionsRouter);
   });
 
+  afterAll(() => {
+    if (originalSharedLinkModel) {
+      mongoose.models.SharedLink = originalSharedLinkModel;
+    } else {
+      delete mongoose.models.SharedLink;
+    }
+  });
+
   it.each(sharePolicyCases)(
     'blocks non-public $label sharing when ACL SHARE passes but role SHARE is disabled',
     async ({ resourceType, permissionType, accessRoleId, middlewareOptions }) => {
@@ -208,4 +241,80 @@ describe('Access permissions share policy', () => {
     });
     expect(updateResourcePermissions).not.toHaveBeenCalled();
   });
+
+  it('blocks granting shared-link owner through generic permission updates', async () => {
+    allowSharedLinkSharing();
+    mockSharedLinkOwner();
+
+    const response = await request(app)
+      .put(`/api/permissions/${ResourceType.SHARED_LINK}/${resourceId}`)
+      .send({
+        updated: [
+          {
+            type: PrincipalType.USER,
+            id: 'target-user',
+            accessRoleId: AccessRoleIds.SHARED_LINK_OWNER,
+          },
+        ],
+        public: false,
+      });
+
+    expect(response.status).toBe(400);
+    expect(response.body.message).toBe('Shared link owner permissions cannot be changed');
+    expect(updateResourcePermissions).not.toHaveBeenCalled();
+  });
+
+  it('blocks granting shared-link owner to the public principal', async () => {
+    allowSharedLinkSharing();
+
+    const response = await request(app)
+      .put(`/api/permissions/${ResourceType.SHARED_LINK}/${resourceId}`)
+      .send({
+        public: true,
+        publicAccessRoleId: AccessRoleIds.SHARED_LINK_OWNER,
+      });
+
+    expect(response.status).toBe(400);
+    expect(response.body.message).toBe('Shared link owner permissions cannot be changed');
+    expect(updateResourcePermissions).not.toHaveBeenCalled();
+    expect(mockSharedLinkFindById).not.toHaveBeenCalled();
+  });
+
+  it('blocks removing the canonical shared-link owner', async () => {
+    allowSharedLinkSharing();
+    mockSharedLinkOwner('owner-user');
+
+    const response = await request(app)
+      .put(`/api/permissions/${ResourceType.SHARED_LINK}/${resourceId}`)
+      .send({
+        updated: [],
+        removed: [{ type: PrincipalType.USER, id: 'owner-user' }],
+        public: false,
+      });
+
+    expect(response.status).toBe(400);
+    expect(response.body.message).toBe('Shared link owner permissions cannot be changed');
+    expect(updateResourcePermissions).not.toHaveBeenCalled();
+  });
+
+  it('allows viewer grants for non-owner shared-link users', async () => {
+    allowSharedLinkSharing();
+    mockSharedLinkOwner('owner-user');
+
+    const response = await request(app)
+      .put(`/api/permissions/${ResourceType.SHARED_LINK}/${resourceId}`)
+      .send({
+        updated: [
+          {
+            type: PrincipalType.USER,
+            id: 'target-user',
+            accessRoleId: AccessRoleIds.SHARED_LINK_VIEWER,
+          },
+        ],
+        public: false,
+      });
+
+    expect(response.status).toBe(200);
+    expect(updateResourcePermissions).toHaveBeenCalledTimes(1);
+  });
 });
diff --git a/api/server/routes/actions.js b/api/server/routes/actions.js
index 38d0dc8c949..d9a2f2f7fad 100644
--- a/api/server/routes/actions.js
+++ b/api/server/routes/actions.js
@@ -14,7 +14,7 @@ const {
 } = require('@librechat/api');
 const { findToken, updateToken, createToken } = require('~/models');
 const { requireJwtAuth } = require('~/server/middleware');
-const { getFlowStateManager } = require('~/config');
+const { getActionFlowStateManager } = require('~/config');
 const { getLogStores } = require('~/cache');
 
 const router = express.Router();
@@ -56,7 +56,7 @@ router.get('/:action_id/oauth/callback', async (req, res) => {
   const { action_id } = req.params;
   const { code, state } = req.query;
   const flowsCache = getLogStores(CacheKeys.FLOWS);
-  const flowManager = getFlowStateManager(flowsCache);
+  const flowManager = getActionFlowStateManager(flowsCache);
   const basePath = getBasePath();
   let identifier = action_id;
   try {
diff --git a/api/server/routes/admin/config.js b/api/server/routes/admin/config.js
index 0632077ea97..d934645f186 100644
--- a/api/server/routes/admin/config.js
+++ b/api/server/routes/admin/config.js
@@ -18,6 +18,7 @@ const handlers = createAdminConfigHandlers({
   findConfigByPrincipal: db.findConfigByPrincipal,
   upsertConfig: db.upsertConfig,
   patchConfigFields: db.patchConfigFields,
+  tombstoneConfigField: db.tombstoneConfigField,
   unsetConfigField: db.unsetConfigField,
   deleteConfig: db.deleteConfig,
   toggleConfigActive: db.toggleConfigActive,
@@ -33,6 +34,7 @@ router.get('/base', handlers.getBaseConfig);
 router.get('/:principalType/:principalId', handlers.getConfig);
 router.put('/:principalType/:principalId', handlers.upsertConfigOverrides);
 router.patch('/:principalType/:principalId/fields', handlers.patchConfigField);
+router.post('/:principalType/:principalId/fields/tombstone', handlers.tombstoneConfigField);
 router.delete('/:principalType/:principalId/fields', handlers.deleteConfigField);
 router.delete('/:principalType/:principalId', handlers.deleteConfigOverrides);
 router.patch('/:principalType/:principalId/active', handlers.toggleConfig);
diff --git a/api/server/routes/admin/skills.js b/api/server/routes/admin/skills.js
new file mode 100644
index 00000000000..54e54004ff2
--- /dev/null
+++ b/api/server/routes/admin/skills.js
@@ -0,0 +1,50 @@
+const express = require('express');
+const { createAdminSkillsSyncAccess, createAdminSkillsSyncHandlers } = require('@librechat/api');
+const { SystemCapabilities } = require('@librechat/data-schemas');
+const { hasCapability, requireCapability } = require('~/server/middleware/roles/capabilities');
+const { requireJwtAuth } = require('~/server/middleware');
+const { upsertSkillSyncCredential, deleteSkillSyncCredential } = require('~/models');
+const { getGitHubSkillSyncRunnerForRequest } = require('~/server/services/Skills/sync');
+const { getAppConfig } = require('~/server/services/Config');
+const configMiddleware = require('~/server/middleware/config/app');
+
+const router = express.Router();
+const requireAdminAccess = requireCapability(SystemCapabilities.ACCESS_ADMIN);
+
+const syncAccess = createAdminSkillsSyncAccess({
+  getAppConfig,
+  hasCapability,
+});
+
+const handlers = createAdminSkillsSyncHandlers({
+  getRunner: getGitHubSkillSyncRunnerForRequest,
+  upsertCredential: upsertSkillSyncCredential,
+  deleteCredential: deleteSkillSyncCredential,
+});
+
+router.use(
+  requireJwtAuth,
+  requireAdminAccess,
+  configMiddleware,
+  syncAccess.attachBaseSkillSyncConfig,
+);
+
+router.get(
+  '/sync/status',
+  syncAccess.requireReadSkills,
+  syncAccess.attachCredentialReadAccess,
+  handlers.getSyncStatus,
+);
+router.post('/sync/run', syncAccess.requireSyncRunCapability, handlers.runSync);
+router.put(
+  '/sync/credentials/:credentialKey',
+  syncAccess.requirePlatformManageSkills,
+  handlers.setCredential,
+);
+router.delete(
+  '/sync/credentials/:credentialKey',
+  syncAccess.requirePlatformManageSkills,
+  handlers.deleteCredential,
+);
+
+module.exports = router;
diff --git a/api/server/routes/admin/skills.test.js b/api/server/routes/admin/skills.test.js
new file mode 100644
index 00000000000..f452d6ea212
--- /dev/null
+++ b/api/server/routes/admin/skills.test.js
@@ -0,0 +1,119 @@
+const express = require('express');
+const request = require('supertest');
+
+const mockRequireJwtAuth = jest.fn((req, res, next) => {
+  req.user = { id: 'user-1', role: 'ADMIN', tenantId: 'tenant-a' };
+  next();
+});
+const mockCapabilityMiddleware = jest.fn((req, res, next) => next());
+const mockRequireCapability = jest.fn(() => mockCapabilityMiddleware);
+const mockHasCapability = jest.fn().mockResolvedValue(true);
+const mockConfigMiddleware = jest.fn((req, res, next) => {
+  req.config = { skillSync: { github: { enabled: false, sources: [] } } };
+  next();
+});
+const mockGetAppConfig = jest.fn();
+const mockGetGitHubSkillSyncRunnerForRequest = jest.fn();
+const mockHandlers = {
+  getSyncStatus: jest.fn((req, res) => res.status(200).json({ ok: true })),
+  runSync: jest.fn((req, res) => res.status(200).json({ ok: true })),
+  setCredential: jest.fn((req, res) => res.status(200).json({ ok: true })),
+  deleteCredential: jest.fn((req, res) => res.status(200).json({ ok: true })),
+};
+const mockSyncAccess = {
+  attachBaseSkillSyncConfig: jest.fn((req, res, next) => next()),
+  requireReadSkills: jest.fn((req, res, next) => next()),
+  attachCredentialReadAccess: jest.fn((req, res, next) => next()),
+  requireSyncRunCapability: jest.fn((req, res, next) => next()),
+  requirePlatformManageSkills: jest.fn((req, res, next) => next()),
+};
+
+jest.mock('@librechat/data-schemas', () => ({
+  SystemCapabilities: {
+    ACCESS_ADMIN: 'access:admin',
+  },
+}));
+
+jest.mock('@librechat/api', () => ({
+  createAdminSkillsSyncAccess: jest.fn(() => mockSyncAccess),
+  createAdminSkillsSyncHandlers: jest.fn(() => mockHandlers),
+}));
+
+jest.mock('~/server/middleware/roles/capabilities', () => ({
+  hasCapability: mockHasCapability,
+  requireCapability: mockRequireCapability,
+}));
+
+jest.mock('~/server/middleware', () => ({
+  requireJwtAuth: mockRequireJwtAuth,
+}));
+
+jest.mock('~/server/middleware/config/app', () => mockConfigMiddleware);
+
+jest.mock('~/server/services/Config', () => ({
+  getAppConfig: mockGetAppConfig,
+}));
+
+jest.mock('~/models', () => ({
+  upsertSkillSyncCredential: jest.fn(),
+  deleteSkillSyncCredential: jest.fn(),
+}));
+
+jest.mock('~/server/services/Skills/sync', () => ({
+  getGitHubSkillSyncRunnerForRequest: mockGetGitHubSkillSyncRunnerForRequest,
+}));
+
+describe('admin skills sync routes', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  function createApp() {
+    delete require.cache[require.resolve('./skills')];
+    const router = require('./skills');
+    const app = express();
+    app.use(express.json());
+    app.use('/api/admin/skills', router);
+    return app;
+  }
+
+  it('delegates skill sync access policy to the API package', async () => {
+    const app = createApp();
+
+    await request(app).get('/api/admin/skills/sync/status').expect(200);
+
+    const {
+      createAdminSkillsSyncAccess,
+      createAdminSkillsSyncHandlers,
+    } = require('@librechat/api');
+    expect(mockRequireCapability).toHaveBeenCalledWith('access:admin');
+    expect(createAdminSkillsSyncAccess).toHaveBeenCalledWith({
+      getAppConfig: mockGetAppConfig,
+      hasCapability: mockHasCapability,
+    });
+    expect(createAdminSkillsSyncHandlers).toHaveBeenCalledWith(
+      expect.objectContaining({ getRunner: mockGetGitHubSkillSyncRunnerForRequest }),
+    );
+    expect(mockRequireJwtAuth).toHaveBeenCalled();
+    expect(mockCapabilityMiddleware).toHaveBeenCalled();
+    expect(mockConfigMiddleware).toHaveBeenCalled();
+    expect(mockSyncAccess.attachBaseSkillSyncConfig).toHaveBeenCalled();
+    expect(mockSyncAccess.requireReadSkills).toHaveBeenCalled();
+    expect(mockSyncAccess.attachCredentialReadAccess).toHaveBeenCalled();
+    expect(mockHandlers.getSyncStatus).toHaveBeenCalled();
+  });
+
+  it('mounts package access middlewares before each sync endpoint handler', async () => {
+    const app = createApp();
+
+    await request(app).post('/api/admin/skills/sync/run').expect(200);
+    await request(app).put('/api/admin/skills/sync/credentials/default').send({}).expect(200);
+    await request(app).delete('/api/admin/skills/sync/credentials/default').expect(200);
+
+    expect(mockSyncAccess.requireSyncRunCapability).toHaveBeenCalled();
+    expect(mockHandlers.runSync).toHaveBeenCalled();
+    expect(mockSyncAccess.requirePlatformManageSkills).toHaveBeenCalledTimes(2);
+    expect(mockHandlers.setCredential).toHaveBeenCalled();
+    expect(mockHandlers.deleteCredential).toHaveBeenCalled();
+  });
+});
diff --git a/api/server/routes/agents/__tests__/abort.spec.js b/api/server/routes/agents/__tests__/abort.spec.js
index 442665d9737..418c5f42549 100644
--- a/api/server/routes/agents/__tests__/abort.spec.js
+++ b/api/server/routes/agents/__tests__/abort.spec.js
@@ -195,6 +195,43 @@ describe('Agent Abort Endpoint', () => {
         expect(response.status).toBe(200);
         expect(mockSaveMessage).not.toHaveBeenCalled();
       });
+
+      it('should skip message saving when abort content is only an OAuth prompt', async () => {
+        const jobStreamId = 'test-stream-123';
+
+        mockGenerationJobManager.getJob.mockResolvedValue({
+          metadata: { userId: 'test-user-123' },
+        });
+
+        mockGenerationJobManager.abortJob.mockResolvedValue({
+          success: true,
+          jobData: {
+            userMessage: { messageId: 'user-msg-123' },
+            responseMessageId: 'response-msg-456',
+            conversationId: jobStreamId,
+          },
+          content: [
+            {
+              type: 'tool_call',
+              tool_call: {
+                type: 'tool_call',
+                id: 'oauth-call-1',
+                name: 'oauth_mcp_Google-Workspace',
+                args: '',
+                auth: 'https://auth.example.com/oauth',
+              },
+            },
+          ],
+          text: '',
+        });
+
+        const response = await request(app)
+          .post('/api/agents/chat/abort')
+          .send({ conversationId: jobStreamId });
+
+        expect(response.status).toBe(200);
+        expect(mockSaveMessage).not.toHaveBeenCalled();
+      });
     });
 
     describe('Partial Response Saving', () => {
@@ -215,6 +252,7 @@ describe('Agent Abort Endpoint', () => {
             conversationId: jobStreamId,
             sender: 'TestAgent',
             endpoint: 'anthropic',
+            iconURL: 'https://example.com/spec-icon.png',
             model: 'claude-3',
           },
           content: [{ type: 'text', text: 'Partial response...' }],
@@ -238,6 +276,7 @@ describe('Agent Abort Endpoint', () => {
             text: 'Partial response...',
             sender: 'TestAgent',
             endpoint: 'anthropic',
+            iconURL: 'https://example.com/spec-icon.png',
             model: 'claude-3',
             unfinished: true,
             error: false,
@@ -264,8 +303,8 @@ describe('Agent Abort Endpoint', () => {
             responseMessageId: 'response-msg-456',
             conversationId: jobStreamId,
           },
-          content: [],
-          text: '',
+          content: [{ type: 'text', text: 'Partial response...' }],
+          text: 'Partial response...',
         });
 
         mockSaveMessage.mockRejectedValue(new Error('Database error'));
diff --git a/api/server/routes/agents/__tests__/streamTenant.spec.js b/api/server/routes/agents/__tests__/streamTenant.spec.js
index 1f89953186e..708a0712284 100644
--- a/api/server/routes/agents/__tests__/streamTenant.spec.js
+++ b/api/server/routes/agents/__tests__/streamTenant.spec.js
@@ -45,9 +45,11 @@ jest.mock('~/server/middleware', () => ({
 }));
 
 jest.mock('~/server/routes/agents/chat', () => require('express').Router());
-jest.mock('~/server/routes/agents/v1', () => ({
-  v1: require('express').Router(),
-}));
+jest.mock('~/server/routes/agents/v1', () => {
+  const router = require('express').Router();
+  router.use((req, res) => res.status(418).json({ error: 'v1 caught stream route' }));
+  return { v1: router };
+});
 jest.mock('~/server/routes/agents/openai', () => require('express').Router());
 jest.mock('~/server/routes/agents/responses', () => require('express').Router());
 
diff --git a/api/server/routes/agents/actions.js b/api/server/routes/agents/actions.js
index 6133ee24e1d..eab7c908aaf 100644
--- a/api/server/routes/agents/actions.js
+++ b/api/server/routes/agents/actions.js
@@ -3,8 +3,12 @@ const { nanoid } = require('nanoid');
 const { logger } = require('@librechat/data-schemas');
 const {
   generateCheckAccess,
+  planAgentActionUpdate,
   isActionDomainAllowed,
+  legacyActionDomainEncode,
   validateActionOAuthMetadata,
+  ACTION_CREDENTIAL_REFRESH_MESSAGE,
+  buildActionOAuthTokenDeleteQueries,
 } = require('@librechat/api');
 const {
   Permissions,
@@ -16,17 +20,19 @@ const {
   validateActionDomain,
   validateAndParseOpenAPISpec,
 } = require('librechat-data-provider');
-const {
-  legacyDomainEncode,
-  encryptMetadata,
-  domainParser,
-} = require('~/server/services/ActionService');
+const { encryptMetadata, domainParser } = require('~/server/services/ActionService');
 const { findAccessibleResources } = require('~/server/services/PermissionService');
 const db = require('~/models');
 const { canAccessAgentResource } = require('~/server/middleware');
 
 const router = express.Router();
 
+async function deleteActionOAuthTokens(action_id) {
+  await Promise.all(
+    buildActionOAuthTokenDeleteQueries(action_id).map((query) => db.deleteTokens(query)),
+  );
+}
+
 const checkAgentCreate = generateCheckAccess({
   permissionType: PermissionTypes.AGENTS,
   permissions: [Permissions.USE, Permissions.CREATE],
@@ -92,7 +98,7 @@ router.post(
         return res.status(400).json({ message: 'No functions provided' });
       }
 
-      let metadata = await encryptMetadata(removeNullishValues(_metadata, true));
+      const metadata = await encryptMetadata(removeNullishValues(_metadata, true));
       const appConfig = req.config;
 
       // SECURITY: Validate the OpenAPI spec and extract the server URL
@@ -135,15 +141,16 @@ router.post(
         return res.status(400).json({ message: 'No domain provided' });
       }
 
-      const legacyDomain = legacyDomainEncode(metadata.domain);
+      const legacyDomain = legacyActionDomainEncode(metadata.domain);
 
-      const action_id = _action_id ?? nanoid();
+      const requestedActionId = _action_id;
+      const action_id = requestedActionId ?? nanoid();
       const initialPromises = [];
 
       // Permissions already validated by middleware - load agent directly
       initialPromises.push(db.getAgent({ id: agent_id }));
-      if (_action_id) {
-        initialPromises.push(db.getActions({ action_id }, true));
+      if (requestedActionId) {
+        initialPromises.push(db.getActions({ action_id: requestedActionId }, true));
       }
 
       /** @type {[Agent, [Action|undefined]]} */
@@ -152,53 +159,51 @@ router.post(
         return res.status(404).json({ message: 'Agent not found for adding action' });
       }
 
-      if (actions_result && actions_result.length) {
-        const action = actions_result[0];
-        if (action.agent_id !== agent_id) {
+      const storedAction = actions_result?.[0];
+      if (storedAction) {
+        if (storedAction.agent_id !== agent_id) {
           return res.status(403).json({ message: 'Action does not belong to this agent' });
         }
-        metadata = { ...action.metadata, ...metadata };
+      }
+
+      const { actions: agentActions = [], tools: agentTools = [], author: agent_author } = agent;
+      const plannedUpdate = planAgentActionUpdate({
+        agentActions,
+        agentTools,
+        incomingFunctions: functions,
+        incomingMetadata: metadata,
+        actionId: action_id,
+        requestedActionId,
+        encodedDomain,
+        legacyDomain,
+        previousLegacyDomain: legacyActionDomainEncode(storedAction?.metadata?.domain),
+        storedAction,
+      });
+
+      if (plannedUpdate.requiresCredentialRefresh) {
+        return res.status(400).json({
+          message: ACTION_CREDENTIAL_REFRESH_MESSAGE,
+        });
       }
 
       try {
-        await validateActionOAuthMetadata(metadata.auth, appConfig?.actions?.allowedAddresses);
+        await validateActionOAuthMetadata(
+          plannedUpdate.metadata.auth,
+          appConfig?.actions?.allowedAddresses,
+        );
       } catch (error) {
         return res.status(400).json({ message: error.message });
       }
 
-      const { actions: _actions = [], author: agent_author } = agent ?? {};
-      const actions = [];
-      for (const action of _actions) {
-        const [_action_domain, current_action_id] = action.split(actionDelimiter);
-        if (current_action_id === action_id) {
-          continue;
-        }
-
-        actions.push(action);
+      if (plannedUpdate.deleteOAuthTokens && requestedActionId) {
+        // Keep the callback URL stable while preventing old OAuth tokens from following a new target.
+        await deleteActionOAuthTokens(requestedActionId);
       }
 
-      actions.push(`${encodedDomain}${actionDelimiter}${action_id}`);
-
-      /** @type {string[]}} */
-      const { tools: _tools = [] } = agent;
-
-      const shouldRemoveAgentTool = (tool) => {
-        if (!tool) {
-          return false;
-        }
-        return (
-          tool.includes(encodedDomain) || tool.includes(legacyDomain) || tool.includes(action_id)
-        );
-      };
-
-      const tools = _tools
-        .filter((tool) => !shouldRemoveAgentTool(tool))
-        .concat(functions.map((tool) => `${tool.function.name}${actionDelimiter}${encodedDomain}`));
-
       // Force version update since actions are changing
       const updatedAgent = await db.updateAgent(
         { id: agent_id },
-        { tools, actions },
+        { tools: plannedUpdate.tools, actions: plannedUpdate.actions },
         {
           updatingUserId: req.user.id,
           forceVersion: true,
@@ -206,14 +211,21 @@ router.post(
       );
 
       // Only update user field for new actions
-      const actionUpdateData = { metadata, agent_id };
+      const actionUpdateData = {
+        action_id: plannedUpdate.actionId,
+        metadata: plannedUpdate.metadata,
+        agent_id,
+      };
       if (!actions_result || !actions_result.length) {
         // For new actions, use the agent owner's user ID
         actionUpdateData.user = agent_author || req.user.id;
       }
 
-      /** @type {[Action]} */
-      const updatedAction = await db.updateAction({ action_id, agent_id }, actionUpdateData);
+      /** @type {Action} */
+      const updatedAction = await db.updateAction(
+        { action_id: requestedActionId ?? action_id, agent_id },
+        actionUpdateData,
+      );
 
       const sensitiveFields = ['api_key', 'oauth_client_id', 'oauth_client_secret'];
       for (let field of sensitiveFields) {
diff --git a/api/server/routes/agents/chat.js b/api/server/routes/agents/chat.js
index 0543b0b1aa6..8ffbde6552b 100644
--- a/api/server/routes/agents/chat.js
+++ b/api/server/routes/agents/chat.js
@@ -1,5 +1,5 @@
 const express = require('express');
-const { generateCheckAccess, skipAgentCheck } = require('@librechat/api');
+const { createMessageFilterPii, generateCheckAccess, skipAgentCheck } = require('@librechat/api');
 const { PermissionTypes, Permissions, PermissionBits } = require('librechat-data-provider');
 const {
   moderateText,
@@ -25,6 +25,7 @@ const checkAgentResourceAccess = canAccessAgentFromBody({
   requiredPermission: PermissionBits.VIEW,
 });
 
+router.use(createMessageFilterPii({ getConfig: (req) => req.config?.messageFilter?.pii }));
 router.use(moderateText);
 router.use(checkAgentAccess);
 router.use(checkAgentResourceAccess);
diff --git a/api/server/routes/agents/index.js b/api/server/routes/agents/index.js
index f7076ce153b..145a6c03161 100644
--- a/api/server/routes/agents/index.js
+++ b/api/server/routes/agents/index.js
@@ -1,5 +1,10 @@
 const express = require('express');
-const { isEnabled, GenerationJobManager } = require('@librechat/api');
+const {
+  isEnabled,
+  GenerationJobManager,
+  hasPersistableAbortContent,
+  buildAbortedResponseMetadata,
+} = require('@librechat/api');
 const { createSseStreamTelemetry } = require('@librechat/api/telemetry');
 const { logger } = require('@librechat/data-schemas');
 const {
@@ -43,8 +48,6 @@ router.use(requireJwtAuth);
 router.use(checkBan);
 router.use(uaParser);
 
-router.use('/', v1);
-
 /**
  * Stream endpoints - mounted before chatRouter to bypass rate limiters
  * These are GET requests and don't need message body validation or rate limiting
@@ -273,7 +276,8 @@ router.post('/chat/abort', async (req, res) => {
     if (
       abortResult.success &&
       abortResult.jobData?.userMessage?.messageId &&
-      abortResult.jobData?.responseMessageId
+      abortResult.jobData?.responseMessageId &&
+      hasPersistableAbortContent(abortResult.content)
     ) {
       const { jobData, content, text } = abortResult;
       const responseMessage = {
@@ -284,6 +288,7 @@ router.post('/chat/abort', async (req, res) => {
         text: text || '',
         sender: jobData.sender || 'AI',
         endpoint: jobData.endpoint,
+        iconURL: jobData.iconURL,
         model: jobData.model,
         unfinished: true,
         error: false,
@@ -291,6 +296,15 @@ router.post('/chat/abort', async (req, res) => {
         user: userId,
       };
 
+      /** Persist the usage/cost rollup + context breakdown for the stopped
+       *  response (from the job's tracked tokenUsage/contextUsage) so its
+       *  branch/total cost and granular rows survive a reload — parity with the
+       *  normal completion path. */
+      const abortMetadata = buildAbortedResponseMetadata(jobData);
+      if (abortMetadata) {
+        responseMessage.metadata = abortMetadata;
+      }
+
       try {
         await saveMessage(
           {
@@ -314,6 +328,8 @@ router.post('/chat/abort', async (req, res) => {
   return res.status(404).json({ error: 'Job not found', streamId: jobStreamId });
 });
 
+router.use('/', v1);
+
 const chatRouter = express.Router();
 chatRouter.use(configMiddleware);
 
diff --git a/api/server/routes/auth.2fa-ratelimit.test.js b/api/server/routes/auth.2fa-ratelimit.test.js
new file mode 100644
index 00000000000..35cc0e8840a
--- /dev/null
+++ b/api/server/routes/auth.2fa-ratelimit.test.js
@@ -0,0 +1,120 @@
+const express = require('express');
+const request = require('supertest');
+
+const mockSetTwoFactorTempUser = jest.fn((req, res, next) => next());
+const mockTwoFactorTempLimiter = jest.fn((req, res, next) => next());
+const mockCheckBan = jest.fn((req, res, next) => next());
+const mockVerify2FAWithTempToken = jest.fn((req, res) => res.status(204).end());
+
+jest.mock('@librechat/api', () => ({
+  createSetBalanceConfig: jest.fn(() => (req, res, next) => next()),
+  forceRefreshCloudFrontAuthCookies: jest.fn(),
+}));
+
+jest.mock('~/server/controllers/AuthController', () => ({
+  refreshController: jest.fn((req, res) => res.status(204).end()),
+  registrationController: jest.fn((req, res) => res.status(204).end()),
+  resetPasswordController: jest.fn((req, res) => res.status(204).end()),
+  resetPasswordRequestController: jest.fn((req, res) => res.status(204).end()),
+  graphTokenController: jest.fn((req, res) => res.status(204).end()),
+}));
+
+jest.mock('~/server/controllers/TwoFactorController', () => ({
+  enable2FA: jest.fn((req, res) => res.status(204).end()),
+  verify2FA: jest.fn((req, res) => res.status(204).end()),
+  confirm2FA: jest.fn((req, res) => res.status(204).end()),
+  disable2FA: jest.fn((req, res) => res.status(204).end()),
+  regenerateBackupCodes: jest.fn((req, res) => res.status(204).end()),
+}));
+
+jest.mock('~/server/controllers/auth/TwoFactorAuthController', () => ({
+  verify2FAWithTempToken: (...args) => mockVerify2FAWithTempToken(...args),
+}));
+
+jest.mock('~/server/controllers/auth/LogoutController', () => ({
+  logoutController: jest.fn((req, res) => res.status(204).end()),
+}));
+
+jest.mock('~/server/controllers/auth/LoginController', () => ({
+  loginController: jest.fn((req, res) => res.status(204).end()),
+}));
+
+jest.mock('~/models', () => ({
+  findBalanceByUser: jest.fn(),
+  upsertBalanceFields: jest.fn(),
+}));
+
+jest.mock('~/server/services/Config', () => ({
+  getAppConfig: jest.fn(),
+}));
+
+jest.mock('~/server/middleware', () => {
+  const pass = (req, res, next) => next();
+  return {
+    logHeaders: pass,
+    loginLimiter: pass,
+    setTwoFactorTempUser: (...args) => mockSetTwoFactorTempUser(...args),
+    twoFactorTempLimiter: (...args) => mockTwoFactorTempLimiter(...args),
+    checkBan: (...args) => mockCheckBan(...args),
+    requireLocalAuth: pass,
+    requireLdapAuth: pass,
+    registerLimiter: pass,
+    checkInviteUser: pass,
+    validateRegistration: pass,
+    resetPasswordLimiter: pass,
+    validatePasswordReset: pass,
+    requireJwtAuth: pass,
+  };
+});
+
+const authRouter = require('./auth');
+
+describe('POST /api/auth/2fa/verify-temp rate limiting', () => {
+  let app;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockSetTwoFactorTempUser.mockImplementation((req, res, next) => next());
+    mockTwoFactorTempLimiter.mockImplementation((req, res, next) => next());
+    mockCheckBan.mockImplementation((req, res, next) => next());
+    mockVerify2FAWithTempToken.mockImplementation((req, res) => res.status(204).end());
+
+    app = express();
+    app.use(express.json());
+    app.use('/api/auth', authRouter);
+  });
+
+  it('sets the temp user before limiting, checking bans, and verifying temp 2FA tokens', async () => {
+    await request(app).post('/api/auth/2fa/verify-temp').send({ token: '123456' }).expect(204);
+
+    expect(mockSetTwoFactorTempUser).toHaveBeenCalledTimes(1);
+    expect(mockTwoFactorTempLimiter).toHaveBeenCalledTimes(1);
+    expect(mockCheckBan).toHaveBeenCalledTimes(1);
+    expect(mockVerify2FAWithTempToken).toHaveBeenCalledTimes(1);
+    expect(mockSetTwoFactorTempUser.mock.invocationCallOrder[0]).toBeLessThan(
+      mockTwoFactorTempLimiter.mock.invocationCallOrder[0],
+    );
+    expect(mockTwoFactorTempLimiter.mock.invocationCallOrder[0]).toBeLessThan(
+      mockCheckBan.mock.invocationCallOrder[0],
+    );
+    expect(mockCheckBan.mock.invocationCallOrder[0]).toBeLessThan(
+      mockVerify2FAWithTempToken.mock.invocationCallOrder[0],
+    );
+  });
+
+  it('does not verify the temp 2FA token after the limiter rejects the request', async () => {
+    mockTwoFactorTempLimiter.mockImplementation((req, res) =>
+      res.status(429).json({ message: 'Too many verification attempts' }),
+    );
+
+    const response = await request(app)
+      .post('/api/auth/2fa/verify-temp')
+      .send({ token: '123456' })
+      .expect(429);
+
+    expect(response.body).toEqual({ message: 'Too many verification attempts' });
+    expect(mockSetTwoFactorTempUser).toHaveBeenCalledTimes(1);
+    expect(mockCheckBan).not.toHaveBeenCalled();
+    expect(mockVerify2FAWithTempToken).not.toHaveBeenCalled();
+  });
+});
diff --git a/api/server/routes/auth.cloudfront.test.js b/api/server/routes/auth.cloudfront.test.js
index 9d50ac97a71..ae786291046 100644
--- a/api/server/routes/auth.cloudfront.test.js
+++ b/api/server/routes/auth.cloudfront.test.js
@@ -50,6 +50,8 @@ jest.mock('~/server/middleware', () => {
   return {
     logHeaders: pass,
     loginLimiter: pass,
+    setTwoFactorTempUser: pass,
+    twoFactorTempLimiter: pass,
     checkBan: pass,
     requireLocalAuth: pass,
     requireLdapAuth: pass,
diff --git a/api/server/routes/auth.js b/api/server/routes/auth.js
index e2fc08187da..14c4e863897 100644
--- a/api/server/routes/auth.js
+++ b/api/server/routes/auth.js
@@ -87,7 +87,13 @@ router.post(
 
 router.post('/2fa/enable', middleware.requireJwtAuth, enable2FA);
 router.post('/2fa/verify', middleware.requireJwtAuth, verify2FA);
-router.post('/2fa/verify-temp', middleware.checkBan, verify2FAWithTempToken);
+router.post(
+  '/2fa/verify-temp',
+  middleware.setTwoFactorTempUser,
+  middleware.twoFactorTempLimiter,
+  middleware.checkBan,
+  verify2FAWithTempToken,
+);
 router.post('/2fa/confirm', middleware.requireJwtAuth, confirm2FA);
 router.post('/2fa/disable', middleware.requireJwtAuth, disable2FA);
 router.post('/2fa/backup/regenerate', middleware.requireJwtAuth, regenerateBackupCodes);
diff --git a/api/server/routes/convos.js b/api/server/routes/convos.js
index dc59482afa7..c9d77189cdd 100644
--- a/api/server/routes/convos.js
+++ b/api/server/routes/convos.js
@@ -5,6 +5,8 @@ const {
   isEnabled,
   resolveImportMaxFileSize,
   restoreTenantContextFromReq,
+  deleteAllSharedLinksWithCleanup,
+  deleteConvoSharedLinksWithCleanup,
 } = require('@librechat/api');
 const { logger } = require('@librechat/data-schemas');
 const { CacheKeys, EModelEndpoint } = require('librechat-data-provider');
@@ -29,6 +31,9 @@ const assistantClients = {
 const router = express.Router();
 router.use(requireJwtAuth);
 
+const isValidProjectFilter = (projectId) =>
+  !projectId || projectId === 'unassigned' || /^[a-f\d]{24}$/i.test(projectId);
+
 router.get('/', async (req, res) => {
   const limit = parseInt(req.query.limit, 10) || 25;
   const cursor = req.query.cursor;
@@ -36,6 +41,13 @@ router.get('/', async (req, res) => {
   const search = req.query.search ? decodeURIComponent(req.query.search) : undefined;
   const sortBy = req.query.sortBy || 'updatedAt';
   const sortDirection = req.query.sortDirection || 'desc';
+  const projectId = Array.isArray(req.query.projectId)
+    ? req.query.projectId[0]
+    : req.query.projectId;
+
+  if (!isValidProjectFilter(projectId)) {
+    return res.status(400).json({ error: 'projectId must be a valid project id or unassigned' });
+  }
 
   let tags;
   if (req.query.tags) {
@@ -51,6 +63,7 @@ router.get('/', async (req, res) => {
       search,
       sortBy,
       sortDirection,
+      projectId,
     });
     res.status(200).json(result);
   } catch (error) {
@@ -133,7 +146,7 @@ router.delete('/', async (req, res) => {
     const dbResponse = await db.deleteConvos(req.user.id, filter);
     if (filter.conversationId) {
       await db.deleteToolCalls(req.user.id, filter.conversationId);
-      await db.deleteConvoSharedLink(req.user.id, filter.conversationId);
+      await deleteConvoSharedLinksWithCleanup(req.user.id, filter.conversationId);
     }
     res.status(201).json(dbResponse);
   } catch (error) {
@@ -146,7 +159,7 @@ router.delete('/all', async (req, res) => {
   try {
     const dbResponse = await db.deleteConvos(req.user.id, {});
     await db.deleteToolCalls(req.user.id);
-    await db.deleteAllSharedLinks(req.user.id);
+    await deleteAllSharedLinksWithCleanup(req.user.id);
     res.status(201).json(dbResponse);
   } catch (error) {
     logger.error('Error clearing conversations', error);
diff --git a/api/server/routes/endpoints.js b/api/server/routes/endpoints.js
index e7ff1c70000..b11de153df6 100644
--- a/api/server/routes/endpoints.js
+++ b/api/server/routes/endpoints.js
@@ -1,9 +1,14 @@
 const express = require('express');
 const requireJwtAuth = require('~/server/middleware/requireJwtAuth');
+const configMiddleware = require('~/server/middleware/config/app');
 const endpointController = require('~/server/controllers/EndpointController');
+const tokenConfigController = require('~/server/controllers/TokenConfigController');
+const contextProjectionController = require('~/server/controllers/ContextProjectionController');
 
 const router = express.Router();
 /** Auth required for role/tenant-scoped endpoint config resolution. */
 router.get('/', requireJwtAuth, endpointController);
+router.get('/token-config', requireJwtAuth, configMiddleware, tokenConfigController);
+router.post('/context-projection', requireJwtAuth, configMiddleware, contextProjectionController);
 
 module.exports = router;
diff --git a/api/server/routes/files/multer.js b/api/server/routes/files/multer.js
index cb155e2ac27..da17ce8008a 100644
--- a/api/server/routes/files/multer.js
+++ b/api/server/routes/files/multer.js
@@ -5,6 +5,7 @@ const multer = require('multer');
 const { sanitizeFilename } = require('@librechat/api');
 const {
   mergeFileConfig,
+  inferMimeType,
   getEndpointFileConfig,
   fileConfig: defaultFileConfig,
 } = require('librechat-data-provider');
@@ -37,6 +38,14 @@ const importFileFilter = (req, file, cb) => {
   }
 };
 
+const normalizeUploadMimeType = (file) => {
+  const mimeType = inferMimeType(file.originalname || '', file.mimetype || '');
+  if (mimeType && file.mimetype !== mimeType) {
+    file.mimetype = mimeType;
+  }
+  return mimeType;
+};
+
 /**
  *
  * @param {import('librechat-data-provider').FileConfig | undefined} customFileConfig
@@ -52,7 +61,9 @@ const createFileFilter = (customFileConfig) => {
       return cb(new Error('No file provided'), false);
     }
 
-    if (req.originalUrl.endsWith('/speech/stt') && file.mimetype.startsWith('audio/')) {
+    const mimeType = normalizeUploadMimeType(file);
+
+    if (req.originalUrl.endsWith('/speech/stt') && mimeType.startsWith('audio/')) {
       return cb(null, true);
     }
 
@@ -64,8 +75,8 @@ const createFileFilter = (customFileConfig) => {
       endpointType,
     });
 
-    if (!defaultFileConfig.checkType(file.mimetype, endpointFileConfig.supportedMimeTypes)) {
-      return cb(new Error('Unsupported file type: ' + file.mimetype), false);
+    if (!defaultFileConfig.checkType(mimeType, endpointFileConfig.supportedMimeTypes)) {
+      return cb(new Error('Unsupported file type: ' + (file.mimetype || mimeType)), false);
     }
 
     cb(null, true);
@@ -85,4 +96,4 @@ const createMulterInstance = async () => {
   });
 };
 
-module.exports = { createMulterInstance, storage, importFileFilter };
+module.exports = { createMulterInstance, storage, importFileFilter, createFileFilter };
diff --git a/api/server/routes/files/multer.spec.js b/api/server/routes/files/multer.spec.js
index 84b97fe7896..23b7a2458a3 100644
--- a/api/server/routes/files/multer.spec.js
+++ b/api/server/routes/files/multer.spec.js
@@ -4,7 +4,7 @@ const fs = require('fs');
 const os = require('os');
 const path = require('path');
 const crypto = require('crypto');
-const { createMulterInstance, storage, importFileFilter } = require('./multer');
+const { createMulterInstance, storage, importFileFilter, createFileFilter } = require('./multer');
 
 // Mock only the config service that requires external dependencies
 jest.mock('~/server/services/Config', () => ({
@@ -281,6 +281,25 @@ describe('Multer Configuration', () => {
       }
     });
 
+    it('should infer ZIP MIME type when multipart upload omits it', (done) => {
+      const { mergeFileConfig } = require('librechat-data-provider');
+      const fileFilter = createFileFilter(mergeFileConfig());
+      const zipFile = {
+        ...mockFile,
+        originalname: 'archive.zip',
+        mimetype: '',
+      };
+
+      const cb = jest.fn((err, result) => {
+        expect(err).toBeNull();
+        expect(result).toBe(true);
+        expect(zipFile.mimetype).toBe('application/zip');
+        done();
+      });
+
+      fileFilter(mockReq, zipFile, cb);
+    });
+
     it('should use real mergeFileConfig function', async () => {
       const { mergeFileConfig, mbToBytes } = require('librechat-data-provider');
 
diff --git a/api/server/routes/index.js b/api/server/routes/index.js
index 6694e47f23e..59955e937e6 100644
--- a/api/server/routes/index.js
+++ b/api/server/routes/index.js
@@ -6,12 +6,14 @@ const adminConfig = require('./admin/config');
 const adminGrants = require('./admin/grants');
 const adminGroups = require('./admin/groups');
 const adminRoles = require('./admin/roles');
+const adminSkills = require('./admin/skills');
 const adminUsers = require('./admin/users');
 const endpoints = require('./endpoints');
 const staticRoute = require('./static');
 const messages = require('./messages');
 const memories = require('./memories');
 const presets = require('./presets');
+const projects = require('./projects');
 const prompts = require('./prompts');
 const skills = require('./skills');
 const balance = require('./balance');
@@ -43,6 +45,7 @@ module.exports = {
   adminGrants,
   adminGroups,
   adminRoles,
+  adminSkills,
   adminUsers,
   keys,
   apiKeys,
@@ -59,6 +62,7 @@ module.exports = {
   config,
   models,
   prompts,
+  projects,
   skills,
   actions,
   presets,
diff --git a/api/server/routes/mcp.js b/api/server/routes/mcp.js
index 09d6b7d49ad..1637b8f7e19 100644
--- a/api/server/routes/mcp.js
+++ b/api/server/routes/mcp.js
@@ -14,6 +14,7 @@ const {
   MCPTokenStorage,
   setOAuthSession,
   PENDING_STALE_MS,
+  mcpConfig: mcpSettings,
   getUserMCPAuthMap,
   validateOAuthCsrf,
   OAUTH_CSRF_COOKIE,
@@ -38,6 +39,7 @@ const {
 } = require('~/config');
 const {
   getServerConnectionStatus,
+  resolveAllMcpConfigs,
   resolveConfigServers,
   getMCPSetupData,
 } = require('~/server/services/MCP');
@@ -52,6 +54,29 @@ const router = Router();
 
 const OAUTH_CSRF_COOKIE_PATH = '/api/mcp';
 
+const getOAuthFlowId = (userId, serverName) =>
+  MCPOAuthHandler.generateFlowId(userId, serverName, getTenantId());
+
+const canAccessOAuthFlow = (flowId, userId) => {
+  const parsed = MCPOAuthHandler.parseFlowId(flowId);
+  if (!parsed) {
+    return false;
+  }
+  if (parsed.tenantId && parsed.tenantId !== getTenantId()) {
+    return false;
+  }
+  return parsed.userId === userId || parsed.userId === 'system';
+};
+
+const clearGetTokensFlow = async ({ flowManager, flowId, tokens }) => {
+  const state = await flowManager.getFlowState(flowId, 'mcp_get_tokens');
+  if (state?.type === 'mcp_get_tokens' && state.status === 'PENDING') {
+    await flowManager.completeFlow(flowId, 'mcp_get_tokens', tokens);
+    return;
+  }
+  await flowManager.deleteFlow(flowId, 'mcp_get_tokens');
+};
+
 const checkMCPUsePermissions = generateCheckAccess({
   permissionType: PermissionTypes.MCP_SERVERS,
   permissions: [Permissions.USE],
@@ -83,10 +108,21 @@ router.get('/:serverName/oauth/initiate', requireJwtAuth, setOAuthSession, async
     const user = req.user;
 
     // Verify the userId matches the authenticated user
-    if (userId !== user.id) {
+    if (typeof userId !== 'string' || userId !== user.id) {
       return res.status(403).json({ error: 'User mismatch' });
     }
 
+    const expectedFlowId = getOAuthFlowId(user.id, serverName);
+    if (typeof flowId !== 'string' || flowId !== expectedFlowId) {
+      logger.error('[MCP OAuth] Invalid flow ID for initiate request', {
+        serverName,
+        userId,
+        flowId,
+        expectedFlowId,
+      });
+      return res.status(403).json({ error: 'Flow mismatch' });
+    }
+
     logger.debug('[MCP OAuth] Initiate request', { serverName, userId, flowId });
 
     const flowsCache = getLogStores(CacheKeys.FLOWS);
@@ -99,7 +135,45 @@ router.get('/:serverName/oauth/initiate', requireJwtAuth, setOAuthSession, async
       return res.status(404).json({ error: 'Flow not found' });
     }
 
-    const { serverUrl, oauth: oauthConfig } = flowState.metadata || {};
+    const {
+      authorizationUrl: storedAuthorizationUrl,
+      serverName: flowServerName,
+      userId: flowUserId,
+      serverUrl,
+      oauth: oauthConfig,
+    } = flowState.metadata || {};
+
+    if (flowUserId && flowUserId !== user.id) {
+      logger.error('[MCP OAuth] Flow user mismatch', { flowId, userId, flowUserId });
+      return res.status(403).json({ error: 'User mismatch' });
+    }
+
+    if (flowServerName && flowServerName !== serverName) {
+      logger.error('[MCP OAuth] Flow server mismatch', { flowId, serverName, flowServerName });
+      return res.status(400).json({ error: 'Invalid flow state' });
+    }
+
+    const pendingAge = flowState.createdAt ? Date.now() - flowState.createdAt : Infinity;
+    const isFreshPendingFlow = flowState.status === 'PENDING' && pendingAge < PENDING_STALE_MS;
+    if (!isFreshPendingFlow) {
+      logger.error('[MCP OAuth] Flow is not active for initiation', {
+        flowId,
+        status: flowState.status,
+        pendingAge,
+      });
+      return res.status(400).json({ error: 'Invalid flow state' });
+    }
+
+    if (typeof storedAuthorizationUrl === 'string' && storedAuthorizationUrl.length > 0) {
+      logger.debug('[MCP OAuth] Reusing stored authorization URL', {
+        serverName,
+        userId,
+        flowId,
+      });
+      setOAuthCsrfCookie(res, flowId, OAUTH_CSRF_COOKIE_PATH);
+      return res.redirect(storedAuthorizationUrl);
+    }
+
     if (!serverUrl || !oauthConfig) {
       logger.error('[MCP OAuth] Missing server URL or OAuth config in flow state');
       return res.status(400).json({ error: 'Invalid flow state' });
@@ -108,8 +182,10 @@ router.get('/:serverName/oauth/initiate', requireJwtAuth, setOAuthSession, async
     const configServers = await resolveConfigServers(req);
     const oauthHeaders = await getOAuthHeaders(serverName, userId, configServers);
     const registry = getMCPServersRegistry();
-    const allowedDomains = registry.getAllowedDomains();
-    const allowedAddresses = registry.getAllowedAddresses();
+    const { allowedDomains, allowedAddresses } = await registry.resolveAllowlists({
+      userId,
+      role: req.user?.role,
+    });
     const {
       authorizationUrl,
       flowId: oauthFlowId,
@@ -123,10 +199,17 @@ router.get('/:serverName/oauth/initiate', requireJwtAuth, setOAuthSession, async
       allowedDomains,
       undefined,
       allowedAddresses,
+      getTenantId(),
     );
 
     logger.debug('[MCP OAuth] OAuth flow initiated', { oauthFlowId, authorizationUrl });
 
+    const oldState = flowState.metadata?.state;
+    if (typeof oldState === 'string') {
+      await MCPOAuthHandler.deleteStateMapping(oldState, flowManager);
+    }
+    const metadataWithUrl = { ...flowMetadata, authorizationUrl, tenantId: getTenantId() };
+    await flowManager.initFlow(oauthFlowId, 'mcp_oauth', metadataWithUrl);
     await MCPOAuthHandler.storeStateMapping(flowMetadata.state, oauthFlowId, flowManager);
     setOAuthCsrfCookie(res, oauthFlowId, OAUTH_CSRF_COOKIE_PATH);
     res.redirect(authorizationUrl);
@@ -162,16 +245,21 @@ router.get('/:serverName/oauth/callback', async (req, res) => {
           const flowManager = getFlowStateManager(flowsCache);
           const flowId = await MCPOAuthHandler.resolveStateToFlowId(state, flowManager);
           if (flowId) {
-            const flowParts = flowId.split(':');
-            const [flowUserId] = flowParts;
-            const hasCsrf = validateOAuthCsrf(req, res, flowId, OAUTH_CSRF_COOKIE_PATH);
-            const hasSession = !hasCsrf && validateOAuthSession(req, flowUserId);
-            if (hasCsrf || hasSession) {
-              await flowManager.failFlow(flowId, 'mcp_oauth', String(oauthError));
-              logger.debug('[MCP OAuth] Marked flow as FAILED with OAuth error', {
+            const parsed = MCPOAuthHandler.parseFlowId(flowId);
+            if (!parsed) {
+              logger.warn('[MCP OAuth] Invalid flow ID format for OAuth error callback', {
                 flowId,
-                error: oauthError,
               });
+            } else {
+              const hasCsrf = validateOAuthCsrf(req, res, flowId, OAUTH_CSRF_COOKIE_PATH);
+              const hasSession = !hasCsrf && validateOAuthSession(req, parsed.userId);
+              if (hasCsrf || hasSession) {
+                await flowManager.failFlow(flowId, 'mcp_oauth', String(oauthError));
+                logger.debug('[MCP OAuth] Marked flow as FAILED with OAuth error', {
+                  flowId,
+                  error: oauthError,
+                });
+              }
             }
           }
         } catch (err) {
@@ -203,16 +291,14 @@ router.get('/:serverName/oauth/callback', async (req, res) => {
     }
     logger.debug('[MCP OAuth] Resolved flow ID from state', { flowId });
 
-    const flowParts = flowId.split(':');
-    if (flowParts.length < 2 || !flowParts[0] || !flowParts[1]) {
+    const parsedFlowId = MCPOAuthHandler.parseFlowId(flowId);
+    if (!parsedFlowId) {
       logger.error('[MCP OAuth] Invalid flow ID format', { flowId });
       return res.redirect(`${basePath}/oauth/error?error=invalid_state`);
     }
 
-    const [flowUserId] = flowParts;
-
     const hasCsrf = validateOAuthCsrf(req, res, flowId, OAUTH_CSRF_COOKIE_PATH);
-    const hasSession = !hasCsrf && validateOAuthSession(req, flowUserId);
+    const hasSession = !hasCsrf && validateOAuthSession(req, parsedFlowId.userId);
     let hasActiveFlow = false;
     if (!hasCsrf && !hasSession) {
       const pendingFlow = await flowManager.getFlowState(flowId, 'mcp_oauth');
@@ -309,7 +395,10 @@ router.get('/:serverName/oauth/callback', async (req, res) => {
             updateToken: db.updateToken,
             findToken: db.findToken,
             clientInfo: flowState.clientInfo,
-            metadata: flowState.metadata,
+            metadata: MCPOAuthHandler.buildStoredClientMetadata(
+              flowState.metadata,
+              flowState.resourceMetadata,
+            ),
           });
           logger.debug('[MCP OAuth] Stored OAuth tokens prior to reconnection', {
             serverName,
@@ -326,7 +415,23 @@ router.get('/:serverName/oauth/callback', async (req, res) => {
          */
         if (typeof flowManager?.deleteFlow === 'function') {
           try {
-            await flowManager.deleteFlow(flowId, 'mcp_get_tokens');
+            const tokenFlowId = MCPOAuthHandler.generateTokenFlowId(
+              flowState.userId,
+              serverName,
+              flowState.tenantId,
+            );
+            await clearGetTokensFlow({
+              flowManager,
+              flowId: tokenFlowId,
+              tokens,
+            });
+            if (tokenFlowId !== flowId) {
+              await clearGetTokensFlow({
+                flowManager,
+                flowId,
+                tokens,
+              });
+            }
           } catch (error) {
             logger.warn('[MCP OAuth] Failed to clear cached token flow state', error);
           }
@@ -340,10 +445,25 @@ router.get('/:serverName/oauth/callback', async (req, res) => {
         if (flowState.userId !== 'system') {
           const user = { id: flowState.userId };
 
+          /** Merged config (incl. Config-tier overlays) so the reconnection and
+           *  the cache gate both see request-scoped servers the base registry
+           *  lookup misses */
+          let serverConfig;
+          try {
+            const allConfigs = await resolveAllMcpConfigs(flowState.userId);
+            serverConfig = allConfigs?.[serverName];
+          } catch (error) {
+            logger.warn(
+              `[MCP OAuth] Could not resolve server config for ${serverName} before reconnecting:`,
+              error,
+            );
+          }
+
           const userConnection = await mcpManager.getUserConnection({
             user,
             serverName,
             flowManager,
+            serverConfig,
             tokenMethods: {
               findToken: db.findToken,
               updateToken: db.updateToken,
@@ -364,6 +484,7 @@ router.get('/:serverName/oauth/callback', async (req, res) => {
             userId: flowState.userId,
             serverName,
             tools,
+            serverConfig,
           });
         } else {
           logger.debug(`[MCP OAuth] System-level OAuth completed for ${serverName}`);
@@ -411,7 +532,7 @@ router.get('/oauth/tokens/:flowId', requireJwtAuth, async (req, res) => {
       return res.status(401).json({ error: 'User not authenticated' });
     }
 
-    if (!flowId.startsWith(`${user.id}:`) && !flowId.startsWith('system:')) {
+    if (!canAccessOAuthFlow(flowId, user.id)) {
       return res.status(403).json({ error: 'Access denied' });
     }
 
@@ -448,7 +569,7 @@ router.post('/:serverName/oauth/bind', requireJwtAuth, setOAuthSession, async (r
       return res.status(401).json({ error: 'User not authenticated' });
     }
 
-    const flowId = MCPOAuthHandler.generateFlowId(user.id, serverName);
+    const flowId = getOAuthFlowId(user.id, serverName);
     setOAuthCsrfCookie(res, flowId, OAUTH_CSRF_COOKIE_PATH);
 
     res.json({ success: true });
@@ -471,7 +592,7 @@ router.get('/oauth/status/:flowId', requireJwtAuth, async (req, res) => {
       return res.status(401).json({ error: 'User not authenticated' });
     }
 
-    if (!flowId.startsWith(`${user.id}:`) && !flowId.startsWith('system:')) {
+    if (!canAccessOAuthFlow(flowId, user.id)) {
       return res.status(403).json({ error: 'Access denied' });
     }
 
@@ -512,7 +633,7 @@ router.post('/oauth/cancel/:serverName', requireJwtAuth, async (req, res) => {
 
     const flowsCache = getLogStores(CacheKeys.FLOWS);
     const flowManager = getFlowStateManager(flowsCache);
-    const flowId = MCPOAuthHandler.generateFlowId(user.id, serverName);
+    const flowId = getOAuthFlowId(user.id, serverName);
     const flowState = await flowManager.getFlowState(flowId, 'mcp_oauth');
 
     if (!flowState) {
@@ -600,7 +721,7 @@ router.post(
       const { success, message, oauthRequired, oauthUrl } = result;
 
       if (oauthRequired) {
-        const flowId = MCPOAuthHandler.generateFlowId(user.id, serverName);
+        const flowId = getOAuthFlowId(user.id, serverName);
         setOAuthCsrfCookie(res, flowId, OAUTH_CSRF_COOKIE_PATH);
       }
 
@@ -660,6 +781,7 @@ router.get('/connection/status', requireJwtAuth, async (req, res) => {
     res.json({
       success: true,
       connectionStatus,
+      oauthTimeout: mcpSettings.OAUTH_HANDLING_TIMEOUT,
     });
   } catch (error) {
     logger.error('[MCP Connection Status] Failed to get connection status', error);
diff --git a/api/server/routes/messages.js b/api/server/routes/messages.js
index a07293c0e2c..17e740c5151 100644
--- a/api/server/routes/messages.js
+++ b/api/server/routes/messages.js
@@ -1,8 +1,13 @@
 const express = require('express');
 const { v4: uuidv4 } = require('uuid');
 const { logger } = require('@librechat/data-schemas');
-const { ContentTypes } = require('librechat-data-provider');
-const { unescapeLaTeX, countTokens } = require('@librechat/api');
+const { ContentTypes, isAssistantsEndpoint } = require('librechat-data-provider');
+const {
+  unescapeLaTeX,
+  countTokens,
+  sendFeedbackScore,
+  traceIdForMessage,
+} = require('@librechat/api');
 const { findAllArtifacts, replaceArtifactContent } = require('~/server/services/Artifacts/update');
 const { requireJwtAuth, validateMessageReq } = require('~/server/middleware');
 const db = require('~/models');
@@ -391,6 +396,25 @@ router.put('/:conversationId/:messageId/feedback', validateMessageReq, async (re
       { context: 'updateFeedback' },
     );
 
+    // Best-effort: Assistants messages do not have deterministic AgentRun traces.
+    if (!isAssistantsEndpoint(updatedMessage.endpoint)) {
+      sendFeedbackScore({
+        traceId: traceIdForMessage(messageId),
+        feedback: updatedMessage.feedback,
+        metadata: {
+          messageId: updatedMessage.messageId ?? messageId,
+          parentMessageId: updatedMessage.parentMessageId,
+          conversationId: updatedMessage.conversationId ?? conversationId,
+          sessionId: updatedMessage.conversationId ?? conversationId,
+          userId: req?.user?.id,
+          endpoint: updatedMessage.endpoint,
+          sender: updatedMessage.sender,
+          isCreatedByUser: updatedMessage.isCreatedByUser,
+          tokenCount: updatedMessage.tokenCount,
+        },
+      }).catch((err) => logger.error('[langfuse] feedback score failed:', err));
+    }
+
     res.json({
       messageId,
       conversationId,
diff --git a/api/server/routes/projects.js b/api/server/routes/projects.js
new file mode 100644
index 00000000000..fd782a1ba5d
--- /dev/null
+++ b/api/server/routes/projects.js
@@ -0,0 +1,25 @@
+const express = require('express');
+const { createProjectHandlers } = require('@librechat/api');
+const requireJwtAuth = require('~/server/middleware/requireJwtAuth');
+const db = require('~/models');
+
+const router = express.Router();
+const handlers = createProjectHandlers({
+  listChatProjects: db.listChatProjects,
+  createChatProject: db.createChatProject,
+  getChatProject: db.getChatProject,
+  updateChatProject: db.updateChatProject,
+  deleteChatProject: db.deleteChatProject,
+  assignConversationToProject: db.assignConversationToProject,
+});
+
+router.use(requireJwtAuth);
+
+router.get('/', handlers.listProjects);
+router.post('/', handlers.createProject);
+router.put('/conversations/:conversationId', handlers.assignConversationToProject);
+router.get('/:projectId', handlers.getProject);
+router.patch('/:projectId', handlers.updateProject);
+router.delete('/:projectId', handlers.deleteProject);
+
+module.exports = router;
diff --git a/api/server/routes/rum.js b/api/server/routes/rum.js
index b407992e1e8..cc5c2f281a4 100644
--- a/api/server/routes/rum.js
+++ b/api/server/routes/rum.js
@@ -1,6 +1,6 @@
 const express = require('express');
 const { getRumProxyBodyLimit, isRumProxyEnabled, proxyRumRequest } = require('@librechat/api');
-const { requireJwtAuth } = require('~/server/middleware');
+const { requireRumProxyAuth } = require('~/server/middleware');
 
 const router = express.Router();
 const rawOtlpBody = express.raw({
@@ -16,7 +16,13 @@ function requireRumProxyEnabled(_req, res, next) {
   return next();
 }
 
-router.post('/v1/traces', requireRumProxyEnabled, requireJwtAuth, rawOtlpBody, proxyRumRequest);
-router.post('/v1/logs', requireRumProxyEnabled, requireJwtAuth, rawOtlpBody, proxyRumRequest);
+router.post(
+  '/v1/traces',
+  requireRumProxyEnabled,
+  requireRumProxyAuth,
+  rawOtlpBody,
+  proxyRumRequest,
+);
+router.post('/v1/logs', requireRumProxyEnabled, requireRumProxyAuth, rawOtlpBody, proxyRumRequest);
 
 module.exports = router;
diff --git a/api/server/routes/share.js b/api/server/routes/share.js
index ce4dee1a1f4..03cc00fbc2c 100644
--- a/api/server/routes/share.js
+++ b/api/server/routes/share.js
@@ -1,18 +1,36 @@
 const mongoose = require('mongoose');
 const express = require('express');
-const { isEnabled, isActiveExpirationDate, getSharedLinkExpiration } = require('@librechat/api');
+const {
+  isEnabled,
+  generateCheckAccess,
+  grantCreationPermissions,
+  ensureLinkPermissions,
+  deleteSharedLinkWithCleanup,
+  updateSharedLinkPermissionsExpiration,
+  isActiveExpirationDate,
+  getSharedLinkExpiration,
+} = require('@librechat/api');
 const { logger, createTempChatExpirationDate } = require('@librechat/data-schemas');
+const { PermissionTypes, Permissions } = require('librechat-data-provider');
 const {
   getSharedMessages,
   createSharedLink,
   updateSharedLink,
-  deleteSharedLink,
   getSharedLinks,
   getSharedLink,
+  getRoleByName,
 } = require('~/models');
+const canAccessSharedLink = require('~/server/middleware/canAccessSharedLink');
+const optionalJwtAuth = require('~/server/middleware/optionalJwtAuth');
 const requireJwtAuth = require('~/server/middleware/requireJwtAuth');
 const router = express.Router();
 
+const checkSharedLinksAccess = generateCheckAccess({
+  permissionType: PermissionTypes.SHARED_LINKS,
+  permissions: [Permissions.CREATE],
+  getRoleByName,
+});
+
 const resolveSharedLinkExpiration = (req, conversationId) =>
   getSharedLinkExpiration(
     { req, conversationId },
@@ -36,25 +54,20 @@ const allowSharedLinks =
   process.env.ALLOW_SHARED_LINKS === undefined || isEnabled(process.env.ALLOW_SHARED_LINKS);
 
 if (allowSharedLinks) {
-  const allowSharedLinksPublic = isEnabled(process.env.ALLOW_SHARED_LINKS_PUBLIC);
-  router.get(
-    '/:shareId',
-    allowSharedLinksPublic ? (req, res, next) => next() : requireJwtAuth,
-    async (req, res) => {
-      try {
-        const share = await getSharedMessages(req.params.shareId);
-
-        if (share) {
-          res.status(200).json(share);
-        } else {
-          res.status(404).end();
-        }
-      } catch (error) {
-        logger.error('Error getting shared messages:', error);
-        res.status(500).json({ message: 'Error getting shared messages' });
+  router.get('/:shareId', optionalJwtAuth, canAccessSharedLink, async (req, res) => {
+    try {
+      const share = await getSharedMessages(req.params.shareId, req.shareResourceId);
+      if (share) {
+        res.set('Cache-Control', 'private, no-store');
+        res.status(200).json(share);
+      } else {
+        res.status(404).end();
       }
-    },
-  );
+    } catch (error) {
+      logger.error('Error getting shared messages:', error);
+      res.status(500).json({ message: 'Error getting shared messages' });
+    }
+  });
 }
 
 /**
@@ -65,7 +78,6 @@ router.get('/', requireJwtAuth, async (req, res) => {
     const params = {
       pageParam: req.query.cursor,
       pageSize: Math.max(1, parseInt(req.query.pageSize) || 10),
-      isPublic: isEnabled(req.query.isPublic),
       sortBy: ['createdAt', 'title'].includes(req.query.sortBy) ? req.query.sortBy : 'createdAt',
       sortDirection: ['asc', 'desc'].includes(req.query.sortDirection)
         ? req.query.sortDirection
@@ -77,7 +89,6 @@ router.get('/', requireJwtAuth, async (req, res) => {
       req.user.id,
       params.pageParam,
       params.pageSize,
-      params.isPublic,
       params.sortBy,
       params.sortDirection,
       params.search,
@@ -101,7 +112,12 @@ router.get('/link/:conversationId', requireJwtAuth, async (req, res) => {
   try {
     const share = await getSharedLink(req.user.id, req.params.conversationId);
 
+    if (share._id && share.success) {
+      await ensureLinkPermissions(share._id, req.user.id);
+    }
+
     return res.status(200).json({
+      _id: share._id,
       success: share.success,
       shareId: share.shareId,
       targetMessageId: share.targetMessageId,
@@ -113,7 +129,7 @@ router.get('/link/:conversationId', requireJwtAuth, async (req, res) => {
   }
 });
 
-router.post('/:conversationId', requireJwtAuth, async (req, res) => {
+router.post('/:conversationId', requireJwtAuth, checkSharedLinksAccess, async (req, res) => {
   try {
     const { targetMessageId } = req.body;
     const expiredAt = await resolveSharedLinkExpiration(req, req.params.conversationId);
@@ -121,6 +137,10 @@ router.post('/:conversationId', requireJwtAuth, async (req, res) => {
       return res.status(404).end();
     }
 
+    const role = await getRoleByName(req.user.role);
+    const sharedLinksPerms = role?.permissions?.[PermissionTypes.SHARED_LINKS] || {};
+    const grantPublic = sharedLinksPerms[Permissions.SHARE_PUBLIC] === true;
+
     const created = await createSharedLink(
       req.user.id,
       req.params.conversationId,
@@ -128,6 +148,7 @@ router.post('/:conversationId', requireJwtAuth, async (req, res) => {
       expiredAt,
     );
     if (created) {
+      await grantCreationPermissions(created._id, req.user.id, grantPublic, expiredAt);
       res.status(200).json(created);
     } else {
       res.status(404).end();
@@ -165,6 +186,9 @@ router.patch('/:shareId', requireJwtAuth, async (req, res) => {
       expiredAt,
     );
     if (updatedShare) {
+      if (updatedShare._id && expiredAt !== undefined) {
+        await updateSharedLinkPermissionsExpiration(updatedShare._id, expiredAt);
+      }
       res.status(200).json(updatedShare);
     } else {
       res.status(404).end();
@@ -177,7 +201,7 @@ router.patch('/:shareId', requireJwtAuth, async (req, res) => {
 
 router.delete('/:shareId', requireJwtAuth, async (req, res) => {
   try {
-    const result = await deleteSharedLink(req.user.id, req.params.shareId);
+    const result = await deleteSharedLinkWithCleanup(req.user.id, req.params.shareId);
 
     if (!result) {
       return res.status(404).json({ message: 'Share not found' });
diff --git a/api/server/routes/skills.js b/api/server/routes/skills.js
index 694009a480b..99339d2a297 100644
--- a/api/server/routes/skills.js
+++ b/api/server/routes/skills.js
@@ -21,14 +21,11 @@ const {
 const {
   createSkill,
   getSkillById,
-  listSkillsByAccess,
   updateSkill,
   deleteSkill,
-  listSkillFiles,
   upsertSkillFile,
   deleteSkillFile,
   getSkillFileByPath,
-  updateSkillFileContent,
   getRoleByName,
 } = require('~/models');
 const { requireJwtAuth, canAccessSkillResource } = require('~/server/middleware');
@@ -40,8 +37,14 @@ const {
 } = require('~/server/services/PermissionService');
 const { getStrategyFunctions } = require('~/server/services/Files/strategies');
 const { createFileLimiters } = require('~/server/middleware/limiters/uploadLimiters');
+const { maybeRunGitHubSkillSyncForRequest } = require('~/server/services/Skills/sync');
 const configMiddleware = require('~/server/middleware/config/app');
 const { getFileStrategy } = require('~/server/utils/getFileStrategy');
+const {
+  getSkillDbMethods,
+  withDeploymentSkillIds,
+  getSkillStrategyFunctions,
+} = require('~/server/services/Endpoints/agents/skillDeps');
 
 const router = express.Router();
 
@@ -100,6 +103,7 @@ const checkSkillCreate = generateCheckAccess({
 // Rate limiters (reuse existing file upload limiters)
 // ---------------------------------------------------------------------------
 const { fileUploadIpLimiter, fileUploadUserLimiter } = createFileLimiters();
+const skillDbMethods = getSkillDbMethods();
 
 router.use(requireJwtAuth);
 router.use(configMiddleware);
@@ -110,18 +114,28 @@ router.use(checkSkillAccess);
 // ---------------------------------------------------------------------------
 const handlers = createSkillsHandlers({
   createSkill,
-  getSkillById,
-  listSkillsByAccess,
+  getSkillById: skillDbMethods.getSkillById,
+  listSkillsByAccess: skillDbMethods.listSkillsByAccess,
   updateSkill,
   deleteSkill,
-  listSkillFiles,
+  listSkillFiles: skillDbMethods.listSkillFiles,
   deleteSkillFile,
-  getSkillFileByPath,
-  updateSkillFileContent,
-  getStrategyFunctions,
-  findAccessibleResources,
-  findPubliclyAccessibleResources,
-  hasPublicPermission,
+  getSkillFileByPath: skillDbMethods.getSkillFileByPath,
+  updateSkillFileContent: skillDbMethods.updateSkillFileContent,
+  getStrategyFunctions: getSkillStrategyFunctions,
+  findAccessibleResources: async (params) =>
+    params.resourceType === 'skill' && params.requiredPermissions === PermissionBits.VIEW
+      ? withDeploymentSkillIds(await findAccessibleResources(params))
+      : findAccessibleResources(params),
+  findPubliclyAccessibleResources: async (params) =>
+    params.resourceType === 'skill' && params.requiredPermissions === PermissionBits.VIEW
+      ? withDeploymentSkillIds(await findPubliclyAccessibleResources(params))
+      : findPubliclyAccessibleResources(params),
+  hasPublicPermission: async (params) =>
+    params.resourceType === 'skill' && params.requiredPermissions === PermissionBits.VIEW
+      ? withDeploymentSkillIds([]).some((id) => id.toString() === params.resourceId.toString()) ||
+        hasPublicPermission(params)
+      : hasPublicPermission(params),
   grantPermission,
   isValidObjectIdString,
 });
@@ -272,6 +286,14 @@ async function uploadFileHandler(req, res) {
 // ---------------------------------------------------------------------------
 // Routes
 // ---------------------------------------------------------------------------
+async function maybeStartRequestSkillSync(req, _res, next) {
+  try {
+    await maybeRunGitHubSkillSyncForRequest(req);
+  } catch (error) {
+    logger.error('[GET /skills] Failed to start request-scoped skill sync:', error);
+  }
+  next();
+}
 
 // Import: accepts .md / .zip / .skill via multipart
 router.post(
@@ -284,7 +306,7 @@ router.post(
   importHandler,
 );
 
-router.get('/', handlers.list);
+router.get('/', maybeStartRequestSkillSync, handlers.list);
 router.post('/', checkSkillCreate, handlers.create);
 
 router.get(
diff --git a/api/server/routes/skills.test.js b/api/server/routes/skills.test.js
index af99e4bc5e5..c48c0ff70bf 100644
--- a/api/server/routes/skills.test.js
+++ b/api/server/routes/skills.test.js
@@ -33,6 +33,7 @@ const {
 } = require('librechat-data-provider');
 
 let mockFileConfig;
+const mockMaybeRunGitHubSkillSyncForRequest = jest.fn(async () => false);
 
 jest.mock('~/server/services/Config', () => ({
   getCachedTools: jest.fn().mockResolvedValue({}),
@@ -68,6 +69,10 @@ jest.mock('~/server/utils/getFileStrategy', () => ({
   getFileStrategy: jest.fn().mockReturnValue('local'),
 }));
 
+jest.mock('~/server/services/Skills/sync', () => ({
+  maybeRunGitHubSkillSyncForRequest: mockMaybeRunGitHubSkillSyncForRequest,
+}));
+
 jest.mock('~/models', () => {
   const mongoose = require('mongoose');
   const { createMethods } = require('@librechat/data-schemas');
@@ -152,6 +157,7 @@ afterEach(async () => {
   await AclEntry.deleteMany({});
   currentTestUser = testUsers.owner;
   mockFileConfig = undefined;
+  mockMaybeRunGitHubSkillSyncForRequest.mockClear();
 });
 
 afterAll(async () => {
@@ -409,6 +415,12 @@ describe('Skill routes', () => {
       setTestUser(testUsers.owner);
       const res = await request(app).get('/api/skills');
       expect(res.status).toBe(200);
+      expect(mockMaybeRunGitHubSkillSyncForRequest).toHaveBeenCalledWith(
+        expect.objectContaining({
+          config: expect.objectContaining({ fileStrategy: 'local' }),
+          user: expect.objectContaining({ id: testUsers.owner._id.toString() }),
+        }),
+      );
       expect(res.body.skills.length).toBe(1);
       expect(res.body.skills[0].name).toBe('mine-skill');
     });
diff --git a/api/server/services/ActionService.js b/api/server/services/ActionService.js
index 2e324b53124..db8a536d8e5 100644
--- a/api/server/services/ActionService.js
+++ b/api/server/services/ActionService.js
@@ -29,7 +29,7 @@ const {
   deleteActions,
   deleteAssistant,
 } = require('~/models');
-const { getFlowStateManager } = require('~/config');
+const { getActionFlowStateManager } = require('~/config');
 const { getLogStores } = require('~/cache');
 
 const JWT_SECRET = process.env.JWT_SECRET;
@@ -243,7 +243,7 @@ async function createActionTool({
                   },
                 };
                 const flowsCache = getLogStores(CacheKeys.FLOWS);
-                const flowManager = getFlowStateManager(flowsCache);
+                const flowManager = getActionFlowStateManager(flowsCache);
                 await flowManager.createFlowWithHandler(
                   `${identifier}:oauth_login:${config.metadata.thread_id}:${config.metadata.run_id}`,
                   'oauth_login',
@@ -341,7 +341,7 @@ async function createActionTool({
                     },
                   );
                 const flowsCache = getLogStores(CacheKeys.FLOWS);
-                const flowManager = getFlowStateManager(flowsCache);
+                const flowManager = getActionFlowStateManager(flowsCache);
                 const refreshData = await flowManager.createFlowWithHandler(
                   `${identifier}:refresh`,
                   'oauth_refresh',
diff --git a/api/server/services/AuthService.js b/api/server/services/AuthService.js
index c3aca089d44..8f6c281ee1d 100644
--- a/api/server/services/AuthService.js
+++ b/api/server/services/AuthService.js
@@ -45,9 +45,113 @@ const domains = {
   server: process.env.DOMAIN_SERVER,
 };
 
+const AuthTokenTypes = Object.freeze({
+  EMAIL_VERIFICATION: 'email_verification',
+  PASSWORD_RESET: 'password_reset',
+});
+
+const latestAuthTokenOptions = Object.freeze({ sort: { createdAt: -1 } });
 const genericVerificationMessage = 'Please check your email to verify your email address.';
+const invalidEmailVerificationMessage = 'Invalid or expired email verification token';
 const OPENID_SESSION_ID_TOKEN_EXPIRY_BUFFER_SECONDS = 30;
 
+const findPasswordResetToken = async (userId) => {
+  const typedToken = await findToken(
+    {
+      userId,
+      type: AuthTokenTypes.PASSWORD_RESET,
+    },
+    latestAuthTokenOptions,
+  );
+
+  if (typedToken) {
+    return typedToken;
+  }
+
+  return await findToken(
+    {
+      userId,
+      email: null,
+      identifier: null,
+      type: null,
+    },
+    latestAuthTokenOptions,
+  );
+};
+
+const findEmailVerificationToken = async (user) => {
+  const typedToken = await findToken(
+    {
+      userId: user._id,
+      email: user.email,
+      type: AuthTokenTypes.EMAIL_VERIFICATION,
+    },
+    latestAuthTokenOptions,
+  );
+
+  if (typedToken) {
+    return typedToken;
+  }
+
+  return await findToken(
+    {
+      userId: user._id,
+      email: user.email,
+      identifier: null,
+      type: null,
+    },
+    latestAuthTokenOptions,
+  );
+};
+
+const deleteEmailVerificationTokens = (user) =>
+  Promise.all([
+    deleteTokens({
+      userId: user._id,
+      email: user.email,
+      type: AuthTokenTypes.EMAIL_VERIFICATION,
+    }),
+    deleteTokens({
+      userId: user._id,
+      email: user.email,
+      identifier: null,
+      type: null,
+    }),
+  ]);
+
+const getEmailVerificationTokenDeleteQuery = (emailVerificationToken) => {
+  if (!emailVerificationToken.identifier && !emailVerificationToken.type) {
+    return {
+      token: emailVerificationToken.token,
+      userId: emailVerificationToken.userId,
+      email: emailVerificationToken.email,
+      identifier: null,
+      type: null,
+    };
+  }
+
+  return {
+    token: emailVerificationToken.token,
+    type: AuthTokenTypes.EMAIL_VERIFICATION,
+  };
+};
+
+const getPasswordResetTokenDeleteQuery = (passwordResetToken) => {
+  if (!passwordResetToken.email && !passwordResetToken.type) {
+    return {
+      token: passwordResetToken.token,
+      email: null,
+      identifier: null,
+      type: null,
+    };
+  }
+
+  return {
+    token: passwordResetToken.token,
+    type: AuthTokenTypes.PASSWORD_RESET,
+  };
+};
+
 const getUnexpiredOpenIDSessionIdToken = (idToken) => {
   if (!idToken) {
     return;
@@ -133,6 +237,7 @@ const sendVerificationEmail = async (user) => {
   await createToken({
     userId: user._id,
     email: user.email,
+    type: AuthTokenTypes.EMAIL_VERIFICATION,
     token: hash,
     createdAt: Date.now(),
     expiresIn: 900,
@@ -147,25 +252,46 @@ const sendVerificationEmail = async (user) => {
  */
 const verifyEmail = async (req) => {
   const { email, token } = req.body;
-  const decodedEmail = decodeURIComponent(email);
+
+  if (typeof email !== 'string' || typeof token !== 'string' || !email || !token) {
+    logger.warn('[verifyEmail] [Invalid email verification request]');
+    return new Error(invalidEmailVerificationMessage);
+  }
+
+  let decodedEmail;
+  try {
+    decodedEmail = decodeURIComponent(email);
+  } catch {
+    logger.warn(`[verifyEmail] [Invalid email encoding] [Email: ${email}]`);
+    return new Error(invalidEmailVerificationMessage);
+  }
 
   const user = await findUser({ email: decodedEmail }, 'email _id emailVerified');
 
   if (!user) {
     logger.warn(`[verifyEmail] [User not found] [Email: ${decodedEmail}]`);
-    return new Error('User not found');
+    return new Error(invalidEmailVerificationMessage);
   }
 
-  if (user.emailVerified) {
-    logger.info(`[verifyEmail] Email already verified [Email: ${decodedEmail}]`);
-    return { message: 'Email already verified', status: 'success' };
-  }
-
-  let emailVerificationData = await findToken({ email: decodedEmail }, { sort: { createdAt: -1 } });
+  const emailVerificationData = await findEmailVerificationToken(user);
 
   if (!emailVerificationData) {
     logger.warn(`[verifyEmail] [No email verification data found] [Email: ${decodedEmail}]`);
-    return new Error('Invalid or expired password reset token');
+    return new Error(invalidEmailVerificationMessage);
+  }
+
+  if (!emailVerificationData.token) {
+    logger.warn(
+      `[verifyEmail] [Email verification token data is invalid] [Email: ${decodedEmail}]`,
+    );
+    return new Error(invalidEmailVerificationMessage);
+  }
+
+  const tokenUserId = emailVerificationData.userId?.toString();
+  const userId = user._id?.toString();
+  if (!tokenUserId || tokenUserId !== userId) {
+    logger.warn(`[verifyEmail] [Email verification token user mismatch] [Email: ${decodedEmail}]`);
+    return new Error(invalidEmailVerificationMessage);
   }
 
   const isValid = bcrypt.compareSync(token, emailVerificationData.token);
@@ -174,17 +300,23 @@ const verifyEmail = async (req) => {
     logger.warn(
       `[verifyEmail] [Invalid or expired email verification token] [Email: ${decodedEmail}]`,
     );
-    return new Error('Invalid or expired email verification token');
+    return new Error(invalidEmailVerificationMessage);
+  }
+
+  if (user.emailVerified) {
+    await deleteTokens(getEmailVerificationTokenDeleteQuery(emailVerificationData));
+    logger.info(`[verifyEmail] Email already verified [Email: ${decodedEmail}]`);
+    return { message: 'Email verification was successful', status: 'success' };
   }
 
   const updatedUser = await updateUser(emailVerificationData.userId, { emailVerified: true });
 
   if (!updatedUser) {
     logger.warn(`[verifyEmail] [User update failed] [Email: ${decodedEmail}]`);
-    return new Error('Failed to update user verification status');
+    return new Error(invalidEmailVerificationMessage);
   }
 
-  await deleteTokens({ token: emailVerificationData.token });
+  await deleteTokens(getEmailVerificationTokenDeleteQuery(emailVerificationData));
   logger.info(`[verifyEmail] Email verification successful [Email: ${decodedEmail}]`);
   return { message: 'Email verification was successful', status: 'success' };
 };
@@ -337,12 +469,16 @@ const requestPasswordReset = async (req) => {
     };
   }
 
-  await deleteTokens({ userId: user._id });
+  await Promise.all([
+    deleteTokens({ userId: user._id, type: AuthTokenTypes.PASSWORD_RESET }),
+    deleteTokens({ userId: user._id, email: null, identifier: null, type: null }),
+  ]);
 
   const [resetToken, hash] = createTokenHash();
 
   await createToken({
     userId: user._id,
+    type: AuthTokenTypes.PASSWORD_RESET,
     token: hash,
     createdAt: Date.now(),
     expiresIn: 900,
@@ -386,12 +522,7 @@ const requestPasswordReset = async (req) => {
  * @returns
  */
 const resetPassword = async (userId, token, password) => {
-  let passwordResetToken = await findToken(
-    {
-      userId,
-    },
-    { sort: { createdAt: -1 } },
-  );
+  const passwordResetToken = await findPasswordResetToken(userId);
 
   if (!passwordResetToken) {
     return new Error('Invalid or expired password reset token');
@@ -419,7 +550,7 @@ const resetPassword = async (userId, token, password) => {
     });
   }
 
-  await deleteTokens({ token: passwordResetToken.token });
+  await deleteTokens(getPasswordResetTokenDeleteQuery(passwordResetToken));
   logger.info(`[resetPassword] Password reset successful. [Email: ${user.email}]`);
   return { message: 'Password reset was successful' };
 };
@@ -724,7 +855,6 @@ const setOpenIDAuthTokens = (
 const resendVerificationEmail = async (req) => {
   try {
     const { email } = req.body;
-    await deleteTokens({ email });
     const user = await findUser({ email }, 'email _id name');
 
     if (!user) {
@@ -732,6 +862,8 @@ const resendVerificationEmail = async (req) => {
       return { status: 200, message: genericVerificationMessage };
     }
 
+    await deleteEmailVerificationTokens(user);
+
     const [verifyToken, hash] = createTokenHash();
 
     const verificationLink = `${
@@ -753,6 +885,7 @@ const resendVerificationEmail = async (req) => {
     await createToken({
       userId: user._id,
       email: user.email,
+      type: AuthTokenTypes.EMAIL_VERIFICATION,
       token: hash,
       createdAt: Date.now(),
       expiresIn: 900,
diff --git a/api/server/services/AuthService.spec.js b/api/server/services/AuthService.spec.js
index 3fce12cc200..03579e7278f 100644
--- a/api/server/services/AuthService.spec.js
+++ b/api/server/services/AuthService.spec.js
@@ -1,32 +1,44 @@
-jest.mock('@librechat/data-schemas', () => ({
-  logger: { info: jest.fn(), warn: jest.fn(), debug: jest.fn(), error: jest.fn() },
-  getTenantId: jest.fn(() => undefined),
-  DEFAULT_SESSION_EXPIRY: 900000,
-  DEFAULT_REFRESH_TOKEN_EXPIRY: 604800000,
-}));
-jest.mock('librechat-data-provider', () => ({
-  ErrorTypes: {},
-  SystemRoles: { USER: 'USER', ADMIN: 'ADMIN' },
-  errorsToString: jest.fn(),
-}));
-jest.mock('@librechat/api', () => ({
-  isEnabled: jest.fn((val) => val === 'true' || val === true),
-  checkEmailConfig: jest.fn(),
-  isEmailDomainAllowed: jest.fn(),
-  math: jest.fn((val, fallback) => (val ? Number(val) : fallback)),
-  shouldUseSecureCookie: jest.fn(() => false),
-  resolveAppConfigForUser: jest.fn(async (_getAppConfig, _user) => ({})),
-  setCloudFrontCookies: jest.fn(() => true),
-  getCloudFrontConfig: jest.fn(() => ({
-    domain: 'https://cdn.example.com',
-    imageSigning: 'cookies',
-    cookieDomain: '.example.com',
-    privateKey: 'test-private-key',
-    keyPairId: 'K123ABC',
-  })),
-  parseCloudFrontCookieScope: jest.fn(() => null),
-  CLOUDFRONT_SCOPE_COOKIE: 'LibreChat-CloudFront-Scope',
-}));
+jest.mock(
+  '@librechat/data-schemas',
+  () => ({
+    logger: { info: jest.fn(), warn: jest.fn(), debug: jest.fn(), error: jest.fn() },
+    getTenantId: jest.fn(() => undefined),
+    DEFAULT_SESSION_EXPIRY: 900000,
+    DEFAULT_REFRESH_TOKEN_EXPIRY: 604800000,
+  }),
+  { virtual: true },
+);
+jest.mock(
+  'librechat-data-provider',
+  () => ({
+    ErrorTypes: {},
+    SystemRoles: { USER: 'USER', ADMIN: 'ADMIN' },
+    errorsToString: jest.fn(),
+  }),
+  { virtual: true },
+);
+jest.mock(
+  '@librechat/api',
+  () => ({
+    isEnabled: jest.fn((val) => val === 'true' || val === true),
+    checkEmailConfig: jest.fn(),
+    isEmailDomainAllowed: jest.fn(),
+    math: jest.fn((val, fallback) => (val ? Number(val) : fallback)),
+    shouldUseSecureCookie: jest.fn(() => false),
+    resolveAppConfigForUser: jest.fn(async (_getAppConfig, _user) => ({})),
+    setCloudFrontCookies: jest.fn(() => true),
+    getCloudFrontConfig: jest.fn(() => ({
+      domain: 'https://cdn.example.com',
+      imageSigning: 'cookies',
+      cookieDomain: '.example.com',
+      privateKey: 'test-private-key',
+      keyPairId: 'K123ABC',
+    })),
+    parseCloudFrontCookieScope: jest.fn(() => null),
+    CLOUDFRONT_SCOPE_COOKIE: 'LibreChat-CloudFront-Scope',
+  }),
+  { virtual: true },
+);
 jest.mock('~/models', () => ({
   findUser: jest.fn(),
   findToken: jest.fn(),
@@ -73,6 +85,7 @@ const jwt = require('jsonwebtoken');
 const { logger, getTenantId } = require('@librechat/data-schemas');
 const {
   findUser,
+  findToken,
   createUser,
   updateUser,
   countUsers,
@@ -80,14 +93,21 @@ const {
   generateToken,
   generateRefreshToken,
   createSession,
+  createToken,
+  deleteTokens,
 } = require('~/models');
 const { getAppConfig } = require('~/server/services/Config');
+const { sendEmail } = require('~/server/utils');
+const bcrypt = require('bcryptjs');
 const {
   setOpenIDAuthTokens,
   requestPasswordReset,
   registerUser,
+  resetPassword,
+  resendVerificationEmail,
   setAuthTokens,
   setCloudFrontAuthCookies,
+  verifyEmail,
 } = require('./AuthService');
 
 /** Helper to build a mock Express response */
@@ -453,6 +473,108 @@ describe('registerUser', () => {
   });
 });
 
+describe('verifyEmail public response handling', () => {
+  const email = 'user@example.com';
+  const encodedEmail = encodeURIComponent(email);
+  const invalidEmailVerificationMessage = 'Invalid or expired email verification token';
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('does not reveal that an account is already verified without a valid token', async () => {
+    findUser.mockResolvedValue({ _id: 'user-id', email, emailVerified: true });
+    findToken.mockResolvedValue(null);
+
+    const result = await verifyEmail({ body: { email: encodedEmail, token: 'not-the-token' } });
+
+    expect(result).toBeInstanceOf(Error);
+    expect(result.message).toBe(invalidEmailVerificationMessage);
+    expect(updateUser).not.toHaveBeenCalled();
+    expect(deleteTokens).not.toHaveBeenCalled();
+  });
+
+  it('returns the same generic error for missing users and invalid tokens', async () => {
+    findUser.mockResolvedValueOnce(null);
+
+    const missingUserResult = await verifyEmail({
+      body: { email: encodedEmail, token: 'not-the-token' },
+    });
+
+    findUser.mockResolvedValueOnce({ _id: 'user-id', email, emailVerified: false });
+    findToken.mockResolvedValueOnce({
+      userId: 'user-id',
+      email,
+      token: bcrypt.hashSync('real-token', 10),
+    });
+
+    const invalidTokenResult = await verifyEmail({
+      body: { email: encodedEmail, token: 'not-the-token' },
+    });
+
+    expect(missingUserResult).toBeInstanceOf(Error);
+    expect(invalidTokenResult).toBeInstanceOf(Error);
+    expect(missingUserResult.message).toBe(invalidEmailVerificationMessage);
+    expect(invalidTokenResult.message).toBe(invalidEmailVerificationMessage);
+  });
+
+  it('verifies an unverified account when the token is valid', async () => {
+    const hashedToken = bcrypt.hashSync('real-token', 10);
+    findUser.mockResolvedValue({ _id: 'user-id', email, emailVerified: false });
+    findToken.mockResolvedValue({ userId: 'user-id', email, token: hashedToken });
+    updateUser.mockResolvedValue({ _id: 'user-id', emailVerified: true });
+
+    const result = await verifyEmail({ body: { email: encodedEmail, token: 'real-token' } });
+
+    expect(result).toEqual({
+      message: 'Email verification was successful',
+      status: 'success',
+    });
+    expect(updateUser).toHaveBeenCalledWith('user-id', { emailVerified: true });
+    expect(deleteTokens).toHaveBeenCalledWith({
+      token: hashedToken,
+      userId: 'user-id',
+      email,
+      identifier: null,
+      type: null,
+    });
+  });
+
+  it('returns the generic error when a valid verification update fails', async () => {
+    const hashedToken = bcrypt.hashSync('real-token', 10);
+    findUser.mockResolvedValue({ _id: 'user-id', email, emailVerified: false });
+    findToken.mockResolvedValue({ userId: 'user-id', email, token: hashedToken });
+    updateUser.mockResolvedValue(null);
+
+    const result = await verifyEmail({ body: { email: encodedEmail, token: 'real-token' } });
+
+    expect(result).toBeInstanceOf(Error);
+    expect(result.message).toBe(invalidEmailVerificationMessage);
+    expect(deleteTokens).not.toHaveBeenCalled();
+  });
+
+  it('allows idempotent success only when an already verified account presents a valid token', async () => {
+    const hashedToken = bcrypt.hashSync('real-token', 10);
+    findUser.mockResolvedValue({ _id: 'user-id', email, emailVerified: true });
+    findToken.mockResolvedValue({ userId: 'user-id', email, token: hashedToken });
+
+    const result = await verifyEmail({ body: { email: encodedEmail, token: 'real-token' } });
+
+    expect(result).toEqual({
+      message: 'Email verification was successful',
+      status: 'success',
+    });
+    expect(updateUser).not.toHaveBeenCalled();
+    expect(deleteTokens).toHaveBeenCalledWith({
+      token: hashedToken,
+      userId: 'user-id',
+      email,
+      identifier: null,
+      type: null,
+    });
+  });
+});
+
 describe('requestPasswordReset', () => {
   beforeEach(() => {
     jest.clearAllMocks();
@@ -516,6 +638,305 @@ describe('requestPasswordReset', () => {
     expect(result).not.toBeInstanceOf(Error);
     expect(result.message).toContain('If an account with that email exists');
   });
+
+  it('should only delete existing password reset tokens when issuing a new reset link', async () => {
+    const user = { _id: 'user-reset', email: 'user@example.com' };
+    findUser.mockResolvedValue(user);
+
+    const req = { body: { email: 'user@example.com' }, ip: '127.0.0.1' };
+    await requestPasswordReset(req);
+
+    expect(deleteTokens).toHaveBeenCalledWith({
+      userId: user._id,
+      type: 'password_reset',
+    });
+    expect(deleteTokens).toHaveBeenCalledWith({
+      userId: user._id,
+      email: null,
+      identifier: null,
+      type: null,
+    });
+    expect(createToken).toHaveBeenCalledWith(
+      expect.objectContaining({
+        userId: user._id,
+        type: 'password_reset',
+      }),
+    );
+  });
+});
+
+describe('resetPassword', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    checkEmailConfig.mockReturnValue(false);
+  });
+
+  it('should only accept password reset tokens for password reset', async () => {
+    const verificationHash = bcrypt.hashSync('verification-token', 10);
+    findToken.mockImplementation(async (query) => {
+      if (query.type === 'password_reset') {
+        return null;
+      }
+      if (query.type === null && query.email === null && query.identifier === null) {
+        return null;
+      }
+      return { token: verificationHash, userId: 'user-reset', email: 'user@example.com' };
+    });
+    updateUser.mockResolvedValue({ email: 'user@example.com' });
+
+    const result = await resetPassword('user-reset', 'verification-token', 'new-password');
+
+    expect(result).toBeInstanceOf(Error);
+    expect(findToken).toHaveBeenCalledWith(
+      {
+        userId: 'user-reset',
+        type: 'password_reset',
+      },
+      { sort: { createdAt: -1 } },
+    );
+    expect(findToken).toHaveBeenCalledWith(
+      {
+        userId: 'user-reset',
+        email: null,
+        identifier: null,
+        type: null,
+      },
+      { sort: { createdAt: -1 } },
+    );
+    expect(updateUser).not.toHaveBeenCalled();
+    expect(deleteTokens).not.toHaveBeenCalled();
+  });
+
+  it('should delete only the used password reset token after a successful reset', async () => {
+    const resetHash = bcrypt.hashSync('reset-token', 10);
+    findToken.mockResolvedValue({
+      token: resetHash,
+      userId: 'user-reset',
+      type: 'password_reset',
+    });
+    updateUser.mockResolvedValue({ email: 'user@example.com' });
+
+    const result = await resetPassword('user-reset', 'reset-token', 'new-password');
+
+    expect(result).toEqual({ message: 'Password reset was successful' });
+    expect(findToken).toHaveBeenCalledWith(
+      {
+        userId: 'user-reset',
+        type: 'password_reset',
+      },
+      { sort: { createdAt: -1 } },
+    );
+    expect(deleteTokens).toHaveBeenCalledWith({
+      token: resetHash,
+      type: 'password_reset',
+    });
+  });
+
+  it('should accept legacy reset tokens without affecting verification-shaped tokens', async () => {
+    const legacyResetHash = bcrypt.hashSync('legacy-reset-token', 10);
+    findToken.mockImplementation(async (query) => {
+      if (query.type === 'password_reset') {
+        return null;
+      }
+      if (query.type === null && query.email === null && query.identifier === null) {
+        return {
+          token: legacyResetHash,
+          userId: 'user-reset',
+        };
+      }
+      return null;
+    });
+    updateUser.mockResolvedValue({ email: 'user@example.com' });
+
+    const result = await resetPassword('user-reset', 'legacy-reset-token', 'new-password');
+
+    expect(result).toEqual({ message: 'Password reset was successful' });
+    expect(findToken).toHaveBeenCalledWith(
+      {
+        userId: 'user-reset',
+        type: 'password_reset',
+      },
+      { sort: { createdAt: -1 } },
+    );
+    expect(findToken).toHaveBeenCalledWith(
+      {
+        userId: 'user-reset',
+        email: null,
+        identifier: null,
+        type: null,
+      },
+      { sort: { createdAt: -1 } },
+    );
+    expect(deleteTokens).toHaveBeenCalledWith({
+      token: legacyResetHash,
+      email: null,
+      identifier: null,
+      type: null,
+    });
+  });
+});
+
+describe('verifyEmail', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('should scope verification token lookup to the user and token category', async () => {
+    const verificationHash = bcrypt.hashSync('verification-token', 10);
+    const user = {
+      _id: 'user-verify',
+      email: 'user@example.com',
+      emailVerified: false,
+    };
+    findUser.mockResolvedValue(user);
+    findToken.mockImplementation(async (query) => {
+      if (query.type === 'email_verification') {
+        return {
+          userId: user._id,
+          email: user.email,
+          token: verificationHash,
+          type: 'email_verification',
+        };
+      }
+      return null;
+    });
+    updateUser.mockResolvedValue({ ...user, emailVerified: true });
+
+    const result = await verifyEmail({
+      body: {
+        email: encodeURIComponent(user.email),
+        token: 'verification-token',
+      },
+    });
+
+    expect(result).toEqual({
+      message: 'Email verification was successful',
+      status: 'success',
+    });
+    expect(findToken).toHaveBeenCalledWith(
+      {
+        userId: user._id,
+        email: user.email,
+        type: 'email_verification',
+      },
+      { sort: { createdAt: -1 } },
+    );
+    expect(deleteTokens).toHaveBeenCalledWith({
+      token: verificationHash,
+      type: 'email_verification',
+    });
+  });
+
+  it('should fall back only to legacy verification tokens for the same user', async () => {
+    const verificationHash = bcrypt.hashSync('legacy-verification-token', 10);
+    const user = {
+      _id: 'user-verify',
+      email: 'user@example.com',
+      emailVerified: false,
+    };
+    findUser.mockResolvedValue(user);
+    findToken.mockImplementation(async (query) => {
+      if (query.type === 'email_verification') {
+        return null;
+      }
+      if (query.type === null && query.identifier === null && query.userId === user._id) {
+        return {
+          userId: user._id,
+          email: user.email,
+          token: verificationHash,
+        };
+      }
+      return null;
+    });
+    updateUser.mockResolvedValue({ ...user, emailVerified: true });
+
+    const result = await verifyEmail({
+      body: {
+        email: encodeURIComponent(user.email),
+        token: 'legacy-verification-token',
+      },
+    });
+
+    expect(result).toEqual({
+      message: 'Email verification was successful',
+      status: 'success',
+    });
+    expect(findToken).toHaveBeenCalledWith(
+      {
+        userId: user._id,
+        email: user.email,
+        identifier: null,
+        type: null,
+      },
+      { sort: { createdAt: -1 } },
+    );
+    expect(deleteTokens).toHaveBeenCalledWith({
+      token: verificationHash,
+      userId: user._id,
+      email: user.email,
+      identifier: null,
+      type: null,
+    });
+  });
+});
+
+describe('resendVerificationEmail', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('should not delete tokens when no user exists for the email', async () => {
+    findUser.mockResolvedValue(null);
+
+    const result = await resendVerificationEmail({
+      body: { email: 'missing@example.com' },
+    });
+
+    expect(result).toEqual({
+      status: 200,
+      message: 'Please check your email to verify your email address.',
+    });
+    expect(deleteTokens).not.toHaveBeenCalled();
+    expect(sendEmail).not.toHaveBeenCalled();
+    expect(createToken).not.toHaveBeenCalled();
+  });
+
+  it('should delete only verification tokens scoped to the resolved user', async () => {
+    const user = {
+      _id: 'user-verify',
+      email: 'user@example.com',
+      name: 'User Verify',
+    };
+    findUser.mockResolvedValue(user);
+
+    const result = await resendVerificationEmail({
+      body: { email: user.email },
+    });
+
+    expect(result).toEqual({
+      status: 200,
+      message: 'Please check your email to verify your email address.',
+    });
+    expect(deleteTokens).toHaveBeenCalledWith({
+      userId: user._id,
+      email: user.email,
+      type: 'email_verification',
+    });
+    expect(deleteTokens).toHaveBeenCalledWith({
+      userId: user._id,
+      email: user.email,
+      identifier: null,
+      type: null,
+    });
+    expect(deleteTokens).not.toHaveBeenCalledWith({ email: user.email });
+    expect(createToken).toHaveBeenCalledWith(
+      expect.objectContaining({
+        userId: user._id,
+        email: user.email,
+        type: 'email_verification',
+      }),
+    );
+  });
 });
 
 describe('CloudFront cookie integration', () => {
diff --git a/api/server/services/Config/__tests__/getCachedTools.spec.js b/api/server/services/Config/__tests__/getCachedTools.spec.js
index 71ae8b5a573..3f85a018f0a 100644
--- a/api/server/services/Config/__tests__/getCachedTools.spec.js
+++ b/api/server/services/Config/__tests__/getCachedTools.spec.js
@@ -1,12 +1,6 @@
 const { CacheKeys } = require('librechat-data-provider');
 
-jest.mock('@librechat/data-schemas', () => ({
-  logger: {
-    error: jest.fn(),
-  },
-}));
 jest.mock('~/cache/getLogStores');
-const { logger } = require('@librechat/data-schemas');
 const getLogStores = require('~/cache/getLogStores');
 
 const mockCache = { get: jest.fn(), set: jest.fn(), delete: jest.fn() };
@@ -16,7 +10,6 @@ const {
   ToolCacheKeys,
   getCachedTools,
   setCachedTools,
-  getMCPServerTools,
   invalidateCachedTools,
 } = require('../getCachedTools');
 
@@ -74,41 +67,10 @@ describe('getCachedTools', () => {
       expect(mockCache.delete).toHaveBeenCalledWith(ToolCacheKeys.GLOBAL);
     });
 
-    it('getMCPServerTools should use TOOL_CACHE namespace', async () => {
-      mockCache.get.mockResolvedValue(null);
-      await getMCPServerTools('user1', 'github');
-      expect(getLogStores).toHaveBeenCalledWith(CacheKeys.TOOL_CACHE);
-      expect(mockCache.get).toHaveBeenCalledWith(ToolCacheKeys.MCP_SERVER('user1', 'github'));
-    });
-
-    it('getMCPServerTools should return null when the cache lookup fails', async () => {
-      const error = new Error('cache unavailable');
-      mockCache.get.mockRejectedValue(error);
-
-      await expect(getMCPServerTools('user1', 'github')).resolves.toBeNull();
-      expect(logger.error).toHaveBeenCalledWith(
-        '[getMCPServerTools] Error fetching cached tools for github:',
-        error,
-      );
-    });
-
-    it('getMCPServerTools should return null when the cache store is unavailable', async () => {
-      const error = new Error('cache store unavailable');
-      getLogStores.mockImplementationOnce(() => {
-        throw error;
-      });
-
-      await expect(getMCPServerTools('user1', 'github')).resolves.toBeNull();
-      expect(logger.error).toHaveBeenCalledWith(
-        '[getMCPServerTools] Error fetching cached tools for github:',
-        error,
-      );
-    });
-
     it('should NOT use CONFIG_STORE namespace', async () => {
       mockCache.get.mockResolvedValue(null);
       await getCachedTools();
-      await getMCPServerTools('user1', 'github');
+      await getCachedTools({ userId: 'user1', serverName: 'github' });
       mockCache.set.mockResolvedValue(true);
       await setCachedTools({ tool1: {} });
       mockCache.delete.mockResolvedValue(true);
diff --git a/api/server/services/Config/getCachedTools.js b/api/server/services/Config/getCachedTools.js
index 083cfae6bad..2877234b582 100644
--- a/api/server/services/Config/getCachedTools.js
+++ b/api/server/services/Config/getCachedTools.js
@@ -1,5 +1,4 @@
 const { CacheKeys, Time } = require('librechat-data-provider');
-const { logger } = require('@librechat/data-schemas');
 const getLogStores = require('~/cache/getLogStores');
 
 /**
@@ -82,27 +81,9 @@ async function invalidateCachedTools(options = {}) {
   await Promise.all(keysToDelete.map((key) => cache.delete(key)));
 }
 
-/**
- * Gets MCP tools for a specific server from cache
- * @function getMCPServerTools
- * @param {string} userId - The user ID
- * @param {string} serverName - The MCP server name
- * @returns {Promise<LCAvailableTools|null>} The available tools for the server
- */
-async function getMCPServerTools(userId, serverName) {
-  try {
-    const cache = getLogStores(CacheKeys.TOOL_CACHE);
-    return (await cache.get(ToolCacheKeys.MCP_SERVER(userId, serverName))) || null;
-  } catch (error) {
-    logger.error(`[getMCPServerTools] Error fetching cached tools for ${serverName}:`, error);
-    return null;
-  }
-}
-
 module.exports = {
   ToolCacheKeys,
   getCachedTools,
   setCachedTools,
-  getMCPServerTools,
   invalidateCachedTools,
 };
diff --git a/api/server/services/Config/loadDefaultModels.js b/api/server/services/Config/loadDefaultModels.js
index cc8da0bbc05..f7ea0daf719 100644
--- a/api/server/services/Config/loadDefaultModels.js
+++ b/api/server/services/Config/loadDefaultModels.js
@@ -1,6 +1,7 @@
 const { logger } = require('@librechat/data-schemas');
 const { EModelEndpoint } = require('librechat-data-provider');
 const {
+  mergeHeaders,
   getAnthropicModels,
   getBedrockModels,
   getOpenAIModels,
@@ -25,18 +26,35 @@ async function loadDefaultModels(req) {
       }));
     const vertexConfig = appConfig?.endpoints?.[EModelEndpoint.anthropic]?.vertexConfig;
 
+    /** Forward configured custom headers (endpoint over global `all`) so model
+     *  fetches reach a gateway-fronted provider the same as chat requests. */
+    const allHeaders = appConfig?.endpoints?.all?.headers;
+    const openAIHeaders = mergeHeaders(
+      allHeaders,
+      appConfig?.endpoints?.[EModelEndpoint.openAI]?.headers,
+    );
+    const anthropicHeaders = mergeHeaders(
+      allHeaders,
+      appConfig?.endpoints?.[EModelEndpoint.anthropic]?.headers,
+    );
+
     const [openAI, anthropic, azureOpenAI, assistants, azureAssistants, google, bedrock] =
       await Promise.all([
-        getOpenAIModels({ user: req.user.id }).catch((error) => {
-          logger.error('Error fetching OpenAI models:', error);
-          return [];
-        }),
-        getAnthropicModels({ user: req.user.id, vertexModels: vertexConfig?.modelNames }).catch(
+        getOpenAIModels({ user: req.user.id, headers: openAIHeaders, userObject: req.user }).catch(
           (error) => {
-            logger.error('Error fetching Anthropic models:', error);
+            logger.error('Error fetching OpenAI models:', error);
             return [];
           },
         ),
+        getAnthropicModels({
+          user: req.user.id,
+          vertexModels: vertexConfig?.modelNames,
+          headers: anthropicHeaders,
+          userObject: req.user,
+        }).catch((error) => {
+          logger.error('Error fetching Anthropic models:', error);
+          return [];
+        }),
         getOpenAIModels({ user: req.user.id, azure: true }).catch((error) => {
           logger.error('Error fetching Azure OpenAI models:', error);
           return [];
diff --git a/api/server/services/Config/mcp.js b/api/server/services/Config/mcp.js
index fa37e223f52..2bd64cc31b8 100644
--- a/api/server/services/Config/mcp.js
+++ b/api/server/services/Config/mcp.js
@@ -1,13 +1,17 @@
-const { createMCPToolCacheService } = require('@librechat/api');
+const { createMCPToolCacheService, MCPServersRegistry } = require('@librechat/api');
 const { getCachedTools, setCachedTools } = require('./getCachedTools');
 
-const { mergeAppTools, cacheMCPServerTools, updateMCPServerTools } = createMCPToolCacheService({
-  getCachedTools,
-  setCachedTools,
-});
+const { mergeAppTools, cacheMCPServerTools, updateMCPServerTools, getMCPServerTools } =
+  createMCPToolCacheService({
+    getCachedTools,
+    setCachedTools,
+    getServerConfig: (serverName, userId) =>
+      MCPServersRegistry.getInstance().getServerConfig(serverName, userId),
+  });
 
 module.exports = {
   mergeAppTools,
+  getMCPServerTools,
   cacheMCPServerTools,
   updateMCPServerTools,
 };
diff --git a/api/server/services/Endpoints/agents/addedConvo.js b/api/server/services/Endpoints/agents/addedConvo.js
index 2a2cd9ca30b..847c6c01af6 100644
--- a/api/server/services/Endpoints/agents/addedConvo.js
+++ b/api/server/services/Endpoints/agents/addedConvo.js
@@ -3,10 +3,14 @@ const {
   ADDED_AGENT_ID,
   initializeAgent,
   validateAgentModel,
+  resolveAgentScopedSkillIds,
+  resolveModelSpecSkillIds,
   loadAddedAgent: loadAddedAgentFn,
 } = require('@librechat/api');
+const { isEphemeralAgentId } = require('librechat-data-provider');
 const { filterFilesByAgentAccess } = require('~/server/services/Files/permissions');
 const { getMCPServerTools } = require('~/server/services/Config');
+const { canAuthorSkillFiles } = require('./skillDeps');
 const db = require('~/models');
 
 const loadAddedAgent = (params) =>
@@ -40,6 +44,13 @@ const loadAddedAgent = (params) =>
  * @param {Map} params.agentConfigs - Map of agent configs to add to
  * @param {string} params.primaryAgentId - The primary agent ID
  * @param {Object|undefined} params.userMCPAuthMap - User MCP auth map to merge into
+ * @param {Array} [params.accessibleSkillIds] - Full VIEW-accessible skill IDs for the user
+ * @param {Array} [params.editableSkillIds] - Full EDIT-accessible skill IDs for the user
+ * @param {boolean} [params.skillsCapabilityEnabled] - Whether endpoint Skills are enabled
+ * @param {boolean} [params.ephemeralSkillsToggle] - Per-request ephemeral Skills badge state
+ * @param {boolean} [params.skillCreateAllowed] - Whether the user can create Skills
+ * @param {Record<string, boolean>} [params.skillStates] - Per-user Skill active overrides
+ * @param {boolean} [params.defaultActiveOnShare] - Default active state for shared Skills
  * @param {boolean} [params.codeEnvAvailable] - `execute_code` capability flag;
  *   forwarded verbatim to the added agent's `initializeAgent`. @see
  *   InitializeAgentParams.codeEnvAvailable for full semantics.
@@ -60,6 +71,13 @@ const processAddedConvo = async ({
   primaryAgentId,
   primaryAgent,
   userMCPAuthMap,
+  accessibleSkillIds = [],
+  editableSkillIds = [],
+  skillsCapabilityEnabled = false,
+  ephemeralSkillsToggle = false,
+  skillCreateAllowed = false,
+  skillStates,
+  defaultActiveOnShare,
   codeEnvAvailable,
 }) => {
   const addedConvo = endpointOption.addedConvo;
@@ -94,6 +112,47 @@ const processAddedConvo = async ({
       return { userMCPAuthMap };
     }
 
+    const selectedModelSpec =
+      addedConvo.spec && Array.isArray(req.config?.modelSpecs?.list)
+        ? req.config.modelSpecs.list.find((modelSpec) => modelSpec.name === addedConvo.spec)
+        : null;
+
+    if (
+      addedAgent &&
+      isEphemeralAgentId(addedAgent.id) &&
+      selectedModelSpec &&
+      Object.hasOwn(selectedModelSpec, 'skills')
+    ) {
+      if (selectedModelSpec.skills === true) {
+        addedAgent.skills_enabled = true;
+        delete addedAgent.skills;
+      } else if (selectedModelSpec.skills === false) {
+        addedAgent.skills_enabled = false;
+        addedAgent.skills = [];
+      } else if (Array.isArray(selectedModelSpec.skills)) {
+        const resolvedSkillIds = await resolveModelSpecSkillIds({
+          names: selectedModelSpec.skills,
+          accessibleSkillIds,
+          getSkillByName: db.getSkillByName,
+        });
+        addedAgent.skills_enabled = true;
+        addedAgent.skills = resolvedSkillIds.map((id) => id.toString());
+      }
+    }
+
+    const scopedSkillIds = resolveAgentScopedSkillIds({
+      agent: addedAgent,
+      accessibleSkillIds,
+      skillsCapabilityEnabled,
+      ephemeralSkillsToggle,
+    });
+    const scopedEditableSkillIds = resolveAgentScopedSkillIds({
+      agent: addedAgent,
+      accessibleSkillIds: editableSkillIds,
+      skillsCapabilityEnabled,
+      ephemeralSkillsToggle,
+    });
+
     const addedConfig = await initializeAgent(
       {
         req,
@@ -105,7 +164,17 @@ const processAddedConvo = async ({
         agent: addedAgent,
         endpointOption,
         allowedProviders,
+        accessibleSkillIds: scopedSkillIds,
+        skillAuthoringAvailable: canAuthorSkillFiles({
+          agent: addedAgent,
+          scopedEditableSkillIds,
+          skillCreateAllowed,
+          skillsCapabilityEnabled,
+          ephemeralSkillsToggle,
+        }),
         codeEnvAvailable,
+        skillStates,
+        defaultActiveOnShare,
       },
       {
         getFiles: db.getFiles,
@@ -118,6 +187,9 @@ const processAddedConvo = async ({
         getToolFilesByIds: db.getToolFilesByIds,
         getCodeGeneratedFiles: db.getCodeGeneratedFiles,
         filterFilesByAgentAccess,
+        listSkillsByAccess: db.listSkillsByAccess,
+        listAlwaysApplySkills: db.listAlwaysApplySkills,
+        getSkillByName: db.getSkillByName,
       },
     );
 
diff --git a/api/server/services/Endpoints/agents/addedConvo.spec.js b/api/server/services/Endpoints/agents/addedConvo.spec.js
index b5c9427690e..cca3372bbd2 100644
--- a/api/server/services/Endpoints/agents/addedConvo.spec.js
+++ b/api/server/services/Endpoints/agents/addedConvo.spec.js
@@ -1,6 +1,9 @@
 const mockInitializeAgent = jest.fn();
 const mockValidateAgentModel = jest.fn();
 const mockLoadAddedAgent = jest.fn();
+const mockResolveAgentScopedSkillIds = jest.fn();
+const mockResolveModelSpecSkillIds = jest.fn();
+const mockCanAuthorSkillFiles = jest.fn();
 const mockGetAgent = jest.fn();
 const mockGetMCPServerTools = jest.fn();
 
@@ -18,6 +21,8 @@ jest.mock('@librechat/api', () => ({
   initializeAgent: (...args) => mockInitializeAgent(...args),
   validateAgentModel: (...args) => mockValidateAgentModel(...args),
   loadAddedAgent: (params) => mockLoadAddedAgent(params),
+  resolveAgentScopedSkillIds: (...args) => mockResolveAgentScopedSkillIds(...args),
+  resolveModelSpecSkillIds: (...args) => mockResolveModelSpecSkillIds(...args),
 }));
 
 jest.mock('~/server/services/Files/permissions', () => ({
@@ -28,11 +33,20 @@ jest.mock('~/server/services/Config', () => ({
   getMCPServerTools: (...args) => mockGetMCPServerTools(...args),
 }));
 
+jest.mock('./skillDeps', () => ({
+  canAuthorSkillFiles: (...args) => mockCanAuthorSkillFiles(...args),
+}));
+
 jest.mock('~/models', () => ({
   getAgent: (...args) => mockGetAgent(...args),
+  getSkillByName: jest.fn(),
+  listSkillsByAccess: jest.fn(),
+  listAlwaysApplySkills: jest.fn(),
 }));
 
 const { processAddedConvo } = require('./addedConvo');
+const db = require('~/models');
+const { Constants } = require('librechat-data-provider');
 
 const makeReq = () => ({ user: { id: 'u1', role: 'USER' } });
 
@@ -44,7 +58,7 @@ const makeReq = () => ({ user: { id: 'u1', role: 'USER' } });
  * `CodeExecutionToolDefinition` landed in their `toolDefinitions` via the
  * registry regardless of any explicit flag.
  */
-describe('processAddedConvo — codeEnvAvailable passthrough', () => {
+describe('processAddedConvo', () => {
   beforeEach(() => {
     jest.clearAllMocks();
     mockValidateAgentModel.mockResolvedValue({ isValid: true });
@@ -53,6 +67,11 @@ describe('processAddedConvo — codeEnvAvailable passthrough', () => {
       userMCPAuthMap: undefined,
     });
     mockLoadAddedAgent.mockResolvedValue({ id: 'added-agent', provider: 'openai' });
+    mockResolveAgentScopedSkillIds.mockImplementation(
+      ({ accessibleSkillIds }) => accessibleSkillIds,
+    );
+    mockResolveModelSpecSkillIds.mockResolvedValue([]);
+    mockCanAuthorSkillFiles.mockReturnValue(false);
   });
 
   const baseParams = (overrides = {}) => ({
@@ -105,4 +124,108 @@ describe('processAddedConvo — codeEnvAvailable passthrough', () => {
       expect.anything(),
     );
   });
+
+  it('resolves and forwards model-spec skill scope for added ephemeral agents', async () => {
+    const accessibleSkillId = { toString: () => 'accessible-skill' };
+    const editableSkillId = { toString: () => 'editable-skill' };
+    const resolvedSkillId = { toString: () => 'resolved-skill' };
+    const scopedSkillId = { toString: () => 'scoped-skill' };
+    const scopedEditableSkillId = { toString: () => 'scoped-editable-skill' };
+    const skillStates = { 'scoped-skill': true };
+
+    mockLoadAddedAgent.mockResolvedValue({
+      id: Constants.EPHEMERAL_AGENT_ID,
+      provider: 'openai',
+      skills_enabled: true,
+      skills: [],
+    });
+    mockResolveModelSpecSkillIds.mockResolvedValue([resolvedSkillId]);
+    mockResolveAgentScopedSkillIds
+      .mockReturnValueOnce([scopedSkillId])
+      .mockReturnValueOnce([scopedEditableSkillId]);
+    mockCanAuthorSkillFiles.mockReturnValue(true);
+
+    await processAddedConvo(
+      baseParams({
+        req: {
+          user: { id: 'u1', role: 'USER' },
+          config: {
+            modelSpecs: {
+              list: [
+                {
+                  name: 'added-spec',
+                  skills: ['finance-analyst'],
+                },
+              ],
+            },
+          },
+        },
+        endpointOption: {
+          spec: 'primary-spec',
+          addedConvo: {
+            endpoint: 'openai',
+            model: 'gpt-4o',
+            spec: 'added-spec',
+          },
+        },
+        accessibleSkillIds: [accessibleSkillId],
+        editableSkillIds: [editableSkillId],
+        skillsCapabilityEnabled: true,
+        ephemeralSkillsToggle: false,
+        skillCreateAllowed: true,
+        skillStates,
+        defaultActiveOnShare: true,
+      }),
+    );
+
+    expect(mockResolveModelSpecSkillIds).toHaveBeenCalledWith({
+      names: ['finance-analyst'],
+      accessibleSkillIds: [accessibleSkillId],
+      getSkillByName: db.getSkillByName,
+    });
+    expect(mockResolveAgentScopedSkillIds).toHaveBeenNthCalledWith(1, {
+      agent: expect.objectContaining({
+        id: Constants.EPHEMERAL_AGENT_ID,
+        skills_enabled: true,
+        skills: ['resolved-skill'],
+      }),
+      accessibleSkillIds: [accessibleSkillId],
+      skillsCapabilityEnabled: true,
+      ephemeralSkillsToggle: false,
+    });
+    expect(mockResolveAgentScopedSkillIds).toHaveBeenNthCalledWith(2, {
+      agent: expect.objectContaining({
+        id: Constants.EPHEMERAL_AGENT_ID,
+        skills_enabled: true,
+        skills: ['resolved-skill'],
+      }),
+      accessibleSkillIds: [editableSkillId],
+      skillsCapabilityEnabled: true,
+      ephemeralSkillsToggle: false,
+    });
+    expect(mockCanAuthorSkillFiles).toHaveBeenCalledWith({
+      agent: expect.objectContaining({
+        id: Constants.EPHEMERAL_AGENT_ID,
+        skills_enabled: true,
+        skills: ['resolved-skill'],
+      }),
+      scopedEditableSkillIds: [scopedEditableSkillId],
+      skillCreateAllowed: true,
+      skillsCapabilityEnabled: true,
+      ephemeralSkillsToggle: false,
+    });
+    expect(mockInitializeAgent).toHaveBeenCalledWith(
+      expect.objectContaining({
+        accessibleSkillIds: [scopedSkillId],
+        skillAuthoringAvailable: true,
+        skillStates,
+        defaultActiveOnShare: true,
+      }),
+      expect.objectContaining({
+        listSkillsByAccess: db.listSkillsByAccess,
+        listAlwaysApplySkills: db.listAlwaysApplySkills,
+        getSkillByName: db.getSkillByName,
+      }),
+    );
+  });
 });
diff --git a/api/server/services/Endpoints/agents/build.js b/api/server/services/Endpoints/agents/build.js
index 19ae3ab7e83..efd7130091b 100644
--- a/api/server/services/Endpoints/agents/build.js
+++ b/api/server/services/Endpoints/agents/build.js
@@ -7,7 +7,7 @@ const db = require('~/models');
 const loadAgent = (params) => loadAgentFn(params, { getAgent: db.getAgent, getMCPServerTools });
 
 const buildOptions = (req, endpoint, parsedBody, endpointType) => {
-  const { spec, iconURL, agent_id, ...model_parameters } = parsedBody;
+  const { spec, iconURL, agent_id, chatProjectId, ...model_parameters } = parsedBody;
   const agentPromise = loadAgent({
     req,
     spec,
@@ -28,6 +28,7 @@ const buildOptions = (req, endpoint, parsedBody, endpointType) => {
     endpoint,
     agent_id,
     endpointType,
+    chatProjectId,
     model_parameters,
     agent: agentPromise,
     addedConvo,
diff --git a/api/server/services/Endpoints/agents/initialize.js b/api/server/services/Endpoints/agents/initialize.js
index bbbcd535ce9..9caee651c41 100644
--- a/api/server/services/Endpoints/agents/initialize.js
+++ b/api/server/services/Endpoints/agents/initialize.js
@@ -9,7 +9,9 @@ const {
   GenerationJobManager,
   getCustomEndpointConfig,
   discoverConnectedAgents,
+  resolveAgentTokenConfig,
   resolveAgentScopedSkillIds,
+  resolveModelSpecSkillIds,
   buildAgentContextAttachmentsByAgentId,
 } = require('@librechat/api');
 const {
@@ -31,8 +33,11 @@ const { loadAgentTools, loadToolsForExecution } = require('~/server/services/Too
 const { filterFilesByAgentAccess } = require('~/server/services/Files/permissions');
 const {
   getSkillToolDeps,
-  enrichWithSkillConfigurable,
-  buildSkillPrimedIdsByName,
+  getSkillDbMethods,
+  canAuthorSkillFiles,
+  withDeploymentSkillIds,
+  buildAgentToolContext,
+  enrichLoadedToolsWithAgentContext,
 } = require('./skillDeps');
 const { getModelsConfig } = require('~/server/controllers/ModelController');
 const { checkPermission, findAccessibleResources } = require('~/server/services/PermissionService');
@@ -132,7 +137,8 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
   /** Query accessible skill IDs once per run (shared across all agents).
    *  Skills activate under strict opt-in semantics — see
    *  `resolveAgentScopedSkillIds` for the per-agent activation predicate:
-   *    - Ephemeral agent → per-conversation skills badge toggle (full catalog).
+   *    - Ephemeral agent → model-spec `skills` config first, otherwise the
+   *      per-conversation skills badge toggle (full catalog).
    *    - Persisted agent → `agent.skills_enabled === true`. Optional
    *      `agent.skills` allowlist narrows the catalog; empty/undefined
    *      allowlist with the toggle on = full accessible catalog. */
@@ -140,15 +146,29 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
   const skillsCapabilityEnabled = enabledCapabilities.has(AgentCapabilities.skills);
   const codeEnvAvailable = enabledCapabilities.has(AgentCapabilities.execute_code);
   const ephemeralSkillsToggle = req.body?.ephemeralAgent?.skills === true;
+  const skillDbMethods = getSkillDbMethods();
 
   const accessibleSkillIds = skillsCapabilityEnabled
+    ? withDeploymentSkillIds(
+        await findAccessibleResources({
+          userId: req.user.id,
+          role: req.user.role,
+          resourceType: ResourceType.SKILL,
+          requiredPermissions: PermissionBits.VIEW,
+        }),
+      )
+    : [];
+  const editableSkillIds = skillsCapabilityEnabled
     ? await findAccessibleResources({
         userId: req.user.id,
         role: req.user.role,
         resourceType: ResourceType.SKILL,
-        requiredPermissions: PermissionBits.VIEW,
+        requiredPermissions: PermissionBits.EDIT,
       })
     : [];
+  const skillCreateAllowed = skillsCapabilityEnabled
+    ? await getSkillToolDeps().canCreateSkill({ req })
+    : false;
 
   const { skillStates, defaultActiveOnShare } = await loadSkillStates({
     userId: req.user.id,
@@ -165,6 +185,7 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
    *   agent?: object,
    *   tool_resources?: object,
    *   toolRegistry?: import('@librechat/agents').LCToolRegistry,
+   *   requestScopedConnections?: import('@librechat/api').RequestScopedMCPConnectionStore,
    *   openAIApiKey?: string
    * }>}
    */
@@ -184,6 +205,8 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
         toolNames,
         agent: ctx.agent,
         toolRegistry: ctx.toolRegistry,
+        mcpAvailableTools: ctx.mcpAvailableTools,
+        requestScopedConnections: ctx.requestScopedConnections,
         userMCPAuthMap: ctx.userMCPAuthMap,
         tool_resources: ctx.tool_resources,
         actionsEnabled: ctx.actionsEnabled,
@@ -195,14 +218,11 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
        *  the agent initialized. Falls back to `false` on any stray
        *  ctx miss so a skills-only agent never gains sandbox access
        *  even if capability lookup somehow skips. */
-      return enrichWithSkillConfigurable(
+      return enrichLoadedToolsWithAgentContext({
         result,
         req,
-        ctx.accessibleSkillIds,
-        ctx.codeEnvAvailable === true,
-        ctx.skillPrimedIdsByName,
-        ctx.activeSkillNames,
-      );
+        ctx,
+      });
     },
     toolEndCallback,
     ...getSkillToolDeps(),
@@ -223,6 +243,24 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
    */
   const subagentAggregatorsByToolCallId = new Map();
 
+  /** Backend prices each model call authoritatively (premium tiers, cache
+   *  rates) and emits the cost on on_token_usage when contextCost is on, so
+   *  the gauge sums real costs instead of re-deriving from base rates.
+   *  `endpointTokenConfig` is filled in once `primaryConfig` resolves below so
+   *  custom-endpoint agents price with their configured rates, not defaults. */
+  const usageCost = {
+    enabled: appConfig?.interfaceConfig?.contextCost === true,
+    pricing: { getMultiplier: db.getMultiplier, getCacheMultiplier: db.getCacheMultiplier },
+  };
+
+  /** Latest visible context snapshot + every emitted usage payload for this
+   *  response, captured by the handlers and persisted on the response message's
+   *  metadata so the breakdown and branch/total cost survive a reload.
+   *  @type {{ latest: import('librechat-data-provider').TContextUsageEvent | null, count: number }} */
+  const contextUsageSink = { latest: null, count: 0 };
+  /** @type {Array<import('librechat-data-provider').TTokenUsageEvent>} */
+  const usageEmitSink = [];
+
   const eventHandlers = getDefaultHandlers({
     res,
     toolExecuteOptions,
@@ -233,6 +271,9 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
     collectedThoughtSignatures,
     streamId,
     subagentAggregatorsByToolCallId,
+    usageCost,
+    contextUsageSink,
+    usageEmitSink,
   });
 
   if (!endpointOption.agent) {
@@ -279,12 +320,53 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
    */
   const manualSkills = extractManualSkills(req.body);
 
+  const selectedModelSpec =
+    endpointOption.spec && Array.isArray(appConfig?.modelSpecs?.list)
+      ? appConfig.modelSpecs.list.find((modelSpec) => modelSpec.name === endpointOption.spec)
+      : null;
+
+  if (
+    primaryAgent &&
+    isEphemeralAgentId(primaryAgent.id) &&
+    selectedModelSpec &&
+    Object.hasOwn(selectedModelSpec, 'skills')
+  ) {
+    if (selectedModelSpec.skills === true) {
+      primaryAgent.skills_enabled = true;
+      delete primaryAgent.skills;
+    } else if (selectedModelSpec.skills === false) {
+      primaryAgent.skills_enabled = false;
+      primaryAgent.skills = [];
+    } else if (Array.isArray(selectedModelSpec.skills)) {
+      const resolvedSkillIds = await resolveModelSpecSkillIds({
+        names: selectedModelSpec.skills,
+        accessibleSkillIds,
+        getSkillByName: db.getSkillByName,
+      });
+      primaryAgent.skills_enabled = true;
+      primaryAgent.skills = resolvedSkillIds.map((id) => id.toString());
+    }
+  }
+
   const primaryScopedSkillIds = resolveAgentScopedSkillIds({
     agent: primaryAgent,
     accessibleSkillIds,
     skillsCapabilityEnabled,
     ephemeralSkillsToggle,
   });
+  const primaryScopedEditableSkillIds = resolveAgentScopedSkillIds({
+    agent: primaryAgent,
+    accessibleSkillIds: editableSkillIds,
+    skillsCapabilityEnabled,
+    ephemeralSkillsToggle,
+  });
+  const primarySkillAuthoringAvailable = canAuthorSkillFiles({
+    agent: primaryAgent,
+    scopedEditableSkillIds: primaryScopedEditableSkillIds,
+    skillCreateAllowed,
+    skillsCapabilityEnabled,
+    ephemeralSkillsToggle,
+  });
 
   const primaryConfig = await initializeAgent(
     {
@@ -299,6 +381,7 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
       allowedProviders,
       isInitialAgent: true,
       accessibleSkillIds: primaryScopedSkillIds,
+      skillAuthoringAvailable: primarySkillAuthoringAvailable,
       codeEnvAvailable,
       skillStates,
       defaultActiveOnShare,
@@ -315,36 +398,24 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
       getToolFilesByIds: db.getToolFilesByIds,
       getCodeGeneratedFiles: db.getCodeGeneratedFiles,
       filterFilesByAgentAccess,
-      listSkillsByAccess: db.listSkillsByAccess,
-      listAlwaysApplySkills: db.listAlwaysApplySkills,
-      getSkillByName: db.getSkillByName,
+      listSkillsByAccess: skillDbMethods.listSkillsByAccess,
+      listAlwaysApplySkills: skillDbMethods.listAlwaysApplySkills,
+      getSkillByName: skillDbMethods.getSkillByName,
     },
   );
 
+  /** Price emitted usage with the primary agent's resolved endpoint config so
+   *  custom-endpoint agents reflect configured rates (mirrors the AgentClient
+   *  spending path, which reads the same config). */
+  usageCost.endpointTokenConfig = primaryConfig.endpointTokenConfig;
+
   logger.debug(
     `[initializeClient] Storing tool context for ${primaryConfig.id}: ${primaryConfig.toolDefinitions?.length ?? 0} tools, registry size: ${primaryConfig.toolRegistry?.size ?? '0'}`,
   );
-  /** Maps each primed skill name (manual `$` or always-apply) to the
-   *  `_id` of the exact doc that was primed. Plumbed to
-   *  `enrichWithSkillConfigurable` so the read_file handler can pin
-   *  same-name collision lookups to the resolver's chosen doc AND relax
-   *  the disable-model-invocation gate for skills whose body is already
-   *  in this turn's context. */
-  const skillPrimedIdsByName = buildSkillPrimedIdsByName(
-    primaryConfig.manualSkillPrimes,
-    primaryConfig.alwaysApplySkillPrimes,
+  agentToolContexts.set(
+    primaryConfig.id,
+    buildAgentToolContext({ agent: primaryAgent, config: primaryConfig }),
   );
-  agentToolContexts.set(primaryConfig.id, {
-    agent: primaryAgent,
-    toolRegistry: primaryConfig.toolRegistry,
-    userMCPAuthMap: primaryConfig.userMCPAuthMap,
-    tool_resources: primaryConfig.tool_resources,
-    actionsEnabled: primaryConfig.actionsEnabled,
-    accessibleSkillIds: primaryConfig.accessibleSkillIds,
-    activeSkillNames: primaryConfig.activeSkillNames,
-    codeEnvAvailable: primaryConfig.codeEnvAvailable,
-    skillPrimedIdsByName,
-  });
 
   const {
     agentConfigs: discoveredConfigs,
@@ -371,6 +442,19 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
           skillsCapabilityEnabled,
           ephemeralSkillsToggle,
         }),
+      computeSkillAuthoringAvailable: (agent) =>
+        canAuthorSkillFiles({
+          agent,
+          scopedEditableSkillIds: resolveAgentScopedSkillIds({
+            agent,
+            accessibleSkillIds: editableSkillIds,
+            skillsCapabilityEnabled,
+            ephemeralSkillsToggle,
+          }),
+          skillCreateAllowed,
+          skillsCapabilityEnabled,
+          ephemeralSkillsToggle,
+        }),
       skillStates,
       defaultActiveOnShare,
       codeEnvAvailable,
@@ -390,9 +474,9 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
         getToolFilesByIds: db.getToolFilesByIds,
         getCodeGeneratedFiles: db.getCodeGeneratedFiles,
         filterFilesByAgentAccess,
-        listSkillsByAccess: db.listSkillsByAccess,
-        listAlwaysApplySkills: db.listAlwaysApplySkills,
-        getSkillByName: db.getSkillByName,
+        listSkillsByAccess: skillDbMethods.listSkillsByAccess,
+        listAlwaysApplySkills: skillDbMethods.listAlwaysApplySkills,
+        getSkillByName: skillDbMethods.getSkillByName,
       },
       // The callback fires during BFS, before the helper prunes agents
       // whose edges end up filtered. Don't populate `agentConfigs` here —
@@ -400,28 +484,8 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
       // set. The per-agent tool context map is OK to keep populated even
       // for pruned ids: it's only read by closure in ON_TOOL_EXECUTE,
       // stale entries are unreachable at runtime.
-      //
-      // Handoff agents get the same `skillPrimedIdsByName` plumbing as the
-      // primary so `read_file` can pin same-name collisions to the exact
-      // primed doc AND relax the `disable-model-invocation: true` gate for
-      // skills whose body is already in this turn's context — matters for
-      // handoff agents that have their own always-apply skills bound or
-      // that the user `$`-invokes within the handoff flow.
       onAgentInitialized: (agentId, agent, config) => {
-        agentToolContexts.set(agentId, {
-          agent,
-          toolRegistry: config.toolRegistry,
-          userMCPAuthMap: config.userMCPAuthMap,
-          tool_resources: config.tool_resources,
-          actionsEnabled: config.actionsEnabled,
-          accessibleSkillIds: config.accessibleSkillIds,
-          activeSkillNames: config.activeSkillNames,
-          codeEnvAvailable: config.codeEnvAvailable,
-          skillPrimedIdsByName: buildSkillPrimedIdsByName(
-            config.manualSkillPrimes,
-            config.alwaysApplySkillPrimes,
-          ),
-        });
+        agentToolContexts.set(agentId, buildAgentToolContext({ agent, config }));
       },
       // Pass through the `@librechat/api` exports so that tests which
       // `jest.mock('@librechat/api')` can override the initializer/validator.
@@ -457,6 +521,13 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
     parentMessageId,
     allowedProviders,
     primaryAgentId: primaryConfig.id,
+    accessibleSkillIds,
+    editableSkillIds,
+    skillsCapabilityEnabled,
+    ephemeralSkillsToggle,
+    skillCreateAllowed,
+    skillStates,
+    defaultActiveOnShare,
     codeEnvAvailable,
   });
 
@@ -468,16 +539,7 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
     if (agentToolContexts.has(agentId)) {
       continue;
     }
-    agentToolContexts.set(agentId, {
-      agent: config,
-      toolRegistry: config.toolRegistry,
-      userMCPAuthMap: config.userMCPAuthMap,
-      tool_resources: config.tool_resources,
-      actionsEnabled: config.actionsEnabled,
-      accessibleSkillIds: config.accessibleSkillIds,
-      activeSkillNames: config.activeSkillNames,
-      codeEnvAvailable: config.codeEnvAvailable,
-    });
+    agentToolContexts.set(agentId, buildAgentToolContext({ agent: config, config }));
   }
 
   // `discoverConnectedAgents` always returns a concrete array, so no
@@ -565,6 +627,18 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
         skippedAgentIds.add(agentId);
         return null;
       }
+      const scopedSkillIds = resolveAgentScopedSkillIds({
+        agent,
+        accessibleSkillIds,
+        skillsCapabilityEnabled,
+        ephemeralSkillsToggle,
+      });
+      const scopedEditableSkillIds = resolveAgentScopedSkillIds({
+        agent,
+        accessibleSkillIds: editableSkillIds,
+        skillsCapabilityEnabled,
+        ephemeralSkillsToggle,
+      });
       const config = await initializeAgent(
         {
           req,
@@ -576,9 +650,11 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
           parentMessageId,
           endpointOption: { ...endpointOption, endpoint: EModelEndpoint.agents },
           allowedProviders,
-          accessibleSkillIds: resolveAgentScopedSkillIds({
+          accessibleSkillIds: scopedSkillIds,
+          skillAuthoringAvailable: canAuthorSkillFiles({
             agent,
-            accessibleSkillIds,
+            scopedEditableSkillIds,
+            skillCreateAllowed,
             skillsCapabilityEnabled,
             ephemeralSkillsToggle,
           }),
@@ -605,26 +681,13 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
           getToolFilesByIds: db.getToolFilesByIds,
           getCodeGeneratedFiles: db.getCodeGeneratedFiles,
           filterFilesByAgentAccess,
-          listSkillsByAccess: db.listSkillsByAccess,
-          listAlwaysApplySkills: db.listAlwaysApplySkills,
-          getSkillByName: db.getSkillByName,
+          listSkillsByAccess: skillDbMethods.listSkillsByAccess,
+          listAlwaysApplySkills: skillDbMethods.listAlwaysApplySkills,
+          getSkillByName: skillDbMethods.getSkillByName,
         },
       );
       agentConfigs.set(agentId, config);
-      agentToolContexts.set(agentId, {
-        agent,
-        toolRegistry: config.toolRegistry,
-        userMCPAuthMap: config.userMCPAuthMap,
-        tool_resources: config.tool_resources,
-        actionsEnabled: config.actionsEnabled,
-        accessibleSkillIds: config.accessibleSkillIds,
-        activeSkillNames: config.activeSkillNames,
-        codeEnvAvailable: config.codeEnvAvailable,
-        skillPrimedIdsByName: buildSkillPrimedIdsByName(
-          config.manualSkillPrimes,
-          config.alwaysApplySkillPrimes,
-        ),
-      });
+      agentToolContexts.set(agentId, buildAgentToolContext({ agent, config }));
       return config;
     } catch (err) {
       logger.error(`[processAgent] Error processing subagent ${agentId}:`, err);
@@ -842,6 +905,28 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
         })
     : undefined;
 
+  /** Per-agent resolved endpoint token config, keyed by agent id. Built from
+   *  `agentToolContexts` (the one map holding every agent, including pure
+   *  subagents pruned from `agentConfigs`) so usage billed/emitted for a
+   *  connected or subagent on a different custom endpoint is priced with THAT
+   *  agent's configured rates instead of the primary's. Every known agent is
+   *  recorded — even with an `undefined` config — so the resolver can tell a
+   *  known non-custom agent (built-in pricing) from an untagged/unknown one
+   *  (primary fallback).
+   *  @type {Map<string, import('@librechat/api').EndpointTokenConfig | undefined>} */
+  const endpointTokenConfigByAgentId = new Map();
+  for (const [agentId, ctx] of agentToolContexts) {
+    endpointTokenConfigByAgentId.set(agentId, ctx?.endpointTokenConfig);
+  }
+  /** Price emitted usage per producing agent too, so the streamed/persisted
+   *  `metadata.usage.cost` matches the per-agent balance transaction. */
+  usageCost.resolveEndpointTokenConfig = (usage) =>
+    resolveAgentTokenConfig({
+      agentId: usage?.agentId,
+      byAgentId: endpointTokenConfigByAgentId,
+      fallback: usageCost.endpointTokenConfig,
+    });
+
   const client = new AgentClient({
     req,
     res,
@@ -857,6 +942,7 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
     agent: primaryConfig,
     spec: endpointOption.spec,
     iconURL: endpointOption.iconURL,
+    chatProjectId: endpointOption.chatProjectId,
     attachments: primaryConfig.requestAttachments ?? primaryConfig.attachments,
     agentContextAttachmentsByAgentId,
     endpointType: endpointOption.endpointType,
@@ -864,6 +950,17 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
     maxContextTokens: primaryConfig.maxContextTokens,
     endpoint: isEphemeralAgentId(primaryConfig.id) ? primaryConfig.endpoint : EModelEndpoint.agents,
     subagentAggregatorsByToolCallId,
+    /** Resolved endpoint token/pricing config so spending and cost reflect
+     *  configured rates for custom-endpoint agents instead of defaults. */
+    endpointTokenConfig: primaryConfig.endpointTokenConfig,
+    /** Per-agent override of the above for multi-endpoint graphs (connected
+     *  agents + subagents); falls back to the primary config when an agent
+     *  isn't present or has no configured rates. */
+    endpointTokenConfigByAgentId,
+    /** Capture sinks the handlers fill during the run; `sendCompletion` reads
+     *  them to persist the breakdown + usage rollup on the response message. */
+    contextUsageSink,
+    usageEmitSink,
   });
 
   if (streamId) {
diff --git a/api/server/services/Endpoints/agents/initialize.spec.js b/api/server/services/Endpoints/agents/initialize.spec.js
index fd1eb7c897a..1e331fc40de 100644
--- a/api/server/services/Endpoints/agents/initialize.spec.js
+++ b/api/server/services/Endpoints/agents/initialize.spec.js
@@ -6,6 +6,7 @@ const {
   PrincipalModel,
   MAX_SUBAGENT_DEPTH,
   MAX_SUBAGENT_GRAPH_NODES,
+  Constants,
 } = require('librechat-data-provider');
 const { MongoMemoryServer } = require('mongodb-memory-server');
 
@@ -68,9 +69,10 @@ jest.mock('~/cache', () => ({
 }));
 
 const { initializeClient } = require('./initialize');
+const { getSkillToolDeps } = require('./skillDeps');
 const { logger } = require('@librechat/data-schemas');
 const { User, AclEntry } = require('~/db/models');
-const { createAgent } = require('~/models');
+const { createAgent, createSkill } = require('~/models');
 
 jest.spyOn(logger, 'warn').mockImplementation(() => {});
 
@@ -226,6 +228,92 @@ describe('initializeClient — processAgent ACL gate', () => {
       handoffContextAttachment,
     ]);
   });
+
+  it('does not enable skill authoring for VIEW-only shared skills', async () => {
+    const { skill } = await createSkill({
+      name: 'shared-view-only',
+      description: 'Use for read-only sharing.',
+      body: '# Shared view-only skill\n',
+      author: new mongoose.Types.ObjectId(),
+      authorName: 'Skill Owner',
+    });
+    await AclEntry.create({
+      principalType: PrincipalType.USER,
+      principalId: testUser._id,
+      principalModel: PrincipalModel.USER,
+      resourceType: ResourceType.SKILL,
+      resourceId: skill._id,
+      permBits: PermissionBits.VIEW,
+      grantedBy: testUser._id,
+    });
+
+    const endpointOption = makeEndpointOption();
+    endpointOption.agent = Promise.resolve({
+      id: PRIMARY_ID,
+      name: 'Primary',
+      provider: 'openai',
+      model: 'gpt-4',
+      tools: [],
+      skills_enabled: true,
+    });
+    mockInitializeAgent.mockResolvedValue(makePrimaryConfig([]));
+    const req = makeReq();
+    req.config.endpoints.agents = { capabilities: ['skills'] };
+    const canCreateSkillSpy = jest
+      .spyOn(getSkillToolDeps(), 'canCreateSkill')
+      .mockResolvedValue(false);
+
+    try {
+      await initializeClient({
+        req,
+        res: {},
+        signal: new AbortController().signal,
+        endpointOption,
+      });
+    } finally {
+      canCreateSkillSpy.mockRestore();
+    }
+
+    const initializeParams = mockInitializeAgent.mock.calls[0][0];
+    expect(initializeParams.accessibleSkillIds.map(String)).toContain(skill._id.toString());
+    expect(initializeParams.skillAuthoringAvailable).toBe(false);
+  });
+
+  it('enables skill authoring when model specs enable skills for an ephemeral agent', async () => {
+    const endpointOption = makeEndpointOption();
+    endpointOption.spec = 'spec-skills';
+    endpointOption.agent = Promise.resolve({
+      id: Constants.EPHEMERAL_AGENT_ID,
+      name: 'Ephemeral Primary',
+      provider: 'openai',
+      model: 'gpt-4',
+      tools: [],
+    });
+    mockInitializeAgent.mockResolvedValue(makePrimaryConfig([]));
+    const req = makeReq();
+    req.config.endpoints.agents = { capabilities: ['skills'] };
+    req.config.modelSpecs = {
+      list: [{ name: 'spec-skills', skills: true }],
+    };
+    const canCreateSkillSpy = jest
+      .spyOn(getSkillToolDeps(), 'canCreateSkill')
+      .mockResolvedValue(true);
+
+    try {
+      await initializeClient({
+        req,
+        res: {},
+        signal: new AbortController().signal,
+        endpointOption,
+      });
+    } finally {
+      canCreateSkillSpy.mockRestore();
+    }
+
+    const initializeParams = mockInitializeAgent.mock.calls[0][0];
+    expect(initializeParams.agent.skills_enabled).toBe(true);
+    expect(initializeParams.skillAuthoringAvailable).toBe(true);
+  });
 });
 
 describe('initializeClient — subagent loading', () => {
@@ -451,6 +539,48 @@ describe('initializeClient — subagent loading', () => {
     expect(arg.actionsEnabled).toBe(true);
   });
 
+  it('threads run-scoped MCP tool definitions into ON_TOOL_EXECUTE loading', async () => {
+    /** Regression guard for the request-scoped MCP/PTC handoff: the
+     *  `mcpAvailableTools` discovered at run start must survive
+     *  `buildAgentToolContext` and reach `loadToolsForExecution`, otherwise
+     *  request-scoped servers reinitialize on every programmatic tool call
+     *  and can trip the MCP circuit breaker under parallel calls. */
+    const mcpTool = 'list_tables_mcp_ClickHouse';
+    const mcpAvailableTools = {
+      ClickHouse: {
+        [mcpTool]: {
+          type: 'function',
+          function: {
+            name: mcpTool,
+            description: 'List tables',
+            parameters: { type: 'object', properties: {} },
+          },
+        },
+      },
+    };
+    const primaryConfig = {
+      ...makePrimaryConfig({}),
+      toolRegistry: new Map([[mcpTool, { name: mcpTool }]]),
+      mcpAvailableTools,
+    };
+    mockInitializeAgent.mockResolvedValue(primaryConfig);
+
+    await initializeClient({
+      req: makeSubagentReq(),
+      res: {},
+      signal: new AbortController().signal,
+      endpointOption: makeEndpointOption(),
+    });
+
+    expect(capturedToolExecuteOptions?.loadTools).toBeInstanceOf(Function);
+    await capturedToolExecuteOptions.loadTools([mcpTool], PRIMARY_ID);
+
+    expect(mockLoadToolsForExecution).toHaveBeenCalledTimes(1);
+    expect(mockLoadToolsForExecution).toHaveBeenCalledWith(
+      expect.objectContaining({ mcpAvailableTools }),
+    );
+  });
+
   it('deduplicates repeated ids in subagents.agent_ids', async () => {
     const subAgent = await createAgent({
       id: DUPLICATE_SUBAGENT_ID,
diff --git a/api/server/services/Endpoints/agents/skillDeps.js b/api/server/services/Endpoints/agents/skillDeps.js
index ee2c6841da1..7154c1d52b3 100644
--- a/api/server/services/Endpoints/agents/skillDeps.js
+++ b/api/server/services/Endpoints/agents/skillDeps.js
@@ -1,18 +1,216 @@
+const crypto = require('crypto');
 const { getStrategyFunctions } = require('~/server/services/Files/strategies');
 const { batchUploadCodeEnvFiles } = require('~/server/services/Files/Code/crud');
 const {
   getSessionInfo,
   checkIfActive,
   readSandboxFile,
+  writeSandboxFile,
 } = require('~/server/services/Files/Code/process');
-const { enrichWithSkillConfigurable } = require('@librechat/api');
+const {
+  checkAccess,
+  getStorageMetadata,
+  resolveRequestTenantId,
+  enrichWithSkillConfigurable,
+  mergeDeploymentSkillIds,
+  createDeploymentSkillMethods,
+  isDeploymentSkillFileSource,
+  getDeploymentSkillDownloadStream,
+} = require('@librechat/api');
+const {
+  Permissions,
+  FileContext,
+  ResourceType,
+  PermissionBits,
+  AccessRoleIds,
+  PrincipalType,
+  PermissionTypes,
+  isEphemeralAgentId,
+} = require('librechat-data-provider');
+const { checkPermission, grantPermission } = require('~/server/services/PermissionService');
+const { getFileStrategy } = require('~/server/utils/getFileStrategy');
 const db = require('~/models');
 
+const deploymentSkillMethods = createDeploymentSkillMethods({
+  getSkillById: db.getSkillById,
+  getSkillByName: db.getSkillByName,
+  listSkillsByAccess: db.listSkillsByAccess,
+  listAlwaysApplySkills: db.listAlwaysApplySkills,
+  listSkillFiles: db.listSkillFiles,
+  getSkillFileByPath: db.getSkillFileByPath,
+  updateSkillFileContent: db.updateSkillFileContent,
+  updateSkillFileCodeEnvIds: db.updateSkillFileCodeEnvIds,
+});
+
+function getSkillDbMethods() {
+  return deploymentSkillMethods;
+}
+
+function withDeploymentSkillIds(ids = []) {
+  return mergeDeploymentSkillIds(ids);
+}
+
+function getSkillStrategyFunctions(source) {
+  if (isDeploymentSkillFileSource(source)) {
+    return {
+      getDownloadStream: (_req, filepath) => getDeploymentSkillDownloadStream(filepath),
+    };
+  }
+  return getStrategyFunctions(source);
+}
+
+function resolveSkillStorage(req, { isImage = false } = {}) {
+  const source = getFileStrategy(req.config, { context: FileContext.skill_file, isImage });
+  const strategy = getStrategyFunctions(source);
+  if (!strategy.saveBuffer) {
+    throw new Error(`Storage backend "${source}" does not support file writes`);
+  }
+  return { saveBuffer: strategy.saveBuffer, source };
+}
+
+function basename(relativePath) {
+  const slash = relativePath.lastIndexOf('/');
+  return slash === -1 ? relativePath : relativePath.slice(slash + 1);
+}
+
+async function saveSkillFileContent({ req, skillId, relativePath, content, mimeType }) {
+  const existingFile = await db.getSkillFileByPath(skillId, relativePath);
+  const tenantId = resolveRequestTenantId(req);
+  const fileId = crypto.randomUUID();
+  const filename = basename(relativePath);
+  const storageFileName = `${fileId}__${filename}`;
+  const buffer = Buffer.from(content, 'utf8');
+  const storage = resolveSkillStorage(req, { isImage: mimeType.startsWith('image/') });
+  const filepath = await storage.saveBuffer({
+    userId: req.user.id,
+    buffer,
+    fileName: storageFileName,
+    basePath: 'uploads',
+    tenantId,
+  });
+  const storageMetadata = getStorageMetadata({ filepath, source: storage.source });
+
+  let result;
+  try {
+    result = await db.upsertSkillFile({
+      skillId,
+      relativePath,
+      file_id: fileId,
+      filename,
+      filepath,
+      ...storageMetadata,
+      source: storage.source,
+      mimeType,
+      bytes: buffer.length,
+      isExecutable: false,
+      author: req.user._id ?? req.user.id,
+      tenantId,
+    });
+    if (!result) {
+      const error = new Error('Skill file save failed to persist metadata');
+      error.code = 'SKILL_FILE_UPSERT_NOT_FOUND';
+      throw error;
+    }
+  } catch (error) {
+    const { deleteFile } = getStrategyFunctions(storage.source);
+    if (deleteFile) {
+      await deleteFile(req, { filepath, user: req.user.id, tenantId }).catch(() => undefined);
+    }
+    throw error;
+  }
+
+  if (existingFile && existingFile.filepath !== filepath) {
+    const { deleteFile } = getStrategyFunctions(existingFile.source);
+    if (deleteFile) {
+      deleteFile(req, {
+        filepath: existingFile.filepath,
+        storageKey: existingFile.storageKey,
+        storageRegion: existingFile.storageRegion,
+        user: existingFile.author ?? req.user.id,
+        tenantId: existingFile.tenantId ?? tenantId,
+      }).catch(() => undefined);
+    }
+  }
+
+  return { bytes: result.bytes, relativePath: result.relativePath };
+}
+
+function canCreateSkill({ req }) {
+  return checkAccess({
+    req,
+    user: req.user,
+    permissionType: PermissionTypes.SKILLS,
+    permissions: [Permissions.USE, Permissions.CREATE],
+    getRoleByName: db.getRoleByName,
+  });
+}
+
+function canEditSkill({ req, skillId }) {
+  return checkPermission({
+    userId: req.user.id,
+    role: req.user.role,
+    resourceType: ResourceType.SKILL,
+    resourceId: skillId,
+    requiredPermission: PermissionBits.EDIT,
+  });
+}
+
+function isAgentSkillsEnabledForRun({ agent, skillsCapabilityEnabled, ephemeralSkillsToggle }) {
+  if (!skillsCapabilityEnabled) {
+    return false;
+  }
+  if (isEphemeralAgentId(agent.id)) {
+    if (agent.skills_enabled === false) {
+      return false;
+    }
+    if (agent.skills_enabled === true) {
+      return true;
+    }
+    return ephemeralSkillsToggle === true;
+  }
+  return agent.skills_enabled === true;
+}
+
+function canAuthorSkillFiles({
+  agent,
+  scopedEditableSkillIds = [],
+  skillCreateAllowed,
+  skillsCapabilityEnabled,
+  ephemeralSkillsToggle,
+}) {
+  return (
+    isAgentSkillsEnabledForRun({ agent, skillsCapabilityEnabled, ephemeralSkillsToggle }) &&
+    (scopedEditableSkillIds.length > 0 || skillCreateAllowed === true)
+  );
+}
+
+function grantSkillOwner({ req, skillId }) {
+  return grantPermission({
+    principalType: PrincipalType.USER,
+    principalId: req.user.id,
+    resourceType: ResourceType.SKILL,
+    resourceId: skillId,
+    accessRoleId: AccessRoleIds.SKILL_OWNER,
+    grantedBy: req.user.id,
+  });
+}
+
+function getAuthorSkillByName({ req, name }) {
+  const author = req.user?._id ?? req.user?.id;
+  if (!author) {
+    return null;
+  }
+  return db.getAuthorSkillByName({
+    name,
+    author,
+    tenantId: resolveRequestTenantId(req),
+  });
+}
+
 /**
- * Builds the `skillPrimedIdsByName` map passed through to
- * `enrichWithSkillConfigurable`. Centralized here so the four CJS call
- * sites (`initialize.js`, `responses.js` x2, `openai.js`) share one
- * source of truth — if `ResolvedManualSkill` ever renames `_id` or
+ * Builds the `skillPrimedIdsByName` map threaded through
+ * `buildAgentToolContext`. Centralized here so every runtime route shares
+ * one source of truth — if `ResolvedManualSkill` ever renames `_id` or
  * gains new identifying fields, only this helper changes.
  *
  * Combines both manual (`$`-popover) primes AND always-apply primes so
@@ -59,17 +257,97 @@ function buildSkillPrimedIdsByName(manualSkillPrimes, alwaysApplySkillPrimes) {
   return out;
 }
 
+/**
+ * Builds the per-agent context consumed by ON_TOOL_EXECUTE. Keeping this
+ * shape in one Adapter gives every runtime path the same configurable
+ * fields and the same primed-skill pinning behavior.
+ *
+ * @param {object} params
+ * @param {object} params.agent
+ * @param {object} params.config
+ * @param {Record<string, import('@librechat/api').LCAvailableTools>} [params.config.mcpAvailableTools]
+ * @param {import('@librechat/api').RequestScopedMCPConnectionStore} [params.config.requestScopedConnections]
+ * @returns {object}
+ */
+function buildAgentToolContext({ agent, config }) {
+  return {
+    agent,
+    /** Per-agent resolved endpoint token/pricing config. Retained here because
+     *  `agentToolContexts` is the one map that holds every agent — including
+     *  pure subagents pruned from `agentConfigs` — so usage can be priced with
+     *  the producing agent's config in multi-endpoint graphs. */
+    endpointTokenConfig: config.endpointTokenConfig,
+    toolRegistry: config.toolRegistry,
+    mcpAvailableTools: config.mcpAvailableTools,
+    requestScopedConnections: config.requestScopedConnections,
+    userMCPAuthMap: config.userMCPAuthMap,
+    tool_resources: config.tool_resources,
+    actionsEnabled: config.actionsEnabled,
+    accessibleSkillIds: config.accessibleSkillIds,
+    activeSkillNames: config.activeSkillNames,
+    codeEnvAvailable: config.codeEnvAvailable,
+    skillAuthoringAvailable: config.skillAuthoringAvailable,
+    fileAuthoringToolNames: config.fileAuthoringToolNames,
+    skillPrimedIdsByName:
+      buildSkillPrimedIdsByName(config.manualSkillPrimes, config.alwaysApplySkillPrimes) ?? {},
+  };
+}
+
+function hasOwn(value, key) {
+  return Object.prototype.hasOwnProperty.call(value ?? {}, key);
+}
+
+/**
+ * Applies per-agent runtime context to a loadToolsForExecution result.
+ *
+ * @param {object} params
+ * @param {{ loadedTools: unknown[], configurable?: Record<string, unknown> }} params.result
+ * @param {object} params.req
+ * @param {object | undefined} params.ctx
+ * @param {object | undefined} [params.fallback]
+ * @returns {{ loadedTools: unknown[], configurable: Record<string, unknown> }}
+ */
+function enrichLoadedToolsWithAgentContext({ result, req, ctx = {}, fallback = {} }) {
+  const codeEnvAvailable = hasOwn(ctx, 'codeEnvAvailable')
+    ? ctx.codeEnvAvailable === true
+    : fallback.codeEnvAvailable === true;
+  const skillAuthoringAvailable = hasOwn(ctx, 'skillAuthoringAvailable')
+    ? ctx.skillAuthoringAvailable === true
+    : fallback.skillAuthoringAvailable === true;
+
+  return enrichWithSkillConfigurable({
+    result,
+    context: {
+      req,
+      codeEnvAvailable,
+      accessibleSkillIds: ctx.accessibleSkillIds ?? fallback.accessibleSkillIds,
+      skillPrimedIdsByName: ctx.skillPrimedIdsByName ?? fallback.skillPrimedIdsByName,
+      activeSkillNames: ctx.activeSkillNames ?? fallback.activeSkillNames,
+      skillAuthoringAvailable,
+      fileAuthoringToolNames: ctx.fileAuthoringToolNames ?? fallback.fileAuthoringToolNames,
+    },
+  });
+}
+
 /** Skill-related properties for ToolExecuteOptions (stable references, allocated once). */
 const skillToolDeps = {
-  getSkillByName: db.getSkillByName,
-  listSkillFiles: db.listSkillFiles,
-  getStrategyFunctions,
+  getSkillByName: deploymentSkillMethods.getSkillByName,
+  getAuthorSkillByName,
+  createSkill: db.createSkill,
+  updateSkill: db.updateSkill,
+  deleteSkill: db.deleteSkill,
+  canCreateSkill,
+  canEditSkill,
+  grantSkillOwner,
+  saveSkillFileContent,
+  listSkillFiles: deploymentSkillMethods.listSkillFiles,
+  getStrategyFunctions: getSkillStrategyFunctions,
   batchUploadCodeEnvFiles,
   getSessionInfo,
   checkIfActive,
-  updateSkillFileCodeEnvIds: db.updateSkillFileCodeEnvIds,
-  getSkillFileByPath: db.getSkillFileByPath,
-  updateSkillFileContent: db.updateSkillFileContent,
+  updateSkillFileCodeEnvIds: deploymentSkillMethods.updateSkillFileCodeEnvIds,
+  getSkillFileByPath: deploymentSkillMethods.getSkillFileByPath,
+  updateSkillFileContent: deploymentSkillMethods.updateSkillFileContent,
   /**
    * `read_file` falls back to a sandbox `cat` for `/mnt/data/...` paths
    * and for `{firstSegment}/...` paths whose first segment isn't a known
@@ -79,6 +357,7 @@ const skillToolDeps = {
    * the agents-side `ToolNode` via `tc.codeSessionContext`.
    */
   readSandboxFile,
+  writeSandboxFile,
 };
 
 function getSkillToolDeps() {
@@ -87,6 +366,13 @@ function getSkillToolDeps() {
 
 module.exports = {
   getSkillToolDeps,
+  canAuthorSkillFiles,
+  isAgentSkillsEnabledForRun,
+  getSkillDbMethods,
+  withDeploymentSkillIds,
+  getSkillStrategyFunctions,
   enrichWithSkillConfigurable,
   buildSkillPrimedIdsByName,
+  buildAgentToolContext,
+  enrichLoadedToolsWithAgentContext,
 };
diff --git a/api/server/services/Endpoints/agents/skillDeps.spec.js b/api/server/services/Endpoints/agents/skillDeps.spec.js
new file mode 100644
index 00000000000..3782a4664a0
--- /dev/null
+++ b/api/server/services/Endpoints/agents/skillDeps.spec.js
@@ -0,0 +1,107 @@
+const mockSaveBuffer = jest.fn();
+const mockDeleteFile = jest.fn();
+const mockGetStrategyFunctions = jest.fn();
+const mockGetFileStrategy = jest.fn();
+const mockGetStorageMetadata = jest.fn();
+const mockResolveRequestTenantId = jest.fn();
+const mockCreateDeploymentSkillMethods = jest.fn((methods) => methods);
+
+jest.mock('~/server/services/Files/strategies', () => ({
+  getStrategyFunctions: (...args) => mockGetStrategyFunctions(...args),
+}));
+
+jest.mock('~/server/services/Files/Code/crud', () => ({
+  batchUploadCodeEnvFiles: jest.fn(),
+}));
+
+jest.mock('~/server/services/Files/Code/process', () => ({
+  getSessionInfo: jest.fn(),
+  checkIfActive: jest.fn(),
+  readSandboxFile: jest.fn(),
+  writeSandboxFile: jest.fn(),
+}));
+
+jest.mock('@librechat/api', () => ({
+  checkAccess: jest.fn(),
+  createDeploymentSkillMethods: (...args) => mockCreateDeploymentSkillMethods(...args),
+  enrichWithSkillConfigurable: jest.fn(),
+  getDeploymentSkillDownloadStream: jest.fn(),
+  getStorageMetadata: (...args) => mockGetStorageMetadata(...args),
+  isDeploymentSkillFileSource: jest.fn(() => false),
+  mergeDeploymentSkillIds: jest.fn((ids = []) => ids),
+  resolveRequestTenantId: (...args) => mockResolveRequestTenantId(...args),
+}));
+
+jest.mock('librechat-data-provider', () => ({
+  AccessRoleIds: { SKILL_OWNER: 'SKILL_OWNER' },
+  FileContext: { skill_file: 'skill_file' },
+  PermissionBits: { EDIT: 2 },
+  Permissions: { USE: 'USE', CREATE: 'CREATE' },
+  PermissionTypes: { SKILLS: 'SKILLS' },
+  PrincipalType: { USER: 'USER' },
+  ResourceType: { SKILL: 'SKILL' },
+  isEphemeralAgentId: jest.fn(() => false),
+}));
+
+jest.mock('~/server/services/PermissionService', () => ({
+  checkPermission: jest.fn(),
+  grantPermission: jest.fn(),
+}));
+
+jest.mock('~/server/utils/getFileStrategy', () => ({
+  getFileStrategy: (...args) => mockGetFileStrategy(...args),
+}));
+
+const mockDb = {
+  getSkillFileByPath: jest.fn(),
+  upsertSkillFile: jest.fn(),
+};
+
+jest.mock('~/models', () => mockDb);
+
+const { getSkillToolDeps } = require('./skillDeps');
+
+describe('skillDeps saveSkillFileContent', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockGetFileStrategy.mockReturnValue('s3');
+    mockGetStrategyFunctions.mockReturnValue({
+      saveBuffer: mockSaveBuffer,
+      deleteFile: mockDeleteFile,
+    });
+    mockSaveBuffer.mockResolvedValue('https://files.example.test/uploads/file.txt');
+    mockDeleteFile.mockResolvedValue(undefined);
+    mockGetStorageMetadata.mockReturnValue({
+      storageKey: 'uploads/file.txt',
+      storageRegion: 'us-east-2',
+    });
+    mockResolveRequestTenantId.mockReturnValue('tenant-1');
+    mockDb.getSkillFileByPath.mockResolvedValue(null);
+  });
+
+  it('cleans up the uploaded object when metadata upsert returns no row', async () => {
+    mockDb.upsertSkillFile.mockResolvedValue(null);
+
+    await expect(
+      getSkillToolDeps().saveSkillFileContent({
+        req: {
+          user: { id: 'user-1', _id: 'user-1' },
+          config: {},
+        },
+        skillId: 'skill-1',
+        relativePath: 'references/template.html',
+        content: '<html></html>',
+        mimeType: 'text/html',
+      }),
+    ).rejects.toMatchObject({ code: 'SKILL_FILE_UPSERT_NOT_FOUND' });
+
+    expect(mockDeleteFile).toHaveBeenCalledWith(
+      expect.objectContaining({ user: expect.objectContaining({ id: 'user-1' }) }),
+      {
+        filepath: 'https://files.example.test/uploads/file.txt',
+        user: 'user-1',
+        tenantId: 'tenant-1',
+      },
+    );
+  });
+});
diff --git a/api/server/services/Endpoints/agents/title.js b/api/server/services/Endpoints/agents/title.js
index 350b00142eb..0aa955055e8 100644
--- a/api/server/services/Endpoints/agents/title.js
+++ b/api/server/services/Endpoints/agents/title.js
@@ -21,7 +21,13 @@ const { saveConvo } = require('~/models');
  *   persisted; awaited before saving the title in `immediate` mode.
  * @param {AbortSignal} [params.signal] - When aborted (e.g. the user stops an
  *   immediate-mode generation), cancels the in-flight title model call so a
- *   cancelled turn neither consumes the title model nor surfaces a title.
+ *   turn stopped before the title finished does not consume the title model. A
+ *   title that already finished generating is still persisted and surfaced.
+ * @param {AbortSignal} [params.discardSignal] - When aborted, discards an
+ *   already-generated title instead of persisting it. Used only when this stream
+ *   is superseded by a newer run (or the turn failed), so a stale title does not
+ *   clobber the conversation now owned by the newer run. A plain user Stop does
+ *   NOT abort this — its generated title is kept.
  * @param {(params: { conversationId: string, title: string }) => Promise<void>|void} [params.onTitleGenerated]
  *   Called after the title is cached and before persistence waits for the
  *   conversation row. Used by live streams to push the title immediately.
@@ -36,6 +42,7 @@ const addTitle = async (
     immediate = false,
     convoReady,
     signal,
+    discardSignal,
     onTitleGenerated,
   },
 ) => {
@@ -130,12 +137,14 @@ const addTitle = async (
       await convoReady;
     }
 
-    if (signal?.aborted) {
-      // The turn was stopped, or this stream was replaced, after the title had
-      // already been generated — discard it instead of persisting a title for a
-      // cancelled/discarded response. Only clear the cache if it still holds THIS
-      // task's title: a replacement stream shares the `userId-conversationId` key
-      // and may have already cached its own (valid) title that we must not remove.
+    if (discardSignal?.aborted) {
+      // This stream was superseded by a newer run (or the turn failed) after the
+      // title had already been generated — discard it so a stale title does not
+      // clobber the conversation now owned by the newer run. A plain user Stop is
+      // not a discard: its generated title falls through and is persisted below.
+      // Only clear the cache if it still holds THIS task's title: a replacement
+      // stream shares the `userId-conversationId` key and may have already cached
+      // its own (valid) title that we must not remove.
       const cached = await titleCache.get(key);
       if (cached === title) {
         await titleCache.delete(key);
diff --git a/api/server/services/Endpoints/agents/title.test.js b/api/server/services/Endpoints/agents/title.test.js
index cf6fe250d87..41537619900 100644
--- a/api/server/services/Endpoints/agents/title.test.js
+++ b/api/server/services/Endpoints/agents/title.test.js
@@ -212,10 +212,9 @@ describe('agents addTitle', () => {
     expect(mockSaveConvo).not.toHaveBeenCalled();
   });
 
-  it('propagates an aborted request signal and discards the title without persisting', async () => {
+  it('propagates the abort signal to the title model call', async () => {
     const client = makeClient();
     const ac = new AbortController();
-    const onTitleGenerated = jest.fn();
     ac.abort();
 
     await addTitle(makeReq(), {
@@ -225,17 +224,35 @@ describe('agents addTitle', () => {
       immediate: true,
       convoReady: Promise.resolve(),
       signal: ac.signal,
-      onTitleGenerated,
     });
 
     const { abortController } = client.titleConvo.mock.calls[0][0];
     expect(abortController.signal.aborted).toBe(true);
+  });
+
+  it('discards the title without persisting when the stream is superseded', async () => {
+    const client = makeClient();
+    const ac = new AbortController();
+    const onTitleGenerated = jest.fn();
+    ac.abort();
+
+    await addTitle(makeReq(), {
+      text: 'hi',
+      client,
+      conversationId: 'cid',
+      immediate: true,
+      convoReady: Promise.resolve(),
+      signal: ac.signal,
+      discardSignal: ac.signal,
+      onTitleGenerated,
+    });
+
     expect(onTitleGenerated).not.toHaveBeenCalled();
     expect(mockSaveConvo).not.toHaveBeenCalled();
     expect(mockCache.delete).toHaveBeenCalledWith('user-1-cid');
   });
 
-  it("does not delete a replacement stream's cached title when aborted", async () => {
+  it("does not delete a replacement stream's cached title when superseded", async () => {
     const client = makeClient('Stale Title');
     const ac = new AbortController();
     ac.abort();
@@ -250,9 +267,47 @@ describe('agents addTitle', () => {
       immediate: true,
       convoReady: Promise.resolve(),
       signal: ac.signal,
+      discardSignal: ac.signal,
     });
 
     expect(mockCache.delete).not.toHaveBeenCalled();
     expect(mockSaveConvo).not.toHaveBeenCalled();
   });
+
+  it('persists a title generated before a user Stop (signal aborted, not superseded)', async () => {
+    const client = makeClient('Kept Title');
+    // `signal` represents a user Stop; no `discardSignal` since the stream is not
+    // superseded. The title finishes generating and is emitted before the Stop.
+    const ac = new AbortController();
+    const onTitleGenerated = jest.fn();
+    let resolveConvo;
+    const convoReady = new Promise((resolve) => {
+      resolveConvo = resolve;
+    });
+
+    const pending = addTitle(makeReq(), {
+      text: 'hi',
+      client,
+      conversationId: 'cid',
+      immediate: true,
+      convoReady,
+      signal: ac.signal,
+      onTitleGenerated,
+    });
+
+    await flush();
+    expect(onTitleGenerated).toHaveBeenCalledWith({ conversationId: 'cid', title: 'Kept Title' });
+
+    // User stops mid-response, then the conversation row is persisted.
+    ac.abort();
+    resolveConvo();
+    await pending;
+
+    expect(mockSaveConvo).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({ conversationId: 'cid', title: 'Kept Title' }),
+      expect.objectContaining({ noUpsert: true }),
+    );
+    expect(mockCache.delete).not.toHaveBeenCalled();
+  });
 });
diff --git a/api/server/services/Endpoints/assistants/initalize.js b/api/server/services/Endpoints/assistants/initalize.js
index d5a246dff7b..4b31f63fddb 100644
--- a/api/server/services/Endpoints/assistants/initalize.js
+++ b/api/server/services/Endpoints/assistants/initalize.js
@@ -1,6 +1,5 @@
 const OpenAI = require('openai');
-const { ProxyAgent } = require('undici');
-const { isUserProvided, checkUserKeyExpiry } = require('@librechat/api');
+const { isUserProvided, checkUserKeyExpiry, getProxyDispatcher } = require('@librechat/api');
 const { ErrorTypes, EModelEndpoint } = require('librechat-data-provider');
 const { getUserKeyValues, getUserKeyExpiry } = require('~/models');
 
@@ -45,10 +44,10 @@ const initializeClient = async ({ req, res, version }) => {
     opts.baseURL = baseURL;
   }
 
-  if (PROXY) {
-    const proxyAgent = new ProxyAgent(PROXY);
+  const proxyDispatcher = getProxyDispatcher(PROXY);
+  if (proxyDispatcher) {
     opts.fetchOptions = {
-      dispatcher: proxyAgent,
+      dispatcher: proxyDispatcher,
     };
   }
 
diff --git a/api/server/services/Endpoints/azureAssistants/initialize.js b/api/server/services/Endpoints/azureAssistants/initialize.js
index e81f0bcd8ad..fde02b15892 100644
--- a/api/server/services/Endpoints/azureAssistants/initialize.js
+++ b/api/server/services/Endpoints/azureAssistants/initialize.js
@@ -1,10 +1,10 @@
 const OpenAI = require('openai');
-const { ProxyAgent } = require('undici');
 const {
   isUserProvided,
   resolveHeaders,
   constructAzureURL,
   checkUserKeyExpiry,
+  getProxyDispatcher,
 } = require('@librechat/api');
 const { ErrorTypes, EModelEndpoint, mapModelToAzureConfig } = require('librechat-data-provider');
 const { getUserKeyValues, getUserKeyExpiry } = require('~/models');
@@ -157,10 +157,10 @@ const initializeClient = async ({ req, res, version, endpointOption, initAppClie
     opts.baseURL = baseURL;
   }
 
-  if (PROXY) {
-    const proxyAgent = new ProxyAgent(PROXY);
+  const proxyDispatcher = getProxyDispatcher(PROXY);
+  if (proxyDispatcher) {
     opts.fetchOptions = {
-      dispatcher: proxyAgent,
+      dispatcher: proxyDispatcher,
     };
   }
 
diff --git a/api/server/services/Files/Audio/STTService.js b/api/server/services/Files/Audio/STTService.js
index 2caea1ffe0b..af46b9cc799 100644
--- a/api/server/services/Files/Audio/STTService.js
+++ b/api/server/services/Files/Audio/STTService.js
@@ -3,8 +3,7 @@ const fs = require('fs').promises;
 const FormData = require('form-data');
 const { Readable } = require('stream');
 const { logger } = require('@librechat/data-schemas');
-const { HttpsProxyAgent } = require('https-proxy-agent');
-const { genAzureEndpoint, logAxiosError } = require('@librechat/api');
+const { genAzureEndpoint, logAxiosError, applyAxiosProxyConfig } = require('@librechat/api');
 const { extractEnvVariable, STTProviders } = require('librechat-data-provider');
 const { getAppConfig } = require('~/server/services/Config');
 
@@ -303,9 +302,7 @@ class STTService {
 
     const options = { headers };
 
-    if (process.env.PROXY) {
-      options.httpsAgent = new HttpsProxyAgent(process.env.PROXY);
-    }
+    applyAxiosProxyConfig(options, url);
 
     try {
       const response = await axios.post(url, data, options);
diff --git a/api/server/services/Files/Audio/TTSService.js b/api/server/services/Files/Audio/TTSService.js
index 80f4239cc64..301bbe90f84 100644
--- a/api/server/services/Files/Audio/TTSService.js
+++ b/api/server/services/Files/Audio/TTSService.js
@@ -1,7 +1,6 @@
 const axios = require('axios');
 const { logger } = require('@librechat/data-schemas');
-const { HttpsProxyAgent } = require('https-proxy-agent');
-const { genAzureEndpoint, logAxiosError } = require('@librechat/api');
+const { genAzureEndpoint, logAxiosError, applyAxiosProxyConfig } = require('@librechat/api');
 const { extractEnvVariable, TTSProviders } = require('librechat-data-provider');
 const { getRandomVoiceId, createChunkProcessor, splitTextIntoChunks } = require('./streamAudio');
 const { getAppConfig } = require('~/server/services/Config');
@@ -267,9 +266,7 @@ class TTSService {
 
     const options = { headers, responseType: stream ? 'stream' : 'arraybuffer' };
 
-    if (process.env.PROXY) {
-      options.httpsAgent = new HttpsProxyAgent(process.env.PROXY);
-    }
+    applyAxiosProxyConfig(options, url);
 
     try {
       return await axios.post(url, data, options);
diff --git a/api/server/services/Files/Code/process.js b/api/server/services/Files/Code/process.js
index d9940da05b0..10ba254a19c 100644
--- a/api/server/services/Files/Code/process.js
+++ b/api/server/services/Files/Code/process.js
@@ -1042,11 +1042,101 @@ async function readSandboxFile({ file_path, session_id, files, req }) {
   }
 }
 
+/**
+ * Writes a UTF-8 text file into the code-execution sandbox by running a
+ * small Python writer through the sandbox `/exec` endpoint. The payload is
+ * base64-encoded JSON so neither the file path nor the content is
+ * interpolated into shell syntax.
+ *
+ * @param {Object} params
+ * @param {string} params.file_path - Path inside the sandbox (prefer `/mnt/data/...`).
+ * @param {string} params.content - Complete UTF-8 text content to write.
+ * @param {string} [params.session_id] - Sandbox session id from the seeded context.
+ * @param {Array<{id: string, name: string, session_id?: string}>} [params.files] - File refs to mount.
+ * @param {ServerRequest} [params.req] - Current authenticated request, used to mint Code API auth.
+ * @returns {Promise<{stdout?: string, stderr?: string, session_id?: string, files?: Array<Object>} | null>}
+ */
+async function writeSandboxFile({ file_path, content, session_id, files, req }) {
+  const baseURL = getCodeBaseURL();
+  if (!baseURL) {
+    return null;
+  }
+
+  const payload = Buffer.from(
+    JSON.stringify({
+      file_path,
+      content_b64: Buffer.from(content, 'utf8').toString('base64'),
+    }),
+    'utf8',
+  ).toString('base64');
+  const code = [
+    "python3 - <<'PY'",
+    'import base64, json, os',
+    `payload = ${JSON.stringify(payload)}`,
+    "data = json.loads(base64.b64decode(payload).decode('utf-8'))",
+    "path = data['file_path']",
+    "content = base64.b64decode(data['content_b64'])",
+    'parent = os.path.dirname(path)',
+    'if parent:',
+    '    os.makedirs(parent, exist_ok=True)',
+    "with open(path, 'wb') as f:",
+    '    f.write(content)',
+    'print(f"WROTE {len(content)} bytes to {path}")',
+    'PY',
+  ].join('\n');
+
+  /** @type {Record<string, unknown>} */
+  const postData = { lang: 'bash', code };
+  if (session_id) {
+    postData.session_id = session_id;
+  }
+  if (files && files.length > 0) {
+    postData.files = files;
+  }
+
+  try {
+    const authHeaders = await getCodeApiAuthHeaders(req);
+    const response = await axios({
+      method: 'post',
+      url: `${baseURL}/exec`,
+      data: postData,
+      headers: {
+        'Content-Type': 'application/json',
+        'User-Agent': 'LibreChat/1.0',
+        ...authHeaders,
+      },
+      httpAgent: codeServerHttpAgent,
+      httpsAgent: codeServerHttpsAgent,
+      timeout: 15000,
+    });
+    const result = response?.data ?? {};
+    if (result.stderr && (result.stdout == null || result.stdout === '')) {
+      throw new Error(String(result.stderr).trim());
+    }
+    if (result.stdout == null && result.session_id == null) {
+      return null;
+    }
+    return {
+      stdout: result.stdout == null ? undefined : String(result.stdout),
+      stderr: result.stderr == null ? undefined : String(result.stderr),
+      session_id: result.session_id,
+      files: result.files,
+    };
+  } catch (error) {
+    logAxiosError({
+      message: `Error writing sandbox file "${file_path}"`,
+      error,
+    });
+    throw error;
+  }
+}
+
 module.exports = {
   primeFiles,
   checkIfActive,
   getSessionInfo,
   processCodeOutput,
   readSandboxFile,
+  writeSandboxFile,
   runPreviewFinalize,
 };
diff --git a/api/server/services/Files/Code/process.spec.js b/api/server/services/Files/Code/process.spec.js
index b1a11a44a4e..0bff06adf32 100644
--- a/api/server/services/Files/Code/process.spec.js
+++ b/api/server/services/Files/Code/process.spec.js
@@ -161,7 +161,13 @@ const {
   getStorageMetadata,
 } = require('@librechat/api');
 
-const { processCodeOutput, getSessionInfo, readSandboxFile, primeFiles } = require('./process');
+const {
+  processCodeOutput,
+  getSessionInfo,
+  readSandboxFile,
+  writeSandboxFile,
+  primeFiles,
+} = require('./process');
 
 describe('Code Process', () => {
   const mockReq = {
@@ -1626,6 +1632,95 @@ describe('Code Process', () => {
     });
   });
 
+  describe('writeSandboxFile', () => {
+    function extractWritePayload() {
+      const code = mockAxios.mock.calls[0][0].data.code;
+      const match = /payload = "([^"]+)"/.exec(code);
+      expect(match).not.toBeNull();
+      const payload = JSON.parse(Buffer.from(match[1], 'base64').toString('utf8'));
+      return {
+        file_path: payload.file_path,
+        content: Buffer.from(payload.content_b64, 'base64').toString('utf8'),
+        code,
+      };
+    }
+
+    it('POSTs a bash python writer to /exec and forwards session context', async () => {
+      mockAxios.mockResolvedValueOnce({
+        data: {
+          stdout: 'WROTE 11 bytes to /mnt/data/new.txt\n',
+          stderr: '',
+          session_id: 'sess-new',
+          files: [{ id: 'file-new', name: 'new.txt', storage_session_id: 'sess-new' }],
+        },
+      });
+      const files = [{ id: 'f1', name: 'input.csv', session_id: 'sess-prev' }];
+
+      const result = await writeSandboxFile({
+        file_path: '/mnt/data/new.txt',
+        content: 'hello world',
+        session_id: 'sess-prev',
+        files,
+        req: mockReq,
+      });
+
+      const call = mockAxios.mock.calls[0][0];
+      expect(call.method).toBe('post');
+      expect(call.url).toBe('https://code-api.example.com/exec');
+      expect(call.data.lang).toBe('bash');
+      expect(call.data.session_id).toBe('sess-prev');
+      expect(call.data.files).toEqual(files);
+      expect(call.timeout).toBe(15000);
+      expect(call.httpAgent).toBe(codeServerHttpAgent);
+      expect(call.httpsAgent).toBe(codeServerHttpsAgent);
+      expect(result).toMatchObject({
+        stdout: 'WROTE 11 bytes to /mnt/data/new.txt\n',
+        session_id: 'sess-new',
+        files: [{ id: 'file-new', name: 'new.txt' }],
+      });
+    });
+
+    it('encodes path and content in a base64 JSON payload instead of shell-interpolating them', async () => {
+      mockAxios.mockResolvedValueOnce({ data: { stdout: 'ok', stderr: '', session_id: 'sess' } });
+      const trickyPath = `/mnt/data/quote'$(whoami).txt`;
+      const trickyContent = "hello ' $(rm -rf /)\nsecond line";
+
+      await writeSandboxFile({
+        file_path: trickyPath,
+        content: trickyContent,
+      });
+
+      const { file_path, content, code } = extractWritePayload();
+      expect(file_path).toBe(trickyPath);
+      expect(content).toBe(trickyContent);
+      expect(code).not.toContain(trickyPath);
+      expect(code).not.toContain(trickyContent);
+    });
+
+    it('returns null when getCodeBaseURL is not configured', async () => {
+      const { getCodeBaseURL } = require('@librechat/agents');
+      getCodeBaseURL.mockReturnValueOnce('');
+
+      const result = await writeSandboxFile({
+        file_path: '/mnt/data/x.txt',
+        content: 'x',
+      });
+
+      expect(result).toBeNull();
+      expect(mockAxios).not.toHaveBeenCalled();
+    });
+
+    it('throws when the writer reports stderr without stdout', async () => {
+      mockAxios.mockResolvedValueOnce({
+        data: { stdout: '', stderr: 'Permission denied\n' },
+      });
+
+      await expect(writeSandboxFile({ file_path: '/root/nope.txt', content: 'x' })).rejects.toThrow(
+        'Permission denied',
+      );
+    });
+  });
+
   describe('primeFiles reupload pushes FRESH sandbox ids (Pass-N review P2)', () => {
     /**
      * Regression: when a primed code file is missing/expired in the
diff --git a/api/server/services/MCP.js b/api/server/services/MCP.js
index 8035bcc3df6..46971a416e2 100644
--- a/api/server/services/MCP.js
+++ b/api/server/services/MCP.js
@@ -1,21 +1,26 @@
 const { tool } = require('@librechat/agents/langchain/tools');
 const { logger, getTenantId } = require('@librechat/data-schemas');
-const {
-  Providers,
-  StepTypes,
-  GraphEvents,
-  Constants: AgentConstants,
-} = require('@librechat/agents');
+const { Providers, Constants: AgentConstants } = require('@librechat/agents');
 const {
   sendEvent,
+  PENDING_STALE_MS,
   MCPOAuthHandler,
   isMCPDomainAllowed,
   normalizeServerName,
   normalizeJsonSchema,
   GenerationJobManager,
   resolveJsonSchemaRefs,
-  buildOAuthToolCallName,
+  sanitizeGeminiSchema,
+  buildMCPAuthStepId,
+  buildMCPAuthToolCall,
+  processMCPEnv,
+  buildMCPAuthRunStepEvent,
+  buildMCPAuthRunStepDeltaEvent,
+  buildMCPAuthRunStepEndDeltaEvent,
+  isUserSourced,
   checkAccessWithRequestCache,
+  requiresEphemeralUserConnection,
+  containsGraphTokenPlaceholder,
 } = require('@librechat/api');
 const {
   Time,
@@ -90,6 +95,13 @@ function evictStale(map, ttl) {
 const unavailableMsg =
   "This tool's MCP server is temporarily unavailable. Please try again shortly.";
 
+function getOAuthFlowId(userId, serverName, tenantId = getTenantId()) {
+  if (!tenantId) {
+    return MCPOAuthHandler.generateFlowId(userId, serverName);
+  }
+  return MCPOAuthHandler.generateFlowId(userId, serverName, tenantId);
+}
+
 async function getAppConfigForRequest(req) {
   const user = req?.user;
   return await getAppConfigForUser(user?.id, user);
@@ -157,6 +169,41 @@ async function resolveAllMcpConfigs(userId, user) {
   return await registry.getAllServerConfigs(userId, configServers);
 }
 
+function getServerCustomUserVars(userMCPAuthMap, serverName) {
+  return userMCPAuthMap?.[`${Constants.mcp_prefix}${serverName}`];
+}
+
+/**
+ * Best-effort early gate; the authoritative check is
+ * `assertResolvedRuntimeConfigAllowed` in `@librechat/api`, whose resolution
+ * this must mirror. Graph placeholders resolve later (async), so a URL still
+ * carrying one defers to the authoritative check instead of rejecting here.
+ */
+async function isEarlyDomainAllowed({
+  serverConfig,
+  user,
+  requestBody,
+  userMCPAuthMap,
+  serverName,
+  allowedDomains,
+  allowedAddresses,
+}) {
+  const validationConfig = processMCPEnv({
+    user,
+    body: requestBody,
+    dbSourced: isUserSourced(serverConfig),
+    options: serverConfig,
+    customUserVars: getServerCustomUserVars(userMCPAuthMap, serverName),
+  });
+  if (
+    typeof validationConfig?.url === 'string' &&
+    containsGraphTokenPlaceholder(validationConfig.url)
+  ) {
+    return true;
+  }
+  return await isMCPDomainAllowed(validationConfig, allowedDomains, allowedAddresses);
+}
+
 /**
  * @param {string} toolName
  * @param {string} serverName
@@ -201,20 +248,11 @@ function isEmptyObjectSchema(jsonSchema) {
 function createRunStepDeltaEmitter({ res, stepId, toolCall, streamId = null }) {
   /**
    * @param {string} authURL - The URL to redirect the user for OAuth authentication.
+   * @param {{ expiresAt?: number }} [options]
    * @returns {Promise<void>}
    */
-  return async function (authURL) {
-    /** @type {{ id: string; delta: AgentToolCallDelta }} */
-    const data = {
-      id: stepId,
-      delta: {
-        type: StepTypes.TOOL_CALLS,
-        tool_calls: [{ ...toolCall, args: '' }],
-        auth: authURL,
-        expires_at: Date.now() + Time.TWO_MINUTES,
-      },
-    };
-    const eventData = { event: GraphEvents.ON_RUN_STEP_DELTA, data };
+  return async function (authURL, options) {
+    const eventData = buildMCPAuthRunStepDeltaEvent({ authURL, stepId, toolCall, options });
     if (streamId) {
       await GenerationJobManager.emitChunk(streamId, eventData);
     } else {
@@ -235,18 +273,7 @@ function createRunStepDeltaEmitter({ res, stepId, toolCall, streamId = null }) {
  */
 function createRunStepEmitter({ res, runId, stepId, toolCall, index, streamId = null }) {
   return async function () {
-    /** @type {import('@librechat/agents').RunStep} */
-    const data = {
-      runId: runId ?? Constants.USE_PRELIM_RESPONSE_MESSAGE_ID,
-      id: stepId,
-      type: StepTypes.TOOL_CALLS,
-      index: index ?? 0,
-      stepDetails: {
-        type: StepTypes.TOOL_CALLS,
-        tool_calls: [toolCall],
-      },
-    };
-    const eventData = { event: GraphEvents.ON_RUN_STEP, data };
+    const eventData = buildMCPAuthRunStepEvent({ runId, stepId, toolCall, index });
     if (streamId) {
       await GenerationJobManager.emitChunk(streamId, eventData);
     } else {
@@ -260,20 +287,43 @@ function createRunStepEmitter({ res, runId, stepId, toolCall, index, streamId =
  * @param {object} params
  * @param {string} params.flowId - The ID of the login flow.
  * @param {FlowStateManager<any>} params.flowManager - The flow manager instance.
- * @param {(authURL: string) => void} [params.callback]
+ * @param {(authURL: string, options?: { expiresAt?: number }) => void | Promise<void>} [params.callback]
  */
 function createOAuthStart({ flowId, flowManager, callback }) {
   /**
    * Creates a function to handle OAuth login requests.
    * @param {string} authURL - The URL to redirect the user for OAuth authentication.
+   * @param {{ expiresAt?: number }} [options]
    * @returns {Promise<boolean>} Returns true to indicate the event was sent successfully.
    */
-  return async function (authURL) {
+  return async function (authURL, options) {
+    let emitted = false;
+    const emitOAuthStart = async (message) => {
+      if (options) {
+        await callback?.(authURL, options);
+      } else {
+        await callback?.(authURL);
+      }
+      emitted = true;
+      logger.debug(message);
+    };
+
+    const existingFlow = await flowManager.getFlowState(flowId, 'oauth_login');
+    if (existingFlow) {
+      await emitOAuthStart('Re-sent OAuth login request to client');
+      return true;
+    }
+
     await flowManager.createFlowWithHandler(flowId, 'oauth_login', async () => {
-      callback?.(authURL);
-      logger.debug('Sent OAuth login request to client');
+      await emitOAuthStart('Sent OAuth login request to client');
       return true;
     });
+
+    if (!emitted) {
+      await emitOAuthStart('Re-sent OAuth login request to client');
+    }
+
+    return true;
   };
 }
 
@@ -286,15 +336,7 @@ function createOAuthStart({ flowId, flowManager, callback }) {
  */
 function createOAuthEnd({ res, stepId, toolCall, streamId = null }) {
   return async function () {
-    /** @type {{ id: string; delta: AgentToolCallDelta }} */
-    const data = {
-      id: stepId,
-      delta: {
-        type: StepTypes.TOOL_CALLS,
-        tool_calls: [{ ...toolCall }],
-      },
-    };
-    const eventData = { event: GraphEvents.ON_RUN_STEP_DELTA, data };
+    const eventData = buildMCPAuthRunStepEndDeltaEvent({ stepId, toolCall });
     if (streamId) {
       await GenerationJobManager.emitChunk(streamId, eventData);
     } else {
@@ -309,12 +351,13 @@ function createOAuthEnd({ res, stepId, toolCall, streamId = null }) {
  * @param {string} params.userId - The ID of the user.
  * @param {string} params.serverName - The name of the server.
  * @param {string} params.toolName - The name of the tool.
+ * @param {string} [params.tenantId] - The tenant ID for the current request.
  * @param {FlowStateManager<any>} params.flowManager - The flow manager instance.
  */
-function createAbortHandler({ userId, serverName, toolName, flowManager }) {
+function createAbortHandler({ userId, serverName, toolName, tenantId, flowManager }) {
   return function () {
     logger.info(`[MCP][User: ${userId}][${serverName}][${toolName}] Tool call aborted`);
-    const flowId = MCPOAuthHandler.generateFlowId(userId, serverName);
+    const flowId = getOAuthFlowId(userId, serverName, tenantId);
     // Clean up both mcp_oauth and mcp_get_tokens flows
     flowManager.failFlow(flowId, 'mcp_oauth', new Error('Tool call aborted'));
     flowManager.failFlow(flowId, 'mcp_get_tokens', new Error('Tool call aborted'));
@@ -323,14 +366,14 @@ function createAbortHandler({ userId, serverName, toolName, flowManager }) {
 
 /**
  * @param {Object} params
- * @param {() => void} params.runStepEmitter
- * @param {(authURL: string) => void} params.runStepDeltaEmitter
- * @returns {(authURL: string) => void}
+ * @param {() => Promise<void>} params.runStepEmitter
+ * @param {(authURL: string, options?: { expiresAt?: number }) => Promise<void>} params.runStepDeltaEmitter
+ * @returns {(authURL: string, options?: { expiresAt?: number }) => Promise<void>}
  */
 function createOAuthCallback({ runStepEmitter, runStepDeltaEmitter }) {
-  return function (authURL) {
-    runStepEmitter();
-    runStepDeltaEmitter(authURL);
+  return async function (authURL, options) {
+    await runStepEmitter();
+    await runStepDeltaEmitter(authURL, options);
   };
 }
 
@@ -344,6 +387,8 @@ function createOAuthCallback({ runStepEmitter, runStepDeltaEmitter }) {
  * @param {number} [params.index]
  * @param {string | null} [params.streamId] - The stream ID for resumable mode.
  * @param {Record<string, Record<string, string>>} [params.userMCPAuthMap]
+ * @param {import('@librechat/api').RequestScopedMCPConnectionStore} [params.requestScopedConnections]
+ * @param {import('@librechat/api').ParsedServerConfig} [params.serverConfig] - Used to bypass reconnect throttling for request-scoped servers.
  * @returns { Promise<Array<typeof tool | { _call: (toolInput: Object | string) => unknown}>> } An object with `_call` method to execute the tool input.
  */
 async function reconnectServer({
@@ -352,36 +397,44 @@ async function reconnectServer({
   index,
   signal,
   serverName,
+  serverConfig,
   configServers,
   userMCPAuthMap,
+  requestBody,
+  requestScopedConnections,
   streamId = null,
 }) {
   logger.debug(
     `[MCP][reconnectServer] serverName: ${serverName}, user: ${user?.id}, hasUserMCPAuthMap: ${!!userMCPAuthMap}`,
   );
 
-  const throttleKey = `${user.id}:${serverName}`;
-  const now = Date.now();
-  const lastAttempt = lastReconnectAttempts.get(throttleKey) ?? 0;
-  if (now - lastAttempt < RECONNECT_THROTTLE_MS) {
-    logger.debug(`[MCP][reconnectServer] Throttled reconnect for ${serverName}`);
-    return null;
+  // Request-scoped servers reconnect on every message by design; throttling them
+  // would stub out healthy tools for messages sent within the throttle window.
+  const requestScoped = serverConfig ? requiresEphemeralUserConnection(serverConfig) : false;
+  if (!requestScoped) {
+    const throttleKey = `${user.id}:${serverName}`;
+    const now = Date.now();
+    const lastAttempt = lastReconnectAttempts.get(throttleKey) ?? 0;
+    if (now - lastAttempt < RECONNECT_THROTTLE_MS) {
+      logger.debug(`[MCP][reconnectServer] Throttled reconnect for ${serverName}`);
+      return null;
+    }
+    lastReconnectAttempts.set(throttleKey, now);
+    evictStale(lastReconnectAttempts, RECONNECT_THROTTLE_MS);
   }
-  lastReconnectAttempts.set(throttleKey, now);
-  evictStale(lastReconnectAttempts, RECONNECT_THROTTLE_MS);
 
   const runId = Constants.USE_PRELIM_RESPONSE_MESSAGE_ID;
   const flowId = `${user.id}:${serverName}:${Date.now()}`;
   const flowManager = getFlowStateManager(getLogStores(CacheKeys.FLOWS));
-  const stepId = 'step_oauth_login_' + serverName;
-  const toolCall = {
+  const stepId = buildMCPAuthStepId(serverName);
+  const toolCall = buildMCPAuthToolCall({
     id: flowId,
-    name: buildOAuthToolCallName(serverName),
-    type: 'tool_call_chunk',
-  };
+    serverName,
+  });
 
   // Set up abort handler to clean up OAuth flows if request is aborted
-  const oauthFlowId = MCPOAuthHandler.generateFlowId(user.id, serverName);
+  const tenantId = user?.tenantId ?? getTenantId();
+  const oauthFlowId = getOAuthFlowId(user.id, serverName, tenantId);
   const abortHandler = () => {
     logger.info(
       `[MCP][User: ${user.id}][${serverName}] Tool loading aborted, cleaning up OAuth flows`,
@@ -425,6 +478,8 @@ async function reconnectServer({
       oauthStart,
       flowManager,
       userMCPAuthMap,
+      requestBody,
+      requestScopedConnections,
       forceNew: true,
       returnOnOAuth: false,
       connectionTimeout: Time.THIRTY_SECONDS,
@@ -454,6 +509,8 @@ async function reconnectServer({
  * @param {AbortSignal} [params.signal]
  * @param {string | null} [params.streamId] - The stream ID for resumable mode.
  * @param {import('@librechat/api').ParsedServerConfig} [params.config]
+ * @param {import('@librechat/api').RequestBody} [params.requestBody]
+ * @param {import('@librechat/api').RequestScopedMCPConnectionStore} [params.requestScopedConnections]
  * @param {Record<string, Record<string, string>>} [params.userMCPAuthMap]
  * @returns { Promise<Array<typeof tool | { _call: (toolInput: Object | string) => unknown}>> } An object with `_call` method to execute the tool input.
  */
@@ -468,10 +525,13 @@ async function createMCPTools({
   serverName,
   configServers,
   userMCPAuthMap,
+  requestBody,
+  requestScopedConnections,
   streamId = null,
 }) {
   const serverConfig =
     config ?? (await getMCPServersRegistry().getServerConfig(serverName, user?.id, configServers));
+
   if (serverConfig?.url) {
     const appConfig = await getAppConfig({
       role: user?.role,
@@ -480,11 +540,15 @@ async function createMCPTools({
     });
     const allowedDomains = appConfig?.mcpSettings?.allowedDomains;
     const allowedAddresses = appConfig?.mcpSettings?.allowedAddresses;
-    const isDomainAllowed = await isMCPDomainAllowed(
+    const isDomainAllowed = await isEarlyDomainAllowed({
       serverConfig,
+      user,
+      requestBody,
+      userMCPAuthMap,
+      serverName,
       allowedDomains,
       allowedAddresses,
-    );
+    });
     if (!isDomainAllowed) {
       logger.warn(`[MCP][${serverName}] Domain not allowed, skipping all tools`);
       return [];
@@ -497,8 +561,11 @@ async function createMCPTools({
     index,
     signal,
     serverName,
+    serverConfig,
     configServers,
     userMCPAuthMap,
+    requestBody,
+    requestScopedConnections,
     streamId,
   });
   if (result === null) {
@@ -522,6 +589,8 @@ async function createMCPTools({
       streamId,
       availableTools: result.availableTools,
       toolKey: `${tool.name}${Constants.mcp_delimiter}${serverName}`,
+      requestBody,
+      requestScopedConnections,
       config: serverConfig,
     });
     if (toolInstance) {
@@ -545,8 +614,11 @@ async function createMCPTools({
  * @param {string | null} [params.streamId] - The stream ID for resumable mode.
  * @param {Providers | EModelEndpoint} params.provider - The provider for the tool.
  * @param {LCAvailableTools} [params.availableTools]
+ * @param {import('@librechat/api').RequestBody} [params.requestBody]
+ * @param {import('@librechat/api').RequestScopedMCPConnectionStore} [params.requestScopedConnections]
  * @param {Record<string, Record<string, string>>} [params.userMCPAuthMap]
  * @param {import('@librechat/api').ParsedServerConfig} [params.config]
+ * @param {(availableTools: LCAvailableTools) => void} [params.onAvailableTools]
  * @returns { Promise<typeof tool | { _call: (toolInput: Object | string) => unknown}> } An object with `_call` method to execute the tool input.
  */
 async function createMCPTool({
@@ -559,14 +631,20 @@ async function createMCPTool({
   provider,
   userMCPAuthMap,
   availableTools,
+  requestBody,
+  requestScopedConnections,
   config,
   configServers,
+  onAvailableTools,
   streamId = null,
 }) {
   const [toolName, serverName] = toolKey.split(Constants.mcp_delimiter);
 
   const serverConfig =
     config ?? (await getMCPServersRegistry().getServerConfig(serverName, user?.id, configServers));
+  const requestScopedTools = serverConfig ? requiresEphemeralUserConnection(serverConfig) : false;
+  const useMissingToolCache = !requestScopedTools;
+
   if (serverConfig?.url) {
     const appConfig = await getAppConfig({
       role: user?.role,
@@ -575,11 +653,15 @@ async function createMCPTool({
     });
     const allowedDomains = appConfig?.mcpSettings?.allowedDomains;
     const allowedAddresses = appConfig?.mcpSettings?.allowedAddresses;
-    const isDomainAllowed = await isMCPDomainAllowed(
+    const isDomainAllowed = await isEarlyDomainAllowed({
       serverConfig,
+      user,
+      requestBody,
+      userMCPAuthMap,
+      serverName,
       allowedDomains,
       allowedAddresses,
-    );
+    });
     if (!isDomainAllowed) {
       logger.warn(`[MCP][${serverName}] Domain no longer allowed, skipping tool: ${toolName}`);
       return undefined;
@@ -589,7 +671,7 @@ async function createMCPTool({
   /** @type {LCTool | undefined} */
   let toolDefinition = availableTools?.[toolKey]?.function;
   if (!toolDefinition) {
-    const cachedAt = missingToolCache.get(toolKey);
+    const cachedAt = useMissingToolCache ? missingToolCache.get(toolKey) : undefined;
     if (cachedAt && Date.now() - cachedAt < MISSING_TOOL_TTL_MS) {
       logger.debug(
         `[MCP][${serverName}][${toolName}] Tool in negative cache, returning unavailable stub.`,
@@ -606,13 +688,19 @@ async function createMCPTool({
       index,
       signal,
       serverName,
+      serverConfig,
       configServers,
       userMCPAuthMap,
+      requestBody,
+      requestScopedConnections,
       streamId,
     });
+    if (result?.availableTools) {
+      onAvailableTools?.(result.availableTools);
+    }
     toolDefinition = result?.availableTools?.[toolKey]?.function;
 
-    if (!toolDefinition) {
+    if (!toolDefinition && useMissingToolCache) {
       missingToolCache.set(toolKey, Date.now());
       evictStale(missingToolCache, MISSING_TOOL_TTL_MS);
     }
@@ -629,6 +717,8 @@ async function createMCPTool({
     res,
     mcpPermissionContext,
     user,
+    requestBody,
+    requestScopedConnections,
     provider,
     toolName,
     serverName,
@@ -642,6 +732,8 @@ function createToolInstance({
   res,
   mcpPermissionContext,
   user: capturedUser = null,
+  requestBody: capturedRequestBody,
+  requestScopedConnections: capturedRequestScopedConnections,
   toolName,
   serverName,
   serverConfig: capturedServerConfig,
@@ -655,6 +747,12 @@ function createToolInstance({
 
   let schema = parameters ? normalizeJsonSchema(resolveJsonSchemaRefs(parameters)) : null;
 
+  if (schema && isGoogle) {
+    // Gemini/Vertex AI accept only a subset of JSON Schema; sanitize so MCP tools with
+    // unions, non-string enums, etc. don't 400 (they work as-is on OpenAI/Claude).
+    schema = sanitizeGeminiSchema(schema);
+  }
+
   if (!schema || (isGoogle && isEmptyObjectSchema(schema))) {
     schema = {
       type: 'object',
@@ -669,9 +767,9 @@ function createToolInstance({
 
   /** @type {(toolArguments: Object | string, config?: GraphRunnableConfig) => Promise<unknown>} */
   const _call = async (toolArguments, config) => {
-    const permissionUser = config?.configurable?.user ?? capturedUser;
-    const userId =
-      config?.configurable?.user?.id || config?.configurable?.user_id || capturedUser?.id;
+    const effectiveUser = config?.configurable?.user ?? capturedUser;
+    const permissionUser = effectiveUser;
+    const userId = effectiveUser?.id || config?.configurable?.user_id || capturedUser?.id;
     /** @type {ReturnType<typeof createAbortHandler>} */
     let abortHandler = null;
     /** @type {AbortSignal} */
@@ -711,7 +809,8 @@ function createToolInstance({
       });
 
       if (derivedSignal) {
-        abortHandler = createAbortHandler({ userId, serverName, toolName, flowManager });
+        const tenantId = config?.configurable?.user?.tenantId ?? getTenantId();
+        abortHandler = createAbortHandler({ userId, serverName, toolName, tenantId, flowManager });
         derivedSignal.addEventListener('abort', abortHandler, { once: true });
       }
 
@@ -727,8 +826,10 @@ function createToolInstance({
         options: {
           signal: derivedSignal,
         },
-        user: config?.configurable?.user,
-        requestBody: config?.configurable?.requestBody,
+        user: effectiveUser,
+        requestBody: config?.configurable?.requestBody ?? capturedRequestBody,
+        requestScopedConnections:
+          config?.configurable?.requestScopedConnections ?? capturedRequestScopedConnections,
         customUserVars,
         flowManager,
         tokenMethods: {
@@ -786,7 +887,9 @@ function createToolInstance({
   });
   toolInstance.mcp = true;
   toolInstance.mcpRawServerName = serverName;
-  toolInstance.mcpJsonSchema = parameters;
+  // On Google/Vertex, propagate the union-flattened schema so definitions extracted
+  // from this instance don't reach the Gemini converter with unsupported unions.
+  toolInstance.mcpJsonSchema = isGoogle ? schema : parameters;
   return toolInstance;
 }
 
@@ -836,12 +939,13 @@ async function getMCPSetupData(userId, options = {}) {
  * Check OAuth flow status for a user and server
  * @param {string} userId - The user ID
  * @param {string} serverName - The server name
+ * @param {string} [tenantId] - The tenant ID for the current request.
  * @returns {Object} Object containing hasActiveFlow and hasFailedFlow flags
  */
-async function checkOAuthFlowStatus(userId, serverName) {
+async function checkOAuthFlowStatus(userId, serverName, tenantId = getTenantId()) {
   const flowsCache = getLogStores(CacheKeys.FLOWS);
   const flowManager = getFlowStateManager(flowsCache);
-  const flowId = MCPOAuthHandler.generateFlowId(userId, serverName);
+  const flowId = getOAuthFlowId(userId, serverName, tenantId);
 
   try {
     const flowState = await flowManager.getFlowState(flowId, 'mcp_oauth');
@@ -850,7 +954,10 @@ async function checkOAuthFlowStatus(userId, serverName) {
     }
 
     const flowAge = Date.now() - flowState.createdAt;
-    const flowTTL = flowState.ttl || 180000; // Default 3 minutes
+    // Report active only while the flow is still usable (the handling/reuse window),
+    // not for the full Keyv retention TTL — otherwise the UI shows "connecting" for a
+    // flow the initiate/callback paths already reject, hiding the connect button.
+    const flowTTL = flowState.ttl || PENDING_STALE_MS;
 
     if (flowState.status === 'FAILED' || flowAge > flowTTL) {
       const wasCancelled = flowState.error && flowState.error.includes('cancelled');
@@ -949,6 +1056,7 @@ module.exports = {
   resolveConfigServers,
   resolveMcpConfigNames,
   resolveAllMcpConfigs,
+  createOAuthStart,
   checkOAuthFlowStatus,
   getServerConnectionStatus,
   createUnavailableToolStub,
diff --git a/api/server/services/MCP.spec.js b/api/server/services/MCP.spec.js
index 38fbb192a4e..30fbc6442b8 100644
--- a/api/server/services/MCP.spec.js
+++ b/api/server/services/MCP.spec.js
@@ -1,5 +1,6 @@
 // Mock all dependencies - define mocks before imports
-// Mock all dependencies
+const mockGetTenantId = jest.fn();
+
 jest.mock('@librechat/data-schemas', () => ({
   logger: {
     debug: jest.fn(),
@@ -7,6 +8,7 @@ jest.mock('@librechat/data-schemas', () => ({
     info: jest.fn(),
     warn: jest.fn(),
   },
+  getTenantId: mockGetTenantId,
 }));
 
 // Create mock registry instance
@@ -45,6 +47,7 @@ const {
   createMCPTools,
   createMCPPermissionContext,
   getMCPSetupData,
+  createOAuthStart,
   checkOAuthFlowStatus,
   getServerConnectionStatus,
   createUnavailableToolStub,
@@ -93,6 +96,7 @@ describe('tests for the new helper functions used by the MCP connection status e
   beforeEach(() => {
     jest.clearAllMocks();
     jest.spyOn(MCPOAuthHandler, 'generateFlowId');
+    mockGetTenantId.mockReturnValue(undefined);
 
     mockGetMCPManager = require('~/config').getMCPManager;
     mockGetFlowStateManager = require('~/config').getFlowStateManager;
@@ -100,6 +104,85 @@ describe('tests for the new helper functions used by the MCP connection status e
     mockGetOAuthReconnectionManager = require('~/config').getOAuthReconnectionManager;
   });
 
+  describe('createOAuthStart', () => {
+    const flowId = 'test-server:oauth_login:thread-1:run-1';
+    const authUrl = 'https://auth.example.com/oauth?state=test';
+
+    it('should create a login flow and emit the OAuth URL for the first request', async () => {
+      const callback = jest.fn();
+      const mockFlowManager = {
+        getFlowState: jest.fn().mockResolvedValue(null),
+        createFlowWithHandler: jest.fn(async (_flowId, _type, handler) => handler()),
+      };
+
+      const oauthStart = createOAuthStart({
+        flowId,
+        flowManager: mockFlowManager,
+        callback,
+      });
+
+      await expect(oauthStart(authUrl)).resolves.toBe(true);
+
+      expect(mockFlowManager.getFlowState).toHaveBeenCalledWith(flowId, 'oauth_login');
+      expect(mockFlowManager.createFlowWithHandler).toHaveBeenCalledWith(
+        flowId,
+        'oauth_login',
+        expect.any(Function),
+      );
+      expect(callback).toHaveBeenCalledWith(authUrl);
+      expect(logger.debug).toHaveBeenCalledWith('Sent OAuth login request to client');
+    });
+
+    it('should replay the OAuth URL when the login flow already exists', async () => {
+      const callback = jest.fn();
+      const mockFlowManager = {
+        getFlowState: jest.fn().mockResolvedValue({
+          status: 'COMPLETED',
+          result: true,
+        }),
+        createFlowWithHandler: jest.fn(),
+      };
+
+      const oauthStart = createOAuthStart({
+        flowId,
+        flowManager: mockFlowManager,
+        callback,
+      });
+
+      await expect(oauthStart(authUrl)).resolves.toBe(true);
+
+      expect(mockFlowManager.getFlowState).toHaveBeenCalledWith(flowId, 'oauth_login');
+      expect(mockFlowManager.createFlowWithHandler).not.toHaveBeenCalled();
+      expect(callback).toHaveBeenCalledWith(authUrl);
+      expect(logger.debug).toHaveBeenCalledWith('Re-sent OAuth login request to client');
+    });
+
+    it('should replay the OAuth URL when flow creation is deduped internally', async () => {
+      const callback = jest.fn();
+      const mockFlowManager = {
+        getFlowState: jest.fn().mockResolvedValue(null),
+        createFlowWithHandler: jest.fn().mockResolvedValue(true),
+      };
+
+      const oauthStart = createOAuthStart({
+        flowId,
+        flowManager: mockFlowManager,
+        callback,
+      });
+
+      await expect(oauthStart(authUrl)).resolves.toBe(true);
+
+      expect(mockFlowManager.getFlowState).toHaveBeenCalledWith(flowId, 'oauth_login');
+      expect(mockFlowManager.createFlowWithHandler).toHaveBeenCalledWith(
+        flowId,
+        'oauth_login',
+        expect.any(Function),
+      );
+      expect(callback).toHaveBeenCalledWith(authUrl);
+      expect(logger.debug).toHaveBeenCalledWith('Re-sent OAuth login request to client');
+    });
+  });
+
   describe('getMCPSetupData', () => {
     const mockUserId = 'user-123';
     const mockConfig = {
@@ -249,8 +332,8 @@ describe('tests for the new helper functions used by the MCP connection status e
     it('should detect failed flow when TTL not specified and flow exceeds default TTL', async () => {
       const mockFlowState = {
         status: 'PENDING',
-        createdAt: Date.now() - 200000, // 200 seconds ago (> 180s default TTL)
-        // ttl not specified, should use 180000 default
+        createdAt: Date.now() - 16 * 60 * 1000, // 16 minutes ago (past the PENDING_STALE_MS window)
+        // ttl not specified, should fall back to the PENDING_STALE_MS default
       };
       const mockFlowManager = { getFlowState: jest.fn(() => mockFlowState) };
       mockGetFlowStateManager.mockReturnValue(mockFlowManager);
@@ -280,6 +363,28 @@ describe('tests for the new helper functions used by the MCP connection status e
       );
     });
 
+    it('should check the tenant-scoped OAuth flow when tenant context exists', async () => {
+      mockGetTenantId.mockReturnValue('tenant/a');
+      MCPOAuthHandler.generateFlowId.mockReturnValue('tenant-flow-id');
+      const mockFlowState = {
+        status: 'PENDING',
+        createdAt: Date.now() - 60000,
+        ttl: 180000,
+      };
+      const mockFlowManager = { getFlowState: jest.fn(() => mockFlowState) };
+      mockGetFlowStateManager.mockReturnValue(mockFlowManager);
+
+      const result = await checkOAuthFlowStatus(mockUserId, mockServerName);
+
+      expect(MCPOAuthHandler.generateFlowId).toHaveBeenCalledWith(
+        mockUserId,
+        mockServerName,
+        'tenant/a',
+      );
+      expect(mockFlowManager.getFlowState).toHaveBeenCalledWith('tenant-flow-id', 'mcp_oauth');
+      expect(result).toEqual({ hasActiveFlow: true, hasFailedFlow: false });
+    });
+
     it('should return false flags for other statuses', async () => {
       const mockFlowState = {
         status: 'COMPLETED',
@@ -669,6 +774,7 @@ describe('User parameter passing tests', () => {
 
   beforeEach(() => {
     jest.clearAllMocks();
+    mockGetTenantId.mockReturnValue(undefined);
     mockReinitMCPServer = require('./Tools/mcp').reinitMCPServer;
     mockGetMCPManager = require('~/config').getMCPManager;
     mockGetFlowStateManager = require('~/config').getFlowStateManager;
@@ -731,6 +837,57 @@ describe('User parameter passing tests', () => {
       expect(mockReinitMCPServer.mock.calls[0][0].user).toBe(mockUser);
     });
 
+    it('should fail tenant-scoped OAuth flows when tool loading is aborted', async () => {
+      const mockUser = { id: 'tenant-user', name: 'Tenant User' };
+      const mockRes = { write: jest.fn(), flush: jest.fn() };
+      const abortController = new AbortController();
+      const mockFlowManager = {
+        createFlowWithHandler: jest.fn(),
+        failFlow: jest.fn(),
+      };
+      mockGetTenantId.mockReturnValue('tenant/a');
+      mockGetFlowStateManager.mockReturnValue(mockFlowManager);
+      MCPOAuthHandler.generateFlowId.mockReturnValue('tenant-flow-id');
+
+      let resolveReinit;
+      mockReinitMCPServer.mockImplementation(
+        () =>
+          new Promise((resolve) => {
+            resolveReinit = resolve;
+          }),
+      );
+
+      const createToolsPromise = createMCPTools({
+        res: mockRes,
+        user: mockUser,
+        serverName: 'tenant-abort-server',
+        provider: 'openai',
+        signal: abortController.signal,
+        userMCPAuthMap: {},
+        config: { type: 'stdio' },
+      });
+
+      abortController.abort();
+      resolveReinit({ tools: [], availableTools: {} });
+      await createToolsPromise;
+
+      expect(MCPOAuthHandler.generateFlowId).toHaveBeenCalledWith(
+        mockUser.id,
+        'tenant-abort-server',
+        'tenant/a',
+      );
+      expect(mockFlowManager.failFlow).toHaveBeenCalledWith(
+        'tenant-flow-id',
+        'mcp_oauth',
+        expect.any(Error),
+      );
+      expect(mockFlowManager.failFlow).toHaveBeenCalledWith(
+        'tenant-flow-id',
+        'mcp_get_tokens',
+        expect.any(Error),
+      );
+    });
+
     it('should throw error if user is not provided', async () => {
       const mockRes = { write: jest.fn(), flush: jest.fn() };
 
@@ -793,6 +950,37 @@ describe('User parameter passing tests', () => {
       expect(mockReinitMCPServer.mock.calls[0][0].user).toBe(mockUser);
     });
 
+    it('should report available tools discovered during single tool reinit', async () => {
+      const mockUser = { id: 'user-discovery-callback', role: 'USER' };
+      const mockRes = { write: jest.fn(), flush: jest.fn() };
+      const onAvailableTools = jest.fn();
+      const discoveredTools = {
+        [`my-tool${D}my-server`]: {
+          function: { description: 'My Tool', parameters: {} },
+        },
+        [`other-tool${D}my-server`]: {
+          function: { description: 'Other Tool', parameters: {} },
+        },
+      };
+
+      mockReinitMCPServer.mockResolvedValue({
+        availableTools: discoveredTools,
+      });
+
+      const result = await createMCPTool({
+        res: mockRes,
+        user: mockUser,
+        toolKey: `my-tool${D}my-server`,
+        provider: 'openai',
+        userMCPAuthMap: {},
+        availableTools: undefined,
+        onAvailableTools,
+      });
+
+      expect(result).toBeDefined();
+      expect(onAvailableTools).toHaveBeenCalledWith(discoveredTools);
+    });
+
     it('should not call reinitMCPServer when tool is in cache', async () => {
       const mockUser = { id: 'test-user-789' };
       const mockRes = { write: jest.fn(), flush: jest.fn() };
@@ -937,6 +1125,126 @@ describe('User parameter passing tests', () => {
       expect(getRoleByName).toHaveBeenCalledTimes(1);
       expect(mockCallTool).toHaveBeenCalledTimes(2);
     });
+
+    it('should pass the captured user to MCPManager.callTool when invocation config omits configurable.user', async () => {
+      const mockUser = { id: 'captured-user', email: 'captured@example.com', role: 'USER' };
+      const mockRes = { write: jest.fn(), flush: jest.fn() };
+      const { getRoleByName } = require('~/models');
+      getRoleByName.mockResolvedValue({
+        permissions: {
+          [PermissionTypes.MCP_SERVERS]: {
+            [Permissions.USE]: true,
+          },
+        },
+      });
+
+      const mockCallTool = jest.fn().mockResolvedValue(['ok', null]);
+      mockGetMCPManager.mockReturnValue({
+        callTool: mockCallTool,
+      });
+
+      const mcpTool = await createMCPTool({
+        res: mockRes,
+        user: mockUser,
+        toolKey: `test-tool${D}test-server`,
+        provider: 'openai',
+        userMCPAuthMap: {},
+        availableTools: {
+          [`test-tool${D}test-server`]: {
+            function: {
+              description: 'Cached tool',
+              parameters: { type: 'object', properties: {} },
+            },
+          },
+        },
+      });
+
+      await expect(
+        mcpTool.invoke(
+          {},
+          {
+            configurable: {
+              user_id: mockUser.id,
+            },
+            metadata: {
+              provider: 'openai',
+              thread_id: 'thread-1',
+              run_id: 'run-1',
+            },
+            toolCall: {},
+          },
+        ),
+      ).resolves.toBe('ok');
+
+      expect(mockCallTool).toHaveBeenCalledWith(
+        expect.objectContaining({
+          serverName: 'test-server',
+          toolName: 'test-tool',
+          user: mockUser,
+        }),
+      );
+    });
+
+    it('should pass captured request body when invocation config omits requestBody', async () => {
+      const mockUser = { id: 'captured-body-user', email: 'captured@example.com', role: 'USER' };
+      const requestBody = { conversationId: 'conv-123', messageId: 'msg-123' };
+      const mockRes = { write: jest.fn(), flush: jest.fn() };
+      const { getRoleByName } = require('~/models');
+      getRoleByName.mockResolvedValue({
+        permissions: {
+          [PermissionTypes.MCP_SERVERS]: {
+            [Permissions.USE]: true,
+          },
+        },
+      });
+
+      const mockCallTool = jest.fn().mockResolvedValue(['ok', null]);
+      mockGetMCPManager.mockReturnValue({
+        callTool: mockCallTool,
+      });
+
+      const mcpTool = await createMCPTool({
+        res: mockRes,
+        user: mockUser,
+        requestBody,
+        toolKey: `test-tool${D}test-server`,
+        provider: 'openai',
+        userMCPAuthMap: {},
+        availableTools: {
+          [`test-tool${D}test-server`]: {
+            function: {
+              description: 'Cached tool',
+              parameters: { type: 'object', properties: {} },
+            },
+          },
+        },
+      });
+
+      await expect(
+        mcpTool.invoke(
+          {},
+          {
+            configurable: {
+              user: mockUser,
+            },
+            metadata: {
+              provider: 'openai',
+              thread_id: 'thread-1',
+              run_id: 'run-1',
+            },
+            toolCall: {},
+          },
+        ),
+      ).resolves.toBe('ok');
+
+      expect(mockCallTool).toHaveBeenCalledWith(
+        expect.objectContaining({
+          serverName: 'test-server',
+          toolName: 'test-tool',
+          requestBody,
+        }),
+      );
+    });
   });
 
   describe('reinitMCPServer (via reconnectServer)', () => {
@@ -1107,6 +1415,50 @@ describe('User parameter passing tests', () => {
       });
     });
 
+    it('should validate the resolved runtime URL for tool creation', async () => {
+      const mockUser = { id: 'runtime-domain-user', role: 'user' };
+      const requestBody = { conversationId: 'tenant-a' };
+      const mockRes = { write: jest.fn(), flush: jest.fn() };
+
+      mockRegistryInstance.getServerConfig.mockResolvedValue({
+        type: 'streamable-http',
+        url: 'https://{{LIBRECHAT_BODY_CONVERSATIONID}}.example.com/sse',
+        source: 'yaml',
+      });
+
+      mockGetAppConfig.mockResolvedValue({
+        mcpSettings: { allowedDomains: ['*.example.com'] },
+      });
+
+      mockIsMCPDomainAllowed.mockResolvedValueOnce(true);
+
+      const result = await createMCPTool({
+        res: mockRes,
+        user: mockUser,
+        requestBody,
+        toolKey: `test-tool${D}test-server`,
+        provider: 'openai',
+        userMCPAuthMap: {},
+        availableTools: {
+          [`test-tool${D}test-server`]: {
+            function: {
+              description: 'Test tool',
+              parameters: { type: 'object', properties: {} },
+            },
+          },
+        },
+      });
+
+      expect(result).toBeDefined();
+      expect(mockIsMCPDomainAllowed).toHaveBeenCalledWith(
+        expect.objectContaining({
+          url: 'https://tenant-a.example.com/sse',
+        }),
+        ['*.example.com'],
+        undefined,
+      );
+    });
+
     it('should skip domain validation for stdio transports (no URL)', async () => {
       const mockUser = { id: 'stdio-test-user' };
       const mockRes = { write: jest.fn(), flush: jest.fn() };
@@ -1390,6 +1742,56 @@ describe('User parameter passing tests', () => {
       // Still only 1 real reconnect — user B was protected by the cache
       expect(mockReinitMCPServer).toHaveBeenCalledTimes(1);
     });
+
+    it('should bypass the negative cache for request-scoped tools', async () => {
+      const userA = { id: 'request-scoped-user-A' };
+      const userB = { id: 'request-scoped-user-B' };
+      const mockRes = { write: jest.fn(), flush: jest.fn() };
+      const serverName = 'request-scoped-server';
+      const toolKey = `tenant-tool${D}${serverName}`;
+
+      mockRegistryInstance.getServerConfig.mockResolvedValue({
+        type: 'streamable-http',
+        url: 'https://api.example.com/{{LIBRECHAT_BODY_MESSAGEID}}/mcp',
+        source: 'yaml',
+      });
+
+      mockReinitMCPServer
+        .mockResolvedValueOnce({
+          availableTools: {},
+        })
+        .mockResolvedValueOnce({
+          availableTools: {
+            [toolKey]: {
+              function: { description: 'Tenant tool', parameters: {} },
+            },
+          },
+        });
+
+      await createMCPTool({
+        res: mockRes,
+        user: userA,
+        requestBody: { messageId: 'message-a' },
+        toolKey,
+        provider: 'openai',
+        userMCPAuthMap: {},
+        availableTools: undefined,
+      });
+
+      const result = await createMCPTool({
+        res: mockRes,
+        user: userB,
+        requestBody: { messageId: 'message-b' },
+        toolKey,
+        provider: 'openai',
+        userMCPAuthMap: {},
+        availableTools: undefined,
+      });
+
+      expect(result).toBeDefined();
+      expect(result.name).toContain('tenant-tool');
+      expect(mockReinitMCPServer).toHaveBeenCalledTimes(2);
+    });
   });
 
   describe('createMCPTools throttle handling', () => {
diff --git a/api/server/services/MCPRequestContext.js b/api/server/services/MCPRequestContext.js
new file mode 100644
index 00000000000..50a9c90a61e
--- /dev/null
+++ b/api/server/services/MCPRequestContext.js
@@ -0,0 +1,13 @@
+const {
+  cleanupMCPRequestContextForReq,
+  cleanupMCPRequestContext,
+  createMCPRequestContext,
+  getMCPRequestContext,
+} = require('@librechat/api');
+
+module.exports = {
+  cleanupMCPRequestContextForReq,
+  cleanupMCPRequestContext,
+  createMCPRequestContext,
+  getMCPRequestContext,
+};
diff --git a/api/server/services/PermissionService.js b/api/server/services/PermissionService.js
index 9d40564127c..65336ab0022 100644
--- a/api/server/services/PermissionService.js
+++ b/api/server/services/PermissionService.js
@@ -27,6 +27,22 @@ const validateResourceType = (resourceType) => {
   }
 };
 
+const ensureLocalUserPrincipalExists = async (principalId) => {
+  const user = await db.findUser({ _id: principalId }, '_id');
+  if (!user) {
+    throw new Error('User principal not found');
+  }
+  return user._id.toString();
+};
+
+const ensureLocalGroupPrincipalExists = async (principalId) => {
+  const group = await db.findGroupById(principalId, { _id: 1 });
+  if (!group) {
+    throw new Error('Group principal not found');
+  }
+  return group._id.toString();
+};
+
 /**
  * @import { TPrincipal } from 'librechat-data-provider'
  */
@@ -300,8 +316,8 @@ const ensurePrincipalExists = async function (principal) {
     return null;
   }
 
-  if (principal.id) {
-    return principal.id;
+  if (principal.type === PrincipalType.USER && principal.id) {
+    return await ensureLocalUserPrincipalExists(principal.id);
   }
 
   if (principal.type === PrincipalType.USER && principal.source === 'entra') {
@@ -366,6 +382,10 @@ const ensureGroupPrincipalExists = async function (principal, authContext = null
     throw new Error(`Invalid principal type: ${principal.type}. Expected '${PrincipalType.GROUP}'`);
   }
 
+  if (principal.id && principal.source !== 'entra') {
+    return await ensureLocalGroupPrincipalExists(principal.id);
+  }
+
   if (principal.source === 'entra') {
     if (!principal.name || !principal.idOnTheSource) {
       throw new Error('Entra ID group principals must have name and idOnTheSource');
diff --git a/api/server/services/PermissionService.spec.js b/api/server/services/PermissionService.spec.js
index 3fcda2a8404..d6f78414a85 100644
--- a/api/server/services/PermissionService.spec.js
+++ b/api/server/services/PermissionService.spec.js
@@ -1,5 +1,5 @@
 const mongoose = require('mongoose');
-const { RoleBits, createModels } = require('@librechat/data-schemas');
+const { RoleBits, createModels, tenantStorage } = require('@librechat/data-schemas');
 const { MongoMemoryServer } = require('mongodb-memory-server');
 const {
   ResourceType,
@@ -15,6 +15,8 @@ const {
   getAvailableRoles,
   grantPermission,
   checkPermission,
+  ensurePrincipalExists,
+  ensureGroupPrincipalExists,
 } = require('./PermissionService');
 const { findRoleByIdentifier, getUserPrincipals, seedDefaultRoles } = require('~/models');
 
@@ -44,6 +46,8 @@ jest.mock('~/config', () => ({
 
 let mongoServer;
 let AclEntry;
+let User;
+let Group;
 
 beforeAll(async () => {
   mongoServer = await MongoMemoryServer.create();
@@ -58,6 +62,8 @@ beforeAll(async () => {
   Object.assign(mongoose.models, dbModels);
 
   AclEntry = dbModels.AclEntry;
+  User = dbModels.User;
+  Group = dbModels.Group;
 
   // Seed default roles
   await seedDefaultRoles();
@@ -243,6 +249,69 @@ describe('PermissionService', () => {
     });
   });
 
+  describe('principal validation for ACL writes', () => {
+    beforeEach(async () => {
+      await User.deleteMany({ email: /acl-principal/i });
+      await Group.deleteMany({ name: /ACL Principal/i });
+    });
+
+    test('rejects a local user id outside the current request context', async () => {
+      const outsideUser = await User.create({
+        name: 'ACL Principal Outside User',
+        email: 'acl-principal-outside-user@example.com',
+        tenantId: 'tenant-b',
+      });
+
+      await expect(
+        tenantStorage.run({ tenantId: 'tenant-a' }, async () =>
+          ensurePrincipalExists({
+            type: PrincipalType.USER,
+            id: outsideUser._id.toString(),
+            name: 'Outside User',
+            source: 'local',
+          }),
+        ),
+      ).rejects.toThrow('User principal not found');
+    });
+
+    test('accepts a local user id in the current request context', async () => {
+      const currentUser = await User.create({
+        name: 'ACL Principal Current User',
+        email: 'acl-principal-current-user@example.com',
+        tenantId: 'tenant-a',
+      });
+
+      const principalId = await tenantStorage.run({ tenantId: 'tenant-a' }, async () =>
+        ensurePrincipalExists({
+          type: PrincipalType.USER,
+          id: currentUser._id.toString(),
+          name: 'Current User',
+          source: 'local',
+        }),
+      );
+
+      expect(principalId).toBe(currentUser._id.toString());
+    });
+
+    test('rejects a local group id outside the current request context', async () => {
+      const outsideGroup = await Group.create({
+        name: 'ACL Principal Outside Group',
+        tenantId: 'tenant-b',
+      });
+
+      await expect(
+        tenantStorage.run({ tenantId: 'tenant-a' }, async () =>
+          ensureGroupPrincipalExists({
+            type: PrincipalType.GROUP,
+            id: outsideGroup._id.toString(),
+            name: 'Outside Group',
+            source: 'local',
+          }),
+        ),
+      ).rejects.toThrow('Group principal not found');
+    });
+  });
+
   describe('checkPermission', () => {
     let otherResourceId;
 
diff --git a/api/server/services/Skills/sync.js b/api/server/services/Skills/sync.js
new file mode 100644
index 00000000000..f19005639f1
--- /dev/null
+++ b/api/server/services/Skills/sync.js
@@ -0,0 +1,215 @@
+const { FileContext } = require('librechat-data-provider');
+const {
+  getStorageMetadata,
+  createGitHubSkillSyncRunner,
+  createSkillSyncTriggerOrchestrator,
+  startGitHubSkillSyncScheduler,
+} = require('@librechat/api');
+const { logger, runAsSystem } = require('@librechat/data-schemas');
+const db = require('~/models');
+const { getAppConfig } = require('~/server/services/Config');
+const { getStrategyFunctions } = require('~/server/services/Files/strategies');
+const { getFileStrategy } = require('~/server/utils/getFileStrategy');
+
+const SYSTEM_USER_ID = '000000000000000000000000';
+
+let appConfigRef;
+let runner;
+let scheduler;
+
+async function loadCurrentAppConfig() {
+  try {
+    const appConfig = await getAppConfig({ baseOnly: true });
+    appConfigRef = appConfig;
+    return appConfig;
+  } catch (error) {
+    if (appConfigRef) {
+      return appConfigRef;
+    }
+    throw error;
+  }
+}
+
+async function getSyncConfig(loadAppConfig = loadCurrentAppConfig) {
+  const appConfig = await loadAppConfig();
+  return appConfig?.skillSync;
+}
+
+async function resolveSkillStorage({ isImage = false, loadAppConfig = loadCurrentAppConfig } = {}) {
+  const appConfig = await loadAppConfig();
+  const source = getFileStrategy(appConfig, { context: FileContext.skill_file, isImage });
+  const strategy = getStrategyFunctions(source);
+  if (!strategy.saveBuffer) {
+    throw new Error(`Storage backend "${source}" does not support file writes`);
+  }
+  return { source, saveBuffer: strategy.saveBuffer };
+}
+
+async function getSyntheticReq({ userId = SYSTEM_USER_ID, tenantId, loadAppConfig } = {}) {
+  const appConfig = await (loadAppConfig ?? loadCurrentAppConfig)();
+  return {
+    config: appConfig,
+    user: {
+      id: userId,
+      _id: userId,
+      tenantId,
+    },
+  };
+}
+
+function withBaseSkillSyncConfig(req, baseConfig) {
+  if (!req?.config || req.config.config?.skillSync !== undefined) {
+    return req;
+  }
+  return {
+    ...req,
+    config: {
+      ...req.config,
+      config: {
+        ...(req.config.config ?? {}),
+        skillSync: baseConfig?.skillSync,
+      },
+    },
+  };
+}
+
+function createRunner({ getConfig, loadAppConfig, allowServerCredentials = true } = {}) {
+  const resolveAppConfig = loadAppConfig ?? loadCurrentAppConfig;
+  const resolveConfig = getConfig ?? (() => getSyncConfig(resolveAppConfig));
+  const createdRunner = createGitHubSkillSyncRunner({
+    getConfig: resolveConfig,
+    getCredentialToken: db.getSkillSyncCredentialToken,
+    getCredentialSummary: db.getSkillSyncCredentialSummary,
+    listCredentials: db.listSkillSyncCredentials,
+    listStatuses: db.listSkillSyncStatuses,
+    upsertStatus: db.upsertSkillSyncStatus,
+    tryAcquireLock: db.tryAcquireSkillSyncLock,
+    refreshLock: db.refreshSkillSyncLock,
+    releaseLock: db.releaseSkillSyncLock,
+    createSkill: db.createSkill,
+    updateSkill: db.updateSkill,
+    getSkillById: db.getSkillById,
+    findSkillBySourceIdentity: db.findSkillBySourceIdentity,
+    listSkillsBySource: db.listSkillsBySource,
+    listSkillFiles: db.listSkillFiles,
+    getSkillFileByPath: db.getSkillFileByPath,
+    upsertSkillFile: db.upsertSkillFile,
+    deleteSkillFile: db.deleteSkillFile,
+    deleteSkill: db.deleteSkill,
+    grantPermission: async ({
+      principalType,
+      principalId,
+      resourceType,
+      resourceId,
+      accessRoleId,
+      grantedBy,
+    }) => {
+      // Default access roles are seeded globally (no tenantId) under runAsSystem,
+      // but the runner may execute inside a source's tenant context. Resolve the
+      // role outside tenant isolation so the global role matches, then write the
+      // ACL entry in the active (tenant) context so tenant users can see it.
+      const role = await runAsSystem(() => db.findRoleByIdentifier(accessRoleId));
+      if (!role) {
+        throw new Error(`Role ${accessRoleId} not found`);
+      }
+      if (role.resourceType !== resourceType) {
+        throw new Error(
+          `Role ${accessRoleId} is for ${role.resourceType} resources, not ${resourceType}`,
+        );
+      }
+      return db.grantPermission(
+        principalType,
+        principalId,
+        resourceType,
+        resourceId,
+        role.permBits,
+        grantedBy,
+        undefined,
+        role._id,
+      );
+    },
+    saveBuffer: async ({ userId, buffer, fileName, basePath, isImage, tenantId }) => {
+      const storage = await resolveSkillStorage({ isImage, loadAppConfig: resolveAppConfig });
+      const filepath = await storage.saveBuffer({
+        userId: userId ?? SYSTEM_USER_ID,
+        buffer,
+        fileName,
+        basePath,
+        tenantId,
+      });
+      return {
+        filepath,
+        source: storage.source,
+        ...getStorageMetadata({ filepath, source: storage.source }),
+      };
+    },
+    deleteFile: async (file) => {
+      const strategy = getStrategyFunctions(file.source);
+      if (!strategy.deleteFile) {
+        return;
+      }
+      await strategy.deleteFile(
+        await getSyntheticReq({
+          userId: file.user?.toString?.() ?? file.user ?? SYSTEM_USER_ID,
+          tenantId: file.tenantId,
+          loadAppConfig: resolveAppConfig,
+        }),
+        file,
+      );
+    },
+    allowServerCredentials,
+  });
+  return {
+    getStatus: createdRunner.getStatus,
+    runOnce: createdRunner.runOnce,
+  };
+}
+
+const triggerOrchestrator = createSkillSyncTriggerOrchestrator({
+  createRunner,
+  logger,
+});
+
+function getGitHubSkillSyncRunnerForRequest(req) {
+  return triggerOrchestrator.getRunnerForAdminRequest(withBaseSkillSyncConfig(req, appConfigRef));
+}
+
+async function maybeRunGitHubSkillSyncForRequest(req) {
+  const baseConfig = await loadCurrentAppConfig();
+  return triggerOrchestrator.maybeRunForRequest({
+    ...withBaseSkillSyncConfig(req, baseConfig),
+    skillSyncAllowServerCredentials: false,
+  });
+}
+
+function initializeGitHubSkillSync(appConfig) {
+  appConfigRef = appConfig;
+  runner = createRunner();
+  scheduler = startGitHubSkillSyncScheduler({
+    getConfig: getSyncConfig,
+    runner,
+  });
+  return { runner, scheduler };
+}
+
+function getGitHubSkillSyncRunner() {
+  if (!runner) {
+    runner = createRunner();
+  }
+  return runner;
+}
+
+function stopGitHubSkillSyncScheduler() {
+  if (scheduler) {
+    scheduler.stop();
+    scheduler = undefined;
+  }
+}
+
+module.exports = {
+  initializeGitHubSkillSync,
+  getGitHubSkillSyncRunner,
+  getGitHubSkillSyncRunnerForRequest,
+  maybeRunGitHubSkillSyncForRequest,
+  stopGitHubSkillSyncScheduler,
+};
diff --git a/api/server/services/Skills/sync.test.js b/api/server/services/Skills/sync.test.js
new file mode 100644
index 00000000000..069ffc6db27
--- /dev/null
+++ b/api/server/services/Skills/sync.test.js
@@ -0,0 +1,583 @@
+const mockGetAppConfig = jest.fn();
+const mockGetStrategyFunctions = jest.fn();
+const mockGetFileStrategy = jest.fn();
+const mockFindRoleByIdentifier = jest.fn();
+const mockGrantPermission = jest.fn();
+let mockRunnerDeps;
+let mockRunnerStatus;
+const mockCreatedRunners = [];
+
+jest.mock('~/server/services/Config', () => ({
+  getAppConfig: mockGetAppConfig,
+}));
+
+jest.mock('@librechat/api', () => {
+  const actualApi = jest.requireActual('@librechat/api');
+  return {
+    createSkillSyncTriggerOrchestrator: actualApi.createSkillSyncTriggerOrchestrator,
+    createGitHubSkillSyncRunner: jest.fn((deps) => {
+      mockRunnerDeps = deps;
+      const runner = {
+        getStatus: jest.fn(async () => {
+          if (mockRunnerStatus) {
+            return mockRunnerStatus;
+          }
+          const config = await deps.getConfig();
+          const github = config?.github ?? {};
+          return {
+            enabled: github.enabled ?? false,
+            intervalMinutes: github.intervalMinutes ?? 60,
+            runOnStartup: github.runOnStartup ?? false,
+            sources: (github.sources ?? []).map((source) => ({
+              provider: 'github',
+              sourceId: source.id,
+              status: 'idle',
+              credentialPresent:
+                deps.allowServerCredentials !== false &&
+                Boolean(source.credentialKey || source.token),
+              owner: source.owner,
+              repo: source.repo,
+              ref: source.ref,
+              paths: source.paths,
+              syncedSkillCount: 0,
+              syncedFileCount: 0,
+              deletedSkillCount: 0,
+              deletedFileCount: 0,
+            })),
+            credentials: [],
+          };
+        }),
+        runOnce: jest.fn(async () => deps.getConfig()),
+      };
+      mockCreatedRunners.push({ deps, runner });
+      return runner;
+    }),
+    getStorageMetadata: jest.fn(() => ({})),
+    startGitHubSkillSyncScheduler: jest.fn(() => ({ stop: jest.fn() })),
+  };
+});
+
+jest.mock('@librechat/data-schemas', () => ({
+  logger: {
+    error: jest.fn(),
+    warn: jest.fn(),
+  },
+  runAsSystem: jest.fn((fn) => fn()),
+}));
+
+jest.mock('~/models', () => ({
+  findRoleByIdentifier: mockFindRoleByIdentifier,
+  grantPermission: mockGrantPermission,
+  getSkillSyncCredentialToken: jest.fn(),
+  getSkillSyncCredentialSummary: jest.fn(),
+  listSkillSyncCredentials: jest.fn(async () => []),
+  listSkillSyncStatuses: jest.fn(async () => []),
+  upsertSkillSyncStatus: jest.fn(),
+  tryAcquireSkillSyncLock: jest.fn(),
+  refreshSkillSyncLock: jest.fn(),
+  releaseSkillSyncLock: jest.fn(),
+  createSkill: jest.fn(),
+  updateSkill: jest.fn(),
+  getSkillById: jest.fn(),
+  findSkillBySourceIdentity: jest.fn(),
+  listSkillsBySource: jest.fn(),
+  listSkillFiles: jest.fn(),
+  getSkillFileByPath: jest.fn(),
+  upsertSkillFile: jest.fn(),
+  deleteSkillFile: jest.fn(),
+  deleteSkill: jest.fn(),
+}));
+jest.mock('~/server/services/Files/strategies', () => ({
+  getStrategyFunctions: mockGetStrategyFunctions,
+}));
+jest.mock('~/server/utils/getFileStrategy', () => ({ getFileStrategy: mockGetFileStrategy }));
+
+describe('GitHub skill sync service', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockGetAppConfig.mockReset();
+    mockGetStrategyFunctions.mockReset();
+    mockGetFileStrategy.mockReset();
+    mockFindRoleByIdentifier.mockReset();
+    mockGrantPermission.mockReset();
+    mockRunnerDeps = undefined;
+    mockRunnerStatus = undefined;
+    mockCreatedRunners.length = 0;
+  });
+
+  it('resolves sync config from fresh base app config for runner operations', async () => {
+    const startupSkillSync = {
+      github: {
+        enabled: false,
+        intervalMinutes: 60,
+        runOnStartup: false,
+        sources: [],
+      },
+    };
+    const freshSkillSync = {
+      github: {
+        enabled: true,
+        intervalMinutes: 5,
+        runOnStartup: false,
+        sources: [
+          {
+            id: 'librechat-skills',
+            owner: 'LibreChat',
+            repo: 'skills',
+            ref: 'main',
+            paths: ['skills'],
+            credentialKey: 'github-skills-prod',
+          },
+        ],
+      },
+    };
+    mockGetAppConfig.mockResolvedValue({ skillSync: freshSkillSync });
+
+    const service = require('./sync');
+    const { runner } = service.initializeGitHubSkillSync({ skillSync: startupSkillSync });
+    const result = await runner.runOnce();
+
+    expect(result).toBe(freshSkillSync);
+    expect(mockRunnerDeps.getConfig).toBeDefined();
+    expect(mockGetAppConfig).toHaveBeenCalledWith({ baseOnly: true });
+  });
+
+  it('does not return raw unvalidated config.skillSync as sync config', async () => {
+    const rawSkillSync = {
+      github: {
+        enabled: true,
+        sources: 'not-an-array',
+      },
+    };
+    mockGetAppConfig.mockResolvedValue({ config: { skillSync: rawSkillSync } });
+
+    const service = require('./sync');
+    const { runner } = service.initializeGitHubSkillSync({ config: { skillSync: rawSkillSync } });
+    const result = await runner.runOnce();
+
+    expect(result).toBeUndefined();
+    expect(mockGetAppConfig).toHaveBeenCalledWith({ baseOnly: true });
+  });
+
+  it('does not let user skill-list sync use server credentials from resolved config', async () => {
+    const skillSync = {
+      github: {
+        enabled: true,
+        intervalMinutes: 60,
+        runOnStartup: true,
+        sources: [
+          {
+            id: 'tenant-skills',
+            owner: 'LibreChat',
+            repo: 'skills',
+            ref: 'main',
+            paths: ['skills'],
+            token: '${GITHUB_SKILLS_TOKEN}',
+            tenantId: 'other-tenant',
+          },
+        ],
+      },
+    };
+
+    const service = require('./sync');
+    const started = await service.maybeRunGitHubSkillSyncForRequest({
+      config: { skillSync, config: {} },
+      user: { id: 'user-1', tenantId: 'tenant-a' },
+    });
+
+    const requestRunner = mockCreatedRunners[0].runner;
+    const requestConfig = await mockCreatedRunners[0].deps.getConfig();
+    expect(started).toBe(false);
+    expect(mockCreatedRunners[0].deps.allowServerCredentials).toBe(false);
+    expect(requestRunner.runOnce).not.toHaveBeenCalled();
+    expect(requestConfig.github.runOnStartup).toBe(false);
+    expect(requestConfig.github.sources[0]).toEqual(
+      expect.objectContaining({
+        id: 'tenant-skills',
+        tenantId: 'tenant-a',
+      }),
+    );
+  });
+
+  it('does not auto-start request-scoped sync when server credentials are unavailable', async () => {
+    const skillSync = {
+      github: {
+        enabled: true,
+        intervalMinutes: 60,
+        runOnStartup: true,
+        sources: [
+          {
+            id: 'tenant-skills',
+            owner: 'LibreChat',
+            repo: 'skills',
+            ref: 'main',
+            paths: ['skills'],
+            token: '${GITHUB_SKILLS_TOKEN}',
+          },
+        ],
+      },
+    };
+    mockRunnerStatus = {
+      enabled: true,
+      intervalMinutes: 60,
+      runOnStartup: false,
+      sources: [
+        {
+          provider: 'github',
+          sourceId: 'tenant-skills',
+          status: 'idle',
+          credentialPresent: false,
+          owner: 'LibreChat',
+          repo: 'skills',
+          ref: 'main',
+          paths: ['skills'],
+          syncedSkillCount: 0,
+          syncedFileCount: 0,
+          deletedSkillCount: 0,
+          deletedFileCount: 0,
+        },
+      ],
+      credentials: [],
+    };
+
+    const service = require('./sync');
+    const started = await service.maybeRunGitHubSkillSyncForRequest({
+      config: { skillSync, config: {} },
+      user: { id: 'user-1', tenantId: 'tenant-a' },
+    });
+
+    expect(started).toBe(false);
+    expect(mockCreatedRunners[0].deps.allowServerCredentials).toBe(false);
+    expect(mockCreatedRunners[0].runner.runOnce).not.toHaveBeenCalled();
+  });
+
+  it('does not start a request-scoped sync for base YAML skillSync config', async () => {
+    const skillSync = {
+      github: {
+        enabled: true,
+        intervalMinutes: 60,
+        runOnStartup: true,
+        sources: [
+          {
+            id: 'base-skills',
+            owner: 'LibreChat',
+            repo: 'skills',
+            ref: 'main',
+            paths: ['skills'],
+            token: '${GITHUB_SKILLS_TOKEN}',
+          },
+        ],
+      },
+    };
+    mockGetAppConfig.mockResolvedValue({ skillSync });
+
+    const service = require('./sync');
+    const started = await service.maybeRunGitHubSkillSyncForRequest({
+      config: { skillSync },
+      user: { id: 'user-1', tenantId: 'tenant-a' },
+    });
+
+    expect(started).toBe(false);
+    expect(mockCreatedRunners).toHaveLength(0);
+    expect(mockGetAppConfig).toHaveBeenCalledWith({ baseOnly: true });
+  });
+
+  it('creates an admin request runner from resolved skillSync config overrides', async () => {
+    const skillSync = {
+      github: {
+        enabled: true,
+        intervalMinutes: 60,
+        runOnStartup: true,
+        sources: [
+          {
+            id: 'tenant-skills',
+            owner: 'LibreChat',
+            repo: 'skills',
+            ref: 'main',
+            paths: ['skills'],
+            token: '${GITHUB_SKILLS_TOKEN}',
+            tenantId: 'other-tenant',
+          },
+        ],
+      },
+    };
+
+    const service = require('./sync');
+    const runner = service.getGitHubSkillSyncRunnerForRequest({
+      config: { skillSync, config: {} },
+      user: { id: 'user-1', tenantId: 'tenant-a' },
+      skillSyncAllowServerCredentials: true,
+    });
+    const config = await mockCreatedRunners[0].deps.getConfig();
+
+    expect(runner.runOnce).toBe(mockCreatedRunners[0].runner.runOnce);
+    expect(runner.getStatus).toBe(mockCreatedRunners[0].runner.getStatus);
+    expect(mockCreatedRunners[0].deps.allowServerCredentials).toBe(true);
+    expect(config.github.runOnStartup).toBe(true);
+    expect(config.github.sources[0]).toEqual(
+      expect.objectContaining({ id: 'tenant-skills', tenantId: 'tenant-a' }),
+    );
+  });
+
+  it('preserves base admin runner tenant scope when request config has no nested base copy', async () => {
+    const skillSync = {
+      github: {
+        enabled: true,
+        intervalMinutes: 60,
+        runOnStartup: true,
+        sources: [
+          {
+            id: 'base-skills',
+            owner: 'LibreChat',
+            repo: 'skills',
+            ref: 'main',
+            paths: ['skills'],
+            token: '${GITHUB_SKILLS_TOKEN}',
+            tenantId: 'base-tenant',
+          },
+        ],
+      },
+    };
+
+    const service = require('./sync');
+    service.initializeGitHubSkillSync({ skillSync });
+    service.getGitHubSkillSyncRunnerForRequest({
+      config: { skillSync },
+      user: { id: 'user-1', tenantId: 'tenant-a' },
+      skillSyncAllowServerCredentials: true,
+    });
+    const config = await mockCreatedRunners[1].deps.getConfig();
+
+    expect(config.github.sources[0]).toEqual(
+      expect.objectContaining({ id: 'base-skills', tenantId: 'base-tenant' }),
+    );
+  });
+
+  it('does not allow request-built admin override runners to use server credentials by default', async () => {
+    const skillSync = {
+      github: {
+        enabled: true,
+        intervalMinutes: 60,
+        runOnStartup: true,
+        sources: [
+          {
+            id: 'tenant-skills',
+            owner: 'LibreChat',
+            repo: 'skills',
+            ref: 'main',
+            paths: ['skills'],
+            token: '${GITHUB_SKILLS_TOKEN}',
+          },
+        ],
+      },
+    };
+
+    const service = require('./sync');
+    service.getGitHubSkillSyncRunnerForRequest({
+      config: { skillSync, config: {} },
+      user: { id: 'user-1', tenantId: 'tenant-a' },
+    });
+
+    expect(mockCreatedRunners[0].deps.allowServerCredentials).toBe(false);
+  });
+
+  it('does not start a request-scoped sync when the configured source is already running', async () => {
+    const skillSync = {
+      github: {
+        enabled: true,
+        intervalMinutes: 60,
+        runOnStartup: false,
+        sources: [
+          {
+            id: 'tenant-skills',
+            owner: 'LibreChat',
+            repo: 'skills',
+            ref: 'main',
+            paths: ['skills'],
+            token: '${GITHUB_SKILLS_TOKEN}',
+          },
+        ],
+      },
+    };
+    mockRunnerStatus = {
+      enabled: true,
+      intervalMinutes: 60,
+      runOnStartup: false,
+      sources: [
+        {
+          provider: 'github',
+          sourceId: 'tenant-skills',
+          status: 'running',
+          credentialPresent: true,
+          owner: 'LibreChat',
+          repo: 'skills',
+          ref: 'main',
+          paths: ['skills'],
+          startedAt: new Date(),
+          syncedSkillCount: 0,
+          syncedFileCount: 0,
+          deletedSkillCount: 0,
+          deletedFileCount: 0,
+        },
+      ],
+      credentials: [],
+    };
+
+    const service = require('./sync');
+    const started = await service.maybeRunGitHubSkillSyncForRequest({
+      config: { skillSync, config: {} },
+      user: { id: 'user-1', tenantId: 'tenant-a' },
+    });
+
+    expect(started).toBe(false);
+    expect(mockCreatedRunners[0].runner.runOnce).not.toHaveBeenCalled();
+  });
+
+  it('retries a request-scoped sync when a running source status is stale', async () => {
+    const skillSync = {
+      github: {
+        enabled: true,
+        intervalMinutes: 60,
+        runOnStartup: false,
+        sources: [
+          {
+            id: 'tenant-skills',
+            owner: 'LibreChat',
+            repo: 'skills',
+            ref: 'main',
+            paths: ['skills'],
+            token: '${GITHUB_SKILLS_TOKEN}',
+          },
+        ],
+      },
+    };
+    mockRunnerStatus = {
+      enabled: true,
+      intervalMinutes: 60,
+      runOnStartup: false,
+      sources: [
+        {
+          provider: 'github',
+          sourceId: 'tenant-skills',
+          status: 'running',
+          credentialPresent: true,
+          owner: 'LibreChat',
+          repo: 'skills',
+          ref: 'main',
+          paths: ['skills'],
+          startedAt: new Date(Date.now() - 40 * 60 * 1000),
+          syncedSkillCount: 0,
+          syncedFileCount: 0,
+          deletedSkillCount: 0,
+          deletedFileCount: 0,
+        },
+      ],
+      credentials: [],
+    };
+
+    const service = require('./sync');
+    const started = await service.maybeRunGitHubSkillSyncForRequest({
+      config: { skillSync, config: {} },
+      user: { id: 'user-1', tenantId: 'tenant-a' },
+    });
+
+    expect(started).toBe(true);
+    expect(mockCreatedRunners[0].runner.runOnce).toHaveBeenCalledTimes(1);
+  });
+
+  it('uses the file owner when deleting synced files from storage', async () => {
+    const deleteFile = jest.fn(async () => undefined);
+    const ownerId = '507f1f77bcf86cd799439011';
+    mockGetAppConfig.mockResolvedValue({ skillSync: undefined, paths: {} });
+    mockGetStrategyFunctions.mockReturnValue({ deleteFile });
+
+    const service = require('./sync');
+    service.initializeGitHubSkillSync({ skillSync: undefined });
+    await mockRunnerDeps.deleteFile({
+      filepath: `/uploads/${ownerId}/file.txt`,
+      source: 'local',
+      user: ownerId,
+      tenantId: 'tenant-a',
+    });
+
+    expect(deleteFile).toHaveBeenCalledWith(
+      expect.objectContaining({
+        user: expect.objectContaining({
+          id: ownerId,
+          _id: ownerId,
+          tenantId: 'tenant-a',
+        }),
+      }),
+      expect.objectContaining({
+        user: ownerId,
+        tenantId: 'tenant-a',
+      }),
+    );
+  });
+
+  it('does not force manual sync runs into the system tenant context', async () => {
+    const { runAsSystem } = require('@librechat/data-schemas');
+    mockGetAppConfig.mockResolvedValue({ skillSync: undefined, paths: {} });
+
+    const service = require('./sync');
+    const { runner } = service.initializeGitHubSkillSync({ skillSync: undefined });
+    await runner.runOnce();
+
+    expect(runAsSystem).not.toHaveBeenCalled();
+  });
+
+  it('resolves the access role outside tenant isolation but writes the ACL in context', async () => {
+    const { runAsSystem } = require('@librechat/data-schemas');
+    mockGetAppConfig.mockResolvedValue({ skillSync: undefined, paths: {} });
+    mockFindRoleByIdentifier.mockResolvedValue({
+      _id: 'role-object-id',
+      resourceType: 'skill',
+      permBits: 1,
+    });
+    mockGrantPermission.mockResolvedValue({ _id: 'acl-entry-id' });
+
+    const service = require('./sync');
+    service.initializeGitHubSkillSync({ skillSync: undefined });
+    await mockRunnerDeps.grantPermission({
+      principalType: 'public',
+      principalId: null,
+      resourceType: 'skill',
+      resourceId: 'skill-id',
+      accessRoleId: 'skill_viewer',
+      grantedBy: 'system',
+    });
+
+    expect(runAsSystem).toHaveBeenCalledTimes(1);
+    expect(mockFindRoleByIdentifier).toHaveBeenCalledWith('skill_viewer');
+    expect(mockGrantPermission).toHaveBeenCalledWith(
+      'public',
+      null,
+      'skill',
+      'skill-id',
+      1,
+      'system',
+      undefined,
+      'role-object-id',
+    );
+  });
+
+  it('fails the grant when the access role does not exist', async () => {
+    mockGetAppConfig.mockResolvedValue({ skillSync: undefined, paths: {} });
+    mockFindRoleByIdentifier.mockResolvedValue(null);
+
+    const service = require('./sync');
+    service.initializeGitHubSkillSync({ skillSync: undefined });
+
+    await expect(
+      mockRunnerDeps.grantPermission({
+        principalType: 'public',
+        principalId: null,
+        resourceType: 'skill',
+        resourceId: 'skill-id',
+        accessRoleId: 'skill_viewer',
+        grantedBy: 'system',
+      }),
+    ).rejects.toThrow('Role skill_viewer not found');
+    expect(mockGrantPermission).not.toHaveBeenCalled();
+  });
+});
diff --git a/api/server/services/ToolService.js b/api/server/services/ToolService.js
index 67b68bdad16..5624aef65f9 100644
--- a/api/server/services/ToolService.js
+++ b/api/server/services/ToolService.js
@@ -1,9 +1,7 @@
-const { logger } = require('@librechat/data-schemas');
+const { logger, redactMessage } = require('@librechat/data-schemas');
 const { tool: toolFn, DynamicStructuredTool } = require('@librechat/agents/langchain/tools');
 const {
   sleep,
-  StepTypes,
-  GraphEvents,
   createToolSearch,
   createBashExecutionTool,
   Constants: AgentConstants,
@@ -18,11 +16,18 @@ const {
   isActionDomainAllowed,
   buildWebSearchContext,
   buildImageToolContext,
-  buildOAuthToolCallName,
   buildToolClassification,
   getMissingCustomUserVars,
   buildWebSearchDynamicContext,
   getCodeApiAuthHeaders,
+  getReplayablePendingMCPOAuthStart,
+  getMCPServerNamesFromTools,
+  buildMCPAuthToolCall,
+  buildMCPAuthStepId,
+  buildMCPAuthRunStepEvent,
+  buildMCPAuthRunStepDeltaEvent,
+  buildMCPAuthRunStepCompletedEvent,
+  isFileAuthoringToolDefinition,
 } = require('@librechat/api');
 const {
   Time,
@@ -64,9 +69,9 @@ const { manifestToolMap, toolkits } = require('~/app/clients/tools/manifest');
 const { createOnSearchResults } = require('~/server/services/Tools/search');
 const { reinitMCPServer } = require('~/server/services/Tools/mcp');
 const { createMCPPermissionContext, resolveConfigServers } = require('~/server/services/MCP');
+const { getMCPRequestContext } = require('~/server/services/MCPRequestContext');
 const { recordUsage } = require('~/server/services/Threads');
 const { loadTools } = require('~/app/clients/tools/util');
-const { redactMessage } = require('~/config/parsers');
 const { findPluginAuthsByKeys } = require('~/models');
 const { getFlowStateManager, getMCPServersRegistry } = require('~/config');
 const { getLogStores } = require('~/cache');
@@ -524,6 +529,7 @@ const isBuiltInTool = (toolName) =>
  * @returns {Promise<{
  *   toolDefinitions?: import('@librechat/api').LCTool[];
  *   toolRegistry?: Map<string, import('@librechat/api').LCTool>;
+ *   mcpAvailableTools?: Record<string, import('@librechat/api').LCAvailableTools>;
  *   userMCPAuthMap?: Record<string, Record<string, string>>;
  *   hasDeferredTools?: boolean;
  * }>}
@@ -595,40 +601,44 @@ async function loadToolDefinitionsWrapper({ req, res, agent, streamId = null, to
   const flowManager = getFlowStateManager(flowsCache);
   const configServers = await resolveConfigServers(req);
   const pendingOAuthServers = new Set();
+  const pendingOAuthStarts = new Map();
+  const emittedOAuthStarts = new Map();
+  const oauthToolCallIds = new Map();
+  const oauthStepIndexes = new Map();
+  /** @type {Record<string, import('@librechat/api').LCAvailableTools>} */
+  const mcpAvailableTools = {};
+  const requestScopedConnections = getMCPRequestContext(req, res);
+  const rememberMCPAvailableTools = (serverName, availableTools) => {
+    if (!availableTools || Object.keys(availableTools).length === 0) {
+      return;
+    }
+    mcpAvailableTools[serverName] = availableTools;
+  };
 
-  const createOAuthEmitter = (serverName) => {
-    return async (authURL) => {
-      const flowId = `${req.user.id}:${serverName}:${Date.now()}`;
-      const stepId = 'step_oauth_login_' + serverName;
-      const toolCall = {
+  const createOAuthEmitter = (serverName, index) => {
+    return async (authURL, options) => {
+      if (emittedOAuthStarts.get(serverName) === authURL) {
+        return;
+      }
+      emittedOAuthStarts.set(serverName, authURL);
+
+      const flowId =
+        oauthToolCallIds.get(serverName) ?? `${req.user.id}:${serverName}:${Date.now()}`;
+      const stepId = buildMCPAuthStepId(serverName);
+      oauthToolCallIds.set(serverName, flowId);
+      oauthStepIndexes.set(serverName, index);
+      const toolCall = buildMCPAuthToolCall({
         id: flowId,
-        name: buildOAuthToolCallName(serverName),
-        type: 'tool_call_chunk',
-      };
-
-      const runStepData = {
-        runId: Constants.USE_PRELIM_RESPONSE_MESSAGE_ID,
-        id: stepId,
-        type: StepTypes.TOOL_CALLS,
-        index: 0,
-        stepDetails: {
-          type: StepTypes.TOOL_CALLS,
-          tool_calls: [toolCall],
-        },
-      };
-
-      const runStepDeltaData = {
-        id: stepId,
-        delta: {
-          type: StepTypes.TOOL_CALLS,
-          tool_calls: [{ ...toolCall, args: '' }],
-          auth: authURL,
-          expires_at: Date.now() + Time.TWO_MINUTES,
-        },
-      };
+        serverName,
+      });
 
-      const runStepEvent = { event: GraphEvents.ON_RUN_STEP, data: runStepData };
-      const runStepDeltaEvent = { event: GraphEvents.ON_RUN_STEP_DELTA, data: runStepDeltaData };
+      const runStepEvent = buildMCPAuthRunStepEvent({ stepId, toolCall, index });
+      const runStepDeltaEvent = buildMCPAuthRunStepDeltaEvent({
+        authURL,
+        stepId,
+        toolCall,
+        options,
+      });
 
       if (streamId) {
         await GenerationJobManager.emitChunk(streamId, runStepEvent);
@@ -644,7 +654,73 @@ async function loadToolDefinitionsWrapper({ req, res, agent, streamId = null, to
     };
   };
 
+  const createOAuthEndEmitter = (serverName) => {
+    return async () => {
+      const stepId = buildMCPAuthStepId(serverName);
+      const toolCall = buildMCPAuthToolCall({
+        id: oauthToolCallIds.get(serverName),
+        args: '',
+        output: 'OAuth authentication completed',
+        serverName,
+        type: 'tool_call',
+      });
+      const runStepCompletedEvent = buildMCPAuthRunStepCompletedEvent({
+        stepId,
+        toolCall,
+        index: oauthStepIndexes.get(serverName) ?? 0,
+      });
+
+      if (streamId) {
+        await GenerationJobManager.emitChunk(streamId, runStepCompletedEvent);
+      } else if (res && !res.writableEnded) {
+        sendEvent(res, runStepCompletedEvent);
+      } else {
+        logger.warn(
+          `[Tool Definitions] Cannot emit OAuth completion for ${serverName}: no streamId and res not available`,
+        );
+      }
+    };
+  };
+
+  const getPendingOAuthStartForEmit = async (serverName) => {
+    const cachedOAuthStart = pendingOAuthStarts.get(serverName);
+    if (cachedOAuthStart?.options?.expiresAt != null) {
+      return cachedOAuthStart;
+    }
+
+    const pendingOAuthStart = await getReplayablePendingMCPOAuthStart({
+      flowManager,
+      userId: req.user.id,
+      serverName,
+    });
+    if (!pendingOAuthStart) {
+      return cachedOAuthStart;
+    }
+
+    if (!cachedOAuthStart || pendingOAuthStart.authURL === cachedOAuthStart.authURL) {
+      pendingOAuthStarts.set(serverName, pendingOAuthStart);
+      return pendingOAuthStart;
+    }
+
+    return cachedOAuthStart;
+  };
+
   const getOrFetchMCPServerTools = async (userId, serverName) => {
+    const addPendingOAuthServer = async () => {
+      const pendingOAuthStart = await getReplayablePendingMCPOAuthStart({
+        flowManager,
+        userId,
+        serverName,
+      });
+      if (!pendingOAuthStart) {
+        return false;
+      }
+
+      pendingOAuthServers.add(serverName);
+      pendingOAuthStarts.set(serverName, pendingOAuthStart);
+      return true;
+    };
+
     let serverConfig;
     try {
       serverConfig =
@@ -677,13 +753,26 @@ async function loadToolDefinitionsWrapper({ req, res, agent, streamId = null, to
       return null;
     }
 
-    const cached = await getMCPServerTools(userId, serverName);
+    if (mcpAvailableTools[serverName]) {
+      return mcpAvailableTools[serverName];
+    }
+
+    const cached = await getMCPServerTools(userId, serverName, serverConfig);
     if (cached) {
+      rememberMCPAvailableTools(serverName, cached);
+      await addPendingOAuthServer();
       return cached;
     }
 
-    const oauthStart = async () => {
+    if (await addPendingOAuthServer()) {
+      return null;
+    }
+
+    const oauthStart = async (authURL, options) => {
       pendingOAuthServers.add(serverName);
+      if (typeof authURL === 'string' && authURL.length > 0) {
+        pendingOAuthStarts.set(serverName, { authURL, options });
+      }
     };
 
     const result = await reinitMCPServer({
@@ -693,8 +782,11 @@ async function loadToolDefinitionsWrapper({ req, res, agent, streamId = null, to
       serverName,
       configServers,
       userMCPAuthMap,
+      requestBody: req.body,
+      requestScopedConnections,
     });
 
+    rememberMCPAvailableTools(serverName, result?.availableTools);
     return result?.availableTools || null;
   };
 
@@ -766,6 +858,7 @@ async function loadToolDefinitionsWrapper({ req, res, agent, streamId = null, to
       deferredToolsEnabled,
       programmaticToolsEnabled,
       codeExecutionEnabled,
+      provider: agent.provider,
     },
     {
       isBuiltInTool,
@@ -774,26 +867,51 @@ async function loadToolDefinitionsWrapper({ req, res, agent, streamId = null, to
     },
   );
 
+  for (const serverName of getMCPServerNamesFromTools(filteredTools)) {
+    if (pendingOAuthServers.has(serverName)) {
+      continue;
+    }
+
+    const pendingOAuthStart = await getReplayablePendingMCPOAuthStart({
+      flowManager,
+      userId: req.user.id,
+      serverName,
+    });
+    if (pendingOAuthStart) {
+      pendingOAuthServers.add(serverName);
+      pendingOAuthStarts.set(serverName, pendingOAuthStart);
+    }
+  }
+
   if (pendingOAuthServers.size > 0 && (res || streamId)) {
     const serverNames = Array.from(pendingOAuthServers);
     logger.info(
       `[Tool Definitions] OAuth required for ${serverNames.length} server(s): ${serverNames.join(', ')}. Emitting events and waiting.`,
     );
 
-    const oauthWaitPromises = serverNames.map(async (serverName) => {
+    const oauthWaitPromises = serverNames.map(async (serverName, index) => {
       try {
+        const pendingOAuthStart = await getPendingOAuthStartForEmit(serverName);
+        const oauthStart = createOAuthEmitter(serverName, index);
+        if (pendingOAuthStart) {
+          await oauthStart(pendingOAuthStart.authURL, pendingOAuthStart.options);
+        }
+
         const result = await reinitMCPServer({
           user: req.user,
           serverName,
           configServers,
           userMCPAuthMap,
           flowManager,
+          requestBody: req.body,
           returnOnOAuth: false,
-          oauthStart: createOAuthEmitter(serverName),
+          oauthStart,
+          oauthEnd: createOAuthEndEmitter(serverName),
           connectionTimeout: Time.TWO_MINUTES,
         });
 
         if (result?.availableTools) {
+          rememberMCPAvailableTools(serverName, result.availableTools);
           logger.info(`[Tool Definitions] OAuth completed for ${serverName}, tools available`);
           return { serverName, success: true };
         }
@@ -822,6 +940,7 @@ async function loadToolDefinitionsWrapper({ req, res, agent, streamId = null, to
           deferredToolsEnabled,
           programmaticToolsEnabled,
           codeExecutionEnabled,
+          provider: agent.provider,
         },
         {
           isBuiltInTool,
@@ -921,6 +1040,8 @@ async function loadToolDefinitionsWrapper({ req, res, agent, streamId = null, to
 
   return {
     toolRegistry,
+    mcpAvailableTools,
+    requestScopedConnections,
     userMCPAuthMap,
     toolContextMap,
     dynamicToolContextMap,
@@ -1047,6 +1168,7 @@ async function loadAgentTools({
       uploadImageBuffer,
       returnMetadata: true,
       mcpPermissionContext,
+      requestScopedConnections: getMCPRequestContext(req, res),
       [Tools.web_search]: webSearchCallbacks,
     },
     webSearch: appConfig.webSearch,
@@ -1122,6 +1244,7 @@ async function loadAgentTools({
   if (!hasActionTools) {
     return {
       toolRegistry,
+      requestScopedConnections: getMCPRequestContext(req, res),
       userMCPAuthMap,
       toolContextMap,
       dynamicToolContextMap,
@@ -1140,6 +1263,7 @@ async function loadAgentTools({
     }
     return {
       toolRegistry,
+      requestScopedConnections: getMCPRequestContext(req, res),
       userMCPAuthMap,
       toolContextMap,
       dynamicToolContextMap,
@@ -1268,6 +1392,7 @@ async function loadAgentTools({
 
   return {
     toolRegistry,
+    requestScopedConnections: getMCPRequestContext(req, res),
     toolContextMap,
     dynamicToolContextMap,
     userMCPAuthMap,
@@ -1293,6 +1418,8 @@ async function loadAgentTools({
  * @param {Object} params.agent - The agent object
  * @param {string[]} params.toolNames - Names of tools to load
  * @param {Map} [params.toolRegistry] - Tool registry
+ * @param {Record<string, import('@librechat/api').LCAvailableTools>} [params.mcpAvailableTools] - Run-scoped MCP tool definitions
+ * @param {import('@librechat/api').RequestScopedMCPConnectionStore} [params.requestScopedConnections] - Run-scoped MCP connections
  * @param {Record<string, Record<string, string>>} [params.userMCPAuthMap] - User MCP auth map
  * @param {Object} [params.tool_resources] - Tool resources
  * @param {string|null} [params.streamId] - Stream ID for web search callbacks
@@ -1306,6 +1433,8 @@ async function loadToolsForExecution({
   agent,
   toolNames,
   toolRegistry,
+  mcpAvailableTools,
+  requestScopedConnections,
   userMCPAuthMap,
   tool_resources,
   streamId = null,
@@ -1313,7 +1442,8 @@ async function loadToolsForExecution({
 }) {
   const appConfig = req.config;
   const allLoadedTools = [];
-  const configurable = { userMCPAuthMap };
+  const mcpRequestScopedConnections = requestScopedConnections ?? getMCPRequestContext(req, res);
+  const configurable = { userMCPAuthMap, requestScopedConnections: mcpRequestScopedConnections };
 
   const isToolSearch = toolNames.includes(AgentConstants.TOOL_SEARCH);
   const ptcToolNames = [
@@ -1380,6 +1510,13 @@ async function loadToolsForExecution({
     }
   }
 
+  const fileAuthoringToolNames = new Set(
+    toolRegistry
+      ? Array.from(toolRegistry.values())
+          .filter((definition) => isFileAuthoringToolDefinition(definition))
+          .map((definition) => definition.name)
+      : [],
+  );
   const specialToolNames = new Set([
     AgentConstants.TOOL_SEARCH,
     AgentConstants.PROGRAMMATIC_TOOL_CALLING,
@@ -1387,6 +1524,7 @@ async function loadToolsForExecution({
     AgentConstants.BASH_TOOL,
     AgentConstants.SKILL_TOOL,
     AgentConstants.READ_FILE,
+    ...fileAuthoringToolNames,
   ]);
 
   let ptcOrchestratedToolNames = [];
@@ -1425,6 +1563,8 @@ async function loadToolsForExecution({
         processFileURL,
         uploadImageBuffer,
         returnMetadata: true,
+        mcpAvailableTools,
+        requestScopedConnections: mcpRequestScopedConnections,
         [Tools.web_search]: webSearchCallbacks,
       },
       webSearch: appConfig?.webSearch,
diff --git a/api/server/services/Tools/mcp.js b/api/server/services/Tools/mcp.js
index e13fa9989bc..c0e32ccd8f6 100644
--- a/api/server/services/Tools/mcp.js
+++ b/api/server/services/Tools/mcp.js
@@ -1,8 +1,9 @@
 const { logger } = require('@librechat/data-schemas');
-const { getMissingCustomUserVars } = require('@librechat/api');
+const { getMissingCustomUserVars, requiresEphemeralUserConnection } = require('@librechat/api');
 const { CacheKeys, Constants } = require('librechat-data-provider');
 const { getMCPManager, getMCPServersRegistry, getFlowStateManager } = require('~/config');
 const { findToken, createToken, updateToken, deleteTokens } = require('~/models');
+const { getGraphApiToken } = require('~/server/services/GraphTokenService');
 const { exchangeOboToken } = require('~/server/services/OboTokenService');
 const { createOboTrustChecker } = require('~/server/services/OboPolicyService');
 const { updateMCPServerTools } = require('~/server/services/Config');
@@ -20,7 +21,10 @@ const { getLogStores } = require('~/cache');
  * @param {boolean} [params.forceNew]
  * @param {number} [params.connectionTimeout]
  * @param {FlowStateManager<any>} [params.flowManager]
- * @param {(authURL: string) => Promise<void>} [params.oauthStart]
+ * @param {(authURL: string, options?: { expiresAt?: number }) => Promise<void>} [params.oauthStart]
+ * @param {() => Promise<void>} [params.oauthEnd]
+ * @param {import('@librechat/api').RequestBody} [params.requestBody]
+ * @param {import('@librechat/api').RequestScopedMCPConnectionStore} [params.requestScopedConnections]
  * @param {Record<string, Record<string, string>>} [params.userMCPAuthMap]
  */
 async function reinitMCPServer({
@@ -35,20 +39,26 @@ async function reinitMCPServer({
   oauthStart: _oauthStart,
   flowManager: _flowManager,
   serverConfig: providedConfig,
+  requestBody,
+  requestScopedConnections,
+  oauthEnd,
 }) {
   /** @type {MCPConnection | null} */
   let connection = null;
+  let serverConfig = providedConfig;
   /** @type {LCAvailableTools | null} */
   let availableTools = null;
   /** @type {ReturnType<MCPConnection['fetchTools']> | null} */
   let tools = null;
   let oauthRequired = false;
   let oauthUrl = null;
+  let ephemeralServer = false;
 
   try {
     const registry = getMCPServersRegistry();
-    const serverConfig =
-      providedConfig ?? (await registry.getServerConfig(serverName, user?.id, configServers));
+    serverConfig =
+      serverConfig ?? (await registry.getServerConfig(serverName, user?.id, configServers));
+    ephemeralServer = serverConfig ? requiresEphemeralUserConnection(serverConfig) : false;
     if (serverConfig?.inspectionFailed) {
       if (serverConfig.source === 'config') {
         logger.info(
@@ -63,28 +73,29 @@ async function reinitMCPServer({
           oauthUrl: null,
           tools: null,
         };
-      }
-      logger.info(
-        `[MCP Reinitialize] Server ${serverName} had failed inspection, attempting reinspection`,
-      );
-      try {
-        const storageLocation = serverConfig.source === 'user' ? 'DB' : 'CACHE';
-        await registry.reinspectServer(serverName, storageLocation, user?.id);
-        logger.info(`[MCP Reinitialize] Reinspection succeeded for server: ${serverName}`);
-      } catch (reinspectError) {
-        logger.error(
-          `[MCP Reinitialize] Reinspection failed for server ${serverName}:`,
-          reinspectError,
+      } else {
+        logger.info(
+          `[MCP Reinitialize] Server ${serverName} had failed inspection, attempting reinspection`,
         );
-        return {
-          availableTools: null,
-          success: false,
-          message: `MCP server '${serverName}' is still unreachable`,
-          oauthRequired: false,
-          serverName,
-          oauthUrl: null,
-          tools: null,
-        };
+        try {
+          const storageLocation = serverConfig.source === 'user' ? 'DB' : 'CACHE';
+          await registry.reinspectServer(serverName, storageLocation, user?.id);
+          logger.info(`[MCP Reinitialize] Reinspection succeeded for server: ${serverName}`);
+        } catch (reinspectError) {
+          logger.error(
+            `[MCP Reinitialize] Reinspection failed for server ${serverName}:`,
+            reinspectError,
+          );
+          return {
+            availableTools: null,
+            success: false,
+            message: `MCP server '${serverName}' is still unreachable`,
+            oauthRequired: false,
+            serverName,
+            oauthUrl: null,
+            tools: null,
+          };
+        }
       }
     }
 
@@ -132,9 +143,13 @@ async function reinitMCPServer({
         flowManager,
         tokenMethods,
         returnOnOAuth,
+        oauthEnd,
         customUserVars,
+        requestBody,
+        requestScopedConnections,
         connectionTimeout,
         serverConfig,
+        graphTokenResolver: getGraphApiToken,
         oboTokenResolver: exchangeOboToken,
         oboTrustChecker: createOboTrustChecker(),
       });
@@ -168,8 +183,10 @@ async function reinitMCPServer({
             tokenMethods,
             oauthStart,
             customUserVars,
+            requestBody,
             connectionTimeout,
             configServers,
+            graphTokenResolver: getGraphApiToken,
             oboTokenResolver: exchangeOboToken,
             oboTrustChecker: createOboTrustChecker(),
           });
@@ -202,6 +219,7 @@ async function reinitMCPServer({
         userId: user.id,
         serverName,
         tools,
+        serverConfig,
       });
     }
 
@@ -249,6 +267,17 @@ async function reinitMCPServer({
       '[MCP Reinitialize] Error loading MCP Tools, servers may still be initializing:',
       error,
     );
+  } finally {
+    if (connection && ephemeralServer && !requestScopedConnections) {
+      try {
+        await connection.disconnect();
+      } catch (error) {
+        logger.warn(
+          `[MCP Reinitialize] Failed to disconnect ephemeral server ${serverName}`,
+          error,
+        );
+      }
+    }
   }
 }
 
diff --git a/api/server/services/Tools/mcp.spec.js b/api/server/services/Tools/mcp.spec.js
index bce51aa29a9..ab8cd3f2811 100644
--- a/api/server/services/Tools/mcp.spec.js
+++ b/api/server/services/Tools/mcp.spec.js
@@ -1,9 +1,15 @@
 const { Constants } = require('librechat-data-provider');
 
 const mockGetConnection = jest.fn();
+const mockDiscoverServerTools = jest.fn();
+const mockGetGraphApiToken = jest.fn();
+const mockUpdateMCPServerTools = jest.fn();
 
 jest.mock('~/config', () => ({
-  getMCPManager: jest.fn(() => ({ getConnection: mockGetConnection })),
+  getMCPManager: jest.fn(() => ({
+    getConnection: mockGetConnection,
+    discoverServerTools: mockDiscoverServerTools,
+  })),
   getMCPServersRegistry: jest.fn(() => ({ getServerConfig: jest.fn() })),
   getFlowStateManager: jest.fn(() => ({})),
 }));
@@ -14,7 +20,10 @@ jest.mock('~/models', () => ({
   deleteTokens: jest.fn(),
 }));
 jest.mock('~/server/services/Config', () => ({
-  updateMCPServerTools: jest.fn(),
+  updateMCPServerTools: mockUpdateMCPServerTools,
+}));
+jest.mock('~/server/services/GraphTokenService', () => ({
+  getGraphApiToken: mockGetGraphApiToken,
 }));
 jest.mock('~/cache', () => ({
   getLogStores: jest.fn(() => ({})),
@@ -35,6 +44,7 @@ describe('reinitMCPServer — customUserVars gating (issue #10969)', () => {
 
   beforeEach(() => {
     jest.clearAllMocks();
+    mockUpdateMCPServerTools.mockResolvedValue({});
   });
 
   it('does not connect and exposes no tools when a required customUserVar is unset', async () => {
@@ -90,6 +100,77 @@ describe('reinitMCPServer — customUserVars gating (issue #10969)', () => {
     );
   });
 
+  it('passes request body and Graph resolver into connection creation', async () => {
+    mockGetConnection.mockResolvedValue({ fetchTools: jest.fn().mockResolvedValue([]) });
+    const requestBody = { conversationId: 'conv-123', messageId: 'msg-123' };
+
+    await reinitMCPServer({
+      user,
+      serverName,
+      serverConfig: { type: 'streamable-http', url: 'https://thingy.example.com/mcp' },
+      requestBody,
+      userMCPAuthMap: undefined,
+    });
+
+    expect(mockGetConnection).toHaveBeenCalledWith(
+      expect.objectContaining({
+        requestBody,
+        graphTokenResolver: mockGetGraphApiToken,
+      }),
+    );
+  });
+
+  it('passes request body and Graph resolver into OAuth discovery fallback', async () => {
+    mockGetConnection.mockRejectedValue(new Error('OAuth authentication required'));
+    mockDiscoverServerTools.mockResolvedValue({ tools: [], oauthRequired: true, oauthUrl: null });
+    const requestBody = { conversationId: 'conv-456', messageId: 'msg-456' };
+
+    await reinitMCPServer({
+      user,
+      serverName,
+      serverConfig: { type: 'streamable-http', url: 'https://thingy.example.com/mcp' },
+      requestBody,
+      userMCPAuthMap: undefined,
+    });
+
+    expect(mockDiscoverServerTools).toHaveBeenCalledWith(
+      expect.objectContaining({
+        requestBody,
+        graphTokenResolver: mockGetGraphApiToken,
+      }),
+    );
+  });
+
+  it('disconnects ephemeral BODY-scoped connections after loading tools', async () => {
+    const disconnect = jest.fn().mockResolvedValue(undefined);
+    const tools = [{ name: 'search', inputSchema: { type: 'object', properties: {} } }];
+    const serverConfig = {
+      type: 'streamable-http',
+      url: 'https://thingy.example.com/messages/{{LIBRECHAT_BODY_MESSAGEID}}/mcp',
+      source: 'yaml',
+    };
+    mockGetConnection.mockResolvedValue({
+      disconnect,
+      fetchTools: jest.fn().mockResolvedValue(tools),
+    });
+
+    await reinitMCPServer({
+      user,
+      serverName,
+      serverConfig,
+      requestBody: { messageId: 'msg-789' },
+      userMCPAuthMap: undefined,
+    });
+
+    expect(disconnect).toHaveBeenCalledTimes(1);
+    expect(mockUpdateMCPServerTools).toHaveBeenCalledWith(
+      expect.objectContaining({
+        tools,
+        serverConfig,
+      }),
+    );
+  });
+
   it('proceeds to connect when the server declares no customUserVars', async () => {
     mockGetConnection.mockResolvedValue({ fetchTools: jest.fn().mockResolvedValue([]) });
 
diff --git a/api/server/services/__tests__/ToolService.spec.js b/api/server/services/__tests__/ToolService.spec.js
index 3fc9e58eb69..0d69fb92ef2 100644
--- a/api/server/services/__tests__/ToolService.spec.js
+++ b/api/server/services/__tests__/ToolService.spec.js
@@ -11,6 +11,8 @@ const {
 const mockGetEndpointsConfig = jest.fn();
 const mockGetMCPServerTools = jest.fn();
 const mockGetCachedTools = jest.fn();
+const mockSendEvent = jest.fn();
+const mockEmitChunk = jest.fn();
 jest.mock('~/server/services/Config', () => ({
   getEndpointsConfig: (...args) => mockGetEndpointsConfig(...args),
   getMCPServerTools: (...args) => mockGetMCPServerTools(...args),
@@ -23,6 +25,10 @@ jest.mock('@librechat/api', () => ({
   ...jest.requireActual('@librechat/api'),
   loadToolDefinitions: (...args) => mockLoadToolDefinitions(...args),
   getUserMCPAuthMap: (...args) => mockGetUserMCPAuthMap(...args),
+  sendEvent: (...args) => mockSendEvent(...args),
+  GenerationJobManager: {
+    emitChunk: (...args) => mockEmitChunk(...args),
+  },
 }));
 
 const mockLoadToolsUtil = jest.fn();
@@ -36,6 +42,7 @@ const mockLegacyDomainEncode = jest.fn();
 const mockDecryptMetadata = jest.fn();
 const mockCreateActionTool = jest.fn();
 const mockGetServerConfig = jest.fn();
+const mockFlowManager = { getFlowState: jest.fn() };
 const mockResolveConfigServers = jest.fn();
 const mockUserCanUseMCPServers = jest.fn().mockResolvedValue(true);
 jest.mock('~/server/services/Tools/credentials', () => ({
@@ -71,7 +78,7 @@ jest.mock('~/models', () => ({
   findPluginAuthsByKeys: jest.fn(),
 }));
 jest.mock('~/config', () => ({
-  getFlowStateManager: jest.fn(() => ({})),
+  getFlowStateManager: jest.fn(() => mockFlowManager),
   getMCPServersRegistry: jest.fn(() => ({
     getServerConfig: (...args) => mockGetServerConfig(...args),
   })),
@@ -93,6 +100,8 @@ const {
   processRequiredActions,
   resolveAgentCapabilities,
 } = require('../ToolService');
+const { reinitMCPServer } = require('~/server/services/Tools/mcp');
+const { PENDING_STALE_MS } = require('@librechat/api');
 
 function createMockReq(capabilities) {
   return {
@@ -127,6 +136,7 @@ describe('ToolService - Action Capability Gating', () => {
     mockGetCachedTools.mockResolvedValue(null);
     mockGetUserMCPAuthMap.mockResolvedValue({});
     mockGetServerConfig.mockResolvedValue(undefined);
+    mockFlowManager.getFlowState.mockResolvedValue(undefined);
     mockResolveConfigServers.mockResolvedValue({});
   });
 
@@ -297,6 +307,85 @@ describe('ToolService - Action Capability Gating', () => {
       expect(result.actionsEnabled).toBe(false);
     });
 
+    it('emits separate MCP OAuth login steps and completion events for multiple pending servers', async () => {
+      const req = createMockReq([AgentCapabilities.tools]);
+      const res = { writableEnded: false };
+      const servers = ['ELI', 'Vespa'];
+      mockGetEndpointsConfig.mockResolvedValue(createEndpointsConfig([AgentCapabilities.tools]));
+      mockResolveConfigServers.mockResolvedValue(
+        Object.fromEntries(
+          servers.map((serverName) => [
+            serverName,
+            {
+              type: 'streamable-http',
+              url: `https://mcp.example.com/${serverName}`,
+              requiresOAuth: true,
+            },
+          ]),
+        ),
+      );
+
+      mockLoadToolDefinitions
+        .mockImplementationOnce(async (_args, deps) => {
+          await deps.getOrFetchMCPServerTools(req.user.id, servers[0]);
+          await deps.getOrFetchMCPServerTools(req.user.id, servers[1]);
+          return {
+            toolDefinitions: [],
+            toolRegistry: new Map(),
+            hasDeferredTools: false,
+          };
+        })
+        .mockResolvedValue({
+          toolDefinitions: [],
+          toolRegistry: new Map(),
+          hasDeferredTools: false,
+        });
+
+      reinitMCPServer.mockImplementation(
+        async ({ serverName, returnOnOAuth, oauthStart, oauthEnd }) => {
+          if (returnOnOAuth === false) {
+            await oauthStart(`https://auth.example.com/${serverName}`);
+            await oauthEnd();
+            return { availableTools: { [`tool_${serverName}`]: {} } };
+          }
+
+          await oauthStart(`https://auth.example.com/${serverName}`);
+          return { availableTools: null };
+        },
+      );
+
+      await loadAgentTools({
+        req,
+        res,
+        agent: {
+          id: 'agent_123',
+          tools: servers.map((server) => `search${Constants.mcp_delimiter}${server}`),
+        },
+        definitionsOnly: true,
+      });
+
+      const runStepEvents = mockSendEvent.mock.calls
+        .map(([, event]) => event)
+        .filter((event) => event.data?.stepDetails?.type === 'tool_calls');
+      const deltaEvents = mockSendEvent.mock.calls
+        .map(([, event]) => event)
+        .filter((event) => event.data?.delta?.type === 'tool_calls');
+      const authDeltaEvents = deltaEvents.filter((event) => event.data.delta.auth);
+      const completionEvents = mockSendEvent.mock.calls
+        .map(([, event]) => event)
+        .filter((event) => event.data?.result?.tool_call?.name?.startsWith('oauth'));
+
+      expect(runStepEvents.map((event) => event.data.index)).toEqual([0, 1]);
+      expect(authDeltaEvents.map((event) => event.data.id)).toEqual([
+        'step_oauth_login_ELI',
+        'step_oauth_login_Vespa',
+      ]);
+      expect(completionEvents.map((event) => event.data.result.id)).toEqual([
+        'step_oauth_login_ELI',
+        'step_oauth_login_Vespa',
+      ]);
+    });
+
     it('should not expose cached MCP tool definitions when the registry lookup fails', async () => {
       const serverName = 'private-server';
       const mcpTool = `search${Constants.mcp_delimiter}${serverName}`;
@@ -335,6 +424,454 @@ describe('ToolService - Action Capability Gating', () => {
       expect(mockGetMCPServerTools).not.toHaveBeenCalled();
     });
 
+    it('should re-emit pending MCP OAuth prompts when cached tool definitions exist', async () => {
+      const serverName = 'Google-Workspace';
+      const authorizationUrl = 'https://auth.example.com/Google-Workspace';
+      const mcpTool = `search${Constants.mcp_delimiter}${serverName}`;
+      const capabilities = [AgentCapabilities.tools];
+      const req = createMockReq(capabilities);
+      const res = { writableEnded: false };
+      mockGetEndpointsConfig.mockResolvedValue(createEndpointsConfig(capabilities));
+      mockGetServerConfig.mockResolvedValue({
+        type: 'streamable-http',
+        url: 'https://demo.librechat.ai/mcp',
+        requiresOAuth: true,
+      });
+      mockGetMCPServerTools.mockResolvedValue({
+        [mcpTool]: {
+          function: {
+            name: mcpTool,
+            description: 'Cached search',
+            parameters: {},
+          },
+        },
+      });
+      mockFlowManager.getFlowState.mockResolvedValue({
+        status: 'PENDING',
+        createdAt: Date.now(),
+        metadata: { authorizationUrl },
+      });
+      mockLoadToolDefinitions.mockImplementation(async (params, deps) => {
+        const serverTools = await deps.getOrFetchMCPServerTools(params.userId, serverName);
+        return {
+          toolDefinitions: serverTools ? Object.keys(serverTools) : [],
+          toolRegistry: new Map(),
+          hasDeferredTools: false,
+        };
+      });
+      reinitMCPServer.mockImplementation(async ({ oauthStart }) => {
+        await oauthStart(authorizationUrl);
+        return { availableTools: { [mcpTool]: {} } };
+      });
+
+      const result = await loadAgentTools({
+        req,
+        res,
+        agent: { id: 'agent_123', tools: [mcpTool] },
+        definitionsOnly: true,
+      });
+
+      expect(result.toolDefinitions).toEqual([mcpTool]);
+      expect(mockGetMCPServerTools).toHaveBeenCalledWith(
+        req.user.id,
+        serverName,
+        expect.objectContaining({ requiresOAuth: true }),
+      );
+      expect(reinitMCPServer).toHaveBeenCalledWith(
+        expect.objectContaining({
+          serverName,
+          returnOnOAuth: false,
+          oauthStart: expect.any(Function),
+        }),
+      );
+      expect(mockSendEvent).toHaveBeenCalledWith(
+        res,
+        expect.objectContaining({
+          event: 'on_run_step',
+          data: expect.objectContaining({
+            id: `step_oauth_login_${serverName}`,
+          }),
+        }),
+      );
+      expect(mockSendEvent).toHaveBeenCalledWith(
+        res,
+        expect.objectContaining({
+          event: 'on_run_step_delta',
+          data: expect.objectContaining({
+            id: `step_oauth_login_${serverName}`,
+            delta: expect.objectContaining({
+              auth: authorizationUrl,
+            }),
+          }),
+        }),
+      );
+    });
+
+    it('should not join in-flight MCP initialization before replaying pending OAuth prompts', async () => {
+      const serverName = 'Google-Workspace';
+      const authorizationUrl = 'https://auth.example.com/Google-Workspace';
+      const mcpTool = `${Constants.mcp_all}${Constants.mcp_delimiter}${serverName}`;
+      const capabilities = [AgentCapabilities.tools];
+      const req = createMockReq(capabilities);
+      const res = { writableEnded: false };
+      mockGetEndpointsConfig.mockResolvedValue(createEndpointsConfig(capabilities));
+      mockGetServerConfig.mockResolvedValue({
+        type: 'streamable-http',
+        url: 'https://demo.librechat.ai/mcp',
+        requiresOAuth: true,
+      });
+      mockGetMCPServerTools.mockResolvedValue(null);
+      mockFlowManager.getFlowState.mockResolvedValue({
+        status: 'PENDING',
+        createdAt: Date.now(),
+        metadata: { authorizationUrl },
+      });
+      mockLoadToolDefinitions.mockImplementation(async (params, deps) => {
+        await deps.getOrFetchMCPServerTools(params.userId, serverName);
+        return {
+          toolDefinitions: [],
+          toolRegistry: new Map(),
+          hasDeferredTools: false,
+        };
+      });
+      reinitMCPServer.mockImplementation(async ({ oauthStart }) => {
+        await oauthStart(authorizationUrl);
+        return { availableTools: null };
+      });
+
+      await loadAgentTools({
+        req,
+        res,
+        agent: { id: 'agent_123', tools: [mcpTool] },
+        definitionsOnly: true,
+      });
+
+      expect(mockGetMCPServerTools).toHaveBeenCalledWith(
+        req.user.id,
+        serverName,
+        expect.objectContaining({ requiresOAuth: true }),
+      );
+      expect(reinitMCPServer).toHaveBeenCalledTimes(1);
+      expect(reinitMCPServer).toHaveBeenCalledWith(
+        expect.objectContaining({
+          serverName,
+          returnOnOAuth: false,
+          oauthStart: expect.any(Function),
+        }),
+      );
+      expect(mockSendEvent).toHaveBeenCalledWith(
+        res,
+        expect.objectContaining({
+          event: 'on_run_step_delta',
+          data: expect.objectContaining({
+            id: `step_oauth_login_${serverName}`,
+            delta: expect.objectContaining({
+              auth: authorizationUrl,
+            }),
+          }),
+        }),
+      );
+    });
+
+    it('should re-emit pending MCP OAuth prompts when selected MCP tools are already concrete', async () => {
+      const serverName = `Google${Constants.mcp_delimiter}Workspace`;
+      const authorizationUrl = 'https://auth.example.com/Google-Workspace';
+      const mcpTool = `search${Constants.mcp_delimiter}${serverName}`;
+      const capabilities = [AgentCapabilities.tools];
+      const req = createMockReq(capabilities);
+      const res = { writableEnded: false };
+      mockGetEndpointsConfig.mockResolvedValue(createEndpointsConfig(capabilities));
+      mockFlowManager.getFlowState.mockResolvedValue({
+        status: 'PENDING',
+        createdAt: Date.now(),
+        metadata: { authorizationUrl },
+      });
+      mockLoadToolDefinitions.mockResolvedValue({
+        toolDefinitions: [mcpTool],
+        toolRegistry: new Map(),
+        hasDeferredTools: false,
+      });
+      reinitMCPServer.mockImplementation(async ({ oauthStart }) => {
+        await oauthStart(authorizationUrl);
+        return { availableTools: { [mcpTool]: {} } };
+      });
+
+      const result = await loadAgentTools({
+        req,
+        res,
+        agent: { id: 'agent_123', tools: [mcpTool] },
+        definitionsOnly: true,
+      });
+
+      expect(result.toolDefinitions).toEqual([mcpTool]);
+      expect(mockGetMCPServerTools).not.toHaveBeenCalled();
+      expect(reinitMCPServer).toHaveBeenCalledWith(
+        expect.objectContaining({
+          serverName,
+          returnOnOAuth: false,
+          oauthStart: expect.any(Function),
+        }),
+      );
+      expect(mockSendEvent).toHaveBeenCalledWith(
+        res,
+        expect.objectContaining({
+          event: 'on_run_step_delta',
+          data: expect.objectContaining({
+            id: `step_oauth_login_${serverName}`,
+            delta: expect.objectContaining({
+              auth: authorizationUrl,
+            }),
+          }),
+        }),
+      );
+    });
+
+    it('should emit stored pending MCP OAuth prompts before waiting on a silent in-flight join', async () => {
+      const serverName = 'Google-Workspace';
+      const authorizationUrl = 'https://auth.example.com/Google-Workspace';
+      const mcpTool = `search${Constants.mcp_delimiter}${serverName}`;
+      const capabilities = [AgentCapabilities.tools];
+      const req = createMockReq(capabilities);
+      const res = { writableEnded: false };
+      mockGetEndpointsConfig.mockResolvedValue(createEndpointsConfig(capabilities));
+      mockFlowManager.getFlowState.mockResolvedValue({
+        status: 'PENDING',
+        createdAt: Date.now(),
+        metadata: { authorizationUrl },
+      });
+      mockLoadToolDefinitions.mockResolvedValue({
+        toolDefinitions: [mcpTool],
+        toolRegistry: new Map(),
+        hasDeferredTools: false,
+      });
+      reinitMCPServer.mockResolvedValue({ availableTools: null });
+
+      const result = await loadAgentTools({
+        req,
+        res,
+        agent: { id: 'agent_123', tools: [mcpTool] },
+        definitionsOnly: true,
+      });
+
+      expect(result.toolDefinitions).toEqual([mcpTool]);
+      expect(reinitMCPServer).toHaveBeenCalledWith(
+        expect.objectContaining({
+          serverName,
+          returnOnOAuth: false,
+          oauthStart: expect.any(Function),
+        }),
+      );
+      expect(mockSendEvent).toHaveBeenCalledWith(
+        res,
+        expect.objectContaining({
+          event: 'on_run_step_delta',
+          data: expect.objectContaining({
+            id: `step_oauth_login_${serverName}`,
+            delta: expect.objectContaining({
+              auth: authorizationUrl,
+            }),
+          }),
+        }),
+      );
+    });
+
+    it('should preserve OAuth URLs emitted while discovering MCP tools before a silent wait join', async () => {
+      const serverName = 'Google-Workspace';
+      const authorizationUrl = 'https://auth.example.com/Google-Workspace';
+      const mcpTool = `search${Constants.mcp_delimiter}${serverName}`;
+      const capabilities = [AgentCapabilities.tools];
+      const req = createMockReq(capabilities);
+      const res = { writableEnded: false };
+      mockGetEndpointsConfig.mockResolvedValue(createEndpointsConfig(capabilities));
+      mockGetServerConfig.mockResolvedValue({
+        type: 'streamable-http',
+        url: 'https://demo.librechat.ai/mcp',
+        requiresOAuth: true,
+      });
+      mockGetMCPServerTools.mockResolvedValue(null);
+      mockFlowManager.getFlowState.mockResolvedValue(null);
+      mockLoadToolDefinitions.mockImplementation(async (params, deps) => {
+        await deps.getOrFetchMCPServerTools(params.userId, serverName);
+        return {
+          toolDefinitions: [],
+          toolRegistry: new Map(),
+          hasDeferredTools: false,
+        };
+      });
+      reinitMCPServer
+        .mockImplementationOnce(async ({ oauthStart }) => {
+          await oauthStart(authorizationUrl, { expiresAt: Date.now() + 60_000 });
+          return { availableTools: null };
+        })
+        .mockResolvedValue({ availableTools: null });
+
+      await loadAgentTools({
+        req,
+        res,
+        agent: { id: 'agent_123', tools: [mcpTool] },
+        definitionsOnly: true,
+      });
+
+      expect(reinitMCPServer).toHaveBeenCalledTimes(2);
+      expect(mockSendEvent).toHaveBeenCalledWith(
+        res,
+        expect.objectContaining({
+          event: 'on_run_step_delta',
+          data: expect.objectContaining({
+            id: `step_oauth_login_${serverName}`,
+            delta: expect.objectContaining({
+              auth: authorizationUrl,
+            }),
+          }),
+        }),
+      );
+    });
+
+    it('should pass request body context into MCP tool definition reinitialization', async () => {
+      const serverName = 'Body-Scoped';
+      const mcpTool = `search${Constants.mcp_delimiter}${serverName}`;
+      const capabilities = [AgentCapabilities.tools];
+      const req = createMockReq(capabilities);
+      req.body = { conversationId: 'conv-123', messageId: 'msg-123' };
+
+      mockGetEndpointsConfig.mockResolvedValue(createEndpointsConfig(capabilities));
+      mockGetServerConfig.mockResolvedValue({
+        type: 'streamable-http',
+        url: 'https://demo.librechat.ai/messages/{{LIBRECHAT_BODY_MESSAGEID}}/mcp',
+        source: 'yaml',
+      });
+      mockGetMCPServerTools.mockResolvedValue(null);
+      mockFlowManager.getFlowState.mockResolvedValue(null);
+      mockLoadToolDefinitions.mockImplementation(async (params, deps) => {
+        await deps.getOrFetchMCPServerTools(params.userId, serverName);
+        return {
+          toolDefinitions: [],
+          toolRegistry: new Map(),
+          hasDeferredTools: false,
+        };
+      });
+      reinitMCPServer.mockResolvedValue({ availableTools: null });
+
+      await loadAgentTools({
+        req,
+        agent: { id: 'agent_123', tools: [mcpTool] },
+        definitionsOnly: true,
+      });
+
+      expect(reinitMCPServer).toHaveBeenCalledWith(
+        expect.objectContaining({
+          serverName,
+          requestBody: req.body,
+        }),
+      );
+      expect(mockGetMCPServerTools).toHaveBeenCalledWith(
+        req.user.id,
+        serverName,
+        expect.objectContaining({
+          url: expect.stringContaining('LIBRECHAT_BODY_MESSAGEID'),
+        }),
+      );
+    });
+
+    it('returns run-scoped MCP tool definitions for request-scoped servers', async () => {
+      const serverName = 'ClickHouse';
+      const mcpTool = `list_tables${Constants.mcp_delimiter}${serverName}`;
+      const capabilities = [AgentCapabilities.tools];
+      const req = createMockReq(capabilities);
+      req.body = { conversationId: 'conv-123', messageId: 'msg-123' };
+      const availableTools = {
+        [mcpTool]: {
+          function: {
+            name: mcpTool,
+            description: 'List tables',
+            parameters: { type: 'object', properties: {} },
+          },
+        },
+      };
+
+      mockGetEndpointsConfig.mockResolvedValue(createEndpointsConfig(capabilities));
+      mockGetServerConfig.mockResolvedValue({
+        type: 'streamable-http',
+        url: 'https://mcp.example.com/{{LIBRECHAT_BODY_MESSAGEID}}/mcp',
+        source: 'yaml',
+      });
+      mockGetMCPServerTools.mockResolvedValue(null);
+      mockFlowManager.getFlowState.mockResolvedValue(null);
+      mockLoadToolDefinitions.mockImplementation(async (params, deps) => {
+        const serverTools = await deps.getOrFetchMCPServerTools(params.userId, serverName);
+        return {
+          toolDefinitions: serverTools ? Object.keys(serverTools) : [],
+          toolRegistry: new Map([[mcpTool, { name: mcpTool }]]),
+          hasDeferredTools: false,
+        };
+      });
+      reinitMCPServer.mockResolvedValue({ availableTools });
+
+      const result = await loadAgentTools({
+        req,
+        agent: { id: 'agent_123', tools: [mcpTool] },
+        definitionsOnly: true,
+      });
+
+      expect(result.toolDefinitions).toEqual([mcpTool]);
+      expect(result.mcpAvailableTools).toEqual({ [serverName]: availableTools });
+      expect(mockGetMCPServerTools).toHaveBeenCalledWith(
+        req.user.id,
+        serverName,
+        expect.objectContaining({
+          url: expect.stringContaining('LIBRECHAT_BODY_MESSAGEID'),
+        }),
+      );
+    });
+
+    it('should preserve pending-flow expiry for OAuth URLs captured during discovery', async () => {
+      const serverName = 'Google-Workspace';
+      const authorizationUrl = 'https://auth.example.com/Google-Workspace';
+      const mcpTool = `search${Constants.mcp_delimiter}${serverName}`;
+      const capabilities = [AgentCapabilities.tools];
+      const req = createMockReq(capabilities);
+      const res = { writableEnded: false };
+      const createdAt = Date.now() - 45_000;
+      mockGetEndpointsConfig.mockResolvedValue(createEndpointsConfig(capabilities));
+      mockGetServerConfig.mockResolvedValue({
+        type: 'streamable-http',
+        url: 'https://demo.librechat.ai/mcp',
+        requiresOAuth: true,
+      });
+      mockGetMCPServerTools.mockResolvedValue(null);
+      mockFlowManager.getFlowState.mockResolvedValueOnce(null).mockResolvedValueOnce({
+        status: 'PENDING',
+        createdAt,
+        metadata: { authorizationUrl },
+      });
+      mockLoadToolDefinitions.mockImplementation(async (params, deps) => {
+        await deps.getOrFetchMCPServerTools(params.userId, serverName);
+        return {
+          toolDefinitions: [],
+          toolRegistry: new Map(),
+          hasDeferredTools: false,
+        };
+      });
+      reinitMCPServer
+        .mockImplementationOnce(async ({ oauthStart }) => {
+          await oauthStart(authorizationUrl);
+          return { availableTools: null };
+        })
+        .mockResolvedValue({ availableTools: null });
+
+      await loadAgentTools({
+        req,
+        res,
+        agent: { id: 'agent_123', tools: [mcpTool] },
+        definitionsOnly: true,
+      });
+
+      const authDeltaEvent = mockSendEvent.mock.calls
+        .map(([, event]) => event)
+        .find((event) => event.data?.delta?.auth === authorizationUrl);
+      expect(authDeltaEvent?.data.delta.expires_at).toBe(createdAt + PENDING_STALE_MS);
+    });
+
     it('should use request-scoped MCP config before falling back to the registry', async () => {
       const serverName = 'config-server';
       const mcpTool = `search${Constants.mcp_delimiter}${serverName}`;
@@ -380,7 +917,11 @@ describe('ToolService - Action Capability Gating', () => {
 
       expect(result.toolDefinitions).toEqual([mcpTool]);
       expect(mockGetServerConfig).not.toHaveBeenCalled();
-      expect(mockGetMCPServerTools).toHaveBeenCalledWith(req.user.id, serverName);
+      expect(mockGetMCPServerTools).toHaveBeenCalledWith(
+        req.user.id,
+        serverName,
+        expect.objectContaining({ url: 'https://config.example.com/mcp' }),
+      );
     });
   });
 
@@ -449,6 +990,49 @@ describe('ToolService - Action Capability Gating', () => {
       expect(result.configurable.ptcToolMap.size).toBe(0);
     });
 
+    it('passes run-scoped MCP tool definitions into PTC execution loading', async () => {
+      const capabilities = [
+        AgentCapabilities.tools,
+        AgentCapabilities.programmatic_tools,
+        AgentCapabilities.execute_code,
+      ];
+      const req = createMockReq(capabilities);
+      const serverName = 'ClickHouse';
+      const mcpTool = `list_tables${Constants.mcp_delimiter}${serverName}`;
+      const mcpAvailableTools = {
+        [serverName]: {
+          [mcpTool]: {
+            function: {
+              name: mcpTool,
+              description: 'List tables',
+              parameters: { type: 'object', properties: {} },
+            },
+          },
+        },
+      };
+      const toolRegistry = new Map([[mcpTool, { name: mcpTool }]]);
+      mockGetEndpointsConfig.mockResolvedValue(createEndpointsConfig(capabilities));
+
+      await loadToolsForExecution({
+        req,
+        res: {},
+        agent: { id: 'agent_ptc', tools: [Tools.execute_code] },
+        toolNames: [Constants.BASH_PROGRAMMATIC_TOOL_CALLING],
+        toolRegistry,
+        mcpAvailableTools,
+        actionsEnabled: false,
+      });
+
+      expect(mockLoadToolsUtil).toHaveBeenCalledWith(
+        expect.objectContaining({
+          tools: [mcpTool],
+          options: expect.objectContaining({
+            mcpAvailableTools,
+          }),
+        }),
+      );
+    });
+
     it('does not load PTC when programmatic tools capability is disabled', async () => {
       const capabilities = [AgentCapabilities.tools, AgentCapabilities.execute_code];
       const req = createMockReq(capabilities);
diff --git a/api/server/services/initializeMCPs.js b/api/server/services/initializeMCPs.js
index be52b6e6ede..e3b35a6e867 100644
--- a/api/server/services/initializeMCPs.js
+++ b/api/server/services/initializeMCPs.js
@@ -3,6 +3,21 @@ const { logger } = require('@librechat/data-schemas');
 const { mergeAppTools, getAppConfig } = require('./Config');
 const { createMCPServersRegistry, createMCPManager } = require('~/config');
 
+/**
+ * Resolves the current request's effective MCP allowlists from the merged (tenant-scoped)
+ * config. The registry calls this per inspection/connection so admin-panel `mcpSettings`
+ * overrides are honored without a restart. Tenant comes from the ALS context inside
+ * `getAppConfig`; `userId`/`role` pick up user/role-scoped overrides when an actor exists.
+ * @param {{ userId?: string, role?: string }} [ctx]
+ */
+async function resolveMCPAllowlists(ctx) {
+  const appConfig = await getAppConfig({ role: ctx?.role, userId: ctx?.userId });
+  return {
+    allowedDomains: appConfig?.mcpSettings?.allowedDomains,
+    allowedAddresses: appConfig?.mcpSettings?.allowedAddresses,
+  };
+}
+
 /**
  * Initialize MCP servers
  */
@@ -15,6 +30,7 @@ async function initializeMCPs() {
       mongoose,
       appConfig?.mcpSettings?.allowedDomains,
       appConfig?.mcpSettings?.allowedAddresses,
+      resolveMCPAllowlists,
     );
   } catch (error) {
     logger.error('[MCP] Failed to initialize MCPServersRegistry:', error);
diff --git a/api/server/services/initializeMCPs.spec.js b/api/server/services/initializeMCPs.spec.js
index c62b85ae1b2..fe0766343c7 100644
--- a/api/server/services/initializeMCPs.spec.js
+++ b/api/server/services/initializeMCPs.spec.js
@@ -82,6 +82,7 @@ describe('initializeMCPs', () => {
         expect.anything(), // mongoose
         ['localhost'],
         undefined,
+        expect.any(Function), // per-request allowlist resolver
       );
     });
 
@@ -98,6 +99,7 @@ describe('initializeMCPs', () => {
         expect.anything(),
         allowedDomains,
         undefined,
+        expect.any(Function),
       );
     });
 
@@ -113,9 +115,34 @@ describe('initializeMCPs', () => {
         expect.anything(),
         undefined,
         undefined,
+        expect.any(Function),
       );
     });
 
+    it('wires a per-request resolver that reads the merged (non-baseOnly) config', async () => {
+      mockGetAppConfig.mockResolvedValue({
+        mcpConfig: null,
+        mcpSettings: { allowedDomains: ['yaml.com'] },
+      });
+
+      await initializeMCPs();
+
+      const resolver = mockCreateMCPServersRegistry.mock.calls[0][3];
+      expect(typeof resolver).toBe('function');
+
+      // The resolver resolves the request's merged allowlists — not the boot YAML base.
+      mockGetAppConfig.mockResolvedValue({
+        mcpSettings: { allowedDomains: ['merged.com'], allowedAddresses: ['10.0.0.0/8'] },
+      });
+      const resolved = await resolver({ userId: 'u1', role: 'ADMIN' });
+
+      expect(mockGetAppConfig).toHaveBeenLastCalledWith({ role: 'ADMIN', userId: 'u1' });
+      expect(resolved).toEqual({
+        allowedDomains: ['merged.com'],
+        allowedAddresses: ['10.0.0.0/8'],
+      });
+    });
+
     it('should throw and log error if MCPServersRegistry initialization fails', async () => {
       const registryError = new Error('Registry initialization failed');
       mockCreateMCPServersRegistry.mockImplementation(() => {
diff --git a/api/server/socialLogins.js b/api/server/socialLogins.js
index 78f0e82a322..f4d088e6d03 100644
--- a/api/server/socialLogins.js
+++ b/api/server/socialLogins.js
@@ -1,7 +1,7 @@
 const passport = require('passport');
 const session = require('express-session');
 const { CacheKeys } = require('librechat-data-provider');
-const { isEnabled, shouldUseSecureCookie } = require('@librechat/api');
+const { math, isEnabled, shouldUseSecureCookie } = require('@librechat/api');
 const { logger, DEFAULT_SESSION_EXPIRY } = require('@librechat/data-schemas');
 const {
   openIdJwtLogin,
@@ -20,6 +20,23 @@ const {
 } = require('~/strategies');
 const { getLogStores } = require('~/cache');
 
+const DEFAULT_OPENID_REUSE_MAX_SESSION_AGE_MS = 15 * 60 * 1000;
+
+const getSessionExpiry = () => math(process.env.SESSION_EXPIRY, DEFAULT_SESSION_EXPIRY);
+
+const getOpenIdSessionExpiry = () => {
+  const sessionExpiry = getSessionExpiry();
+  if (!isEnabled(process.env.OPENID_REUSE_TOKENS)) {
+    return sessionExpiry;
+  }
+
+  const reuseMaxSessionAge = math(
+    process.env.OPENID_REUSE_MAX_SESSION_AGE_MS,
+    DEFAULT_OPENID_REUSE_MAX_SESSION_AGE_MS,
+  );
+  return Math.max(sessionExpiry, reuseMaxSessionAge);
+};
+
 /**
  * Configures OpenID Connect for the application.
  * @param {Express.Application} app - The Express application instance.
@@ -27,7 +44,7 @@ const { getLogStores } = require('~/cache');
  */
 async function configureOpenId(app) {
   logger.info('Configuring OpenID Connect...');
-  const sessionExpiry = Number(process.env.SESSION_EXPIRY) || DEFAULT_SESSION_EXPIRY;
+  const sessionExpiry = getOpenIdSessionExpiry();
   const sessionOptions = {
     secret: process.env.OPENID_SESSION_SECRET,
     resave: false,
@@ -97,7 +114,7 @@ const configureSocialLogins = async (app) => {
     process.env.SAML_SESSION_SECRET
   ) {
     logger.info('Configuring SAML Connect...');
-    const sessionExpiry = Number(process.env.SESSION_EXPIRY) || DEFAULT_SESSION_EXPIRY;
+    const sessionExpiry = getSessionExpiry();
     const sessionOptions = {
       secret: process.env.SAML_SESSION_SECRET,
       resave: false,
diff --git a/api/server/socialLogins.spec.js b/api/server/socialLogins.spec.js
new file mode 100644
index 00000000000..bf016a43ebb
--- /dev/null
+++ b/api/server/socialLogins.spec.js
@@ -0,0 +1,143 @@
+const mockSessionMiddleware = jest.fn((req, res, next) => next());
+const mockPassportSessionMiddleware = jest.fn((req, res, next) => next());
+const mockSession = jest.fn(() => mockSessionMiddleware);
+const mockPassportUse = jest.fn();
+const mockPassportSession = jest.fn(() => mockPassportSessionMiddleware);
+const mockGetLogStores = jest.fn(() => 'openid-session-store');
+const mockOpenIdJwtLogin = jest.fn(() => 'openid-jwt-strategy');
+const mockSetupOpenId = jest.fn();
+const mockSetupSaml = jest.fn();
+const mockIsEnabled = jest.fn();
+const mockShouldUseSecureCookie = jest.fn(() => true);
+const mockMath = jest.fn((value, fallback) => {
+  if (value == null || value === '') {
+    return fallback;
+  }
+  if (typeof value === 'number') {
+    return value;
+  }
+  return value
+    .split('*')
+    .map((part) => Number(part.trim()))
+    .reduce((result, part) => result * part, 1);
+});
+
+jest.mock(
+  'express-session',
+  () =>
+    (...args) =>
+      mockSession(...args),
+);
+jest.mock('passport', () => ({
+  use: (...args) => mockPassportUse(...args),
+  session: (...args) => mockPassportSession(...args),
+}));
+jest.mock('librechat-data-provider', () => ({
+  CacheKeys: {
+    OPENID_SESSION: 'openid-session',
+    SAML_SESSION: 'saml-session',
+  },
+}));
+jest.mock('@librechat/api', () => ({
+  math: (...args) => mockMath(...args),
+  isEnabled: (...args) => mockIsEnabled(...args),
+  shouldUseSecureCookie: (...args) => mockShouldUseSecureCookie(...args),
+}));
+jest.mock('@librechat/data-schemas', () => ({
+  DEFAULT_SESSION_EXPIRY: 900000,
+  logger: { error: jest.fn(), info: jest.fn() },
+}));
+jest.mock('~/cache', () => ({ getLogStores: (...args) => mockGetLogStores(...args) }));
+jest.mock('~/strategies', () => ({
+  openIdJwtLogin: (...args) => mockOpenIdJwtLogin(...args),
+  facebookLogin: jest.fn(),
+  facebookAdminLogin: jest.fn(),
+  discordLogin: jest.fn(),
+  discordAdminLogin: jest.fn(),
+  setupOpenId: (...args) => mockSetupOpenId(...args),
+  googleLogin: jest.fn(),
+  googleAdminLogin: jest.fn(),
+  githubLogin: jest.fn(),
+  githubAdminLogin: jest.fn(),
+  appleLogin: jest.fn(),
+  appleAdminLogin: jest.fn(),
+  setupSaml: (...args) => mockSetupSaml(...args),
+}));
+
+const configureSocialLogins = require('./socialLogins');
+
+describe('configureSocialLogins OpenID session expiry', () => {
+  const ORIGINAL_ENV = process.env;
+
+  const setupOpenIdEnv = () => {
+    process.env.OPENID_CLIENT_ID = 'client-id';
+    process.env.OPENID_CLIENT_SECRET = 'client-secret';
+    process.env.OPENID_ISSUER = 'https://issuer.example.com';
+    process.env.OPENID_SCOPE = 'openid profile email';
+    process.env.OPENID_SESSION_SECRET = 'openid-session-secret';
+    process.env.OPENID_USE_PKCE = 'false';
+  };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    process.env = {};
+    setupOpenIdEnv();
+    mockSetupOpenId.mockResolvedValue({ issuer: 'https://issuer.example.com' });
+    mockIsEnabled.mockImplementation((value) => value === 'true');
+  });
+
+  afterAll(() => {
+    process.env = ORIGINAL_ENV;
+  });
+
+  it('extends the OpenID session cookie to the reuse window when token reuse is enabled', async () => {
+    process.env.SESSION_EXPIRY = '1000 * 60 * 15';
+    process.env.OPENID_REUSE_TOKENS = 'true';
+    process.env.OPENID_REUSE_MAX_SESSION_AGE_MS = '1000 * 60 * 60';
+    const app = { use: jest.fn() };
+
+    await configureSocialLogins(app);
+
+    expect(mockSession).toHaveBeenCalledWith(
+      expect.objectContaining({
+        cookie: {
+          maxAge: 3600000,
+          secure: true,
+        },
+      }),
+    );
+    expect(mockOpenIdJwtLogin).toHaveBeenCalledWith({ issuer: 'https://issuer.example.com' });
+    expect(mockPassportUse).toHaveBeenCalledWith('openidJwt', 'openid-jwt-strategy');
+  });
+
+  it('keeps a longer SESSION_EXPIRY when the reuse window is shorter', async () => {
+    process.env.SESSION_EXPIRY = '1000 * 60 * 60 * 2';
+    process.env.OPENID_REUSE_TOKENS = 'true';
+    process.env.OPENID_REUSE_MAX_SESSION_AGE_MS = '1000 * 60 * 60';
+    const app = { use: jest.fn() };
+
+    await configureSocialLogins(app);
+
+    expect(mockSession).toHaveBeenCalledWith(
+      expect.objectContaining({
+        cookie: expect.objectContaining({ maxAge: 7200000 }),
+      }),
+    );
+  });
+
+  it('uses SESSION_EXPIRY when OpenID token reuse is disabled', async () => {
+    process.env.SESSION_EXPIRY = '1000 * 60 * 15';
+    process.env.OPENID_REUSE_TOKENS = '';
+    process.env.OPENID_REUSE_MAX_SESSION_AGE_MS = '1000 * 60 * 60';
+    const app = { use: jest.fn() };
+
+    await configureSocialLogins(app);
+
+    expect(mockSession).toHaveBeenCalledWith(
+      expect.objectContaining({
+        cookie: expect.objectContaining({ maxAge: 900000 }),
+      }),
+    );
+    expect(mockPassportUse).not.toHaveBeenCalled();
+  });
+});
diff --git a/api/server/utils/__tests__/staticCache.spec.js b/api/server/utils/__tests__/staticCache.spec.js
index 5d285017bd4..2b22223393c 100644
--- a/api/server/utils/__tests__/staticCache.spec.js
+++ b/api/server/utils/__tests__/staticCache.spec.js
@@ -5,6 +5,12 @@ const request = require('supertest');
 const zlib = require('zlib');
 const staticCache = require('../staticCache');
 
+const binaryParser = (res, callback) => {
+  const chunks = [];
+  res.on('data', (chunk) => chunks.push(chunk));
+  res.on('end', () => callback(null, Buffer.concat(chunks)));
+};
+
 describe('staticCache', () => {
   let app;
   let testDir;
@@ -36,10 +42,15 @@ describe('staticCache', () => {
     fs.writeFileSync(manifestFile, jsonContent);
     fs.writeFileSync(swFile, swContent);
 
-    // Create gzipped versions of some files
+    // Create precompressed versions of some files
     fs.writeFileSync(testFile + '.gz', zlib.gzipSync(jsContent));
+    fs.writeFileSync(testFile + '.br', zlib.brotliCompressSync(jsContent));
     fs.writeFileSync(path.join(testDir, 'test.css'), 'body { color: red; }');
     fs.writeFileSync(path.join(testDir, 'test.css.gz'), zlib.gzipSync('body { color: red; }'));
+    fs.writeFileSync(
+      path.join(testDir, 'test.css.br'),
+      zlib.brotliCompressSync('body { color: red; }'),
+    );
 
     // Create a file that only exists in gzipped form
     fs.writeFileSync(
@@ -67,6 +78,7 @@ describe('staticCache', () => {
     delete process.env.NODE_ENV;
     delete process.env.STATIC_CACHE_S_MAX_AGE;
     delete process.env.STATIC_CACHE_MAX_AGE;
+    delete process.env.ENABLE_STATIC_ASSET_BROTLI;
   });
   describe('cache headers in production', () => {
     beforeEach(() => {
@@ -193,6 +205,51 @@ describe('staticCache', () => {
       process.env.NODE_ENV = 'production';
     });
 
+    it('should serve Brotli files when client accepts Brotli encoding', async () => {
+      process.env.ENABLE_STATIC_ASSET_BROTLI = 'true';
+      app.use(staticCache(testDir, { skipGzipScan: false }));
+
+      const response = await request(app)
+        .get('/test.js')
+        .set('Accept-Encoding', 'br, gzip, deflate')
+        .buffer(true)
+        .parse(binaryParser)
+        .expect(200);
+
+      expect(response.headers['content-encoding']).toBe('br');
+      expect(response.headers['content-type']).toMatch(/javascript/);
+      expect(response.headers['cache-control']).toBe('public, max-age=172800, s-maxage=86400');
+      expect(zlib.brotliDecompressSync(response.body).toString()).toBe('console.log("test");');
+    });
+
+    it('should prefer Brotli over gzip when both encodings are accepted', async () => {
+      process.env.ENABLE_STATIC_ASSET_BROTLI = 'true';
+      app.use(staticCache(testDir, { skipGzipScan: false }));
+
+      const response = await request(app)
+        .get('/test.css')
+        .set('Accept-Encoding', 'gzip, br')
+        .buffer(true)
+        .parse(binaryParser)
+        .expect(200);
+
+      expect(response.headers['content-encoding']).toBe('br');
+      expect(response.headers['content-type']).toMatch(/css/);
+      expect(zlib.brotliDecompressSync(response.body).toString()).toBe('body { color: red; }');
+    });
+
+    it('should keep serving gzip when Brotli is not enabled', async () => {
+      app.use(staticCache(testDir, { skipGzipScan: false }));
+
+      const response = await request(app)
+        .get('/test.js')
+        .set('Accept-Encoding', 'br, gzip, deflate')
+        .expect(200);
+
+      expect(response.headers['content-encoding']).toBe('gzip');
+      expect(response.text).toBe('console.log("test");');
+    });
+
     it('should serve gzipped files when client accepts gzip encoding', async () => {
       app.use(staticCache(testDir, { skipGzipScan: false }));
 
diff --git a/api/server/utils/fallback.js b/api/server/utils/fallback.js
new file mode 100644
index 00000000000..3e067ab9caf
--- /dev/null
+++ b/api/server/utils/fallback.js
@@ -0,0 +1,20 @@
+/** Static asset extensions that must 404 when missing — serving the SPA's
+ * index.html for them breaks strict MIME checks and poisons SW/browser caches. */
+const STATIC_ASSET_EXT =
+  /\.(?:js|mjs|css|map|json|wasm|webmanifest|png|jpe?g|gif|svg|ico|webp|avif|woff2?|ttf|otf|eot)$/i;
+
+/**
+ * Creates the SPA fallback middleware: serves index.html for unmatched
+ * routes while returning 404 for missing static assets.
+ * @param {(req: import('express').Request, res: import('express').Response) => void} sendIndexHtml
+ */
+function createSpaFallback(sendIndexHtml) {
+  return (req, res) => {
+    if (STATIC_ASSET_EXT.test(req.path)) {
+      return res.status(404).end();
+    }
+    return sendIndexHtml(req, res);
+  };
+}
+
+module.exports = createSpaFallback;
diff --git a/api/server/utils/import/importers-timestamp.spec.js b/api/server/utils/import/importers-timestamp.spec.js
index e12c099abb8..268cc74c0d8 100644
--- a/api/server/utils/import/importers-timestamp.spec.js
+++ b/api/server/utils/import/importers-timestamp.spec.js
@@ -7,6 +7,7 @@ const { getImporter } = require('./importers');
 jest.mock('~/models', () => ({
   bulkSaveConvos: jest.fn(),
   bulkSaveMessages: jest.fn(),
+  bulkIncrementTagCounts: jest.fn(),
 }));
 
 const mockGetEndpointsConfig = jest.fn().mockResolvedValue(null);
diff --git a/api/server/utils/import/importers.js b/api/server/utils/import/importers.js
index b86be3798e0..435572d65a3 100644
--- a/api/server/utils/import/importers.js
+++ b/api/server/utils/import/importers.js
@@ -22,8 +22,11 @@ function getImporter(jsonData) {
       return importClaudeConvo;
     }
     // ChatGPT format has mapping object in each conversation
-    logger.info('Importing ChatGPT conversation');
-    return importChatGptConvo;
+    if (jsonData.length === 0 || jsonData[0]?.mapping) {
+      logger.info('Importing ChatGPT conversation');
+      return importChatGptConvo;
+    }
+    throw new Error('Unsupported import type');
   }
 
   // For ChatbotUI
@@ -81,6 +84,7 @@ async function importChatBotUiConvo(
     logger.info(`user: ${requestUserId} | ChatbotUI conversation imported`);
   } catch (error) {
     logger.error(`user: ${requestUserId} | Error creating conversation from ChatbotUI file`, error);
+    throw error;
   }
 }
 
@@ -197,6 +201,7 @@ async function importClaudeConvo(
     logger.info(`user: ${requestUserId} | Claude conversation imported`);
   } catch (error) {
     logger.error(`user: ${requestUserId} | Error creating conversation from Claude file`, error);
+    throw error;
   }
 }
 
@@ -305,6 +310,7 @@ async function importLibreChatConvo(
     logger.debug(`user: ${requestUserId} | Conversation "${jsonData.title}" imported`);
   } catch (error) {
     logger.error(`user: ${requestUserId} | Error creating conversation from LibreChat file`, error);
+    throw error;
   }
 }
 
@@ -336,6 +342,7 @@ async function importChatGptConvo(
     await importBatchBuilder.saveBatch();
   } catch (error) {
     logger.error(`user: ${requestUserId} | Error creating conversation from imported file`, error);
+    throw error;
   }
 }
 
@@ -355,7 +362,7 @@ function processConversation(conv, importBatchBuilder, requestUserId, defaultMod
   // Map all message IDs to new UUIDs
   const messageMap = new Map();
   for (const [id, mapping] of Object.entries(conv.mapping)) {
-    if (mapping.message && mapping.message.content.content_type) {
+    if (mapping.message?.content?.content_type) {
       const newMessageId = uuidv4();
       messageMap.set(id, newMessageId);
     }
@@ -467,6 +474,9 @@ function processConversation(conv, importBatchBuilder, requestUserId, defaultMod
     }
 
     const newMessageId = messageMap.get(id);
+    if (!newMessageId) {
+      continue;
+    }
     const parentMessageId = findValidParent(mapping.parent);
 
     const messageText = formatMessageText(mapping.message);
@@ -474,7 +484,7 @@ function processConversation(conv, importBatchBuilder, requestUserId, defaultMod
     const isCreatedByUser = role === 'user';
     let sender = isCreatedByUser ? 'user' : 'assistant';
     const model =
-      mapping.message.metadata.model_slug || defaultModel || openAISettings.model.default;
+      mapping.message.metadata?.model_slug || defaultModel || openAISettings.model.default;
 
     if (!isCreatedByUser) {
       /** Extracted model name from model slug */
@@ -598,7 +608,7 @@ function formatMessageText(messageData) {
     messageText = `\`\`\`json\n${JSON.stringify(messageData.content, null, 2)}\n\`\`\``;
   }
 
-  if (isText && messageData.author.role !== 'user') {
+  if (isText && messageData.author?.role !== 'user') {
     messageText = processAssistantMessage(messageData, messageText);
   }
 
diff --git a/api/server/utils/import/importers.spec.js b/api/server/utils/import/importers.spec.js
index 6ccd2f37288..a9bd679f55f 100644
--- a/api/server/utils/import/importers.spec.js
+++ b/api/server/utils/import/importers.spec.js
@@ -764,6 +764,86 @@ describe('importChatGptConvo', () => {
     expect(userMsg.createdAt).toEqual(new Date(1000 * 1000));
     expect(assistantMsg.createdAt).toEqual(new Date(2000 * 1000));
   });
+
+  it('should import messages missing metadata without failing (newer ChatGPT exports)', async () => {
+    const testData = [
+      {
+        title: 'Missing Metadata Test',
+        create_time: 1714585031.148505,
+        update_time: 1714585060.879308,
+        mapping: {
+          'root-node': {
+            id: 'root-node',
+            message: null,
+            parent: null,
+            children: ['user-msg-1'],
+          },
+          'user-msg-1': {
+            id: 'user-msg-1',
+            message: {
+              id: 'user-msg-1',
+              author: { role: 'user' },
+              create_time: 1714585031.150442,
+              content: { content_type: 'text', parts: ['User message without metadata'] },
+            },
+            parent: 'root-node',
+            children: ['assistant-msg-1'],
+          },
+          'assistant-msg-1': {
+            id: 'assistant-msg-1',
+            message: {
+              id: 'assistant-msg-1',
+              author: { role: 'assistant' },
+              create_time: 1714585032.150442,
+              content: { content_type: 'text', parts: ['Assistant response without metadata'] },
+            },
+            parent: 'user-msg-1',
+            children: ['no-content-msg'],
+          },
+          'no-content-msg': {
+            id: 'no-content-msg',
+            message: {
+              id: 'no-content-msg',
+              author: { role: 'tool' },
+              create_time: 1714585033.150442,
+            },
+            parent: 'assistant-msg-1',
+            children: [],
+          },
+        },
+      },
+    ];
+
+    const requestUserId = 'user-123';
+    const importBatchBuilder = new ImportBatchBuilder(requestUserId);
+    jest.spyOn(importBatchBuilder, 'saveMessage');
+
+    const importer = getImporter(testData);
+    await importer(testData, requestUserId, () => importBatchBuilder);
+
+    const savedMessages = importBatchBuilder.saveMessage.mock.calls.map((call) => call[0]);
+    expect(savedMessages).toHaveLength(2);
+
+    const userMessage = savedMessages.find((msg) => msg.isCreatedByUser);
+    const assistantMessage = savedMessages.find((msg) => !msg.isCreatedByUser);
+    expect(userMessage.model).toBe(openAISettings.model.default);
+    expect(assistantMessage.model).toBe(openAISettings.model.default);
+    expect(assistantMessage.parentMessageId).toBe(userMessage.messageId);
+  });
+
+  it('should rethrow errors so failed imports are not reported as successful', async () => {
+    const jsonData = JSON.parse(
+      fs.readFileSync(path.join(__dirname, '__data__', 'chatgpt-export.json'), 'utf8'),
+    );
+    const requestUserId = 'user-123';
+    const importBatchBuilder = new ImportBatchBuilder(requestUserId);
+    jest.spyOn(importBatchBuilder, 'saveBatch').mockRejectedValue(new Error('db unavailable'));
+
+    const importer = getImporter(jsonData);
+    await expect(importer(jsonData, requestUserId, () => importBatchBuilder)).rejects.toThrow(
+      'db unavailable',
+    );
+  });
 });
 
 describe('importLibreChatConvo', () => {
@@ -1135,6 +1215,17 @@ describe('getImporter', () => {
     const jsonData = { unsupported: 'data' };
     expect(() => getImporter(jsonData)).toThrow('Unsupported import type');
   });
+
+  it('should throw for array-based files that are not ChatGPT or Claude exports', () => {
+    const openWebUiExport = [
+      { id: 'abc', title: 'Open WebUI Chat', chat: { history: { messages: {} } } },
+    ];
+    expect(() => getImporter(openWebUiExport)).toThrow('Unsupported import type');
+  });
+
+  it('should route empty arrays to the ChatGPT importer without throwing', () => {
+    expect(() => getImporter([])).not.toThrow();
+  });
 });
 
 describe('processAssistantMessage', () => {
diff --git a/api/server/utils/staticCache.js b/api/server/utils/staticCache.js
index ecaea856d0a..a16830a56c8 100644
--- a/api/server/utils/staticCache.js
+++ b/api/server/utils/staticCache.js
@@ -6,9 +6,10 @@ const oneDayInSeconds = 24 * 60 * 60;
 
 const sMaxAge = process.env.STATIC_CACHE_S_MAX_AGE || oneDayInSeconds;
 const maxAge = process.env.STATIC_CACHE_MAX_AGE || oneDayInSeconds * 2;
+const isEnabled = (value) => value === true || String(value).toLowerCase() === 'true';
 
 /**
- * Creates an Express static middleware with optional gzip compression and configurable caching
+ * Creates an Express static middleware with optional precompressed asset serving and configurable caching
  *
  * @param {string} staticPath - The file system path to serve static files from
  * @param {Object} [options={}] - Configuration options
@@ -18,6 +19,7 @@ const maxAge = process.env.STATIC_CACHE_MAX_AGE || oneDayInSeconds * 2;
  */
 function staticCache(staticPath, options = {}) {
   const { noCache = false, skipGzipScan = false } = options;
+  const enableBrotli = isEnabled(process.env.ENABLE_STATIC_ASSET_BROTLI);
 
   const setHeaders = (res, filePath) => {
     if (process.env.NODE_ENV?.toLowerCase() !== 'production') {
@@ -36,7 +38,8 @@ function staticCache(staticPath, options = {}) {
       fileName === 'index.html' ||
       fileName.endsWith('.webmanifest') ||
       fileName === 'manifest.json' ||
-      fileName === 'sw.js'
+      fileName === 'sw.js' ||
+      fileName === 'sw-heal.js'
     ) {
       res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate');
     } else {
@@ -51,8 +54,8 @@ function staticCache(staticPath, options = {}) {
     });
   } else {
     return expressStaticGzip(staticPath, {
-      enableBrotli: false,
-      orderPreference: ['gz'],
+      enableBrotli,
+      orderPreference: enableBrotli ? ['br', 'gz'] : ['gz'],
       setHeaders,
       index: false,
     });
diff --git a/api/strategies/openIdJwtStrategy.js b/api/strategies/openIdJwtStrategy.js
index ab1bcd1c0a1..14f50f3f042 100644
--- a/api/strategies/openIdJwtStrategy.js
+++ b/api/strategies/openIdJwtStrategy.js
@@ -1,7 +1,6 @@
 const cookies = require('cookie');
 const jwksRsa = require('jwks-rsa');
 const { logger } = require('@librechat/data-schemas');
-const { HttpsProxyAgent } = require('https-proxy-agent');
 const { SystemRoles } = require('librechat-data-provider');
 const { Strategy: JwtStrategy, ExtractJwt } = require('passport-jwt');
 const {
@@ -10,6 +9,7 @@ const {
   getOpenIdEmail,
   getOpenIdIssuer,
   normalizeOpenIdIssuer,
+  getHttpsProxyAgent,
   math,
 } = require('@librechat/api');
 const { updateUser, findUser } = require('~/models');
@@ -73,8 +73,9 @@ const openIdJwtLogin = (openIdConfig) => {
     jwksUri: openIdConfig.serverMetadata().jwks_uri,
   };
 
-  if (process.env.PROXY) {
-    jwksRsaOptions.requestAgent = new HttpsProxyAgent(process.env.PROXY);
+  const requestAgent = getHttpsProxyAgent(jwksRsaOptions.jwksUri);
+  if (requestAgent) {
+    jwksRsaOptions.requestAgent = requestAgent;
   }
 
   return new JwtStrategy(
diff --git a/api/strategies/openIdJwtStrategy.spec.js b/api/strategies/openIdJwtStrategy.spec.js
index 4a1871110c5..5b4bc86c495 100644
--- a/api/strategies/openIdJwtStrategy.spec.js
+++ b/api/strategies/openIdJwtStrategy.spec.js
@@ -28,6 +28,7 @@ jest.mock('@librechat/api', () => ({
   getOpenIdEmail: jest.requireActual('@librechat/api').getOpenIdEmail,
   getOpenIdIssuer: jest.fn(() => 'https://issuer.example.com'),
   normalizeOpenIdIssuer: jest.requireActual('@librechat/api').normalizeOpenIdIssuer,
+  getHttpsProxyAgent: jest.fn(() => undefined),
   math: jest.fn((val, fallback) => fallback),
 }));
 jest.mock('~/models', () => ({
diff --git a/api/strategies/openidStrategy.js b/api/strategies/openidStrategy.js
index 67da4bf007f..d9c2684314f 100644
--- a/api/strategies/openidStrategy.js
+++ b/api/strategies/openidStrategy.js
@@ -14,14 +14,15 @@ const {
   getOpenIdEmail,
   getOpenIdIssuer,
   getBalanceConfig,
+  selectOpenIdRole,
+  getAvatarSaveParams,
   isEmailDomainAllowed,
   getAvatarFileStrategy,
-  getAvatarSaveParams,
-  selectOpenIdRole,
+  resolveAppConfigForUser,
+  getOpenIdProxyDispatcher,
   getOpenIdRoleSyncOptions,
   getOpenIdRolesForOpenIdSync,
   getLibreChatRolesForOpenIdSync,
-  resolveAppConfigForUser,
 } = require('@librechat/api');
 const { getStrategyFunctions } = require('~/server/services/Files/strategies');
 const { resizeAvatar } = require('~/server/services/Files/images/avatar');
@@ -61,11 +62,12 @@ async function customFetch(url, options) {
   try {
     /** @type {undici.RequestInit} */
     let fetchOptions = options;
-    if (process.env.PROXY) {
-      logger.info(`[openidStrategy] proxy agent configured: ${process.env.PROXY}`);
+    const dispatcher = getOpenIdProxyDispatcher();
+    if (dispatcher) {
+      logger.info('[openidStrategy] proxy dispatcher configured');
       fetchOptions = {
         ...options,
-        dispatcher: new undici.ProxyAgent(process.env.PROXY),
+        dispatcher,
       };
     }
 
@@ -107,6 +109,12 @@ This violates RFC 7235 and may cause issues with strict OAuth clients. Removing
 /** @typedef {Configuration | null}  */
 let openidConfig = null;
 
+const getOpenIdAuthorizationAudience = () =>
+  (process.env.OPENID_AUDIENCE ?? '')
+    .split(',')
+    .map((value) => value.trim())
+    .find(Boolean);
+
 /**
  * Custom OpenID Strategy
  *
@@ -127,10 +135,11 @@ class CustomOpenIDStrategy extends OpenIDStrategy {
       params.set('state', options.state);
     }
 
-    if (process.env.OPENID_AUDIENCE) {
-      params.set('audience', process.env.OPENID_AUDIENCE);
+    const authorizationAudience = getOpenIdAuthorizationAudience();
+    if (authorizationAudience) {
+      params.set('audience', authorizationAudience);
       logger.debug(
-        `[openidStrategy] Adding audience to authorization request: ${process.env.OPENID_AUDIENCE}`,
+        `[openidStrategy] Adding audience to authorization request: ${authorizationAudience}`,
       );
     }
 
@@ -412,9 +421,9 @@ async function resolveGroupsFromOverage(accessToken, sub) {
       body: JSON.stringify({ securityEnabledOnly: false }),
     };
 
-    if (process.env.PROXY) {
-      const { ProxyAgent } = undici;
-      fetchOptions.dispatcher = new ProxyAgent(process.env.PROXY);
+    const dispatcher = getOpenIdProxyDispatcher();
+    if (dispatcher) {
+      fetchOptions.dispatcher = dispatcher;
     }
 
     const response = await undici.fetch(url, fetchOptions);
diff --git a/api/strategies/openidStrategy.spec.js b/api/strategies/openidStrategy.spec.js
index b1d6081fe84..36a491a0685 100644
--- a/api/strategies/openidStrategy.spec.js
+++ b/api/strategies/openidStrategy.spec.js
@@ -3,7 +3,12 @@ const fetch = require('node-fetch');
 const jwtDecode = require('jsonwebtoken/decode');
 const { ErrorTypes, FileSources } = require('librechat-data-provider');
 const { findUser, createUser, updateUser, findRolesByNames } = require('~/models');
-const { getOpenIdIssuer, resolveAppConfigForUser, isEnabled } = require('@librechat/api');
+const {
+  getOpenIdProxyDispatcher,
+  resolveAppConfigForUser,
+  getOpenIdIssuer,
+  isEnabled,
+} = require('@librechat/api');
 const { resizeAvatar } = require('~/server/services/Files/images/avatar');
 const { getAppConfig } = require('~/server/services/Config');
 const { setupOpenId } = require('./openidStrategy');
@@ -15,7 +20,6 @@ jest.mock('node-fetch');
 jest.mock('jsonwebtoken/decode');
 jest.mock('undici', () => ({
   fetch: jest.fn(),
-  ProxyAgent: jest.fn(),
 }));
 jest.mock('~/server/services/Files/strategies', () => ({
   getStrategyFunctions: jest.fn(() => ({
@@ -74,6 +78,7 @@ jest.mock('@librechat/api', () => {
       enabled: false,
     })),
     getOpenIdIssuer: jest.fn(() => 'https://fake-issuer.com'),
+    getOpenIdProxyDispatcher: jest.fn(() => undefined),
     getAvatarFileStrategy: jest.fn((config, fallbackStrategy) => {
       const { FileSources } = jest.requireActual('librechat-data-provider');
       if (config?.fileStrategies) {
@@ -140,20 +145,28 @@ jest.mock('openid-client', () => {
 jest.mock('openid-client/passport', () => {
   /** Store callbacks by strategy name - 'openid' and 'openidAdmin' */
   const verifyCallbacks = {};
+  const strategies = {};
   let lastVerifyCallback;
 
-  const mockStrategy = jest.fn((options, verify) => {
+  const mockStrategy = jest.fn(function (options, verify) {
     lastVerifyCallback = verify;
-    return { name: 'openid', options, verify };
+    this.name = 'openid';
+    this.options = options;
+    this.verify = verify;
   });
+  mockStrategy.prototype.authorizationRequestParams = jest.fn(() => new URLSearchParams());
 
   return {
     Strategy: mockStrategy,
     /** Get the last registered callback (for backward compatibility) */
     __getVerifyCallback: () => lastVerifyCallback,
+    __getStrategyByName: (name) => strategies[name],
     /** Store callback by name when passport.use is called */
-    __setVerifyCallback: (name, callback) => {
-      verifyCallbacks[name] = callback;
+    __setStrategy: (name, strategy) => {
+      strategies[name] = strategy;
+      if (strategy?.verify) {
+        verifyCallbacks[name] = strategy.verify;
+      }
     },
     /** Get callback by strategy name */
     __getVerifyCallbackByName: (name) => verifyCallbacks[name],
@@ -164,9 +177,7 @@ jest.mock('openid-client/passport', () => {
 jest.mock('passport', () => ({
   use: jest.fn((name, strategy) => {
     const passportMock = require('openid-client/passport');
-    if (strategy && strategy.verify) {
-      passportMock.__setVerifyCallback(name, strategy.verify);
-    }
+    passportMock.__setStrategy(name, strategy);
   }),
 }));
 
@@ -210,6 +221,7 @@ describe('setupOpenId', () => {
       get: jest.fn(),
       set: jest.fn(),
     }));
+    getOpenIdProxyDispatcher.mockReturnValue(undefined);
     require('openid-client').genericGrantRequest.mockReset();
     require('openid-client').genericGrantRequest.mockResolvedValue({
       access_token: 'exchanged_graph_token',
@@ -232,6 +244,7 @@ describe('setupOpenId', () => {
     delete process.env.OPENID_USERNAME_CLAIM;
     delete process.env.OPENID_NAME_CLAIM;
     delete process.env.OPENID_EMAIL_CLAIM;
+    delete process.env.OPENID_AUDIENCE;
     delete process.env.OPENID_AVATAR_AUTHORIZED_ORIGINS;
     delete process.env.PROXY;
     delete process.env.OPENID_USE_PKCE;
@@ -335,6 +348,61 @@ describe('setupOpenId', () => {
       expect(metadata.client_secret).toBe('my-secret');
       expect(metadata.token_endpoint_auth_method).toBeUndefined();
     });
+
+    it('uses the shared OpenID proxy dispatcher for custom fetch requests', async () => {
+      const dispatcher = { dispatch: jest.fn() };
+      const response = { status: 204, statusText: 'No Content', headers: new Headers() };
+      getOpenIdProxyDispatcher.mockReturnValue(dispatcher);
+      undici.fetch.mockResolvedValue(response);
+
+      await setupOpenId();
+
+      const [, , , , options] = openidClient.discovery.mock.calls.at(-1);
+      const openIdFetch = options[openidClient.customFetch];
+      await expect(
+        openIdFetch('https://issuer.example.com/.well-known/openid-configuration', {
+          method: 'GET',
+        }),
+      ).resolves.toBe(response);
+
+      expect(getOpenIdProxyDispatcher).toHaveBeenCalled();
+      expect(undici.fetch).toHaveBeenCalledWith(
+        'https://issuer.example.com/.well-known/openid-configuration',
+        {
+          method: 'GET',
+          dispatcher,
+        },
+      );
+    });
+  });
+
+  describe('authorizationRequestParams', () => {
+    const getLoginStrategy = () => require('openid-client/passport').__getStrategyByName('openid');
+
+    it('adds a single OpenID audience to authorization requests', () => {
+      process.env.OPENID_AUDIENCE = 'librechat';
+
+      const params = getLoginStrategy().authorizationRequestParams({}, { state: 'login-state' });
+
+      expect(params.get('audience')).toBe('librechat');
+      expect(params.get('state')).toBe('login-state');
+    });
+
+    it('uses the first non-empty audience when OPENID_AUDIENCE accepts multiple JWT audiences', () => {
+      process.env.OPENID_AUDIENCE = ' librechat , control-plane-web ';
+
+      const params = getLoginStrategy().authorizationRequestParams({}, {});
+
+      expect(params.get('audience')).toBe('librechat');
+    });
+
+    it('does not add an authorization audience when OPENID_AUDIENCE is empty', () => {
+      process.env.OPENID_AUDIENCE = ' , ';
+
+      const params = getLoginStrategy().authorizationRequestParams({}, {});
+
+      expect(params.has('audience')).toBe(false);
+    });
   });
 
   it('should create a new user with correct username when preferred_username claim exists', async () => {
diff --git a/api/test/__mocks__/logger.js b/api/test/__mocks__/logger.js
index 94dd08bb1c4..699a94883f1 100644
--- a/api/test/__mocks__/logger.js
+++ b/api/test/__mocks__/logger.js
@@ -58,12 +58,3 @@ jest.mock('~/config', () => {
     },
   };
 });
-
-jest.mock('~/config/parsers', () => {
-  return {
-    redactMessage: jest.fn(),
-    redactFormat: jest.fn(),
-    debugTraverse: jest.fn(),
-    formatConsoleMeta: jest.fn(() => ''),
-  };
-});
diff --git a/api/test/app/clients/tools/structured/OpenAIImageTools.test.js b/api/test/app/clients/tools/structured/OpenAIImageTools.test.js
index aa0726b9163..b83ed5335c6 100644
--- a/api/test/app/clients/tools/structured/OpenAIImageTools.test.js
+++ b/api/test/app/clients/tools/structured/OpenAIImageTools.test.js
@@ -25,6 +25,8 @@ jest.mock('@librechat/api', () => ({
     },
   },
   extractBaseURL: jest.fn((url) => url),
+  getProxyDispatcher: jest.fn(() => undefined),
+  applyAxiosProxyConfig: jest.fn(),
 }));
 
 jest.mock('~/server/services/Files/strategies', () => ({
diff --git a/api/utils/tokens.spec.js b/api/utils/tokens.spec.js
index e2c4ac9ba46..82c5a8b31fb 100644
--- a/api/utils/tokens.spec.js
+++ b/api/utils/tokens.spec.js
@@ -1521,6 +1521,68 @@ describe('Claude Model Tests', () => {
     });
   });
 
+  it('should return correct context length for Claude Fable 5 (1M)', () => {
+    expect(getModelMaxTokens('claude-fable-5', EModelEndpoint.anthropic)).toBe(
+      maxTokensMap[EModelEndpoint.anthropic]['claude-fable-5'],
+    );
+    expect(getModelMaxTokens('claude-fable-5')).toBe(
+      maxTokensMap[EModelEndpoint.anthropic]['claude-fable-5'],
+    );
+  });
+
+  it('should return correct max output tokens for Claude Fable 5 (128K)', () => {
+    const { getModelMaxOutputTokens } = require('@librechat/api');
+    expect(getModelMaxOutputTokens('claude-fable-5', EModelEndpoint.anthropic)).toBe(
+      maxOutputTokensMap[EModelEndpoint.anthropic]['claude-fable-5'],
+    );
+  });
+
+  it('should match model names correctly for Claude Fable 5', () => {
+    const modelVariations = [
+      'claude-fable-5',
+      'claude-fable-5-20260609',
+      'claude-fable-5-latest',
+      'anthropic/claude-fable-5',
+      'claude-fable-5/anthropic',
+      'anthropic.claude-fable-5',
+    ];
+
+    modelVariations.forEach((model) => {
+      expect(matchModelName(model, EModelEndpoint.anthropic)).toBe('claude-fable-5');
+    });
+  });
+
+  it('should return correct context length for Claude Mythos 5 (1M)', () => {
+    expect(getModelMaxTokens('claude-mythos-5', EModelEndpoint.anthropic)).toBe(
+      maxTokensMap[EModelEndpoint.anthropic]['claude-mythos-5'],
+    );
+    expect(getModelMaxTokens('claude-mythos-5')).toBe(
+      maxTokensMap[EModelEndpoint.anthropic]['claude-mythos-5'],
+    );
+  });
+
+  it('should return correct max output tokens for Claude Mythos 5 (128K)', () => {
+    const { getModelMaxOutputTokens } = require('@librechat/api');
+    expect(getModelMaxOutputTokens('claude-mythos-5', EModelEndpoint.anthropic)).toBe(
+      maxOutputTokensMap[EModelEndpoint.anthropic]['claude-mythos-5'],
+    );
+  });
+
+  it('should match model names correctly for Claude Mythos 5', () => {
+    const modelVariations = [
+      'claude-mythos-5',
+      'claude-mythos-5-20260609',
+      'claude-mythos-5-latest',
+      'anthropic/claude-mythos-5',
+      'claude-mythos-5/anthropic',
+      'anthropic.claude-mythos-5',
+    ];
+
+    modelVariations.forEach((model) => {
+      expect(matchModelName(model, EModelEndpoint.anthropic)).toBe('claude-mythos-5');
+    });
+  });
+
   it('should return correct context length for Claude Sonnet 4.6 (1M)', () => {
     expect(getModelMaxTokens('claude-sonnet-4-6', EModelEndpoint.anthropic)).toBe(
       maxTokensMap[EModelEndpoint.anthropic]['claude-sonnet-4-6'],
diff --git a/bun.lock b/bun.lock
index 56914cfcc84..6ed9ac13926 100644
--- a/bun.lock
+++ b/bun.lock
@@ -37,7 +37,7 @@
     },
     "api": {
       "name": "@librechat/backend",
-      "version": "0.8.6",
+      "version": "0.8.7-rc1",
       "dependencies": {
         "@anthropic-ai/vertex-sdk": "^0.14.3",
         "@aws-sdk/client-bedrock-runtime": "^3.980.0",
@@ -130,7 +130,7 @@
     },
     "client": {
       "name": "@librechat/frontend",
-      "version": "0.8.6",
+      "version": "0.8.7-rc1",
       "dependencies": {
         "@ariakit/react": "^0.4.15",
         "@ariakit/react-core": "^0.4.17",
@@ -264,7 +264,7 @@
     },
     "packages/api": {
       "name": "@librechat/api",
-      "version": "1.7.31",
+      "version": "1.7.32",
       "devDependencies": {
         "@babel/preset-env": "^7.21.5",
         "@babel/preset-react": "^7.18.6",
@@ -345,7 +345,7 @@
     },
     "packages/client": {
       "name": "@librechat/client",
-      "version": "0.4.60",
+      "version": "0.4.61",
       "devDependencies": {
         "@babel/core": "^7.28.5",
         "@babel/preset-env": "^7.28.5",
@@ -433,7 +433,7 @@
     },
     "packages/data-provider": {
       "name": "librechat-data-provider",
-      "version": "0.8.503",
+      "version": "0.8.505",
       "dependencies": {
         "axios": "^1.13.5",
         "dayjs": "^1.11.13",
@@ -470,7 +470,7 @@
     },
     "packages/data-schemas": {
       "name": "@librechat/data-schemas",
-      "version": "0.0.52",
+      "version": "0.0.53",
       "devDependencies": {
         "@rollup/plugin-alias": "^5.1.0",
         "@rollup/plugin-commonjs": "^29.0.0",
diff --git a/client/index.html b/client/index.html
index 2bd9c91e5e1..79755db659b 100644
--- a/client/index.html
+++ b/client/index.html
@@ -48,6 +48,91 @@
       `;
       document.head.appendChild(loadingContainerStyle);
     </script>
+    <script>
+      (function () {
+        var KEY = 'lc-asset-recovery-at';
+        function shouldRecover() {
+          try {
+            var last = Number(sessionStorage.getItem(KEY)) || 0;
+            if (Date.now() - last < 60000) {
+              return false;
+            }
+            sessionStorage.setItem(KEY, String(Date.now()));
+            return true;
+          } catch (e) {
+            return false;
+          }
+        }
+        /** Recovers from stale builds (e.g. an outdated service worker serving old
+         * hashed chunks after a deploy) by unregistering workers and reloading once.
+         * Returns true when a recovery reload was initiated. */
+        window.__lcRecoverStaleAssets = function () {
+          if (!shouldRecover()) {
+            return false;
+          }
+          var reload = function () {
+            window.location.reload();
+          };
+          if (navigator.serviceWorker) {
+            var scopeBase = new URL('./', document.baseURI || window.location.href).href;
+            navigator.serviceWorker
+              .getRegistrations()
+              .then(function (registrations) {
+                return Promise.all(
+                  registrations
+                    .filter(function (registration) {
+                      return registration.scope.indexOf(scopeBase) === 0;
+                    })
+                    .map(function (registration) {
+                      return registration.unregister();
+                    }),
+                );
+              })
+              .then(reload, reload);
+          } else {
+            reload();
+          }
+          return true;
+        };
+        if (navigator.serviceWorker) {
+          navigator.serviceWorker.addEventListener('message', function (event) {
+            if (!event.data || event.data.type !== 'LC_SW_PING') {
+              return;
+            }
+            var source = event.source || navigator.serviceWorker.controller;
+            if (source) {
+              source.postMessage({ type: 'LC_SW_PONG' });
+            }
+          });
+        }
+        window.addEventListener(
+          'error',
+          function (event) {
+            var el = event.target;
+            if (!el || !el.tagName) {
+              return;
+            }
+            var failedScript = el.tagName === 'SCRIPT' && el.src;
+            var failedPreload =
+              el.tagName === 'LINK' && /preload/.test(el.rel || '') && /\.js$/.test(el.href || '');
+            if (failedScript || failedPreload) {
+              window.__lcRecoverStaleAssets();
+            }
+          },
+          true,
+        );
+        window.addEventListener('unhandledrejection', function (event) {
+          var message = event.reason && event.reason.message;
+          if (
+            typeof message === 'string' &&
+            (message.indexOf('dynamically imported module') !== -1 ||
+              message.indexOf('Importing a module script failed') !== -1)
+          ) {
+            window.__lcRecoverStaleAssets();
+          }
+        });
+      })();
+    </script>
     <script defer type="module" src="/src/main.jsx"></script>
   </head>
   <body>
diff --git a/client/jest.config.cjs b/client/jest.config.cjs
index a40d832da88..9a1fce22008 100644
--- a/client/jest.config.cjs
+++ b/client/jest.config.cjs
@@ -1,4 +1,4 @@
-/** v0.8.6 */
+/** v0.8.7-rc1 */
 module.exports = {
   roots: ['<rootDir>/src'],
   testEnvironment: 'jsdom',
diff --git a/client/package.json b/client/package.json
index d7906026dd3..d54dfd285f4 100644
--- a/client/package.json
+++ b/client/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@librechat/frontend",
-  "version": "v0.8.6",
+  "version": "v0.8.7-rc1",
   "description": "",
   "type": "module",
   "scripts": {
@@ -70,7 +70,7 @@
     "downloadjs": "^1.4.7",
     "export-from-json": "^1.7.2",
     "filenamify": "^6.0.0",
-    "framer-motion": "^11.5.4",
+    "framer-motion": "^12.40.0",
     "heic-to": "^1.1.14",
     "html-to-image": "^1.11.11",
     "i18next": "^24.2.2",
@@ -82,8 +82,15 @@
     "lodash": "^4.17.23",
     "lucide-react": "^0.394.0",
     "match-sorter": "^8.1.0",
+    "mdast-util-directive": "^3.0.0",
+    "mdast-util-from-markdown": "^2.0.1",
+    "mdast-util-gfm": "^3.0.0",
+    "mdast-util-math": "^3.0.0",
     "mermaid": "^11.15.0",
+    "micromark-extension-directive": "^3.0.1",
+    "micromark-extension-gfm": "^3.0.0",
     "micromark-extension-llm-math": "^3.1.0",
+    "micromark-extension-math": "^3.1.0",
     "qrcode.react": "^4.2.0",
     "rc-input-number": "^7.4.2",
     "react": "^18.2.0",
@@ -149,12 +156,12 @@
     "jest-canvas-mock": "^2.5.2",
     "jest-environment-jsdom": "^30.2.0",
     "jest-file-loader": "^1.0.3",
-    "jest-junit": "^16.0.0",
+    "jest-junit": "^17.0.0",
     "monaco-editor": "^0.55.1",
     "postcss": "^8.4.31",
     "postcss-preset-env": "^11.2.0",
     "tailwindcss": "^3.4.1",
-    "typescript": "^5.3.3",
+    "typescript": "^5.9.3",
     "vite": "^8.0.16",
     "vite-plugin-compression2": "^2.5.3",
     "vite-plugin-node-polyfills": "^0.28.0",
diff --git a/client/src/@types/i18next.d.ts b/client/src/@types/i18next.d.ts
index 82f1ce1a3d1..2070c552715 100644
--- a/client/src/@types/i18next.d.ts
+++ b/client/src/@types/i18next.d.ts
@@ -1,9 +1,12 @@
-import { defaultNS, resources } from '~/locales/i18n';
+import translationEn from '~/locales/en/translation.json';
+import { defaultNS } from '~/locales/i18n';
 
 declare module 'i18next' {
   interface CustomTypeOptions {
     defaultNS: typeof defaultNS;
-    resources: typeof resources.en;
+    resources: {
+      translation: typeof translationEn;
+    };
     strictKeyChecks: true;
   }
 }
diff --git a/client/src/App.jsx b/client/src/App.jsx
index fe280f71297..78ed8438b04 100644
--- a/client/src/App.jsx
+++ b/client/src/App.jsx
@@ -4,11 +4,12 @@ import { DndProvider } from 'react-dnd';
 import { RouterProvider } from 'react-router-dom';
 import * as RadixToast from '@radix-ui/react-toast';
 import { HTML5Backend } from 'react-dnd-html5-backend';
-import { ReactQueryDevtools } from '@tanstack/react-query-devtools';
 import { Toast, ThemeProvider, ToastProvider } from '@librechat/client';
 import { QueryClient, QueryClientProvider, QueryCache } from '@tanstack/react-query';
 import { ScreenshotProvider, useApiErrorBoundary } from './hooks';
 import WakeLockManager from '~/components/System/WakeLockManager';
+import QueryDevtoolsGate from '~/components/QueryDevtoolsGate';
+import LanguageSync from '~/components/System/LanguageSync';
 import { getThemeFromEnv } from './utils/getThemeFromEnv';
 import { initializeFontSize } from '~/store/fontSize';
 import { LiveAnnouncer } from '~/a11y';
@@ -47,6 +48,7 @@ const App = () => {
   return (
     <QueryClientProvider client={queryClient}>
       <RecoilRoot>
+        <LanguageSync />
         <LiveAnnouncer>
           <ThemeProvider
             // Only pass initialTheme and themeRGB if environment theme exists
@@ -63,7 +65,7 @@ const App = () => {
                 <DndProvider backend={HTML5Backend}>
                   <RouterProvider router={router} />
                   <WakeLockManager />
-                  <ReactQueryDevtools initialIsOpen={false} position="top-right" />
+                  <QueryDevtoolsGate />
                   <Toast />
                   <RadixToast.Viewport className="pointer-events-none fixed inset-0 z-[1000] mx-auto my-2 flex max-w-[560px] flex-col items-stretch justify-start md:pb-5" />
                 </DndProvider>
diff --git a/client/src/Providers/ArtifactContext.tsx b/client/src/Providers/ArtifactContext.tsx
index 938f26d6e86..62136b7c78a 100644
--- a/client/src/Providers/ArtifactContext.tsx
+++ b/client/src/Providers/ArtifactContext.tsx
@@ -8,17 +8,31 @@ type TArtifactContext = {
 export const ArtifactContext = createContext<TArtifactContext>({} as TArtifactContext);
 export const useArtifactContext = () => useContext(ArtifactContext);
 
-export function ArtifactProvider({ children }: { children: ReactNode }) {
+export function ArtifactProvider({
+  children,
+  baseIndex = 0,
+}: {
+  children: ReactNode;
+  /**
+   * Offset added to every assigned index, so per-block memoized rendering can
+   * seed each block's provider with the count of artifacts in earlier blocks
+   * and keep document-order indices stable.
+   */
+  baseIndex?: number;
+}) {
   const counterRef = useRef(0);
 
-  const getNextIndex = useCallback((skip: boolean) => {
-    if (skip) {
-      return counterRef.current;
-    }
-    const nextIndex = counterRef.current;
-    counterRef.current += 1;
-    return nextIndex;
-  }, []);
+  const getNextIndex = useCallback(
+    (skip: boolean) => {
+      if (skip) {
+        return baseIndex + counterRef.current;
+      }
+      const nextIndex = counterRef.current;
+      counterRef.current += 1;
+      return baseIndex + nextIndex;
+    },
+    [baseIndex],
+  );
 
   const resetCounter = useCallback(() => {
     counterRef.current = 0;
diff --git a/client/src/Providers/BadgeRowContext.tsx b/client/src/Providers/BadgeRowContext.tsx
index 6cecc39b2da..ffbf41fe16a 100644
--- a/client/src/Providers/BadgeRowContext.tsx
+++ b/client/src/Providers/BadgeRowContext.tsx
@@ -1,7 +1,7 @@
 import React, { createContext, useContext, useEffect, useMemo, useRef } from 'react';
 import { useSetRecoilState } from 'recoil';
 import { Tools, Constants, LocalStorageKeys, AgentCapabilities } from 'librechat-data-provider';
-import type { TAgentsEndpoint } from 'librechat-data-provider';
+import type { TAgentsEndpoint, TEphemeralAgent } from 'librechat-data-provider';
 import {
   useMCPServerManager,
   useSearchApiKeyForm,
@@ -181,7 +181,7 @@ export default function BadgeRowProvider({
         if (prev == null) {
           /** ephemeralAgent is null — use localStorage defaults */
           if (hasOverrides || mcpOverrides) {
-            const result = { ...initialValues };
+            const result: TEphemeralAgent = { ...initialValues };
             if (mcpOverrides) {
               result.mcp = mcpOverrides;
             }
diff --git a/client/src/Providers/CodeBlockContext.tsx b/client/src/Providers/CodeBlockContext.tsx
index 2823f532bea..ad2ffe73509 100644
--- a/client/src/Providers/CodeBlockContext.tsx
+++ b/client/src/Providers/CodeBlockContext.tsx
@@ -8,17 +8,33 @@ type TCodeBlockContext = {
 export const CodeBlockContext = createContext<TCodeBlockContext>({} as TCodeBlockContext);
 export const useCodeBlockContext = () => useContext(CodeBlockContext);
 
-export function CodeBlockProvider({ children }: { children: ReactNode }) {
+export function CodeBlockProvider({
+  children,
+  baseIndex = 0,
+}: {
+  children: ReactNode;
+  /**
+   * Offset added to every assigned index. When rendering a message as
+   * independently memoized blocks, each block gets its own provider seeded with
+   * the running count of executable code blocks in earlier blocks, so document-
+   * order indices are preserved without a single shared (memoization-fragile)
+   * counter.
+   */
+  baseIndex?: number;
+}) {
   const counterRef = useRef(0);
 
-  const getNextIndex = useCallback((skip: boolean) => {
-    if (skip) {
-      return counterRef.current;
-    }
-    const nextIndex = counterRef.current;
-    counterRef.current += 1;
-    return nextIndex;
-  }, []);
+  const getNextIndex = useCallback(
+    (skip: boolean) => {
+      if (skip) {
+        return baseIndex + counterRef.current;
+      }
+      const nextIndex = counterRef.current;
+      counterRef.current += 1;
+      return baseIndex + nextIndex;
+    },
+    [baseIndex],
+  );
 
   const resetCounter = useCallback(() => {
     counterRef.current = 0;
diff --git a/client/src/a11y/LiveMessage.tsx b/client/src/a11y/LiveMessage.tsx
index b773deae53d..b25b48f1080 100644
--- a/client/src/a11y/LiveMessage.tsx
+++ b/client/src/a11y/LiveMessage.tsx
@@ -16,17 +16,17 @@ const LiveMessage: React.FC<LiveMessageProps> = ({
 
   useEffect(() => {
     if (ariaLive === 'assertive') {
-      announceAssertive(message);
+      announceAssertive({ message });
     } else if (ariaLive === 'polite') {
-      announcePolite(message);
+      announcePolite({ message });
     }
   }, [message, ariaLive, announceAssertive, announcePolite]);
 
   useEffect(() => {
     return () => {
       if (clearOnUnmount === true || clearOnUnmount === 'true') {
-        announceAssertive('');
-        announcePolite('');
+        announceAssertive({ message: '' });
+        announcePolite({ message: '' });
       }
     };
   }, [clearOnUnmount, announceAssertive, announcePolite]);
diff --git a/client/src/common/selector.ts b/client/src/common/selector.ts
index af69ca4af50..002755d114d 100644
--- a/client/src/common/selector.ts
+++ b/client/src/common/selector.ts
@@ -10,6 +10,8 @@ export interface Endpoint {
   agentNames?: Record<string, string>;
   assistantNames?: Record<string, string>;
   modelIcons?: Record<string, string | undefined>;
+  showMarketplace?: boolean;
+  searchAliases?: string[];
 }
 
 export interface SelectedValues {
diff --git a/client/src/common/types.ts b/client/src/common/types.ts
index 7be7bef749a..9cdebffd2bf 100644
--- a/client/src/common/types.ts
+++ b/client/src/common/types.ts
@@ -351,6 +351,12 @@ export type TOptions = {
   isResubmission?: boolean;
   /** Currently only utilized when `isResubmission === true`, uses that message's currently attached files */
   overrideFiles?: t.TMessage['files'];
+  /**
+   * Assistant message being regenerated. Used to derive the optimistic response
+   * id for non-tail regenerations without accidentally keying the stream to the
+   * conversation tail.
+   */
+  targetResponseMessageId?: string | null;
   /**
    * Carry forward a user message's manually-invoked skills when the caller
    * is resubmitting / regenerating that same message — the compose-time
@@ -363,7 +369,7 @@ export type TOptions = {
   addedConvo?: t.TConversation;
 };
 
-export type TAskFunction = (props: TAskProps, options?: TOptions) => void;
+export type TAskFunction = (props: TAskProps, options?: TOptions) => false | void;
 
 /**
  * Stable context object passed from non-memo'd wrapper components (Message, MessageContent)
@@ -652,5 +658,8 @@ export type TThread = { id: string; createdAt: string };
 declare global {
   interface Window {
     google_tag_manager?: unknown;
+    __LIBRECHAT_CONFIG__?: {
+      enableQueryDevtools?: boolean;
+    };
   }
 }
diff --git a/client/src/components/Agents/Marketplace.tsx b/client/src/components/Agents/Marketplace.tsx
index adf406f7b06..1e534dbf85b 100644
--- a/client/src/components/Agents/Marketplace.tsx
+++ b/client/src/components/Agents/Marketplace.tsx
@@ -218,17 +218,17 @@ const AgentMarketplace: React.FC<AgentMarketplaceProps> = ({ className = '' }) =
             {/* Sticky wrapper for search bar and categories */}
             <div className="sticky top-0 z-10 mt-4 bg-presentation pb-4 md:mt-0">
               <div className="container mx-auto max-w-4xl px-4">
-                <div className="mx-auto mb-3 flex max-w-2xl items-center justify-between gap-2 md:hidden">
-                  <OpenSidebar />
-                  <MarketplaceAdminSettings compact />
-                </div>
+                {isSmallScreen ? (
+                  <div className="mx-auto mb-3 flex max-w-2xl items-center justify-between gap-2">
+                    <OpenSidebar />
+                    <MarketplaceAdminSettings compact />
+                  </div>
+                ) : null}
                 {/* Search bar */}
                 <div className="mx-auto flex max-w-2xl gap-2 pb-6">
                   <SearchBar value={searchQuery} onSearch={handleSearch} />
                   {/* TODO: Remove this once we have a better way to handle admin settings */}
-                  <div className="hidden md:block">
-                    <MarketplaceAdminSettings />
-                  </div>
+                  {!isSmallScreen && <MarketplaceAdminSettings />}
                 </div>
 
                 {/* Category tabs */}
diff --git a/client/src/components/Agents/VirtualizedAgentGrid.tsx b/client/src/components/Agents/VirtualizedAgentGrid.tsx
index 0fed2c19744..a2843c5b20b 100644
--- a/client/src/components/Agents/VirtualizedAgentGrid.tsx
+++ b/client/src/components/Agents/VirtualizedAgentGrid.tsx
@@ -1,8 +1,8 @@
 import React, { useMemo, useEffect, useCallback, useRef } from 'react';
-import { AutoSizer, List as VirtualList, WindowScroller } from 'react-virtualized';
 import { throttle } from 'lodash';
 import { Spinner } from '@librechat/client';
 import { PermissionBits } from 'librechat-data-provider';
+import { AutoSizer, List as VirtualList, WindowScroller } from 'react-virtualized';
 import type t from 'librechat-data-provider';
 import { useMarketplaceAgentsInfiniteQuery } from '~/data-provider/Agents';
 import { useAgentCategories, useLocalize } from '~/hooks';
@@ -175,7 +175,7 @@ const VirtualizedAgentGrid: React.FC<VirtualizedAgentGridProps> = ({
               const globalIndex = index * cardsPerRow + cardIndex;
               return (
                 <div key={`${agent.id}-${globalIndex}`} role="gridcell">
-                  <AgentCard agent={agent} onClick={() => onSelectAgent(agent)} />
+                  <AgentCard agent={agent} onSelect={onSelectAgent} />
                 </div>
               );
             })}
@@ -282,7 +282,7 @@ const VirtualizedAgentGrid: React.FC<VirtualizedAgentGridProps> = ({
                   const rowCount = getRowCount(currentAgents.length, cardsPerRow);
 
                   return (
-                    <div ref={registerChild}>
+                    <div ref={registerChild as React.LegacyRef<HTMLDivElement>}>
                       <VirtualList
                         ref={listRef}
                         autoHeight
diff --git a/client/src/components/Agents/tests/ErrorDisplay.spec.tsx b/client/src/components/Agents/tests/ErrorDisplay.spec.tsx
index 303308cefc3..f0552669b4e 100644
--- a/client/src/components/Agents/tests/ErrorDisplay.spec.tsx
+++ b/client/src/components/Agents/tests/ErrorDisplay.spec.tsx
@@ -272,7 +272,7 @@ describe('ErrorDisplay', () => {
     });
 
     it('handles null/undefined errors', () => {
-      render(<ErrorDisplay error={null} />);
+      render(<ErrorDisplay error={{}} />);
 
       expect(screen.getByText('Something went wrong')).toBeInTheDocument();
       expect(
diff --git a/client/src/components/Agents/tests/VirtualScrollingPerformance.test.tsx b/client/src/components/Agents/tests/VirtualScrollingPerformance.test.tsx
index 43a5be20d5e..198ba4271fd 100644
--- a/client/src/components/Agents/tests/VirtualScrollingPerformance.test.tsx
+++ b/client/src/components/Agents/tests/VirtualScrollingPerformance.test.tsx
@@ -1,7 +1,6 @@
 import React from 'react';
 import { render, screen } from '@testing-library/react';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
-import { jest } from '@jest/globals';
 import type * as t from 'librechat-data-provider';
 import VirtualizedAgentGrid from '../VirtualizedAgentGrid';
 
@@ -48,7 +47,9 @@ const mockRowRenderer = jest.fn();
 
 jest.mock('react-virtualized', () => {
   const ReactActual = jest.requireActual<typeof import('react')>('react');
-  const mockRowRendererRef = { current: jest.fn() };
+  const mockRowRendererRef: { current: VirtualListMockProps['rowRenderer'] | null } = {
+    current: null,
+  };
 
   return {
     AutoSizer: ({
diff --git a/client/src/components/Agents/tests/VirtualizedAgentGrid.test.tsx b/client/src/components/Agents/tests/VirtualizedAgentGrid.test.tsx
index 9fb6c402094..2aed774e819 100644
--- a/client/src/components/Agents/tests/VirtualizedAgentGrid.test.tsx
+++ b/client/src/components/Agents/tests/VirtualizedAgentGrid.test.tsx
@@ -1,7 +1,6 @@
 import React from 'react';
 import { render, screen } from '@testing-library/react';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
-import { jest } from '@jest/globals';
 import type t from 'librechat-data-provider';
 import VirtualizedAgentGrid from '../VirtualizedAgentGrid';
 
@@ -166,9 +165,15 @@ jest.mock('../SmartLoader', () => ({
 }));
 
 jest.mock('../AgentCard', () => {
-  return function MockAgentCard({ agent, onClick }: { agent: t.Agent; onClick: () => void }) {
+  return function MockAgentCard({
+    agent,
+    onSelect,
+  }: {
+    agent: t.Agent;
+    onSelect: (agent: t.Agent) => void;
+  }) {
     return (
-      <div data-testid={`agent-card-${agent.id}`} onClick={onClick}>
+      <div data-testid={`agent-card-${agent.id}`} onClick={() => onSelect(agent)}>
         <h3>{agent.name}</h3>
         <p>{agent.description}</p>
       </div>
diff --git a/client/src/components/Artifacts/Mermaid.tsx b/client/src/components/Artifacts/Mermaid.tsx
deleted file mode 100644
index 9d54285cb61..00000000000
--- a/client/src/components/Artifacts/Mermaid.tsx
+++ /dev/null
@@ -1,176 +0,0 @@
-import React, { useEffect, useRef, useState, useCallback } from 'react';
-import { Button } from '@librechat/client';
-import { ZoomIn, ZoomOut, RotateCcw } from 'lucide-react';
-import { TransformWrapper, TransformComponent } from 'react-zoom-pan-pinch';
-import type { ReactZoomPanPinchRef } from 'react-zoom-pan-pinch';
-import { artifactFlowchartConfig } from '~/utils/mermaid';
-
-interface MermaidDiagramProps {
-  content: string;
-  isDarkMode?: boolean;
-}
-
-let mermaidPromise: Promise<typeof import('mermaid').default> | null = null;
-
-const loadMermaid = () => {
-  if (!mermaidPromise) {
-    mermaidPromise = import('mermaid').then((mod) => mod.default);
-  }
-
-  return mermaidPromise;
-};
-
-const MermaidDiagram: React.FC<MermaidDiagramProps> = ({ content, isDarkMode = true }) => {
-  const mermaidRef = useRef<HTMLDivElement>(null);
-  const transformRef = useRef<ReactZoomPanPinchRef>(null);
-  const [isRendered, setIsRendered] = useState(false);
-  const theme = isDarkMode ? 'dark' : 'neutral';
-  const bgColor = isDarkMode ? '#212121' : '#FFFFFF';
-
-  useEffect(() => {
-    let isMounted = true;
-
-    const renderDiagram = async () => {
-      try {
-        const mermaid = await loadMermaid();
-
-        mermaid.initialize({
-          startOnLoad: false,
-          theme,
-          securityLevel: 'sandbox',
-          flowchart: artifactFlowchartConfig,
-        });
-
-        if (!mermaidRef.current) {
-          return;
-        }
-
-        const { svg } = await mermaid.render('mermaid-diagram', content);
-        mermaidRef.current.innerHTML = svg;
-
-        const svgElement = mermaidRef.current.querySelector('svg');
-        if (svgElement) {
-          svgElement.style.width = '100%';
-          svgElement.style.height = '100%';
-        }
-        if (isMounted) {
-          setIsRendered(true);
-        }
-      } catch (error) {
-        console.error('Mermaid rendering error:', error);
-        if (mermaidRef.current) {
-          mermaidRef.current.innerHTML = 'Error rendering diagram';
-        }
-      }
-    };
-
-    renderDiagram();
-
-    return () => {
-      isMounted = false;
-    };
-  }, [content, theme]);
-
-  const centerAndFitDiagram = useCallback(() => {
-    if (transformRef.current && mermaidRef.current) {
-      const { centerView, zoomToElement } = transformRef.current;
-      zoomToElement(mermaidRef.current as HTMLElement);
-      centerView(1, 0);
-    }
-  }, []);
-
-  useEffect(() => {
-    if (isRendered) {
-      centerAndFitDiagram();
-    }
-  }, [isRendered, centerAndFitDiagram]);
-
-  const handlePanning = useCallback(() => {
-    if (!transformRef.current) {
-      return;
-    }
-
-    const { state, instance } = transformRef.current;
-    if (!state || !instance) {
-      return;
-    }
-    const { scale, positionX, positionY } = state;
-    const { wrapperComponent, contentComponent } = instance;
-
-    if (!wrapperComponent || !contentComponent) {
-      return;
-    }
-
-    const wrapperRect = wrapperComponent.getBoundingClientRect();
-    const contentRect = contentComponent.getBoundingClientRect();
-    const maxX = wrapperRect.width - contentRect.width * scale;
-    const maxY = wrapperRect.height - contentRect.height * scale;
-
-    let newX = positionX;
-    let newY = positionY;
-
-    if (newX > 0) {
-      newX = 0;
-    }
-    if (newY > 0) {
-      newY = 0;
-    }
-    if (newX < maxX) {
-      newX = maxX;
-    }
-    if (newY < maxY) {
-      newY = maxY;
-    }
-
-    if (newX !== positionX || newY !== positionY) {
-      instance.setTransformState(scale, newX, newY);
-    }
-  }, []);
-
-  return (
-    <div
-      className="relative h-screen w-screen cursor-move p-5"
-      style={{ backgroundColor: bgColor }}
-    >
-      <TransformWrapper
-        ref={transformRef}
-        initialScale={1}
-        minScale={0.1}
-        maxScale={10}
-        limitToBounds={false}
-        centerOnInit={true}
-        initialPositionY={0}
-        wheel={{ step: 0.1 }}
-        panning={{ velocityDisabled: true }}
-        alignmentAnimation={{ disabled: true }}
-        onPanning={handlePanning}
-      >
-        {({ zoomIn, zoomOut }) => (
-          <>
-            <TransformComponent
-              wrapperStyle={{ width: '100%', height: '100%', overflow: 'hidden' }}
-            >
-              <div
-                ref={mermaidRef}
-                style={{ width: 'auto', height: 'auto', minWidth: '100%', minHeight: '100%' }}
-              />
-            </TransformComponent>
-            <div className="absolute bottom-2 right-2 flex space-x-2">
-              <Button onClick={() => zoomIn(0.1)} variant="outline" size="icon">
-                <ZoomIn className="h-4 w-4" />
-              </Button>
-              <Button onClick={() => zoomOut(0.1)} variant="outline" size="icon">
-                <ZoomOut className="h-4 w-4" />
-              </Button>
-              <Button onClick={centerAndFitDiagram} variant="outline" size="icon">
-                <RotateCcw className="h-4 w-4" />
-              </Button>
-            </div>
-          </>
-        )}
-      </TransformWrapper>
-    </div>
-  );
-};
-
-export default MermaidDiagram;
diff --git a/client/src/components/Auth/__tests__/Login.spec.tsx b/client/src/components/Auth/__tests__/Login.spec.tsx
index 3937deb6242..f01c12d2cfe 100644
--- a/client/src/components/Auth/__tests__/Login.spec.tsx
+++ b/client/src/components/Auth/__tests__/Login.spec.tsx
@@ -1,7 +1,7 @@
 import reactRouter from 'react-router-dom';
 import userEvent from '@testing-library/user-event';
-import { getByTestId, render, waitFor } from 'test/layout-test-utils';
 import type { TStartupConfig } from 'librechat-data-provider';
+import { getByTestId, render, waitFor } from 'test/layout-test-utils';
 import * as endpointQueries from '~/data-provider/Endpoints/queries';
 import * as miscDataProvider from '~/data-provider/Misc/queries';
 import * as authMutations from '~/data-provider/Auth/mutations';
@@ -176,7 +176,7 @@ test('calls loginUser.mutate on login', async () => {
 });
 
 test('Navigates to / on successful login', async () => {
-  const { getByLabelText, history } = setup({
+  const { getByLabelText } = setup({
     // @ts-ignore - we don't need all parameters of the QueryObserverResult
     useLoginUserReturnValue: {
       isLoading: false,
@@ -202,5 +202,5 @@ test('Navigates to / on successful login', async () => {
   await userEvent.type(passwordInput, 'password');
   await userEvent.click(submitButton);
 
-  waitFor(() => expect(history.location.pathname).toBe('/'));
+  waitFor(() => expect(window.location.pathname).toBe('/'));
 });
diff --git a/client/src/components/Auth/__tests__/LoginForm.spec.tsx b/client/src/components/Auth/__tests__/LoginForm.spec.tsx
index f6376d166d1..14692befaad 100644
--- a/client/src/components/Auth/__tests__/LoginForm.spec.tsx
+++ b/client/src/components/Auth/__tests__/LoginForm.spec.tsx
@@ -1,9 +1,9 @@
-import { render, getByTestId } from 'test/layout-test-utils';
 import userEvent from '@testing-library/user-event';
 import type { TStartupConfig } from 'librechat-data-provider';
 import * as endpointQueries from '~/data-provider/Endpoints/queries';
 import * as miscDataProvider from '~/data-provider/Misc/queries';
 import * as authMutations from '~/data-provider/Auth/mutations';
+import { render, getByTestId } from 'test/layout-test-utils';
 import * as authQueries from '~/data-provider/Auth/queries';
 import Login from '../LoginForm';
 
@@ -18,8 +18,10 @@ const mockStartupConfig: TStartupConfig = {
   githubLoginEnabled: true,
   googleLoginEnabled: true,
   openidLoginEnabled: true,
+  appleLoginEnabled: false,
   openidLabel: 'Test OpenID',
   openidImageUrl: 'http://test-server.com',
+  openidAutoRedirect: false,
   samlLoginEnabled: true,
   samlLabel: 'Test SAML',
   samlImageUrl: 'http://test-server.com',
@@ -33,9 +35,11 @@ const mockStartupConfig: TStartupConfig = {
     enabled: false,
   },
   emailEnabled: false,
-  checkBalance: false,
   showBirthdayIcon: false,
   helpAndFaqURL: '',
+  sharedLinksEnabled: true,
+  publicSharedLinksEnabled: true,
+  allowAccountDeletion: true,
 };
 
 const setup = ({
@@ -106,15 +110,25 @@ beforeEach(() => {
 
 test('renders login form', () => {
   const { getByLabelText } = render(
-    <Login onSubmit={mockLogin} startupConfig={mockStartupConfig} />,
+    <Login
+      onSubmit={mockLogin}
+      startupConfig={mockStartupConfig}
+      error={undefined}
+      setError={jest.fn()}
+    />,
   );
   expect(getByLabelText(/email/i)).toBeInTheDocument();
   expect(getByLabelText(/password/i)).toBeInTheDocument();
 });
 
 test('submits login form', async () => {
-  const { getByLabelText, getByRole } = render(
-    <Login onSubmit={mockLogin} startupConfig={mockStartupConfig} />,
+  const { getByLabelText } = render(
+    <Login
+      onSubmit={mockLogin}
+      startupConfig={mockStartupConfig}
+      error={undefined}
+      setError={jest.fn()}
+    />,
   );
   const emailInput = getByLabelText(/email/i);
   const passwordInput = getByLabelText(/password/i);
@@ -128,8 +142,13 @@ test('submits login form', async () => {
 });
 
 test('displays validation error messages', async () => {
-  const { getByLabelText, getByRole, getByText } = render(
-    <Login onSubmit={mockLogin} startupConfig={mockStartupConfig} />,
+  const { getByLabelText, getByText } = render(
+    <Login
+      onSubmit={mockLogin}
+      startupConfig={mockStartupConfig}
+      error={undefined}
+      setError={jest.fn()}
+    />,
   );
   const emailInput = getByLabelText(/email/i);
   const passwordInput = getByLabelText(/password/i);
diff --git a/client/src/components/Chat/ChatView.tsx b/client/src/components/Chat/ChatView.tsx
index 27530a5c228..1c84b93b82a 100644
--- a/client/src/components/Chat/ChatView.tsx
+++ b/client/src/components/Chat/ChatView.tsx
@@ -4,12 +4,19 @@ import { useForm } from 'react-hook-form';
 import { Spinner } from '@librechat/client';
 import { useParams } from 'react-router-dom';
 import { Constants, buildTree } from 'librechat-data-provider';
-import type { TMessage } from 'librechat-data-provider';
+import type { TChatProject, TMessage } from 'librechat-data-provider';
 import type { ChatFormValues } from '~/common';
+import {
+  useAddedResponse,
+  useResumeOnLoad,
+  useAdaptiveSSE,
+  useChatHelpers,
+  useLocalize,
+} from '~/hooks';
 import { ChatContext, AddedChatContext, ChatFormProvider, useFileMapContext } from '~/Providers';
-import { useAddedResponse, useResumeOnLoad, useAdaptiveSSE, useChatHelpers } from '~/hooks';
 import ConversationStarters from './Input/ConversationStarters';
 import { useGetMessagesByConvoId } from '~/data-provider';
+import ProjectLandingChip from './ProjectLandingChip';
 import MessagesView from './Messages/MessagesView';
 import Presentation from './Presentation';
 import ChatForm from './Input/ChatForm';
@@ -29,8 +36,9 @@ function LoadingSpinner() {
   );
 }
 
-function ChatView({ index = 0 }: { index?: number }) {
+function ChatView({ index = 0, project }: { index?: number; project?: TChatProject }) {
   const { conversationId } = useParams();
+  const localize = useLocalize();
   const rootSubmission = useRecoilValue(store.submissionByIndex(index));
   const isSubmitting = useRecoilValue(store.isSubmittingFamily(index));
   const centerFormOnLanding = useRecoilValue(store.centerFormOnLanding);
@@ -70,6 +78,7 @@ function ChatView({ index = 0 }: { index?: number }) {
     (!messagesTree || messagesTree.length === 0) &&
     (conversationId === Constants.NEW_CONVO || !conversationId);
   const isNavigating = (!messagesTree || messagesTree.length === 0) && conversationId != null;
+  const isProjectLandingPage = isLandingPage && project != null;
 
   if (isLoading && conversationId !== Constants.NEW_CONVO) {
     content = <LoadingSpinner />;
@@ -81,6 +90,11 @@ function ChatView({ index = 0 }: { index?: number }) {
     content = <Landing centerFormOnLanding={centerFormOnLanding} />;
   }
 
+  const chatFormPlaceholder =
+    isProjectLandingPage && project
+      ? localize('com_ui_new_chat_in_project', { name: project.name })
+      : undefined;
+
   return (
     <ChatFormProvider {...methods}>
       <ChatContext.Provider value={chatHelpers}>
@@ -104,8 +118,10 @@ function ChatView({ index = 0 }: { index?: number }) {
                       isLandingPage && 'max-w-3xl transition-all duration-200 xl:max-w-4xl',
                     )}
                   >
-                    <ChatForm index={index} />
-                    {isLandingPage ? <ConversationStarters /> : <Footer />}
+                    {isProjectLandingPage && project && <ProjectLandingChip project={project} />}
+                    {isLandingPage && <ConversationStarters />}
+                    <ChatForm index={index} placeholder={chatFormPlaceholder} />
+                    {!isLandingPage && <Footer />}
                   </div>
                 </div>
                 {isLandingPage && <Footer />}
diff --git a/client/src/components/Chat/ExportAndShareMenu.tsx b/client/src/components/Chat/ExportAndShareMenu.tsx
index 739f2c497b6..5dcbe9ea139 100644
--- a/client/src/components/Chat/ExportAndShareMenu.tsx
+++ b/client/src/components/Chat/ExportAndShareMenu.tsx
@@ -2,11 +2,12 @@ import { useState, useId, useRef } from 'react';
 import { useRecoilValue } from 'recoil';
 import * as Ariakit from '@ariakit/react';
 import { Upload, Share2 } from 'lucide-react';
+import { PermissionTypes, Permissions } from 'librechat-data-provider';
 import { DropdownPopup, TooltipAnchor, useMediaQuery } from '@librechat/client';
 import type * as t from '~/common';
 import ExportModal from '~/components/Nav/ExportConversation/ExportModal';
 import { ShareButton } from '~/components/Conversations/ConvoOptions';
-import { useLocalize } from '~/hooks';
+import { useHasAccess, useLocalize } from '~/hooks';
 import store from '~/store';
 
 export default function ExportAndShareMenu({
@@ -22,6 +23,10 @@ export default function ExportAndShareMenu({
   const menuId = useId();
   const shareButtonRef = useRef<HTMLButtonElement>(null);
   const exportButtonRef = useRef<HTMLButtonElement>(null);
+  const canCreateSharedLinks = useHasAccess({
+    permissionType: PermissionTypes.SHARED_LINKS,
+    permission: Permissions.CREATE,
+  });
   const isSmallScreen = useMediaQuery('(max-width: 768px)');
   const conversation = useRecoilValue(store.conversationByIndex(0));
 
@@ -48,11 +53,11 @@ export default function ExportAndShareMenu({
       label: localize('com_ui_share'),
       onClick: shareHandler,
       icon: <Share2 className="icon-md mr-2 text-text-secondary" />,
-      show: isSharedButtonEnabled,
+      show: isSharedButtonEnabled && canCreateSharedLinks,
       /** NOTE: THE FOLLOWING PROPS ARE REQUIRED FOR MENU ITEMS THAT OPEN DIALOGS */
       hideOnClick: false,
       ref: shareButtonRef,
-      render: (props) => <button {...props} />,
+      render: (props) => <button {...props} data-testid="share-conversation-menu-item" />,
     },
     {
       label: localize('com_endpoint_export'),
diff --git a/client/src/components/Chat/Header.tsx b/client/src/components/Chat/Header.tsx
index 31ff30ffce5..fc3e4e750ef 100644
--- a/client/src/components/Chat/Header.tsx
+++ b/client/src/components/Chat/Header.tsx
@@ -45,7 +45,7 @@ function Header() {
     <div className="via-presentation/70 md:from-presentation/80 md:via-presentation/50 2xl:from-presentation/0 absolute top-0 z-10 flex h-[52px] w-full items-center justify-between bg-gradient-to-b from-presentation to-transparent p-2 font-semibold text-text-primary 2xl:via-transparent">
       <div className="hide-scrollbar flex w-full items-center justify-between gap-2 overflow-x-auto">
         <div className="mx-1 flex items-center">
-          <OpenSidebar className="md:hidden" />
+          {isSmallScreen ? <OpenSidebar /> : null}
           {!(navVisible && isSmallScreen) && (
             <div
               className={cn(
diff --git a/client/src/components/Chat/Input/AddedConvo.tsx b/client/src/components/Chat/Input/AddedConvo.tsx
index 63152693ce0..764612ec90c 100644
--- a/client/src/components/Chat/Input/AddedConvo.tsx
+++ b/client/src/components/Chat/Input/AddedConvo.tsx
@@ -41,6 +41,7 @@ export default function AddedConvo({
           <EndpointIcon
             conversation={addedConvo}
             endpointsConfig={endpointsConfig}
+            agentsMap={agentsMap}
             containerClassName="shadow-stroke overflow-hidden rounded-full"
             context="menu-item"
             size={20}
diff --git a/client/src/components/Chat/Input/AudioRecorder.tsx b/client/src/components/Chat/Input/AudioRecorder.tsx
index e9e19d09047..3eaefcdcc87 100644
--- a/client/src/components/Chat/Input/AudioRecorder.tsx
+++ b/client/src/components/Chat/Input/AudioRecorder.tsx
@@ -2,8 +2,8 @@ import { memo, useCallback, useRef } from 'react';
 import { MicOff } from 'lucide-react';
 import { useToastContext, TooltipAnchor, ListeningIcon, Spinner } from '@librechat/client';
 import { useLocalize, useSpeechToText, useGetAudioSettings } from '~/hooks';
+import { globalAudioId, type TAskFunction } from '~/common';
 import { useChatFormContext } from '~/Providers';
-import { globalAudioId } from '~/common';
 import { cn } from '~/utils';
 
 const isExternalSTT = (speechToTextEndpoint: string) => speechToTextEndpoint === 'external';
@@ -11,13 +11,11 @@ export default memo(function AudioRecorder({
   disabled,
   ask,
   methods,
-  textAreaRef,
   isSubmitting,
 }: {
   disabled: boolean;
-  ask: (data: { text: string }) => void;
+  ask: TAskFunction;
   methods: ReturnType<typeof useChatFormContext>;
-  textAreaRef: React.RefObject<HTMLTextAreaElement>;
   isSubmitting: boolean;
 }) {
   const { setValue, reset, getValues } = methods;
@@ -49,7 +47,10 @@ export default memo(function AudioRecorder({
           isExternalSTT(speechToTextEndpoint) && existingTextRef.current
             ? `${existingTextRef.current} ${text}`
             : text;
-        ask({ text: finalText });
+        const submitted = ask({ text: finalText });
+        if (submitted === false) {
+          return;
+        }
         reset({ text: '' });
         existingTextRef.current = '';
       }
@@ -79,10 +80,6 @@ export default memo(function AudioRecorder({
     onTranscriptionComplete,
   );
 
-  if (!textAreaRef.current) {
-    return null;
-  }
-
   const handleStartRecording = async () => {
     existingTextRef.current = getValues('text') || '';
     startRecording();
diff --git a/client/src/components/Chat/Input/ChatForm.tsx b/client/src/components/Chat/Input/ChatForm.tsx
index 884a9251c42..baed7ba4a22 100644
--- a/client/src/components/Chat/Input/ChatForm.tsx
+++ b/client/src/components/Chat/Input/ChatForm.tsx
@@ -5,12 +5,6 @@ import { useRecoilState, useRecoilValue } from 'recoil';
 import { Constants, isAssistantsEndpoint, isAgentsEndpoint } from 'librechat-data-provider';
 import type { TConversation } from 'librechat-data-provider';
 import type { ExtendedFile, FileSetter, ConvoGenerator } from '~/common';
-import {
-  useChatContext,
-  useChatFormContext,
-  useAddedChatContext,
-  useAssistantsMapContext,
-} from '~/Providers';
 import {
   useTextarea,
   useAutoSave,
@@ -21,6 +15,12 @@ import {
   useSubmitMessage,
   useFocusChatEffect,
 } from '~/hooks';
+import {
+  useChatContext,
+  useChatFormContext,
+  useAddedChatContext,
+  useAssistantsMapContext,
+} from '~/Providers';
 import PendingManualSkillsChips from './PendingManualSkillsChips';
 import { cn, getModelSpec, removeFocusRings } from '~/utils';
 import { useGetStartupConfig } from '~/data-provider';
@@ -28,11 +28,12 @@ import { mainTextareaId, BadgeItem } from '~/common';
 import AttachFileChat from './Files/AttachFileChat';
 import FileFormChat from './Files/FileFormChat';
 import TextareaHeader from './TextareaHeader';
-import SkillsCommand from './SkillsCommand';
 import PromptsCommand from './PromptsCommand';
+import SkillsCommand from './SkillsCommand';
 import AudioRecorder from './AudioRecorder';
 import CollapseChat from './CollapseChat';
 import StreamAudio from './StreamAudio';
+import TokenUsage from './TokenUsage';
 import StopButton from './StopButton';
 import SendButton from './SendButton';
 import EditBadges from './EditBadges';
@@ -42,6 +43,7 @@ import store from '~/store';
 
 interface ChatFormProps {
   index: number;
+  placeholder?: string;
   /** From ChatContext — individual values so memo can compare them */
   files: Map<string, ExtendedFile>;
   setFiles: FileSetter;
@@ -55,6 +57,7 @@ interface ChatFormProps {
 
 const ChatForm = memo(function ChatForm({
   index,
+  placeholder,
   files,
   setFiles,
   conversation,
@@ -177,6 +180,7 @@ const ChatForm = memo(function ChatForm({
     submitButtonRef,
     setIsScrollable,
     disabled: disableInputs,
+    placeholder,
   });
 
   useQueryParams({ textAreaRef });
@@ -376,11 +380,11 @@ const ChatForm = memo(function ChatForm({
                 }
               />
               <div className="mx-auto flex" />
+              <TokenUsage index={index} conversation={conversation} isSubmitting={isSubmitting} />
               {SpeechToText && (
                 <AudioRecorder
                   methods={methods}
                   ask={submitMessage}
-                  textAreaRef={textAreaRef}
                   disabled={disableInputs || isNotAppendable}
                   isSubmitting={isSubmitting}
                 />
@@ -413,7 +417,7 @@ ChatForm.displayName = 'ChatForm';
  * to the memo'd ChatForm. This prevents ChatForm from re-rendering on every
  * streaming chunk — it only re-renders when the specific values it uses change.
  */
-function ChatFormWrapper({ index = 0 }: { index?: number }) {
+function ChatFormWrapper({ index = 0, placeholder }: { index?: number; placeholder?: string }) {
   const {
     files,
     setFiles,
@@ -442,6 +446,7 @@ function ChatFormWrapper({ index = 0 }: { index?: number }) {
       conversation?.spec,
       conversation?.useResponsesApi,
       conversation?.model,
+      conversation?.maxContextTokens,
       hasMessages,
     ],
   );
@@ -465,6 +470,7 @@ function ChatFormWrapper({ index = 0 }: { index?: number }) {
   return (
     <ChatForm
       index={index}
+      placeholder={placeholder}
       files={files}
       setFiles={setFiles}
       conversation={stableConversation}
diff --git a/client/src/components/Chat/Input/CircleRender.tsx b/client/src/components/Chat/Input/CircleRender.tsx
deleted file mode 100644
index 5b46f657448..00000000000
--- a/client/src/components/Chat/Input/CircleRender.tsx
+++ /dev/null
@@ -1,36 +0,0 @@
-import React from 'react';
-import { ECallState } from 'librechat-data-provider';
-import { CircleIcon, CircleDotsIcon } from '@librechat/client';
-
-const CircleRender = ({ rmsLevel, isCameraOn, state }) => {
-  const getIconComponent = (state) => {
-    switch (state) {
-      case ECallState.Thinking:
-        return <CircleDotsIcon />;
-      default:
-        return (
-          <div className="smooth-transition" style={{ transform: `scale(${transformScale})` }}>
-            <CircleIcon state={state} size="256" />
-          </div>
-        );
-    }
-  };
-
-  const baseScale = isCameraOn ? 0.5 : 1;
-  const scaleMultiplier =
-    rmsLevel > 0.08
-      ? 1.8
-      : rmsLevel > 0.07
-        ? 1.6
-        : rmsLevel > 0.05
-          ? 1.4
-          : rmsLevel > 0.01
-            ? 1.2
-            : 1;
-
-  const transformScale = baseScale * scaleMultiplier;
-
-  return getIconComponent(state);
-};
-
-export default CircleRender;
diff --git a/client/src/components/Chat/Input/ConversationStarters.tsx b/client/src/components/Chat/Input/ConversationStarters.tsx
index bd78f4b2b43..ea9549e1808 100644
--- a/client/src/components/Chat/Input/ConversationStarters.tsx
+++ b/client/src/components/Chat/Input/ConversationStarters.tsx
@@ -1,8 +1,12 @@
 import { useMemo, useCallback } from 'react';
 import { EModelEndpoint, Constants } from 'librechat-data-provider';
+import {
+  useGetAssistantDocsQuery,
+  useGetEndpointsQuery,
+  useGetStartupConfig,
+} from '~/data-provider';
 import { useChatContext, useAgentsMapContext, useAssistantsMapContext } from '~/Providers';
-import { useGetAssistantDocsQuery, useGetEndpointsQuery } from '~/data-provider';
-import { getIconEndpoint, getEntity } from '~/utils';
+import { getIconEndpoint, getEntity, getModelSpec } from '~/utils';
 import { useSubmitMessage } from '~/hooks';
 
 const ConversationStarters = () => {
@@ -10,6 +14,7 @@ const ConversationStarters = () => {
   const agentsMap = useAgentsMapContext();
   const assistantMap = useAssistantsMapContext();
   const { data: endpointsConfig } = useGetEndpointsQuery();
+  const { data: startupConfig } = useGetStartupConfig();
 
   const endpointType = useMemo(() => {
     let ep = conversation?.endpoint ?? '';
@@ -35,17 +40,26 @@ const ConversationStarters = () => {
     assistant_id: conversation?.assistant_id,
   });
 
+  const modelSpec = useMemo(
+    () => getModelSpec({ specName: conversation?.spec, startupConfig }),
+    [conversation?.spec, startupConfig],
+  );
+
   const conversation_starters = useMemo(() => {
     if (entity?.conversation_starters?.length) {
       return entity.conversation_starters;
     }
 
+    if (modelSpec?.conversation_starters?.length) {
+      return modelSpec.conversation_starters;
+    }
+
     if (isAgent) {
       return [];
     }
 
     return documentsMap.get(entity?.id ?? '')?.conversation_starters ?? [];
-  }, [documentsMap, isAgent, entity]);
+  }, [documentsMap, isAgent, entity, modelSpec]);
 
   const { submitMessage } = useSubmitMessage();
   const sendConversationStarter = useCallback(
@@ -58,18 +72,17 @@ const ConversationStarters = () => {
   }
 
   return (
-    <div className="mt-8 flex flex-wrap justify-center gap-3 px-4">
+    <div className="mb-8 mt-2 flex w-full flex-wrap items-stretch justify-center gap-2 px-4">
       {conversation_starters
         .slice(0, Constants.MAX_CONVO_STARTERS)
         .map((text: string, index: number) => (
           <button
             key={index}
             onClick={() => sendConversationStarter(text)}
-            className="relative flex w-40 cursor-pointer flex-col gap-2 rounded-2xl border border-border-medium px-3 pb-4 pt-3 text-start align-top text-[15px] shadow-[0_0_2px_0_rgba(0,0,0,0.05),0_4px_6px_0_rgba(0,0,0,0.02)] transition-colors duration-300 ease-in-out fade-in hover:bg-surface-tertiary"
+            style={{ animationDelay: `${index * 75}ms`, animationFillMode: 'backwards' }}
+            className="flex max-w-[16rem] cursor-pointer items-center justify-center rounded-2xl border border-border-medium bg-surface-secondary px-4 py-2.5 text-center text-sm text-text-secondary shadow-sm transition-colors duration-200 fade-in hover:border-border-heavy hover:bg-surface-tertiary hover:text-text-primary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring-primary"
           >
-            <p className="break-word line-clamp-3 overflow-hidden text-balance break-all text-text-secondary">
-              {text}
-            </p>
+            <span className="line-clamp-2 text-balance break-words">{text}</span>
           </button>
         ))}
     </div>
diff --git a/client/src/components/Chat/Input/TokenUsage/Breakdown.tsx b/client/src/components/Chat/Input/TokenUsage/Breakdown.tsx
new file mode 100644
index 00000000000..f8c479b68a3
--- /dev/null
+++ b/client/src/components/Chat/Input/TokenUsage/Breakdown.tsx
@@ -0,0 +1,202 @@
+import type { TokenUsageView } from '~/hooks/Chat/useTokenUsage';
+import type { CurrencyConfig } from '~/utils';
+import { groupToolTokens, formatTokens, formatCost } from '~/utils';
+import { useLocalize } from '~/hooks';
+
+interface RowProps {
+  label: string;
+  value: number;
+  max?: number;
+}
+
+function Row({ label, value, max }: RowProps) {
+  const percent = max != null && max > 0 ? Math.min((value / max) * 100, 100) : null;
+  return (
+    <div className="flex items-center justify-between gap-4 text-sm">
+      <span className="text-text-secondary">{label}</span>
+      <span className="font-medium text-text-primary">
+        {formatTokens(value)}
+        {percent != null && (
+          <span className="ml-1 text-xs text-text-secondary" aria-hidden="true">
+            ({Math.round(percent)}%)
+          </span>
+        )}
+      </span>
+    </div>
+  );
+}
+
+interface BreakdownProps {
+  view: TokenUsageView;
+  showCost: boolean;
+  currency?: CurrencyConfig;
+}
+
+export default function Breakdown({ view, showCost, currency }: BreakdownProps) {
+  const localize = useLocalize();
+  const { usedTokens, maxTokens, percent, snapshot, snapshotActive, branchUsage, hasUsage } = view;
+  /** Show the all-branches total only when it (a) exceeds the active branch —
+   *  epsilon guards against float summation order surfacing a spurious row in an
+   *  unbranched conversation — and (b) has COMPLETE cost coverage, so a sibling
+   *  branch saved without cost can't render an under-reported total. */
+  const showTotal = view.totalUsage.costKnown && view.totalCost - view.branchCost > 1e-9;
+
+  const breakdown = snapshotActive ? snapshot?.breakdown : undefined;
+  const instructionTokens =
+    snapshot?.effectiveInstructionTokens ?? breakdown?.instructionTokens ?? 0;
+  const systemTokens =
+    (breakdown?.systemMessageTokens ?? 0) + (breakdown?.dynamicInstructionTokens ?? 0);
+  /** Summary has its own row, so exclude it (it's part of `usedTokens`) to avoid
+   *  double-counting it inside the Messages row on a summarized turn. */
+  const messageTokens = Math.max(
+    0,
+    usedTokens - instructionTokens - (breakdown?.summaryTokens ?? 0),
+  );
+  const freeTokens = maxTokens != null ? Math.max(0, maxTokens - usedTokens) : null;
+
+  const groups =
+    breakdown?.toolTokenCounts != null
+      ? groupToolTokens(breakdown.toolTokenCounts, breakdown.deferredToolNames)
+      : null;
+  const toolRows =
+    groups == null
+      ? null
+      : ([
+          [localize('com_ui_context_tools_system'), groups.system],
+          [localize('com_ui_context_tools_mcp'), groups.mcp],
+          [localize('com_ui_skills'), groups.skills],
+          [localize('com_ui_context_subagents'), groups.subagents],
+          [localize('com_ui_context_tools_system_deferred'), groups.systemDeferred],
+          [localize('com_ui_context_tools_mcp_deferred'), groups.mcpDeferred],
+        ] as const);
+
+  return (
+    <div className="w-64 space-y-3" role="region" aria-label={localize('com_ui_context_usage')}>
+      <div className="flex items-center justify-between">
+        <span className="text-sm font-medium text-text-primary">
+          {localize('com_ui_context_window')}
+        </span>
+        <span className="text-xs font-medium text-text-secondary">
+          {maxTokens != null
+            ? `${formatTokens(usedTokens)} / ${formatTokens(maxTokens)} (${Math.round(percent)}%)`
+            : formatTokens(usedTokens)}
+        </span>
+      </div>
+
+      <div
+        role="progressbar"
+        aria-valuemin={0}
+        aria-valuemax={100}
+        aria-valuenow={maxTokens != null ? Math.round(percent) : undefined}
+        aria-label={localize('com_ui_context_usage')}
+        className="h-2 w-full overflow-hidden rounded-full bg-surface-tertiary"
+      >
+        {percent > 0 && (
+          <div
+            className="h-full rounded-full bg-text-primary transition-all duration-300"
+            style={{ width: `${Math.min(percent, 100)}%` }}
+          />
+        )}
+      </div>
+
+      <div
+        className="space-y-1.5"
+        data-testid={breakdown ? 'context-breakdown' : 'context-estimate'}
+      >
+        {breakdown ? (
+          <>
+            <Row
+              label={localize('com_ui_context_messages')}
+              value={messageTokens}
+              max={maxTokens}
+            />
+            {systemTokens > 0 && (
+              <Row label={localize('com_ui_context_system')} value={systemTokens} max={maxTokens} />
+            )}
+            {toolRows != null ? (
+              toolRows.map(
+                ([label, value]) =>
+                  value > 0 && <Row key={label} label={label} value={value} max={maxTokens} />,
+              )
+            ) : (
+              <Row
+                label={localize('com_ui_context_tools')}
+                value={breakdown.toolSchemaTokens}
+                max={maxTokens}
+              />
+            )}
+            {breakdown.summaryTokens > 0 && (
+              <Row
+                label={localize('com_ui_context_summary')}
+                value={breakdown.summaryTokens}
+                max={maxTokens}
+              />
+            )}
+            {freeTokens != null && (
+              <Row label={localize('com_ui_context_free')} value={freeTokens} max={maxTokens} />
+            )}
+          </>
+        ) : (
+          <>
+            {view.branchTotals.summaryBaseline > 0 && (
+              <Row
+                label={localize('com_ui_context_summary')}
+                value={view.branchTotals.summaryBaseline}
+                max={maxTokens}
+              />
+            )}
+            <Row label={localize('com_ui_input')} value={view.branchTotals.input} />
+            <Row
+              label={localize('com_ui_output')}
+              value={view.branchTotals.output + view.liveTokens}
+            />
+            {maxTokens == null && (
+              <p className="text-xs text-text-secondary">{localize('com_ui_context_unknown')}</p>
+            )}
+            <p className="text-xs italic text-text-secondary">{localize('com_ui_estimated')}</p>
+          </>
+        )}
+      </div>
+
+      {hasUsage && (
+        <>
+          <div className="border-t border-border-light" role="separator" />
+          <div className="space-y-1.5" data-testid="token-usage-totals">
+            <Row label={localize('com_ui_input')} value={branchUsage.input} />
+            <Row label={localize('com_ui_output')} value={branchUsage.output} />
+            {branchUsage.cacheRead > 0 && (
+              <Row label={localize('com_ui_cache_read')} value={branchUsage.cacheRead} />
+            )}
+            {branchUsage.cacheWrite > 0 && (
+              <Row label={localize('com_ui_cache_write')} value={branchUsage.cacheWrite} />
+            )}
+          </div>
+        </>
+      )}
+
+      {showCost && hasUsage && branchUsage.costKnown && (
+        <>
+          <div className="border-t border-border-light" role="separator" />
+          <div className="space-y-1.5" data-testid="token-usage-cost">
+            <div className="flex items-center justify-between text-sm">
+              <span className="text-text-secondary">
+                {showTotal
+                  ? localize('com_ui_context_cost_branch')
+                  : localize('com_ui_context_cost')}
+              </span>
+              <span className="font-medium text-text-primary">
+                {formatCost(view.branchCost, currency)}
+              </span>
+            </div>
+            {showTotal && (
+              <div className="flex items-center justify-between text-xs">
+                <span className="text-text-secondary">{localize('com_ui_context_cost_total')}</span>
+                <span className="text-text-secondary">{formatCost(view.totalCost, currency)}</span>
+              </div>
+            )}
+          </div>
+        </>
+      )}
+    </div>
+  );
+}
diff --git a/client/src/components/Chat/Input/TokenUsage/Gauge.tsx b/client/src/components/Chat/Input/TokenUsage/Gauge.tsx
new file mode 100644
index 00000000000..ba7e420302d
--- /dev/null
+++ b/client/src/components/Chat/Input/TokenUsage/Gauge.tsx
@@ -0,0 +1,62 @@
+import { cn } from '~/utils';
+
+const SIZE = 28;
+const STROKE_WIDTH = 3.5;
+const RADIUS = (SIZE - STROKE_WIDTH) / 2;
+const CIRCUMFERENCE = 2 * Math.PI * RADIUS;
+
+interface GaugeProps {
+  /** 0–100, clamped by the caller */
+  percent: number;
+  /** Max context unknown — render an empty track only */
+  indeterminate: boolean;
+}
+
+function getStrokeClass(percent: number, indeterminate: boolean): string {
+  if (indeterminate) {
+    return 'stroke-text-secondary';
+  }
+  if (percent > 90) {
+    return 'stroke-red-500';
+  }
+  if (percent > 75) {
+    return 'stroke-yellow-500';
+  }
+  return 'stroke-text-secondary';
+}
+
+export default function Gauge({ percent, indeterminate }: GaugeProps) {
+  const offset = CIRCUMFERENCE - (percent / 100) * CIRCUMFERENCE;
+
+  return (
+    <svg
+      width={SIZE}
+      height={SIZE}
+      viewBox={`0 0 ${SIZE} ${SIZE}`}
+      className="-rotate-90"
+      aria-hidden="true"
+      focusable="false"
+    >
+      <circle
+        cx={SIZE / 2}
+        cy={SIZE / 2}
+        r={RADIUS}
+        fill="transparent"
+        strokeWidth={STROKE_WIDTH}
+        className="stroke-border-heavy"
+        strokeDasharray={indeterminate ? '2 4' : undefined}
+      />
+      <circle
+        cx={SIZE / 2}
+        cy={SIZE / 2}
+        r={RADIUS}
+        fill="transparent"
+        strokeWidth={STROKE_WIDTH}
+        strokeDasharray={CIRCUMFERENCE}
+        strokeDashoffset={indeterminate ? CIRCUMFERENCE : offset}
+        strokeLinecap="round"
+        className={cn('transition-all duration-300', getStrokeClass(percent, indeterminate))}
+      />
+    </svg>
+  );
+}
diff --git a/client/src/components/Chat/Input/TokenUsage/index.tsx b/client/src/components/Chat/Input/TokenUsage/index.tsx
new file mode 100644
index 00000000000..cb9f4894a58
--- /dev/null
+++ b/client/src/components/Chat/Input/TokenUsage/index.tsx
@@ -0,0 +1,123 @@
+import { memo } from 'react';
+import * as Ariakit from '@ariakit/react';
+import { TooltipAnchor } from '@librechat/client';
+import type { TConversation } from 'librechat-data-provider';
+import type { CurrencyConfig } from '~/utils';
+import { formatTokens, formatCost, cn } from '~/utils';
+import useTokenUsage from '~/hooks/Chat/useTokenUsage';
+import { useGetStartupConfig } from '~/data-provider';
+import { useLocalize } from '~/hooks';
+import Breakdown from './Breakdown';
+import Gauge from './Gauge';
+
+interface TokenUsageProps {
+  index: number;
+  conversation: TConversation | null;
+  isSubmitting: boolean;
+}
+
+function TokenUsageIndicator({
+  index,
+  conversation,
+  isSubmitting,
+  showCost,
+  currency,
+}: TokenUsageProps & {
+  showCost: boolean;
+  currency?: CurrencyConfig;
+}) {
+  const localize = useLocalize();
+  const view = useTokenUsage({ index, conversation, isSubmitting });
+  const popover = Ariakit.usePopoverStore({ placement: 'top' });
+
+  /** Hide until the branch has data — keeps a fresh, message-less chat clean and
+   *  lets the indicator animate into view once the first tokens land. */
+  if (view.usedTokens <= 0) {
+    return null;
+  }
+
+  const hasMax = view.maxTokens != null && view.maxTokens > 0;
+  const ariaLabel = hasMax
+    ? localize('com_ui_context_usage_label', {
+        0: formatTokens(view.usedTokens),
+        1: formatTokens(view.maxTokens ?? 0),
+        2: String(Math.round(view.percent)),
+      })
+    : localize('com_ui_context_usage_label_unknown', { 0: formatTokens(view.usedTokens) });
+
+  const snapshotSummary = hasMax
+    ? localize('com_ui_context_usage_snapshot', {
+        0: formatTokens(view.usedTokens),
+        1: formatTokens(view.maxTokens ?? 0),
+        2: String(Math.round(view.percent)),
+      })
+    : localize('com_ui_context_usage_snapshot_unknown', { 0: formatTokens(view.usedTokens) });
+  const snapshot =
+    showCost && view.hasUsage && view.branchUsage.costKnown
+      ? `${snapshotSummary} · ${formatCost(view.branchCost, currency)}`
+      : snapshotSummary;
+
+  return (
+    <>
+      <TooltipAnchor
+        description={snapshot}
+        side="top"
+        render={
+          <Ariakit.PopoverDisclosure
+            store={popover}
+            type="button"
+            data-testid="token-usage"
+            aria-label={ariaLabel}
+            aria-haspopup="dialog"
+            className={cn(
+              'flex size-9 items-center justify-center rounded-full p-1 transition-colors',
+              'hover:bg-surface-hover focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring',
+              'duration-300 animate-in fade-in zoom-in-95',
+            )}
+          >
+            <span
+              role="meter"
+              aria-valuemin={0}
+              aria-valuemax={hasMax ? view.maxTokens : undefined}
+              aria-valuenow={view.usedTokens}
+              aria-label={localize('com_ui_context_usage')}
+              className="flex items-center justify-center"
+            >
+              <Gauge percent={view.percent} indeterminate={!hasMax} />
+            </span>
+          </Ariakit.PopoverDisclosure>
+        }
+      />
+      <Ariakit.Popover
+        store={popover}
+        gutter={8}
+        portal
+        unmountOnHide
+        aria-label={localize('com_ui_context_usage')}
+        className="z-[200] rounded-xl border border-border-medium bg-surface-secondary p-3 shadow-lg focus:outline-none"
+      >
+        <Breakdown view={view} showCost={showCost} currency={currency} />
+      </Ariakit.Popover>
+    </>
+  );
+}
+
+/** Config gate kept outside the indicator so disabled deployments mount nothing */
+const TokenUsage = memo(function TokenUsage(props: TokenUsageProps) {
+  const { data: startupConfig } = useGetStartupConfig();
+  /** Wait for config before mounting: until it loads `contextUsage === false`
+   *  reads as undefined, so a disabled deployment would briefly mount the
+   *  indicator and fire the token-config query on first load */
+  if (startupConfig == null || startupConfig.interface?.contextUsage === false) {
+    return null;
+  }
+  return (
+    <TokenUsageIndicator
+      {...props}
+      showCost={startupConfig.interface?.contextCost === true}
+      currency={startupConfig.interface?.currency}
+    />
+  );
+});
+
+export default TokenUsage;
diff --git a/client/src/components/Chat/Input/ToolsDropdown.tsx b/client/src/components/Chat/Input/ToolsDropdown.tsx
index 10ba4458709..14530c8d37a 100644
--- a/client/src/components/Chat/Input/ToolsDropdown.tsx
+++ b/client/src/components/Chat/Input/ToolsDropdown.tsx
@@ -278,7 +278,7 @@ const ToolsDropdown = ({ disabled }: ToolsDropdownProps) => {
       onClick: handleSkillsToggle,
       hideOnClick: false,
       render: (props) => (
-        <div {...props}>
+        <div {...props} data-testid="tools-menu-skills">
           <div className="flex items-center gap-2">
             <ScrollText className="icon-md" aria-hidden="true" />
             <span>{localize('com_ui_skills')}</span>
diff --git a/client/src/components/Chat/Input/__tests__/SkillsCommand.spec.tsx b/client/src/components/Chat/Input/__tests__/SkillsCommand.spec.tsx
index 53ec6388f7b..ecafb845866 100644
--- a/client/src/components/Chat/Input/__tests__/SkillsCommand.spec.tsx
+++ b/client/src/components/Chat/Input/__tests__/SkillsCommand.spec.tsx
@@ -320,7 +320,7 @@ describe('SkillsCommand', () => {
       isFetchingNextPage: false,
     });
     mockUseAgentsMapContext.mockReturnValue({
-      agent_1: { id: 'agent_1', skills_enabled: true },
+      agent_1: { id: 'agent_1', skills: [], skills_enabled: true },
     });
 
     const textAreaRef = makeTextarea('$');
diff --git a/client/src/components/Chat/Landing.tsx b/client/src/components/Chat/Landing.tsx
index 7707fe7066d..d3a3d3c8b19 100644
--- a/client/src/components/Chat/Landing.tsx
+++ b/client/src/components/Chat/Landing.tsx
@@ -2,11 +2,18 @@ import { useMemo, useCallback, useState, useEffect, useRef } from 'react';
 import { easings } from '@react-spring/web';
 import { EModelEndpoint } from 'librechat-data-provider';
 import { BirthdayIcon, TooltipAnchor, SplitText } from '@librechat/client';
+import {
+  getIconEndpoint,
+  getEntity,
+  getModelSpec,
+  createConfigHtmlSanitizer,
+  CONFIG_HTML_MEDIA_TAGS,
+  CONFIG_HTML_MEDIA_ATTR,
+} from '~/utils';
 import { useChatContext, useAgentsMapContext, useAssistantsMapContext } from '~/Providers';
 import { useGetEndpointsQuery, useGetStartupConfig } from '~/data-provider';
 import ConvoIcon from '~/components/Endpoints/ConvoIcon';
 import { useLocalize, useAuthContext } from '~/hooks';
-import { getIconEndpoint, getEntity } from '~/utils';
 
 const containerClassName =
   'shadow-stroke relative flex h-full items-center justify-center rounded-full bg-white dark:bg-presentation dark:text-white text-black dark:after:shadow-none ';
@@ -61,8 +68,26 @@ export default function Landing({ centerFormOnLanding }: { centerFormOnLanding:
     assistant_id: conversation?.assistant_id,
   });
 
-  const name = entity?.name ?? '';
-  const description = (entity?.description || conversation?.greeting) ?? '';
+  const modelSpec = useMemo(
+    () => getModelSpec({ specName: conversation?.spec, startupConfig }),
+    [conversation?.spec, startupConfig],
+  );
+
+  const brandedSpecLabel = modelSpec?.showOnLanding ? modelSpec.label : '';
+  const brandedSpecDescription = (modelSpec?.showOnLanding && modelSpec.description) || '';
+  const name = entity?.name ?? brandedSpecLabel;
+  const description =
+    (entity?.description || brandedSpecDescription || conversation?.greeting) ?? '';
+  const descriptionIsHTML = description.trim().startsWith('<');
+
+  const sanitizeDescription = useMemo(
+    () =>
+      createConfigHtmlSanitizer({
+        allowedTags: CONFIG_HTML_MEDIA_TAGS,
+        allowedAttr: CONFIG_HTML_MEDIA_ATTR,
+      }),
+    [],
+  );
 
   const getGreeting = useCallback(() => {
     if (typeof startupConfig?.interface?.customWelcome === 'string') {
@@ -198,11 +223,17 @@ export default function Landing({ centerFormOnLanding }: { centerFormOnLanding:
             />
           )}
         </div>
-        {description && (
-          <div className="animate-fadeIn mt-4 max-w-md text-center text-sm font-normal text-text-primary">
-            {description}
-          </div>
-        )}
+        {description &&
+          (descriptionIsHTML ? (
+            <div
+              className="animate-fadeIn mt-4 flex max-w-md items-center justify-center gap-2 text-center text-sm font-normal text-text-primary [&_img]:inline-block [&_img]:h-4 [&_img]:w-4"
+              dangerouslySetInnerHTML={{ __html: sanitizeDescription(description) }}
+            />
+          ) : (
+            <div className="animate-fadeIn mt-4 max-w-md text-center text-sm font-normal text-text-primary">
+              {description}
+            </div>
+          ))}
       </div>
     </div>
   );
diff --git a/client/src/components/Chat/Menus/Endpoints/ModelSelectorContext.tsx b/client/src/components/Chat/Menus/Endpoints/ModelSelectorContext.tsx
index 5a51db6ce99..b09bef94be9 100644
--- a/client/src/components/Chat/Menus/Endpoints/ModelSelectorContext.tsx
+++ b/client/src/components/Chat/Menus/Endpoints/ModelSelectorContext.tsx
@@ -1,5 +1,5 @@
-import debounce from 'lodash/debounce';
 import React, { createContext, useContext, useState, useMemo, useCallback } from 'react';
+import debounce from 'lodash/debounce';
 import { EModelEndpoint, isAgentsEndpoint, isAssistantsEndpoint } from 'librechat-data-provider';
 import type * as t from 'librechat-data-provider';
 import type { Endpoint, SelectedValues } from '~/common';
@@ -161,8 +161,8 @@ export function ModelSelectorProvider({ children, startupConfig }: ModelSelector
       return null;
     }
     const allItems = [...modelSpecs, ...mappedEndpoints];
-    return filterItems(allItems, searchValue, agentsMap, assistantsMap || {});
-  }, [searchValue, modelSpecs, mappedEndpoints, agentsMap, assistantsMap]);
+    return filterItems(allItems, searchValue, agentsMap, assistantsMap || {}, localize);
+  }, [searchValue, modelSpecs, mappedEndpoints, agentsMap, assistantsMap, localize]);
 
   const setDebouncedSearchValue = useMemo(
     () =>
diff --git a/client/src/components/Chat/Menus/Endpoints/__tests__/utils.test.ts b/client/src/components/Chat/Menus/Endpoints/__tests__/utils.test.ts
new file mode 100644
index 00000000000..a4b5069a691
--- /dev/null
+++ b/client/src/components/Chat/Menus/Endpoints/__tests__/utils.test.ts
@@ -0,0 +1,46 @@
+import type { useLocalize } from '~/hooks';
+import type { Endpoint } from '~/common';
+import { filterItems } from '../utils';
+
+const agentsEndpoint: Endpoint = {
+  value: 'agents',
+  label: 'My Agents',
+  hasModels: true,
+  icon: null,
+  showMarketplace: true,
+  searchAliases: ['agent marketplace', 'marketplace'],
+};
+
+const disabledAgentsEndpoint: Endpoint = {
+  value: 'agents',
+  label: 'My Agents',
+  hasModels: false,
+  icon: null,
+};
+
+describe('model selector utilities', () => {
+  it('matches endpoint search aliases', () => {
+    const results = filterItems([agentsEndpoint], 'marketplace', undefined, undefined);
+    expect(results).toEqual([agentsEndpoint]);
+  });
+
+  it('matches localized Marketplace labels', () => {
+    const localize = ((key: string) => {
+      if (key === 'com_agents_marketplace') {
+        return 'Tienda de Agentes';
+      }
+      if (key === 'com_ui_marketplace') {
+        return 'Tienda';
+      }
+      return key;
+    }) as ReturnType<typeof useLocalize>;
+
+    const results = filterItems([agentsEndpoint], 'tienda', undefined, undefined, localize);
+    expect(results).toEqual([agentsEndpoint]);
+  });
+
+  it('does not match agents when there are no selectable agent options', () => {
+    const results = filterItems([disabledAgentsEndpoint], 'my agents', undefined, undefined);
+    expect(results).toEqual([]);
+  });
+});
diff --git a/client/src/components/Chat/Menus/Endpoints/components/EndpointItem.tsx b/client/src/components/Chat/Menus/Endpoints/components/EndpointItem.tsx
index c8cef36010f..fc2852edda1 100644
--- a/client/src/components/Chat/Menus/Endpoints/components/EndpointItem.tsx
+++ b/client/src/components/Chat/Menus/Endpoints/components/EndpointItem.tsx
@@ -5,11 +5,12 @@ import { CheckCircle2, MousePointerClick, SettingsIcon } from 'lucide-react';
 import { EModelEndpoint, isAgentsEndpoint, isAssistantsEndpoint } from 'librechat-data-provider';
 import type { TModelSpec } from 'librechat-data-provider';
 import type { Endpoint } from '~/common';
-import { CustomMenu as Menu, CustomMenuItem as MenuItem } from '../CustomMenu';
+import { CustomMenu as Menu, CustomMenuItem as MenuItem, CustomMenuSeparator } from '../CustomMenu';
+import MarketplaceItem, { marketplaceSearchMatches } from './Marketplace';
+import { filterModels, shouldRenderEndpointOption } from '../utils';
 import { useModelSelectorContext } from '../ModelSelectorContext';
 import { renderEndpointModels } from './EndpointModelItem';
 import { ModelSpecItem } from './ModelSpecItem';
-import { filterModels } from '../utils';
 import { useLocalize } from '~/hooks';
 import { cn } from '~/utils';
 
@@ -127,9 +128,15 @@ function EndpointMenuContent({
         assistantsMap,
       )
     : null;
+  const renderedModels = filteredModels ?? endpoint.models?.map((model) => model.name) ?? [];
+  const showMarketplace =
+    endpoint.showMarketplace === true && marketplaceSearchMatches(searchValue, localize);
+  const hasSelectableRows = endpointSpecs.length > 0 || renderedModels.length > 0;
 
   return (
     <>
+      {showMarketplace && <MarketplaceItem label={localize('com_agents_marketplace')} />}
+      {showMarketplace && hasSelectableRows && <CustomMenuSeparator />}
       {endpointSpecs.map((spec: TModelSpec) => (
         <ModelSpecItem key={spec.name} spec={spec} isSelected={selectedSpec === spec.name} />
       ))}
@@ -175,6 +182,10 @@ export function EndpointItem({ endpoint, endpointIndex }: EndpointItemProps) {
 
   const isEndpointSelected = !selectedSpec && selectedEndpoint === endpoint.value;
 
+  if (!shouldRenderEndpointOption(endpoint)) {
+    return null;
+  }
+
   if (endpoint.hasModels) {
     const placeholder =
       isAgentsEndpoint(endpoint.value) || isAssistantsEndpoint(endpoint.value)
diff --git a/client/src/components/Chat/Menus/Endpoints/components/GroupIcon.tsx b/client/src/components/Chat/Menus/Endpoints/components/GroupIcon.tsx
index eb1081435d8..3c4cb840a46 100644
--- a/client/src/components/Chat/Menus/Endpoints/components/GroupIcon.tsx
+++ b/client/src/components/Chat/Menus/Endpoints/components/GroupIcon.tsx
@@ -1,6 +1,7 @@
 import React, { memo, useState } from 'react';
 import { AlertCircle } from 'lucide-react';
 import type { IconMapProps } from '~/common';
+import { getKnownEndpointAsset, hasKnownEndpointIcon } from '~/hooks/Endpoint/UnknownIcon';
 import { icons } from '~/hooks/Endpoint/Icons';
 
 interface GroupIconProps {
@@ -42,13 +43,27 @@ const GroupIcon: React.FC<GroupIconProps> = ({ iconURL, groupName }) => {
     );
   }
 
+  const resolvedIconURL = getKnownEndpointAsset(iconURL);
+
+  if (!resolvedIconURL && hasKnownEndpointIcon(iconURL)) {
+    const Icon: IconType = icons.unknown as IconType;
+    return (
+      <Icon
+        size={20}
+        endpoint={iconURL}
+        context="menu-item"
+        className="icon-md shrink-0 text-text-primary"
+      />
+    );
+  }
+
   return (
     <div
       className="icon-md shrink-0 overflow-hidden rounded-full"
       style={{ width: 20, height: 20 }}
     >
       <img
-        src={iconURL}
+        src={resolvedIconURL || iconURL}
         alt={groupName}
         className="h-full w-full object-cover"
         onError={handleImageError}
diff --git a/client/src/components/Chat/Menus/Endpoints/components/Marketplace.tsx b/client/src/components/Chat/Menus/Endpoints/components/Marketplace.tsx
new file mode 100644
index 00000000000..577e537866f
--- /dev/null
+++ b/client/src/components/Chat/Menus/Endpoints/components/Marketplace.tsx
@@ -0,0 +1,49 @@
+import { LayoutGrid } from 'lucide-react';
+import { useNavigate } from 'react-router-dom';
+import type { LocalizeFunction } from '~/common';
+import { CustomMenuItem as MenuItem } from '../CustomMenu';
+import { cn } from '~/utils';
+
+const marketplaceSearchAliases = ['agent marketplace', 'marketplace'];
+
+export function marketplaceSearchMatches(searchValue: string, localize: LocalizeFunction): boolean {
+  const searchTerm = searchValue.trim().toLowerCase();
+  if (!searchTerm) {
+    return true;
+  }
+
+  return [
+    localize('com_agents_marketplace'),
+    localize('com_ui_marketplace'),
+    ...marketplaceSearchAliases,
+  ].some((label) => label.toLowerCase().includes(searchTerm));
+}
+
+export default function MarketplaceItem({
+  className,
+  label,
+}: {
+  className?: string;
+  label: string;
+}) {
+  const navigate = useNavigate();
+
+  return (
+    <MenuItem
+      onClick={() => navigate('/agents')}
+      aria-label={label}
+      data-testid="model-selector-marketplace-item"
+      className={cn(
+        'flex w-full cursor-pointer items-center justify-between rounded-lg px-2 text-sm',
+        className,
+      )}
+    >
+      <div className="flex w-full min-w-0 items-center gap-2 px-1 py-1">
+        <div className="flex h-5 w-5 shrink-0 items-center justify-center">
+          <LayoutGrid className="h-5 w-5 text-text-primary" aria-hidden="true" />
+        </div>
+        <span className="truncate text-left">{label}</span>
+      </div>
+    </MenuItem>
+  );
+}
diff --git a/client/src/components/Chat/Menus/Endpoints/components/ModelSpecItem.tsx b/client/src/components/Chat/Menus/Endpoints/components/ModelSpecItem.tsx
index a73d1d8e47c..10662fa55b5 100644
--- a/client/src/components/Chat/Menus/Endpoints/components/ModelSpecItem.tsx
+++ b/client/src/components/Chat/Menus/Endpoints/components/ModelSpecItem.tsx
@@ -5,6 +5,7 @@ import type { TModelSpec } from 'librechat-data-provider';
 import { useFavorites, useLocalize, useIsActiveItem } from '~/hooks';
 import { useModelSelectorContext } from '../ModelSelectorContext';
 import { CustomMenuItem as MenuItem } from '../CustomMenu';
+import SpecDescription from './SpecDescription';
 import SpecIcon from './SpecIcon';
 import { cn } from '~/utils';
 
@@ -48,9 +49,7 @@ export function ModelSpecItem({ spec, isSelected }: ModelSpecItemProps) {
         )}
         <div className="flex min-w-0 flex-col gap-1">
           <span className="truncate text-left">{spec.label}</span>
-          {spec.description && (
-            <span className="break-words text-xs font-normal">{spec.description}</span>
-          )}
+          <SpecDescription description={spec.description} />
         </div>
       </div>
       <button
diff --git a/client/src/components/Chat/Menus/Endpoints/components/SearchResults.tsx b/client/src/components/Chat/Menus/Endpoints/components/SearchResults.tsx
index 26831a577e9..a64907ff26f 100644
--- a/client/src/components/Chat/Menus/Endpoints/components/SearchResults.tsx
+++ b/client/src/components/Chat/Menus/Endpoints/components/SearchResults.tsx
@@ -4,8 +4,11 @@ import { CheckCircle2, EarthIcon } from 'lucide-react';
 import { isAgentsEndpoint, isAssistantsEndpoint } from 'librechat-data-provider';
 import type { TModelSpec } from 'librechat-data-provider';
 import type { Endpoint } from '~/common';
+import MarketplaceItem, { marketplaceSearchMatches } from './Marketplace';
 import { useModelSelectorContext } from '../ModelSelectorContext';
 import { CustomMenuItem as MenuItem } from '../CustomMenu';
+import { shouldRenderEndpointOption } from '../utils';
+import SpecDescription from './SpecDescription';
 import SpecIcon from './SpecIcon';
 import { cn } from '~/utils';
 
@@ -80,9 +83,7 @@ export function SearchResults({ results, localize, searchValue }: SearchResultsP
                 )}
                 <div className="flex min-w-0 flex-col gap-1">
                   <span className="truncate text-left">{spec.label}</span>
-                  {spec.description && (
-                    <span className="break-words text-xs font-normal">{spec.description}</span>
-                  )}
+                  <SpecDescription description={spec.description} />
                 </div>
               </div>
               {selectedSpec === spec.name && (
@@ -102,11 +103,20 @@ export function SearchResults({ results, localize, searchValue }: SearchResultsP
         } else {
           // For an endpoint item
           const endpoint = item as Endpoint;
-          if (endpoint.hasModels && endpoint.models && endpoint.models.length > 0) {
+          if (!shouldRenderEndpointOption(endpoint)) {
+            return null;
+          }
+
+          if (endpoint.hasModels) {
             const lowerQuery = searchValue.toLowerCase();
-            const filteredModels = endpoint.label.toLowerCase().includes(lowerQuery)
-              ? endpoint.models
-              : endpoint.models.filter((model) => {
+            const endpointMatches = endpoint.label.toLowerCase().includes(lowerQuery);
+            const showMarketplace =
+              endpoint.showMarketplace === true &&
+              (endpointMatches || marketplaceSearchMatches(searchValue, localize));
+            const models = endpoint.models ?? [];
+            const filteredModels = endpointMatches
+              ? models
+              : models.filter((model) => {
                   let modelName = model.name;
                   if (
                     isAgentsEndpoint(endpoint.value) &&
@@ -124,7 +134,7 @@ export function SearchResults({ results, localize, searchValue }: SearchResultsP
                   return modelName.toLowerCase().includes(lowerQuery);
                 });
 
-            if (!filteredModels.length) {
+            if (!filteredModels.length && !showMarketplace) {
               return null; // skip if no models match
             }
 
@@ -138,6 +148,12 @@ export function SearchResults({ results, localize, searchValue }: SearchResultsP
                   )}
                   {endpoint.label}
                 </div>
+                {showMarketplace && (
+                  <MarketplaceItem
+                    className="px-3 py-2 pl-6"
+                    label={localize('com_agents_marketplace')}
+                  />
+                )}
                 {filteredModels.map((model) => {
                   const modelId = model.name;
 
diff --git a/client/src/components/Chat/Menus/Endpoints/components/SpecDescription.tsx b/client/src/components/Chat/Menus/Endpoints/components/SpecDescription.tsx
new file mode 100644
index 00000000000..b67395380ad
--- /dev/null
+++ b/client/src/components/Chat/Menus/Endpoints/components/SpecDescription.tsx
@@ -0,0 +1,32 @@
+import { useMemo } from 'react';
+import { createConfigHtmlSanitizer, CONFIG_HTML_MEDIA_TAGS, CONFIG_HTML_MEDIA_ATTR } from '~/utils';
+
+interface SpecDescriptionProps {
+  description?: string;
+}
+
+export default function SpecDescription({ description }: SpecDescriptionProps) {
+  const sanitize = useMemo(
+    () =>
+      createConfigHtmlSanitizer({
+        allowedTags: CONFIG_HTML_MEDIA_TAGS,
+        allowedAttr: CONFIG_HTML_MEDIA_ATTR,
+      }),
+    [],
+  );
+
+  if (!description) {
+    return null;
+  }
+
+  if (!description.trim().startsWith('<')) {
+    return <span className="break-words text-xs font-normal">{description}</span>;
+  }
+
+  return (
+    <span
+      className="inline-flex items-center gap-1 break-words text-xs font-normal [&_img]:inline-block [&_img]:h-3.5 [&_img]:w-3.5"
+      dangerouslySetInnerHTML={{ __html: sanitize(description) }}
+    />
+  );
+}
diff --git a/client/src/components/Chat/Menus/Endpoints/components/__tests__/EndpointItem.test.tsx b/client/src/components/Chat/Menus/Endpoints/components/__tests__/EndpointItem.test.tsx
new file mode 100644
index 00000000000..5a8d6eca1c1
--- /dev/null
+++ b/client/src/components/Chat/Menus/Endpoints/components/__tests__/EndpointItem.test.tsx
@@ -0,0 +1,80 @@
+import React from 'react';
+import { fireEvent, render, screen } from '@testing-library/react';
+import type { Endpoint, SelectedValues } from '~/common';
+import { EndpointItem } from '../EndpointItem';
+
+const mockHandleSelectEndpoint = jest.fn();
+const mockHandleOpenKeyDialog = jest.fn();
+const mockSetEndpointSearchValue = jest.fn();
+
+let mockSelectedValues: SelectedValues = { endpoint: '', model: '', modelSpec: '' };
+
+jest.mock('~/hooks', () => ({
+  useLocalize: () => (key: string) => key,
+}));
+
+jest.mock('~/components/Chat/Menus/Endpoints/ModelSelectorContext', () => ({
+  useModelSelectorContext: () => ({
+    agentsMap: undefined,
+    assistantsMap: undefined,
+    modelSpecs: [],
+    selectedValues: mockSelectedValues,
+    endpointSearchValues: {},
+    handleOpenKeyDialog: mockHandleOpenKeyDialog,
+    handleSelectEndpoint: mockHandleSelectEndpoint,
+    setEndpointSearchValue: mockSetEndpointSearchValue,
+    endpointRequiresUserKey: () => false,
+  }),
+}));
+
+jest.mock('~/components/Chat/Menus/Endpoints/CustomMenu', () => {
+  const React = jest.requireActual<typeof import('react')>('react');
+
+  return {
+    CustomMenu: ({ children, label }: { children?: React.ReactNode; label?: React.ReactNode }) =>
+      React.createElement('div', null, label, children),
+    CustomMenuItem: React.forwardRef(function MockMenuItem(
+      { children, ...rest }: { children?: React.ReactNode },
+      ref: React.Ref<HTMLButtonElement>,
+    ) {
+      return React.createElement('button', { ref, type: 'button', ...rest }, children);
+    }),
+    CustomMenuSeparator: () => React.createElement('hr'),
+  };
+});
+
+const disabledAgentsEndpoint: Endpoint = {
+  value: 'agents',
+  label: 'My Agents',
+  hasModels: false,
+  icon: null,
+};
+
+const customEndpoint: Endpoint = {
+  value: 'custom',
+  label: 'Custom',
+  hasModels: false,
+  icon: null,
+};
+
+describe('EndpointItem', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockSelectedValues = { endpoint: '', model: '', modelSpec: '' };
+  });
+
+  it('does not render agents as a leaf endpoint when no selectable rows exist', () => {
+    render(<EndpointItem endpoint={disabledAgentsEndpoint} endpointIndex={0} />);
+
+    expect(screen.queryByText('My Agents')).not.toBeInTheDocument();
+    expect(mockHandleSelectEndpoint).not.toHaveBeenCalled();
+  });
+
+  it('keeps non-agent endpoints without models selectable', () => {
+    render(<EndpointItem endpoint={customEndpoint} endpointIndex={0} />);
+
+    fireEvent.click(screen.getByRole('button', { name: 'Custom' }));
+
+    expect(mockHandleSelectEndpoint).toHaveBeenCalledWith(customEndpoint);
+  });
+});
diff --git a/client/src/components/Chat/Menus/Endpoints/components/__tests__/GroupIcon.test.tsx b/client/src/components/Chat/Menus/Endpoints/components/__tests__/GroupIcon.test.tsx
new file mode 100644
index 00000000000..ee8ba0f5f06
--- /dev/null
+++ b/client/src/components/Chat/Menus/Endpoints/components/__tests__/GroupIcon.test.tsx
@@ -0,0 +1,64 @@
+import { render, screen } from '@testing-library/react';
+import GroupIcon from '../GroupIcon';
+
+jest.mock('~/hooks/Endpoint/Icons', () => {
+  const React = jest.requireActual<typeof import('react')>('react');
+  const createIcon =
+    (iconKey: string) =>
+    ({ className, endpoint }: { className?: string; endpoint?: string | null }) =>
+      React.createElement('span', {
+        className,
+        'data-testid': 'endpoint-icon',
+        'data-icon-key': iconKey,
+        'data-endpoint': endpoint ?? '',
+      });
+
+  return {
+    icons: {
+      openAI: createIcon('openAI'),
+      unknown: createIcon('unknown'),
+    },
+  };
+});
+
+describe('GroupIcon', () => {
+  it('renders built-in endpoint icon keys', () => {
+    render(<GroupIcon iconURL="openAI" groupName="OpenAI" />);
+
+    expect(screen.getByTestId('endpoint-icon')).toHaveAttribute('data-icon-key', 'openAI');
+  });
+
+  it('resolves known endpoint asset aliases case-insensitively', () => {
+    render(<GroupIcon iconURL="OpenRouter" groupName="OpenRouter" />);
+
+    expect(screen.getByRole('img', { name: 'OpenRouter' })).toHaveAttribute(
+      'src',
+      'assets/openrouter.png',
+    );
+  });
+
+  it('resolves known endpoint asset aliases to shipped file paths', () => {
+    render(<GroupIcon iconURL="Helicone" groupName="Helicone" />);
+
+    expect(screen.getByRole('img', { name: 'Helicone' })).toHaveAttribute(
+      'src',
+      'assets/helicone.svg',
+    );
+  });
+
+  it('renders known endpoint aliases backed by components', () => {
+    render(<GroupIcon iconURL="Moonshot" groupName="Moonshot" />);
+
+    expect(screen.getByTestId('endpoint-icon')).toHaveAttribute('data-icon-key', 'unknown');
+    expect(screen.getByTestId('endpoint-icon')).toHaveAttribute('data-endpoint', 'Moonshot');
+  });
+
+  it('renders configured image URLs directly', () => {
+    render(<GroupIcon iconURL="/assets/openrouter.png" groupName="OpenRouter" />);
+
+    expect(screen.getByRole('img', { name: 'OpenRouter' })).toHaveAttribute(
+      'src',
+      '/assets/openrouter.png',
+    );
+  });
+});
diff --git a/client/src/components/Chat/Menus/Endpoints/components/__tests__/SearchResults.test.tsx b/client/src/components/Chat/Menus/Endpoints/components/__tests__/SearchResults.test.tsx
index 8ab9235f6fd..34acdd0e792 100644
--- a/client/src/components/Chat/Menus/Endpoints/components/__tests__/SearchResults.test.tsx
+++ b/client/src/components/Chat/Menus/Endpoints/components/__tests__/SearchResults.test.tsx
@@ -1,10 +1,11 @@
-import { render, screen } from '@testing-library/react';
+import { fireEvent, render, screen } from '@testing-library/react';
 import type { Endpoint, SelectedValues } from '~/common';
 import { SearchResults } from '../SearchResults';
 
 const mockHandleSelectSpec = jest.fn();
 const mockHandleSelectModel = jest.fn();
 const mockHandleSelectEndpoint = jest.fn();
+const mockNavigate = jest.fn();
 let mockSelectedValues: SelectedValues;
 
 jest.mock('~/components/Chat/Menus/Endpoints/ModelSelectorContext', () => ({
@@ -29,6 +30,10 @@ jest.mock('~/components/Chat/Menus/Endpoints/CustomMenu', () => {
   };
 });
 
+jest.mock('react-router-dom', () => ({
+  useNavigate: () => mockNavigate,
+}));
+
 jest.mock('../SpecIcon', () => {
   const React = jest.requireActual<typeof import('react')>('react');
   return {
@@ -54,6 +59,24 @@ const noModelsEndpoint: Endpoint = {
   icon: null,
 };
 
+const agentsMarketplaceEndpoint: Endpoint = {
+  value: 'agents',
+  label: 'My Agents',
+  hasModels: true,
+  models: [{ name: 'agent-1' }],
+  agentNames: { 'agent-1': 'Support Agent' },
+  showMarketplace: true,
+  searchAliases: ['agent marketplace', 'marketplace'],
+  icon: null,
+};
+
+const disabledAgentsEndpoint: Endpoint = {
+  value: 'agents',
+  label: 'My Agents',
+  hasModels: false,
+  icon: null,
+};
+
 describe('SearchResults', () => {
   beforeEach(() => {
     jest.clearAllMocks();
@@ -106,4 +129,36 @@ describe('SearchResults', () => {
     const item = screen.getByRole('menuitem');
     expect(item).toHaveAttribute('aria-selected', 'true');
   });
+
+  it('renders Marketplace from agent endpoint search results and navigates to agents', () => {
+    mockSelectedValues = { endpoint: '', model: '', modelSpec: '' };
+    render(
+      <SearchResults
+        results={[agentsMarketplaceEndpoint]}
+        localize={localize}
+        searchValue="marketplace"
+      />,
+    );
+
+    const item = screen.getByRole('menuitem', { name: 'com_agents_marketplace' });
+    expect(item).toBeInTheDocument();
+
+    fireEvent.click(item);
+    expect(mockNavigate).toHaveBeenCalledWith('/agents');
+    expect(mockHandleSelectModel).not.toHaveBeenCalled();
+  });
+
+  it('does not render agents as a selectable endpoint when marketplace and agent rows are unavailable', () => {
+    mockSelectedValues = { endpoint: '', model: '', modelSpec: '' };
+    render(
+      <SearchResults
+        results={[disabledAgentsEndpoint]}
+        localize={localize}
+        searchValue="my agents"
+      />,
+    );
+
+    expect(screen.queryByRole('menuitem', { name: 'My Agents' })).not.toBeInTheDocument();
+    expect(mockHandleSelectEndpoint).not.toHaveBeenCalled();
+  });
 });
diff --git a/client/src/components/Chat/Menus/Endpoints/components/__tests__/SpecDescription.spec.tsx b/client/src/components/Chat/Menus/Endpoints/components/__tests__/SpecDescription.spec.tsx
new file mode 100644
index 00000000000..524e1ff5837
--- /dev/null
+++ b/client/src/components/Chat/Menus/Endpoints/components/__tests__/SpecDescription.spec.tsx
@@ -0,0 +1,39 @@
+import { render, screen } from '@testing-library/react';
+import SpecDescription from '../SpecDescription';
+
+describe('SpecDescription', () => {
+  it('renders nothing without a description', () => {
+    const { container } = render(<SpecDescription />);
+
+    expect(container).toBeEmptyDOMElement();
+  });
+
+  it('renders plain text descriptions without interpreting markup', () => {
+    render(<SpecDescription description="Fast & accurate < 1s responses" />);
+
+    expect(screen.getByText('Fast & accurate < 1s responses')).toBeInTheDocument();
+  });
+
+  it('renders HTML descriptions with inline images', () => {
+    const { container } = render(
+      <SpecDescription description='<span>Powered by <img src="/assets/claude.png" alt="Claude" /> Claude</span>' />,
+    );
+
+    const image = container.querySelector('img');
+    expect(image).toHaveAttribute('src', '/assets/claude.png');
+    expect(image).toHaveAttribute('alt', 'Claude');
+    expect(container).toHaveTextContent('Powered by Claude');
+  });
+
+  it('strips scripts, event handlers, and unsafe URLs from HTML descriptions', () => {
+    const { container } = render(
+      <SpecDescription description='<span onclick="alert(1)">Safe<script>alert(1)</script><img src="javascript:alert(1)" onerror="alert(1)"></span>' />,
+    );
+
+    expect(container).toHaveTextContent('Safe');
+    expect(container.querySelector('script')).toBeNull();
+    expect(container.querySelector('[onclick]')).toBeNull();
+    expect(container.querySelector('[onerror]')).toBeNull();
+    expect(container.querySelector('img')?.getAttribute('src') ?? '').not.toContain('javascript');
+  });
+});
diff --git a/client/src/components/Chat/Menus/Endpoints/components/index.ts b/client/src/components/Chat/Menus/Endpoints/components/index.ts
index bc08e6a8a18..a2e3478bfdb 100644
--- a/client/src/components/Chat/Menus/Endpoints/components/index.ts
+++ b/client/src/components/Chat/Menus/Endpoints/components/index.ts
@@ -3,3 +3,4 @@ export * from './EndpointModelItem';
 export * from './EndpointItem';
 export * from './SearchResults';
 export * from './CustomGroup';
+export * from './Marketplace';
diff --git a/client/src/components/Chat/Menus/Endpoints/utils.ts b/client/src/components/Chat/Menus/Endpoints/utils.ts
index 1681ed7f1d6..474d3f23ea6 100644
--- a/client/src/components/Chat/Menus/Endpoints/utils.ts
+++ b/client/src/components/Chat/Menus/Endpoints/utils.ts
@@ -16,13 +16,17 @@ export function filterItems<
     label: string;
     name?: string;
     value?: string;
+    hasModels?: boolean;
     models?: Array<{ name: string; isGlobal?: boolean }>;
+    searchAliases?: string[];
+    showMarketplace?: boolean;
   },
 >(
   items: T[],
   searchValue: string,
   agentsMap: TAgentsMap | undefined,
   assistantsMap: TAssistantsMap | undefined,
+  localize?: ReturnType<typeof useLocalize>,
 ): T[] | null {
   const searchTermLower = searchValue.trim().toLowerCase();
   if (!searchTermLower) {
@@ -30,10 +34,20 @@ export function filterItems<
   }
 
   return items.filter((item) => {
+    if (!shouldRenderEndpointOption(item)) {
+      return false;
+    }
+
     const itemMatches =
       item.label.toLowerCase().includes(searchTermLower) ||
       (item.name && item.name.toLowerCase().includes(searchTermLower)) ||
-      (item.value && item.value.toLowerCase().includes(searchTermLower));
+      (item.value && item.value.toLowerCase().includes(searchTermLower)) ||
+      item.searchAliases?.some((alias) => alias.toLowerCase().includes(searchTermLower)) ||
+      (item.showMarketplace === true &&
+        localize != null &&
+        [localize('com_agents_marketplace'), localize('com_ui_marketplace')].some((label) =>
+          label.toLowerCase().includes(searchTermLower),
+        ));
 
     if (itemMatches) {
       return true;
@@ -67,6 +81,13 @@ export function filterItems<
   });
 }
 
+export function shouldRenderEndpointOption(endpoint: {
+  value?: string;
+  hasModels?: boolean;
+}): boolean {
+  return !isAgentsEndpoint(endpoint.value) || endpoint.hasModels === true;
+}
+
 export function filterModels(
   endpoint: Endpoint,
   models: string[],
diff --git a/client/src/components/Chat/Menus/Models/fakeData.ts b/client/src/components/Chat/Menus/Models/fakeData.ts
index 43d4cf489a2..6095dde6ef5 100644
--- a/client/src/components/Chat/Menus/Models/fakeData.ts
+++ b/client/src/components/Chat/Menus/Models/fakeData.ts
@@ -32,7 +32,7 @@ export const data: TModelSpec[] = [
     // iconURL: 'https://i.ytimg.com/vi/SaneSRqePVY/maxresdefault.jpg',
     iconURL: EModelEndpoint.openAI, // Allow using project-included icons
     preset: {
-      chatGptLabel: 'Vision Helper',
+      modelLabel: 'Vision Helper',
       greeting: "What's up!!",
       endpoint: EModelEndpoint.openAI,
       model: 'gpt-4-turbo',
diff --git a/client/src/components/Chat/Messages/Content/ContentParts.tsx b/client/src/components/Chat/Messages/Content/ContentParts.tsx
index 84e8ce3db86..00569c11f54 100644
--- a/client/src/components/Chat/Messages/Content/ContentParts.tsx
+++ b/client/src/components/Chat/Messages/Content/ContentParts.tsx
@@ -6,14 +6,14 @@ import type {
   TAttachment,
   Agents,
 } from 'librechat-data-provider';
+import type { ToolCallGroupExpansionState } from './ToolCallGroup';
 import { ParallelContentRenderer, type PartWithIndex } from './ParallelContent';
 import { mapAttachments, groupSequentialToolCalls } from '~/utils';
 import { MessageContext, SearchContext } from '~/Providers';
-import { EditTextPart, EmptyText } from './Parts';
 import PendingSkillCall from './Parts/PendingSkillCall';
+import { EditTextPart, EmptyText } from './Parts';
 import MemoryArtifacts from './MemoryArtifacts';
 import ToolCallGroup from './ToolCallGroup';
-import type { ToolCallGroupExpansionState } from './ToolCallGroup';
 import Container from './Container';
 import Part from './Part';
 
@@ -105,6 +105,8 @@ type ContentPartsProps = {
    * the full message object) so `React.memo` stays shallow-happy.
    */
   manualSkills?: string[];
+  /** ISO timestamp of the parent message, surfaced in parallel column headers. */
+  createdAt?: string | null;
   conversationId?: string | null;
   attachments?: TAttachment[];
   searchResults?: { [key: string]: SearchResultData };
@@ -142,6 +144,7 @@ const ContentParts = memo(function ContentParts({
   conversationId,
   isCreatedByUser,
   isLatestMessage,
+  createdAt,
 }: ContentPartsProps) {
   const attachmentMap = useMemo(() => mapAttachments(attachments ?? []), [attachments]);
   const effectiveIsSubmitting = isLatestMessage ? isSubmitting : false;
@@ -375,6 +378,7 @@ const ContentParts = memo(function ContentParts({
         <ParallelContentRenderer
           content={content}
           messageId={messageId}
+          createdAt={createdAt}
           conversationId={conversationId}
           attachments={attachments}
           searchResults={searchResults}
diff --git a/client/src/components/Chat/Messages/Content/Markdown.tsx b/client/src/components/Chat/Messages/Content/Markdown.tsx
index 1217869a2c3..54e01e11452 100644
--- a/client/src/components/Chat/Messages/Content/Markdown.tsx
+++ b/client/src/components/Chat/Messages/Content/Markdown.tsx
@@ -1,25 +1,9 @@
 import React, { memo, useMemo } from 'react';
-import remarkGfm from 'remark-gfm';
-import remarkMath from 'remark-math';
-import supersub from 'remark-supersub';
-import rehypeKatex from 'rehype-katex';
 import { useRecoilValue } from 'recoil';
-import ReactMarkdown from 'react-markdown';
-import rehypeHighlight from 'rehype-highlight';
-import remarkDirective from 'remark-directive';
-import type { Pluggable } from 'unified';
-import { Citation, CompositeCitation, HighlightedText } from '~/components/Web/Citation';
-import {
-  mcpUIResourcePlugin,
-  MCPUIResource,
-  MCPUIResourceCarousel,
-} from '~/components/MCPUIResource';
-import { Artifact, artifactPlugin } from '~/components/Artifacts/Artifact';
-import { ArtifactProvider, CodeBlockProvider } from '~/Providers';
+import { getRemarkPlugins, getRehypePlugins, getMarkdownComponents } from './markdownConfig';
 import MarkdownErrorBoundary from './MarkdownErrorBoundary';
-import { langSubset, preprocessLaTeX } from '~/utils';
-import { unicodeCitation } from '~/components/Web';
-import { code, a, p, img } from './MarkdownComponents';
+import MarkdownBlocks from './MarkdownBlocks';
+import { preprocessLaTeX } from '~/utils';
 import store from '~/store';
 
 type TContentProps = {
@@ -38,31 +22,6 @@ const Markdown = memo(function Markdown({ content = '', isLatestMessage }: TCont
     return LaTeXParsing ? preprocessLaTeX(content) : content;
   }, [content, LaTeXParsing, isInitializing]);
 
-  const rehypePlugins = useMemo(
-    () => [
-      [rehypeKatex],
-      [
-        rehypeHighlight,
-        {
-          detect: true,
-          ignoreMissing: true,
-          subset: langSubset,
-        },
-      ],
-    ],
-    [],
-  );
-
-  const remarkPlugins: Pluggable[] = [
-    supersub,
-    remarkGfm,
-    remarkDirective,
-    artifactPlugin,
-    [remarkMath, { singleDollarTextMath: false }],
-    unicodeCitation,
-    mcpUIResourcePlugin,
-  ];
-
   if (isInitializing) {
     return (
       <div className="absolute">
@@ -75,34 +34,12 @@ const Markdown = memo(function Markdown({ content = '', isLatestMessage }: TCont
 
   return (
     <MarkdownErrorBoundary content={content} codeExecution={true}>
-      <ArtifactProvider>
-        <CodeBlockProvider>
-          <ReactMarkdown
-            /** @ts-ignore */
-            remarkPlugins={remarkPlugins}
-            /* @ts-ignore */
-            rehypePlugins={rehypePlugins}
-            components={
-              {
-                code,
-                a,
-                p,
-                img,
-                artifact: Artifact,
-                citation: Citation,
-                'highlighted-text': HighlightedText,
-                'composite-citation': CompositeCitation,
-                'mcp-ui-resource': MCPUIResource,
-                'mcp-ui-carousel': MCPUIResourceCarousel,
-              } as {
-                [nodeType: string]: React.ElementType;
-              }
-            }
-          >
-            {currentContent}
-          </ReactMarkdown>
-        </CodeBlockProvider>
-      </ArtifactProvider>
+      <MarkdownBlocks
+        content={currentContent}
+        remarkPlugins={getRemarkPlugins()}
+        rehypePlugins={getRehypePlugins()}
+        components={getMarkdownComponents()}
+      />
     </MarkdownErrorBoundary>
   );
 });
diff --git a/client/src/components/Chat/Messages/Content/MarkdownBlocks.bench.tsx b/client/src/components/Chat/Messages/Content/MarkdownBlocks.bench.tsx
new file mode 100644
index 00000000000..3c664f4b0c0
--- /dev/null
+++ b/client/src/components/Chat/Messages/Content/MarkdownBlocks.bench.tsx
@@ -0,0 +1,165 @@
+import React, { Profiler } from 'react';
+import { RecoilRoot } from 'recoil';
+import ReactMarkdown from 'react-markdown';
+import { render } from '@testing-library/react';
+import { getRemarkPlugins, getRehypePlugins, getMarkdownComponents } from './markdownConfig';
+import { ArtifactProvider, CodeBlockProvider } from '~/Providers';
+import CodeBlock from '~/components/Messages/Content/CodeBlock';
+import Markdown from './Markdown';
+
+/**
+ * Streaming render benchmark comparing the previous whole-message renderer
+ * (one ReactMarkdown re-parsing everything per token) against the per-block
+ * memoized renderer. This file lives outside `__tests__/` and is named
+ * `.bench.tsx` so the default jest run skips it; execute it explicitly with:
+ *
+ *   node node_modules/jest/bin/jest.js --runInBand --coverage=false \
+ *     --testMatch '**\/MarkdownBlocks.bench.tsx'
+ *
+ * Two metrics are reported:
+ *  - codeBlockRenders: deterministic structural metric — how many times code
+ *    blocks render across the whole stream (the memoization win, noise-free).
+ *  - totalMs: summed React Profiler actualDuration (wall-clock; jsdom absolute
+ *    numbers are not browser-accurate, but the OLD/NEW ratio is indicative).
+ */
+
+jest.mock('~/components/Messages/Content/CodeBlock', () => ({
+  __esModule: true,
+  default: jest.fn(() => null),
+}));
+
+const codeBlockMock = CodeBlock as unknown as jest.Mock;
+
+const LANGS = ['python', 'javascript', 'typescript', 'bash', 'json', 'sql', 'go', 'rust'];
+
+const buildMessage = (sections: number): string => {
+  const parts: string[] = [];
+  for (let i = 0; i < sections; i += 1) {
+    parts.push(`## Section ${i + 1}`, '');
+    parts.push(
+      `This is paragraph ${i + 1} explaining the code below with some **bold** and ` +
+        `\`inline\` text, intentionally a bit long to add realistic reflow cost during ` +
+        `streaming, repeated across every section of the message.`,
+      '',
+    );
+    const lang = LANGS[i % LANGS.length];
+    parts.push('```' + lang);
+    for (let l = 0; l < 8; l += 1) {
+      parts.push(`const value_${i}_${l} = computeSomething(${l}, "arg_${l}"); // line ${l}`);
+    }
+    parts.push('```', '');
+    if (i % 3 === 0) {
+      parts.push('| Name | Type | Value |', '| --- | --- | --- |');
+      for (let r = 0; r < 5; r += 1) {
+        parts.push(`| item_${i}_${r} | number | ${r * i} |`);
+      }
+      parts.push('');
+    }
+  }
+  return parts.join('\n');
+};
+
+const makePrefixes = (content: string, steps: number): string[] => {
+  const prefixes: string[] = [];
+  for (let s = 1; s <= steps; s += 1) {
+    prefixes.push(content.slice(0, Math.ceil((content.length * s) / steps)));
+  }
+  return prefixes;
+};
+
+const OldMarkdown = ({ content }: { content: string }) => (
+  <ArtifactProvider>
+    <CodeBlockProvider>
+      <ReactMarkdown
+        /** @ts-ignore */
+        remarkPlugins={getRemarkPlugins()}
+        /** @ts-ignore */
+        rehypePlugins={getRehypePlugins()}
+        components={getMarkdownComponents()}
+      >
+        {content}
+      </ReactMarkdown>
+    </CodeBlockProvider>
+  </ArtifactProvider>
+);
+
+const NewMarkdown = ({ content }: { content: string }) => (
+  <Markdown content={content} isLatestMessage={true} />
+);
+
+const measure = (
+  Component: React.ComponentType<{ content: string }>,
+  prefixes: string[],
+): { totalMs: number; codeBlockRenders: number } => {
+  codeBlockMock.mockClear();
+  let totalMs = 0;
+  const onRender = (_id: string, _phase: string, actualDuration: number) => {
+    totalMs += actualDuration;
+  };
+  const tree = (content: string) => (
+    <Profiler id="bench" onRender={onRender}>
+      <RecoilRoot>
+        <Component content={content} />
+      </RecoilRoot>
+    </Profiler>
+  );
+  const { rerender, unmount } = render(tree(prefixes[0]));
+  for (let i = 1; i < prefixes.length; i += 1) {
+    rerender(tree(prefixes[i]));
+  }
+  const result = { totalMs, codeBlockRenders: codeBlockMock.mock.calls.length };
+  unmount();
+  return result;
+};
+
+describe('Markdown streaming benchmark (OLD whole-message vs NEW per-block)', () => {
+  it('reports render cost across a simulated stream', () => {
+    const content = buildMessage(12);
+    const steps = 80;
+    const prefixes = makePrefixes(content, steps);
+    const iterations = 3;
+
+    // Warm up module/highlight caches so the first measured run isn't skewed.
+    measure(OldMarkdown, prefixes);
+    measure(NewMarkdown, prefixes);
+
+    const old: Array<{ totalMs: number; codeBlockRenders: number }> = [];
+    const neu: Array<{ totalMs: number; codeBlockRenders: number }> = [];
+    for (let i = 0; i < iterations; i += 1) {
+      old.push(measure(OldMarkdown, prefixes));
+      neu.push(measure(NewMarkdown, prefixes));
+    }
+
+    const minMs = (rs: Array<{ totalMs: number }>) => Math.min(...rs.map((r) => r.totalMs));
+    const oldMs = minMs(old);
+    const newMs = minMs(neu);
+    const oldRenders = old[0].codeBlockRenders;
+    const newRenders = neu[0].codeBlockRenders;
+
+    console.log(
+      [
+        '',
+        '================ Markdown streaming benchmark ================',
+        `message size: ${content.length} chars, stream steps: ${steps}, iterations: ${iterations}`,
+        '',
+        `code-block renders over the stream (structural, noise-free):`,
+        `  OLD (whole-message): ${oldRenders}`,
+        `  NEW (per-block)    : ${newRenders}`,
+        `  reduction          : ${(100 * (1 - newRenders / oldRenders)).toFixed(1)}%`,
+        '',
+        `total render time (min of ${iterations}, summed Profiler actualDuration; jsdom):`,
+        `  OLD: ${oldMs.toFixed(1)} ms`,
+        `  NEW: ${newMs.toFixed(1)} ms`,
+        `  speedup: ${(oldMs / newMs).toFixed(2)}x`,
+        '=============================================================',
+        '',
+      ].join('\n'),
+    );
+
+    // Sanity: the per-block renderer must not render code blocks MORE than the
+    // whole-message renderer. The real win is asserted separately below.
+    expect(newRenders).toBeLessThanOrEqual(oldRenders);
+    // Memoization should cut total code-block renders by a wide margin.
+    expect(newRenders).toBeLessThan(oldRenders * 0.5);
+  });
+});
diff --git a/client/src/components/Chat/Messages/Content/MarkdownBlocks.tsx b/client/src/components/Chat/Messages/Content/MarkdownBlocks.tsx
new file mode 100644
index 00000000000..89f2fc76bd6
--- /dev/null
+++ b/client/src/components/Chat/Messages/Content/MarkdownBlocks.tsx
@@ -0,0 +1,110 @@
+import React, { memo, useMemo } from 'react';
+import ReactMarkdown from 'react-markdown';
+import type { PluggableList } from 'unified';
+import type { ElementType } from 'react';
+import { ArtifactProvider, CodeBlockProvider } from '~/Providers';
+import { splitMarkdownIntoBlocks } from './splitMarkdown';
+
+type SharedProps = {
+  remarkPlugins: PluggableList;
+  rehypePlugins: PluggableList;
+  components: { [nodeType: string]: ElementType };
+};
+
+type MarkdownBlockProps = SharedProps & {
+  content: string;
+  codeBaseIndex: number;
+  artifactBaseIndex: number;
+};
+
+/**
+ * Renders one top-level markdown block inside its own code/artifact providers,
+ * seeded with the running index of executable code blocks and artifacts in
+ * earlier blocks. Memoized on `content` and the base indices: a completed block
+ * whose source slice and bases are unchanged across streamed tokens skips both
+ * re-parsing and re-rendering, so only the final, still-growing block re-parses.
+ */
+const MarkdownBlock = memo(
+  function MarkdownBlock({
+    content,
+    codeBaseIndex,
+    artifactBaseIndex,
+    remarkPlugins,
+    rehypePlugins,
+    components,
+  }: MarkdownBlockProps) {
+    return (
+      <ArtifactProvider baseIndex={artifactBaseIndex}>
+        <CodeBlockProvider baseIndex={codeBaseIndex}>
+          <ReactMarkdown
+            /** @ts-ignore */
+            remarkPlugins={remarkPlugins}
+            /** @ts-ignore */
+            rehypePlugins={rehypePlugins}
+            components={components}
+          >
+            {content}
+          </ReactMarkdown>
+        </CodeBlockProvider>
+      </ArtifactProvider>
+    );
+  },
+  (prev, next) =>
+    prev.content === next.content &&
+    prev.codeBaseIndex === next.codeBaseIndex &&
+    prev.artifactBaseIndex === next.artifactBaseIndex,
+);
+MarkdownBlock.displayName = 'MarkdownBlock';
+
+type MarkdownBlocksProps = SharedProps & {
+  content: string;
+};
+
+/**
+ * Splits a message into top-level blocks and renders each independently so
+ * that, during streaming, only the last block re-parses while earlier blocks
+ * (tables, code, etc.) stay memoized. Each block's executable code and artifact
+ * indices are preserved in document order via per-block providers seeded with
+ * prefix-summed base indices.
+ */
+const MarkdownBlocks = memo(function MarkdownBlocks({
+  content,
+  remarkPlugins,
+  rehypePlugins,
+  components,
+}: MarkdownBlocksProps) {
+  const blocks = useMemo(() => {
+    let codeBaseIndex = 0;
+    let artifactBaseIndex = 0;
+    return splitMarkdownIntoBlocks(content).map((block) => {
+      const entry = { raw: block.raw, codeBaseIndex, artifactBaseIndex };
+      codeBaseIndex += block.codeBlockCount;
+      artifactBaseIndex += block.artifactCount;
+      return entry;
+    });
+  }, [content]);
+
+  return (
+    <>
+      {blocks.map((block, index) => (
+        // Key includes the base indices so that an in-place edit which inserts a
+        // block before existing code/artifact blocks (shifting their base) forces
+        // a remount, refreshing the index each code/artifact block captures in a
+        // ref. During append-only streaming these stay constant, so completed
+        // blocks keep a stable key and are not remounted.
+        <MarkdownBlock
+          key={`${index}-${block.codeBaseIndex}-${block.artifactBaseIndex}`}
+          content={block.raw}
+          codeBaseIndex={block.codeBaseIndex}
+          artifactBaseIndex={block.artifactBaseIndex}
+          remarkPlugins={remarkPlugins}
+          rehypePlugins={rehypePlugins}
+          components={components}
+        />
+      ))}
+    </>
+  );
+});
+MarkdownBlocks.displayName = 'MarkdownBlocks';
+
+export default MarkdownBlocks;
diff --git a/client/src/components/Chat/Messages/Content/MarkdownComponents.tsx b/client/src/components/Chat/Messages/Content/MarkdownComponents.tsx
index c38c40f1e10..5147dd2a9ac 100644
--- a/client/src/components/Chat/Messages/Content/MarkdownComponents.tsx
+++ b/client/src/components/Chat/Messages/Content/MarkdownComponents.tsx
@@ -185,6 +185,19 @@ export const p: React.ElementType = memo(function MarkdownParagraph({ children }
 });
 p.displayName = 'MarkdownParagraph';
 
+type TTableProps = {
+  children: React.ReactNode;
+};
+
+export const table: React.ElementType = memo(function MarkdownTable({ children }: TTableProps) {
+  return (
+    <div className="markdown-table-wrapper w-full max-w-full">
+      <table>{children}</table>
+    </div>
+  );
+});
+table.displayName = 'MarkdownTable';
+
 type TImageProps = {
   src?: string;
   alt?: string;
diff --git a/client/src/components/Chat/Messages/Content/MarkdownErrorBoundary.tsx b/client/src/components/Chat/Messages/Content/MarkdownErrorBoundary.tsx
index 0342c60f8a2..08d91a43b5e 100644
--- a/client/src/components/Chat/Messages/Content/MarkdownErrorBoundary.tsx
+++ b/client/src/components/Chat/Messages/Content/MarkdownErrorBoundary.tsx
@@ -4,9 +4,9 @@ import supersub from 'remark-supersub';
 import ReactMarkdown from 'react-markdown';
 import rehypeHighlight from 'rehype-highlight';
 import type { PluggableList } from 'unified';
-import { code, codeNoExecution, a, p } from './MarkdownComponents';
+import { code, codeNoExecution, a, p, table } from './MarkdownComponents';
+import { langSubset, remarkApproxTilde } from '~/utils';
 import { CodeBlockProvider } from '~/Providers';
-import { langSubset } from '~/utils';
 
 interface ErrorBoundaryState {
   hasError: boolean;
@@ -61,6 +61,7 @@ class MarkdownErrorBoundary extends React.Component<
         <CodeBlockProvider>
           <ReactMarkdown
             remarkPlugins={[
+              remarkApproxTilde,
               /** @ts-ignore */
               supersub,
               remarkGfm,
@@ -72,6 +73,7 @@ class MarkdownErrorBoundary extends React.Component<
                 code: codeExecution ? code : codeNoExecution,
                 a,
                 p,
+                table,
               } as {
                 [nodeType: string]: React.ElementType;
               }
diff --git a/client/src/components/Chat/Messages/Content/MarkdownLite.tsx b/client/src/components/Chat/Messages/Content/MarkdownLite.tsx
index 24980d8a90a..b9d70480d82 100644
--- a/client/src/components/Chat/Messages/Content/MarkdownLite.tsx
+++ b/client/src/components/Chat/Messages/Content/MarkdownLite.tsx
@@ -6,10 +6,10 @@ import supersub from 'remark-supersub';
 import ReactMarkdown from 'react-markdown';
 import rehypeHighlight from 'rehype-highlight';
 import type { PluggableList } from 'unified';
-import { code, codeNoExecution, a, p, img } from './MarkdownComponents';
+import { code, codeNoExecution, a, p, img, table } from './MarkdownComponents';
 import { CodeBlockProvider, ArtifactProvider } from '~/Providers';
 import MarkdownErrorBoundary from './MarkdownErrorBoundary';
-import { langSubset } from '~/utils';
+import { langSubset, remarkApproxTilde } from '~/utils';
 
 const MarkdownLite = memo(
   ({ content = '', codeExecution = true }: { content?: string; codeExecution?: boolean }) => {
@@ -31,6 +31,7 @@ const MarkdownLite = memo(
           <CodeBlockProvider>
             <ReactMarkdown
               remarkPlugins={[
+                remarkApproxTilde,
                 /** @ts-ignore */
                 supersub,
                 remarkGfm,
@@ -44,6 +45,7 @@ const MarkdownLite = memo(
                   a,
                   p,
                   img,
+                  table,
                 } as {
                   [nodeType: string]: React.ElementType;
                 }
diff --git a/client/src/components/Chat/Messages/Content/ParallelContent.tsx b/client/src/components/Chat/Messages/Content/ParallelContent.tsx
index 2c56bc04e3e..b1d75c86ef9 100644
--- a/client/src/components/Chat/Messages/Content/ParallelContent.tsx
+++ b/client/src/components/Chat/Messages/Content/ParallelContent.tsx
@@ -1,10 +1,10 @@
 import { memo, useMemo } from 'react';
 import type { TMessageContentParts, SearchResultData, TAttachment } from 'librechat-data-provider';
-import { SearchContext } from '~/Providers';
 import MemoryArtifacts from './MemoryArtifacts';
 import Sources from '~/components/Web/Sources';
-import { EmptyText } from './Parts';
+import { SearchContext } from '~/Providers';
 import SiblingHeader from './SiblingHeader';
+import { EmptyText } from './Parts';
 import Container from './Container';
 import { cn } from '~/utils';
 
@@ -137,6 +137,7 @@ type ParallelColumnsProps = {
   columns: ParallelColumn[];
   groupId: number;
   messageId: string;
+  createdAt?: string | null;
   isSubmitting: boolean;
   lastContentIdx: number;
   conversationId?: string | null;
@@ -150,6 +151,7 @@ export const ParallelColumns = memo(function ParallelColumns({
   columns,
   groupId,
   messageId,
+  createdAt,
   conversationId,
   isSubmitting,
   lastContentIdx,
@@ -169,6 +171,7 @@ export const ParallelColumns = memo(function ParallelColumns({
             <SiblingHeader
               agentId={agentId}
               messageId={messageId}
+              createdAt={createdAt}
               isSubmitting={isSubmitting}
               conversationId={conversationId}
             />
@@ -193,6 +196,7 @@ export const ParallelColumns = memo(function ParallelColumns({
 type ParallelContentRendererProps = {
   content?: Array<TMessageContentParts | undefined>;
   messageId: string;
+  createdAt?: string | null;
   conversationId?: string | null;
   attachments?: TAttachment[];
   searchResults?: { [key: string]: SearchResultData };
@@ -207,6 +211,7 @@ type ParallelContentRendererProps = {
 export const ParallelContentRenderer = memo(function ParallelContentRenderer({
   content,
   messageId,
+  createdAt,
   conversationId,
   attachments,
   searchResults,
@@ -253,6 +258,7 @@ export const ParallelContentRenderer = memo(function ParallelContentRenderer({
           columns={columns}
           groupId={groupId}
           messageId={messageId}
+          createdAt={createdAt}
           renderPart={renderPart}
           isSubmitting={isSubmitting}
           conversationId={conversationId}
diff --git a/client/src/components/Chat/Messages/Content/Part.tsx b/client/src/components/Chat/Messages/Content/Part.tsx
index a0502816f65..6df833370a8 100644
--- a/client/src/components/Chat/Messages/Content/Part.tsx
+++ b/client/src/components/Chat/Messages/Content/Part.tsx
@@ -18,6 +18,7 @@ import {
   Text,
   SkillCall,
   ReadFileCall,
+  FileAuthoringCall,
   BashCall,
   SubagentCall,
 } from './Parts';
@@ -230,6 +231,19 @@ const Part = memo(function Part({
           onExpand={onToolExpand}
         />
       );
+    } else if (isToolCall && (toolCall.name === 'create_file' || toolCall.name === 'edit_file')) {
+      return (
+        <FileAuthoringCall
+          toolName={toolCall.name}
+          args={toolCall.args}
+          output={toolCall.output ?? ''}
+          initialProgress={toolCall.progress ?? 0.1}
+          isSubmitting={isSubmitting}
+          attachments={attachments}
+          hideAttachments={hideAttachments}
+          onExpand={onToolExpand}
+        />
+      );
     } else if (isToolCall && toolCall.name === Tools.bash_tool) {
       return (
         <BashCall
diff --git a/client/src/components/Chat/Messages/Content/Parts/FileAuthoringCall.tsx b/client/src/components/Chat/Messages/Content/Parts/FileAuthoringCall.tsx
new file mode 100644
index 00000000000..ae8b6fe993c
--- /dev/null
+++ b/client/src/components/Chat/Messages/Content/Parts/FileAuthoringCall.tsx
@@ -0,0 +1,215 @@
+import { useMemo } from 'react';
+import { FilePenLine, FilePlus2 } from 'lucide-react';
+import type { TAttachment } from 'librechat-data-provider';
+import parseJsonField, { parseJsonFieldOccurrences } from './parseJsonField';
+import ProgressText from '~/components/Chat/Messages/Content/ProgressText';
+import useToolCallState from './useToolCallState';
+import useLazyHighlight from './useLazyHighlight';
+import CodeWindowHeader from './CodeWindowHeader';
+import { AttachmentGroup } from './Attachment';
+import { langFromPath } from './ReadFileCall';
+import { useLocalize } from '~/hooks';
+import { cn } from '~/utils';
+
+type FileAuthoringToolName = 'create_file' | 'edit_file';
+
+type ToolCallArgs = string | Record<string, unknown> | undefined;
+
+interface TextEditPreview {
+  oldText: string;
+  newText: string;
+}
+
+function hasDiff(output: string): boolean {
+  return /\n@@\s/.test(output) || output.includes('\n--- ') || output.includes('\n+++ ');
+}
+
+function parseArgsObject(args: ToolCallArgs): Record<string, unknown> | undefined {
+  if (typeof args === 'object' && args !== null) {
+    return args;
+  }
+  if (typeof args !== 'string') {
+    return undefined;
+  }
+  try {
+    const parsed = JSON.parse(args);
+    if (typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed)) {
+      return parsed as Record<string, unknown>;
+    }
+  } catch {
+    return undefined;
+  }
+  return undefined;
+}
+
+function textValue(value: unknown): string {
+  return typeof value === 'string' ? value : '';
+}
+
+function editPreviewLines(prefix: '-' | '+', text: string): string {
+  return text
+    .split('\n')
+    .map((line) => `${prefix}${line}`)
+    .join('\n');
+}
+
+function formatEditPreview(edits: TextEditPreview[]): string {
+  return edits
+    .map((edit, index) => {
+      const suffix = edits.length > 1 ? ` ${index + 1}` : '';
+      return [
+        `--- old_text${suffix}`,
+        `+++ new_text${suffix}`,
+        '@@',
+        editPreviewLines('-', edit.oldText),
+        editPreviewLines('+', edit.newText),
+      ].join('\n');
+    })
+    .join('\n\n');
+}
+
+function buildEditArgsPreview(args: ToolCallArgs): string {
+  const parsed = parseArgsObject(args);
+  if (Array.isArray(parsed?.edits) && parsed.edits.length > 0) {
+    const edits = parsed.edits
+      .map((edit): TextEditPreview | undefined => {
+        if (typeof edit !== 'object' || edit === null || Array.isArray(edit)) {
+          return undefined;
+        }
+        const entry = edit as Record<string, unknown>;
+        const oldText = textValue(entry.old_text);
+        const newText = textValue(entry.new_text);
+        return oldText || newText ? { oldText, newText } : undefined;
+      })
+      .filter((edit): edit is TextEditPreview => !!edit);
+    return formatEditPreview(edits);
+  }
+
+  if (parsed) {
+    const oldText = textValue(parsed.old_text);
+    const newText = textValue(parsed.new_text);
+    return oldText || newText ? formatEditPreview([{ oldText, newText }]) : '';
+  }
+
+  /** Partial JSON during streaming: pair up field occurrences in document order, covering both single-replacement and batched `edits` args */
+  const oldTexts = parseJsonFieldOccurrences(args, 'old_text');
+  const newTexts = parseJsonFieldOccurrences(args, 'new_text');
+  const editCount = Math.max(oldTexts.length, newTexts.length);
+  const edits = Array.from({ length: editCount }, (_, index) => ({
+    oldText: oldTexts[index] ?? '',
+    newText: newTexts[index] ?? '',
+  })).filter((edit) => edit.oldText || edit.newText);
+  return formatEditPreview(edits);
+}
+
+export default function FileAuthoringCall({
+  toolName,
+  isSubmitting,
+  initialProgress = 0.1,
+  args,
+  output = '',
+  attachments,
+  hideAttachments = false,
+  onExpand,
+}: {
+  toolName: FileAuthoringToolName;
+  initialProgress: number;
+  isSubmitting: boolean;
+  args?: string | Record<string, unknown>;
+  output?: string;
+  attachments?: TAttachment[];
+  hideAttachments?: boolean;
+  onExpand?: () => void;
+}) {
+  const localize = useLocalize();
+  const isCreate = toolName === 'create_file';
+  /** `create_file` can overwrite an existing file (sandbox `overwrite: true`,
+   *  or skill SKILL.md updates). The host-authored summary always opens with
+   *  `Created`/`Updated`, so key the finished label off it for truthfulness. */
+  const overwrote = isCreate && output.startsWith('Updated ');
+  const filePath = useMemo(() => parseJsonField(args, 'file_path'), [args]);
+  const authoredContent = useMemo(() => parseJsonField(args, 'content'), [args]);
+  const editArgsPreview = useMemo(() => buildEditArgsPreview(args), [args]);
+  const fileName = filePath.split('/').pop() || filePath;
+  const fileLang = useMemo(() => langFromPath(filePath), [filePath]);
+  const argsPreview = isCreate ? authoredContent : editArgsPreview;
+  const outputIsDiff = hasDiff(output);
+  /** A diff in the output supersedes the args preview — it carries the input with real file context */
+  const preview = outputIsDiff ? output : argsPreview || output;
+  const showOutputSection = !!output && preview !== output;
+  const previewIsDiff = outputIsDiff || (!isCreate && !!editArgsPreview && preview !== output);
+  let previewLang = 'plaintext';
+  if (previewIsDiff) {
+    previewLang = 'diff';
+  } else if (isCreate && authoredContent && preview === authoredContent) {
+    previewLang = fileLang;
+  }
+
+  const { showCode, toggleCode, expandStyle, expandRef, progress, cancelled, hasError } =
+    useToolCallState(initialProgress, isSubmitting, output, !!filePath || !!preview, onExpand);
+
+  const highlighted = useLazyHighlight(preview || undefined, previewLang);
+  const Icon = isCreate && !overwrote ? FilePlus2 : FilePenLine;
+  let finishedKey: 'com_ui_created_file' | 'com_ui_updated_file' | 'com_ui_edited_file' =
+    'com_ui_edited_file';
+  if (isCreate) {
+    finishedKey = overwrote ? 'com_ui_updated_file' : 'com_ui_created_file';
+  }
+
+  return (
+    <>
+      <div className="relative my-1.5 flex size-5 shrink-0 items-center gap-2.5">
+        <ProgressText
+          progress={progress}
+          onClick={toggleCode}
+          inProgressText={localize(isCreate ? 'com_ui_creating_file' : 'com_ui_editing_file', {
+            0: fileName,
+          })}
+          finishedText={
+            cancelled ? localize('com_ui_cancelled') : localize(finishedKey, { 0: fileName })
+          }
+          errorSuffix={hasError && !cancelled ? localize('com_ui_tool_failed') : undefined}
+          icon={
+            <Icon
+              className={cn(
+                'size-4 shrink-0 text-text-secondary',
+                progress < 1 && !cancelled && !hasError && 'animate-pulse',
+              )}
+              aria-hidden="true"
+            />
+          }
+          hasInput={!!filePath || !!preview}
+          isExpanded={showCode}
+          error={cancelled}
+        />
+      </div>
+      <div style={expandStyle}>
+        <div className="overflow-hidden" ref={expandRef}>
+          {!!preview && (
+            <div className="my-2 overflow-hidden rounded-lg border border-border-light bg-surface-secondary">
+              <CodeWindowHeader language={previewIsDiff ? 'diff' : fileName} code={preview} />
+              <pre className="max-h-[300px] overflow-auto bg-surface-chat p-4 font-mono text-xs dark:bg-surface-primary-alt">
+                <code className={`hljs language-${previewLang} !whitespace-pre`}>
+                  {highlighted ?? preview}
+                </code>
+              </pre>
+              {showOutputSection && (
+                <pre
+                  className={cn(
+                    'max-h-[300px] overflow-auto whitespace-pre-wrap break-words border-t border-border-light px-3 py-2.5 font-mono text-xs',
+                    hasError ? 'text-red-600 dark:text-red-400' : 'text-text-primary',
+                  )}
+                >
+                  {output}
+                </pre>
+              )}
+            </div>
+          )}
+        </div>
+      </div>
+      {!hideAttachments && attachments && attachments.length > 0 && (
+        <AttachmentGroup attachments={attachments} />
+      )}
+    </>
+  );
+}
diff --git a/client/src/components/Chat/Messages/Content/Parts/__tests__/ArtifactRouting.test.tsx b/client/src/components/Chat/Messages/Content/Parts/__tests__/ArtifactRouting.test.tsx
index 70a1661dcb2..555c8c6ffe6 100644
--- a/client/src/components/Chat/Messages/Content/Parts/__tests__/ArtifactRouting.test.tsx
+++ b/client/src/components/Chat/Messages/Content/Parts/__tests__/ArtifactRouting.test.tsx
@@ -1,8 +1,8 @@
 import React from 'react';
-import { render, screen, fireEvent, act } from '@testing-library/react';
 import { RecoilRoot, useRecoilValue } from 'recoil';
-import type { MutableSnapshot } from 'recoil';
+import { render, screen, fireEvent, act } from '@testing-library/react';
 import type { TAttachment } from 'librechat-data-provider';
+import type { MutableSnapshot } from 'recoil';
 import Attachment, { AttachmentGroup } from '../Attachment';
 import store from '~/store';
 
@@ -198,9 +198,8 @@ describe('Attachment routing for tool artifacts', () => {
      * yet); use it as the canonical "unrouted text" example. */
     const json = baseAttachment({
       filename: 'data.json',
-      type: 'application/json',
       text: '{"a":1,"b":2}',
-    } as Partial<TAttachment>);
+    });
     const { container } = renderWith(<Attachment attachment={json} />);
     expect(container.querySelector('pre')).not.toBeNull();
     expect(screen.queryByTestId('mermaid-render')).not.toBeInTheDocument();
@@ -544,10 +543,9 @@ describe('ToolArtifactCard click behaviour', () => {
     const xlsx = baseAttachment({
       file_id: 'just-resolved-xlsx',
       filename: 'data.xlsx',
-      type: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
       text: '<table>resolved</table>',
       textFormat: 'html',
-    } as Partial<TAttachment>);
+    });
     const initializeState = (snap: MutableSnapshot) => {
       snap.set(store.isSubmittingFamily(0), false);
       snap.set(store.artifactsVisibility, false);
@@ -580,10 +578,9 @@ describe('ToolArtifactCard click behaviour', () => {
     const xlsx = baseAttachment({
       file_id: 'one-shot-xlsx',
       filename: 'data.xlsx',
-      type: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
       text: '<table>resolved</table>',
       textFormat: 'html',
-    } as Partial<TAttachment>);
+    });
     const initializeState = (snap: MutableSnapshot) => {
       snap.set(store.isSubmittingFamily(0), false);
       snap.set(store.artifactsVisibility, false);
@@ -710,15 +707,13 @@ describe('AttachmentGroup routing', () => {
     const empty = baseAttachment({
       file_id: 'empty-zip',
       filename: 'placeholder.zip',
-      type: 'application/zip',
       bytes: 0,
-    } as Partial<TAttachment>);
+    });
     const real = baseAttachment({
       file_id: 'real-zip',
       filename: 'archive.zip',
-      type: 'application/zip',
       bytes: 1024,
-    } as Partial<TAttachment>);
+    });
     const { container } = renderWith(<AttachmentGroup attachments={[empty, real]} />);
     fireEvent.click(screen.getByRole('button', { name: 'com_ui_show_n_files' }));
     const chips = Array.from(container.querySelectorAll('[data-testid="file-container"]'));
@@ -733,26 +728,22 @@ describe('AttachmentGroup routing', () => {
     const first = baseAttachment({
       file_id: 'file-a',
       filename: 'a.zip',
-      type: 'application/zip',
-    } as Partial<TAttachment>);
+    });
     const second = baseAttachment({
       file_id: 'file-b',
       filename: 'b.zip',
-      type: 'application/zip',
-    } as Partial<TAttachment>);
+    });
     const json = baseAttachment({
       file_id: 'file-c',
       filename: 'c.json',
-      type: 'application/json',
       text: '{"c":true}',
-    } as Partial<TAttachment>);
+    });
     const image = baseAttachment({
       file_id: 'image-a',
       filename: 'preview.png',
-      type: 'image/png',
       width: 16,
       height: 16,
-    } as Partial<TAttachment>);
+    });
 
     const { container } = renderWith(
       <AttachmentGroup attachments={[first, second, json, image]} />,
@@ -784,9 +775,8 @@ describe('AttachmentGroup routing', () => {
     const sandboxFile = baseAttachment({
       file_id: 'sandbox-zip',
       filename: 'archive-deadbe.zip',
-      type: 'application/zip',
       bytes: 1024,
-    } as Partial<TAttachment>);
+    });
     const { container } = renderWith(<AttachmentGroup attachments={[sandboxFile]} />);
     const chip = container.querySelector('[data-testid="file-container"]');
     expect(chip?.textContent).toBe('archive-deadbe.zip');
@@ -802,9 +792,8 @@ describe('AttachmentGroup routing', () => {
     const sandboxDotfile = baseAttachment({
       file_id: 'sandbox-config',
       filename: '_.config-abcdef.zip',
-      type: 'application/zip',
       bytes: 12,
-    } as Partial<TAttachment>);
+    });
     const { container } = renderWith(<AttachmentGroup attachments={[sandboxDotfile]} />);
     const chip = container.querySelector('[data-testid="file-container"]');
     expect(chip?.textContent).toBe('.config.zip');
@@ -823,7 +812,6 @@ describe('AttachmentGroup routing', () => {
       baseAttachment({
         file_id: 'pending-1',
         filename: 'data.xlsx',
-        type: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
         status: 'pending',
       } as Partial<TAttachment>),
       baseAttachment({
@@ -859,7 +847,6 @@ describe('AttachmentGroup routing', () => {
       baseAttachment({
         file_id: 'c',
         filename: 'data.json',
-        type: 'application/json',
         text: '{"a":1}',
       } as Partial<TAttachment>),
       baseAttachment({
diff --git a/client/src/components/Chat/Messages/Content/Parts/__tests__/FileAuthoringCall.test.tsx b/client/src/components/Chat/Messages/Content/Parts/__tests__/FileAuthoringCall.test.tsx
new file mode 100644
index 00000000000..a57a00c9540
--- /dev/null
+++ b/client/src/components/Chat/Messages/Content/Parts/__tests__/FileAuthoringCall.test.tsx
@@ -0,0 +1,281 @@
+import React from 'react';
+import { render, screen } from '@testing-library/react';
+import FileAuthoringCall from '../FileAuthoringCall';
+
+jest.mock('~/hooks', () => ({
+  useLocalize:
+    () =>
+    (key: string, values?: Record<string | number, string>): string => {
+      const translations: Record<string, string> = {
+        com_ui_created_file: 'Created {{0}}',
+        com_ui_creating_file: 'Creating {{0}}',
+        com_ui_updated_file: 'Updated {{0}}',
+        com_ui_edited_file: 'Edited {{0}}',
+        com_ui_editing_file: 'Editing {{0}}',
+        com_ui_cancelled: 'Cancelled',
+        com_ui_tool_failed: 'failed',
+      };
+      return (translations[key] ?? key).replace('{{0}}', values?.[0] ?? '');
+    },
+}));
+
+jest.mock('~/utils', () => ({
+  cn: (...classes: Array<string | false | null | undefined>) => classes.filter(Boolean).join(' '),
+}));
+
+jest.mock('~/components/Chat/Messages/Content/ProgressText', () => ({
+  __esModule: true,
+  default: ({
+    progress,
+    inProgressText,
+    finishedText,
+  }: {
+    progress: number;
+    inProgressText: string;
+    finishedText: string;
+  }) => <div data-testid="progress-text">{progress < 1 ? inProgressText : finishedText}</div>,
+}));
+
+jest.mock('../CodeWindowHeader', () => ({
+  __esModule: true,
+  default: ({ language }: { language: string }) => (
+    <div data-testid="code-window-header" data-language={language} />
+  ),
+}));
+
+jest.mock('../Attachment', () => ({
+  AttachmentGroup: () => <div data-testid="attachment-group" />,
+}));
+
+jest.mock('../useLazyHighlight', () => ({
+  __esModule: true,
+  default: () => null,
+}));
+
+jest.mock('../useToolCallState', () => ({
+  __esModule: true,
+  default: (initialProgress: number) => ({
+    showCode: true,
+    toggleCode: jest.fn(),
+    expandStyle: {},
+    expandRef: { current: null },
+    progress: initialProgress,
+    cancelled: false,
+    hasError: false,
+  }),
+}));
+
+describe('FileAuthoringCall', () => {
+  it('shows create_file content args while the call is in progress', () => {
+    render(
+      <FileAuthoringCall
+        toolName="create_file"
+        initialProgress={0.5}
+        isSubmitting={true}
+        args={{
+          file_path: 'skills/demo/SKILL.md',
+          content: '# Demo\n\nUse this skill for testing.',
+        }}
+        output=""
+      />,
+    );
+
+    expect(screen.getByTestId('progress-text')).toHaveTextContent('Creating SKILL.md');
+    expect(screen.getByTestId('code-window-header')).toHaveAttribute('data-language', 'SKILL.md');
+    expect(screen.getByText(/Use this skill for testing/)).toBeInTheDocument();
+  });
+
+  it('keeps authored content visible alongside the output after create_file completes', () => {
+    render(
+      <FileAuthoringCall
+        toolName="create_file"
+        initialProgress={1}
+        isSubmitting={false}
+        args={{
+          file_path: 'skills/demo/SKILL.md',
+          content: '# Demo\n\nLarge generated body stays visible after completion.',
+        }}
+        output="Created skills/demo/SKILL.md (4096 chars)."
+      />,
+    );
+
+    expect(screen.getByTestId('progress-text')).toHaveTextContent('Created SKILL.md');
+    expect(screen.getByTestId('code-window-header')).toHaveAttribute('data-language', 'SKILL.md');
+    expect(screen.getByText(/Large generated body stays visible/)).toBeInTheDocument();
+    expect(screen.getByText('Created skills/demo/SKILL.md (4096 chars).')).toBeInTheDocument();
+  });
+
+  it('labels a create_file overwrite as Updated when the output summary says so', () => {
+    render(
+      <FileAuthoringCall
+        toolName="create_file"
+        initialProgress={1}
+        isSubmitting={false}
+        args={{
+          file_path: 'skills/demo/SKILL.md',
+          content: '# Demo\n\nRevised body.',
+        }}
+        output="Updated skills/demo/SKILL.md (8302 chars)."
+      />,
+    );
+
+    expect(screen.getByTestId('progress-text')).toHaveTextContent('Updated SKILL.md');
+  });
+
+  it('prefers the output diff over the args preview after edit_file completes', () => {
+    const output = [
+      'Edited skills/demo/SKILL.md (exact match).',
+      '',
+      '--- skills/demo/SKILL.md',
+      '+++ skills/demo/SKILL.md',
+      '@@ -1,1 +1,1 @@',
+      '-old line',
+      '+new line',
+    ].join('\n');
+    render(
+      <FileAuthoringCall
+        toolName="edit_file"
+        initialProgress={1}
+        isSubmitting={false}
+        args={{
+          file_path: 'skills/demo/SKILL.md',
+          old_text: 'old line',
+          new_text: 'new line',
+        }}
+        output={output}
+      />,
+    );
+
+    const preview = screen.getByText((_, element) => element?.tagName.toLowerCase() === 'code');
+    expect(preview).toHaveTextContent('-old line');
+    expect(preview).toHaveTextContent('+new line');
+    expect(screen.queryByText(/--- old_text/)).not.toBeInTheDocument();
+  });
+
+  it('shows the attempted input alongside the error output when edit_file fails', () => {
+    render(
+      <FileAuthoringCall
+        toolName="edit_file"
+        initialProgress={1}
+        isSubmitting={false}
+        args={{
+          file_path: 'skills/demo/SKILL.md',
+          old_text: 'missing text',
+          new_text: 'replacement',
+        }}
+        output="Error: old_text matched 0 locations in skills/demo/SKILL.md."
+      />,
+    );
+
+    const preview = screen.getByText((_, element) => element?.tagName.toLowerCase() === 'code');
+    expect(preview).toHaveTextContent('-missing text');
+    expect(preview).toHaveTextContent('+replacement');
+    expect(screen.getByText(/matched 0 locations/)).toBeInTheDocument();
+  });
+
+  it('shows edit_file replacement args while the call is in progress', () => {
+    render(
+      <FileAuthoringCall
+        toolName="edit_file"
+        initialProgress={0.5}
+        isSubmitting={true}
+        args={{
+          file_path: 'skills/demo/SKILL.md',
+          old_text: 'description: Old behavior',
+          new_text: 'description: New behavior',
+        }}
+        output=""
+      />,
+    );
+
+    expect(screen.getByTestId('progress-text')).toHaveTextContent('Editing SKILL.md');
+    expect(screen.getByTestId('code-window-header')).toHaveAttribute('data-language', 'diff');
+    const preview = screen.getByText((_, element) => element?.tagName.toLowerCase() === 'code');
+    expect(preview).toHaveTextContent('--- old_text');
+    expect(preview).toHaveTextContent('+++ new_text');
+    expect(preview).toHaveTextContent('-description: Old behavior');
+    expect(preview).toHaveTextContent('+description: New behavior');
+  });
+
+  it('streams create_file content from partial JSON string args during run_step_delta', () => {
+    render(
+      <FileAuthoringCall
+        toolName="create_file"
+        initialProgress={0.5}
+        isSubmitting={true}
+        args={'{"file_path":"skills/demo/SKILL.md","content":"# Demo\\n\\nStreaming body so far'}
+        output=""
+      />,
+    );
+
+    expect(screen.getByTestId('progress-text')).toHaveTextContent('Creating SKILL.md');
+    expect(screen.getByTestId('code-window-header')).toHaveAttribute('data-language', 'SKILL.md');
+    expect(screen.getByText(/Streaming body so far/)).toBeInTheDocument();
+  });
+
+  it('streams edit_file replacement preview from partial JSON string args', () => {
+    render(
+      <FileAuthoringCall
+        toolName="edit_file"
+        initialProgress={0.5}
+        isSubmitting={true}
+        args={
+          '{"file_path":"skills/demo/SKILL.md","old_text":"description: Old behavior","new_text":"description: New beh'
+        }
+        output=""
+      />,
+    );
+
+    const preview = screen.getByText((_, element) => element?.tagName.toLowerCase() === 'code');
+    expect(preview).toHaveTextContent('-description: Old behavior');
+    expect(preview).toHaveTextContent('+description: New beh');
+  });
+
+  it('streams batched edit_file previews from a partial edits array', () => {
+    const args =
+      '{"file_path":"skills/demo/SKILL.md","edits":[' +
+      '{"old_text":"first old","new_text":"first new"},' +
+      '{"old_text":"second old","new_text":"second n';
+    render(
+      <FileAuthoringCall
+        toolName="edit_file"
+        initialProgress={0.5}
+        isSubmitting={true}
+        args={args}
+        output=""
+      />,
+    );
+
+    const preview = screen.getByText((_, element) => element?.tagName.toLowerCase() === 'code');
+    expect(preview).toHaveTextContent('--- old_text 1');
+    expect(preview).toHaveTextContent('-first old');
+    expect(preview).toHaveTextContent('+first new');
+    expect(preview).toHaveTextContent('--- old_text 2');
+    expect(preview).toHaveTextContent('-second old');
+    expect(preview).toHaveTextContent('+second n');
+  });
+
+  it('shows batched edit_file replacements from edits args while the call is in progress', () => {
+    render(
+      <FileAuthoringCall
+        toolName="edit_file"
+        initialProgress={0.5}
+        isSubmitting={true}
+        args={{
+          file_path: 'skills/demo/SKILL.md',
+          edits: [
+            { old_text: 'first old', new_text: 'first new' },
+            { old_text: 'second old', new_text: 'second new' },
+          ],
+        }}
+        output=""
+      />,
+    );
+
+    const preview = screen.getByText((_, element) => element?.tagName.toLowerCase() === 'code');
+    expect(preview).toHaveTextContent('--- old_text 1');
+    expect(preview).toHaveTextContent('+++ new_text 2');
+    expect(preview).toHaveTextContent('-first old');
+    expect(preview).toHaveTextContent('+second new');
+  });
+});
diff --git a/client/src/components/Chat/Messages/Content/Parts/__tests__/LogContent.test.tsx b/client/src/components/Chat/Messages/Content/Parts/__tests__/LogContent.test.tsx
index bb34bb1deeb..19feccef2cf 100644
--- a/client/src/components/Chat/Messages/Content/Parts/__tests__/LogContent.test.tsx
+++ b/client/src/components/Chat/Messages/Content/Parts/__tests__/LogContent.test.tsx
@@ -1,8 +1,8 @@
 import React from 'react';
-import { render, screen } from '@testing-library/react';
 import { RecoilRoot } from 'recoil';
-import type { MutableSnapshot } from 'recoil';
+import { render, screen } from '@testing-library/react';
 import type { TAttachment } from 'librechat-data-provider';
+import type { MutableSnapshot } from 'recoil';
 import LogContent from '../LogContent';
 import store from '~/store';
 
@@ -110,9 +110,8 @@ describe('LogContent attachment routing', () => {
     const json = baseAttachment({
       file_id: 'c',
       filename: 'data.json',
-      type: 'application/json',
       text: '{"a":1,"b":2}',
-    } as Partial<TAttachment>);
+    });
     const { container } = renderWith(<LogContent output="" attachments={[json]} />);
     expect(container.querySelector('pre')).not.toBeNull();
     expect(screen.queryByRole('button', { pressed: true })).not.toBeInTheDocument();
@@ -123,8 +122,7 @@ describe('LogContent attachment routing', () => {
     const zip = baseAttachment({
       file_id: 'd',
       filename: 'archive.zip',
-      type: 'application/zip',
-    } as Partial<TAttachment>);
+    });
     renderWith(<LogContent output="" attachments={[zip]} />);
     expect(screen.getByTestId('log-link')).toHaveAttribute('data-filename', 'archive.zip');
   });
@@ -137,9 +135,8 @@ describe('LogContent attachment routing', () => {
     const pptx = baseAttachment({
       file_id: 'e',
       filename: 'slides.pptx',
-      type: 'application/vnd.openxmlformats-officedocument.presentationml.presentation',
       text: '<!DOCTYPE html><body><ol><li>Slide 1</li></ol></body>',
-    } as Partial<TAttachment>);
+    });
     renderWith(<LogContent output="" attachments={[pptx]} />);
     expect(screen.getByText('slides.pptx')).toBeInTheDocument();
   });
@@ -151,9 +148,8 @@ describe('LogContent attachment routing', () => {
     const pptx = baseAttachment({
       file_id: 'e2',
       filename: 'slides.pptx',
-      type: 'application/vnd.openxmlformats-officedocument.presentationml.presentation',
-      text: undefined as unknown as string,
-    } as Partial<TAttachment>);
+      text: undefined,
+    });
     renderWith(<LogContent output="" attachments={[pptx]} />);
     expect(screen.queryByRole('button', { pressed: true })).not.toBeInTheDocument();
     expect(screen.getByTestId('log-link')).toHaveAttribute('data-filename', 'slides.pptx');
@@ -168,10 +164,9 @@ describe('LogContent attachment routing', () => {
     const expired = baseAttachment({
       file_id: 'x-expired',
       filename: 'slides.pptx',
-      type: 'application/vnd.openxmlformats-officedocument.presentationml.presentation',
       text: '<!DOCTYPE html><body><ol><li>Slide 1</li></ol></body>',
       expiresAt: Date.now() - 60_000,
-    } as Partial<TAttachment>);
+    });
     renderWith(<LogContent output="" attachments={[expired]} />);
     // No panel card and no log-link (the expired branch returns plain text).
     expect(screen.queryByRole('button', { pressed: true })).not.toBeInTheDocument();
@@ -211,7 +206,6 @@ describe('LogContent attachment routing', () => {
          * bucket, so it would no longer satisfy the "inline pre" check
          * below. */
         filename: 'notes.json',
-        type: 'application/json',
         text: '{"a":1,"b":2}',
       } as Partial<TAttachment>),
     ] as TAttachment[];
diff --git a/client/src/components/Chat/Messages/Content/Parts/__tests__/SubagentCall.test.tsx b/client/src/components/Chat/Messages/Content/Parts/__tests__/SubagentCall.test.tsx
index f78f71d75b3..2b968071add 100644
--- a/client/src/components/Chat/Messages/Content/Parts/__tests__/SubagentCall.test.tsx
+++ b/client/src/components/Chat/Messages/Content/Parts/__tests__/SubagentCall.test.tsx
@@ -8,15 +8,14 @@ import type {
   SubagentAggregatorState,
 } from '~/utils/subagentContent';
 import type { SubagentProgress } from '~/store/subagents';
-
 import {
   foldSubagentEvent,
   foldSubagentEventIntoTicker,
   initSubagentAggregatorState,
   initSubagentTickerState,
 } from '~/utils/subagentContent';
-import { subagentProgressByToolCallId } from '~/store/subagents';
 import SubagentCall, { SUBAGENT_TICKER_THROTTLE_MS } from '../SubagentCall';
+import { subagentProgressByToolCallId } from '~/store/subagents';
 
 jest.mock('~/hooks', () => ({
   useLocalize:
@@ -622,7 +621,7 @@ describe('SubagentCall — dialog content', () => {
     );
     openSubagentDialog();
     expect(screen.getByText('raw final text')).toBeInTheDocument();
-    rerender(<RecoilRoot />);
+    rerender(<RecoilRoot>{null}</RecoilRoot>);
   });
 
   it('renders persistedContent parts when no live events are available (page-refresh flow)', () => {
diff --git a/client/src/components/Chat/Messages/Content/Parts/__tests__/TextAttachment.test.tsx b/client/src/components/Chat/Messages/Content/Parts/__tests__/TextAttachment.test.tsx
index 6996550c523..aaf388b080c 100644
--- a/client/src/components/Chat/Messages/Content/Parts/__tests__/TextAttachment.test.tsx
+++ b/client/src/components/Chat/Messages/Content/Parts/__tests__/TextAttachment.test.tsx
@@ -71,7 +71,6 @@ const textAttachment = (overrides: Partial<TAttachment> = {}): TAttachment =>
      * bearing, downloadable, expandable) without the panel coupling. */
     filename: 'output.json',
     filepath: '/files/output.json',
-    type: 'application/json',
     text: '{"a":1,"b":2,"c":3}',
     ...overrides,
   }) as TAttachment;
@@ -190,8 +189,7 @@ describe('AttachmentGroup', () => {
       textAttachment({
         file_id: 'b',
         filename: 'archive.zip',
-        type: 'application/zip',
-        text: undefined as unknown as string,
+        text: undefined,
       }),
     ] as TAttachment[];
     const { container } = render(<AttachmentGroup attachments={attachments} />);
@@ -205,8 +203,7 @@ describe('AttachmentGroup', () => {
         file_id: 'placeholder',
         filename: 'placeholder.zip',
         filepath: '',
-        type: 'application/zip',
-        text: undefined as unknown as string,
+        text: undefined,
       }),
       textAttachment({
         file_id: 'json',
@@ -230,8 +227,7 @@ describe('AttachmentGroup', () => {
       textAttachment({
         file_id: 'archive',
         filename: 'archive.zip',
-        type: 'application/zip',
-        text: undefined as unknown as string,
+        text: undefined,
       }),
       textAttachment({
         file_id: 'json',
diff --git a/client/src/components/Chat/Messages/Content/Parts/__tests__/attachmentTypes.test.ts b/client/src/components/Chat/Messages/Content/Parts/__tests__/attachmentTypes.test.ts
index 02113c8a255..f624097f594 100644
--- a/client/src/components/Chat/Messages/Content/Parts/__tests__/attachmentTypes.test.ts
+++ b/client/src/components/Chat/Messages/Content/Parts/__tests__/attachmentTypes.test.ts
@@ -1,5 +1,4 @@
 import type { TAttachment } from 'librechat-data-provider';
-import { TOOL_ARTIFACT_TYPES } from '~/utils/artifacts';
 import {
   artifactTypeForAttachment,
   attachmentSalience,
@@ -8,6 +7,7 @@ import {
   isInternalSandboxArtifact,
   isTextAttachment,
 } from '../attachmentTypes';
+import { TOOL_ARTIFACT_TYPES } from '~/utils/artifacts';
 
 const baseAttachment = (overrides: Partial<TAttachment> = {}): TAttachment =>
   ({
@@ -138,9 +138,8 @@ describe('artifactTypeForAttachment', () => {
      * pipeline instead. */
     const attachment = baseAttachment({
       filename: 'photo.jpg',
-      type: 'image/jpeg',
       text: undefined,
-    } as Partial<TAttachment>);
+    });
     expect(artifactTypeForAttachment(attachment)).toBeNull();
   });
 });
diff --git a/client/src/components/Chat/Messages/Content/Parts/__tests__/parseJsonField.test.ts b/client/src/components/Chat/Messages/Content/Parts/__tests__/parseJsonField.test.ts
index 0d02d9b8361..facffb222f9 100644
--- a/client/src/components/Chat/Messages/Content/Parts/__tests__/parseJsonField.test.ts
+++ b/client/src/components/Chat/Messages/Content/Parts/__tests__/parseJsonField.test.ts
@@ -1,4 +1,7 @@
-import parseJsonField, { areToolCallArgsComplete } from '../parseJsonField';
+import parseJsonField, {
+  parseJsonFieldOccurrences,
+  areToolCallArgsComplete,
+} from '../parseJsonField';
 
 describe('parseJsonField', () => {
   describe('object args', () => {
@@ -100,6 +103,71 @@ describe('parseJsonField', () => {
       expect(parseJsonField(partial, 'command')).toBe('tab\\there');
     });
   });
+
+  describe('in-progress streaming fields — unterminated values', () => {
+    it('extracts a field whose closing quote has not streamed in yet', () => {
+      const partial = '{"file_path":"skills/demo/SKILL.md","content":"# Demo\\nline two';
+      expect(parseJsonField(partial, 'content')).toBe('# Demo\nline two');
+    });
+
+    it('grows the extracted value as more deltas arrive', () => {
+      const full = '{"file_path":"a.md","content":"# Title\\n\\nBody text here"}';
+      const lengths = [40, 48, 56, full.length];
+      const values = lengths.map((len) => parseJsonField(full.slice(0, len), 'content'));
+      expect(values[values.length - 1]).toBe('# Title\n\nBody text here');
+      values.slice(1).forEach((value, index) => {
+        expect(value.startsWith(values[index])).toBe(true);
+      });
+    });
+
+    it('drops a dangling backslash from a partially streamed escape', () => {
+      const partial = '{"content":"line one\\';
+      expect(parseJsonField(partial, 'content')).toBe('line one');
+    });
+
+    it('unescapes a complete escaped backslash at the stream edge', () => {
+      const partial = '{"content":"path C:\\\\';
+      expect(parseJsonField(partial, 'content')).toBe('path C:\\');
+    });
+
+    it('handles escaped quotes inside an unterminated value', () => {
+      const partial = '{"command":"say \\"hi';
+      expect(parseJsonField(partial, 'command')).toBe('say "hi');
+    });
+
+    it('returns empty string when the value has not opened yet', () => {
+      expect(parseJsonField('{"content":', 'content')).toBe('');
+      expect(parseJsonField('{"content":"', 'content')).toBe('');
+    });
+
+    it('does not run past a completed field into later args', () => {
+      const partial = '{"old_text":"keep this","new_text":"and th';
+      expect(parseJsonField(partial, 'old_text')).toBe('keep this');
+      expect(parseJsonField(partial, 'new_text')).toBe('and th');
+    });
+  });
+});
+
+describe('parseJsonFieldOccurrences', () => {
+  it('returns empty array for non-string args', () => {
+    expect(parseJsonFieldOccurrences(undefined, 'old_text')).toEqual([]);
+    expect(parseJsonFieldOccurrences({ old_text: 'x' }, 'old_text')).toEqual([]);
+    expect(parseJsonFieldOccurrences('', 'old_text')).toEqual([]);
+  });
+
+  it('extracts repeated fields from a partial edits array in document order', () => {
+    const partial =
+      '{"file_path":"a.md","edits":[' +
+      '{"old_text":"first old","new_text":"first new"},' +
+      '{"old_text":"second old","new_text":"second n';
+    expect(parseJsonFieldOccurrences(partial, 'old_text')).toEqual(['first old', 'second old']);
+    expect(parseJsonFieldOccurrences(partial, 'new_text')).toEqual(['first new', 'second n']);
+  });
+
+  it('extracts a single top-level field', () => {
+    const partial = '{"file_path":"a.md","old_text":"only one';
+    expect(parseJsonFieldOccurrences(partial, 'old_text')).toEqual(['only one']);
+  });
 });
 
 describe('areToolCallArgsComplete', () => {
diff --git a/client/src/components/Chat/Messages/Content/Parts/index.ts b/client/src/components/Chat/Messages/Content/Parts/index.ts
index da495abb825..6d6bf470b75 100644
--- a/client/src/components/Chat/Messages/Content/Parts/index.ts
+++ b/client/src/components/Chat/Messages/Content/Parts/index.ts
@@ -11,5 +11,6 @@ export { default as AgentUpdate } from './AgentUpdate';
 export { default as EditTextPart } from './EditTextPart';
 export { default as SkillCall } from './SkillCall';
 export { default as ReadFileCall } from './ReadFileCall';
+export { default as FileAuthoringCall } from './FileAuthoringCall';
 export { default as BashCall } from './BashCall';
 export { default as SubagentCall } from './SubagentCall';
diff --git a/client/src/components/Chat/Messages/Content/Parts/parseJsonField.ts b/client/src/components/Chat/Messages/Content/Parts/parseJsonField.ts
index cf4f9a3aa42..e177fff1dda 100644
--- a/client/src/components/Chat/Messages/Content/Parts/parseJsonField.ts
+++ b/client/src/components/Chat/Messages/Content/Parts/parseJsonField.ts
@@ -15,6 +15,24 @@ export function areToolCallArgsComplete(args: ToolCallArgs): boolean {
   }
 }
 
+/** Matches `"field":"value"`, tolerating a missing closing quote and a dangling escape at the end of partially streamed args. */
+function fieldRegex(field: string, flags?: string): RegExp {
+  const escaped = field.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  return new RegExp(`"${escaped}"\\s*:\\s*"((?:[^"\\\\]|\\\\.)*)(?:"|\\\\?$)`, flags);
+}
+
+function unescapeJsonString(value: string): string {
+  return value.replace(/\\(.)/g, (_, c: string) => {
+    if (c === 'n') {
+      return '\n';
+    }
+    if (c === '"' || c === '\\') {
+      return c;
+    }
+    return `\\${c}`;
+  });
+}
+
 /** Extracts a string field from tool call args, handling object, JSON string, and partial-JSON fallback. */
 export default function parseJsonField(args: ToolCallArgs, field: string): string {
   if (typeof args === 'object' && args !== null) {
@@ -28,19 +46,17 @@ export default function parseJsonField(args: ToolCallArgs, field: string): strin
   } catch {
     // partial JSON during streaming; fall through to regex
   }
-  const escaped = field.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-  const re = new RegExp(`"${escaped}"\\s*:\\s*"((?:[^"\\\\]|\\\\.)*)"`);
-  const match = args?.match(re);
+  const match = args?.match(fieldRegex(field));
   if (!match) {
     return '';
   }
-  return match[1].replace(/\\(.)/g, (_, c: string) => {
-    if (c === 'n') {
-      return '\n';
-    }
-    if (c === '"' || c === '\\') {
-      return c;
-    }
-    return `\\${c}`;
-  });
+  return unescapeJsonString(match[1]);
+}
+
+/** Extracts every occurrence of a string field from partially streamed JSON args, in document order. */
+export function parseJsonFieldOccurrences(args: ToolCallArgs, field: string): string[] {
+  if (typeof args !== 'string' || args.length === 0) {
+    return [];
+  }
+  return Array.from(args.matchAll(fieldRegex(field, 'g')), (match) => unescapeJsonString(match[1]));
 }
diff --git a/client/src/components/Chat/Messages/Content/SiblingHeader.tsx b/client/src/components/Chat/Messages/Content/SiblingHeader.tsx
index 080974ed2b2..160966fb136 100644
--- a/client/src/components/Chat/Messages/Content/SiblingHeader.tsx
+++ b/client/src/components/Chat/Messages/Content/SiblingHeader.tsx
@@ -3,6 +3,7 @@ import { GitBranchPlus } from 'lucide-react';
 import { useToastContext } from '@librechat/client';
 import { EModelEndpoint, parseEphemeralAgentId, stripAgentIdSuffix } from 'librechat-data-provider';
 import type { TMessage, Agent } from 'librechat-data-provider';
+import MessageTimestamp from '~/components/Chat/Messages/ui/MessageTimestamp';
 import { useBranchMessageMutation } from '~/data-provider/Messages';
 import MessageIcon from '~/components/Share/MessageIcon';
 import { useAgentsMapContext } from '~/Providers';
@@ -14,6 +15,8 @@ type SiblingHeaderProps = {
   agentId?: string;
   /** The messageId of the parent message */
   messageId?: string;
+  /** ISO timestamp of the parent message */
+  createdAt?: string | null;
   /** The conversationId */
   conversationId?: string | null;
   /** Whether a submission is in progress */
@@ -27,6 +30,7 @@ type SiblingHeaderProps = {
 export default function SiblingHeader({
   agentId,
   messageId,
+  createdAt,
   conversationId,
   isSubmitting,
 }: SiblingHeaderProps) {
@@ -117,6 +121,7 @@ export default function SiblingHeader({
           />
         </div>
         <span className="truncate text-sm font-medium text-text-primary">{displayName}</span>
+        <MessageTimestamp value={createdAt} />
       </div>
       <button
         type="button"
diff --git a/client/src/components/Chat/Messages/Content/WebSearch.tsx b/client/src/components/Chat/Messages/Content/WebSearch.tsx
index 7af0811fd7e..c8d76a04b21 100644
--- a/client/src/components/Chat/Messages/Content/WebSearch.tsx
+++ b/client/src/components/Chat/Messages/Content/WebSearch.tsx
@@ -141,26 +141,21 @@ export default function WebSearch({
     return [];
   }, [searchResults, attachments, ownTurn]);
 
-  const processedSources = useMemo(() => {
+  // Show favicons from the raw SERP results immediately rather than waiting for
+  // each source to flip to `processed`; the agents scrape barrier would otherwise
+  // freeze the stack on "Searching the web" for the slowest scrape's duration.
+  const streamingSources = useMemo(() => {
     if (complete && !finalizing) {
       return [];
     }
-    if (!searchResults) {
-      return [];
-    }
-    const result = searchResults[ownTurn];
+    const result = searchResults?.[ownTurn];
     if (!result) {
       return [];
     }
-    if (finalizing) {
-      return [...(result.organic || []), ...(result.topStories || [])];
-    }
-    return [...(result.organic || []), ...(result.topStories || [])].filter(
-      (source) => source.processed === true,
-    );
+    return [...(result.organic || []), ...(result.topStories || [])];
   }, [searchResults, complete, finalizing, ownTurn]);
 
-  const showSources = processedSources.length > 0;
+  const showSources = streamingSources.length > 0;
   const progressText = useMemo(() => {
     let text: ProgressKeys =
       ownTurn !== '0' ? 'com_ui_web_searching_again' : 'com_ui_web_searching';
@@ -278,7 +273,7 @@ export default function WebSearch({
       <span className="sr-only" aria-live="polite" aria-atomic="true">
         {progressText}
       </span>
-      {showSources && <StackedFavicons sources={processedSources} start={-5} />}
+      {showSources && <StackedFavicons sources={streamingSources} start={-5} />}
       <Globe className="size-4 shrink-0 text-text-secondary" aria-hidden="true" />
       <span className="tool-status-text shimmer font-medium text-text-secondary">
         {progressText}
diff --git a/client/src/components/Chat/Messages/Content/__tests__/Markdown.mcpui.test.tsx b/client/src/components/Chat/Messages/Content/__tests__/Markdown.mcpui.test.tsx
index 6ca06056fa3..bde96149040 100644
--- a/client/src/components/Chat/Messages/Content/__tests__/Markdown.mcpui.test.tsx
+++ b/client/src/components/Chat/Messages/Content/__tests__/Markdown.mcpui.test.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
 import { render, screen } from '@testing-library/react';
 import Markdown from '../Markdown';
+import MarkdownLite from '../MarkdownLite';
 import { RecoilRoot } from 'recoil';
 import { UI_RESOURCE_MARKER } from '~/components/MCPUIResource/plugin';
 import {
@@ -108,3 +109,35 @@ describe('Markdown with MCP UI markers (resource IDs)', () => {
     expect(renderers[1]).toHaveAttribute('data-resource-uri', 'ui://weather/nyc');
   });
 });
+
+describe('Markdown table rendering', () => {
+  const tableMarkdown = [
+    '| Alpha | Bravo | Charlie | Delta | Echo | Foxtrot | Golf | Hotel |',
+    '| --- | --- | --- | --- | --- | --- | --- | --- |',
+    '| one | two | three | four | five | six | seven | eight |',
+  ].join('\n');
+
+  it('wraps GFM tables in a horizontally scrollable container', () => {
+    render(
+      <RecoilRoot>
+        <Markdown content={tableMarkdown} isLatestMessage={false} />
+      </RecoilRoot>,
+    );
+
+    expect(screen.getByRole('table').parentElement).toHaveClass(
+      'markdown-table-wrapper',
+      'w-full',
+      'max-w-full',
+    );
+  });
+
+  it('wraps lightweight Markdown tables in a horizontally scrollable container', () => {
+    render(<MarkdownLite content={tableMarkdown} />);
+
+    expect(screen.getByRole('table').parentElement).toHaveClass(
+      'markdown-table-wrapper',
+      'w-full',
+      'max-w-full',
+    );
+  });
+});
diff --git a/client/src/components/Chat/Messages/Content/__tests__/MarkdownBlocks.artifacts.test.tsx b/client/src/components/Chat/Messages/Content/__tests__/MarkdownBlocks.artifacts.test.tsx
new file mode 100644
index 00000000000..2e2ade6e3e4
--- /dev/null
+++ b/client/src/components/Chat/Messages/Content/__tests__/MarkdownBlocks.artifacts.test.tsx
@@ -0,0 +1,117 @@
+import React from 'react';
+import { RecoilRoot } from 'recoil';
+import ReactMarkdown from 'react-markdown';
+import { MemoryRouter } from 'react-router-dom';
+import { render, screen } from '@testing-library/react';
+import { getRemarkPlugins, getRehypePlugins, getMarkdownComponents } from '../markdownConfig';
+import { MessageContext, ArtifactProvider, CodeBlockProvider } from '~/Providers';
+import Markdown from '../Markdown';
+
+/**
+ * End-to-end artifact-index regression tests. The real `Artifact` component
+ * computes its document-order index via the (per-block) ArtifactProvider and
+ * stores it on the artifact passed to `ArtifactButton`; we stub only
+ * `ArtifactButton` to read that index back. This verifies the per-block base
+ * indexing assigns artifacts the same indices the whole-message renderer did —
+ * the index used by artifact edit/update calls.
+ */
+jest.mock('~/components/Artifacts/ArtifactButton', () => ({
+  __esModule: true,
+  default: ({ artifact }: { artifact?: { index?: number; identifier?: string } }) => (
+    <div
+      data-testid="art"
+      data-index={String(artifact?.index)}
+      data-id={String(artifact?.identifier)}
+    />
+  ),
+}));
+
+const artifact = (id: string, title: string) =>
+  `:::artifact{identifier="${id}" type="text/markdown" title="${title}"}\nhello ${id}\n:::`;
+
+const wrap = (ui: React.ReactNode) => (
+  <MemoryRouter>
+    <RecoilRoot>
+      <MessageContext.Provider value={{ messageId: 'm1', isExpanded: true }}>
+        {ui}
+      </MessageContext.Provider>
+    </RecoilRoot>
+  </MemoryRouter>
+);
+
+/** The previous whole-message renderer: one ReactMarkdown under one ArtifactProvider. */
+const OldMarkdown = ({ content }: { content: string }) => (
+  <ArtifactProvider>
+    <CodeBlockProvider>
+      <ReactMarkdown
+        /** @ts-ignore */
+        remarkPlugins={getRemarkPlugins()}
+        /** @ts-ignore */
+        rehypePlugins={getRehypePlugins()}
+        components={getMarkdownComponents()}
+      >
+        {content}
+      </ReactMarkdown>
+    </CodeBlockProvider>
+  </ArtifactProvider>
+);
+
+const readArtifacts = async () =>
+  (await screen.findAllByTestId('art')).map((el) => ({
+    idx: el.getAttribute('data-index'),
+    id: el.getAttribute('data-id'),
+  }));
+
+describe('MarkdownBlocks artifact-index parity (e2e)', () => {
+  it('assigns document-order indices to multiple artifacts', async () => {
+    const content = `${artifact('a', 'A')}\n\n${artifact('b', 'B')}`;
+    render(wrap(<Markdown content={content} isLatestMessage={false} />));
+
+    expect(await readArtifacts()).toEqual([
+      { idx: '0', id: 'a' },
+      { idx: '1', id: 'b' },
+    ]);
+  });
+
+  it('matches the whole-message renderer indices (text + artifacts interleaved)', async () => {
+    const content = `Intro.\n\n${artifact('a', 'A')}\n\nMiddle.\n\n${artifact('b', 'B')}\n\nEnd.`;
+
+    const { unmount } = render(wrap(<OldMarkdown content={content} />));
+    const oldIdx = await readArtifacts();
+    unmount();
+
+    render(wrap(<Markdown content={content} isLatestMessage={false} />));
+    const newIdx = await readArtifacts();
+
+    expect(newIdx).toEqual(oldIdx);
+    expect(newIdx).toEqual([
+      { idx: '0', id: 'a' },
+      { idx: '1', id: 'b' },
+    ]);
+  });
+
+  it('refreshes artifact indices when an in-place edit inserts an artifact before another', async () => {
+    const before = `Intro.\n\n${artifact('b', 'B')}`;
+    const after = `${artifact('a', 'A')}\n\n${artifact('b', 'B')}`;
+
+    const { rerender } = render(wrap(<Markdown content={before} isLatestMessage={false} />));
+    expect(await readArtifacts()).toEqual([{ idx: '0', id: 'b' }]);
+
+    rerender(wrap(<Markdown content={after} isLatestMessage={false} />));
+    // 'b' was index 0; inserting 'a' before it shifts its base to 1. Without the
+    // base-aware block key its ref-cached index would stay 0 (duplicating 'a').
+    expect(await readArtifacts()).toEqual([
+      { idx: '0', id: 'a' },
+      { idx: '1', id: 'b' },
+    ]);
+  });
+
+  it('does not consume an index for inline text artifact directives', async () => {
+    // `:artifact{}` (text directive) renders as literal text, not an Artifact, so
+    // the following real artifact must still be index 0.
+    const content = `See :artifact{identifier="x"} inline.\n\n${artifact('a', 'A')}`;
+    render(wrap(<Markdown content={content} isLatestMessage={false} />));
+
+    expect(await readArtifacts()).toEqual([{ idx: '0', id: 'a' }]);
+  });
+});
diff --git a/client/src/components/Chat/Messages/Content/__tests__/MarkdownBlocks.test.tsx b/client/src/components/Chat/Messages/Content/__tests__/MarkdownBlocks.test.tsx
new file mode 100644
index 00000000000..b681bc109ab
--- /dev/null
+++ b/client/src/components/Chat/Messages/Content/__tests__/MarkdownBlocks.test.tsx
@@ -0,0 +1,240 @@
+import React from 'react';
+import { RecoilRoot } from 'recoil';
+import ReactMarkdown from 'react-markdown';
+import { render, screen } from '@testing-library/react';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { getRemarkPlugins, getRehypePlugins, getMarkdownComponents } from '../markdownConfig';
+import { ArtifactProvider, CodeBlockProvider } from '~/Providers';
+import Markdown from '../Markdown';
+
+/**
+ * Stub CodeBlock so we can read the blockIndex each executable code block
+ * receives, while still exercising the real `code` override's skip/single-line
+ * decision (which decides whether a CodeBlock renders at all).
+ */
+jest.mock('~/components/Messages/Content/CodeBlock', () => ({
+  __esModule: true,
+  default: ({ lang, blockIndex }: { lang?: string; blockIndex?: number }) => (
+    <div data-testid="cb" data-block-index={String(blockIndex)} data-lang={String(lang)} />
+  ),
+}));
+
+/** The previous whole-message renderer: a single ReactMarkdown under one set of providers. */
+const OldMarkdown = ({ content }: { content: string }) => (
+  <ArtifactProvider>
+    <CodeBlockProvider>
+      <ReactMarkdown
+        /** @ts-ignore */
+        remarkPlugins={getRemarkPlugins()}
+        /** @ts-ignore */
+        rehypePlugins={getRehypePlugins()}
+        components={getMarkdownComponents()}
+      >
+        {content}
+      </ReactMarkdown>
+    </CodeBlockProvider>
+  </ArtifactProvider>
+);
+
+/**
+ * The whole-message renderer emits whitespace-only text nodes ("\n") between
+ * top-level block elements; the per-block renderer parses each block in
+ * isolation and omits them. That whitespace is collapsed between block-level
+ * elements, so it is visually and functionally irrelevant — normalize it away
+ * before comparing structure.
+ */
+const normalizeHtml = (html: string) => html.replace(/>\s+</g, '><').trim();
+
+const indicesIn = (container: HTMLElement) =>
+  Array.from(container.querySelectorAll('[data-testid="cb"]')).map((el) => ({
+    idx: el.getAttribute('data-block-index'),
+    lang: el.getAttribute('data-lang'),
+  }));
+
+const streamThrough = (
+  Component: React.ComponentType<{ content: string }>,
+  content: string,
+): HTMLElement => {
+  const lines = content.split('\n');
+  const { container, rerender } = render(
+    <RecoilRoot>
+      <Component content={lines[0]} />
+    </RecoilRoot>,
+  );
+  for (let i = 2; i <= lines.length; i += 1) {
+    rerender(
+      <RecoilRoot>
+        <Component content={lines.slice(0, i).join('\n')} />
+      </RecoilRoot>,
+    );
+  }
+  return container;
+};
+
+const MIXED = [
+  'Intro paragraph.',
+  '',
+  '```python',
+  'print("one")',
+  'x = 1',
+  '```',
+  '',
+  'Some `inline` code here.',
+  '',
+  '```js',
+  'console.log("two");',
+  'const y = 2;',
+  '```',
+  '',
+  '```math',
+  'E = mc^2',
+  '```',
+  '',
+  '```bash',
+  'echo single',
+  '```',
+  '',
+  '```mermaid',
+  'graph TD; A-->B;',
+  '```',
+  '',
+  '```ts',
+  'const z: number = 3;',
+  'export {};',
+  '```',
+].join('\n');
+
+const EXPECTED = [
+  { idx: '0', lang: 'python' },
+  { idx: '1', lang: 'js' },
+  { idx: '2', lang: 'bash' },
+  { idx: '3', lang: 'ts' },
+];
+
+const NewMarkdown = ({ content }: { content: string }) => (
+  <Markdown content={content} isLatestMessage={false} />
+);
+
+describe('MarkdownBlocks code-block index parity', () => {
+  it('assigns document-order indices on a direct render (matches whole-message renderer)', () => {
+    const { container: oldC } = render(
+      <RecoilRoot>
+        <OldMarkdown content={MIXED} />
+      </RecoilRoot>,
+    );
+    const { container: newC } = render(
+      <RecoilRoot>
+        <Markdown content={MIXED} isLatestMessage={false} />
+      </RecoilRoot>,
+    );
+
+    expect(indicesIn(oldC)).toEqual(EXPECTED);
+    expect(indicesIn(newC)).toEqual(EXPECTED);
+  });
+
+  it('keeps indices correct across a simulated stream (no drift under memoization)', () => {
+    const oldC = streamThrough(OldMarkdown, MIXED);
+    const newC = streamThrough(NewMarkdown, MIXED);
+
+    expect(indicesIn(oldC)).toEqual(EXPECTED);
+    expect(indicesIn(newC)).toEqual(EXPECTED);
+  });
+
+  it('streamed indices match a fresh direct render (stable for stored execution results)', () => {
+    const streamed = streamThrough(NewMarkdown, MIXED);
+    const { container: fresh } = render(
+      <RecoilRoot>
+        <Markdown content={MIXED} isLatestMessage={false} />
+      </RecoilRoot>,
+    );
+    expect(indicesIn(streamed)).toEqual(indicesIn(fresh));
+  });
+
+  it('refreshes indices when an in-place edit inserts a code block before existing ones', () => {
+    const before = 'intro\n\n```js\na\n```';
+    const after = '```py\nx\n```\n\n```js\na\n```';
+    const { container, rerender } = render(
+      <RecoilRoot>
+        <Markdown content={before} isLatestMessage={false} />
+      </RecoilRoot>,
+    );
+    expect(indicesIn(container)).toEqual([{ idx: '0', lang: 'js' }]);
+
+    rerender(
+      <RecoilRoot>
+        <Markdown content={after} isLatestMessage={false} />
+      </RecoilRoot>,
+    );
+    // The js block's base shifted 0 -> 1; without forcing a remount its ref-cached
+    // index would stay 0 (duplicating py). It must become 1.
+    expect(indicesIn(container)).toEqual([
+      { idx: '0', lang: 'py' },
+      { idx: '1', lang: 'js' },
+    ]);
+  });
+});
+
+describe('MarkdownBlocks DOM equivalence (non-code blocks)', () => {
+  const cases: Array<[string, string]> = [
+    ['paragraphs', 'First paragraph.\n\nSecond paragraph.'],
+    ['gfm table', ['| a | b |', '| - | - |', '| 1 | 2 |', '| 3 | 4 |'].join('\n')],
+    ['unordered list', '- one\n- two\n- three'],
+    ['ordered list', '1. one\n2. two'],
+    ['headings + text', '# Title\n\nBody text with **bold** and _italics_.'],
+    ['blockquote', '> quoted line one\n> quoted line two'],
+    ['inline code', 'Use the `useMemo` hook for memoization.'],
+    ['mixed', '# H\n\nPara with `code`.\n\n| x | y |\n| - | - |\n| 1 | 2 |\n\n- a\n- b'],
+  ];
+
+  it.each(cases)('renders identical DOM to the whole-message renderer: %s', (_label, content) => {
+    const { container: oldC } = render(
+      <RecoilRoot>
+        <OldMarkdown content={content} />
+      </RecoilRoot>,
+    );
+    const { container: newC } = render(
+      <RecoilRoot>
+        <Markdown content={content} isLatestMessage={false} />
+      </RecoilRoot>,
+    );
+    expect(normalizeHtml(newC.innerHTML)).toBe(normalizeHtml(oldC.innerHTML));
+  });
+});
+
+describe('MarkdownBlocks rendering smoke', () => {
+  it('renders an empty cursor placeholder while initializing', () => {
+    const { container } = render(
+      <RecoilRoot>
+        <Markdown content="" isLatestMessage={true} />
+      </RecoilRoot>,
+    );
+    expect(container.querySelector('.result-thinking')).not.toBeNull();
+  });
+
+  it('renders executable code blocks for a multi-code message', () => {
+    render(
+      <RecoilRoot>
+        <Markdown content={MIXED} isLatestMessage={false} />
+      </RecoilRoot>,
+    );
+    expect(screen.getAllByTestId('cb')).toHaveLength(4);
+  });
+});
+
+describe('MarkdownBlocks document-level definitions', () => {
+  it('resolves a reference-style link whose definition is in a separate block', () => {
+    const queryClient = new QueryClient();
+    const content = 'See [docs][d] for details.\n\n[d]: https://example.com/docs';
+    render(
+      <QueryClientProvider client={queryClient}>
+        <RecoilRoot>
+          <Markdown content={content} isLatestMessage={false} />
+        </RecoilRoot>
+      </QueryClientProvider>,
+    );
+    expect(screen.getByRole('link', { name: 'docs' })).toHaveAttribute(
+      'href',
+      'https://example.com/docs',
+    );
+  });
+});
diff --git a/client/src/components/Chat/Messages/Content/__tests__/Part.test.tsx b/client/src/components/Chat/Messages/Content/__tests__/Part.test.tsx
index 1da1d389d12..5fd14982879 100644
--- a/client/src/components/Chat/Messages/Content/__tests__/Part.test.tsx
+++ b/client/src/components/Chat/Messages/Content/__tests__/Part.test.tsx
@@ -14,6 +14,9 @@ jest.mock('../Parts', () => ({
   Text: ({ text }: { text?: string }) => <div data-testid="text">{text}</div>,
   SkillCall: () => <div data-testid="skill-call" />,
   ReadFileCall: () => <div data-testid="read-file-call" />,
+  FileAuthoringCall: ({ toolName }: { toolName: string }) => (
+    <div data-testid="file-authoring-call" data-tool-name={toolName} />
+  ),
   BashCall: ({ commandField }: { commandField?: string }) => (
     <div data-testid="bash-call" data-command-field={commandField ?? 'command'} />
   ),
@@ -101,4 +104,31 @@ describe('Part tool renderer selection', () => {
     expect(screen.getByTestId('execute-code')).toBeInTheDocument();
     expect(screen.queryByTestId('bash-call')).not.toBeInTheDocument();
   });
+
+  it('routes create_file calls through the file-authoring renderer', () => {
+    renderPart(
+      toolCallPart('create_file', '{"file_path":"skills/demo/SKILL.md","content":"# Demo"}'),
+    );
+
+    expect(screen.getByTestId('file-authoring-call')).toHaveAttribute(
+      'data-tool-name',
+      'create_file',
+    );
+    expect(screen.queryByTestId('tool-call')).not.toBeInTheDocument();
+  });
+
+  it('routes edit_file calls through the file-authoring renderer', () => {
+    renderPart(
+      toolCallPart(
+        'edit_file',
+        '{"file_path":"skills/demo/SKILL.md","old_text":"Demo","new_text":"Updated"}',
+      ),
+    );
+
+    expect(screen.getByTestId('file-authoring-call')).toHaveAttribute(
+      'data-tool-name',
+      'edit_file',
+    );
+    expect(screen.queryByTestId('tool-call')).not.toBeInTheDocument();
+  });
 });
diff --git a/client/src/components/Chat/Messages/Content/__tests__/UIResourceCarousel.test.tsx b/client/src/components/Chat/Messages/Content/__tests__/UIResourceCarousel.test.tsx
index 6e472e3f49b..91d94998989 100644
--- a/client/src/components/Chat/Messages/Content/__tests__/UIResourceCarousel.test.tsx
+++ b/client/src/components/Chat/Messages/Content/__tests__/UIResourceCarousel.test.tsx
@@ -35,11 +35,11 @@ Object.defineProperty(HTMLElement.prototype, 'scrollTo', {
 
 describe('UIResourceCarousel', () => {
   const mockUIResources: UIResource[] = [
-    { uri: 'resource1', mimeType: 'text/html', text: 'Resource 1' },
-    { uri: 'resource2', mimeType: 'text/html', text: 'Resource 2' },
-    { uri: 'resource3', mimeType: 'text/html', text: 'Resource 3' },
-    { uri: 'resource4', mimeType: 'text/html', text: 'Resource 4' },
-    { uri: 'resource5', mimeType: 'text/html', text: 'Resource 5' },
+    { resourceId: 'resource1', uri: 'resource1', mimeType: 'text/html', text: 'Resource 1' },
+    { resourceId: 'resource2', uri: 'resource2', mimeType: 'text/html', text: 'Resource 2' },
+    { resourceId: 'resource3', uri: 'resource3', mimeType: 'text/html', text: 'Resource 3' },
+    { resourceId: 'resource4', uri: 'resource4', mimeType: 'text/html', text: 'Resource 4' },
+    { resourceId: 'resource5', uri: 'resource5', mimeType: 'text/html', text: 'Resource 5' },
   ];
 
   const mockHandleUIAction = handleUIAction as jest.MockedFunction<typeof handleUIAction>;
diff --git a/client/src/components/Chat/Messages/Content/__tests__/WebSearch.test.tsx b/client/src/components/Chat/Messages/Content/__tests__/WebSearch.test.tsx
index e18ad58e49b..fc29f0391ba 100644
--- a/client/src/components/Chat/Messages/Content/__tests__/WebSearch.test.tsx
+++ b/client/src/components/Chat/Messages/Content/__tests__/WebSearch.test.tsx
@@ -205,13 +205,13 @@ describe('WebSearch', () => {
     });
   });
 
-  describe('processedSources scoping', () => {
-    it('shows processed sources only from ownTurn during streaming', () => {
+  describe('streaming favicons', () => {
+    it('renders favicons for all ownTurn sources during streaming, before they are processed', () => {
       const searchResults = makeSearchResults({
         0: {
           organic: [
             { link: 'https://a.com', title: 'A', processed: true } as ValidSource,
-            { link: 'https://b.com', title: 'B', processed: false } as ValidSource,
+            { link: 'https://b.com', title: 'B' } as ValidSource,
           ],
         },
         1: {
@@ -229,11 +229,27 @@ describe('WebSearch', () => {
         initialProgress: 0.5,
       });
 
-      const favicons = screen.queryAllByTestId('stacked-favicons');
-      if (favicons.length > 0) {
-        const count = Number(favicons[0].getAttribute('data-count'));
-        expect(count).toBeLessThanOrEqual(2);
-      }
+      const favicons = screen.getByTestId('stacked-favicons');
+      // Both turn-0 sources show immediately — including the unprocessed one —
+      // while the turn-1 source stays scoped out.
+      expect(Number(favicons.getAttribute('data-count'))).toBe(2);
+      expect(screen.getAllByText('Processing results').length).toBeGreaterThanOrEqual(1);
+    });
+
+    it('stays on "Searching the web" until any source for the turn arrives', () => {
+      const searchResults = makeSearchResults({ 0: { organic: [] } });
+      const attachments = [makeAttachment(0, searchResults['0'])];
+
+      renderWebSearch({
+        searchResults,
+        attachments,
+        isSubmitting: true,
+        isLast: true,
+        initialProgress: 0.5,
+      });
+
+      expect(screen.queryByTestId('stacked-favicons')).not.toBeInTheDocument();
+      expect(screen.getAllByText('Searching the web').length).toBeGreaterThanOrEqual(1);
     });
   });
 
diff --git a/client/src/components/Chat/Messages/Content/__tests__/splitMarkdown.test.ts b/client/src/components/Chat/Messages/Content/__tests__/splitMarkdown.test.ts
new file mode 100644
index 00000000000..100a984f47c
--- /dev/null
+++ b/client/src/components/Chat/Messages/Content/__tests__/splitMarkdown.test.ts
@@ -0,0 +1,168 @@
+import { splitMarkdownIntoBlocks } from '../splitMarkdown';
+
+const raws = (content: string) => splitMarkdownIntoBlocks(content).map((block) => block.raw);
+
+describe('splitMarkdownIntoBlocks', () => {
+  it('returns [] for empty content', () => {
+    expect(splitMarkdownIntoBlocks('')).toEqual([]);
+  });
+
+  it('returns a single block for one paragraph', () => {
+    expect(raws('Hello world.')).toEqual(['Hello world.']);
+  });
+
+  it('splits consecutive paragraphs into separate blocks', () => {
+    expect(raws('First.\n\nSecond.')).toEqual(['First.', 'Second.']);
+  });
+
+  it('keeps a GFM table as one atomic block', () => {
+    const table = '| a | b |\n| - | - |\n| 1 | 2 |';
+    const content = `Intro.\n\n${table}\n\nOutro.`;
+    expect(raws(content)).toEqual(['Intro.', table, 'Outro.']);
+  });
+
+  it('keeps a fenced code block (with internal blank lines) as one block', () => {
+    const code = '```js\nconst x = 1;\n\nconst y = 2;\n```';
+    const content = `Before.\n\n${code}\n\nAfter.`;
+    expect(raws(content)).toEqual(['Before.', code, 'After.']);
+  });
+
+  it('keeps a $$ math block as one block', () => {
+    const mathBlock = '$$\nE = mc^2\n$$';
+    const content = `Text.\n\n${mathBlock}\n\nMore.`;
+    expect(raws(content)).toEqual(['Text.', mathBlock, 'More.']);
+  });
+
+  it('keeps a :::artifact::: container (with inner blank lines) intact', () => {
+    const artifact = ':::artifact{title="t"}\nline one\n\nline two\n:::';
+    const content = `Lead.\n\n${artifact}\n\nTail.`;
+    expect(raws(content)).toEqual(['Lead.', artifact, 'Tail.']);
+  });
+
+  it('keeps a list as one block (does not split items)', () => {
+    const list = '- one\n- two\n- three';
+    expect(raws(list)).toEqual([list]);
+  });
+
+  it('does not split inline constructs across blocks (inline code/markers stay in their paragraph)', () => {
+    const para = 'Use `inline` code and \\ui{abc} markers here.';
+    expect(raws(para)).toEqual([para]);
+  });
+
+  it('each block re-parses to the same single block (idempotent boundaries)', () => {
+    const content = ['# Heading', '', 'A paragraph.', '', '```py\nprint(1)\n```'].join('\n');
+    const blocks = raws(content);
+    expect(blocks).toHaveLength(3);
+    for (const block of blocks) {
+      expect(raws(block)).toEqual([block]);
+    }
+  });
+
+  describe('index counts (mirror the code/artifact render decision)', () => {
+    it('counts a multi-line fenced code block as executable', () => {
+      const [block] = splitMarkdownIntoBlocks('```js\nconst x = 1;\nconst y = 2;\n```');
+      expect(block.codeBlockCount).toBe(1);
+    });
+
+    it('counts a single-line block with a known language as executable', () => {
+      const [block] = splitMarkdownIntoBlocks('```bash\necho hi\n```');
+      expect(block.codeBlockCount).toBe(1);
+    });
+
+    it('counts a no-language single-line block as executable', () => {
+      const [block] = splitMarkdownIntoBlocks('```\necho hi\n```');
+      expect(block.codeBlockCount).toBe(1);
+    });
+
+    it('counts a single-line block with an unsupported language (renderer still renders a CodeBlock)', () => {
+      const [block] = splitMarkdownIntoBlocks('```madeuplang\nhi\n```');
+      expect(block.codeBlockCount).toBe(1);
+    });
+
+    it('does NOT count math or mermaid fences', () => {
+      expect(splitMarkdownIntoBlocks('```math\nE=mc^2\n```')[0].codeBlockCount).toBe(0);
+      expect(splitMarkdownIntoBlocks('```mermaid\ngraph TD; A-->B;\n```')[0].codeBlockCount).toBe(
+        0,
+      );
+    });
+
+    it('does NOT count hyphenated math/mermaid languages (renderer normalizes them)', () => {
+      expect(
+        splitMarkdownIntoBlocks('```mermaid-js\ngraph TD; A-->B;\n```')[0].codeBlockCount,
+      ).toBe(0);
+      expect(splitMarkdownIntoBlocks('```math-tex\nE=mc^2\n```')[0].codeBlockCount).toBe(0);
+    });
+
+    it('does count a fence that merely starts with math/mermaid letters', () => {
+      expect(splitMarkdownIntoBlocks('```mathematica\nx\n```')[0].codeBlockCount).toBe(1);
+    });
+
+    it('counts an artifact container once and does not count code inside it', () => {
+      const artifact = ':::artifact{title="t"}\n```js\nconst x = 1;\nconst y = 2;\n```\n:::';
+      const [block] = splitMarkdownIntoBlocks(artifact);
+      expect(block.artifactCount).toBe(1);
+      expect(block.codeBlockCount).toBe(0);
+    });
+
+    it('counts leaf artifact directives, not just containers', () => {
+      expect(splitMarkdownIntoBlocks('::artifact{identifier="a" type="x"}')[0].artifactCount).toBe(
+        1,
+      );
+    });
+
+    it('does NOT count inline text artifact directives (the plugin rewrites them to text)', () => {
+      expect(splitMarkdownIntoBlocks('see :artifact{identifier="b"} inline')[0].artifactCount).toBe(
+        0,
+      );
+    });
+  });
+
+  describe('document-level definitions force single-block rendering', () => {
+    it('keeps a reference-style link and its definition in one block', () => {
+      const content = 'See [docs][d] for details.\n\n[d]: https://example.com/docs';
+      const blocks = splitMarkdownIntoBlocks(content);
+      expect(blocks).toHaveLength(1);
+      expect(blocks[0].raw).toBe(content);
+    });
+
+    it('keeps a footnote reference and its definition in one block', () => {
+      const content = 'Claim with a note.[^1]\n\n[^1]: the footnote text';
+      const blocks = splitMarkdownIntoBlocks(content);
+      expect(blocks).toHaveLength(1);
+      expect(blocks[0].raw).toBe(content);
+    });
+
+    it('forces single-block when a definition is nested in a blockquote', () => {
+      const content = 'See [docs][d].\n\n> [d]: https://example.com/docs';
+      const blocks = splitMarkdownIntoBlocks(content);
+      expect(blocks).toHaveLength(1);
+      expect(blocks[0].raw).toBe(content);
+    });
+
+    it('forces single-block when a definition is nested in a list item', () => {
+      const content = 'See [a][d].\n\n- item\n\n  [d]: https://example.com';
+      const blocks = splitMarkdownIntoBlocks(content);
+      expect(blocks).toHaveLength(1);
+      expect(blocks[0].raw).toBe(content);
+    });
+
+    it('still splits when no document-level definition is present', () => {
+      const blocks = splitMarkdownIntoBlocks('First paragraph.\n\nSecond paragraph.');
+      expect(blocks).toHaveLength(2);
+    });
+  });
+
+  describe('raw HTML blocks force single-block rendering', () => {
+    it('renders the whole message as one block for multiple top-level HTML blocks', () => {
+      const content = '<div>a</div>\n\n<div>b</div>';
+      const blocks = splitMarkdownIntoBlocks(content);
+      expect(blocks).toHaveLength(1);
+      expect(blocks[0].raw).toBe(content);
+    });
+
+    it('still splits when HTML is only inline within a paragraph', () => {
+      const blocks = splitMarkdownIntoBlocks('para with <br> inline.\n\nsecond para');
+      expect(blocks).toHaveLength(2);
+    });
+  });
+});
diff --git a/client/src/components/Chat/Messages/Content/markdownConfig.ts b/client/src/components/Chat/Messages/Content/markdownConfig.ts
new file mode 100644
index 00000000000..90ac6a70440
--- /dev/null
+++ b/client/src/components/Chat/Messages/Content/markdownConfig.ts
@@ -0,0 +1,80 @@
+import remarkGfm from 'remark-gfm';
+import remarkMath from 'remark-math';
+import supersub from 'remark-supersub';
+import rehypeKatex from 'rehype-katex';
+import rehypeHighlight from 'rehype-highlight';
+import remarkDirective from 'remark-directive';
+import type { PluggableList } from 'unified';
+import type { ElementType } from 'react';
+import {
+  mcpUIResourcePlugin,
+  MCPUIResource,
+  MCPUIResourceCarousel,
+} from '~/components/MCPUIResource';
+import { Citation, CompositeCitation, HighlightedText } from '~/components/Web/Citation';
+import { Artifact, artifactPlugin } from '~/components/Artifacts/Artifact';
+import { code, a, p, img, table } from './MarkdownComponents';
+import { langSubset, remarkApproxTilde } from '~/utils';
+import { unicodeCitation } from '~/components/Web';
+
+/**
+ * Single source of truth for the markdown rendering pipeline, shared by the
+ * whole-message renderer and the per-block memoized renderer so both produce
+ * identical output.
+ *
+ * These are exposed as lazily-initialized, cached getters rather than top-level
+ * consts on purpose: `MarkdownComponents` participates in a circular import
+ * (`MarkdownComponents` → `CodeBlock` → `Parts` → `Markdown` → here →
+ * `MarkdownComponents`). Reading `code`/`a`/… at module-evaluation time throws
+ * `Cannot access 'code' before initialization` under native ESM. Deferring the
+ * read to first call (render time) sidesteps the temporal dead zone, and caching
+ * keeps a stable reference so react-markdown does not rebuild its processor.
+ */
+let remarkPluginsCache: PluggableList | null = null;
+let rehypePluginsCache: PluggableList | null = null;
+let markdownComponentsCache: { [nodeType: string]: ElementType } | null = null;
+
+export const getRemarkPlugins = (): PluggableList => {
+  if (remarkPluginsCache === null) {
+    remarkPluginsCache = [
+      remarkApproxTilde,
+      supersub,
+      remarkGfm,
+      remarkDirective,
+      artifactPlugin,
+      [remarkMath, { singleDollarTextMath: false }],
+      unicodeCitation,
+      mcpUIResourcePlugin,
+    ];
+  }
+  return remarkPluginsCache;
+};
+
+export const getRehypePlugins = (): PluggableList => {
+  if (rehypePluginsCache === null) {
+    rehypePluginsCache = [
+      [rehypeKatex],
+      [rehypeHighlight, { detect: true, ignoreMissing: true, subset: langSubset }],
+    ];
+  }
+  return rehypePluginsCache;
+};
+
+export const getMarkdownComponents = (): { [nodeType: string]: ElementType } => {
+  if (markdownComponentsCache === null) {
+    markdownComponentsCache = {
+      code,
+      a,
+      p,
+      img,
+      table,
+      artifact: Artifact,
+      citation: Citation,
+      'highlighted-text': HighlightedText,
+      'composite-citation': CompositeCitation,
+      'mcp-ui-resource': MCPUIResource,
+      'mcp-ui-carousel': MCPUIResourceCarousel,
+    };
+  }
+  return markdownComponentsCache;
+};
diff --git a/client/src/components/Chat/Messages/Content/splitMarkdown.ts b/client/src/components/Chat/Messages/Content/splitMarkdown.ts
new file mode 100644
index 00000000000..1037839c6e4
--- /dev/null
+++ b/client/src/components/Chat/Messages/Content/splitMarkdown.ts
@@ -0,0 +1,157 @@
+import { gfm } from 'micromark-extension-gfm';
+import { math } from 'micromark-extension-math';
+import { gfmFromMarkdown } from 'mdast-util-gfm';
+import { mathFromMarkdown } from 'mdast-util-math';
+import { fromMarkdown } from 'mdast-util-from-markdown';
+import { directive } from 'micromark-extension-directive';
+import { directiveFromMarkdown } from 'mdast-util-directive';
+
+export type MarkdownBlock = {
+  /** Exact source slice for this top-level block. */
+  raw: string;
+  /** Executable code blocks within this block (those that render a runnable CodeBlock). */
+  codeBlockCount: number;
+  /** Artifact containers within this block. */
+  artifactCount: number;
+};
+
+type MdastNode = {
+  type: string;
+  name?: string;
+  lang?: string | null;
+  value?: string;
+  children?: MdastNode[];
+  position?: { start?: { offset?: number }; end?: { offset?: number } };
+};
+
+/**
+ * Mirror the `code` component's decision for whether a fenced block renders as a
+ * runnable CodeBlock (and therefore consumes a block index). Every fenced code
+ * block does, except `math` and `mermaid` fences, which have dedicated
+ * renderers. mdast strips a fenced block's trailing newline, but
+ * react-markdown/remark-rehype re-add it, so the `code` component never treats a
+ * fenced block as single-line inline code regardless of its language — only true
+ * inline code (an `inlineCode` node, not counted here) is.
+ */
+const renderedCodeLang = (lang: string): string =>
+  /language-(\w+)/.exec(`language-${lang}`)?.[1] ?? '';
+
+/**
+ * Normalize the fence info string the same way the `code` component does — it
+ * reads the language from `className` via `/language-(\w+)/`, so only the leading
+ * word characters survive (`mermaid-js` → `mermaid`, `math-tex` → `math`). A
+ * fence is executable (consumes a CodeBlock index) unless it normalizes to
+ * `math` or `mermaid`, which have dedicated renderers.
+ */
+const isExecutableCode = (lang: string): boolean => {
+  const normalized = renderedCodeLang(lang);
+  return normalized !== 'math' && normalized !== 'mermaid';
+};
+
+const containsDefinition = (node: MdastNode): boolean => {
+  if (node.type === 'definition' || node.type === 'footnoteDefinition') {
+    return true;
+  }
+  return (node.children ?? []).some(containsDefinition);
+};
+
+const ARTIFACT_DIRECTIVE_TYPES = new Set(['containerDirective', 'leafDirective']);
+
+const countWithin = (node: MdastNode, counts: { code: number; artifact: number }): void => {
+  if (ARTIFACT_DIRECTIVE_TYPES.has(node.type) && node.name === 'artifact') {
+    // artifactPlugin renders container (`:::artifact:::`) and leaf
+    // (`::artifact{}`) artifact directives as an Artifact, each consuming one
+    // index; their children never render as executable code blocks, so stop
+    // descending. Inline text directives (`:artifact{}`) are intentionally
+    // excluded — the plugin rewrites every textDirective to literal text, so no
+    // Artifact renders and no index is consumed.
+    counts.artifact += 1;
+    return;
+  }
+  if (node.type === 'code' && isExecutableCode(node.lang ?? '')) {
+    counts.code += 1;
+  }
+  if (node.children) {
+    for (const child of node.children) {
+      countWithin(child, counts);
+    }
+  }
+};
+
+/**
+ * Parse markdown into an mdast tree using the same structural constructs the
+ * render pipeline relies on (GFM tables, container directives like
+ * `:::artifact:::`, and `$$` math), so top-level block boundaries match what
+ * react-markdown produces. Inline-only transforms (citations, MCP-UI markers,
+ * supersub) never cross a top-level block, so they are intentionally omitted.
+ */
+const parseToMdast = (content: string): MdastNode =>
+  fromMarkdown(content, {
+    extensions: [gfm(), directive(), math()],
+    mdastExtensions: [gfmFromMarkdown(), directiveFromMarkdown(), mathFromMarkdown()],
+  }) as MdastNode;
+
+/**
+ * Split a markdown string into its top-level blocks, returning the exact source
+ * slice for each block plus the index counts it consumes. Completed blocks
+ * produce byte-identical slices (and stable counts) across streamed updates,
+ * which is what makes per-block memoization effective: only the final, still-
+ * growing block changes from one token to the next.
+ *
+ * Inter-block whitespace (blank lines) is not part of any node's span and is
+ * dropped; block-level elements carry their own margins, so rendering each
+ * slice independently is visually equivalent to rendering the whole string.
+ */
+export function splitMarkdownIntoBlocks(content: string): MarkdownBlock[] {
+  if (!content) {
+    return [];
+  }
+
+  const tree = parseToMdast(content);
+  const children = tree.children ?? [];
+
+  if (children.length === 0) {
+    return [{ raw: content, codeBlockCount: 0, artifactCount: 0 }];
+  }
+
+  // Per-block rendering loses document-global context, so render the whole
+  // message as one block when it uses a construct that needs it:
+  //  - reference/footnote definitions are document-scoped (and may be nested in
+  //    a blockquote or list item), so a reference would otherwise render as
+  //    literal text once severed from its definition; and
+  //  - top-level raw HTML blocks are escaped to text (rehypeRaw is not enabled),
+  //    so the separator between adjacent HTML blocks would otherwise be dropped.
+  const requiresWholeMessage = children.some(
+    (node) => node.type === 'html' || containsDefinition(node),
+  );
+  if (requiresWholeMessage) {
+    return [{ raw: content, ...blockCounts(children) }];
+  }
+
+  const blocks: MarkdownBlock[] = [];
+
+  for (const node of children) {
+    const start = node.position?.start?.offset;
+    const end = node.position?.end?.offset;
+    if (start == null || end == null) {
+      return [{ raw: content, ...blockCounts(children) }];
+    }
+    const counts = { code: 0, artifact: 0 };
+    countWithin(node, counts);
+    blocks.push({
+      raw: content.slice(start, end),
+      codeBlockCount: counts.code,
+      artifactCount: counts.artifact,
+    });
+  }
+
+  return blocks;
+}
+
+const blockCounts = (children: MdastNode[]): { codeBlockCount: number; artifactCount: number } => {
+  const counts = { code: 0, artifact: 0 };
+  for (const node of children) {
+    countWithin(node, counts);
+  }
+  return { codeBlockCount: counts.code, artifactCount: counts.artifact };
+};
diff --git a/client/src/components/Chat/Messages/Feedback.tsx b/client/src/components/Chat/Messages/Feedback.tsx
index eea1464e66f..9bc10c19270 100644
--- a/client/src/components/Chat/Messages/Feedback.tsx
+++ b/client/src/components/Chat/Messages/Feedback.tsx
@@ -1,14 +1,6 @@
 import React, { useState, useCallback, useMemo, useEffect } from 'react';
 import * as Ariakit from '@ariakit/react';
 import { TFeedback, TFeedbackTag, getTagsForRating } from 'librechat-data-provider';
-import {
-  Button,
-  OGDialog,
-  OGDialogContent,
-  OGDialogTitle,
-  ThumbUpIcon,
-  ThumbDownIcon,
-} from '@librechat/client';
 import {
   AlertCircle,
   PenTool,
@@ -19,6 +11,14 @@ import {
   Lightbulb,
   Search,
 } from 'lucide-react';
+import {
+  Button,
+  OGDialog,
+  OGDialogContent,
+  OGDialogTitle,
+  ThumbUpIcon,
+  ThumbDownIcon,
+} from '@librechat/client';
 import { useLocalize } from '~/hooks';
 import { cn } from '~/utils';
 
@@ -218,8 +218,9 @@ function buttonClasses(isActive: boolean, isLast: boolean) {
   return cn(
     'hover-button rounded-lg p-1.5 text-text-secondary-alt',
     'hover:text-text-primary hover:bg-surface-hover',
-    'md:group-hover:visible md:group-focus-within:visible md:group-[.final-completion]:visible',
-    !isLast && 'md:opacity-0 md:group-hover:opacity-100 md:group-focus-within:opacity-100',
+    'group-hover:visible group-focus-within:visible group-[.final-completion]:visible',
+    !isLast &&
+      'group-hover:opacity-100 group-focus-within:opacity-100 [@media(hover:hover)]:opacity-0',
     'focus-visible:ring-2 focus-visible:ring-black dark:focus-visible:ring-white focus-visible:outline-none',
     isActive && 'active text-text-primary bg-surface-hover',
   );
diff --git a/client/src/components/Chat/Messages/Fork.tsx b/client/src/components/Chat/Messages/Fork.tsx
index ca03533ea29..1c4e79d4b5c 100644
--- a/client/src/components/Chat/Messages/Fork.tsx
+++ b/client/src/components/Chat/Messages/Fork.tsx
@@ -229,8 +229,9 @@ export default function Fork({
   const buttonStyle = cn(
     'hover-button rounded-lg p-1.5 text-text-secondary-alt',
     'hover:text-text-primary hover:bg-surface-hover',
-    'md:group-hover:visible md:group-focus-within:visible md:group-[.final-completion]:visible',
-    !isLast && 'md:opacity-0 md:group-hover:opacity-100 md:group-focus-within:opacity-100',
+    'group-hover:visible group-focus-within:visible group-[.final-completion]:visible',
+    !isLast &&
+      'group-hover:opacity-100 group-focus-within:opacity-100 [@media(hover:hover)]:opacity-0',
     'focus-visible:ring-2 focus-visible:ring-black dark:focus-visible:ring-white focus-visible:outline-none',
     isActive && 'active text-text-primary bg-surface-hover',
   );
diff --git a/client/src/components/Chat/Messages/HoverButtons.tsx b/client/src/components/Chat/Messages/HoverButtons.tsx
index 180e8b599e1..b0e47adbca2 100644
--- a/client/src/components/Chat/Messages/HoverButtons.tsx
+++ b/client/src/components/Chat/Messages/HoverButtons.tsx
@@ -1,7 +1,7 @@
 import React, { useState, useMemo, memo } from 'react';
 import { useRecoilState } from 'recoil';
-import type { TConversation, TMessage, TFeedback } from 'librechat-data-provider';
 import { EditIcon, Clipboard, CheckMark, ContinueIcon, RegenerateIcon } from '@librechat/client';
+import type { TConversation, TMessage, TFeedback } from 'librechat-data-provider';
 import { useGenerationsByLatest, useLocalize } from '~/hooks';
 import { Fork } from '~/components/Conversations';
 import MessageAudio from './MessageAudio';
@@ -84,8 +84,9 @@ const HoverButton = memo(
     const buttonStyle = cn(
       'hover-button rounded-lg p-1.5 text-text-secondary-alt',
       'hover:text-text-primary hover:bg-surface-hover',
-      'md:group-hover:visible md:group-focus-within:visible md:group-[.final-completion]:visible',
-      !isLast && 'md:opacity-0 md:group-hover:opacity-100 md:group-focus-within:opacity-100',
+      'group-hover:visible group-focus-within:visible group-[.final-completion]:visible',
+      !isLast &&
+        'group-hover:opacity-100 group-focus-within:opacity-100 [@media(hover:hover)]:opacity-0',
       !isVisible && 'opacity-0',
       'focus-visible:ring-2 focus-visible:ring-black dark:focus-visible:ring-white focus-visible:outline-none',
       isActive && isVisible && 'active text-text-primary bg-surface-hover',
@@ -215,7 +216,9 @@ const HoverButtons = ({
         isLast={isLast}
         className={cn(
           'ml-0 flex items-center gap-1.5 text-xs',
-          isSubmitting && isCreatedByUser ? 'md:opacity-0 md:group-hover:opacity-100' : '',
+          isSubmitting && isCreatedByUser
+            ? 'group-hover:opacity-100 [@media(hover:hover)]:opacity-0'
+            : '',
         )}
       />
 
diff --git a/client/src/components/Chat/Messages/MessageNav.tsx b/client/src/components/Chat/Messages/MessageNav.tsx
index 0c2d3b0c620..2a4cd0a57e6 100644
--- a/client/src/components/Chat/Messages/MessageNav.tsx
+++ b/client/src/components/Chat/Messages/MessageNav.tsx
@@ -3,8 +3,8 @@ import { ChevronUp, ChevronDown } from 'lucide-react';
 import { ContentTypes } from 'librechat-data-provider';
 import { HoverCard, HoverCardTrigger, HoverCardPortal, HoverCardContent } from '@librechat/client';
 import type { TMessage, TMessageContentParts } from 'librechat-data-provider';
-import { useGetMessagesByConvoId } from '~/data-provider';
 import { useMessagesConversation, useMessagesSubmission } from '~/Providers';
+import { useGetMessagesByConvoId } from '~/data-provider';
 import { useLocalize } from '~/hooks';
 import { cn } from '~/utils';
 
@@ -19,7 +19,7 @@ function extractPreviewFromContent(content?: TMessageContentParts[]): string {
     return '';
   }
   for (const part of content) {
-    if (part.type !== ContentTypes.TEXT) {
+    if (part?.type !== ContentTypes.TEXT) {
       continue;
     }
     const textField = part.text;
@@ -73,6 +73,7 @@ function getMessageEntries(root: ParentNode, messagesById: Map<string, TMessage>
 const JUMP_EPS = 4;
 const SCROLL_DURATION = 400;
 const BOTTOM_SNAP_RETRIES = 2;
+const DRAG_THRESHOLD = 4;
 
 function easeOutCubic(t: number): number {
   return 1 - Math.pow(1 - t, 3);
@@ -86,6 +87,18 @@ function readScrollMargin(el: HTMLElement | null): number {
   return Number.isFinite(value) ? value : 0;
 }
 
+function computeTargetScroll(
+  container: HTMLElement,
+  el: HTMLElement,
+  scrollMargin: number,
+): number {
+  const cRect = container.getBoundingClientRect();
+  const elRect = el.getBoundingClientRect();
+  const target = container.scrollTop + (elRect.top - cRect.top) - scrollMargin;
+  const max = container.scrollHeight - container.clientHeight;
+  return Math.max(0, Math.min(target, max));
+}
+
 const indicatorButtonClasses = cn(
   'flex h-[5px] items-center justify-center rounded-sm',
   'focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-border-xheavy',
@@ -180,6 +193,9 @@ function MessageNav({ scrollableRef }: { scrollableRef: React.RefObject<HTMLDivE
   const messagesByIdRef = useRef(messagesById);
   const scrollTokenRef = useRef(0);
   const scrollMarginRef = useRef(0);
+  const navRef = useRef<HTMLElement>(null);
+  const dragCleanupRef = useRef<(() => void) | null>(null);
+  const suppressClickRef = useRef(false);
 
   const getCurrentVisibleId = useCallback((): string | null => {
     let nextId: string | null = null;
@@ -246,11 +262,7 @@ function MessageNav({ scrollableRef }: { scrollableRef: React.RefObject<HTMLDivE
       if (!current) {
         return;
       }
-      const cRect = container.getBoundingClientRect();
-      const elRect = current.getBoundingClientRect();
-      const targetScroll = container.scrollTop + (elRect.top - cRect.top) - scrollMargin;
-      const max = container.scrollHeight - container.clientHeight;
-      const clamped = Math.max(0, Math.min(targetScroll, max));
+      const clamped = computeTargetScroll(container, current, scrollMargin);
       container.scrollTop = startScroll + (clamped - startScroll) * easeOutCubic(progress);
       if (progress < 1) {
         requestAnimationFrame(step);
@@ -260,6 +272,142 @@ function MessageNav({ scrollableRef }: { scrollableRef: React.RefObject<HTMLDivE
     requestAnimationFrame(step);
   }, []);
 
+  const scrollToImmediate = useCallback((id: string) => {
+    const el = document.getElementById(id);
+    if (!el) {
+      return;
+    }
+    const container = el.closest<HTMLElement>('.scrollbar-gutter-stable');
+    if (!container) {
+      return;
+    }
+    scrollTokenRef.current++;
+    const scrollMargin = scrollMarginRef.current || readScrollMargin(el);
+    container.scrollTop = computeTargetScroll(container, el, scrollMargin);
+  }, []);
+
+  const focusMessage = useCallback((id: string) => {
+    const el = document.getElementById(id);
+    if (!el) {
+      return;
+    }
+    if (!el.hasAttribute('tabindex')) {
+      el.setAttribute('tabindex', '-1');
+    }
+    el.focus({ preventScroll: true });
+  }, []);
+
+  const handleSelect = useCallback(
+    (id: string) => {
+      if (suppressClickRef.current) {
+        suppressClickRef.current = false;
+        return;
+      }
+      scrollToStart(id);
+      focusMessage(id);
+    },
+    [scrollToStart, focusMessage],
+  );
+
+  const focusNav = useCallback((): boolean => {
+    const nav = navRef.current;
+    if (!nav) {
+      return false;
+    }
+    const target =
+      nav.querySelector<HTMLElement>('[aria-current="true"]') ??
+      nav.querySelector<HTMLElement>('[data-msg-id]');
+    if (!target) {
+      return false;
+    }
+    target.focus();
+    return document.activeElement === target;
+  }, []);
+
+  const scrubTo = useCallback(
+    (clientY: number) => {
+      const col = columnRef.current;
+      if (!col) {
+        return;
+      }
+      const ribs = col.querySelectorAll<HTMLElement>('[data-msg-id]');
+      const count = ribs.length;
+      if (count === 0) {
+        return;
+      }
+      const rect = col.getBoundingClientRect();
+      const fraction = rect.height > 0 ? (clientY - rect.top) / rect.height : 0;
+      const index = Math.max(0, Math.min(count - 1, Math.round(fraction * (count - 1))));
+      const id = ribs[index].getAttribute('data-msg-id');
+      if (id) {
+        scrollToImmediate(id);
+      }
+    },
+    [scrollToImmediate],
+  );
+
+  const handlePointerDown = useCallback(
+    (e: React.PointerEvent<HTMLDivElement>) => {
+      if (e.button !== 0) {
+        return;
+      }
+      dragCleanupRef.current?.();
+      suppressClickRef.current = false;
+      const state = { pointerId: e.pointerId, startY: e.clientY, dragging: false };
+
+      const finish = (wasDragging: boolean) => {
+        document.removeEventListener('pointermove', onMove);
+        document.removeEventListener('pointerup', onUp);
+        document.removeEventListener('pointercancel', onUp);
+        window.removeEventListener('blur', onBlur);
+        dragCleanupRef.current = null;
+        if (wasDragging) {
+          suppressClickRef.current = true;
+          window.setTimeout(() => {
+            suppressClickRef.current = false;
+          }, 0);
+        }
+      };
+
+      function onMove(ev: PointerEvent) {
+        if (ev.pointerId !== state.pointerId) {
+          return;
+        }
+        if ((ev.buttons & 1) === 0) {
+          finish(state.dragging);
+          return;
+        }
+        if (!state.dragging) {
+          if (Math.abs(ev.clientY - state.startY) < DRAG_THRESHOLD) {
+            return;
+          }
+          state.dragging = true;
+        }
+        scrubTo(ev.clientY);
+      }
+
+      function onUp(ev: PointerEvent) {
+        if (ev.pointerId !== state.pointerId) {
+          return;
+        }
+        finish(state.dragging);
+      }
+
+      function onBlur() {
+        finish(state.dragging);
+      }
+
+      dragCleanupRef.current = () => finish(state.dragging);
+      document.addEventListener('pointermove', onMove);
+      document.addEventListener('pointerup', onUp);
+      document.addEventListener('pointercancel', onUp);
+      window.addEventListener('blur', onBlur);
+    },
+    [scrubTo],
+  );
+
+  useEffect(() => () => dragCleanupRef.current?.(), []);
+
   useEffect(() => {
     refreshEntries();
 
@@ -628,13 +776,27 @@ function MessageNav({ scrollableRef }: { scrollableRef: React.RefObject<HTMLDivE
     }
   }, [entries, scrollableRef, scrollToStart]);
 
+  useEffect(() => {
+    const onKeyDown = (e: KeyboardEvent) => {
+      if (e.altKey && e.shiftKey && (e.code === 'KeyM' || e.key.toLowerCase() === 'm')) {
+        if (focusNav()) {
+          e.preventDefault();
+        }
+      }
+    };
+    document.addEventListener('keydown', onKeyDown);
+    return () => document.removeEventListener('keydown', onKeyDown);
+  }, [focusNav]);
+
   if (entries.length < 3) {
     return null;
   }
 
   return (
     <nav
+      ref={navRef}
       aria-label={localize('com_ui_message_nav')}
+      aria-keyshortcuts="Shift+Alt+M"
       className={cn(
         'group/nav absolute right-2 top-1/2 z-40 hidden max-h-[min(24rem,calc(100%-2rem))]',
         '-translate-y-1/2 flex-col items-center gap-1.5 rounded-full px-1 py-2 md:flex',
@@ -655,7 +817,8 @@ function MessageNav({ scrollableRef }: { scrollableRef: React.RefObject<HTMLDivE
 
       <div
         ref={columnRef}
-        className="flex min-h-0 flex-col items-center gap-1.5 overflow-y-auto [&::-webkit-scrollbar]:hidden"
+        onPointerDown={handlePointerDown}
+        className="flex min-h-0 cursor-grab touch-none select-none flex-col items-center gap-1.5 overflow-y-auto active:cursor-grabbing [&::-webkit-scrollbar]:hidden"
         style={{ scrollbarWidth: 'none', msOverflowStyle: 'none' }}
       >
         {entries.map((entry) => (
@@ -664,7 +827,7 @@ function MessageNav({ scrollableRef }: { scrollableRef: React.RefObject<HTMLDivE
             entry={entry}
             isActive={visibleIds.has(entry.id)}
             isCurrent={currentId === entry.id}
-            onSelect={scrollToStart}
+            onSelect={handleSelect}
             label={localize(
               entry.isUser ? 'com_ui_message_nav_go_to_user' : 'com_ui_message_nav_go_to_assistant',
               { 0: entry.preview.slice(0, 30) },
diff --git a/client/src/components/Chat/Messages/MessageParts.tsx b/client/src/components/Chat/Messages/MessageParts.tsx
index ff6b01b2ddb..c4b5930214e 100644
--- a/client/src/components/Chat/Messages/MessageParts.tsx
+++ b/client/src/components/Chat/Messages/MessageParts.tsx
@@ -5,6 +5,7 @@ import type { TMessageContentParts } from 'librechat-data-provider';
 import type { TMessageProps, TMessageIcon } from '~/common';
 import { useMessageHelpers, useLocalize, useAttachments, useContentMetadata } from '~/hooks';
 import { cn, getHeaderPrefixForScreenReader, getMessageAriaLabel } from '~/utils';
+import MessageTimestamp from '~/components/Chat/Messages/ui/MessageTimestamp';
 import MessageIcon from '~/components/Chat/Messages/MessageIcon';
 import ContentParts from './Content/ContentParts';
 import { fontSizeAtom } from '~/store/fontSize';
@@ -107,7 +108,12 @@ export default function Message(props: TMessageProps) {
           <div
             id={messageId ?? ''}
             aria-label={getMessageAriaLabel(message, localize)}
-            className={cn(baseClasses.common, baseClasses.chat, 'message-render')}
+            className={cn(
+              baseClasses.common,
+              baseClasses.chat,
+              'focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-border-xheavy',
+              'message-render',
+            )}
           >
             {!hasParallelContent && (
               <div className="relative flex flex-shrink-0 flex-col items-center">
@@ -129,6 +135,7 @@ export default function Message(props: TMessageProps) {
                     {getHeaderPrefixForScreenReader(message, localize)}
                   </span>
                   {name}
+                  <MessageTimestamp value={message.createdAt ?? message.clientTimestamp} />
                 </h2>
               )}
               <div className="flex flex-col gap-1">
diff --git a/client/src/components/Chat/Messages/MinimalHoverButtons.tsx b/client/src/components/Chat/Messages/MinimalHoverButtons.tsx
index b10e38d0314..4de428dc47d 100644
--- a/client/src/components/Chat/Messages/MinimalHoverButtons.tsx
+++ b/client/src/components/Chat/Messages/MinimalHoverButtons.tsx
@@ -1,6 +1,6 @@
 import { useState } from 'react';
 import { Clipboard, CheckMark } from '@librechat/client';
-import type { TMessage, TAttachment, SearchResultData } from 'librechat-data-provider';
+import type { TMessage, SearchResultData } from 'librechat-data-provider';
 import { useLocalize, useCopyToClipboard } from '~/hooks';
 
 type THoverButtons = {
@@ -20,7 +20,7 @@ export default function MinimalHoverButtons({ message, searchResults }: THoverBu
   return (
     <div className="visible mt-1 flex justify-center gap-1 self-end text-gray-400 lg:justify-start">
       <button
-        className="ml-0 flex items-center gap-1.5 rounded-lg p-1.5 text-xs text-text-secondary-alt transition-colors duration-200 hover:bg-surface-hover hover:text-text-primary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-black dark:focus-visible:ring-white md:opacity-0 md:group-focus-within:opacity-100 md:group-hover:opacity-100"
+        className="ml-0 flex items-center gap-1.5 rounded-lg p-1.5 text-xs text-text-secondary-alt transition-colors duration-200 hover:bg-surface-hover hover:text-text-primary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-black group-focus-within:opacity-100 group-hover:opacity-100 dark:focus-visible:ring-white [@media(hover:hover)]:opacity-0"
         onClick={() => copyToClipboard(setIsCopied)}
         type="button"
         title={
diff --git a/client/src/components/Chat/Messages/SearchMessage.tsx b/client/src/components/Chat/Messages/SearchMessage.tsx
index 982aee06cef..955810b20b6 100644
--- a/client/src/components/Chat/Messages/SearchMessage.tsx
+++ b/client/src/components/Chat/Messages/SearchMessage.tsx
@@ -1,10 +1,11 @@
 import { useMemo } from 'react';
 import { useAtomValue } from 'jotai';
 import { useRecoilValue } from 'recoil';
-import { useAuthContext, useLocalize } from '~/hooks';
 import type { TMessageProps, TMessageIcon } from '~/common';
 import MinimalHoverButtons from '~/components/Chat/Messages/MinimalHoverButtons';
+import MessageTimestamp from '~/components/Chat/Messages/ui/MessageTimestamp';
 import Icon from '~/components/Chat/Messages/MessageIcon';
+import { useAuthContext, useLocalize } from '~/hooks';
 import SearchContent from './Content/SearchContent';
 import { fontSizeAtom } from '~/store/fontSize';
 import SearchButtons from './SearchButtons';
@@ -26,7 +27,10 @@ const MessageBody = ({ message, messageLabel, fontSize }) => (
   <div
     className={cn('relative flex w-11/12 flex-col', message.isCreatedByUser ? '' : 'agent-turn')}
   >
-    <div className={cn('select-none font-semibold', fontSize)}>{messageLabel}</div>
+    <div className={cn('select-none font-semibold', fontSize)}>
+      {messageLabel}
+      <MessageTimestamp value={message.createdAt ?? message.clientTimestamp} />
+    </div>
     <SearchContent message={message} />
     <SubRow classes="text-xs">
       <MinimalHoverButtons message={message} />
diff --git a/client/src/components/Chat/Messages/SiblingSwitch.tsx b/client/src/components/Chat/Messages/SiblingSwitch.tsx
index aeb2f0cbce6..74af2c6bda3 100644
--- a/client/src/components/Chat/Messages/SiblingSwitch.tsx
+++ b/client/src/components/Chat/Messages/SiblingSwitch.tsx
@@ -26,7 +26,7 @@ export default function SiblingSwitch({
   const buttonStyle = cn(
     'hover-button rounded-lg p-1.5 text-text-secondary-alt',
     'hover:text-text-primary hover:bg-surface-hover',
-    'md:group-hover:visible md:group-focus-within:visible md:group-[.final-completion]:visible',
+    'group-hover:visible group-focus-within:visible group-[.final-completion]:visible',
     'focus-visible:ring-2 focus-visible:ring-black dark:focus-visible:ring-white focus-visible:outline-none',
   );
 
diff --git a/client/src/components/Chat/Messages/__tests__/MessageIcon.render.test.tsx b/client/src/components/Chat/Messages/__tests__/MessageIcon.render.test.tsx
index d37ad9692a6..f17767f680f 100644
--- a/client/src/components/Chat/Messages/__tests__/MessageIcon.render.test.tsx
+++ b/client/src/components/Chat/Messages/__tests__/MessageIcon.render.test.tsx
@@ -104,7 +104,7 @@ describe('MessageIcon render cycles', () => {
     const { rerender } = render(<MessageIcon iconData={baseIconData} agent={agent1} />);
     iconRenderCount.current = 0;
 
-    const agent2 = makeAgent({ avatar: { filepath: '/images/new-avatar.png' } });
+    const agent2 = makeAgent({ avatar: { filepath: '/images/new-avatar.png', source: 'local' } });
     rerender(<MessageIcon iconData={baseIconData} agent={agent2} />);
 
     expect(iconRenderCount.current).toBe(1);
diff --git a/client/src/components/Chat/Messages/__tests__/MessageIcon.test.ts b/client/src/components/Chat/Messages/__tests__/MessageIcon.test.ts
index db4e9df3163..f4f78139180 100644
--- a/client/src/components/Chat/Messages/__tests__/MessageIcon.test.ts
+++ b/client/src/components/Chat/Messages/__tests__/MessageIcon.test.ts
@@ -62,8 +62,14 @@ describe('MessageIcon arePropsEqual', () => {
   it('returns false when agent avatar filepath changes', () => {
     expect(
       arePropsEqual(
-        { iconData: baseIconData, agent: makeAgent({ avatar: { filepath: '/a.png' } }) },
-        { iconData: baseIconData, agent: makeAgent({ avatar: { filepath: '/b.png' } }) },
+        {
+          iconData: baseIconData,
+          agent: makeAgent({ avatar: { filepath: '/a.png', source: 'local' } }),
+        },
+        {
+          iconData: baseIconData,
+          agent: makeAgent({ avatar: { filepath: '/b.png', source: 'local' } }),
+        },
       ),
     ).toBe(false);
   });
diff --git a/client/src/components/Chat/Messages/__tests__/MessageNav.spec.tsx b/client/src/components/Chat/Messages/__tests__/MessageNav.spec.tsx
index 00708e76b7f..4cc9d4008a1 100644
--- a/client/src/components/Chat/Messages/__tests__/MessageNav.spec.tsx
+++ b/client/src/components/Chat/Messages/__tests__/MessageNav.spec.tsx
@@ -9,6 +9,13 @@ type TestMessage = {
   conversationId?: string;
   text?: string;
   isCreatedByUser?: boolean;
+  content?: Array<
+    | {
+        type?: string;
+        text?: string | { value?: string };
+      }
+    | undefined
+  >;
 };
 
 const mockUseGetMessagesByConvoId = jest.fn();
@@ -88,6 +95,21 @@ class MockIntersectionObserver {
 
 const originalIO = global.IntersectionObserver;
 
+class PointerEventPolyfill extends MouseEvent {
+  pointerId: number;
+  constructor(type: string, params: MouseEventInit & { pointerId?: number } = {}) {
+    super(type, params);
+    this.pointerId = params.pointerId ?? 0;
+  }
+}
+
+if (typeof (global as { PointerEvent?: unknown }).PointerEvent === 'undefined') {
+  (global as unknown as { PointerEvent: typeof PointerEventPolyfill }).PointerEvent =
+    PointerEventPolyfill;
+  (window as unknown as { PointerEvent: typeof PointerEventPolyfill }).PointerEvent =
+    PointerEventPolyfill;
+}
+
 import MessageNav from '../MessageNav';
 
 function buildMessage(overrides: Partial<TestMessage> = {}): TestMessage {
@@ -279,6 +301,22 @@ describe('MessageNav', () => {
       expect(text.endsWith('...')).toBe(true);
       expect(text.length).toBe(83);
     });
+
+    it('skips sparse content entries when deriving preview text', () => {
+      const messages = [
+        buildMessage({
+          messageId: 'a',
+          text: '',
+          isCreatedByUser: true,
+          content: [undefined, { type: 'text', text: 'content-preview' }],
+        }),
+        buildMessage({ messageId: 'b', text: 'bravo' }),
+        buildMessage({ messageId: 'c', text: 'charlie', isCreatedByUser: true }),
+      ];
+      const { container } = renderNav(messages);
+      const preview = container.querySelectorAll('[data-testid="hover-card-content"] p')[0];
+      expect(preview).toHaveTextContent('content-preview');
+    });
   });
 
   describe('accessibility', () => {
@@ -608,6 +646,311 @@ describe('MessageNav', () => {
     });
   });
 
+  describe('focus management', () => {
+    it('moves focus to the target message when an indicator is clicked', () => {
+      const messages = [
+        buildMessage({ messageId: 'a', text: 'alpha', isCreatedByUser: true }),
+        buildMessage({ messageId: 'b', text: 'bravo' }),
+        buildMessage({ messageId: 'c', text: 'charlie', isCreatedByUser: true }),
+      ];
+      const { container } = renderNav(messages);
+
+      const indicator = container.querySelectorAll('[data-msg-id]')[1] as HTMLButtonElement;
+      act(() => {
+        fireEvent.click(indicator);
+      });
+
+      const message = document.getElementById('b');
+      expect(message).toHaveAttribute('tabindex', '-1');
+      expect(document.activeElement).toBe(message);
+    });
+
+    it('focuses the current indicator when Shift+Alt+M is pressed', () => {
+      const messages = [
+        buildMessage({ messageId: 'a', text: 'alpha', isCreatedByUser: true }),
+        buildMessage({ messageId: 'b', text: 'bravo' }),
+        buildMessage({ messageId: 'c', text: 'charlie', isCreatedByUser: true }),
+      ];
+      const { container } = renderNav(messages);
+
+      const io = MockIntersectionObserver.last();
+      act(() => {
+        io!.trigger([{ target: document.getElementById('b')!, isIntersecting: true }]);
+        jest.advanceTimersByTime(32);
+      });
+
+      act(() => {
+        fireEvent.keyDown(document, { code: 'KeyM', altKey: true, shiftKey: true });
+      });
+
+      expect(document.activeElement).toBe(container.querySelector('[data-msg-id="b"]'));
+    });
+
+    it('focuses the current indicator via the produced key on non-QWERTY layouts', () => {
+      const messages = [
+        buildMessage({ messageId: 'a', text: 'alpha', isCreatedByUser: true }),
+        buildMessage({ messageId: 'b', text: 'bravo' }),
+        buildMessage({ messageId: 'c', text: 'charlie', isCreatedByUser: true }),
+      ];
+      const { container } = renderNav(messages);
+
+      const io = MockIntersectionObserver.last();
+      act(() => {
+        io!.trigger([{ target: document.getElementById('b')!, isIntersecting: true }]);
+        jest.advanceTimersByTime(32);
+      });
+
+      act(() => {
+        fireEvent.keyDown(document, { key: 'm', code: 'Semicolon', altKey: true, shiftKey: true });
+      });
+
+      expect(document.activeElement).toBe(container.querySelector('[data-msg-id="b"]'));
+    });
+
+    it('consumes Shift+Alt+M only when the nav is rendered', () => {
+      const messages = [
+        buildMessage({ messageId: 'a', text: 'alpha', isCreatedByUser: true }),
+        buildMessage({ messageId: 'b', text: 'bravo' }),
+        buildMessage({ messageId: 'c', text: 'charlie', isCreatedByUser: true }),
+      ];
+      renderNav(messages);
+
+      let notPrevented = true;
+      act(() => {
+        notPrevented = fireEvent.keyDown(document, {
+          code: 'KeyM',
+          altKey: true,
+          shiftKey: true,
+        });
+      });
+
+      expect(notPrevented).toBe(false);
+    });
+
+    it('does not consume Shift+Alt+M when the nav is not rendered', () => {
+      renderNav([buildMessage({ messageId: 'solo', text: 'only one', isCreatedByUser: true })]);
+
+      let notPrevented = true;
+      act(() => {
+        notPrevented = fireEvent.keyDown(document, {
+          code: 'KeyM',
+          altKey: true,
+          shiftKey: true,
+        });
+      });
+
+      expect(notPrevented).toBe(true);
+    });
+
+    it('ignores the keyboard shortcut without the alt and shift modifiers', () => {
+      const messages = [
+        buildMessage({ messageId: 'a', text: 'alpha', isCreatedByUser: true }),
+        buildMessage({ messageId: 'b', text: 'bravo' }),
+        buildMessage({ messageId: 'c', text: 'charlie', isCreatedByUser: true }),
+      ];
+      const { container } = renderNav(messages);
+
+      act(() => {
+        fireEvent.keyDown(document, { code: 'KeyM' });
+      });
+
+      const navButtons = container.querySelectorAll('[data-msg-id]');
+      expect(Array.from(navButtons)).not.toContain(document.activeElement);
+    });
+  });
+
+  describe('drag to scroll', () => {
+    function setupDraggableNav() {
+      const messages = Array.from({ length: 5 }, (_, i) =>
+        buildMessage({
+          messageId: `m-${i}`,
+          text: `message ${i}`,
+          isCreatedByUser: i % 2 === 0,
+        }),
+      );
+      const result = renderNav(messages);
+      const column = result.container.querySelector('nav > div') as HTMLDivElement;
+      column.getBoundingClientRect = () => ({ top: 0, bottom: 50, height: 50 }) as DOMRect;
+
+      const ribs = Array.from(column.querySelectorAll('[data-msg-id]')) as HTMLElement[];
+
+      const writes: number[] = [];
+      Object.defineProperty(result.scrollable, 'scrollTop', {
+        get: () => 0,
+        set: (v: number) => {
+          writes.push(v);
+        },
+        configurable: true,
+      });
+
+      return { ...result, column, ribs, writes };
+    }
+
+    it('scrubs the conversation while dragging past the threshold', () => {
+      const { column, writes } = setupDraggableNav();
+
+      act(() => {
+        fireEvent.pointerDown(column, { pointerId: 1, button: 0, buttons: 1, clientY: 0 });
+        fireEvent.pointerMove(document, { pointerId: 1, buttons: 1, clientY: 25 });
+      });
+
+      expect(writes.length).toBeGreaterThan(0);
+    });
+
+    it('keeps tracking the drag after the pointer leaves the narrow column', () => {
+      const { column, writes } = setupDraggableNav();
+
+      act(() => {
+        fireEvent.pointerDown(column, { pointerId: 1, button: 0, buttons: 1, clientY: 0 });
+        // pointer has moved off the column; the move bubbles to the document listener
+        fireEvent.pointerMove(document.body, { pointerId: 1, buttons: 1, clientY: 25 });
+      });
+
+      expect(writes.length).toBeGreaterThan(0);
+    });
+
+    it('maps the pointer proportionally across the full set of messages', () => {
+      const { column } = setupDraggableNav();
+      const getById = jest.spyOn(document, 'getElementById');
+
+      act(() => {
+        fireEvent.pointerDown(column, { pointerId: 1, button: 0, buttons: 1, clientY: 0 });
+        fireEvent.pointerMove(document, { pointerId: 1, buttons: 1, clientY: 25 });
+      });
+      expect(getById.mock.calls.map((c) => c[0])).toContain('m-2');
+
+      getById.mockClear();
+      act(() => {
+        fireEvent.pointerMove(document, { pointerId: 1, buttons: 1, clientY: 50 });
+      });
+      expect(getById.mock.calls.map((c) => c[0])).toContain('m-4');
+
+      getById.mockRestore();
+    });
+
+    it('does not scrub for movement under the threshold', () => {
+      const { column, writes } = setupDraggableNav();
+
+      act(() => {
+        fireEvent.pointerDown(column, { pointerId: 1, button: 0, buttons: 1, clientY: 0 });
+        fireEvent.pointerMove(document, { pointerId: 1, buttons: 1, clientY: 2 });
+      });
+
+      expect(writes.length).toBe(0);
+    });
+
+    it('ignores pointer moves after the interaction ends', () => {
+      const { column, writes } = setupDraggableNav();
+
+      act(() => {
+        fireEvent.pointerDown(column, { pointerId: 1, button: 0, buttons: 1, clientY: 0 });
+        fireEvent.pointerUp(document, { pointerId: 1, clientY: 0 });
+      });
+      act(() => {
+        fireEvent.pointerMove(document, { pointerId: 1, buttons: 1, clientY: 40 });
+      });
+
+      expect(writes.length).toBe(0);
+    });
+
+    it('ends the drag when the primary button is released during a move', () => {
+      const { column, writes } = setupDraggableNav();
+
+      act(() => {
+        fireEvent.pointerDown(column, { pointerId: 1, button: 0, buttons: 1, clientY: 0 });
+        fireEvent.pointerMove(document, { pointerId: 1, buttons: 1, clientY: 25 });
+        fireEvent.pointerMove(document, { pointerId: 1, buttons: 0, clientY: 30 });
+      });
+      const before = writes.length;
+      act(() => {
+        fireEvent.pointerMove(document, { pointerId: 1, buttons: 1, clientY: 45 });
+      });
+
+      expect(writes.length).toBe(before);
+    });
+
+    it('ends the drag when the window loses focus', () => {
+      const { column, writes } = setupDraggableNav();
+
+      act(() => {
+        fireEvent.pointerDown(column, { pointerId: 1, button: 0, buttons: 1, clientY: 0 });
+        fireEvent.pointerMove(document, { pointerId: 1, buttons: 1, clientY: 25 });
+        window.dispatchEvent(new Event('blur'));
+      });
+      const before = writes.length;
+      act(() => {
+        fireEvent.pointerMove(document, { pointerId: 1, buttons: 1, clientY: 45 });
+      });
+
+      expect(writes.length).toBe(before);
+    });
+
+    it('tears down a previous drag when a new pointer starts', () => {
+      const { column, writes } = setupDraggableNav();
+
+      act(() => {
+        fireEvent.pointerDown(column, { pointerId: 1, button: 0, buttons: 1, clientY: 0 });
+        fireEvent.pointerMove(document, { pointerId: 1, buttons: 1, clientY: 25 });
+      });
+      act(() => {
+        fireEvent.pointerDown(column, { pointerId: 2, button: 0, buttons: 1, clientY: 0 });
+      });
+      const before = writes.length;
+      act(() => {
+        fireEvent.pointerMove(document, { pointerId: 1, buttons: 1, clientY: 45 });
+      });
+
+      expect(writes.length).toBe(before);
+    });
+
+    it('selects via the native click when a press does not become a drag', () => {
+      const { column, ribs } = setupDraggableNav();
+
+      act(() => {
+        fireEvent.pointerDown(column, { pointerId: 1, button: 0, buttons: 1, clientY: 0 });
+        fireEvent.pointerUp(document, { pointerId: 1, clientY: 0 });
+      });
+      act(() => {
+        fireEvent.click(ribs[0]);
+      });
+
+      expect(document.activeElement).toBe(document.getElementById('m-0'));
+    });
+
+    it('suppresses the click that immediately follows a drag', () => {
+      const { column, ribs } = setupDraggableNav();
+
+      act(() => {
+        fireEvent.pointerDown(column, { pointerId: 1, button: 0, buttons: 1, clientY: 0 });
+        fireEvent.pointerMove(document, { pointerId: 1, buttons: 1, clientY: 25 });
+        fireEvent.pointerUp(document, { pointerId: 1, clientY: 25 });
+      });
+
+      act(() => {
+        fireEvent.click(ribs[0]);
+      });
+
+      expect(document.activeElement).not.toBe(document.getElementById('m-0'));
+    });
+
+    it('clears click suppression after the drag so a later activation is honored', () => {
+      const { column, ribs } = setupDraggableNav();
+
+      act(() => {
+        fireEvent.pointerDown(column, { pointerId: 1, button: 0, buttons: 1, clientY: 0 });
+        fireEvent.pointerMove(document, { pointerId: 1, buttons: 1, clientY: 25 });
+        fireEvent.pointerUp(document, { pointerId: 1, clientY: 25 });
+        jest.advanceTimersByTime(1);
+      });
+
+      act(() => {
+        fireEvent.click(ribs[0]);
+      });
+
+      expect(document.activeElement).toBe(document.getElementById('m-0'));
+    });
+  });
+
   describe('observers', () => {
     it('observes each message on mount', () => {
       const messages = [
diff --git a/client/src/components/Chat/Messages/ui/MessageRender.tsx b/client/src/components/Chat/Messages/ui/MessageRender.tsx
index dd556360364..c285d68b272 100644
--- a/client/src/components/Chat/Messages/ui/MessageRender.tsx
+++ b/client/src/components/Chat/Messages/ui/MessageRender.tsx
@@ -5,6 +5,7 @@ import type { TMessage } from 'librechat-data-provider';
 import type { TMessageProps, TMessageIcon, TMessageChatContext } from '~/common';
 import { cn, getHeaderPrefixForScreenReader, getMessageAriaLabel } from '~/utils';
 import MessageContent from '~/components/Chat/Messages/Content/MessageContent';
+import MessageTimestamp from '~/components/Chat/Messages/ui/MessageTimestamp';
 import { useLocalize, useMessageActions, useContentMetadata } from '~/hooks';
 import PlaceholderRow from '~/components/Chat/Messages/ui/PlaceholderRow';
 import SiblingSwitch from '~/components/Chat/Messages/SiblingSwitch';
@@ -72,6 +73,7 @@ function areMessageRenderPropsEqual(prev: MessageRenderProps, next: MessageRende
     prevMsg.text === nextMsg.text &&
     prevMsg.error === nextMsg.error &&
     prevMsg.unfinished === nextMsg.unfinished &&
+    prevMsg.createdAt === nextMsg.createdAt &&
     prevMsg.depth === nextMsg.depth &&
     prevMsg.isCreatedByUser === nextMsg.isCreatedByUser &&
     (prevMsg.children?.length ?? 0) === (nextMsg.children?.length ?? 0) &&
@@ -179,7 +181,7 @@ const MessageRender = memo(function MessageRender({
   };
 
   const conditionalClasses = {
-    focus: 'focus:outline-none focus:ring-2 focus:ring-border-xheavy',
+    focus: 'focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-border-xheavy',
   };
 
   return (
@@ -212,6 +214,7 @@ const MessageRender = memo(function MessageRender({
           <h2 className={cn('select-none font-semibold', fontSize)}>
             <span className="sr-only">{getHeaderPrefixForScreenReader(msg, localize)}</span>
             {messageLabel}
+            <MessageTimestamp value={msg.createdAt ?? msg.clientTimestamp} />
           </h2>
         )}
 
diff --git a/client/src/components/Chat/Messages/ui/MessageTimestamp.tsx b/client/src/components/Chat/Messages/ui/MessageTimestamp.tsx
new file mode 100644
index 00000000000..079fa4349ce
--- /dev/null
+++ b/client/src/components/Chat/Messages/ui/MessageTimestamp.tsx
@@ -0,0 +1,31 @@
+import { useTranslation } from 'react-i18next';
+import useTimeTick from '~/hooks/useTimeTick';
+import { getMessageTimestamp } from '~/utils';
+
+/**
+ * Inline message timestamp shown next to the author name in the message header.
+ * On hover-capable pointers it reveals on row hover/focus; on touch and other
+ * non-hover devices it stays visible. Recent messages show the relative form
+ * ("10 minutes ago") with the absolute date on hover; older messages show the
+ * absolute date directly.
+ */
+export default function MessageTimestamp({ value }: { value?: string | null }) {
+  const { i18n } = useTranslation();
+  // Re-render on a shared interval so relative labels stay current while idle.
+  useTimeTick();
+  const timestamp = getMessageTimestamp(value, i18n.language);
+
+  if (!timestamp) {
+    return null;
+  }
+
+  return (
+    <time
+      dateTime={timestamp.iso}
+      title={timestamp.isRecent ? timestamp.absolute : undefined}
+      className="ml-2 text-xs font-normal text-text-secondary transition-opacity duration-200 group-focus-within:opacity-100 group-hover:opacity-100 [@media(hover:hover)]:opacity-0"
+    >
+      {timestamp.isRecent ? timestamp.relative : timestamp.absolute}
+    </time>
+  );
+}
diff --git a/client/src/components/Chat/ProjectLandingChip.tsx b/client/src/components/Chat/ProjectLandingChip.tsx
new file mode 100644
index 00000000000..22692e8c007
--- /dev/null
+++ b/client/src/components/Chat/ProjectLandingChip.tsx
@@ -0,0 +1,89 @@
+import { useCallback, useMemo } from 'react';
+import { useSearchParams } from 'react-router-dom';
+import { Folder, X } from 'lucide-react';
+import { ControlCombobox, TooltipAnchor } from '@librechat/client';
+import type { TChatProject } from 'librechat-data-provider';
+import type { OptionWithIcon } from '~/common';
+import { useProjectsInfiniteQuery } from '~/data-provider';
+import { useChatContext } from '~/Providers';
+import { useLocalize } from '~/hooks';
+
+/**
+ * Subtle project indicator shown on a project-scoped new-chat landing.
+ * Clicking the chip switches the project (searchable combobox); the trailing
+ * `×` removes the project scope. Both update the conversation draft and the
+ * `?projectId` search param in place, so the typed message and model are kept.
+ */
+export default function ProjectLandingChip({ project }: { project: TChatProject }) {
+  const localize = useLocalize();
+  const { conversation, setConversation } = useChatContext();
+  const [searchParams, setSearchParams] = useSearchParams();
+
+  const { data } = useProjectsInfiniteQuery(
+    { sortBy: 'lastConversationAt', sortDirection: 'desc', limit: 100 },
+    { staleTime: 30000 },
+  );
+  const projects = useMemo(() => data?.pages.flatMap((page) => page.projects) ?? [], [data?.pages]);
+  const items = useMemo<OptionWithIcon[]>(
+    () =>
+      projects.map((item) => ({
+        label: item.name,
+        value: item._id,
+        icon: <Folder className="h-4 w-4 text-text-secondary" aria-hidden="true" />,
+      })),
+    [projects],
+  );
+
+  const applyProject = useCallback(
+    (projectId: string | null) => {
+      if (conversation) {
+        setConversation({ ...conversation, chatProjectId: projectId });
+      }
+      const nextParams = new URLSearchParams(searchParams);
+      if (projectId) {
+        nextParams.set('projectId', projectId);
+      } else {
+        nextParams.delete('projectId');
+      }
+      setSearchParams(nextParams, { replace: true });
+    },
+    [conversation, setConversation, searchParams, setSearchParams],
+  );
+
+  return (
+    <div className="group mb-2.5 flex items-center gap-1 px-1">
+      <ControlCombobox
+        selectId="project-landing-select"
+        selectedValue={project._id}
+        displayValue={project.name}
+        items={items}
+        setValue={(value) => {
+          if (value) {
+            applyProject(value);
+          }
+        }}
+        SelectIcon={<Folder className="h-3.5 w-3.5 text-text-secondary" aria-hidden="true" />}
+        ariaLabel={localize('com_ui_change_project')}
+        searchPlaceholder={localize('com_ui_search_projects')}
+        isCollapsed={false}
+        showCarat={true}
+        placement="top"
+        containerClassName="w-auto px-0"
+        className="h-8 w-auto min-w-[11rem] gap-1.5 rounded-full px-2.5 text-sm font-medium text-text-secondary hover:text-text-primary"
+      />
+      <TooltipAnchor
+        description={localize('com_ui_remove_from_project')}
+        render={
+          <button
+            type="button"
+            aria-label={localize('com_ui_remove_from_project')}
+            onClick={() => applyProject(null)}
+            className="flex h-7 w-7 shrink-0 items-center justify-center rounded-full text-text-secondary opacity-0 outline-none transition-all hover:bg-surface-hover hover:text-text-primary focus-visible:opacity-100 focus-visible:ring-2 focus-visible:ring-ring-primary group-hover:opacity-100"
+          >
+            <X className="h-3.5 w-3.5" aria-hidden="true" />
+          </button>
+        }
+      />
+    </div>
+  );
+}
diff --git a/client/src/components/Conversations/ConversationEndpointIcon.tsx b/client/src/components/Conversations/ConversationEndpointIcon.tsx
new file mode 100644
index 00000000000..381fe541858
--- /dev/null
+++ b/client/src/components/Conversations/ConversationEndpointIcon.tsx
@@ -0,0 +1,49 @@
+import { memo } from 'react';
+import type { TConversation, TEndpointsConfig } from 'librechat-data-provider';
+import { useAgentsMapContext, useAssistantsMapContext } from '~/Providers';
+import EndpointIcon from '~/components/Endpoints/EndpointIcon';
+import { areConversationIconFieldsEqual } from './utils';
+import { useGetEndpointsQuery } from '~/data-provider';
+
+const emptyEndpointsConfig = {} as TEndpointsConfig;
+
+type EndpointIconContext = 'message' | 'nav' | 'landing' | 'menu-item';
+
+type ConversationEndpointIconProps = {
+  conversation: TConversation;
+  className?: string;
+  context?: EndpointIconContext;
+  size?: number;
+};
+
+function ConversationEndpointIcon({
+  conversation,
+  className,
+  context = 'menu-item',
+  size = 20,
+}: ConversationEndpointIconProps) {
+  const { data: endpointsConfig = emptyEndpointsConfig } = useGetEndpointsQuery();
+  const agentsMap = useAgentsMapContext();
+  const assistantMap = useAssistantsMapContext();
+
+  return (
+    <EndpointIcon
+      conversation={conversation}
+      endpointsConfig={endpointsConfig}
+      assistantMap={assistantMap}
+      agentsMap={agentsMap}
+      className={className}
+      size={size}
+      context={context}
+    />
+  );
+}
+
+export default memo(ConversationEndpointIcon, (prevProps, nextProps) => {
+  return (
+    prevProps.className === nextProps.className &&
+    prevProps.context === nextProps.context &&
+    prevProps.size === nextProps.size &&
+    areConversationIconFieldsEqual(prevProps.conversation, nextProps.conversation)
+  );
+});
diff --git a/client/src/components/Conversations/Conversations.tsx b/client/src/components/Conversations/Conversations.tsx
index 4a4e1308841..68bf043c633 100644
--- a/client/src/components/Conversations/Conversations.tsx
+++ b/client/src/components/Conversations/Conversations.tsx
@@ -1,14 +1,23 @@
 import { useMemo, memo, type FC, useCallback, useEffect, useRef } from 'react';
 import throttle from 'lodash/throttle';
-import { ChevronDown } from 'lucide-react';
 import { useRecoilValue } from 'recoil';
-import { Spinner, useMediaQuery } from '@librechat/client';
-import { List, AutoSizer, CellMeasurer, CellMeasurerCache } from 'react-virtualized';
+import { ChevronDown } from 'lucide-react';
+import { QueryKeys } from 'librechat-data-provider';
+import { useQueryClient } from '@tanstack/react-query';
+import { List, CellMeasurer, CellMeasurerCache } from 'react-virtualized';
+import { Spinner, TooltipAnchor, NewChatIcon, useMediaQuery } from '@librechat/client';
 import type { TConversation } from 'librechat-data-provider';
-import { useLocalize, TranslationKeys, useFavorites, useShowMarketplace } from '~/hooks';
+import {
+  useLocalize,
+  TranslationKeys,
+  useFavorites,
+  useShowMarketplace,
+  useNewConvo,
+  useElementSize,
+} from '~/hooks';
+import { groupConversationsByDate, clearMessagesCache, cn } from '~/utils';
 import FavoritesList from '~/components/Nav/Favorites/FavoritesList';
 import { useActiveJobs } from '~/data-provider';
-import { groupConversationsByDate, cn } from '~/utils';
 import Convo from './Convo';
 import store from '~/store';
 
@@ -32,6 +41,7 @@ interface ConversationsProps {
   isSearchLoading: boolean;
   isChatsExpanded: boolean;
   setIsChatsExpanded: (expanded: boolean) => void;
+  showFavorites?: boolean;
 }
 
 interface MeasuredRowProps {
@@ -76,20 +86,53 @@ interface ChatsHeaderProps {
   onToggle: () => void;
 }
 
+const headerIconButtonClassName =
+  'flex h-7 w-7 shrink-0 items-center justify-center rounded-md text-text-secondary outline-none transition-colors hover:bg-surface-active-alt hover:text-text-primary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-black dark:focus-visible:ring-white';
+
 /** Collapsible header for the Chats section */
 const ChatsHeader: FC<ChatsHeaderProps> = memo(({ isExpanded, onToggle }) => {
   const localize = useLocalize();
+  const queryClient = useQueryClient();
+  const { newConversation } = useNewConvo();
+  const conversation = useRecoilValue(store.conversationByIndex(0));
+
+  const handleNewChat = useCallback(() => {
+    clearMessagesCache(queryClient, conversation?.conversationId);
+    queryClient.invalidateQueries([QueryKeys.messages]);
+    newConversation();
+  }, [conversation?.conversationId, newConversation, queryClient]);
+
   return (
-    <button
-      onClick={onToggle}
-      className="group flex w-full items-center justify-between rounded-lg px-1 py-2 text-xs font-bold text-text-secondary outline-none focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-black dark:focus-visible:ring-white"
-      type="button"
-    >
-      <span className="select-none">{localize('com_ui_chats')}</span>
-      <ChevronDown
-        className={cn('h-3 w-3 transition-transform duration-200', isExpanded ? 'rotate-180' : '')}
+    <div className="flex h-8 w-full items-center gap-0.5 pr-2">
+      <button
+        onClick={onToggle}
+        className="group flex min-w-0 flex-1 items-center gap-1 rounded-lg px-1 py-2 text-xs font-bold text-text-secondary outline-none focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-black dark:focus-visible:ring-white"
+        type="button"
+        aria-expanded={isExpanded}
+      >
+        <span className="select-none truncate">{localize('com_ui_chats')}</span>
+        <ChevronDown
+          className={cn(
+            'h-3 w-3 shrink-0 transition-transform duration-200',
+            isExpanded ? '' : '-rotate-90',
+          )}
+          aria-hidden="true"
+        />
+      </button>
+      <TooltipAnchor
+        description={localize('com_ui_new_chat')}
+        render={
+          <button
+            type="button"
+            aria-label={localize('com_ui_new_chat')}
+            className={headerIconButtonClassName}
+            onClick={handleNewChat}
+          >
+            <NewChatIcon className="h-4 w-4" />
+          </button>
+        }
       />
-    </button>
+    </div>
   );
 });
 
@@ -114,42 +157,10 @@ DateLabel.displayName = 'DateLabel';
 
 type FlattenedItem =
   | { type: 'favorites' }
-  | { type: 'chats-header' }
   | { type: 'header'; groupName: string }
   | { type: 'convo'; convo: TConversation }
   | { type: 'loading' };
 
-const MemoizedConvo = memo(
-  ({
-    conversation,
-    retainView,
-    toggleNav,
-    isGenerating,
-  }: {
-    conversation: TConversation;
-    retainView: () => void;
-    toggleNav: () => void;
-    isGenerating: boolean;
-  }) => {
-    return (
-      <Convo
-        conversation={conversation}
-        retainView={retainView}
-        toggleNav={toggleNav}
-        isGenerating={isGenerating}
-      />
-    );
-  },
-  (prevProps, nextProps) => {
-    return (
-      prevProps.conversation.conversationId === nextProps.conversation.conversationId &&
-      prevProps.conversation.title === nextProps.conversation.title &&
-      prevProps.conversation.endpoint === nextProps.conversation.endpoint &&
-      prevProps.isGenerating === nextProps.isGenerating
-    );
-  },
-);
-
 const Conversations: FC<ConversationsProps> = ({
   conversations: rawConversations,
   moveToTop,
@@ -160,6 +171,7 @@ const Conversations: FC<ConversationsProps> = ({
   isSearchLoading,
   isChatsExpanded,
   setIsChatsExpanded,
+  showFavorites = true,
 }) => {
   const localize = useLocalize();
   const search = useRecoilValue(store.search);
@@ -167,6 +179,11 @@ const Conversations: FC<ConversationsProps> = ({
   const isSmallScreen = useMediaQuery('(max-width: 768px)');
   const convoHeight = isSmallScreen ? 44 : 34;
   const showAgentMarketplace = useShowMarketplace();
+  const {
+    ref: listContainerRef,
+    width: listWidth,
+    height: listHeight,
+  } = useElementSize<HTMLDivElement>();
 
   const favoritesContentKeyRef = useRef('');
 
@@ -179,7 +196,9 @@ const Conversations: FC<ConversationsProps> = ({
 
   // Determine if FavoritesList will render content
   const shouldShowFavorites =
-    !search.query && (isFavoritesLoading || favorites.length > 0 || showAgentMarketplace);
+    showFavorites &&
+    !search.query &&
+    (isFavoritesLoading || favorites.length > 0 || showAgentMarketplace);
 
   favoritesContentKeyRef.current = `${favorites.length}-${showAgentMarketplace ? 1 : 0}-${isFavoritesLoading ? 1 : 0}`;
 
@@ -199,7 +218,6 @@ const Conversations: FC<ConversationsProps> = ({
     if (shouldShowFavorites) {
       items.push({ type: 'favorites' });
     }
-    items.push({ type: 'chats-header' });
 
     if (isChatsExpanded) {
       groupedConversations.forEach(([groupName, convos]) => {
@@ -232,11 +250,9 @@ const Conversations: FC<ConversationsProps> = ({
           if (item.type === 'favorites') {
             return `favorites-${favoritesContentKeyRef.current}`;
           }
-          if (item.type === 'chats-header') {
-            return 'chats-header';
-          }
           if (item.type === 'header') {
-            return `header-${item.groupName}`;
+            const firstHeaderIndex = flattenedItemsRef.current[0]?.type === 'favorites' ? 1 : 0;
+            return `header-${item.groupName}-${index === firstHeaderIndex ? 'first' : 'sub'}`;
           }
           if (item.type === 'convo') {
             return `convo-${item.convo.conversationId}`;
@@ -276,6 +292,17 @@ const Conversations: FC<ConversationsProps> = ({
     return () => cancelAnimationFrame(frameId);
   }, [search.query, cache, containerRef]);
 
+  /** Grid only re-derives row offsets when the row count changes; reorders that
+   *  keep the count (e.g. a convo bumped across date groups) need an explicit recompute. */
+  useEffect(() => {
+    const frameId = requestAnimationFrame(() => {
+      if (containerRef.current && 'recomputeRowHeights' in containerRef.current) {
+        containerRef.current.recomputeRowHeights(0);
+      }
+    });
+    return () => cancelAnimationFrame(frameId);
+  }, [flattenedItems, containerRef]);
+
   const rowRenderer = useCallback(
     ({ index, key, parent, style }) => {
       const item = flattenedItems[index];
@@ -297,22 +324,9 @@ const Conversations: FC<ConversationsProps> = ({
         );
       }
 
-      if (item.type === 'chats-header') {
-        return (
-          <MeasuredRow key={key} {...rowProps}>
-            <ChatsHeader
-              isExpanded={isChatsExpanded}
-              onToggle={() => setIsChatsExpanded(!isChatsExpanded)}
-            />
-          </MeasuredRow>
-        );
-      }
-
       if (item.type === 'header') {
-        // First date header index depends on whether favorites row is included
-        // With favorites: [favorites, chats-header, first-header] → index 2
-        // Without favorites: [chats-header, first-header] → index 1
-        const firstHeaderIndex = shouldShowFavorites ? 2 : 1;
+        // First date header index depends on whether the favorites row is included
+        const firstHeaderIndex = flattenedItems[0]?.type === 'favorites' ? 1 : 0;
         return (
           <MeasuredRow key={key} {...rowProps}>
             <DateLabel groupName={item.groupName} isFirst={index === firstHeaderIndex} />
@@ -324,7 +338,7 @@ const Conversations: FC<ConversationsProps> = ({
         const isGenerating = activeJobIds.has(item.convo.conversationId ?? '');
         return (
           <MeasuredRow key={key} {...rowProps}>
-            <MemoizedConvo
+            <Convo
               conversation={item.convo}
               retainView={moveToTop}
               toggleNav={toggleNav}
@@ -336,17 +350,7 @@ const Conversations: FC<ConversationsProps> = ({
 
       return null;
     },
-    [
-      cache,
-      flattenedItems,
-      moveToTop,
-      toggleNav,
-      isSmallScreen,
-      isChatsExpanded,
-      setIsChatsExpanded,
-      shouldShowFavorites,
-      activeJobIds,
-    ],
+    [cache, flattenedItems, moveToTop, toggleNav, isSmallScreen, activeJobIds],
   );
 
   const getRowHeight = useCallback(
@@ -370,34 +374,36 @@ const Conversations: FC<ConversationsProps> = ({
 
   return (
     <div className="relative flex h-full min-h-0 flex-col pb-2 text-sm text-text-primary">
+      <div className="px-3">
+        <ChatsHeader
+          isExpanded={isChatsExpanded}
+          onToggle={() => setIsChatsExpanded(!isChatsExpanded)}
+        />
+      </div>
       {isSearchLoading ? (
         <div className="flex flex-1 items-center justify-center">
           <Spinner className="text-text-primary" />
           <span className="ml-2 text-text-primary">{localize('com_ui_loading')}</span>
         </div>
       ) : (
-        <div className="flex-1">
-          <AutoSizer>
-            {({ width, height }) => (
-              <List
-                ref={containerRef}
-                width={width}
-                height={height}
-                deferredMeasurementCache={cache}
-                rowCount={flattenedItems.length}
-                rowHeight={getRowHeight}
-                rowRenderer={rowRenderer}
-                overscanRowCount={10}
-                aria-readonly={false}
-                className="outline-none"
-                aria-label="Conversations"
-                onRowsRendered={handleRowsRendered}
-                tabIndex={-1}
-                style={{ outline: 'none' }}
-                containerRole="rowgroup"
-              />
-            )}
-          </AutoSizer>
+        <div ref={listContainerRef} className="min-h-0 flex-1 overflow-hidden">
+          <List
+            ref={containerRef}
+            width={listWidth}
+            height={listHeight}
+            deferredMeasurementCache={cache}
+            rowCount={flattenedItems.length}
+            rowHeight={getRowHeight}
+            rowRenderer={rowRenderer}
+            overscanRowCount={10}
+            aria-readonly={false}
+            className="outline-none"
+            aria-label="Conversations"
+            onRowsRendered={handleRowsRendered}
+            tabIndex={-1}
+            style={{ outline: 'none' }}
+            containerRole="rowgroup"
+          />
         </div>
       )}
     </div>
diff --git a/client/src/components/Conversations/Convo.tsx b/client/src/components/Conversations/Convo.tsx
index 46e3be09ebc..95d6198df43 100644
--- a/client/src/components/Conversations/Convo.tsx
+++ b/client/src/components/Conversations/Convo.tsx
@@ -1,13 +1,13 @@
-import React, { useState, useEffect, useRef, useMemo, useCallback } from 'react';
+import React, { memo, useState, useEffect, useRef, useMemo, useCallback } from 'react';
 import { useRecoilValue } from 'recoil';
 import { useParams } from 'react-router-dom';
 import { Constants } from 'librechat-data-provider';
 import { useToastContext, useMediaQuery } from '@librechat/client';
 import type { TConversation } from 'librechat-data-provider';
-import { useUpdateConversationMutation } from '~/data-provider';
-import EndpointIcon from '~/components/Endpoints/EndpointIcon';
 import { useNavigateToConvo, useLocalize, useShiftKey } from '~/hooks';
-import { useGetEndpointsQuery } from '~/data-provider';
+import ConversationEndpointIcon from './ConversationEndpointIcon';
+import { useUpdateConversationMutation } from '~/data-provider';
+import { areConversationRenderPropsEqual } from './utils';
 import { NotificationSeverity } from '~/common';
 import { ConvoOptions } from './ConvoOptions';
 import RenameForm from './RenameForm';
@@ -22,7 +22,7 @@ interface ConversationProps {
   isGenerating?: boolean;
 }
 
-export default function Conversation({
+function Conversation({
   conversation,
   retainView,
   toggleNav,
@@ -32,7 +32,6 @@ export default function Conversation({
   const localize = useLocalize();
   const { showToast } = useToastContext();
   const { navigateToConvo } = useNavigateToConvo();
-  const { data: endpointsConfig } = useGetEndpointsQuery();
   const currentConvoId = useMemo(() => params.conversationId, [params.conversationId]);
   const updateConvoMutation = useUpdateConversationMutation(currentConvoId ?? '');
   const activeConvos = useRecoilValue(store.allConversationsSelector);
@@ -171,11 +170,48 @@ export default function Conversation({
     renameHandler: handleRename,
     isActiveConvo,
     conversationId,
+    chatProjectId: conversation.chatProjectId,
     isPopoverActive,
     setIsPopoverActive: handlePopoverOpenChange,
     isShiftHeld: isActiveConvo ? isShiftHeld : false,
   };
 
+  const generatingSpinner = (
+    <svg
+      className="h-5 w-5 flex-shrink-0 animate-spin text-text-primary"
+      viewBox="0 0 24 24"
+      fill="none"
+      aria-label={localize('com_ui_generating')}
+    >
+      <circle className="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" strokeWidth="3" />
+      <path
+        className="opacity-75"
+        fill="currentColor"
+        d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
+      />
+    </svg>
+  );
+
+  let actionVisibilityClassName =
+    'pointer-events-none max-w-0 scale-x-0 opacity-0 group-focus-within:pointer-events-auto group-focus-within:max-w-[60px] group-focus-within:scale-x-100 group-focus-within:opacity-100 group-hover:pointer-events-auto group-hover:max-w-[60px] group-hover:scale-x-100 group-hover:opacity-100';
+  if (isGenerating) {
+    actionVisibilityClassName = 'pointer-events-none w-5 scale-x-100 opacity-100';
+  } else if (isPopoverActive || isActiveConvo) {
+    actionVisibilityClassName = 'pointer-events-auto scale-x-100 opacity-100';
+  }
+
+  let actionWidthClassName = '';
+  if (!isGenerating && !isPopoverActive && isActiveConvo && isShiftHeld) {
+    actionWidthClassName = 'max-w-[60px]';
+  } else if (!isGenerating) {
+    actionWidthClassName = 'max-w-[28px]';
+  }
+
+  const showConvoOptions = !renaming && (hasInteracted || isActiveConvo);
+  const actionContent = isGenerating
+    ? generatingSpinner
+    : showConvoOptions && <ConvoOptions {...convoOptionsProps} />;
+
   return (
     <div
       ref={containerRef}
@@ -234,54 +270,24 @@ export default function Conversation({
           isSmallScreen={isSmallScreen}
           localize={localize}
         >
-          {isGenerating ? (
-            <svg
-              className="h-5 w-5 flex-shrink-0 animate-spin text-text-primary"
-              viewBox="0 0 24 24"
-              fill="none"
-              aria-label={localize('com_ui_generating')}
-            >
-              <circle
-                className="opacity-25"
-                cx="12"
-                cy="12"
-                r="10"
-                stroke="currentColor"
-                strokeWidth="3"
-              />
-              <path
-                className="opacity-75"
-                fill="currentColor"
-                d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
-              />
-            </svg>
-          ) : (
-            <EndpointIcon
-              conversation={conversation}
-              endpointsConfig={endpointsConfig}
-              size={20}
-              context="menu-item"
-            />
-          )}
+          <ConversationEndpointIcon conversation={conversation} size={20} context="menu-item" />
         </ConvoLink>
       )}
       <div
         className={cn(
-          'mr-2 flex origin-left',
-          isPopoverActive || isActiveConvo
-            ? 'pointer-events-auto scale-x-100 opacity-100'
-            : 'pointer-events-none max-w-0 scale-x-0 opacity-0 group-focus-within:pointer-events-auto group-focus-within:max-w-[60px] group-focus-within:scale-x-100 group-focus-within:opacity-100 group-hover:pointer-events-auto group-hover:max-w-[60px] group-hover:scale-x-100 group-hover:opacity-100',
-          !isPopoverActive && isActiveConvo && isShiftHeld ? 'max-w-[60px]' : 'max-w-[28px]',
+          'mr-2 flex origin-left items-center justify-center',
+          actionVisibilityClassName,
+          actionWidthClassName,
         )}
         // Removing aria-hidden to fix accessibility issue: ARIA hidden element must not be focusable or contain focusable elements
         // but not sure what its original purpose was, so leaving the property commented out until it can be cleared safe to delete.
         // aria-hidden={!(isPopoverActive || isActiveConvo)}
       >
         {/* Only render ConvoOptions when user interacts (hover/focus) or for active conversation */}
-        {!renaming && !isGenerating && (hasInteracted || isActiveConvo) && (
-          <ConvoOptions {...convoOptionsProps} />
-        )}
+        {actionContent}
       </div>
     </div>
   );
 }
+
+export default memo(Conversation, areConversationRenderPropsEqual);
diff --git a/client/src/components/Conversations/ConvoLink.tsx b/client/src/components/Conversations/ConvoLink.tsx
index 543407501e7..6fd251f02b3 100644
--- a/client/src/components/Conversations/ConvoLink.tsx
+++ b/client/src/components/Conversations/ConvoLink.tsx
@@ -23,7 +23,7 @@ const ConvoLink: React.FC<ConvoLinkProps> = ({
   return (
     <div
       className={cn(
-        'flex grow items-center gap-2 overflow-hidden rounded-lg px-2',
+        'flex min-w-0 grow items-center gap-2 overflow-hidden rounded-lg px-2',
         isActiveConvo || isPopoverActive ? 'bg-surface-active-alt' : '',
       )}
       title={title ?? undefined}
diff --git a/client/src/components/Conversations/ConvoOptions/ConvoOptions.tsx b/client/src/components/Conversations/ConvoOptions/ConvoOptions.tsx
index 25889e0e676..7916de77704 100644
--- a/client/src/components/Conversations/ConvoOptions/ConvoOptions.tsx
+++ b/client/src/components/Conversations/ConvoOptions/ConvoOptions.tsx
@@ -1,27 +1,39 @@
 import { useState, useId, useRef, memo, useCallback, useMemo } from 'react';
 import * as Ariakit from '@ariakit/react';
-import { useParams, useNavigate } from 'react-router-dom';
-import { QueryKeys } from 'librechat-data-provider';
 import { useQueryClient } from '@tanstack/react-query';
+import { useParams, useNavigate } from 'react-router-dom';
 import { DropdownPopup, Spinner, useToastContext } from '@librechat/client';
-import { Ellipsis, Share2, CopyPlus, Archive, Pen, Trash } from 'lucide-react';
+import {
+  Ellipsis,
+  Share2,
+  CopyPlus,
+  Archive,
+  FolderInput,
+  FolderX,
+  Pen,
+  Trash,
+} from 'lucide-react';
+import { QueryKeys, PermissionTypes, Permissions } from 'librechat-data-provider';
 import type { MouseEvent } from 'react';
 import type { TMessage } from 'librechat-data-provider';
 import {
   useDuplicateConversationMutation,
+  useAssignConversationToProjectMutation,
   useDeleteConversationMutation,
   useGetStartupConfig,
   useArchiveConvoMutation,
 } from '~/data-provider';
-import { useLocalize, useNavigateToConvo, useNewConvo } from '~/hooks';
+import { useHasAccess, useLocalize, useNavigateToConvo, useNewConvo } from '~/hooks';
 import { NotificationSeverity } from '~/common';
 import { useChatContext } from '~/Providers';
 import DeleteButton from './DeleteButton';
+import ProjectButton from './ProjectButton';
 import ShareButton from './ShareButton';
 import { cn } from '~/utils';
 
 function ConvoOptions({
   conversationId,
+  chatProjectId,
   title,
   retainView,
   renameHandler,
@@ -31,6 +43,7 @@ function ConvoOptions({
   isShiftHeld = false,
 }: {
   conversationId: string | null;
+  chatProjectId?: string | null;
   title: string | null;
   retainView: () => void;
   renameHandler: (e: MouseEvent) => void;
@@ -53,11 +66,19 @@ function ConvoOptions({
   const menuId = useId();
   const shareButtonRef = useRef<HTMLButtonElement>(null);
   const deleteButtonRef = useRef<HTMLButtonElement>(null);
+  const projectButtonRef = useRef<HTMLButtonElement>(null);
   const [showShareDialog, setShowShareDialog] = useState(false);
   const [showDeleteDialog, setShowDeleteDialog] = useState(false);
+  const [showProjectDialog, setShowProjectDialog] = useState(false);
   const [announcement, setAnnouncement] = useState('');
 
+  const canCreateSharedLinks = useHasAccess({
+    permissionType: PermissionTypes.SHARED_LINKS,
+    permission: Permissions.CREATE,
+  });
+
   const archiveConvoMutation = useArchiveConvoMutation();
+  const assignConversationToProject = useAssignConversationToProjectMutation();
 
   const deleteMutation = useDeleteConversationMutation({
     onSuccess: () => {
@@ -116,6 +137,37 @@ function ConvoOptions({
     setShowDeleteDialog(true);
   }, []);
 
+  const projectHandler = useCallback(() => {
+    setShowProjectDialog(true);
+  }, []);
+
+  const removeProjectHandler = useCallback(() => {
+    const convoId = conversationId ?? '';
+    if (!convoId) {
+      return;
+    }
+    assignConversationToProject.mutate(
+      { conversationId: convoId, projectId: null },
+      {
+        onSuccess: () => {
+          setIsPopoverActive(false);
+          showToast({
+            message: localize('com_ui_project_updated'),
+            severity: NotificationSeverity.SUCCESS,
+            showIcon: true,
+          });
+        },
+        onError: () => {
+          showToast({
+            message: localize('com_ui_project_update_error'),
+            severity: NotificationSeverity.ERROR,
+            showIcon: true,
+          });
+        },
+      },
+    );
+  }, [assignConversationToProject, conversationId, localize, setIsPopoverActive, showToast]);
+
   const handleInstantDelete = useCallback(
     (e: MouseEvent) => {
       e.stopPropagation();
@@ -189,7 +241,7 @@ function ConvoOptions({
         label: localize('com_ui_share'),
         onClick: shareHandler,
         icon: <Share2 className="icon-sm mr-2 text-text-primary" aria-hidden="true" />,
-        show: startupConfig && startupConfig.sharedLinksEnabled,
+        show: startupConfig && startupConfig.sharedLinksEnabled && canCreateSharedLinks,
         ariaHasPopup: 'dialog' as const,
         ariaControls: 'share-conversation-dialog',
         /** NOTE: THE FOLLOWING PROPS ARE REQUIRED FOR MENU ITEMS THAT OPEN DIALOGS */
@@ -212,6 +264,27 @@ function ConvoOptions({
           <CopyPlus className="icon-sm mr-2 text-text-primary" aria-hidden="true" />
         ),
       },
+      {
+        label: localize('com_ui_change_project'),
+        onClick: projectHandler,
+        icon: <FolderInput className="icon-sm mr-2 text-text-primary" aria-hidden="true" />,
+        ariaHasPopup: 'dialog' as const,
+        ariaControls: 'project-conversation-dialog',
+        hideOnClick: false,
+        ref: projectButtonRef,
+        render: (props) => <button {...props} />,
+      },
+      {
+        label: localize('com_ui_remove_from_project'),
+        onClick: removeProjectHandler,
+        show: Boolean(chatProjectId),
+        hideOnClick: false,
+        icon: assignConversationToProject.isLoading ? (
+          <Spinner className="size-4" />
+        ) : (
+          <FolderX className="icon-sm mr-2 text-text-primary" aria-hidden="true" />
+        ),
+      },
       {
         label: localize('com_ui_archive'),
         onClick: handleArchiveClick,
@@ -243,7 +316,12 @@ function ConvoOptions({
       isArchiveLoading,
       isDuplicateLoading,
       handleArchiveClick,
+      canCreateSharedLinks,
       handleDuplicateClick,
+      projectHandler,
+      removeProjectHandler,
+      chatProjectId,
+      assignConversationToProject.isLoading,
     ],
   );
 
@@ -342,6 +420,16 @@ function ConvoOptions({
           setShowDeleteDialog={setShowDeleteDialog}
         />
       )}
+      {showProjectDialog && (
+        <ProjectButton
+          conversationId={conversationId ?? ''}
+          chatProjectId={chatProjectId}
+          setMenuOpen={setIsPopoverActive}
+          triggerRef={projectButtonRef}
+          showProjectDialog={showProjectDialog}
+          setShowProjectDialog={setShowProjectDialog}
+        />
+      )}
     </>
   );
 }
@@ -350,6 +438,7 @@ export default memo(ConvoOptions, (prevProps, nextProps) => {
   return (
     prevProps.conversationId === nextProps.conversationId &&
     prevProps.title === nextProps.title &&
+    prevProps.chatProjectId === nextProps.chatProjectId &&
     prevProps.isPopoverActive === nextProps.isPopoverActive &&
     prevProps.isActiveConvo === nextProps.isActiveConvo &&
     prevProps.isShiftHeld === nextProps.isShiftHeld
diff --git a/client/src/components/Conversations/ConvoOptions/ProjectButton.tsx b/client/src/components/Conversations/ConvoOptions/ProjectButton.tsx
new file mode 100644
index 00000000000..a0860ef29b7
--- /dev/null
+++ b/client/src/components/Conversations/ConvoOptions/ProjectButton.tsx
@@ -0,0 +1,157 @@
+import { useEffect, useMemo, useState, type RefObject } from 'react';
+import {
+  Button,
+  Spinner,
+  OGDialog,
+  OGDialogClose,
+  OGDialogTitle,
+  OGDialogHeader,
+  OGDialogContent,
+  useToastContext,
+} from '@librechat/client';
+import type { TChatProject } from 'librechat-data-provider';
+import { useAssignConversationToProjectMutation, useProjectsInfiniteQuery } from '~/data-provider';
+import { useLocalize } from '~/hooks';
+import { NotificationSeverity } from '~/common';
+
+type ProjectButtonProps = {
+  conversationId: string;
+  chatProjectId?: string | null;
+  showProjectDialog?: boolean;
+  setShowProjectDialog?: (value: boolean) => void;
+  triggerRef?: RefObject<HTMLButtonElement>;
+  setMenuOpen?: (open: boolean) => void;
+};
+
+function ProjectConversationDialog({
+  conversationId,
+  chatProjectId,
+  setMenuOpen,
+  setShowProjectDialog,
+}: {
+  conversationId: string;
+  chatProjectId?: string | null;
+  setMenuOpen?: (open: boolean) => void;
+  setShowProjectDialog: (value: boolean) => void;
+}) {
+  const localize = useLocalize();
+  const { showToast } = useToastContext();
+  const [selectedProjectId, setSelectedProjectId] = useState(chatProjectId ?? '');
+  const assignConversation = useAssignConversationToProjectMutation();
+  const { data, fetchNextPage, isFetchingNextPage } = useProjectsInfiniteQuery({
+    sortBy: 'name',
+    sortDirection: 'asc',
+  });
+
+  const projects = useMemo<TChatProject[]>(
+    () => data?.pages.flatMap((page) => page.projects) ?? [],
+    [data?.pages],
+  );
+  const hasNextPage = data?.pages[data.pages.length - 1]?.nextCursor != null;
+
+  useEffect(() => {
+    setSelectedProjectId(chatProjectId ?? '');
+  }, [chatProjectId]);
+
+  const saveProject = () => {
+    assignConversation.mutate(
+      {
+        conversationId,
+        projectId: selectedProjectId || null,
+      },
+      {
+        onSuccess: () => {
+          setShowProjectDialog(false);
+          setMenuOpen?.(false);
+          showToast({
+            message: localize('com_ui_project_updated'),
+            severity: NotificationSeverity.SUCCESS,
+            showIcon: true,
+          });
+        },
+        onError: () => {
+          showToast({
+            message: localize('com_ui_project_update_error'),
+            severity: NotificationSeverity.ERROR,
+            showIcon: true,
+          });
+        },
+      },
+    );
+  };
+
+  return (
+    <OGDialogContent
+      id="project-conversation-dialog"
+      className="w-11/12 max-w-md"
+      showCloseButton={false}
+    >
+      <OGDialogHeader>
+        <OGDialogTitle>{localize('com_ui_change_project')}</OGDialogTitle>
+      </OGDialogHeader>
+      <label className="flex flex-col gap-2 text-sm text-text-primary">
+        {localize('com_ui_select_project')}
+        <select
+          value={selectedProjectId}
+          onChange={(event) => setSelectedProjectId(event.target.value)}
+          className="h-10 rounded-lg border border-border-light bg-surface-primary px-3 text-sm outline-none focus:ring-2 focus:ring-ring-primary"
+        >
+          <option value="">{localize('com_ui_unassigned')}</option>
+          {projects.map((project) => (
+            <option key={project._id} value={project._id}>
+              {project.name}
+            </option>
+          ))}
+        </select>
+      </label>
+      {hasNextPage && (
+        <button
+          type="button"
+          className="mt-3 text-sm text-text-secondary hover:text-text-primary"
+          onClick={() => fetchNextPage()}
+          disabled={isFetchingNextPage}
+        >
+          {isFetchingNextPage ? localize('com_ui_loading') : localize('com_ui_load_more')}
+        </button>
+      )}
+      <div className="flex justify-end gap-4 pt-4">
+        <OGDialogClose asChild>
+          <Button aria-label="cancel" variant="outline">
+            {localize('com_ui_cancel')}
+          </Button>
+        </OGDialogClose>
+        <Button onClick={saveProject} disabled={assignConversation.isLoading}>
+          {assignConversation.isLoading ? <Spinner /> : localize('com_ui_save')}
+        </Button>
+      </div>
+    </OGDialogContent>
+  );
+}
+
+export default function ProjectButton({
+  conversationId,
+  chatProjectId,
+  setMenuOpen,
+  showProjectDialog,
+  setShowProjectDialog,
+  triggerRef,
+}: ProjectButtonProps) {
+  if (showProjectDialog === undefined || setShowProjectDialog === undefined) {
+    return null;
+  }
+
+  if (!conversationId) {
+    return null;
+  }
+
+  return (
+    <OGDialog open={showProjectDialog} onOpenChange={setShowProjectDialog} triggerRef={triggerRef}>
+      <ProjectConversationDialog
+        conversationId={conversationId}
+        chatProjectId={chatProjectId}
+        setMenuOpen={setMenuOpen}
+        setShowProjectDialog={setShowProjectDialog}
+      />
+    </OGDialog>
+  );
+}
diff --git a/client/src/components/Conversations/ConvoOptions/ShareButton.tsx b/client/src/components/Conversations/ConvoOptions/ShareButton.tsx
index 6f18a48ba8e..2161e53923f 100644
--- a/client/src/components/Conversations/ConvoOptions/ShareButton.tsx
+++ b/client/src/components/Conversations/ConvoOptions/ShareButton.tsx
@@ -93,7 +93,12 @@ export default function ShareButton({
 
               {shareId && (
                 <div className="flex items-center gap-2 rounded-md bg-surface-secondary p-2">
-                  <div className="flex-1 break-all text-sm text-text-secondary">{sharedLink}</div>
+                  <div
+                    className="flex-1 break-all text-sm text-text-secondary"
+                    data-testid="shared-link-url"
+                  >
+                    {sharedLink}
+                  </div>
                   <span className="sr-only" aria-live="polite" aria-atomic="true">
                     {announcement}
                   </span>
diff --git a/client/src/components/Conversations/ConvoOptions/SharedLinkButton.tsx b/client/src/components/Conversations/ConvoOptions/SharedLinkButton.tsx
index 724ee822e1c..4cc36033d0f 100644
--- a/client/src/components/Conversations/ConvoOptions/SharedLinkButton.tsx
+++ b/client/src/components/Conversations/ConvoOptions/SharedLinkButton.tsx
@@ -1,6 +1,12 @@
 import { useState, useRef } from 'react';
 import { Trans } from 'react-i18next';
 import { QrCode, RotateCw, Trash2 } from 'lucide-react';
+import {
+  PermissionTypes,
+  Permissions,
+  PermissionBits,
+  ResourceType,
+} from 'librechat-data-provider';
 import {
   Label,
   Button,
@@ -19,9 +25,10 @@ import {
   useUpdateSharedLinkMutation,
   useDeleteSharedLinkMutation,
 } from '~/data-provider';
+import GenericGrantAccessDialog from '~/components/Sharing/GenericGrantAccessDialog';
+import { useHasAccess, useResourcePermissions, useLocalize } from '~/hooks';
 import { NotificationSeverity } from '~/common';
 import { buildShareLinkUrl } from '~/utils';
-import { useLocalize } from '~/hooks';
 
 export default function SharedLinkButton({
   share,
@@ -127,6 +134,22 @@ export default function SharedLinkButton({
     }
   };
 
+  const hasAccessToShareLinks = useHasAccess({
+    permissionType: PermissionTypes.SHARED_LINKS,
+    permission: Permissions.SHARE,
+  });
+
+  const { hasPermission, isLoading: permissionsLoading } = useResourcePermissions(
+    ResourceType.SHARED_LINK,
+    share?._id || '',
+  );
+
+  const canManageAccess =
+    hasAccessToShareLinks &&
+    !permissionsLoading &&
+    hasPermission(PermissionBits.SHARE) &&
+    !!share?._id;
+
   const qrCodeLabel = showQR ? localize('com_ui_hide_qr') : localize('com_ui_show_qr');
 
   return (
@@ -192,6 +215,27 @@ export default function SharedLinkButton({
                 </Button>
               )}
             />
+
+            {canManageAccess && (
+              <GenericGrantAccessDialog
+                resourceType={ResourceType.SHARED_LINK}
+                resourceDbId={share?._id}
+                resourceName={share?.shareId ?? undefined}
+              >
+                <TooltipAnchor
+                  description={localize('com_ui_shared_link_manage_access')}
+                  render={(props) => (
+                    <Button
+                      {...props}
+                      variant="outline"
+                      aria-label={localize('com_ui_shared_link_manage_access')}
+                    >
+                      {localize('com_ui_shared_link_manage_access')}
+                    </Button>
+                  )}
+                />
+              </GenericGrantAccessDialog>
+            )}
           </div>
         )}
         <OGDialog
diff --git a/client/src/components/Conversations/ConvoOptions/index.js b/client/src/components/Conversations/ConvoOptions/index.js
index c294bb45ce6..44a5e2c9d3d 100644
--- a/client/src/components/Conversations/ConvoOptions/index.js
+++ b/client/src/components/Conversations/ConvoOptions/index.js
@@ -1,4 +1,5 @@
 export * from './DeleteButton';
+export { default as ProjectButton } from './ProjectButton';
 export { default as ShareButton } from './ShareButton';
 export { default as SharedLinkButton } from './SharedLinkButton';
 export { default as ConvoOptions } from './ConvoOptions';
diff --git a/client/src/components/Conversations/ConvoOptions/index.ts b/client/src/components/Conversations/ConvoOptions/index.ts
index c294bb45ce6..44a5e2c9d3d 100644
--- a/client/src/components/Conversations/ConvoOptions/index.ts
+++ b/client/src/components/Conversations/ConvoOptions/index.ts
@@ -1,4 +1,5 @@
 export * from './DeleteButton';
+export { default as ProjectButton } from './ProjectButton';
 export { default as ShareButton } from './ShareButton';
 export { default as SharedLinkButton } from './SharedLinkButton';
 export { default as ConvoOptions } from './ConvoOptions';
diff --git a/client/src/components/Conversations/ProjectsSection.tsx b/client/src/components/Conversations/ProjectsSection.tsx
new file mode 100644
index 00000000000..23c19f4ddec
--- /dev/null
+++ b/client/src/components/Conversations/ProjectsSection.tsx
@@ -0,0 +1,565 @@
+import { memo, useCallback, useEffect, useId, useMemo, useRef, useState } from 'react';
+import * as Ariakit from '@ariakit/react';
+import { QueryKeys } from 'librechat-data-provider';
+import { useQueryClient } from '@tanstack/react-query';
+import { useRecoilCallback, useRecoilValue } from 'recoil';
+import { useNavigate, useLocation } from 'react-router-dom';
+import {
+  ChevronDown,
+  ChevronRight,
+  Ellipsis,
+  Folder,
+  FolderPlus,
+  Folders,
+  Pencil,
+  Trash2,
+} from 'lucide-react';
+import {
+  Button,
+  Input,
+  Spinner,
+  OGDialog,
+  OGDialogClose,
+  OGDialogTitle,
+  OGDialogHeader,
+  OGDialogContent,
+  TooltipAnchor,
+  DropdownPopup,
+  NewChatIcon,
+  useToastContext,
+} from '@librechat/client';
+import type { TChatProject, TConversation } from 'librechat-data-provider';
+import type { MenuItemProps } from '~/common';
+import {
+  useProjectsInfiniteQuery,
+  useActiveJobs,
+  useConversationsInfiniteQuery,
+  useUpdateProjectMutation,
+  useDeleteProjectMutation,
+} from '~/data-provider';
+import ProjectCreateDialog from '~/components/Projects/ProjectCreateDialog';
+import { useLocalize, useLocalStorage, useNewConvo } from '~/hooks';
+import { clearMessagesCache, cn } from '~/utils';
+import { NotificationSeverity } from '~/common';
+import Convo from './Convo';
+import store from '~/store';
+
+const INLINE_CHAT_LIMIT = 8;
+
+const iconButtonClassName =
+  'flex h-7 w-7 shrink-0 items-center justify-center rounded-md text-text-secondary outline-none transition-colors hover:bg-surface-active-alt hover:text-text-primary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-black dark:focus-visible:ring-white';
+
+function ProjectRenameDialog({
+  open,
+  onOpenChange,
+  project,
+}: {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  project: TChatProject;
+}) {
+  const localize = useLocalize();
+  const formId = useId();
+  const inputRef = useRef<HTMLInputElement | null>(null);
+  const [name, setName] = useState(project.name);
+  const updateProject = useUpdateProjectMutation();
+  const { showToast } = useToastContext();
+
+  useEffect(() => {
+    if (!open) {
+      return;
+    }
+    setName(project.name);
+    const frameId = requestAnimationFrame(() => inputRef.current?.focus());
+    return () => cancelAnimationFrame(frameId);
+  }, [open, project.name]);
+
+  const handleSubmit = (event: React.FormEvent<HTMLFormElement>) => {
+    event.preventDefault();
+    const trimmed = name.trim();
+    if (!trimmed || updateProject.isLoading) {
+      return;
+    }
+    updateProject.mutate(
+      { projectId: project._id, name: trimmed },
+      {
+        onSuccess: () => onOpenChange(false),
+        onError: () =>
+          showToast({
+            message: localize('com_ui_project_rename_error'),
+            severity: NotificationSeverity.ERROR,
+            showIcon: true,
+          }),
+      },
+    );
+  };
+
+  return (
+    <OGDialog open={open} onOpenChange={onOpenChange}>
+      <OGDialogContent className="w-11/12 max-w-md" showCloseButton={false}>
+        <OGDialogHeader>
+          <OGDialogTitle>{localize('com_ui_rename_project')}</OGDialogTitle>
+        </OGDialogHeader>
+        <form id={formId} onSubmit={handleSubmit}>
+          <Input
+            ref={inputRef}
+            value={name}
+            onChange={(event) => setName(event.target.value)}
+            aria-label={localize('com_ui_project_name')}
+            className="w-full bg-transparent text-text-primary placeholder:text-text-secondary focus-visible:ring-2 focus-visible:ring-ring-primary"
+          />
+        </form>
+        <div className="flex justify-end gap-4 pt-4">
+          <OGDialogClose asChild>
+            <Button aria-label="cancel" variant="outline">
+              {localize('com_ui_cancel')}
+            </Button>
+          </OGDialogClose>
+          <Button
+            type="submit"
+            form={formId}
+            variant="submit"
+            disabled={!name.trim() || updateProject.isLoading}
+          >
+            {updateProject.isLoading ? <Spinner className="size-4" /> : localize('com_ui_save')}
+          </Button>
+        </div>
+      </OGDialogContent>
+    </OGDialog>
+  );
+}
+
+function ProjectDeleteDialog({
+  open,
+  onOpenChange,
+  project,
+}: {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  project: TChatProject;
+}) {
+  const localize = useLocalize();
+  const navigate = useNavigate();
+  const location = useLocation();
+  const deleteProject = useDeleteProjectMutation();
+  const { showToast } = useToastContext();
+
+  const confirmDelete = () => {
+    deleteProject.mutate(project._id, {
+      onSuccess: () => {
+        onOpenChange(false);
+        if (location.pathname === `/projects/${project._id}`) {
+          navigate('/projects');
+        }
+      },
+      onError: () =>
+        showToast({
+          message: localize('com_ui_project_delete_error'),
+          severity: NotificationSeverity.ERROR,
+          showIcon: true,
+        }),
+    });
+  };
+
+  return (
+    <OGDialog open={open} onOpenChange={onOpenChange}>
+      <OGDialogContent className="w-11/12 max-w-md" showCloseButton={false}>
+        <OGDialogHeader>
+          <OGDialogTitle>{localize('com_ui_delete_project')}</OGDialogTitle>
+        </OGDialogHeader>
+        <div className="text-sm text-text-secondary">
+          {localize('com_ui_delete_project_confirm', { name: project.name })}
+        </div>
+        <div className="flex justify-end gap-4 pt-4">
+          <OGDialogClose asChild>
+            <Button aria-label="cancel" variant="outline">
+              {localize('com_ui_cancel')}
+            </Button>
+          </OGDialogClose>
+          <Button variant="destructive" onClick={confirmDelete} disabled={deleteProject.isLoading}>
+            {deleteProject.isLoading ? <Spinner className="size-4" /> : localize('com_ui_delete')}
+          </Button>
+        </div>
+      </OGDialogContent>
+    </OGDialog>
+  );
+}
+
+const noop = () => {};
+
+type ProjectChatsInlineProps = {
+  projectId: string;
+  toggleNav: () => void;
+  onShowAll: () => void;
+};
+
+const ProjectChatsInline = memo(function ProjectChatsInline({
+  projectId,
+  toggleNav,
+  onShowAll,
+}: ProjectChatsInlineProps) {
+  const localize = useLocalize();
+  const { data: activeJobsData } = useActiveJobs();
+  const activeJobIds = useMemo(
+    () => new Set(activeJobsData?.activeJobIds ?? []),
+    [activeJobsData?.activeJobIds],
+  );
+  const { data, isLoading } = useConversationsInfiniteQuery(
+    { projectId, sortBy: 'updatedAt', sortDirection: 'desc' },
+    { staleTime: 30000, cacheTime: 300000 },
+  );
+
+  const conversations = useMemo<TConversation[]>(
+    () =>
+      (data?.pages.flatMap((page) => page.conversations) ?? []).filter(Boolean) as TConversation[],
+    [data?.pages],
+  );
+  const hasMore =
+    conversations.length > INLINE_CHAT_LIMIT ||
+    (data?.pages[data.pages.length - 1]?.nextCursor ?? null) != null;
+  const visible = conversations.slice(0, INLINE_CHAT_LIMIT);
+
+  if (isLoading && conversations.length === 0) {
+    return (
+      <div className="flex justify-start py-1.5 pl-2">
+        <Spinner className="h-4 w-4 text-text-secondary" />
+      </div>
+    );
+  }
+
+  if (conversations.length === 0) {
+    return (
+      <div className="py-1.5 pl-2 text-xs text-text-secondary">
+        {localize('com_ui_no_project_chats')}
+      </div>
+    );
+  }
+
+  return (
+    <div data-testid={`project-chats-${projectId}`}>
+      {visible.map((convo) => (
+        <Convo
+          key={convo.conversationId}
+          conversation={convo}
+          retainView={noop}
+          toggleNav={toggleNav}
+          isGenerating={activeJobIds.has(convo.conversationId ?? '')}
+        />
+      ))}
+      {hasMore && (
+        <button
+          type="button"
+          onClick={onShowAll}
+          className="ml-1 mt-0.5 rounded-md px-2 py-1 text-xs font-medium text-text-secondary outline-none transition-colors hover:text-text-primary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-black dark:focus-visible:ring-white"
+        >
+          {localize('com_ui_show_all')}
+        </button>
+      )}
+    </div>
+  );
+});
+
+ProjectChatsInline.displayName = 'ProjectChatsInline';
+
+type ProjectItemProps = {
+  project: TChatProject;
+  toggleNav: () => void;
+  defaultExpanded: boolean;
+};
+
+const ProjectItem = memo(
+  function ProjectItem({ project, toggleNav, defaultExpanded }: ProjectItemProps) {
+    const localize = useLocalize();
+    const navigate = useNavigate();
+    const queryClient = useQueryClient();
+    const { newConversation } = useNewConvo();
+    const getCurrentConversationId = useRecoilCallback(
+      ({ snapshot }) =>
+        async () => {
+          const conversation = await snapshot.getPromise(store.conversationByIndex(0));
+          return conversation?.conversationId;
+        },
+      [],
+    );
+    const menuId = useId();
+    const [expanded, setExpanded] = useState(defaultExpanded);
+    const [isMenuOpen, setIsMenuOpen] = useState(false);
+    const [isRenameOpen, setIsRenameOpen] = useState(false);
+    const [isDeleteOpen, setIsDeleteOpen] = useState(false);
+
+    const openProject = useCallback(() => {
+      navigate(`/projects/${project._id}`);
+      toggleNav();
+    }, [navigate, project._id, toggleNav]);
+
+    const startChat = useCallback(async () => {
+      const conversationId = await getCurrentConversationId();
+      clearMessagesCache(queryClient, conversationId);
+      queryClient.invalidateQueries([QueryKeys.messages]);
+      newConversation({ template: { chatProjectId: project._id } });
+      toggleNav();
+    }, [getCurrentConversationId, newConversation, project._id, queryClient, toggleNav]);
+
+    const menuItems = useMemo<MenuItemProps[]>(
+      () => [
+        {
+          id: `${menuId}-open`,
+          label: localize('com_ui_open_project'),
+          icon: <Folder className="size-4 text-text-secondary" aria-hidden="true" />,
+          onClick: openProject,
+        },
+        {
+          id: `${menuId}-rename`,
+          label: localize('com_ui_rename'),
+          icon: <Pencil className="size-4 text-text-secondary" aria-hidden="true" />,
+          onClick: () => setIsRenameOpen(true),
+        },
+        {
+          id: `${menuId}-delete`,
+          label: localize('com_ui_delete'),
+          icon: <Trash2 className="size-4 text-text-secondary" aria-hidden="true" />,
+          onClick: () => setIsDeleteOpen(true),
+        },
+      ],
+      [localize, menuId, openProject],
+    );
+
+    return (
+      <li className="list-none">
+        <div className="group/project-row relative flex h-9 items-center rounded-lg text-sm text-text-primary transition-colors hover:bg-surface-active-alt">
+          <button
+            type="button"
+            onClick={() => setExpanded((prev) => !prev)}
+            aria-expanded={expanded}
+            aria-label={project.name}
+            className="flex min-w-0 flex-1 items-center gap-1.5 rounded-lg py-1.5 pl-1.5 pr-14 text-left outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-black dark:focus-visible:ring-white"
+          >
+            <ChevronRight
+              className={cn(
+                'h-3.5 w-3.5 shrink-0 text-text-secondary transition-transform duration-200',
+                expanded && 'rotate-90',
+              )}
+              aria-hidden="true"
+            />
+            <Folder className="h-4 w-4 shrink-0 text-text-secondary" aria-hidden="true" />
+            <span className="truncate">{project.name}</span>
+          </button>
+          <div className="absolute right-2 top-1/2 flex -translate-y-1/2 items-center gap-0.5 rounded-md bg-surface-active-alt opacity-0 transition-opacity group-focus-within/project-row:opacity-100 group-hover/project-row:opacity-100 has-[[data-state=open]]:opacity-100">
+            <TooltipAnchor
+              description={localize('com_ui_new_chat_in_project', { name: project.name })}
+              render={
+                <button
+                  type="button"
+                  aria-label={localize('com_ui_new_chat_in_project', { name: project.name })}
+                  className={iconButtonClassName}
+                  onClick={startChat}
+                >
+                  <NewChatIcon className="h-4 w-4" />
+                </button>
+              }
+            />
+            <DropdownPopup
+              portal={true}
+              focusLoop={true}
+              unmountOnHide={true}
+              menuId={menuId}
+              isOpen={isMenuOpen}
+              setIsOpen={setIsMenuOpen}
+              className="z-[125] min-w-44"
+              iconClassName="mr-2 text-text-secondary"
+              trigger={
+                <Ariakit.MenuButton
+                  aria-label={localize('com_ui_more_options')}
+                  className={cn(
+                    iconButtonClassName,
+                    isMenuOpen && 'bg-surface-active-alt text-text-primary',
+                  )}
+                >
+                  <Ellipsis className="h-4 w-4" aria-hidden="true" />
+                </Ariakit.MenuButton>
+              }
+              items={menuItems}
+            />
+          </div>
+        </div>
+        {expanded && (
+          <ProjectChatsInline
+            projectId={project._id}
+            toggleNav={toggleNav}
+            onShowAll={openProject}
+          />
+        )}
+        <ProjectRenameDialog open={isRenameOpen} onOpenChange={setIsRenameOpen} project={project} />
+        <ProjectDeleteDialog open={isDeleteOpen} onOpenChange={setIsDeleteOpen} project={project} />
+      </li>
+    );
+  },
+  (prevProps, nextProps) =>
+    prevProps.project._id === nextProps.project._id &&
+    prevProps.project.name === nextProps.project.name &&
+    prevProps.project.updatedAt === nextProps.project.updatedAt &&
+    prevProps.defaultExpanded === nextProps.defaultExpanded &&
+    prevProps.toggleNav === nextProps.toggleNav,
+);
+
+ProjectItem.displayName = 'ProjectItem';
+
+interface ProjectsSectionProps {
+  toggleNav: () => void;
+  isAuthenticated: boolean;
+}
+
+const ProjectsSection = ({ toggleNav, isAuthenticated }: ProjectsSectionProps) => {
+  const localize = useLocalize();
+  const navigate = useNavigate();
+  const [storedExpanded, setStoredExpanded] = useLocalStorage('projectsSectionExpanded', true);
+  const [hasToggledSection, setHasToggledSection] = useLocalStorage(
+    'projectsSectionToggled',
+    false,
+  );
+  const [isCreateOpen, setIsCreateOpen] = useState(false);
+  const conversation = useRecoilValue(store.conversationByIndex(0));
+  const activeProjectId = conversation?.chatProjectId ?? null;
+
+  const { data, isLoading } = useProjectsInfiniteQuery(
+    { sortBy: 'lastConversationAt', sortDirection: 'desc', limit: 25 },
+    { enabled: isAuthenticated, staleTime: 30000, cacheTime: 300000 },
+  );
+
+  const projects = useMemo(() => data?.pages.flatMap((page) => page.projects) ?? [], [data?.pages]);
+  const hasMore = (data?.pages[data.pages.length - 1]?.nextCursor ?? null) != null;
+
+  /**
+   * Collapse the section by default for users with no projects who have never
+   * toggled it, to keep the sidebar compact. An explicit toggle — or a collapse
+   * set before this default existed (stored === false) — is always respected.
+   */
+  const respectStoredExpanded = hasToggledSection || storedExpanded === false;
+  const isExpanded = respectStoredExpanded ? storedExpanded : isLoading || projects.length > 0;
+
+  const openProjects = useCallback(() => {
+    navigate('/projects');
+    toggleNav();
+  }, [navigate, toggleNav]);
+
+  const renderProjectsBody = () => {
+    if (isLoading && projects.length === 0) {
+      return (
+        <div className="flex justify-start py-2 pl-2">
+          <Spinner className="h-4 w-4 text-text-secondary" />
+        </div>
+      );
+    }
+
+    if (projects.length === 0) {
+      return (
+        <button
+          type="button"
+          onClick={() => setIsCreateOpen(true)}
+          className="flex w-full items-center gap-2 rounded-lg px-2 py-1.5 text-sm text-text-secondary outline-none transition-colors hover:bg-surface-hover hover:text-text-primary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-black dark:focus-visible:ring-white"
+        >
+          <FolderPlus className="h-4 w-4 shrink-0" aria-hidden="true" />
+          <span className="truncate">{localize('com_ui_new_project')}</span>
+        </button>
+      );
+    }
+
+    return (
+      <ul className="m-0 list-none p-0">
+        {projects.map((project) => (
+          <ProjectItem
+            key={project._id}
+            project={project}
+            toggleNav={toggleNav}
+            defaultExpanded={project._id === activeProjectId}
+          />
+        ))}
+        {hasMore && (
+          <li className="list-none">
+            <button
+              type="button"
+              onClick={openProjects}
+              className="flex w-full items-center gap-2 rounded-lg px-2 py-1.5 text-xs font-medium text-text-secondary outline-none transition-colors hover:bg-surface-hover hover:text-text-primary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-black dark:focus-visible:ring-white"
+            >
+              {localize('com_ui_all_projects')}
+            </button>
+          </li>
+        )}
+      </ul>
+    );
+  };
+
+  if (!isAuthenticated) {
+    return null;
+  }
+
+  return (
+    <div className="flex flex-col px-3 text-sm">
+      <div className="flex h-8 w-full items-center gap-0.5 pr-2">
+        <button
+          onClick={() => {
+            setStoredExpanded(!isExpanded);
+            setHasToggledSection(true);
+          }}
+          className="group flex min-w-0 flex-1 items-center gap-1 rounded-lg px-1 py-2 text-xs font-bold text-text-secondary outline-none focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-black dark:focus-visible:ring-white"
+          type="button"
+          aria-expanded={isExpanded}
+        >
+          <span className="select-none truncate">{localize('com_ui_projects')}</span>
+          <ChevronDown
+            className={cn(
+              'h-3 w-3 shrink-0 transition-transform duration-200',
+              isExpanded ? '' : '-rotate-90',
+            )}
+            aria-hidden="true"
+          />
+        </button>
+        <TooltipAnchor
+          description={localize('com_ui_all_projects')}
+          render={
+            <button
+              type="button"
+              aria-label={localize('com_ui_all_projects')}
+              className={iconButtonClassName}
+              onClick={openProjects}
+            >
+              <Folders className="h-4 w-4" aria-hidden="true" />
+            </button>
+          }
+        />
+        <TooltipAnchor
+          description={localize('com_ui_new_project')}
+          render={
+            <button
+              type="button"
+              aria-label={localize('com_ui_new_project')}
+              className={iconButtonClassName}
+              onClick={() => setIsCreateOpen(true)}
+            >
+              <FolderPlus className="h-4 w-4" aria-hidden="true" />
+            </button>
+          }
+        />
+      </div>
+
+      {isExpanded && (
+        <div className="scrollbar-gutter-stable max-h-[42vh] overflow-y-auto">
+          {renderProjectsBody()}
+        </div>
+      )}
+
+      <ProjectCreateDialog
+        open={isCreateOpen}
+        onOpenChange={setIsCreateOpen}
+        onCreated={(project) => {
+          navigate(`/projects/${project._id}`);
+          toggleNav();
+        }}
+      />
+    </div>
+  );
+};
+
+ProjectsSection.displayName = 'ProjectsSection';
+
+export default memo(ProjectsSection);
diff --git a/client/src/components/Conversations/__tests__/Conversations.test.tsx b/client/src/components/Conversations/__tests__/Conversations.test.tsx
index a4f403fb7f7..4deb911d732 100644
--- a/client/src/components/Conversations/__tests__/Conversations.test.tsx
+++ b/client/src/components/Conversations/__tests__/Conversations.test.tsx
@@ -10,11 +10,6 @@ jest.mock('react-virtualized', () => {
   const actual = jest.requireActual('react-virtualized');
   return {
     ...actual,
-    AutoSizer: ({
-      children,
-    }: {
-      children: (size: { width: number; height: number }) => React.ReactNode;
-    }) => children({ width: 300, height: 600 }),
     CellMeasurer: ({
       children,
     }: {
@@ -48,11 +43,15 @@ jest.mock('react-virtualized', () => {
 });
 
 jest.mock('~/store', () => {
-  const { atom } = jest.requireActual('recoil');
+  const { atom, atomFamily } = jest.requireActual('recoil');
   return {
     __esModule: true,
     default: {
       search: atom({ key: 'test-conversations-search', default: { query: '' } }),
+      conversationByIndex: atomFamily({
+        key: 'test-conversations-convo-by-index',
+        default: null,
+      }),
     },
   };
 });
@@ -70,12 +69,20 @@ jest.mock('~/hooks', () => ({
   useFavorites: () => mockFavoritesState,
   useLocalize: () => (key: string) => key,
   useShowMarketplace: () => mockShowMarketplace,
+  useNewConvo: () => ({ newConversation: jest.fn() }),
+  useElementSize: () => ({ ref: jest.fn(), width: 300, height: 600 }),
   TranslationKeys: {},
 }));
 
+jest.mock('@tanstack/react-query', () => ({
+  useQueryClient: () => ({ invalidateQueries: jest.fn() }),
+}));
+
 jest.mock('@librechat/client', () => ({
   Spinner: () => <div data-testid="spinner" />,
   useMediaQuery: () => false,
+  TooltipAnchor: ({ render }: { render: React.ReactNode }) => render,
+  NewChatIcon: () => <svg data-testid="new-chat-icon" />,
 }));
 
 jest.mock('~/data-provider', () => ({
@@ -84,6 +91,7 @@ jest.mock('~/data-provider', () => ({
 
 jest.mock('~/utils', () => ({
   groupConversationsByDate: () => [],
+  clearMessagesCache: jest.fn(),
   cn: (...args: unknown[]) => args.filter(Boolean).join(' '),
 }));
 
diff --git a/client/src/components/Conversations/utils.ts b/client/src/components/Conversations/utils.ts
new file mode 100644
index 00000000000..3c45d1a0e28
--- /dev/null
+++ b/client/src/components/Conversations/utils.ts
@@ -0,0 +1,47 @@
+import type { TConversation } from 'librechat-data-provider';
+
+export type ConversationRenderProps = {
+  conversation: TConversation;
+  isGenerating?: boolean;
+};
+
+export function areConversationIconFieldsEqual(
+  prevConversation: TConversation,
+  nextConversation: TConversation,
+) {
+  return (
+    prevConversation.endpoint === nextConversation.endpoint &&
+    prevConversation.endpointType === nextConversation.endpointType &&
+    prevConversation.iconURL === nextConversation.iconURL &&
+    prevConversation.model === nextConversation.model &&
+    prevConversation.modelLabel === nextConversation.modelLabel &&
+    prevConversation.chatGptLabel === nextConversation.chatGptLabel &&
+    prevConversation.spec === nextConversation.spec &&
+    prevConversation.agent_id === nextConversation.agent_id &&
+    prevConversation.assistant_id === nextConversation.assistant_id
+  );
+}
+
+export function areConversationListItemFieldsEqual(
+  prevConversation: TConversation,
+  nextConversation: TConversation,
+) {
+  return (
+    areConversationIconFieldsEqual(prevConversation, nextConversation) &&
+    prevConversation.conversationId === nextConversation.conversationId &&
+    prevConversation.title === nextConversation.title &&
+    prevConversation.chatProjectId === nextConversation.chatProjectId &&
+    prevConversation.createdAt === nextConversation.createdAt &&
+    prevConversation.updatedAt === nextConversation.updatedAt
+  );
+}
+
+export function areConversationRenderPropsEqual(
+  prevProps: ConversationRenderProps,
+  nextProps: ConversationRenderProps,
+) {
+  return (
+    areConversationListItemFieldsEqual(prevProps.conversation, nextProps.conversation) &&
+    prevProps.isGenerating === nextProps.isGenerating
+  );
+}
diff --git a/client/src/components/Endpoints/EndpointIcon.tsx b/client/src/components/Endpoints/EndpointIcon.tsx
index 0625533e026..c2add9ed7a4 100644
--- a/client/src/components/Endpoints/EndpointIcon.tsx
+++ b/client/src/components/Endpoints/EndpointIcon.tsx
@@ -1,66 +1,82 @@
-import { getEndpointField, isAssistantsEndpoint } from 'librechat-data-provider';
+import { getEndpointField, isAssistantsEndpoint, isAgentsEndpoint } from 'librechat-data-provider';
 import type {
   TPreset,
   TConversation,
+  TAgentsMap,
   TAssistantsMap,
   TEndpointsConfig,
 } from 'librechat-data-provider';
 import ConvoIconURL from '~/components/Endpoints/ConvoIconURL';
 import MinimalIcon from '~/components/Endpoints/MinimalIcon';
-import { getIconEndpoint } from '~/utils';
+import { getAgentAvatarUrl, getIconEndpoint } from '~/utils';
 import { isImageURL } from '~/utils/icons';
 
+const emptyEndpointsConfig = {} as TEndpointsConfig;
+
 export default function EndpointIcon({
   conversation,
-  endpointsConfig,
+  endpointsConfig = emptyEndpointsConfig,
   className = 'mr-0',
   assistantMap,
+  agentsMap,
   context,
+  size = 20,
 }: {
   conversation: TConversation | TPreset | null;
   endpointsConfig: TEndpointsConfig;
   containerClassName?: string;
   context?: 'message' | 'nav' | 'landing' | 'menu-item';
   assistantMap?: TAssistantsMap;
+  agentsMap?: TAgentsMap;
   className?: string;
   size?: number;
 }) {
   const convoIconURL = conversation?.iconURL ?? '';
-  let endpoint = conversation?.endpoint;
+  const originalEndpoint = conversation?.endpoint;
+  let endpoint = originalEndpoint;
   endpoint = getIconEndpoint({ endpointsConfig, iconURL: convoIconURL, endpoint });
 
   const endpointType = getEndpointField(endpointsConfig, endpoint, 'type');
   const endpointIconURL = getEndpointField(endpointsConfig, endpoint, 'iconURL');
 
+  const agent = isAgentsEndpoint(endpoint) ? agentsMap?.[conversation?.agent_id ?? ''] : null;
   const assistant = isAssistantsEndpoint(endpoint)
     ? assistantMap?.[endpoint]?.[conversation?.assistant_id ?? '']
     : null;
+  const agentAvatar = getAgentAvatarUrl(agent) ?? '';
+  const agentName = agent?.name ?? '';
   const assistantAvatar = (assistant && (assistant.metadata?.avatar as string)) || '';
   const assistantName = assistant && (assistant.name ?? '');
+  const entityAvatar = agentAvatar || assistantAvatar;
+  const entityName = agentName || assistantName || '';
+  const hasCustomIcon =
+    isImageURL(convoIconURL) || (convoIconURL !== '' && convoIconURL !== originalEndpoint);
 
-  const iconURL = assistantAvatar || convoIconURL;
+  const iconURL = hasCustomIcon ? convoIconURL : entityAvatar || convoIconURL;
 
   if (isImageURL(iconURL)) {
     return (
       <ConvoIconURL
         iconURL={iconURL}
-        modelLabel={conversation?.chatGptLabel ?? conversation?.modelLabel ?? ''}
+        modelLabel={entityName || conversation?.chatGptLabel || conversation?.modelLabel || ''}
         context={context}
         endpointIconURL={endpointIconURL}
         assistantAvatar={assistantAvatar}
         assistantName={assistantName ?? ''}
+        agentAvatar={agentAvatar}
+        agentName={agentName}
       />
     );
   } else {
     return (
       <MinimalIcon
-        size={20}
         iconURL={endpointIconURL}
         endpoint={endpoint}
         endpointType={endpointType}
         model={conversation?.model}
         error={false}
         className={className}
+        size={size}
         isCreatedByUser={false}
         chatGptLabel={undefined}
         modelLabel={undefined}
diff --git a/client/src/components/Endpoints/__tests__/EndpointIcon.test.tsx b/client/src/components/Endpoints/__tests__/EndpointIcon.test.tsx
new file mode 100644
index 00000000000..5dedc2ed4d9
--- /dev/null
+++ b/client/src/components/Endpoints/__tests__/EndpointIcon.test.tsx
@@ -0,0 +1,95 @@
+import React from 'react';
+import '@testing-library/jest-dom';
+import { render, screen } from '@testing-library/react';
+import { EModelEndpoint } from 'librechat-data-provider';
+import type { Agent, TConversation, TEndpointsConfig } from 'librechat-data-provider';
+import EndpointIcon from '../EndpointIcon';
+
+jest.mock('~/components/Endpoints/ConvoIconURL', () => ({
+  __esModule: true,
+  default: ({
+    iconURL,
+    modelLabel,
+    agentAvatar,
+    agentName,
+  }: {
+    iconURL: string;
+    modelLabel?: string;
+    agentAvatar?: string;
+    agentName?: string;
+  }) => (
+    <img
+      src={iconURL}
+      alt={modelLabel || 'Icon'}
+      data-testid="convo-url-icon"
+      data-agent-avatar={agentAvatar}
+      data-agent-name={agentName}
+    />
+  ),
+}));
+
+jest.mock('~/components/Endpoints/MinimalIcon', () => ({
+  __esModule: true,
+  default: ({ endpoint, iconURL }: { endpoint?: string | null; iconURL?: string }) => (
+    <div data-testid="minimal-icon" data-endpoint={endpoint ?? ''} data-icon-url={iconURL ?? ''} />
+  ),
+}));
+
+const endpointsConfig = {
+  [EModelEndpoint.agents]: { order: 0 },
+  [EModelEndpoint.google]: { order: 1 },
+} as TEndpointsConfig;
+
+const agent = {
+  id: 'agent_123',
+  name: 'Research Agent',
+  avatar: {
+    filepath: '/images/agents/agent_123/avatar.png',
+    source: 'local',
+  },
+} as Agent;
+
+describe('EndpointIcon', () => {
+  it('uses the agent avatar when the agents endpoint would otherwise render its default icon', () => {
+    const conversation = {
+      endpoint: EModelEndpoint.agents,
+      agent_id: agent.id,
+      iconURL: EModelEndpoint.agents,
+    } as TConversation;
+
+    render(
+      <EndpointIcon
+        conversation={conversation}
+        endpointsConfig={endpointsConfig}
+        agentsMap={{ [agent.id]: agent }}
+      />,
+    );
+
+    const icon = screen.getByTestId('convo-url-icon');
+    expect(icon).toHaveAttribute('src', '/images/agents/agent_123/avatar.png');
+    expect(icon).toHaveAttribute('alt', 'Research Agent');
+  });
+
+  it('keeps an explicit model spec icon ahead of the agent avatar', () => {
+    const conversation = {
+      endpoint: EModelEndpoint.agents,
+      agent_id: agent.id,
+      spec: 'research-spec',
+      iconURL: EModelEndpoint.google,
+    } as TConversation;
+
+    render(
+      <EndpointIcon
+        conversation={conversation}
+        endpointsConfig={endpointsConfig}
+        agentsMap={{ [agent.id]: agent }}
+      />,
+    );
+
+    expect(screen.queryByTestId('convo-url-icon')).not.toBeInTheDocument();
+    expect(screen.getByTestId('minimal-icon')).toHaveAttribute(
+      'data-endpoint',
+      EModelEndpoint.google,
+    );
+  });
+});
diff --git a/client/src/components/Files/FileList/FileTableColumns.tsx b/client/src/components/Files/FileList/FileTableColumns.tsx
index 754cb061db5..bbad3473186 100644
--- a/client/src/components/Files/FileList/FileTableColumns.tsx
+++ b/client/src/components/Files/FileList/FileTableColumns.tsx
@@ -3,10 +3,13 @@ import { PlusIcon } from 'lucide-react';
 import { Button, Checkbox, DotsIcon, FileIcon } from '@librechat/client';
 import type { ColumnDef } from '@tanstack/react-table';
 import type { TFile } from 'librechat-data-provider';
+import type { TVectorStore } from '~/common';
 import { formatDate, getFileType } from '~/utils';
 import { useLocalize } from '~/hooks';
 
-export const fileTableColumns: ColumnDef<TFile>[] = [
+type TFileWithVectors = TFile & { vectorsAttached?: TVectorStore[] };
+
+export const fileTableColumns: ColumnDef<TFileWithVectors>[] = [
   {
     id: 'select',
     header: ({ table }) => {
@@ -53,7 +56,7 @@ export const fileTableColumns: ColumnDef<TFile>[] = [
       size: '150px',
     },
     accessorKey: 'filename',
-    header: ({ column }) => {
+    header: () => {
       const localize = useLocalize();
       return <>{localize('com_ui_name')}</>;
     },
@@ -68,7 +71,8 @@ export const fileTableColumns: ColumnDef<TFile>[] = [
       return 'Vector Stores';
     },
     cell: ({ row }) => {
-      const { vectorsAttached: attachedVectorStores } = row.original;
+      const localize = useLocalize();
+      const { vectorsAttached: attachedVectorStores = [] } = row.original;
       return (
         <>
           {attachedVectorStores.map((vectorStore, index) => {
@@ -80,7 +84,7 @@ export const fileTableColumns: ColumnDef<TFile>[] = [
                 >
                   <PlusIcon className="h-3 w-3" />
                   &nbsp;
-                  {attachedVectorStores.length - index} more
+                  {localize('com_ui_more_count', { 0: attachedVectorStores.length - index })}
                 </span>
               );
             }
@@ -100,17 +104,19 @@ export const fileTableColumns: ColumnDef<TFile>[] = [
   {
     accessorKey: 'updatedAt',
     header: () => {
-      const localize = useLocalize();
       return 'Modified';
     },
-    cell: ({ row }) => formatDate(row.original.updatedAt),
+    cell: ({ row }) => {
+      const { updatedAt } = row.original;
+      return formatDate(updatedAt instanceof Date ? updatedAt.toISOString() : (updatedAt ?? ''));
+    },
   },
   {
     accessorKey: 'actions',
     header: () => {
       return 'Actions';
     },
-    cell: ({ row }) => {
+    cell: () => {
       return (
         <>
           <Button className="w-min content-center bg-transparent text-gray-500 hover:bg-slate-200">
diff --git a/client/src/components/Files/VectorStore/VectorStoreListItem.tsx b/client/src/components/Files/VectorStore/VectorStoreListItem.tsx
index 66a54b1593c..d0a266b3d23 100644
--- a/client/src/components/Files/VectorStore/VectorStoreListItem.tsx
+++ b/client/src/components/Files/VectorStore/VectorStoreListItem.tsx
@@ -2,6 +2,7 @@ import React from 'react';
 import { useNavigate } from 'react-router-dom';
 import { Button, DotsIcon, TrashIcon } from '@librechat/client';
 import { TVectorStore } from '~/common';
+import { useLocalize } from '~/hooks';
 
 type VectorStoreListItemProps = {
   vectorStore: TVectorStore;
@@ -13,6 +14,7 @@ export default function VectorStoreListItem({
   deleteVectorStore,
 }: VectorStoreListItemProps) {
   const navigate = useNavigate();
+  const localize = useLocalize();
   return (
     <div
       onClick={() => {
@@ -26,7 +28,10 @@ export default function VectorStoreListItem({
       </div>
       <div className="w-2/6 text-gray-500">
         <p>
-          {vectorStore.file_counts.total} Files ({vectorStore.bytes / 1000}KB)
+          {localize('com_ui_files_count_size', {
+            0: vectorStore.file_counts?.total ?? 0,
+            1: (vectorStore.bytes ?? 0) / 1000,
+          })}
         </p>
         <p className="text-sm">{vectorStore.created_at.toString()}</p>
       </div>
diff --git a/client/src/components/MCP/MCPServerStatusIcon.tsx b/client/src/components/MCP/MCPServerStatusIcon.tsx
index 8ae225b2e28..24943c41ef2 100644
--- a/client/src/components/MCP/MCPServerStatusIcon.tsx
+++ b/client/src/components/MCP/MCPServerStatusIcon.tsx
@@ -73,8 +73,19 @@ export default function MCPServerStatusIcon({
 
   const { connectionState } = serverStatus;
 
-  // Connecting: show spinner only (no action available)
+  // Connecting: show spinner, with cancel when an OAuth flow is pending.
   if (connectionState === 'connecting') {
+    if (canCancel) {
+      return (
+        <LoadingStatusIcon
+          serverName={serverName}
+          onConfigClick={onConfigClick}
+          onCancel={onCancel}
+          canCancel={canCancel}
+        />
+      );
+    }
+
     return <ConnectingSpinner serverName={serverName} />;
   }
 
diff --git a/client/src/components/MCP/ServerInitializationSection.tsx b/client/src/components/MCP/ServerInitializationSection.tsx
index c080866b3d4..bbed167da6c 100644
--- a/client/src/components/MCP/ServerInitializationSection.tsx
+++ b/client/src/components/MCP/ServerInitializationSection.tsx
@@ -38,15 +38,33 @@ export default function ServerInitializationSection({
 
   const serverStatus = connectionStatus?.[serverName];
   const isConnected = serverStatus?.connectionState === 'connected';
-  const canCancel = isCancellable(serverName);
+  const hasPendingOAuth =
+    requiresOAuth &&
+    serverStatus?.requiresOAuth === true &&
+    serverStatus.connectionState === 'connecting';
+  const canCancel = isCancellable(serverName) || hasPendingOAuth;
   const isServerInitializing = isInitializing(serverName);
   const serverOAuthUrl = getOAuthUrl(serverName);
 
   const shouldShowReinit = isConnected && (requiresOAuth || hasCustomUserVars);
-  const shouldShowInit = !isConnected && !serverOAuthUrl;
+  const shouldShowInit = !isConnected && !serverOAuthUrl && !hasPendingOAuth;
 
   if (!shouldShowReinit && !shouldShowInit && !serverOAuthUrl) {
-    return null;
+    if (!hasPendingOAuth) {
+      return null;
+    }
+
+    return (
+      <Button
+        onClick={() => cancelOAuthFlow(serverName)}
+        disabled={!canCancel}
+        variant="outline"
+        size={sidePanel ? 'sm' : 'default'}
+        className="w-full"
+      >
+        {localize('com_ui_cancel')}
+      </Button>
+    );
   }
 
   if (serverOAuthUrl) {
diff --git a/client/src/components/MCP/mcpServerUtils.ts b/client/src/components/MCP/mcpServerUtils.ts
index eb93303ca16..feef7dccdea 100644
--- a/client/src/components/MCP/mcpServerUtils.ts
+++ b/client/src/components/MCP/mcpServerUtils.ts
@@ -187,7 +187,9 @@ export function shouldShowActionButton(statusIconProps?: MCPServerStatusIconProp
 
   // Show for disconnected/error (can reconnect/configure)
   if (connectionState === 'disconnected' || connectionState === 'error') return true;
-  // Don't show connecting spinner (no action)
+  // Show a cancel action for pending OAuth connections.
+  if (connectionState === 'connecting' && requiresOAuth && canCancel) return true;
+  // Don't show connecting spinner when no action is available.
   if (connectionState === 'connecting') return false;
   // Connected: only show if there's config to manage
   if (connectionState === 'connected') return hasCustomUserVars || requiresOAuth;
diff --git a/client/src/components/Messages/ContentRender.tsx b/client/src/components/Messages/ContentRender.tsx
index da40bec1047..7473e2768c7 100644
--- a/client/src/components/Messages/ContentRender.tsx
+++ b/client/src/components/Messages/ContentRender.tsx
@@ -5,6 +5,7 @@ import type { TMessage, TMessageContentParts } from 'librechat-data-provider';
 import type { TMessageProps, TMessageIcon, TMessageChatContext } from '~/common';
 import { useAttachments, useLocalize, useMessageActions, useContentMetadata } from '~/hooks';
 import { cn, getHeaderPrefixForScreenReader, getMessageAriaLabel } from '~/utils';
+import MessageTimestamp from '~/components/Chat/Messages/ui/MessageTimestamp';
 import ContentParts from '~/components/Chat/Messages/Content/ContentParts';
 import PlaceholderRow from '~/components/Chat/Messages/ui/PlaceholderRow';
 import SiblingSwitch from '~/components/Chat/Messages/SiblingSwitch';
@@ -70,6 +71,7 @@ function areContentRenderPropsEqual(prev: ContentRenderProps, next: ContentRende
     prevMsg.text === nextMsg.text &&
     prevMsg.error === nextMsg.error &&
     prevMsg.unfinished === nextMsg.unfinished &&
+    prevMsg.createdAt === nextMsg.createdAt &&
     prevMsg.depth === nextMsg.depth &&
     prevMsg.isCreatedByUser === nextMsg.isCreatedByUser &&
     (prevMsg.children?.length ?? 0) === (nextMsg.children?.length ?? 0) &&
@@ -172,7 +174,7 @@ const ContentRender = memo(function ContentRender({
   };
 
   const conditionalClasses = {
-    focus: 'focus:outline-none focus:ring-2 focus:ring-border-xheavy',
+    focus: 'focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-border-xheavy',
   };
 
   return (
@@ -205,6 +207,7 @@ const ContentRender = memo(function ContentRender({
           <h2 className={cn('select-none font-semibold', fontSize)}>
             <span className="sr-only">{getHeaderPrefixForScreenReader(msg, localize)}</span>
             {messageLabel}
+            <MessageTimestamp value={msg.createdAt ?? msg.clientTimestamp} />
           </h2>
         )}
 
@@ -223,6 +226,7 @@ const ContentRender = memo(function ContentRender({
               isLatestMessage={isLatestMessage}
               isSubmitting={isSubmitting}
               isCreatedByUser={msg.isCreatedByUser}
+              createdAt={msg.createdAt ?? msg.clientTimestamp}
               conversationId={conversation?.conversationId}
               content={msg.content as Array<TMessageContentParts | undefined>}
             />
diff --git a/client/src/components/Nav/AccountSettings.tsx b/client/src/components/Nav/AccountSettings.tsx
index 01417ef3624..5ced6db89a4 100644
--- a/client/src/components/Nav/AccountSettings.tsx
+++ b/client/src/components/Nav/AccountSettings.tsx
@@ -20,7 +20,7 @@ function AccountSettings({ collapsed = false }: { collapsed?: boolean }) {
   const accountSettingsButtonRef = useRef<HTMLButtonElement>(null);
 
   return (
-    <Menu.MenuProvider>
+    <Menu.MenuProvider placement={collapsed ? 'right-end' : undefined}>
       <Menu.MenuButton
         ref={accountSettingsButtonRef}
         aria-label={localize('com_nav_account_settings')}
@@ -50,7 +50,6 @@ function AccountSettings({ collapsed = false }: { collapsed?: boolean }) {
       <Menu.Menu
         portal
         className="account-settings-popover popover-ui z-[125] w-[305px] rounded-lg md:w-[244px]"
-        placement={collapsed ? 'right-end' : undefined}
         style={{
           transformOrigin: collapsed ? 'left bottom' : 'bottom',
           translate: collapsed ? '4px 0' : '0 -4px',
diff --git a/client/src/components/Nav/Favorites/tests/FavoritesList.spec.tsx b/client/src/components/Nav/Favorites/tests/FavoritesList.spec.tsx
index 03dc401d608..e1fd91590fb 100644
--- a/client/src/components/Nav/Favorites/tests/FavoritesList.spec.tsx
+++ b/client/src/components/Nav/Favorites/tests/FavoritesList.spec.tsx
@@ -1,12 +1,12 @@
 import React from 'react';
 import { render, waitFor } from '@testing-library/react';
 import '@testing-library/jest-dom';
-import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import { RecoilRoot } from 'recoil';
 import { DndProvider } from 'react-dnd';
-import { HTML5Backend } from 'react-dnd-html5-backend';
 import { BrowserRouter } from 'react-router-dom';
 import { dataService } from 'librechat-data-provider';
+import { HTML5Backend } from 'react-dnd-html5-backend';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import type { Agent } from 'librechat-data-provider';
 
 // Mock store before importing FavoritesList
@@ -71,7 +71,7 @@ jest.mock('~/hooks/Input/useSelectMention', () => () => ({
   onSelectSpec: mockOnSelectSpec,
 }));
 
-const mockUseGetStartupConfig = jest.fn(() => ({
+const mockUseGetStartupConfig = jest.fn((): { data?: { modelSpecs: { list: unknown[] } } } => ({
   data: { modelSpecs: { list: [] as unknown[] } },
 }));
 
diff --git a/client/src/components/Nav/SettingsTabs/Account/TwoFactorAuthentication.tsx b/client/src/components/Nav/SettingsTabs/Account/TwoFactorAuthentication.tsx
index a478f9b2c73..c21e295ed16 100644
--- a/client/src/components/Nav/SettingsTabs/Account/TwoFactorAuthentication.tsx
+++ b/client/src/components/Nav/SettingsTabs/Account/TwoFactorAuthentication.tsx
@@ -11,6 +11,7 @@ import {
   Progress,
 } from '@librechat/client';
 import type { TUser, TVerify2FARequest } from 'librechat-data-provider';
+import type { Variants } from 'framer-motion';
 import {
   useConfirmTwoFactorMutation,
   useDisableTwoFactorMutation,
@@ -24,7 +25,7 @@ import store from '~/store';
 
 export type Phase = 'setup' | 'qr' | 'verify' | 'backup' | 'disable';
 
-const phaseVariants = {
+const phaseVariants: Variants = {
   initial: { opacity: 0, scale: 0.95 },
   animate: { opacity: 1, scale: 1, transition: { duration: 0.3, ease: 'easeOut' } },
   exit: { opacity: 0, scale: 0.95, transition: { duration: 0.3, ease: 'easeIn' } },
diff --git a/client/src/components/Nav/SettingsTabs/Balance/Balance.tsx b/client/src/components/Nav/SettingsTabs/Balance/Balance.tsx
index 18b4368e0ba..28a2efccdce 100644
--- a/client/src/components/Nav/SettingsTabs/Balance/Balance.tsx
+++ b/client/src/components/Nav/SettingsTabs/Balance/Balance.tsx
@@ -1,8 +1,8 @@
 import React from 'react';
 import { useGetStartupConfig, useGetUserBalance } from '~/data-provider';
 import { useAuthContext, useLocalize } from '~/hooks';
-import TokenCreditsItem from './TokenCreditsItem';
 import AutoRefillSettings from './AutoRefillSettings';
+import TokenCreditsItem from './TokenCreditsItem';
 
 function Balance() {
   const localize = useLocalize();
@@ -31,30 +31,36 @@ function Balance() {
     refillIntervalUnit !== undefined &&
     refillIntervalValue !== undefined;
 
+  const renderAutoRefill = () => {
+    if (!autoRefillEnabled) {
+      return (
+        <div className="text-sm text-gray-600">
+          {localize('com_nav_balance_auto_refill_disabled')}
+        </div>
+      );
+    }
+    if (!hasValidRefillSettings) {
+      return (
+        <div className="text-sm text-red-600">{localize('com_nav_balance_auto_refill_error')}</div>
+      );
+    }
+    return (
+      <AutoRefillSettings
+        lastRefill={lastRefill}
+        refillAmount={refillAmount}
+        refillIntervalUnit={refillIntervalUnit}
+        refillIntervalValue={refillIntervalValue}
+      />
+    );
+  };
+
   return (
     <div className="flex flex-col gap-4 p-4 text-sm text-text-primary">
       {/* Token credits display */}
       <TokenCreditsItem tokenCredits={tokenCredits} />
 
       {/* Auto-refill display */}
-      {autoRefillEnabled ? (
-        hasValidRefillSettings ? (
-          <AutoRefillSettings
-            lastRefill={lastRefill}
-            refillAmount={refillAmount}
-            refillIntervalUnit={refillIntervalUnit}
-            refillIntervalValue={refillIntervalValue}
-          />
-        ) : (
-          <div className="text-sm text-red-600">
-            {localize('com_nav_balance_auto_refill_error')}
-          </div>
-        )
-      ) : (
-        <div className="text-sm text-gray-600">
-          {localize('com_nav_balance_auto_refill_disabled')}
-        </div>
-      )}
+      {renderAutoRefill()}
     </div>
   );
 }
diff --git a/client/src/components/Nav/SettingsTabs/Data/SharedLinks.tsx b/client/src/components/Nav/SettingsTabs/Data/SharedLinks.tsx
index af1803adf7c..5413bcb68c4 100644
--- a/client/src/components/Nav/SettingsTabs/Data/SharedLinks.tsx
+++ b/client/src/components/Nav/SettingsTabs/Data/SharedLinks.tsx
@@ -38,7 +38,6 @@ const PAGE_SIZE = 25;
 
 const DEFAULT_PARAMS: SharedLinksListParams = {
   pageSize: PAGE_SIZE,
-  isPublic: true,
   sortBy: 'createdAt',
   sortDirection: 'desc',
   search: '',
diff --git a/client/src/components/Nav/SettingsTabs/General/ArchivedChats.tsx b/client/src/components/Nav/SettingsTabs/General/ArchivedChats.tsx
index 2e6f6df07da..98bed88b326 100644
--- a/client/src/components/Nav/SettingsTabs/General/ArchivedChats.tsx
+++ b/client/src/components/Nav/SettingsTabs/General/ArchivedChats.tsx
@@ -20,7 +20,7 @@ export default function ArchivedChats() {
           title={localize('com_nav_archived_chats')}
           className="max-w-[1000px]"
           showCancelButton={false}
-          main={<ArchivedChatsTable isOpen={isOpen} onOpenChange={setIsOpen} />}
+          main={<ArchivedChatsTable onOpenChange={setIsOpen} />}
         />
       </OGDialog>
     </div>
diff --git a/client/src/components/Nav/SettingsTabs/General/General.tsx b/client/src/components/Nav/SettingsTabs/General/General.tsx
index 90224ac032f..ab10f758020 100644
--- a/client/src/components/Nav/SettingsTabs/General/General.tsx
+++ b/client/src/components/Nav/SettingsTabs/General/General.tsx
@@ -1,7 +1,7 @@
 import React, { useContext, useCallback } from 'react';
 import Cookies from 'js-cookie';
-import { useRecoilState } from 'recoil';
-import { Dropdown, ThemeContext } from '@librechat/client';
+import { useRecoilState, useRecoilValue } from 'recoil';
+import { Dropdown, Spinner, ThemeContext } from '@librechat/client';
 import ArchivedChats from './ArchivedChats';
 import ToggleSwitch from '../ToggleSwitch';
 import { useLocalize } from '~/hooks';
@@ -85,6 +85,7 @@ export const LangSelector = ({
   portal?: boolean;
 }) => {
   const localize = useLocalize();
+  const isLanguageLoading = useRecoilValue(store.languageLoading);
 
   const languageOptions = [
     { value: 'auto', label: localize('com_nav_lang_auto') },
@@ -137,15 +138,26 @@ export const LangSelector = ({
     <div className="flex items-center justify-between">
       <div id={labelId}>{localize('com_nav_language')}</div>
 
-      <Dropdown
-        value={langcode}
-        onChange={onChange}
-        sizeClasses="[--anchor-max-height:256px] max-h-[60vh]"
-        options={languageOptions}
-        className="z-50"
-        aria-labelledby={labelId}
-        portal={portal}
-      />
+      <div className="flex items-center gap-2">
+        {isLanguageLoading && (
+          <span
+            role="status"
+            aria-label={localize('com_ui_loading')}
+            className="flex size-5 items-center justify-center text-text-secondary"
+          >
+            <Spinner className="size-4" />
+          </span>
+        )}
+        <Dropdown
+          value={langcode}
+          onChange={onChange}
+          sizeClasses="[--anchor-max-height:256px] max-h-[60vh]"
+          options={languageOptions}
+          className="z-50"
+          aria-labelledby={labelId}
+          portal={portal}
+        />
+      </div>
     </div>
   );
 };
@@ -169,9 +181,6 @@ function General() {
         userLang = navigator.language || navigator.languages[0];
       }
 
-      requestAnimationFrame(() => {
-        document.documentElement.lang = userLang;
-      });
       setLangcode(userLang);
       Cookies.set('lang', userLang, { expires: 365 });
     },
diff --git a/client/src/components/Nav/SettingsTabs/General/LangSelector.spec.tsx b/client/src/components/Nav/SettingsTabs/General/LangSelector.spec.tsx
index 2ad856d688e..b2920ef744f 100644
--- a/client/src/components/Nav/SettingsTabs/General/LangSelector.spec.tsx
+++ b/client/src/components/Nav/SettingsTabs/General/LangSelector.spec.tsx
@@ -2,8 +2,9 @@ import 'test/matchMedia.mock';
 import React from 'react';
 import { render, fireEvent, waitFor } from '@testing-library/react';
 import '@testing-library/jest-dom/extend-expect';
-import { LangSelector } from './General';
 import { RecoilRoot } from 'recoil';
+import { LangSelector } from './General';
+import store from '~/store';
 
 describe('LangSelector', () => {
   let mockOnChange;
@@ -54,4 +55,19 @@ describe('LangSelector', () => {
       expect(mockOnChange).toHaveBeenCalledWith('it-IT');
     });
   });
+
+  it('shows a loading indicator while language resources load', () => {
+    global.ResizeObserver = class MockedResizeObserver {
+      observe = jest.fn();
+      unobserve = jest.fn();
+      disconnect = jest.fn();
+    };
+    const { getByRole } = render(
+      <RecoilRoot initializeState={({ set }) => set(store.languageLoading, true)}>
+        <LangSelector langcode="en-US" onChange={mockOnChange} />
+      </RecoilRoot>,
+    );
+
+    expect(getByRole('status', { name: 'Loading...' })).toBeInTheDocument();
+  });
 });
diff --git a/client/src/components/Nav/SettingsTabs/Speech/STT/AutoSendTextSelector.tsx b/client/src/components/Nav/SettingsTabs/Speech/STT/AutoSendTextSelector.tsx
index a033ed322c2..77565acb7f2 100644
--- a/client/src/components/Nav/SettingsTabs/Speech/STT/AutoSendTextSelector.tsx
+++ b/client/src/components/Nav/SettingsTabs/Speech/STT/AutoSendTextSelector.tsx
@@ -40,8 +40,9 @@ export default function AutoSendTextSelector() {
     }
   };
 
-  const handleInputChange = (value: number[] | null) => {
-    const newValue = value ? value[0] : 3;
+  const handleInputChange = (value: string | number | null) => {
+    const parsed = typeof value === 'number' ? value : parseInt(String(value ?? ''), 10);
+    const newValue = Number.isNaN(parsed) ? 3 : parsed;
     setDelayValue(newValue);
     if (isEnabled) {
       setAutoSendText(newValue);
diff --git a/client/src/components/Projects/ProjectChatList.tsx b/client/src/components/Projects/ProjectChatList.tsx
new file mode 100644
index 00000000000..fe1a8aa55a3
--- /dev/null
+++ b/client/src/components/Projects/ProjectChatList.tsx
@@ -0,0 +1,261 @@
+import {
+  memo,
+  useCallback,
+  useEffect,
+  useMemo,
+  useRef,
+  type CSSProperties,
+  type FC,
+  type ReactNode,
+} from 'react';
+import throttle from 'lodash/throttle';
+import { Spinner } from '@librechat/client';
+import { AutoSizer, CellMeasurer, CellMeasurerCache, List } from 'react-virtualized';
+import type { TConversation } from 'librechat-data-provider';
+import type { MeasuredCellParent } from '~/components/Conversations/Conversations';
+import ConversationEndpointIcon from '~/components/Conversations/ConversationEndpointIcon';
+import { areConversationRenderPropsEqual } from '~/components/Conversations/utils';
+import { DateLabel } from '~/components/Conversations/Conversations';
+import { useLocalize, useNavigateToConvo } from '~/hooks';
+import { groupConversationsByDate, cn } from '~/utils';
+import { useActiveJobs } from '~/data-provider';
+
+type ChatSortField = 'updatedAt' | 'createdAt';
+
+type FlattenedItem =
+  | { type: 'date'; groupName: string }
+  | { type: 'convo'; convo: TConversation }
+  | { type: 'loading' }
+  | { type: 'empty' };
+
+interface ProjectChatListProps {
+  conversations: TConversation[];
+  isLoading: boolean;
+  isFetchingNextPage: boolean;
+  hasNextPage: boolean;
+  sortBy: ChatSortField;
+  emptyLabel: string;
+  loadMore: () => void;
+}
+
+interface MeasuredRowProps {
+  cache: CellMeasurerCache;
+  rowKey: string;
+  parent: MeasuredCellParent;
+  index: number;
+  style: CSSProperties;
+  children: ReactNode;
+}
+
+const MeasuredRow: FC<MeasuredRowProps> = memo(
+  ({ cache, rowKey, parent, index, style, children }) => (
+    <CellMeasurer cache={cache} columnIndex={0} key={rowKey} parent={parent} rowIndex={index}>
+      {({ registerChild }) => (
+        <div ref={registerChild as React.LegacyRef<HTMLDivElement>} style={style}>
+          {children}
+        </div>
+      )}
+    </CellMeasurer>
+  ),
+);
+
+MeasuredRow.displayName = 'ProjectWorkspaceMeasuredRow';
+
+const LoadingRow = memo(() => {
+  const localize = useLocalize();
+  return (
+    <div className="flex items-center justify-center gap-2 py-4 text-sm text-text-secondary">
+      <Spinner className="text-text-primary" />
+      <span>{localize('com_ui_loading')}</span>
+    </div>
+  );
+});
+
+LoadingRow.displayName = 'ProjectWorkspaceLoadingRow';
+
+const ConversationRow = memo(
+  ({ conversation, isGenerating }: { conversation: TConversation; isGenerating: boolean }) => {
+    const { navigateToConvo } = useNavigateToConvo();
+    const localize = useLocalize();
+    const title = conversation.title || localize('com_ui_untitled');
+    const updatedAt = conversation.updatedAt || conversation.createdAt;
+    const formattedDate = updatedAt ? new Date(updatedAt).toLocaleString() : '';
+
+    return (
+      <button
+        type="button"
+        className="flex w-full items-center gap-3 border-b border-border-light py-3 text-left outline-none transition-colors hover:bg-surface-hover focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-ring-primary"
+        onClick={() => navigateToConvo(conversation)}
+      >
+        <span className="flex h-8 w-8 shrink-0 items-center justify-center">
+          <ConversationEndpointIcon conversation={conversation} size={24} context="menu-item" />
+        </span>
+        <span className="min-w-0 flex-1">
+          <span className="block truncate text-sm font-medium text-text-primary">{title}</span>
+          <span className="block truncate text-xs text-text-secondary">{formattedDate}</span>
+        </span>
+        {isGenerating && (
+          <Spinner
+            className="h-4 w-4 shrink-0 text-text-primary"
+            aria-label={localize('com_ui_generating')}
+          />
+        )}
+      </button>
+    );
+  },
+  areConversationRenderPropsEqual,
+);
+
+ConversationRow.displayName = 'ProjectWorkspaceConversationRow';
+
+const ProjectChatList = ({
+  conversations,
+  isLoading,
+  isFetchingNextPage,
+  hasNextPage,
+  sortBy,
+  emptyLabel,
+  loadMore,
+}: ProjectChatListProps) => {
+  const { data: activeJobsData } = useActiveJobs();
+  const activeJobIds = useMemo(
+    () => new Set(activeJobsData?.activeJobIds ?? []),
+    [activeJobsData?.activeJobIds],
+  );
+  const flattenedItems = useMemo(() => {
+    if (isLoading) {
+      return [{ type: 'loading' as const }];
+    }
+    if (!conversations.length) {
+      return [{ type: 'empty' as const }];
+    }
+
+    const items: FlattenedItem[] = [];
+    groupConversationsByDate(conversations, sortBy).forEach(([groupName, convos]) => {
+      items.push({ type: 'date', groupName });
+      convos.forEach((convo) => items.push({ type: 'convo', convo }));
+    });
+    if (isFetchingNextPage) {
+      items.push({ type: 'loading' });
+    }
+    return items;
+  }, [conversations, isFetchingNextPage, isLoading, sortBy]);
+
+  const flattenedItemsRef = useRef(flattenedItems);
+  flattenedItemsRef.current = flattenedItems;
+
+  const cache = useMemo(
+    () =>
+      new CellMeasurerCache({
+        fixedWidth: true,
+        defaultHeight: 52,
+        keyMapper: (index) => {
+          const item = flattenedItemsRef.current[index];
+          if (!item) {
+            return `project-workspace-unknown-${index}`;
+          }
+          if (item.type === 'date') {
+            return `project-workspace-date-${item.groupName}`;
+          }
+          if (item.type === 'convo') {
+            return `project-workspace-convo-${item.convo.conversationId}`;
+          }
+          return `project-workspace-${item.type}`;
+        },
+      }),
+    [],
+  );
+
+  const listRef = useRef<List | null>(null);
+
+  useEffect(() => {
+    const frameId = requestAnimationFrame(() => {
+      cache.clearAll();
+      listRef.current?.recomputeRowHeights(0);
+    });
+    return () => cancelAnimationFrame(frameId);
+  }, [cache, conversations.length, sortBy]);
+
+  const throttledLoadMore = useMemo(() => throttle(loadMore, 300), [loadMore]);
+
+  const rowRenderer = useCallback(
+    ({ index, key, parent, style }) => {
+      const item = flattenedItems[index];
+      const rowProps = { cache, rowKey: key, parent, index, style };
+
+      if (item.type === 'loading') {
+        return (
+          <MeasuredRow key={key} {...rowProps}>
+            <LoadingRow />
+          </MeasuredRow>
+        );
+      }
+
+      if (item.type === 'empty') {
+        return (
+          <MeasuredRow key={key} {...rowProps}>
+            <div className="py-12 text-center text-sm text-text-secondary">{emptyLabel}</div>
+          </MeasuredRow>
+        );
+      }
+
+      if (item.type === 'date') {
+        return (
+          <MeasuredRow key={key} {...rowProps}>
+            <DateLabel groupName={item.groupName} />
+          </MeasuredRow>
+        );
+      }
+
+      return (
+        <MeasuredRow key={key} {...rowProps}>
+          <ConversationRow
+            conversation={item.convo}
+            isGenerating={activeJobIds.has(item.convo.conversationId ?? '')}
+          />
+        </MeasuredRow>
+      );
+    },
+    [activeJobIds, cache, emptyLabel, flattenedItems],
+  );
+
+  const getRowHeight = useCallback(
+    ({ index }: { index: number }) => cache.getHeight(index, 0),
+    [cache],
+  );
+
+  const handleRowsRendered = useCallback(
+    ({ stopIndex }: { stopIndex: number }) => {
+      if (hasNextPage && stopIndex >= flattenedItems.length - 6) {
+        throttledLoadMore();
+      }
+    },
+    [flattenedItems.length, hasNextPage, throttledLoadMore],
+  );
+
+  return (
+    <div
+      className={cn('min-h-[280px] flex-1 overflow-hidden rounded-lg border border-border-light')}
+    >
+      <AutoSizer>
+        {({ width, height }) => (
+          <List
+            ref={listRef}
+            width={width}
+            height={height}
+            rowCount={flattenedItems.length}
+            rowHeight={getRowHeight}
+            rowRenderer={rowRenderer}
+            deferredMeasurementCache={cache}
+            overscanRowCount={8}
+            onRowsRendered={handleRowsRendered}
+            className="outline-none"
+            style={{ outline: 'none' }}
+          />
+        )}
+      </AutoSizer>
+    </div>
+  );
+};
+
+export default memo(ProjectChatList);
diff --git a/client/src/components/Projects/ProjectCreateDialog.tsx b/client/src/components/Projects/ProjectCreateDialog.tsx
new file mode 100644
index 00000000000..427e0246609
--- /dev/null
+++ b/client/src/components/Projects/ProjectCreateDialog.tsx
@@ -0,0 +1,120 @@
+import {
+  useEffect,
+  useId,
+  useRef,
+  useState,
+  type FormEvent,
+  type MutableRefObject,
+  type ReactNode,
+} from 'react';
+import type { TChatProject } from 'librechat-data-provider';
+import {
+  Button,
+  Input,
+  Label,
+  OGDialog,
+  OGDialogTemplate,
+  Spinner,
+  useToastContext,
+} from '@librechat/client';
+import { useCreateProjectMutation } from '~/data-provider';
+import { useLocalize } from '~/hooks';
+
+type ProjectCreateDialogProps = {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  onCreated?: (project: TChatProject) => void;
+  children?: ReactNode;
+  triggerRef?: MutableRefObject<HTMLButtonElement | null>;
+};
+
+export default function ProjectCreateDialog({
+  open,
+  onOpenChange,
+  onCreated,
+  children,
+  triggerRef,
+}: ProjectCreateDialogProps) {
+  const localize = useLocalize();
+  const formId = useId();
+  const inputRef = useRef<HTMLInputElement | null>(null);
+  const [name, setName] = useState('');
+  const createProject = useCreateProjectMutation();
+  const { showToast } = useToastContext();
+
+  useEffect(() => {
+    if (!open) {
+      return;
+    }
+    const frameId = requestAnimationFrame(() => inputRef.current?.focus());
+    return () => cancelAnimationFrame(frameId);
+  }, [open]);
+
+  const handleOpenChange = (nextOpen: boolean) => {
+    onOpenChange(nextOpen);
+    if (!nextOpen && !createProject.isLoading) {
+      setName('');
+    }
+  };
+
+  const handleCreate = async (event: FormEvent<HTMLFormElement>) => {
+    event.preventDefault();
+    const trimmedName = name.trim();
+    if (!trimmedName || createProject.isLoading) {
+      return;
+    }
+
+    try {
+      const project = await createProject.mutateAsync({ name: trimmedName });
+      setName('');
+      onOpenChange(false);
+      onCreated?.(project);
+    } catch {
+      showToast({
+        message: localize('com_ui_project_create_error'),
+        status: 'error',
+      });
+    }
+  };
+
+  return (
+    <OGDialog open={open} onOpenChange={handleOpenChange} triggerRef={triggerRef}>
+      {children}
+      <OGDialogTemplate
+        title={localize('com_ui_create_project')}
+        showCloseButton={true}
+        className="w-11/12 max-w-lg bg-surface-primary text-text-primary"
+        main={
+          <form id={formId} onSubmit={handleCreate} className="space-y-2">
+            <Label htmlFor={`${formId}-name`} className="text-sm font-medium text-text-primary">
+              {localize('com_ui_project_name')}
+            </Label>
+            <Input
+              id={`${formId}-name`}
+              ref={inputRef}
+              value={name}
+              onChange={(event) => setName(event.target.value)}
+              placeholder={localize('com_ui_project_name_placeholder')}
+              className="w-full bg-transparent text-text-primary placeholder:text-text-secondary focus-visible:ring-2 focus-visible:ring-ring-primary"
+            />
+          </form>
+        }
+        buttons={
+          <Button
+            type="submit"
+            form={formId}
+            variant="submit"
+            disabled={!name.trim() || createProject.isLoading}
+            aria-label={localize('com_ui_create_project')}
+          >
+            {createProject.isLoading ? (
+              <Spinner className="size-4" />
+            ) : (
+              localize('com_ui_create_project')
+            )}
+          </Button>
+        }
+      />
+    </OGDialog>
+  );
+}
diff --git a/client/src/components/Projects/ProjectWorkspace.tsx b/client/src/components/Projects/ProjectWorkspace.tsx
new file mode 100644
index 00000000000..e904029dff4
--- /dev/null
+++ b/client/src/components/Projects/ProjectWorkspace.tsx
@@ -0,0 +1,215 @@
+import { useCallback, useId, useMemo, useState } from 'react';
+import * as Ariakit from '@ariakit/react';
+import { useRecoilValue } from 'recoil';
+import { useQueryClient } from '@tanstack/react-query';
+import { ArrowLeft, ArrowUpDown, Check, Folder, Plus } from 'lucide-react';
+import { useNavigate, useParams } from 'react-router-dom';
+import { QueryKeys } from 'librechat-data-provider';
+import type { ConversationListResponse } from 'librechat-data-provider';
+import { Spinner, DropdownPopup } from '@librechat/client';
+import type { MenuItemProps, RenderProp } from '~/common';
+import { useConversationsInfiniteQuery, useProjectQuery } from '~/data-provider';
+import { useLocalize, useNewConvo } from '~/hooks';
+import { cn, clearMessagesCache } from '~/utils';
+import ProjectChatList from './ProjectChatList';
+import store from '~/store';
+
+type ChatSortField = 'updatedAt' | 'createdAt';
+
+function renderSortMenuItem(label: string, isSelected: boolean): RenderProp {
+  return function SortMenuItem({ className, ...props }) {
+    return (
+      <div {...props} className={cn(className, 'justify-between gap-5')}>
+        <span className="truncate">{label}</span>
+        {isSelected ? (
+          <Check className="h-4 w-4 shrink-0 text-text-primary" aria-hidden="true" />
+        ) : (
+          <span className="h-4 w-4 shrink-0" aria-hidden="true" />
+        )}
+      </div>
+    );
+  };
+}
+
+export default function ProjectWorkspace() {
+  const localize = useLocalize();
+  const navigate = useNavigate();
+  const queryClient = useQueryClient();
+  const { projectId = '' } = useParams();
+  const [sortBy, setSortBy] = useState<ChatSortField>('updatedAt');
+  const sortMenuId = useId();
+  const [isSortMenuOpen, setIsSortMenuOpen] = useState(false);
+  const { data: project, isLoading: isProjectLoading } = useProjectQuery(projectId);
+  const conversation = useRecoilValue(store.conversationByIndex(0));
+  const { newConversation } = useNewConvo();
+  const activeProjectId = project?._id;
+
+  const sortOptions = useMemo(
+    () => [
+      { value: 'updatedAt' as const, label: localize('com_ui_sort_updated') },
+      { value: 'createdAt' as const, label: localize('com_ui_sort_created') },
+    ],
+    [localize],
+  );
+  const selectedSortLabel =
+    sortOptions.find((option) => option.value === sortBy)?.label ?? localize('com_ui_sort_updated');
+  const sortMenuItems = useMemo<MenuItemProps[]>(
+    () =>
+      sortOptions.map((option) => {
+        const isSelected = sortBy === option.value;
+        return {
+          id: `project-chat-sort-${option.value}`,
+          ariaLabel: option.label,
+          ariaChecked: isSelected,
+          onClick: () => setSortBy(option.value),
+          render: renderSortMenuItem(option.label, isSelected),
+        };
+      }),
+    [sortBy, sortOptions],
+  );
+
+  const {
+    data,
+    fetchNextPage,
+    isFetchingNextPage,
+    isLoading: isConversationsLoading,
+  } = useConversationsInfiniteQuery(
+    {
+      projectId: activeProjectId,
+      sortBy,
+      sortDirection: 'desc',
+    },
+    {
+      enabled: Boolean(activeProjectId),
+      staleTime: 30000,
+      cacheTime: 300000,
+    },
+  );
+
+  const conversations = useMemo(
+    () => data?.pages.flatMap((page) => page.conversations) ?? [],
+    [data?.pages],
+  );
+
+  const hasNextPage = useMemo(() => {
+    const pages = data?.pages;
+    if (!pages?.length) {
+      return false;
+    }
+    const lastPage: ConversationListResponse = pages[pages.length - 1];
+    return lastPage.nextCursor !== null;
+  }, [data?.pages]);
+
+  const startProjectChat = useCallback(() => {
+    if (!activeProjectId) {
+      return;
+    }
+    clearMessagesCache(queryClient, conversation?.conversationId);
+    queryClient.invalidateQueries([QueryKeys.messages]);
+    newConversation({ template: { chatProjectId: activeProjectId } });
+  }, [activeProjectId, conversation?.conversationId, newConversation, queryClient]);
+
+  if (isProjectLoading) {
+    return (
+      <div className="flex h-full items-center justify-center">
+        <Spinner className="text-text-primary" />
+      </div>
+    );
+  }
+
+  if (!project) {
+    return (
+      <div className="flex h-full items-center justify-center text-sm text-text-secondary">
+        {localize('com_ui_project_not_found')}
+      </div>
+    );
+  }
+
+  return (
+    <main className="flex h-full min-h-0 flex-col overflow-y-auto bg-surface-primary text-text-primary">
+      <div className="mx-auto flex w-full max-w-3xl flex-1 flex-col px-4 pb-10 pt-4 md:px-6 lg:pt-8">
+        <button
+          type="button"
+          onClick={() => navigate('/projects')}
+          className="-ml-1.5 inline-flex w-fit items-center gap-1.5 rounded-lg px-2 py-1 text-sm text-text-secondary transition-colors hover:bg-surface-hover hover:text-text-primary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring-primary"
+        >
+          <ArrowLeft className="h-4 w-4" aria-hidden="true" />
+          {localize('com_ui_all_projects')}
+        </button>
+
+        <header className="mt-5 flex items-start gap-3">
+          <span className="flex h-11 w-11 shrink-0 items-center justify-center rounded-2xl bg-surface-secondary text-text-secondary">
+            <Folder className="h-6 w-6" aria-hidden="true" />
+          </span>
+          <div className="min-w-0 flex-1 pt-0.5">
+            <h1 className="truncate text-2xl font-semibold tracking-tight text-text-primary">
+              {project.name}
+            </h1>
+            {project.description ? (
+              <p className="mt-0.5 line-clamp-2 text-sm text-text-secondary">
+                {project.description}
+              </p>
+            ) : null}
+          </div>
+        </header>
+
+        <button
+          type="button"
+          onClick={startProjectChat}
+          className={cn(
+            'mt-6 flex w-full items-center gap-3 rounded-[26px] border border-border-medium bg-surface-secondary px-3.5 py-3 text-left shadow-sm transition-colors',
+            'hover:bg-surface-tertiary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring-primary',
+          )}
+          aria-label={localize('com_ui_new_chat_in_project', { name: project.name })}
+        >
+          <span className="flex h-8 w-8 shrink-0 items-center justify-center rounded-full bg-surface-tertiary text-text-primary">
+            <Plus className="h-4 w-4" aria-hidden="true" />
+          </span>
+          <span className="min-w-0 flex-1 truncate text-text-secondary">
+            {localize('com_ui_new_chat_in_project', { name: project.name })}
+          </span>
+        </button>
+
+        <section className="mt-8 flex min-h-0 flex-1 flex-col">
+          <div className="mb-2 flex items-center justify-between gap-3">
+            <h2 className="flex items-baseline gap-2 text-sm font-medium text-text-primary">
+              {localize('com_ui_chats')}
+              <span className="text-text-secondary">{project.conversationCount}</span>
+            </h2>
+            <DropdownPopup
+              portal={true}
+              focusLoop={true}
+              unmountOnHide={true}
+              menuId={sortMenuId}
+              isOpen={isSortMenuOpen}
+              setIsOpen={setIsSortMenuOpen}
+              className="z-[125] min-w-44"
+              trigger={
+                <Ariakit.MenuButton
+                  aria-label={localize('com_ui_sort_chats_by')}
+                  className={cn(
+                    'inline-flex h-8 items-center justify-center gap-1.5 whitespace-nowrap rounded-lg px-2.5 text-sm font-medium text-text-secondary transition-colors hover:bg-surface-hover hover:text-text-primary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring-primary',
+                    isSortMenuOpen && 'bg-surface-hover text-text-primary',
+                  )}
+                >
+                  <ArrowUpDown className="h-4 w-4" aria-hidden="true" />
+                  {selectedSortLabel}
+                </Ariakit.MenuButton>
+              }
+              items={sortMenuItems}
+            />
+          </div>
+          <ProjectChatList
+            conversations={conversations}
+            isLoading={isConversationsLoading}
+            isFetchingNextPage={isFetchingNextPage}
+            hasNextPage={hasNextPage}
+            sortBy={sortBy}
+            emptyLabel={localize('com_ui_no_project_chats')}
+            loadMore={() => fetchNextPage()}
+          />
+        </section>
+      </div>
+    </main>
+  );
+}
diff --git a/client/src/components/Projects/ProjectsView.tsx b/client/src/components/Projects/ProjectsView.tsx
new file mode 100644
index 00000000000..0cbbab14047
--- /dev/null
+++ b/client/src/components/Projects/ProjectsView.tsx
@@ -0,0 +1,244 @@
+import { useDeferredValue, useEffect, useId, useMemo, useState } from 'react';
+import * as Ariakit from '@ariakit/react';
+import { useNavigate, useSearchParams } from 'react-router-dom';
+import { ArrowUpDown, Check, Folder, Plus, Search } from 'lucide-react';
+import { Input, Button, Spinner, DropdownPopup, useMediaQuery } from '@librechat/client';
+import type { TChatProject } from 'librechat-data-provider';
+import type { MenuItemProps, RenderProp } from '~/common';
+import OpenSidebar from '~/components/Chat/Menus/OpenSidebar';
+import { useProjectsInfiniteQuery } from '~/data-provider';
+import ProjectCreateDialog from './ProjectCreateDialog';
+import { useLocalize } from '~/hooks';
+import { cn } from '~/utils';
+
+type ProjectSort = 'name' | 'createdAt' | 'lastConversationAt';
+
+function renderSortMenuItem(label: string, isSelected: boolean): RenderProp {
+  return function SortMenuItem({ className, ...props }) {
+    return (
+      <div {...props} className={cn(className, 'justify-between gap-5')}>
+        <span className="truncate">{label}</span>
+        {isSelected ? (
+          <Check className="h-4 w-4 shrink-0 text-text-primary" aria-hidden="true" />
+        ) : (
+          <span className="h-4 w-4 shrink-0" aria-hidden="true" />
+        )}
+      </div>
+    );
+  };
+}
+
+function formatActivity(project: TChatProject) {
+  const value = project.lastConversationAt ?? project.updatedAt ?? project.createdAt;
+  if (!value) {
+    return null;
+  }
+  const date = new Date(value);
+  if (Number.isNaN(date.getTime())) {
+    return null;
+  }
+  return date.toLocaleDateString(undefined, { month: 'short', day: 'numeric', year: 'numeric' });
+}
+
+export default function ProjectsView() {
+  const localize = useLocalize();
+  const navigate = useNavigate();
+  const [searchParams, setSearchParams] = useSearchParams();
+  const [search, setSearch] = useState('');
+  const [sortBy, setSortBy] = useState<ProjectSort>('lastConversationAt');
+  const [isCreating, setIsCreating] = useState(searchParams.get('new') === '1');
+  const sortMenuId = useId();
+  const [isSortMenuOpen, setIsSortMenuOpen] = useState(false);
+  const deferredSearch = useDeferredValue(search);
+  const isSmallScreen = useMediaQuery('(max-width: 768px)');
+
+  const { data, fetchNextPage, isFetchingNextPage, isLoading } = useProjectsInfiniteQuery({
+    search: deferredSearch || undefined,
+    sortBy,
+    sortDirection: sortBy === 'name' ? 'asc' : 'desc',
+  });
+
+  const projects = useMemo(() => data?.pages.flatMap((page) => page.projects) ?? [], [data?.pages]);
+  const hasNextPage = data?.pages[data.pages.length - 1]?.nextCursor != null;
+  const sortOptions = useMemo(
+    () => [
+      { value: 'lastConversationAt' as const, label: localize('com_ui_latest_activity') },
+      { value: 'createdAt' as const, label: localize('com_ui_sort_created') },
+      { value: 'name' as const, label: localize('com_ui_name') },
+    ],
+    [localize],
+  );
+  const selectedSortLabel =
+    sortOptions.find((option) => option.value === sortBy)?.label ??
+    localize('com_ui_latest_activity');
+  const sortMenuItems = useMemo<MenuItemProps[]>(
+    () =>
+      sortOptions.map((option) => {
+        const isSelected = sortBy === option.value;
+        return {
+          id: `project-sort-${option.value}`,
+          ariaLabel: option.label,
+          ariaChecked: isSelected,
+          onClick: () => setSortBy(option.value),
+          render: renderSortMenuItem(option.label, isSelected),
+        };
+      }),
+    [sortBy, sortOptions],
+  );
+
+  useEffect(() => {
+    if (searchParams.get('new') === '1') {
+      setIsCreating(true);
+    }
+  }, [searchParams]);
+
+  const handleCreateDialogChange = (open: boolean) => {
+    setIsCreating(open);
+    if (!open && searchParams.get('new') === '1') {
+      const nextParams = new URLSearchParams(searchParams);
+      nextParams.delete('new');
+      setSearchParams(nextParams, { replace: true });
+    }
+  };
+
+  return (
+    <main className="flex h-full min-h-0 flex-col overflow-auto bg-surface-primary text-text-primary">
+      <div className="container mx-auto flex w-full max-w-4xl flex-1 flex-col gap-6 px-4 py-8 md:px-6 lg:pt-12">
+        <div className="flex flex-wrap items-center justify-between gap-3">
+          <div className="flex min-w-0 items-center gap-2.5">
+            {isSmallScreen ? <OpenSidebar /> : null}
+            <h1 className="text-2xl font-bold tracking-tight text-text-primary md:text-3xl">
+              {localize('com_ui_projects')}
+            </h1>
+          </div>
+          <div className="flex items-center gap-2">
+            <span className="hidden text-sm text-text-secondary sm:inline">
+              {localize('com_ui_sort_by')}
+            </span>
+            <DropdownPopup
+              portal={true}
+              focusLoop={true}
+              unmountOnHide={true}
+              menuId={sortMenuId}
+              isOpen={isSortMenuOpen}
+              setIsOpen={setIsSortMenuOpen}
+              className="z-[125] min-w-56"
+              trigger={
+                <Ariakit.MenuButton
+                  aria-label={localize('com_ui_sort_projects_by')}
+                  className={cn(
+                    'inline-flex h-10 items-center justify-between gap-2 whitespace-nowrap rounded-lg border border-border-medium bg-surface-secondary px-3 text-sm font-medium text-text-primary transition-colors hover:bg-surface-tertiary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring-primary disabled:pointer-events-none disabled:opacity-50 sm:w-44',
+                    isSortMenuOpen && 'bg-surface-hover text-text-primary',
+                  )}
+                >
+                  <span className="flex min-w-0 items-center gap-2">
+                    <ArrowUpDown
+                      className="h-4 w-4 shrink-0 text-text-secondary"
+                      aria-hidden="true"
+                    />
+                    <span className="truncate">{selectedSortLabel}</span>
+                  </span>
+                </Ariakit.MenuButton>
+              }
+              items={sortMenuItems}
+            />
+            <Button type="button" variant="submit" size="sm" onClick={() => setIsCreating(true)}>
+              <Plus className="h-4 w-4" aria-hidden="true" />
+              {localize('com_ui_new_project')}
+            </Button>
+          </div>
+        </div>
+
+        <div className="flex flex-col gap-5">
+          <label className="relative min-w-0 flex-1">
+            <span className="sr-only">{localize('com_ui_search_projects')}</span>
+            <Search
+              className="pointer-events-none absolute left-3 top-1/2 h-4 w-4 -translate-y-1/2 text-text-secondary"
+              aria-hidden="true"
+            />
+            <Input
+              value={search}
+              onChange={(event) => setSearch(event.target.value)}
+              placeholder={localize('com_ui_search_projects')}
+              className="border-border-medium bg-surface-secondary pl-9 text-text-primary placeholder:text-text-secondary focus-visible:ring-2 focus-visible:ring-ring-primary"
+            />
+          </label>
+          <div className="flex items-center">
+            <span className="rounded-full bg-surface-active-alt px-4 py-2 text-sm font-medium text-text-primary">
+              {localize('com_ui_your_projects')}
+            </span>
+          </div>
+        </div>
+
+        <ProjectCreateDialog
+          open={isCreating}
+          onOpenChange={handleCreateDialogChange}
+          onCreated={(project) => navigate(`/projects/${project._id}`)}
+        />
+
+        {isLoading ? (
+          <div className="flex flex-1 items-center justify-center">
+            <Spinner className="text-text-primary" />
+          </div>
+        ) : (
+          <div className="grid gap-3 md:grid-cols-2 md:gap-4">
+            {projects.map((project) => {
+              const activity = formatActivity(project);
+              return (
+                <button
+                  key={project._id}
+                  type="button"
+                  className={cn(
+                    'group/project flex min-h-[8.5rem] flex-col rounded-xl border border-border-medium bg-surface-secondary p-4 text-left transition-colors',
+                    'hover:border-border-heavy hover:bg-surface-tertiary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring-primary',
+                  )}
+                  onClick={() => navigate(`/projects/${project._id}`)}
+                >
+                  <span className="flex min-w-0 items-center gap-2">
+                    <Folder className="h-4 w-4 shrink-0 text-text-secondary" aria-hidden="true" />
+                    <span className="truncate text-base font-semibold text-text-primary">
+                      {project.name}
+                    </span>
+                  </span>
+                  {project.description ? (
+                    <span className="mt-2 line-clamp-2 text-sm leading-relaxed text-text-secondary">
+                      {project.description}
+                    </span>
+                  ) : null}
+                  <span className="mt-auto flex items-center justify-between gap-2 pt-4 text-xs text-text-secondary">
+                    <span>
+                      {project.conversationCount === 1
+                        ? localize('com_ui_project_chat_count_single')
+                        : localize('com_ui_project_chat_count', {
+                            count: project.conversationCount,
+                          })}
+                    </span>
+                    {activity ? <span className="shrink-0 truncate">{activity}</span> : null}
+                  </span>
+                </button>
+              );
+            })}
+          </div>
+        )}
+
+        {!isLoading && projects.length === 0 && (
+          <div className="rounded-lg border border-border-medium bg-transparent py-16 text-center text-sm text-text-secondary">
+            {localize('com_ui_no_projects')}
+          </div>
+        )}
+
+        {hasNextPage && (
+          <Button
+            type="button"
+            variant="outline"
+            className="mx-auto"
+            onClick={() => fetchNextPage()}
+            disabled={isFetchingNextPage}
+          >
+            {isFetchingNextPage ? localize('com_ui_loading') : localize('com_ui_load_more')}
+          </Button>
+        )}
+      </div>
+    </main>
+  );
+}
diff --git a/client/src/components/Projects/index.ts b/client/src/components/Projects/index.ts
new file mode 100644
index 00000000000..ce29a33470f
--- /dev/null
+++ b/client/src/components/Projects/index.ts
@@ -0,0 +1,2 @@
+export { default as ProjectsView } from './ProjectsView';
+export { default as ProjectWorkspace } from './ProjectWorkspace';
diff --git a/client/src/components/Prompts/buttons/AutoSendPrompt.tsx b/client/src/components/Prompts/buttons/AutoSendPrompt.tsx
index 759c33739e7..21194e248eb 100644
--- a/client/src/components/Prompts/buttons/AutoSendPrompt.tsx
+++ b/client/src/components/Prompts/buttons/AutoSendPrompt.tsx
@@ -31,6 +31,7 @@ export default function AutoSendPrompt({
         checked={autoSendPrompts}
         tabIndex={-1}
         aria-hidden="true"
+        aria-label={localize('com_nav_auto_send_prompts')}
         className="pointer-events-none"
       />
       {localize('com_nav_auto_send_prompts')}
diff --git a/client/src/components/Prompts/forms/CreatePromptForm.tsx b/client/src/components/Prompts/forms/CreatePromptForm.tsx
index 183b5a5c831..7ce4954d1fc 100644
--- a/client/src/components/Prompts/forms/CreatePromptForm.tsx
+++ b/client/src/components/Prompts/forms/CreatePromptForm.tsx
@@ -1,18 +1,18 @@
 import { useEffect } from 'react';
 import { FileText } from 'lucide-react';
 import { useNavigate } from 'react-router-dom';
-import { Button, TextareaAutosize, Input } from '@librechat/client';
 import { useForm, Controller, FormProvider } from 'react-hook-form';
+import { Button, TextareaAutosize, Input, useMediaQuery } from '@librechat/client';
 import { LocalStorageKeys, PermissionTypes, Permissions } from 'librechat-data-provider';
 import OpenSidebar from '~/components/Chat/Menus/OpenSidebar';
-import CategorySelector from '../fields/CategorySelector';
 import VariablesDropdown from '../editor/VariablesDropdown';
+import CategorySelector from '../fields/CategorySelector';
 import PromptVariables from '../display/PromptVariables';
-import Description from '../fields/Description';
 import { usePromptGroupsContext } from '~/Providers';
 import { useLocalize, useHasAccess } from '~/hooks';
-import Command from '../fields/Command';
 import { useCreatePrompt } from '~/data-provider';
+import Description from '../fields/Description';
+import Command from '../fields/Command';
 import { cn } from '~/utils';
 
 type CreateFormValues = {
@@ -42,6 +42,7 @@ const CreatePromptForm = ({
 }) => {
   const localize = useLocalize();
   const navigate = useNavigate();
+  const isSmallScreen = useMediaQuery('(max-width: 768px)');
   const { hasAccess: hasUseAccess } = usePromptGroupsContext() ?? {};
   const hasCreateAccess = useHasAccess({
     permissionType: PermissionTypes.PROMPTS,
@@ -114,10 +115,12 @@ const CreatePromptForm = ({
     <FormProvider {...methods}>
       <form onSubmit={handleSubmit(onSubmit)} className="w-full px-4 py-2">
         <h1 className="sr-only">{localize('com_ui_create_prompt_page')}</h1>
-        <div className="mb-2 flex items-center justify-between gap-2 sm:hidden">
-          <OpenSidebar />
-          <CategorySelector />
-        </div>
+        {isSmallScreen ? (
+          <div className="mb-2 flex items-center justify-between gap-2">
+            <OpenSidebar />
+            <CategorySelector />
+          </div>
+        ) : null}
         <div className="mb-1 flex flex-col items-center justify-between font-bold sm:text-xl md:mb-0 md:text-2xl">
           <div className="flex w-full flex-col items-center justify-between sm:flex-row">
             <Controller
@@ -153,9 +156,11 @@ const CreatePromptForm = ({
                 </div>
               )}
             />
-            <div className="hidden sm:block">
-              <CategorySelector />
-            </div>
+            {!isSmallScreen && (
+              <div>
+                <CategorySelector />
+              </div>
+            )}
           </div>
         </div>
         <div className="flex w-full flex-col gap-4 md:mt-[1.075rem]">
diff --git a/client/src/components/Prompts/forms/PromptForm.tsx b/client/src/components/Prompts/forms/PromptForm.tsx
index 9407db43336..722498564c2 100644
--- a/client/src/components/Prompts/forms/PromptForm.tsx
+++ b/client/src/components/Prompts/forms/PromptForm.tsx
@@ -1,10 +1,10 @@
 import React, { useEffect, useState, useMemo, useCallback, useRef } from 'react';
 import debounce from 'lodash/debounce';
 import { useRecoilValue } from 'recoil';
-import { Menu, Rocket, X } from 'lucide-react';
 import { useParams } from 'react-router-dom';
+import { Menu, Rocket, X } from 'lucide-react';
 import { useForm, FormProvider } from 'react-hook-form';
-import { Button, Skeleton, useToastContext } from '@librechat/client';
+import { Button, Skeleton, useToastContext, useMediaQuery } from '@librechat/client';
 import {
   Permissions,
   ResourceType,
@@ -30,8 +30,8 @@ import DeletePrompt from '../dialogs/DeletePrompt';
 import NoPromptGroup from '../lists/NoPromptGroup';
 import PromptEditor from '../editor/PromptEditor';
 import SkeletonForm from '../utils/SkeletonForm';
-import Description from '../fields/Description';
 import SharePrompt from '../dialogs/SharePrompt';
+import Description from '../fields/Description';
 import PromptName from '../fields/PromptName';
 import { cn, findPromptGroup } from '~/utils';
 import { PromptsEditorMode } from '~/common';
@@ -187,6 +187,7 @@ const PromptForm = ({ promptId: promptIdProp }: { promptId?: string }) => {
   const promptId = promptIdProp || params.promptId || '';
 
   const editorMode = useRecoilValue(store.promptsEditorMode);
+  const isSmallScreen = useMediaQuery('(max-width: 768px)');
   const [selectionIndex, setSelectionIndex] = useState<number>(0);
 
   const prevIsEditingRef = useRef(false);
@@ -437,7 +438,16 @@ const PromptForm = ({ promptId: promptIdProp }: { promptId?: string }) => {
     }
 
     if (fetchedPrompt || group) {
-      return <PromptDetails group={fetchedPrompt || group} showActions={false} />;
+      return (
+        <div className="flex h-full w-full flex-col">
+          {isSmallScreen && (
+            <div className="flex shrink-0 items-center px-4 pt-3">
+              <OpenSidebar />
+            </div>
+          )}
+          <PromptDetails group={fetchedPrompt || group} showActions={false} />
+        </div>
+      );
     }
   }
 
@@ -462,8 +472,8 @@ const PromptForm = ({ promptId: promptIdProp }: { promptId?: string }) => {
             <div className="flex h-full">
               <div className="flex-1 overflow-hidden px-4">
                 {/* Mobile Actions Row */}
-                {!isLoadingGroup && group && (
-                  <div className="mb-3 mt-2 flex items-center justify-between gap-2 sm:hidden">
+                {!isLoadingGroup && group && isSmallScreen && (
+                  <div className="mb-3 mt-2 flex items-center justify-between gap-2">
                     <OpenSidebar />
                     <HeaderActions
                       group={group}
@@ -510,15 +520,17 @@ const PromptForm = ({ promptId: promptIdProp }: { promptId?: string }) => {
                           </Button>
                         )}
                       </div>
-                      <div className="hidden shrink-0 sm:block">
-                        <HeaderActions
-                          group={group}
-                          canEdit={canEdit}
-                          canDelete={canDelete}
-                          selectedPromptId={selectedPromptId}
-                          onCategoryChange={handleCategoryChange}
-                        />
-                      </div>
+                      {!isSmallScreen && (
+                        <div className="shrink-0">
+                          <HeaderActions
+                            group={group}
+                            canEdit={canEdit}
+                            canDelete={canDelete}
+                            selectedPromptId={selectedPromptId}
+                            onCategoryChange={handleCategoryChange}
+                          />
+                        </div>
+                      )}
                     </>
                   )}
                 </div>
diff --git a/client/src/components/QueryDevtoolsGate.tsx b/client/src/components/QueryDevtoolsGate.tsx
new file mode 100644
index 00000000000..ad794aca6f0
--- /dev/null
+++ b/client/src/components/QueryDevtoolsGate.tsx
@@ -0,0 +1,33 @@
+import { lazy, Suspense } from 'react';
+
+interface QueryDevtoolsConfig {
+  enableQueryDevtools?: boolean;
+}
+
+interface QueryDevtoolsGateProps {
+  config?: QueryDevtoolsConfig;
+  isDevelopment?: boolean;
+}
+
+const LazyReactQueryDevtools = lazy(() =>
+  import('@tanstack/react-query-devtools/production').then(({ ReactQueryDevtools }) => ({
+    default: ReactQueryDevtools,
+  })),
+);
+
+export const shouldEnableQueryDevtools = ({
+  isDevelopment = import.meta.env.DEV,
+  config = typeof window === 'undefined' ? undefined : window.__LIBRECHAT_CONFIG__,
+}: QueryDevtoolsGateProps = {}) => isDevelopment || config?.enableQueryDevtools === true;
+
+export default function QueryDevtoolsGate({ isDevelopment, config }: QueryDevtoolsGateProps = {}) {
+  if (!shouldEnableQueryDevtools({ isDevelopment, config })) {
+    return null;
+  }
+
+  return (
+    <Suspense fallback={null}>
+      <LazyReactQueryDevtools initialIsOpen={false} position="top-right" />
+    </Suspense>
+  );
+}
diff --git a/client/src/components/Share/Message.tsx b/client/src/components/Share/Message.tsx
index 8e2c7796e32..3492054698a 100644
--- a/client/src/components/Share/Message.tsx
+++ b/client/src/components/Share/Message.tsx
@@ -2,17 +2,16 @@ import { useAtomValue } from 'jotai';
 import type { TMessageProps } from '~/common';
 import MinimalHoverButtons from '~/components/Chat/Messages/MinimalHoverButtons';
 import MessageContent from '~/components/Chat/Messages/Content/MessageContent';
+import MessageTimestamp from '~/components/Chat/Messages/ui/MessageTimestamp';
 import SearchContent from '~/components/Chat/Messages/Content/SearchContent';
 import SiblingSwitch from '~/components/Chat/Messages/SiblingSwitch';
 import SubRow from '~/components/Chat/Messages/SubRow';
 import { fontSizeAtom } from '~/store/fontSize';
 import { MessageContext } from '~/Providers';
-import { useAttachments } from '~/hooks';
-
 import MultiMessage from './MultiMessage';
-import { cn } from '~/utils';
-
+import { useAttachments } from '~/hooks';
 import Icon from './MessageIcon';
+import { cn } from '~/utils';
 export default function Message(props: TMessageProps) {
   const fontSize = useAtomValue(fontSizeAtom);
   const {
@@ -67,7 +66,10 @@ export default function Message(props: TMessageProps) {
             <div
               className={cn('relative flex w-11/12 flex-col', isCreatedByUser ? '' : 'agent-turn')}
             >
-              <div className={cn('select-none font-semibold', fontSize)}>{messageLabel}</div>
+              <div className={cn('select-none font-semibold', fontSize)}>
+                {messageLabel}
+                <MessageTimestamp value={message.createdAt ?? message.clientTimestamp} />
+              </div>
               <div className="flex-col gap-1 md:gap-3">
                 <div className="flex min-h-[20px] max-w-full flex-grow flex-col gap-0">
                   <MessageContext.Provider
@@ -90,7 +92,7 @@ export default function Message(props: TMessageProps) {
                         edit={false}
                         error={error}
                         isLast={false}
-                        ask={() => ({})}
+                        ask={() => {}}
                         text={text || ''}
                         message={message}
                         isSubmitting={false}
diff --git a/client/src/components/Share/MessagesView.tsx b/client/src/components/Share/MessagesView.tsx
index 0b2e7b1c2d2..0f10b8a95b7 100644
--- a/client/src/components/Share/MessagesView.tsx
+++ b/client/src/components/Share/MessagesView.tsx
@@ -13,7 +13,7 @@ export default function MessagesView({
   const localize = useLocalize();
   const [currentEditId, setCurrentEditId] = useState<number | string | null>(-1);
   return (
-    <div className="min-h-0 flex-1 overflow-hidden">
+    <div className="min-h-0 flex-1 overflow-hidden" data-testid="messages-view">
       <div className="dark:gpt-dark-gray relative h-full">
         <div
           style={{
diff --git a/client/src/components/Share/ShareMessagesProvider.tsx b/client/src/components/Share/ShareMessagesProvider.tsx
index 496b21940e2..cfaeff338c0 100644
--- a/client/src/components/Share/ShareMessagesProvider.tsx
+++ b/client/src/components/Share/ShareMessagesProvider.tsx
@@ -1,7 +1,7 @@
 import React, { useMemo } from 'react';
 import type { TMessage } from 'librechat-data-provider';
-import { MessagesViewContext } from '~/Providers/MessagesViewContext';
 import type { MessagesViewContextValue } from '~/Providers/MessagesViewContext';
+import { MessagesViewContext } from '~/Providers/MessagesViewContext';
 
 interface ShareMessagesProviderProps {
   messages: TMessage[];
@@ -22,7 +22,7 @@ export function ShareMessagesProvider({ messages, children }: ShareMessagesProvi
       conversation: null,
       conversationId: undefined,
       // These are required by the context but not used in share view
-      ask: () => Promise.resolve(),
+      ask: () => {},
       regenerate: () => {},
       handleContinue: () => {},
       latestMessageId: messages[messages.length - 1]?.messageId,
diff --git a/client/src/components/Share/ShareView.tsx b/client/src/components/Share/ShareView.tsx
index 6424546a232..a9341f5d5ea 100644
--- a/client/src/components/Share/ShareView.tsx
+++ b/client/src/components/Share/ShareView.tsx
@@ -17,11 +17,11 @@ import {
   OGDialogTrigger,
 } from '@librechat/client';
 import { ThemeSelector, LangSelector } from '~/components/Nav/SettingsTabs/General/General';
+import { ShareMessagesProvider } from './ShareMessagesProvider';
 import { ShareArtifactsContainer } from './ShareArtifacts';
 import { useLocalize, useDocumentTitle } from '~/hooks';
 import { useGetStartupConfig } from '~/data-provider';
 import { ShareContext } from '~/Providers';
-import { ShareMessagesProvider } from './ShareMessagesProvider';
 import MessagesView from './MessagesView';
 import Footer from '../Chat/Footer';
 import { cn } from '~/utils';
@@ -80,10 +80,6 @@ function SharedView() {
             : null) ?? 'en-US';
       }
 
-      requestAnimationFrame(() => {
-        document.documentElement.lang = userLang;
-      });
-
       setLangcode(userLang);
       Cookies.set('lang', userLang, { expires: 365 });
     },
diff --git a/client/src/components/Sharing/AccessRolesPicker.tsx b/client/src/components/Sharing/AccessRolesPicker.tsx
index 1e77bccac3f..c94f419d636 100644
--- a/client/src/components/Sharing/AccessRolesPicker.tsx
+++ b/client/src/components/Sharing/AccessRolesPicker.tsx
@@ -6,7 +6,7 @@ import { AccessRoleIds, ResourceType } from 'librechat-data-provider';
 import { useGetAccessRolesQuery } from 'librechat-data-provider/react-query';
 import type { AccessRole } from 'librechat-data-provider';
 import type * as t from '~/common';
-import { cn, getRoleLocalizationKeys } from '~/utils';
+import { cn, getRoleLocalizationKeys, RESOURCE_CONFIGS } from '~/utils';
 import { useLocalize } from '~/hooks';
 
 interface AccessRolesPickerProps {
@@ -37,6 +37,12 @@ export default function AccessRolesPicker({
     };
   };
 
+  const ownerRoleId = RESOURCE_CONFIGS[resourceType]?.defaultOwnerRoleId;
+  const filteredRoles =
+    resourceType === ResourceType.SHARED_LINK
+      ? (accessRoles || []).filter((role) => role.accessRoleId !== ownerRoleId)
+      : accessRoles || [];
+
   const selectedRole = accessRoles?.find((role) => role.accessRoleId === selectedRoleId);
   const selectedRoleInfo = selectedRole ? getLocalizedRoleInfo(selectedRole.accessRoleId) : null;
 
@@ -44,7 +50,7 @@ export default function AccessRolesPicker({
     return <Skeleton className="h-10 w-24 rounded-lg" />;
   }
 
-  const dropdownItems: t.MenuItemProps[] = accessRoles.map((role: AccessRole) => {
+  const dropdownItems: t.MenuItemProps[] = filteredRoles.map((role: AccessRole) => {
     const localizedInfo = getLocalizedRoleInfo(role.accessRoleId);
     return {
       id: role.accessRoleId,
diff --git a/client/src/components/Sharing/GenericGrantAccessDialog.tsx b/client/src/components/Sharing/GenericGrantAccessDialog.tsx
index ce7fdbdc143..24e9d1ae9ba 100644
--- a/client/src/components/Sharing/GenericGrantAccessDialog.tsx
+++ b/client/src/components/Sharing/GenericGrantAccessDialog.tsx
@@ -180,14 +180,18 @@ export default function GenericGrantAccessDialog({
         return !allSharesMap.has(key);
       });
 
+      const publicChanged = isPublic !== currentIsPublic;
+      const publicRoleChanged = isPublic && publicRole !== currentPublicRole;
+      const sendPublicUpdate = publicChanged || publicRoleChanged;
+
       await updatePermissionsMutation.mutateAsync({
         resourceType,
         resourceId: resourceDbId,
         data: {
           updated,
           removed,
-          public: isPublic,
-          publicAccessRoleId: isPublic ? publicRole : undefined,
+          ...(sendPublicUpdate ? { public: isPublic } : {}),
+          ...(sendPublicUpdate && isPublic ? { publicAccessRoleId: publicRole } : {}),
         },
       });
 
diff --git a/client/src/components/Sharing/PeoplePicker/SelectedPrincipalsList.tsx b/client/src/components/Sharing/PeoplePicker/SelectedPrincipalsList.tsx
index b74b2126696..05ee3704a5c 100644
--- a/client/src/components/Sharing/PeoplePicker/SelectedPrincipalsList.tsx
+++ b/client/src/components/Sharing/PeoplePicker/SelectedPrincipalsList.tsx
@@ -5,6 +5,7 @@ import { ResourceType } from 'librechat-data-provider';
 import type { TPrincipal, AccessRoleIds } from 'librechat-data-provider';
 import AccessRolesPicker from '~/components/Sharing/AccessRolesPicker';
 import PrincipalAvatar from '~/components/Sharing/PrincipalAvatar';
+import { RESOURCE_CONFIGS } from '~/utils/resources';
 import { useLocalize } from '~/hooks';
 
 interface SelectedPrincipalsListProps {
@@ -50,6 +51,10 @@ export default function SelectedPrincipalsList({
       <div className="space-y-2">
         {principles.map((share) => {
           const { displayName, subtitle } = getPrincipalDisplayInfo(share);
+          const ownerRoleId = RESOURCE_CONFIGS[resourceType]?.defaultOwnerRoleId;
+          const isOwner = share.accessRoleId === ownerRoleId;
+          const isSharedLink = resourceType === ResourceType.SHARED_LINK;
+          const lockOwner = isSharedLink && isOwner;
           return (
             <div
               key={share.idOnTheSource + '-principalList'}
@@ -73,24 +78,33 @@ export default function SelectedPrincipalsList({
               </div>
 
               <div className="flex flex-shrink-0 items-center gap-2">
-                {!!share.accessRoleId && !!onRoleChange && (
-                  <AccessRolesPicker
-                    resourceType={resourceType}
-                    selectedRoleId={share.accessRoleId}
-                    onRoleChange={(newRole) => {
-                      onRoleChange?.(share.idOnTheSource!, newRole);
-                    }}
-                    className="min-w-0"
-                  />
+                {lockOwner ? (
+                  <span className="px-3 py-2 text-sm font-medium text-text-secondary">
+                    {localize('com_ui_role_owner')}
+                  </span>
+                ) : (
+                  !!share.accessRoleId &&
+                  !!onRoleChange && (
+                    <AccessRolesPicker
+                      resourceType={resourceType}
+                      selectedRoleId={share.accessRoleId}
+                      onRoleChange={(newRole) => {
+                        onRoleChange?.(share.idOnTheSource!, newRole);
+                      }}
+                      className="min-w-0"
+                    />
+                  )
+                )}
+                {!lockOwner && (
+                  <Button
+                    variant="outline"
+                    onClick={() => onRemoveHandler(share.idOnTheSource!)}
+                    className="h-9 w-9 p-0 hover:border-destructive/10 hover:bg-destructive/10 hover:text-destructive"
+                    aria-label={localize('com_ui_remove_user', { 0: displayName })}
+                  >
+                    <X className="h-4 w-4" aria-hidden="true" />
+                  </Button>
                 )}
-                <Button
-                  variant="outline"
-                  onClick={() => onRemoveHandler(share.idOnTheSource!)}
-                  className="h-9 w-9 p-0 hover:border-destructive/10 hover:bg-destructive/10 hover:text-destructive"
-                  aria-label={localize('com_ui_remove_user', { 0: displayName })}
-                >
-                  <X className="h-4 w-4" aria-hidden="true" />
-                </Button>
               </div>
             </div>
           );
diff --git a/client/src/components/Sharing/PeoplePickerAdminSettings.tsx b/client/src/components/Sharing/PeoplePickerAdminSettings.tsx
index 5f334f3764d..ab3f9f5517c 100644
--- a/client/src/components/Sharing/PeoplePickerAdminSettings.tsx
+++ b/client/src/components/Sharing/PeoplePickerAdminSettings.tsx
@@ -140,7 +140,7 @@ const PeoplePickerAdminSettings = () => {
       <OGDialogTrigger asChild>
         <Button
           variant={'outline'}
-          className="btn btn-neutral border-token-border-light relative gap-1 rounded-lg font-medium"
+          className="btn btn-neutral border-token-border-light gap-1 rounded-lg font-medium"
           aria-label={localize('com_ui_admin_settings')}
         >
           <ShieldEllipsis className="cursor-pointer" aria-hidden="true" />
diff --git a/client/src/components/Sharing/PublicSharingToggle.tsx b/client/src/components/Sharing/PublicSharingToggle.tsx
index 87896cf8fd2..e93df4bf67d 100644
--- a/client/src/components/Sharing/PublicSharingToggle.tsx
+++ b/client/src/components/Sharing/PublicSharingToggle.tsx
@@ -18,13 +18,14 @@ interface PublicSharingToggleProps {
 
 const accessDescriptions: Record<
   ResourceType,
-  'com_ui_agent' | 'com_ui_prompt' | 'com_ui_mcp_server' | 'com_ui_skill'
+  'com_ui_agent' | 'com_ui_prompt' | 'com_ui_mcp_server' | 'com_ui_skill' | 'com_ui_shared_link'
 > = {
   [ResourceType.AGENT]: 'com_ui_agent',
   [ResourceType.PROMPTGROUP]: 'com_ui_prompt',
   [ResourceType.MCPSERVER]: 'com_ui_mcp_server',
   [ResourceType.REMOTE_AGENT]: 'com_ui_agent',
   [ResourceType.SKILL]: 'com_ui_skill',
+  [ResourceType.SHARED_LINK]: 'com_ui_shared_link',
 };
 
 export default function PublicSharingToggle({
diff --git a/client/src/components/SidePanel/Agents/AgentConfig.tsx b/client/src/components/SidePanel/Agents/AgentConfig.tsx
index 2ee88a59c83..bb8db1a7701 100644
--- a/client/src/components/SidePanel/Agents/AgentConfig.tsx
+++ b/client/src/components/SidePanel/Agents/AgentConfig.tsx
@@ -1,11 +1,14 @@
 import React, { useState, useMemo, useCallback } from 'react';
 import { X } from 'lucide-react';
+import { useQueries } from '@tanstack/react-query';
 import { Switch, useToastContext } from '@librechat/client';
 import { Controller, useWatch, useFormContext } from 'react-hook-form';
 import {
   EModelEndpoint,
   PermissionTypes,
   Permissions,
+  QueryKeys,
+  dataService,
   getEndpointField,
 } from 'librechat-data-provider';
 import type { AgentForm, IconComponentTypes } from '~/common';
@@ -18,14 +21,14 @@ import {
   cn,
 } from '~/utils';
 import { ToolSelectDialog, MCPToolSelectDialog } from '~/components/Tools';
-import { SkillSelectDialog } from '~/components/Skills/dialogs';
 import useAgentCapabilities from '~/hooks/Agents/useAgentCapabilities';
+import { useListSkillsQuery, useGetAgentFiles } from '~/data-provider';
 import { useFileMapContext, useAgentPanelContext } from '~/Providers';
+import { useLocalize, useVisibleTools, useHasAccess } from '~/hooks';
+import { SkillSelectDialog } from '~/components/Skills/dialogs';
 import AgentCategorySelector from './AgentCategorySelector';
 import Action from '~/components/SidePanel/Builder/Action';
-import { useLocalize, useVisibleTools, useHasAccess } from '~/hooks';
 import { Panel, isEphemeralAgent } from '~/common';
-import { useListSkillsQuery, useGetAgentFiles } from '~/data-provider';
 import { icons } from '~/hooks/Endpoint/Icons';
 import Instructions from './Instructions';
 import AgentAvatar from './AgentAvatar';
@@ -37,6 +40,14 @@ import AgentTool from './AgentTool';
 import CodeForm from './Code/Form';
 import MCPTools from './MCPTools';
 
+/** A skill lookup only counts as a confirmed miss on 404/403 — deleted or no
+ *  longer shared. Transient/network/server errors must not present a valid
+ *  configured skill as removable. */
+const isConfirmedSkillMiss = (error: unknown): boolean => {
+  const status = (error as { response?: { status?: number } } | null)?.response?.status;
+  return status === 404 || status === 403;
+};
+
 const labelClass = 'mb-2 text-token-text-primary block text-sm font-medium';
 const inputClass = cn(
   defaultTextProps,
@@ -111,6 +122,36 @@ export default function AgentConfig() {
     return map;
   }, [skillsData?.skills]);
 
+  /** Allowlist ids missing from the first catalog page (`limit: 100`) are
+   *  resolved individually — a cache miss alone must never present a valid
+   *  configured skill as unavailable and invite its removal. */
+  const unresolvedSkillIds = useMemo(
+    () => (skillsData === undefined ? [] : (skills ?? []).filter((id) => !skillsMap.has(id))),
+    [skills, skillsMap, skillsData],
+  );
+  const unresolvedSkillQueries = useQueries({
+    queries: unresolvedSkillIds.map((skillId) => ({
+      queryKey: [QueryKeys.skill, skillId],
+      queryFn: () => dataService.getSkill(skillId),
+      retry: false,
+      refetchOnMount: false,
+      refetchOnReconnect: false,
+      refetchOnWindowFocus: false,
+    })),
+  });
+  const unresolvedSkills = useMemo(() => {
+    const map = new Map<string, { name?: string; missing: boolean }>();
+    unresolvedSkillIds.forEach((skillId, index) => {
+      const query = unresolvedSkillQueries[index];
+      if (query?.isError === true && isConfirmedSkillMiss(query.error)) {
+        map.set(skillId, { missing: true });
+      } else if (query?.data?.name) {
+        map.set(skillId, { name: query.data.name, missing: false });
+      }
+    });
+    return map;
+  }, [unresolvedSkillIds, unresolvedSkillQueries]);
+
   const { data: agentFiles = [] } = useGetAgentFiles(agent_id);
 
   const mergedFileMap = useMemo(() => {
@@ -380,16 +421,31 @@ export default function AgentConfig() {
             >
               <div className="mb-1">
                 {(skills ?? []).map((skillId) => {
-                  const skillName = skillsMap.get(skillId);
-                  if (!skillName) {
+                  const skillName = skillsMap.get(skillId) ?? unresolvedSkills.get(skillId)?.name;
+                  /** Hide chips while the catalog page or per-id lookup is in
+                   *  flight. Once the backend confirms a miss (deleted or no
+                   *  longer shared), the id must stay visible and removable —
+                   *  otherwise the allowlist silently scopes the agent to
+                   *  zero skills with no way to fix it in the UI. */
+                  if (!skillName && unresolvedSkills.get(skillId)?.missing !== true) {
                     return null;
                   }
+                  const isUnavailable = !skillName;
                   return (
                     <div
                       key={skillId}
                       className="mb-1 flex items-center justify-between rounded-md border border-border-light px-3 py-2 text-sm"
                     >
-                      <span className="truncate text-text-primary">{skillName}</span>
+                      <span
+                        className={
+                          isUnavailable
+                            ? 'truncate italic text-text-secondary'
+                            : 'truncate text-text-primary'
+                        }
+                        title={isUnavailable ? skillId : undefined}
+                      >
+                        {skillName ?? localize('com_ui_skill_unavailable')}
+                      </span>
                       <button
                         type="button"
                         onClick={() => {
@@ -401,7 +457,9 @@ export default function AgentConfig() {
                           );
                         }}
                         className="ml-2 flex-shrink-0 text-text-secondary transition-colors hover:text-text-primary"
-                        aria-label={localize('com_ui_remove_skill_var', { 0: skillName })}
+                        aria-label={localize('com_ui_remove_skill_var', {
+                          0: skillName ?? skillId,
+                        })}
                         disabled={skillsActive !== true}
                       >
                         <X className="h-4 w-4" aria-hidden="true" />
diff --git a/client/src/components/SidePanel/Agents/AgentPanel.test.tsx b/client/src/components/SidePanel/Agents/AgentPanel.test.tsx
index a3df6d52c46..e2899bf1e60 100644
--- a/client/src/components/SidePanel/Agents/AgentPanel.test.tsx
+++ b/client/src/components/SidePanel/Agents/AgentPanel.test.tsx
@@ -3,7 +3,6 @@
  */
 import * as React from 'react';
 import { render, waitFor, fireEvent } from '@testing-library/react';
-import { describe, it, expect, beforeEach, jest } from '@jest/globals';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import type { Agent } from 'librechat-data-provider';
 
diff --git a/client/src/components/SidePanel/Agents/ImageVision.tsx b/client/src/components/SidePanel/Agents/ImageVision.tsx
index bc4e1178966..7ac1be83f80 100644
--- a/client/src/components/SidePanel/Agents/ImageVision.tsx
+++ b/client/src/components/SidePanel/Agents/ImageVision.tsx
@@ -1,12 +1,12 @@
 import { Checkbox } from '@librechat/client';
 import { Capabilities } from 'librechat-data-provider';
 import { useFormContext, Controller } from 'react-hook-form';
-import type { AgentForm } from '~/common';
+import type { AssistantForm } from '~/common';
 import { useLocalize } from '~/hooks';
 
 export default function ImageVision() {
   const localize = useLocalize();
-  const methods = useFormContext<AgentForm>();
+  const methods = useFormContext<AssistantForm>();
   const { control, setValue, getValues } = methods;
 
   return (
@@ -21,10 +21,12 @@ export default function ImageVision() {
             onCheckedChange={field.onChange}
             className="relative float-left mr-2 inline-flex h-4 w-4 cursor-pointer"
             value={field.value?.toString()}
+            aria-labelledby="image-vision-label"
           />
         )}
       />
       <label
+        id="image-vision-label"
         className="form-check-label text-token-text-primary w-full cursor-pointer"
         htmlFor={Capabilities.image_vision}
         onClick={() =>
diff --git a/client/src/components/SidePanel/Agents/Images.tsx b/client/src/components/SidePanel/Agents/Images.tsx
index f899fdbbc8a..23ac59e2796 100644
--- a/client/src/components/SidePanel/Agents/Images.tsx
+++ b/client/src/components/SidePanel/Agents/Images.tsx
@@ -112,7 +112,6 @@ export function AvatarMenu({
         isOpen={isOpen}
         setIsOpen={setIsOpen}
         menuId="agent-avatar-menu"
-        placement="bottom"
         gutter={8}
         portal
         mountByState
diff --git a/client/src/components/SidePanel/Agents/Retrieval.tsx b/client/src/components/SidePanel/Agents/Retrieval.tsx
index c23797b4033..d4df0c3f467 100644
--- a/client/src/components/SidePanel/Agents/Retrieval.tsx
+++ b/client/src/components/SidePanel/Agents/Retrieval.tsx
@@ -9,15 +9,15 @@ import {
   HoverCardPortal,
   HoverCardTrigger,
 } from '@librechat/client';
+import type { AssistantForm } from '~/common';
 import OptionHover from '~/components/SidePanel/Parameters/OptionHover';
-import type { AgentForm } from '~/common';
 import { useLocalize } from '~/hooks';
 import { ESide } from '~/common';
 import { cn } from '~/utils/';
 
 export default function Retrieval({ retrievalModels }: { retrievalModels: Set<string> }) {
   const localize = useLocalize();
-  const methods = useFormContext<AgentForm>();
+  const methods = useFormContext<AssistantForm>();
   const { control, setValue, getValues } = methods;
   const model = useWatch({ control, name: 'model' });
 
@@ -44,11 +44,13 @@ export default function Retrieval({ retrievalModels }: { retrievalModels: Set<st
                 onCheckedChange={field.onChange}
                 className="relative float-left mr-2 inline-flex h-4 w-4 cursor-pointer"
                 value={field.value?.toString()}
+                aria-labelledby="retrieval-label"
               />
             )}
           />
           <div className="flex items-center space-x-2">
             <label
+              id="retrieval-label"
               className={cn(
                 'form-check-label text-token-text-primary w-full select-none',
                 isDisabled ? 'cursor-no-drop opacity-50' : 'cursor-pointer',
diff --git a/client/src/components/SidePanel/Agents/Version/__tests__/VersionContent.spec.tsx b/client/src/components/SidePanel/Agents/Version/__tests__/VersionContent.spec.tsx
index 3669fa75e07..6da7b04951d 100644
--- a/client/src/components/SidePanel/Agents/Version/__tests__/VersionContent.spec.tsx
+++ b/client/src/components/SidePanel/Agents/Version/__tests__/VersionContent.spec.tsx
@@ -1,7 +1,7 @@
 import '@testing-library/jest-dom/extend-expect';
 import { render, fireEvent } from '@testing-library/react';
+import type { VersionContext } from '../types';
 import VersionContent from '../VersionContent';
-import { VersionContext } from '../VersionPanel';
 
 const mockRestore = 'Restore';
 
diff --git a/client/src/components/SidePanel/Agents/Version/__tests__/VersionItem.spec.tsx b/client/src/components/SidePanel/Agents/Version/__tests__/VersionItem.spec.tsx
index 053bf0f2249..f6798fd0257 100644
--- a/client/src/components/SidePanel/Agents/Version/__tests__/VersionItem.spec.tsx
+++ b/client/src/components/SidePanel/Agents/Version/__tests__/VersionItem.spec.tsx
@@ -1,7 +1,7 @@
 import '@testing-library/jest-dom/extend-expect';
 import { fireEvent, render, screen } from '@testing-library/react';
+import type { VersionRecord } from '../types';
 import VersionItem from '../VersionItem';
-import { VersionRecord } from '../VersionPanel';
 
 jest.mock('~/hooks', () => ({
   useLocalize: jest.fn().mockImplementation(() => (key, params) => {
diff --git a/client/src/components/SidePanel/Agents/Version/__tests__/isActiveVersion.spec.ts b/client/src/components/SidePanel/Agents/Version/__tests__/isActiveVersion.spec.ts
index d6ef786d9c9..cf42c947128 100644
--- a/client/src/components/SidePanel/Agents/Version/__tests__/isActiveVersion.spec.ts
+++ b/client/src/components/SidePanel/Agents/Version/__tests__/isActiveVersion.spec.ts
@@ -1,5 +1,5 @@
+import type { AgentState, VersionRecord } from '../types';
 import { isActiveVersion } from '../isActiveVersion';
-import type { AgentState, VersionRecord } from '../VersionPanel';
 
 describe('isActiveVersion', () => {
   const createVersion = (overrides = {}): VersionRecord => ({
diff --git a/client/src/components/SidePanel/Agents/__tests__/AgentAvatar.spec.tsx b/client/src/components/SidePanel/Agents/__tests__/AgentAvatar.spec.tsx
index c12caf42d42..0bee0e00bc4 100644
--- a/client/src/components/SidePanel/Agents/__tests__/AgentAvatar.spec.tsx
+++ b/client/src/components/SidePanel/Agents/__tests__/AgentAvatar.spec.tsx
@@ -2,7 +2,6 @@
  * @jest-environment jsdom
  */
 /* eslint-disable i18next/no-literal-string */
-import { describe, it, expect } from '@jest/globals';
 import { render, fireEvent } from '@testing-library/react';
 import { FormProvider, useForm, type UseFormReturn } from 'react-hook-form';
 import type { AgentForm } from '~/common';
@@ -41,7 +40,15 @@ const defaultFormValues: AgentForm = {
   description: null,
   instructions: null,
   model: 'gpt-4',
-  model_parameters: {},
+  model_parameters: {
+    temperature: 1,
+    maxContextTokens: null,
+    max_context_tokens: null,
+    max_output_tokens: null,
+    top_p: 1,
+    frequency_penalty: 0,
+    presence_penalty: 0,
+  },
   tools: [],
   provider: 'openai',
   agent_ids: [],
@@ -62,7 +69,7 @@ const defaultFormValues: AgentForm = {
 
 describe('AgentAvatar reset menu', () => {
   it('clears preview and file state when reset is triggered', () => {
-    let methodsRef: UseFormReturn<AgentForm>;
+    let methodsRef: UseFormReturn<AgentForm> | undefined;
     const Wrapper = () => {
       methodsRef = useForm<AgentForm>({
         defaultValues: {
@@ -88,6 +95,10 @@ describe('AgentAvatar reset menu', () => {
     const { getByTestId } = render(<Wrapper />);
     fireEvent.click(getByTestId('reset-avatar'));
 
+    if (!methodsRef) {
+      throw new Error('Form methods were not initialized');
+    }
+
     expect(methodsRef.getValues('avatar_preview')).toBe('');
     expect(methodsRef.getValues('avatar_file')).toBeNull();
     expect(methodsRef.getValues('avatar_action')).toBe('reset');
diff --git a/client/src/components/SidePanel/Agents/__tests__/AgentPanel.helpers.spec.ts b/client/src/components/SidePanel/Agents/__tests__/AgentPanel.helpers.spec.ts
index 988796cdc31..394fcac5d8c 100644
--- a/client/src/components/SidePanel/Agents/__tests__/AgentPanel.helpers.spec.ts
+++ b/client/src/components/SidePanel/Agents/__tests__/AgentPanel.helpers.spec.ts
@@ -1,7 +1,6 @@
 /**
  * @jest-environment jsdom
  */
-import { describe, it, expect, jest } from '@jest/globals';
 import { Constants, type Agent } from 'librechat-data-provider';
 import type { FieldNamesMarkedBoolean } from 'react-hook-form';
 import type { AgentForm } from '~/common';
@@ -18,7 +17,15 @@ const createForm = (): AgentForm => ({
   description: null,
   instructions: null,
   model: 'gpt-4',
-  model_parameters: {},
+  model_parameters: {
+    temperature: 1,
+    maxContextTokens: null,
+    max_context_tokens: null,
+    max_output_tokens: null,
+    top_p: 1,
+    frequency_penalty: 0,
+    presence_penalty: 0,
+  },
   tools: [],
   provider: 'openai',
   agent_ids: [],
@@ -70,7 +77,7 @@ describe('persistAvatarChanges', () => {
   it('returns false for ephemeral agents', async () => {
     const uploadAvatar = jest.fn();
     const result = await persistAvatarChanges({
-      agentId: Constants.EPHEMERAL_AGENT_ID,
+      agentId: String(Constants.EPHEMERAL_AGENT_ID),
       avatarActionState: 'upload',
       avatarFile: new File(['avatar'], 'avatar.png', { type: 'image/png' }),
       uploadAvatar,
diff --git a/client/src/components/SidePanel/MCPBuilder/index.ts b/client/src/components/SidePanel/MCPBuilder/index.ts
index 375ed0db858..074f579c3f1 100644
--- a/client/src/components/SidePanel/MCPBuilder/index.ts
+++ b/client/src/components/SidePanel/MCPBuilder/index.ts
@@ -5,4 +5,3 @@ export { default as MCPServerDialog } from './MCPServerDialog';
 export { default as MCPServerCard } from './MCPServerCard';
 export { default as MCPStatusBadge, getStatusDotColor } from './MCPStatusBadge';
 export { default as MCPCardActions } from './MCPCardActions';
-export { default as MCPAuth } from './MCPAuth';
diff --git a/client/src/components/SidePanel/Memories/MemoryPanel.tsx b/client/src/components/SidePanel/Memories/MemoryPanel.tsx
index 0b9c932547f..01ec7cb5621 100644
--- a/client/src/components/SidePanel/Memories/MemoryPanel.tsx
+++ b/client/src/components/SidePanel/Memories/MemoryPanel.tsx
@@ -182,6 +182,7 @@ export default function MemoryPanel() {
                   checked={referenceSavedMemories}
                   tabIndex={-1}
                   aria-hidden="true"
+                  aria-label={localize('com_ui_use_memory')}
                   className="pointer-events-none mr-2"
                 />
                 {localize('com_ui_use_memory')}
diff --git a/client/src/components/Skills/dialogs/UploadSkillDialog.tsx b/client/src/components/Skills/dialogs/UploadSkillDialog.tsx
index 3cd1fd54089..6ae501c83bd 100644
--- a/client/src/components/Skills/dialogs/UploadSkillDialog.tsx
+++ b/client/src/components/Skills/dialogs/UploadSkillDialog.tsx
@@ -27,7 +27,9 @@ export default function UploadSkillDialog({ isOpen, setIsOpen }: UploadSkillDial
   const { showToast } = useToastContext();
   const fileInputRef = useRef<HTMLInputElement>(null);
   const [isDragging, setIsDragging] = useState(false);
-  const { data: skillFileConfig = { fileConfig: defaultFileConfig } } = useGetFileConfig({
+  const {
+    data: skillFileConfig = { configuredSizeLimitMb: undefined, fileConfig: defaultFileConfig },
+  } = useGetFileConfig({
     select: (data) => ({
       configuredSizeLimitMb: data?.skills?.fileSizeLimit,
       fileConfig: mergeFileConfig(data),
diff --git a/client/src/components/Skills/layouts/SkillsView.tsx b/client/src/components/Skills/layouts/SkillsView.tsx
index b19ba588fb0..405953eac84 100644
--- a/client/src/components/Skills/layouts/SkillsView.tsx
+++ b/client/src/components/Skills/layouts/SkillsView.tsx
@@ -1,12 +1,13 @@
-import { Navigate, useNavigate, useParams, useLocation, useSearchParams } from 'react-router-dom';
-import { Spinner } from '@librechat/client';
+import { Spinner, useMediaQuery } from '@librechat/client';
 import { PermissionTypes, Permissions } from 'librechat-data-provider';
-import { useGetSkillByIdQuery } from '~/data-provider';
-import { useHasAccess, useAuthContext, useLocalize } from '~/hooks';
+import { Navigate, useNavigate, useParams, useLocation, useSearchParams } from 'react-router-dom';
 import SkillFileViewer from '~/components/Skills/display/SkillFileViewer';
+import { CreateSkillForm, SkillForm } from '~/components/Skills/forms';
+import { useHasAccess, useAuthContext, useLocalize } from '~/hooks';
 import SkillDetail from '~/components/Skills/display/SkillDetail';
 import SkillState from '~/components/Skills/display/SkillState';
-import { CreateSkillForm, SkillForm } from '~/components/Skills/forms';
+import OpenSidebar from '~/components/Chat/Menus/OpenSidebar';
+import { useGetSkillByIdQuery } from '~/data-provider';
 
 /**
  * Skill detail / edit / create route content.
@@ -58,11 +59,14 @@ export default function SkillsView() {
   // No skill selected — empty state
   if (!skillId) {
     return (
-      <div className="flex h-full w-full flex-col items-center justify-center bg-presentation">
-        <SkillState
-          title={localize('com_ui_skill_no_selection')}
-          description={localize('com_ui_skill_no_selection_desc')}
-        />
+      <div className="flex h-full w-full flex-col bg-presentation">
+        <MobileSidebarToggle />
+        <div className="flex flex-1 flex-col items-center justify-center">
+          <SkillState
+            title={localize('com_ui_skill_no_selection')}
+            description={localize('com_ui_skill_no_selection_desc')}
+          />
+        </div>
       </div>
     );
   }
@@ -73,6 +77,7 @@ export default function SkillsView() {
 function CreateView() {
   return (
     <div className="flex h-full w-full flex-col overflow-y-auto bg-presentation">
+      <MobileSidebarToggle />
       <CreateSkillForm />
     </div>
   );
@@ -90,6 +95,7 @@ function DetailView({ skillId }: { skillId: string }) {
   if (activeFile) {
     return (
       <div className="flex h-full w-full flex-col bg-presentation">
+        <MobileSidebarToggle />
         <SkillFileViewer skillId={skillId} relativePath={activeFile} />
       </div>
     );
@@ -106,6 +112,7 @@ function DetailView({ skillId }: { skillId: string }) {
   if (skillQuery.isError || !skillQuery.data) {
     return (
       <div className="flex h-full w-full flex-col bg-presentation">
+        <MobileSidebarToggle />
         <SkillState
           variant="error"
           title={localize('com_ui_skill_not_found')}
@@ -117,6 +124,7 @@ function DetailView({ skillId }: { skillId: string }) {
 
   return (
     <div className="flex h-full w-full flex-col bg-presentation">
+      <MobileSidebarToggle />
       <SkillDetail
         skill={skillQuery.data}
         onEdit={() => navigate(`/skills/${skillId}/edit`)}
@@ -130,7 +138,21 @@ function DetailView({ skillId }: { skillId: string }) {
 function EditView({ skillId }: { skillId: string }) {
   return (
     <div className="flex h-full w-full flex-col overflow-y-auto bg-presentation">
+      <MobileSidebarToggle />
       <SkillForm skillId={skillId} />
     </div>
   );
 }
+
+/** Sidebar reopen affordance for small screens, where the drawer is the only navigation. */
+function MobileSidebarToggle() {
+  const isSmallScreen = useMediaQuery('(max-width: 768px)');
+  if (!isSmallScreen) {
+    return null;
+  }
+  return (
+    <div className="flex shrink-0 items-center px-4 pt-3">
+      <OpenSidebar />
+    </div>
+  );
+}
diff --git a/client/src/components/Skills/layouts/__tests__/SkillsView.spec.tsx b/client/src/components/Skills/layouts/__tests__/SkillsView.spec.tsx
index 8243d9544f4..c5dc2c56b97 100644
--- a/client/src/components/Skills/layouts/__tests__/SkillsView.spec.tsx
+++ b/client/src/components/Skills/layouts/__tests__/SkillsView.spec.tsx
@@ -3,7 +3,8 @@ import { render, screen } from '@testing-library/react';
 import { createMemoryRouter, RouterProvider } from 'react-router-dom';
 import SkillsView from '../SkillsView';
 
-const mockUseHasAccess = jest.fn(() => true);
+const mockUseHasAccess = jest.fn((..._args: unknown[]) => true);
+const mockUseMediaQuery = jest.fn((_query: string) => false);
 
 jest.mock(
   'librechat-data-provider',
@@ -18,10 +19,16 @@ jest.mock(
   '@librechat/client',
   () => ({
     Spinner: () => <div data-testid="spinner" />,
+    useMediaQuery: (query: string) => mockUseMediaQuery(query),
   }),
   { virtual: true },
 );
 
+jest.mock('~/components/Chat/Menus/OpenSidebar', () => ({
+  __esModule: true,
+  default: () => <div data-testid="open-sidebar" />,
+}));
+
 jest.mock('~/hooks', () => ({
   useLocalize: () => (key: string) => key,
   useHasAccess: (...args: unknown[]) => mockUseHasAccess(...args),
@@ -58,6 +65,8 @@ describe('SkillsView', () => {
   beforeEach(() => {
     mockUseHasAccess.mockReset();
     mockUseHasAccess.mockReturnValue(true);
+    mockUseMediaQuery.mockReset();
+    mockUseMediaQuery.mockReturnValue(false);
   });
 
   it('renders the create skill form for /skills/new', () => {
@@ -69,4 +78,25 @@ describe('SkillsView', () => {
 
     expect(screen.getByTestId('create-skill-form')).toBeInTheDocument();
   });
+
+  it('renders the sidebar toggle on small screens', () => {
+    mockUseMediaQuery.mockReturnValue(true);
+    const router = createMemoryRouter([{ path: '/skills', element: <SkillsView /> }], {
+      initialEntries: ['/skills'],
+    });
+
+    render(<RouterProvider router={router} />);
+
+    expect(screen.getByTestId('open-sidebar')).toBeInTheDocument();
+  });
+
+  it('does not render the sidebar toggle on large screens', () => {
+    const router = createMemoryRouter([{ path: '/skills', element: <SkillsView /> }], {
+      initialEntries: ['/skills'],
+    });
+
+    render(<RouterProvider router={router} />);
+
+    expect(screen.queryByTestId('open-sidebar')).not.toBeInTheDocument();
+  });
 });
diff --git a/client/src/components/System/LanguageSync.tsx b/client/src/components/System/LanguageSync.tsx
new file mode 100644
index 00000000000..095192a6b21
--- /dev/null
+++ b/client/src/components/System/LanguageSync.tsx
@@ -0,0 +1,35 @@
+import { useEffect } from 'react';
+import { useRecoilValue, useSetRecoilState } from 'recoil';
+import i18n, { changeLanguageSafely, normalizeLocale } from '~/locales/i18n';
+import store from '~/store';
+
+export default function LanguageSync() {
+  const lang = useRecoilValue(store.lang);
+  const setLanguageLoading = useSetRecoilState(store.languageLoading);
+
+  useEffect(() => {
+    if (i18n.language === normalizeLocale(lang)) {
+      setLanguageLoading(false);
+      return;
+    }
+
+    let isCurrentRequest = true;
+    setLanguageLoading(true);
+
+    changeLanguageSafely(lang)
+      .catch((error) => {
+        console.error('[i18n] Failed to change language', error);
+      })
+      .finally(() => {
+        if (isCurrentRequest) {
+          setLanguageLoading(false);
+        }
+      });
+
+    return () => {
+      isCurrentRequest = false;
+    };
+  }, [lang, setLanguageLoading]);
+
+  return null;
+}
diff --git a/client/src/components/UnifiedSidebar/ConversationsSection.tsx b/client/src/components/UnifiedSidebar/ConversationsSection.tsx
index 3d8183c4e23..74d4ed893c2 100644
--- a/client/src/components/UnifiedSidebar/ConversationsSection.tsx
+++ b/client/src/components/UnifiedSidebar/ConversationsSection.tsx
@@ -14,6 +14,8 @@ import {
 } from '~/hooks';
 import { useConversationsInfiniteQuery, useTitleGeneration } from '~/data-provider';
 import { Conversations } from '~/components/Conversations';
+import ProjectsSection from '~/components/Conversations/ProjectsSection';
+import FavoritesList from '~/components/Nav/Favorites/FavoritesList';
 import SearchBar from '~/components/Nav/SearchBar';
 import store from '~/store';
 
@@ -104,7 +106,7 @@ const ConversationsSection = memo(() => {
 
   return (
     <div
-      className="flex h-full min-h-0 flex-col overflow-hidden pb-3"
+      className="flex h-full min-h-0 flex-col overflow-hidden pb-3 pt-2"
       role="region"
       aria-label={localize('com_ui_chat_history')}
     >
@@ -116,6 +118,12 @@ const ConversationsSection = memo(() => {
         )}
         {search.enabled && <SearchBar isSmallScreen={isSmallScreen} />}
       </div>
+      {!search.query && (
+        <div className="px-3">
+          <FavoritesList isSmallScreen={isSmallScreen} toggleNav={toggleNav} />
+        </div>
+      )}
+      {!search.query && <ProjectsSection toggleNav={toggleNav} isAuthenticated={isAuthenticated} />}
       <div className="flex min-h-0 flex-grow flex-col overflow-hidden">
         <Conversations
           conversations={conversations}
@@ -127,6 +135,7 @@ const ConversationsSection = memo(() => {
           isSearchLoading={isSearchLoading}
           isChatsExpanded={isChatsExpanded}
           setIsChatsExpanded={setIsChatsExpanded}
+          showFavorites={false}
         />
       </div>
     </div>
diff --git a/client/src/components/Web/Citation.tsx b/client/src/components/Web/Citation.tsx
index 90a620bf7ea..d6661e62161 100644
--- a/client/src/components/Web/Citation.tsx
+++ b/client/src/components/Web/Citation.tsx
@@ -1,6 +1,7 @@
 import { memo, useState, useContext, useCallback } from 'react';
 import { Button } from '@librechat/client';
 import { ChevronLeft, ChevronRight, FileText } from 'lucide-react';
+import type { SourceData } from '~/components/Web/SourceHovercard';
 import type { CitationProps } from './types';
 import { SourceHovercard, FaviconImage, getCleanDomain } from '~/components/Web/SourceHovercard';
 import FilePreviewDialog from '~/components/Chat/Messages/Content/FilePreviewDialog';
@@ -40,6 +41,15 @@ function getFileCitationData(source?: FileCitationSource) {
   };
 }
 
+function toSourceData(source: FileCitationSource): SourceData {
+  return {
+    link: source.link ?? '',
+    title: source.title,
+    attribution: source.attribution,
+    snippet: source.snippet,
+  };
+}
+
 interface CompositeCitationProps {
   citationId?: string;
   node?: {
@@ -107,7 +117,7 @@ export function CompositeCitation(props: CompositeCitationProps) {
   return (
     <>
       <SourceHovercard
-        source={currentSource}
+        source={toSourceData(currentSource)}
         label={getCitationLabel()}
         onMouseEnter={() => setHoveredCitationId(citationId || null)}
         onMouseLeave={() => setHoveredCitationId(null)}
@@ -329,7 +339,7 @@ export function Citation(props: CitationComponentProps) {
   return (
     <>
       <SourceHovercard
-        source={refData}
+        source={toSourceData(refData)}
         label={getCitationLabel()}
         onMouseEnter={() => setHoveredCitationId(citationId || null)}
         onMouseLeave={() => setHoveredCitationId(null)}
diff --git a/client/src/components/Web/Sources.tsx b/client/src/components/Web/Sources.tsx
index 81467e4b2f1..a2681f822fe 100644
--- a/client/src/components/Web/Sources.tsx
+++ b/client/src/components/Web/Sources.tsx
@@ -18,8 +18,8 @@ import { FaviconImage, getCleanDomain } from '~/components/Web/SourceHovercard';
 import SourcesErrorBoundary from './SourcesErrorBoundary';
 import { useFileDownload } from '~/data-provider';
 import { useSearchContext } from '~/Providers';
-import { useLocalize } from '~/hooks';
 import { cn, triggerDownload } from '~/utils';
+import { useLocalize } from '~/hooks';
 import store from '~/store';
 
 interface SourceItemProps {
@@ -89,7 +89,6 @@ function SourceItem({ source, expanded = false }: SourceItemProps) {
           </Ariakit.HovercardDisclosure>
 
           <Ariakit.Hovercard
-            animated
             gutter={16}
             className={cn(
               'z-[999] w-[320px] max-w-[calc(100vw-2rem)] rounded-xl border border-border-medium bg-surface-secondary p-3 text-text-primary shadow-lg',
@@ -172,6 +171,7 @@ type AgentFileSource = {
   filename: string;
   bytes?: number;
   type?: string;
+  source?: string;
   pages?: number[];
   relevance?: number;
   pageRelevance?: Record<number, number>;
diff --git a/client/src/components/__tests__/QueryDevtoolsGate.spec.tsx b/client/src/components/__tests__/QueryDevtoolsGate.spec.tsx
new file mode 100644
index 00000000000..c952dcee063
--- /dev/null
+++ b/client/src/components/__tests__/QueryDevtoolsGate.spec.tsx
@@ -0,0 +1,29 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import QueryDevtoolsGate, { shouldEnableQueryDevtools } from '../QueryDevtoolsGate';
+
+jest.mock('@tanstack/react-query-devtools/production', () => ({
+  ReactQueryDevtools: () => <div data-testid="query-devtools" />,
+}));
+
+describe('QueryDevtoolsGate', () => {
+  it('keeps query devtools disabled in production by default', () => {
+    expect(shouldEnableQueryDevtools({ isDevelopment: false, config: undefined })).toBe(false);
+
+    const { container } = render(<QueryDevtoolsGate isDevelopment={false} config={undefined} />);
+
+    expect(container).toBeEmptyDOMElement();
+    expect(screen.queryByTestId('query-devtools')).not.toBeInTheDocument();
+  });
+
+  it('enables query devtools in local development', async () => {
+    render(<QueryDevtoolsGate isDevelopment={true} config={undefined} />);
+
+    await waitFor(() => expect(screen.getByTestId('query-devtools')).toBeInTheDocument());
+  });
+
+  it('enables query devtools in production when the server-injected flag is true', async () => {
+    render(<QueryDevtoolsGate isDevelopment={false} config={{ enableQueryDevtools: true }} />);
+
+    await waitFor(() => expect(screen.getByTestId('query-devtools')).toBeInTheDocument());
+  });
+});
diff --git a/client/src/components/index.ts b/client/src/components/index.ts
index 63103fb13d8..5ecdd1f3443 100644
--- a/client/src/components/index.ts
+++ b/client/src/components/index.ts
@@ -1,2 +1 @@
 export * from './ui';
-export * from './Plugins';
diff --git a/client/src/components/ui/index.ts b/client/src/components/ui/index.ts
index d772738bcf3..1412cf4aff3 100644
--- a/client/src/components/ui/index.ts
+++ b/client/src/components/ui/index.ts
@@ -1,3 +1,4 @@
+export { Button } from '@librechat/client';
 export { default as TermsAndConditionsModal } from './TermsAndConditionsModal';
 export { default as AdminSettingsDialog } from './AdminSettingsDialog';
 export type { PermissionConfig, AdminSettingsDialogProps } from './AdminSettingsDialog';
diff --git a/client/src/data-provider/Agents/queries.ts b/client/src/data-provider/Agents/queries.ts
index efc27cd9953..5bea90e845c 100644
--- a/client/src/data-provider/Agents/queries.ts
+++ b/client/src/data-provider/Agents/queries.ts
@@ -34,9 +34,9 @@ async function fetchAllAgentPages(params: t.AgentListParams): Promise<t.AgentLis
     object: 'list',
     data: pages.flatMap((p) => p.data),
     has_more: false,
-    after: null,
-    first_id: pages[0]?.first_id ?? null,
-    last_id: lastPage?.last_id ?? null,
+    after: undefined,
+    first_id: pages[0]?.first_id ?? '',
+    last_id: lastPage?.last_id ?? '',
   };
 }
 
diff --git a/client/src/data-provider/Auth/queries.ts b/client/src/data-provider/Auth/queries.ts
index ff34d05d0c8..f830e956008 100644
--- a/client/src/data-provider/Auth/queries.ts
+++ b/client/src/data-provider/Auth/queries.ts
@@ -1,6 +1,6 @@
 import { useRecoilValue } from 'recoil';
-import { QueryKeys, dataService } from 'librechat-data-provider';
 import { useQuery } from '@tanstack/react-query';
+import { QueryKeys, dataService } from 'librechat-data-provider';
 import type { QueryObserverResult, UseQueryOptions } from '@tanstack/react-query';
 import type t from 'librechat-data-provider';
 import store from '~/store';
@@ -32,7 +32,7 @@ export const useGraphTokenQuery = (
 
   return useQuery({
     queryKey: [QueryKeys.graphToken, scopes],
-    queryFn: () => dataService.getGraphApiToken({ scopes }),
+    queryFn: () => dataService.getGraphApiToken({ scopes: scopes ?? '' }),
     enabled,
     staleTime: 50 * 60 * 1000, // 50 minutes (tokens expire in 60 minutes)
     retry: 1,
diff --git a/client/src/data-provider/Endpoints/queries.ts b/client/src/data-provider/Endpoints/queries.ts
index 17527c6dc17..1ea8b3c0aa0 100644
--- a/client/src/data-provider/Endpoints/queries.ts
+++ b/client/src/data-provider/Endpoints/queries.ts
@@ -1,6 +1,6 @@
 import { useRecoilValue } from 'recoil';
-import { QueryKeys, dataService } from 'librechat-data-provider';
 import { useQuery } from '@tanstack/react-query';
+import { QueryKeys, dataService } from 'librechat-data-provider';
 import type { QueryObserverResult, UseQueryOptions } from '@tanstack/react-query';
 import type t from 'librechat-data-provider';
 import store from '~/store';
@@ -23,6 +23,63 @@ export const useGetEndpointsQuery = <TData = t.TEndpointsConfig>(
   );
 };
 
+export const useTokenConfigQuery = (
+  config?: UseQueryOptions<t.TTokenConfigMap>,
+): QueryObserverResult<t.TTokenConfigMap> => {
+  const queriesEnabled = useRecoilValue<boolean>(store.queriesEnabled);
+  return useQuery<t.TTokenConfigMap>([QueryKeys.tokenConfig], () => dataService.getTokenConfig(), {
+    staleTime: Infinity,
+    refetchOnWindowFocus: false,
+    refetchOnReconnect: false,
+    /** Refetch on mount only when stale — with `staleTime: Infinity` that's
+     *  exclusively after a user-key change invalidates `tokenConfig`, so a
+     *  settings change made while the gauge is unmounted is picked up on
+     *  return instead of serving the prior key's resolved config */
+    refetchOnMount: true,
+    ...config,
+    enabled: (config?.enabled ?? true) === true && queriesEnabled,
+  });
+};
+
+/**
+ * Server-side context-usage projection for the viewed branch + resolved config
+ * (agents SDK, no model call). Keyed on the fields that change what the next
+ * call would send — branch tail, endpoint/model/agent, window — so a branch or
+ * model/window switch refetches. Disabled until a branch tail is known.
+ */
+export const useContextProjectionQuery = (
+  params: t.TContextProjectionRequest | null,
+  config?: UseQueryOptions<t.TContextUsageEvent | null>,
+): QueryObserverResult<t.TContextUsageEvent | null> => {
+  const queriesEnabled = useRecoilValue<boolean>(store.queriesEnabled);
+  return useQuery<t.TContextUsageEvent | null>(
+    [
+      QueryKeys.contextProjection,
+      params?.conversationId,
+      params?.messageId,
+      params?.endpoint,
+      params?.model,
+      params?.agentId,
+      params?.maxContextTokens,
+      params?.revision,
+    ],
+    () => dataService.getContextProjection(params as t.TContextProjectionRequest),
+    {
+      staleTime: Infinity,
+      refetchOnWindowFocus: false,
+      refetchOnReconnect: false,
+      refetchOnMount: false,
+      ...config,
+      enabled:
+        (config?.enabled ?? true) === true &&
+        queriesEnabled &&
+        params != null &&
+        (params.conversationId?.length ?? 0) > 0 &&
+        (params.messageId?.length ?? 0) > 0,
+    },
+  );
+};
+
 /**
  * Auth-aware query key so unauthenticated (login page) and authenticated
  * (chat page) configs are cached independently, preventing stale
diff --git a/client/src/data-provider/Files/queries.ts b/client/src/data-provider/Files/queries.ts
index b287a1efba7..37d6690bb2d 100644
--- a/client/src/data-provider/Files/queries.ts
+++ b/client/src/data-provider/Files/queries.ts
@@ -38,10 +38,10 @@ export const useGetAgentFiles = <TData = t.TFile[]>(
   );
 };
 
-export const useGetFileConfig = <TData = t.FileConfig>(
-  config?: UseQueryOptions<t.FileConfig, unknown, TData>,
+export const useGetFileConfig = <TData = t.TFileConfig>(
+  config?: UseQueryOptions<t.TFileConfig, unknown, TData>,
 ): QueryObserverResult<TData, unknown> => {
-  return useQuery<t.FileConfig, unknown, TData>(
+  return useQuery<t.TFileConfig, unknown, TData>(
     [QueryKeys.fileConfig],
     () => dataService.getFileConfig(),
     {
diff --git a/client/src/data-provider/MCP/mutations.ts b/client/src/data-provider/MCP/mutations.ts
index 19fa2c36530..5640d30595a 100644
--- a/client/src/data-provider/MCP/mutations.ts
+++ b/client/src/data-provider/MCP/mutations.ts
@@ -1,5 +1,5 @@
-import { useMutation, useQueryClient, UseMutationResult } from '@tanstack/react-query';
 import { dataService, QueryKeys, ResourceType } from 'librechat-data-provider';
+import { useMutation, useQueryClient, UseMutationResult } from '@tanstack/react-query';
 import type * as t from 'librechat-data-provider';
 
 /**
@@ -84,9 +84,12 @@ export const useUpdateMCPServerMutation = (options?: {
         // Update list cache
         const listRes = queryClient.getQueryData<t.MCPServersListResponse>([QueryKeys.mcpServers]);
         if (listRes) {
-          // eslint-disable-next-line @typescript-eslint/no-unused-vars
-          const { type, ...oldServer } = listRes[variables.serverName!];
-          listRes[variables.serverName!] = { ...oldServer, ...updatedServer };
+          const oldServer = listRes[variables.serverName];
+          listRes[variables.serverName] = {
+            ...updatedServer,
+            dbId: updatedServer.dbId ?? oldServer?.dbId,
+            consumeOnly: updatedServer.consumeOnly ?? oldServer?.consumeOnly,
+          };
 
           queryClient.setQueryData<t.MCPServersListResponse>([QueryKeys.mcpServers], {
             ...listRes,
diff --git a/client/src/data-provider/Projects/index.ts b/client/src/data-provider/Projects/index.ts
new file mode 100644
index 00000000000..d0720956a0e
--- /dev/null
+++ b/client/src/data-provider/Projects/index.ts
@@ -0,0 +1,2 @@
+export * from './queries';
+export * from './mutations';
diff --git a/client/src/data-provider/Projects/mutations.ts b/client/src/data-provider/Projects/mutations.ts
new file mode 100644
index 00000000000..a02f177d975
--- /dev/null
+++ b/client/src/data-provider/Projects/mutations.ts
@@ -0,0 +1,123 @@
+import { useRecoilCallback } from 'recoil';
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+import { dataService, QueryKeys } from 'librechat-data-provider';
+import type { UseMutationResult } from '@tanstack/react-query';
+import type {
+  TChatProject,
+  TConversation,
+  TCreateChatProjectRequest,
+  TDeleteChatProjectResponse,
+  TUpdateChatProjectRequest,
+  TAssignConversationToProjectRequest,
+  TAssignConversationToProjectResponse,
+} from 'librechat-data-provider';
+import store from '~/store';
+
+export const useCreateProjectMutation = (): UseMutationResult<
+  TChatProject,
+  unknown,
+  TCreateChatProjectRequest,
+  unknown
+> => {
+  const queryClient = useQueryClient();
+  return useMutation((payload: TCreateChatProjectRequest) => dataService.createProject(payload), {
+    onSuccess: () => {
+      queryClient.invalidateQueries([QueryKeys.projects]);
+    },
+  });
+};
+
+export const useUpdateProjectMutation = (): UseMutationResult<
+  TChatProject,
+  unknown,
+  TUpdateChatProjectRequest,
+  unknown
+> => {
+  const queryClient = useQueryClient();
+  return useMutation((payload: TUpdateChatProjectRequest) => dataService.updateProject(payload), {
+    onSuccess: (project) => {
+      queryClient.setQueryData([QueryKeys.project, project._id], project);
+      queryClient.invalidateQueries([QueryKeys.projects]);
+    },
+  });
+};
+
+export const useDeleteProjectMutation = (): UseMutationResult<
+  TDeleteChatProjectResponse,
+  unknown,
+  string,
+  unknown
+> => {
+  const queryClient = useQueryClient();
+  const clearActiveConversationProject = useRecoilCallback(
+    ({ snapshot, set }) =>
+      async (projectId: string) => {
+        const conversation = await snapshot.getPromise(store.conversationByIndex(0));
+        if (conversation?.conversationId && conversation.chatProjectId === projectId) {
+          set(store.updateConversationSelector(conversation.conversationId), {
+            ...conversation,
+            chatProjectId: null,
+          });
+        }
+      },
+    [],
+  );
+  return useMutation((projectId: string) => dataService.deleteProject(projectId), {
+    onSuccess: (_result, projectId) => {
+      clearActiveConversationProject(projectId);
+      // Invalidate so an *active* project-detail observer refetches and settles into a
+      // not-found state — consumers (e.g. ChatRoute) can then react to the deletion.
+      // (Removing it instead leaves observers stuck loading under `refetchOnMount: false`.)
+      queryClient.invalidateQueries([QueryKeys.project, projectId]);
+      // Drop any *inactive* cached detail so a later visit to the deleted project
+      // refetches (→ not-found) rather than rendering stale cache within `cacheTime`.
+      queryClient.removeQueries([QueryKeys.project, projectId], { type: 'inactive' });
+      queryClient.invalidateQueries([QueryKeys.projects]);
+      queryClient.invalidateQueries([QueryKeys.allConversations]);
+    },
+  });
+};
+
+export const useAssignConversationToProjectMutation = (): UseMutationResult<
+  TAssignConversationToProjectResponse,
+  unknown,
+  TAssignConversationToProjectRequest,
+  unknown
+> => {
+  const queryClient = useQueryClient();
+  const updateActiveConversation = useRecoilCallback(
+    ({ set }) =>
+      (conversation: TConversation) => {
+        if (!conversation.conversationId) {
+          return;
+        }
+        set(store.updateConversationSelector(conversation.conversationId), {
+          ...conversation,
+          chatProjectId: conversation.chatProjectId ?? null,
+        });
+      },
+    [],
+  );
+
+  return useMutation(
+    (payload: TAssignConversationToProjectRequest) =>
+      dataService.assignConversationToProject(payload),
+    {
+      onSuccess: (result) => {
+        updateActiveConversation(result.conversation);
+        queryClient.setQueryData(
+          [QueryKeys.conversation, result.conversation.conversationId],
+          result.conversation,
+        );
+        [result.previousProjectId, result.projectId].forEach((projectId) => {
+          if (projectId) {
+            queryClient.invalidateQueries([QueryKeys.project, projectId]);
+          }
+        });
+        queryClient.invalidateQueries([QueryKeys.projects]);
+        queryClient.invalidateQueries([QueryKeys.allConversations]);
+        queryClient.invalidateQueries([QueryKeys.projectConversations]);
+      },
+    },
+  );
+};
diff --git a/client/src/data-provider/Projects/queries.ts b/client/src/data-provider/Projects/queries.ts
new file mode 100644
index 00000000000..6a8a4ccefde
--- /dev/null
+++ b/client/src/data-provider/Projects/queries.ts
@@ -0,0 +1,49 @@
+import { useInfiniteQuery, useQuery } from '@tanstack/react-query';
+import { dataService, QueryKeys } from 'librechat-data-provider';
+import type {
+  UseInfiniteQueryOptions,
+  QueryObserverResult,
+  UseQueryOptions,
+} from '@tanstack/react-query';
+import type { ProjectListParams, ProjectListResponse, TChatProject } from 'librechat-data-provider';
+
+export const useProjectsInfiniteQuery = (
+  params: ProjectListParams = {},
+  config?: UseInfiniteQueryOptions<ProjectListResponse, unknown>,
+) => {
+  const { sortBy, sortDirection, search, limit } = params;
+
+  return useInfiniteQuery<ProjectListResponse>({
+    queryKey: [QueryKeys.projects, { sortBy, sortDirection, search, limit }],
+    queryFn: ({ pageParam }) =>
+      dataService.listProjects({
+        sortBy,
+        sortDirection,
+        search,
+        limit,
+        cursor: pageParam?.toString(),
+      }),
+    getNextPageParam: (lastPage) => lastPage?.nextCursor ?? undefined,
+    keepPreviousData: true,
+    staleTime: 5 * 60 * 1000,
+    cacheTime: 30 * 60 * 1000,
+    ...config,
+  });
+};
+
+export const useProjectQuery = (
+  projectId?: string | null,
+  config?: UseQueryOptions<TChatProject>,
+): QueryObserverResult<TChatProject, unknown> => {
+  return useQuery<TChatProject>(
+    [QueryKeys.project, projectId],
+    () => dataService.getProjectById(projectId ?? ''),
+    {
+      enabled: Boolean(projectId),
+      refetchOnWindowFocus: false,
+      refetchOnReconnect: false,
+      refetchOnMount: false,
+      ...config,
+    },
+  );
+};
diff --git a/client/src/data-provider/index.ts b/client/src/data-provider/index.ts
index 4a16792080e..e4be6aee0bc 100644
--- a/client/src/data-provider/index.ts
+++ b/client/src/data-provider/index.ts
@@ -7,6 +7,7 @@ export * from './Files';
 export * from './Memories';
 export * from './Messages';
 export * from './Misc';
+export * from './Projects';
 export * from './Tools';
 export * from './connection';
 export * from './Favorites';
diff --git a/client/src/data-provider/mutations.ts b/client/src/data-provider/mutations.ts
index 6edb8f35524..dea58514312 100644
--- a/client/src/data-provider/mutations.ts
+++ b/client/src/data-provider/mutations.ts
@@ -11,6 +11,7 @@ import {
   logger,
   /* Conversations */
   addConvoToAllQueries,
+  findConversationInInfinite,
   updateConvoInAllQueries,
   removeConvoFromAllQueries,
 } from '~/utils';
@@ -34,6 +35,7 @@ export const useUpdateConversationMutation = (
         const targetId = payload.conversationId || id;
         queryClient.setQueryData([QueryKeys.conversation, targetId], updatedConvo);
         updateConvoInAllQueries(queryClient, targetId, () => updatedConvo);
+        queryClient.invalidateQueries([QueryKeys.projectConversations]);
       },
     },
   );
@@ -123,6 +125,9 @@ export const useArchiveConvoMutation = (
           [QueryKeys.conversation, vars.conversationId],
           isArchived ? null : _data,
         );
+        if (_data.chatProjectId) {
+          queryClient.invalidateQueries([QueryKeys.project, _data.chatProjectId]);
+        }
 
         onSuccess?.(_data, vars, context);
       },
@@ -136,6 +141,8 @@ export const useArchiveConvoMutation = (
           queryKey: archivedConvoQueryKey,
           refetchPage: (_, index) => index === 0,
         });
+        queryClient.invalidateQueries([QueryKeys.projectConversations]);
+        queryClient.invalidateQueries([QueryKeys.projects]);
       },
       ..._options,
     },
@@ -475,6 +482,30 @@ export const useDeleteConversationMutation = (
         // TODO: CHECK THIS, no-op; restore if needed
       },
       onSuccess: (data, vars, context) => {
+        const deletedConversation = vars.conversationId
+          ? queryClient.getQueryData<t.TConversation>([QueryKeys.conversation, vars.conversationId])
+          : undefined;
+        let deletedProjectId = deletedConversation?.chatProjectId;
+        if (!deletedProjectId && vars.conversationId) {
+          const cacheKeys = [QueryKeys.allConversations, QueryKeys.projectConversations];
+          for (const cacheKey of cacheKeys) {
+            const queries = queryClient.getQueryCache().findAll([cacheKey], { exact: false });
+            for (const query of queries) {
+              const found = findConversationInInfinite(
+                queryClient.getQueryData<InfiniteData<ConversationListResponse>>(query.queryKey),
+                vars.conversationId,
+              );
+              if (found?.chatProjectId) {
+                deletedProjectId = found.chatProjectId;
+                break;
+              }
+            }
+            if (deletedProjectId) {
+              break;
+            }
+          }
+        }
+
         if (vars.conversationId) {
           removeConvoFromAllQueries(queryClient, vars.conversationId);
         }
@@ -519,6 +550,11 @@ export const useDeleteConversationMutation = (
           queryKey: [QueryKeys.archivedConversations],
           refetchPage: (_, index) => index === 0,
         });
+        queryClient.invalidateQueries([QueryKeys.projectConversations]);
+        queryClient.invalidateQueries([QueryKeys.projects]);
+        if (deletedProjectId) {
+          queryClient.invalidateQueries([QueryKeys.project, deletedProjectId]);
+        }
 
         options?.onSuccess?.(data, vars, context);
       },
@@ -550,6 +586,11 @@ export const useDuplicateConversationMutation = (
         queryKey: [QueryKeys.allConversations],
         refetchPage: (_, index) => index === 0,
       });
+      queryClient.invalidateQueries([QueryKeys.projectConversations]);
+      queryClient.invalidateQueries([QueryKeys.projects]);
+      if (duplicatedConversation.chatProjectId) {
+        queryClient.invalidateQueries([QueryKeys.project, duplicatedConversation.chatProjectId]);
+      }
 
       if (duplicatedConversation.tags && duplicatedConversation.tags.length > 0) {
         queryClient.setQueryData<t.TConversationTag[]>([QueryKeys.conversationTags], (oldTags) => {
@@ -593,6 +634,11 @@ export const useForkConvoMutation = (
         queryKey: [QueryKeys.allConversations],
         refetchPage: (_, index) => index === 0,
       });
+      queryClient.invalidateQueries([QueryKeys.projectConversations]);
+      queryClient.invalidateQueries([QueryKeys.projects]);
+      if (forkedConversation.chatProjectId) {
+        queryClient.invalidateQueries([QueryKeys.project, forkedConversation.chatProjectId]);
+      }
 
       if (forkedConversation.tags && forkedConversation.tags.length > 0) {
         queryClient.setQueryData<t.TConversationTag[]>([QueryKeys.conversationTags], (oldTags) => {
diff --git a/client/src/data-provider/queries.ts b/client/src/data-provider/queries.ts
index 866e25a262c..de6c571c8bd 100644
--- a/client/src/data-provider/queries.ts
+++ b/client/src/data-provider/queries.ts
@@ -86,12 +86,12 @@ export const useConversationsInfiniteQuery = (
   params: ConversationListParams,
   config?: UseInfiniteQueryOptions<ConversationListResponse, unknown>,
 ) => {
-  const { isArchived, sortBy, sortDirection, tags, search } = params;
+  const { isArchived, sortBy, sortDirection, tags, search, projectId } = params;
 
   return useInfiniteQuery<ConversationListResponse>({
     queryKey: [
       isArchived ? QueryKeys.archivedConversations : QueryKeys.allConversations,
-      { isArchived, sortBy, sortDirection, tags, search },
+      { isArchived, sortBy, sortDirection, tags, search, projectId },
     ],
     queryFn: ({ pageParam }) =>
       dataService.listConversations({
@@ -100,6 +100,7 @@ export const useConversationsInfiniteQuery = (
         sortDirection,
         tags,
         search,
+        projectId,
         cursor: pageParam?.toString(),
       }),
     getNextPageParam: (lastPage) => lastPage?.nextCursor ?? undefined,
@@ -143,15 +144,14 @@ export const useSharedLinksQuery = (
   params: SharedLinksListParams,
   config?: UseInfiniteQueryOptions<SharedLinksResponse, unknown>,
 ) => {
-  const { pageSize, isPublic, search, sortBy, sortDirection } = params;
+  const { pageSize, search, sortBy, sortDirection } = params;
 
   return useInfiniteQuery<SharedLinksResponse>({
-    queryKey: [QueryKeys.sharedLinks, { pageSize, isPublic, search, sortBy, sortDirection }],
+    queryKey: [QueryKeys.sharedLinks, { pageSize, search, sortBy, sortDirection }],
     queryFn: ({ pageParam }) =>
       dataService.listSharedLinks({
         cursor: pageParam?.toString(),
         pageSize,
-        isPublic,
         search,
         sortBy,
         sortDirection,
diff --git a/client/src/hooks/Agents/__tests__/useApplyModelSpecAgents.spec.tsx b/client/src/hooks/Agents/__tests__/useApplyModelSpecAgents.spec.tsx
new file mode 100644
index 00000000000..ce68d560b32
--- /dev/null
+++ b/client/src/hooks/Agents/__tests__/useApplyModelSpecAgents.spec.tsx
@@ -0,0 +1,147 @@
+import React from 'react';
+import { RecoilRoot, useRecoilValue } from 'recoil';
+import { renderHook, act } from '@testing-library/react';
+import { Constants, EModelEndpoint } from 'librechat-data-provider';
+import type { TEphemeralAgent, TStartupConfig, TModelSpec } from 'librechat-data-provider';
+import { ephemeralAgentByConvoId, useUpdateEphemeralAgent } from '~/store/agents';
+import { useApplyModelSpecEffects } from '../useApplyModelSpecAgents';
+
+const NEW_CONVO = Constants.NEW_CONVO as string;
+
+const Wrapper = ({ children }: { children: React.ReactNode }) => (
+  <RecoilRoot>{children}</RecoilRoot>
+);
+
+const createModelSpec = (name: string): TModelSpec =>
+  ({
+    name,
+    label: name,
+    preset: {
+      endpoint: EModelEndpoint.openAI,
+      model: name,
+    },
+  }) as TModelSpec;
+
+const createStartupConfig = (list: TModelSpec[]): TStartupConfig =>
+  ({
+    modelSpecs: {
+      list,
+      prioritize: false,
+    },
+  }) as TStartupConfig;
+
+const specsConfig = () => createStartupConfig([createModelSpec('test-spec')]);
+
+const useHarness = (conversationId: string) => {
+  const applyModelSpecEffects = useApplyModelSpecEffects();
+  const updateEphemeralAgent = useUpdateEphemeralAgent();
+  const ephemeralAgent = useRecoilValue(ephemeralAgentByConvoId(conversationId));
+  return { applyModelSpecEffects, updateEphemeralAgent, ephemeralAgent };
+};
+
+describe('useApplyModelSpecEffects', () => {
+  it('preserves an existing conversation ephemeral agent on an in-place model switch', () => {
+    const conversationId = 'convo-123';
+    const agent: TEphemeralAgent = { mcp: ['clickhouse'] };
+    const { result } = renderHook(() => useHarness(conversationId), { wrapper: Wrapper });
+
+    act(() => {
+      result.current.updateEphemeralAgent(conversationId, agent);
+    });
+    expect(result.current.ephemeralAgent).toEqual(agent);
+
+    act(() => {
+      result.current.applyModelSpecEffects({
+        convoId: conversationId,
+        specName: null,
+        prevConvoId: conversationId,
+        prevSpecName: null,
+        startupConfig: specsConfig(),
+      });
+    });
+
+    expect(result.current.ephemeralAgent).toEqual(agent);
+  });
+
+  it('preserves a new conversation ephemeral agent on an in-place model switch', () => {
+    const agent: TEphemeralAgent = { mcp: ['clickhouse'] };
+    const { result } = renderHook(() => useHarness(NEW_CONVO), { wrapper: Wrapper });
+
+    act(() => {
+      result.current.updateEphemeralAgent(NEW_CONVO, agent);
+    });
+
+    act(() => {
+      result.current.applyModelSpecEffects({
+        convoId: NEW_CONVO,
+        specName: null,
+        prevConvoId: NEW_CONVO,
+        prevSpecName: null,
+        startupConfig: specsConfig(),
+      });
+    });
+
+    expect(result.current.ephemeralAgent).toEqual(agent);
+  });
+
+  it('resets the ephemeral agent when switching away from a spec', () => {
+    const { result } = renderHook(() => useHarness(NEW_CONVO), { wrapper: Wrapper });
+
+    act(() => {
+      result.current.updateEphemeralAgent(NEW_CONVO, { mcp: ['clickhouse'] });
+    });
+
+    act(() => {
+      result.current.applyModelSpecEffects({
+        convoId: NEW_CONVO,
+        specName: null,
+        prevConvoId: NEW_CONVO,
+        prevSpecName: 'test-spec',
+        startupConfig: specsConfig(),
+      });
+    });
+
+    expect(result.current.ephemeralAgent).toBeNull();
+  });
+
+  it('resets the new conversation ephemeral agent when leaving an existing conversation', () => {
+    const { result } = renderHook(() => useHarness(NEW_CONVO), { wrapper: Wrapper });
+
+    act(() => {
+      result.current.updateEphemeralAgent(NEW_CONVO, { mcp: ['clickhouse'] });
+    });
+
+    act(() => {
+      result.current.applyModelSpecEffects({
+        convoId: NEW_CONVO,
+        specName: null,
+        prevConvoId: 'convo-123',
+        prevSpecName: null,
+        startupConfig: specsConfig(),
+      });
+    });
+
+    expect(result.current.ephemeralAgent).toBeNull();
+  });
+
+  it('leaves the ephemeral agent untouched when no specs are configured', () => {
+    const agent: TEphemeralAgent = { mcp: ['clickhouse'] };
+    const { result } = renderHook(() => useHarness(NEW_CONVO), { wrapper: Wrapper });
+
+    act(() => {
+      result.current.updateEphemeralAgent(NEW_CONVO, agent);
+    });
+
+    act(() => {
+      result.current.applyModelSpecEffects({
+        convoId: NEW_CONVO,
+        specName: null,
+        prevConvoId: 'convo-123',
+        prevSpecName: 'test-spec',
+        startupConfig: {} as TStartupConfig,
+      });
+    });
+
+    expect(result.current.ephemeralAgent).toEqual(agent);
+  });
+});
diff --git a/client/src/hooks/Agents/useApplyModelSpecAgents.ts b/client/src/hooks/Agents/useApplyModelSpecAgents.ts
index 2c677f85ca0..3b33968e865 100644
--- a/client/src/hooks/Agents/useApplyModelSpecAgents.ts
+++ b/client/src/hooks/Agents/useApplyModelSpecAgents.ts
@@ -10,7 +10,11 @@ import { getModelSpec, applyModelSpecEphemeralAgent } from '~/utils';
  *
  * When a spec is provided, its tool settings are applied to the ephemeral agent.
  * When no spec is provided but specs are configured, the ephemeral agent is reset
- * to null so BadgeRowContext can apply localStorage defaults (non-spec experience).
+ * to null on context transitions (leaving a spec, or moving to a different
+ * conversation key) so BadgeRowContext refills values from localStorage — both
+ * transitions re-trigger its init effect. In-place switches (same conversation,
+ * non-spec → non-spec) keep the ephemeral agent state (e.g. MCP selections),
+ * since no refill would follow the reset.
  */
 export function useApplyModelSpecEffects() {
   const updateEphemeralAgent = useUpdateEphemeralAgent();
@@ -18,17 +22,25 @@ export function useApplyModelSpecEffects() {
     ({
       convoId,
       specName,
+      prevConvoId,
+      prevSpecName,
       startupConfig,
     }: {
       convoId: string | null;
       specName?: string | null;
+      prevConvoId?: string | null;
+      prevSpecName?: string | null;
       startupConfig?: TStartupConfig;
     }) => {
       if (specName == null || !specName) {
-        if (startupConfig?.modelSpecs?.list?.length) {
-          /** Specs are configured but none selected — reset ephemeral agent to null
-           *  so BadgeRowContext fills all values (tool toggles + MCP) from localStorage. */
-          updateEphemeralAgent((convoId ?? Constants.NEW_CONVO) || Constants.NEW_CONVO, null);
+        if (!startupConfig?.modelSpecs?.list?.length) {
+          return;
+        }
+        const targetId = (convoId ?? Constants.NEW_CONVO) || Constants.NEW_CONVO;
+        const sourceId = (prevConvoId ?? Constants.NEW_CONVO) || Constants.NEW_CONVO;
+        const isContextSwitch = Boolean(prevSpecName) || targetId !== sourceId;
+        if (isContextSwitch) {
+          updateEphemeralAgent(targetId, null);
         }
         return;
       }
diff --git a/client/src/hooks/Audio/MediaSourceAppender.ts b/client/src/hooks/Audio/MediaSourceAppender.ts
index aef4f42edf5..38c88ff1881 100644
--- a/client/src/hooks/Audio/MediaSourceAppender.ts
+++ b/client/src/hooks/Audio/MediaSourceAppender.ts
@@ -21,7 +21,9 @@ export class MediaSourceAppender {
   }
 
   public addBase64Data(base64Data: string) {
-    this.addData(Uint8Array.from(atob(base64Data), (char) => char.charCodeAt(0)).buffer);
+    this.addData(
+      Uint8Array.from(atob(base64Data), (char) => char.charCodeAt(0)).buffer as ArrayBuffer,
+    );
   }
 
   public addData(data: ArrayBuffer) {
diff --git a/client/src/hooks/Chat/__tests__/cache.spec.ts b/client/src/hooks/Chat/__tests__/cache.spec.ts
index 0ba7a4aee68..e3f7e8ebc5e 100644
--- a/client/src/hooks/Chat/__tests__/cache.spec.ts
+++ b/client/src/hooks/Chat/__tests__/cache.spec.ts
@@ -2,6 +2,10 @@ import { Constants } from 'librechat-data-provider';
 import type { TMessage } from 'librechat-data-provider';
 import { getMessageCacheIds, getMessagesConversationId } from '../cache';
 
+/** `Constants` is a heterogeneous enum (`string | number`); annotate as
+ *  `string` so the member is usable where a `string` field is expected. */
+const NEW_CONVO: string = Constants.NEW_CONVO;
+
 const message = (conversationId?: string | null): TMessage =>
   ({
     messageId: 'message-id',
@@ -22,8 +26,8 @@ describe('chat message cache helpers', () => {
   it('mirrors new-chat messages into the generated conversation cache', () => {
     expect(
       getMessageCacheIds({
-        queryParam: Constants.NEW_CONVO,
-        conversationId: Constants.NEW_CONVO,
+        queryParam: NEW_CONVO,
+        conversationId: NEW_CONVO,
         messages: [message('generated-convo-id')],
       }),
     ).toEqual([Constants.NEW_CONVO, 'generated-convo-id']);
diff --git a/client/src/hooks/Chat/__tests__/useChatFunctions.regenerate.spec.tsx b/client/src/hooks/Chat/__tests__/useChatFunctions.regenerate.spec.tsx
new file mode 100644
index 00000000000..ab5112f0e67
--- /dev/null
+++ b/client/src/hooks/Chat/__tests__/useChatFunctions.regenerate.spec.tsx
@@ -0,0 +1,145 @@
+import { renderHook, act } from '@testing-library/react';
+import { EModelEndpoint } from 'librechat-data-provider';
+import type { TConversation, TMessage, TSubmission } from 'librechat-data-provider';
+import useChatFunctions from '../useChatFunctions';
+
+const mockNavigate = jest.fn();
+const mockSetShowStopButton = jest.fn();
+const mockSetIsSubmitting = jest.fn();
+const mockGetEphemeralAgent = jest.fn(() => null);
+const mockSetFilesToDelete = jest.fn();
+const mockGetSender = jest.fn(() => 'Assistant');
+const mockGetExpiry = jest.fn(() => 'expiry-key');
+const mockGetQueryData = jest.fn(() => ({}));
+
+jest.mock('react-router-dom', () => ({
+  useNavigate: () => mockNavigate,
+}));
+
+jest.mock('@tanstack/react-query', () => ({
+  useQueryClient: () => ({
+    getQueryData: mockGetQueryData,
+  }),
+}));
+
+jest.mock('recoil', () => ({
+  useRecoilValue: () => false,
+  useSetRecoilState: (atom: unknown) =>
+    String(atom).includes('isSubmitting') ? mockSetIsSubmitting : mockSetShowStopButton,
+  useRecoilCallback: (factory: any) =>
+    factory({
+      snapshot: {
+        getLoadable: () => ({ state: 'hasValue', contents: [] }),
+      },
+      set: jest.fn(),
+      reset: jest.fn(),
+    }),
+}));
+
+jest.mock('~/hooks/Files/useSetFilesToDelete', () => () => mockSetFilesToDelete);
+jest.mock('~/hooks/Conversations/useGetSender', () => () => mockGetSender);
+jest.mock('~/hooks/Input/useUserKey', () => () => ({ getExpiry: mockGetExpiry }));
+jest.mock('~/hooks', () => ({
+  useAuthContext: () => ({ user: null }),
+}));
+jest.mock('~/store', () => ({
+  __esModule: true,
+  default: {
+    isTemporary: 'isTemporary',
+    isSubmittingFamily: () => 'isSubmitting',
+    showStopButtonByIndex: () => 'showStopButton',
+    pendingManualSkillsByConvoId: () => 'pendingManualSkills',
+    messagesSiblingIdxFamily: () => 'messagesSiblingIdx',
+  },
+  useGetEphemeralAgent: () => mockGetEphemeralAgent,
+}));
+jest.mock('~/utils', () => ({
+  logger: {
+    log: jest.fn(),
+    dir: jest.fn(),
+  },
+  createDualMessageContent: jest.fn(() => []),
+  getRouteChatProjectId: jest.fn(() => null),
+}));
+
+const userMessage = (messageId: string, parentMessageId = '00000000-0000-0000-0000-000000000000') =>
+  ({
+    messageId,
+    parentMessageId,
+    conversationId: 'conversation-1',
+    isCreatedByUser: true,
+    sender: 'User',
+    text: messageId,
+  }) as TMessage;
+
+const assistantMessage = (messageId: string, parentMessageId: string) =>
+  ({
+    messageId,
+    parentMessageId,
+    conversationId: 'conversation-1',
+    isCreatedByUser: false,
+    sender: 'Assistant',
+    text: messageId,
+  }) as TMessage;
+
+describe('useChatFunctions regenerate', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockGetQueryData.mockReturnValue({});
+  });
+
+  it('keys a non-tail regenerate to the selected assistant response', () => {
+    let messages = [
+      userMessage('user-1'),
+      assistantMessage('assistant-1', 'user-1'),
+      userMessage('user-2', 'assistant-1'),
+      assistantMessage('assistant-2', 'user-2'),
+      userMessage('user-3', 'assistant-2'),
+      assistantMessage('assistant-3', 'user-3'),
+    ];
+    const setMessages = jest.fn((nextMessages: TMessage[]) => {
+      messages = nextMessages;
+    });
+    const setSubmission = jest.fn();
+    const conversation = {
+      conversationId: 'conversation-1',
+      endpoint: EModelEndpoint.agents,
+      model: 'gpt-4o',
+      agent_id: 'agent-1',
+    } as TConversation;
+
+    const { result } = renderHook(() =>
+      useChatFunctions({
+        isSubmitting: false,
+        latestMessage: messages[5],
+        conversation,
+        getMessages: () => messages,
+        setMessages,
+        setSubmission,
+      }),
+    );
+
+    act(() => {
+      result.current.regenerate(messages[1]);
+    });
+
+    const submission = setSubmission.mock.calls.at(-1)?.[0] as TSubmission;
+    expect(submission.userMessage.overrideParentMessageId).toBe('user-1');
+    expect(submission.userMessage.responseMessageId).toBe('assistant-1_');
+    expect(submission.initialResponse?.messageId).toBe('assistant-1_');
+    expect(submission.initialResponse?.parentMessageId).toBe('user-1');
+    expect(submission.messages.map((message) => message.messageId)).toEqual(['user-1']);
+    expect(submission.regenerateMessages?.map((message) => message.messageId)).toEqual([
+      'user-1',
+      'assistant-1',
+      'user-2',
+      'assistant-2',
+      'user-3',
+      'assistant-3',
+    ]);
+    expect(
+      setMessages.mock.calls.at(-1)?.[0].map((message: TMessage) => message.messageId),
+    ).toEqual(['user-1', 'assistant-1_']);
+    expect(messages.at(-1)?.messageId).toBe('assistant-1_');
+  });
+});
diff --git a/client/src/hooks/Chat/__tests__/useChatFunctions.spec.ts b/client/src/hooks/Chat/__tests__/useChatFunctions.spec.ts
new file mode 100644
index 00000000000..0835cb43f4c
--- /dev/null
+++ b/client/src/hooks/Chat/__tests__/useChatFunctions.spec.ts
@@ -0,0 +1,129 @@
+import type { TMessage } from 'librechat-data-provider';
+import {
+  getRegenerateSubmissionMessages,
+  getPreliminaryRegenerateResponseMessageId,
+  getRegenerateTargetResponseMessage,
+} from '../useChatFunctions';
+
+const userMessage = (messageId: string, parentMessageId = '00000000-0000-0000-0000-000000000000') =>
+  ({
+    messageId,
+    parentMessageId,
+    isCreatedByUser: true,
+    sender: 'User',
+    text: messageId,
+  }) as TMessage;
+
+const assistantMessage = (messageId: string, parentMessageId: string) =>
+  ({
+    messageId,
+    parentMessageId,
+    isCreatedByUser: false,
+    sender: 'Assistant',
+    text: messageId,
+  }) as TMessage;
+
+describe('regenerate response targeting', () => {
+  it('uses the clicked assistant response instead of the conversation tail', () => {
+    const messages = [
+      userMessage('user-1'),
+      assistantMessage('assistant-1', 'user-1'),
+      userMessage('user-2', 'assistant-1'),
+      assistantMessage('assistant-2', 'user-2'),
+      userMessage('user-3', 'assistant-2'),
+      assistantMessage('assistant-3', 'user-3'),
+    ];
+
+    const targetResponse = getRegenerateTargetResponseMessage({
+      messages,
+      parentMessageId: 'user-1',
+      targetResponseMessageId: 'assistant-1',
+      latestMessage: messages[5],
+    });
+
+    expect(targetResponse?.messageId).toBe('assistant-1');
+    expect(getPreliminaryRegenerateResponseMessageId(targetResponse?.messageId)).toBe(
+      'assistant-1_',
+    );
+  });
+
+  it('only falls back to latestMessage when it belongs to the regenerated user turn', () => {
+    const messages = [
+      userMessage('user-1'),
+      assistantMessage('assistant-1', 'user-1'),
+      userMessage('user-2', 'assistant-1'),
+      assistantMessage('assistant-2', 'user-2'),
+    ];
+
+    expect(
+      getRegenerateTargetResponseMessage({
+        messages,
+        parentMessageId: 'user-1',
+        latestMessage: messages[3],
+      })?.messageId,
+    ).toBe('assistant-1');
+
+    expect(
+      getRegenerateTargetResponseMessage({
+        messages,
+        parentMessageId: 'user-2',
+        latestMessage: messages[3],
+      })?.messageId,
+    ).toBe('assistant-2');
+  });
+
+  it('truncates regenerate history before the targeted assistant response', () => {
+    const messages = [
+      userMessage('user-1'),
+      assistantMessage('assistant-1', 'user-1'),
+      userMessage('user-2', 'assistant-1'),
+      assistantMessage('assistant-2', 'user-2'),
+      userMessage('user-3', 'assistant-2'),
+      assistantMessage('assistant-3', 'user-3'),
+    ];
+
+    expect(
+      getRegenerateSubmissionMessages({
+        messages,
+        targetResponseMessage: messages[1],
+        initialResponseId: 'assistant-1_',
+      }).map((message) => message.messageId),
+    ).toEqual(['user-1']);
+  });
+
+  it('keeps unrelated sibling branches when regenerating (no flat-array drop)', () => {
+    // user-1 has two responses: the original chain (assistant-1 -> ... ) and a
+    // regenerated sibling (assistant-1b) that sits LATER in the flat array.
+    const messages = [
+      userMessage('user-1'),
+      assistantMessage('assistant-1', 'user-1'),
+      userMessage('user-2', 'assistant-1'),
+      assistantMessage('assistant-2', 'user-2'),
+      assistantMessage('assistant-1b', 'user-1'),
+    ];
+
+    // Regenerating the latest response on the original branch must drop only
+    // that response, NOT the unrelated assistant-1b branch.
+    expect(
+      getRegenerateSubmissionMessages({
+        messages,
+        targetResponseMessage: messages[3],
+        initialResponseId: 'assistant-2_',
+      })
+        .map((message) => message.messageId)
+        .sort(),
+    ).toEqual(['assistant-1', 'assistant-1b', 'user-1', 'user-2']);
+
+    // Regenerating an earlier response drops its subtree (user-2, assistant-2)
+    // but still keeps the unrelated assistant-1b branch.
+    expect(
+      getRegenerateSubmissionMessages({
+        messages,
+        targetResponseMessage: messages[1],
+        initialResponseId: 'assistant-1_',
+      })
+        .map((message) => message.messageId)
+        .sort(),
+    ).toEqual(['assistant-1b', 'user-1']);
+  });
+});
diff --git a/client/src/hooks/Chat/cache.ts b/client/src/hooks/Chat/cache.ts
index d278fc9b79f..b07ab2398ca 100644
--- a/client/src/hooks/Chat/cache.ts
+++ b/client/src/hooks/Chat/cache.ts
@@ -7,7 +7,7 @@ type MessageCacheIdsParams = {
   messages: TMessage[];
 };
 
-function isConcreteConversationId(conversationId?: string | null) {
+function isConcreteConversationId(conversationId?: string | null): conversationId is string {
   return (
     !!conversationId &&
     conversationId !== Constants.NEW_CONVO &&
diff --git a/client/src/hooks/Chat/index.ts b/client/src/hooks/Chat/index.ts
index 11754c6c5fe..9d9af790ce0 100644
--- a/client/src/hooks/Chat/index.ts
+++ b/client/src/hooks/Chat/index.ts
@@ -1,4 +1,6 @@
 export { default as useChatHelpers } from './useChatHelpers';
+export { default as useTokenLimits } from './useTokenLimits';
+export { default as useTokenUsage } from './useTokenUsage';
 export { default as useAddedResponse } from './useAddedResponse';
 export { default as useChatFunctions } from './useChatFunctions';
 export { default as useGetAddedConvo } from './useGetAddedConvo';
diff --git a/client/src/hooks/Chat/useChatFunctions.ts b/client/src/hooks/Chat/useChatFunctions.ts
index a5e6a335d94..2b6b1509148 100644
--- a/client/src/hooks/Chat/useChatFunctions.ts
+++ b/client/src/hooks/Chat/useChatFunctions.ts
@@ -26,9 +26,15 @@ import type {
 } from 'librechat-data-provider';
 import type { SetterOrUpdater } from 'recoil';
 import type { TAskFunction, ExtendedFile } from '~/common';
+import {
+  logger,
+  hasStreamStartFailed,
+  createDualMessageContent,
+  getRouteChatProjectId,
+} from '~/utils';
+import useFocusRegeneratedResponse from '~/hooks/Chat/useFocusRegeneratedResponse';
 import useSetFilesToDelete from '~/hooks/Files/useSetFilesToDelete';
 import useGetSender from '~/hooks/Conversations/useGetSender';
-import { logger, createDualMessageContent } from '~/utils';
 import store, { useGetEphemeralAgent } from '~/store';
 import { startupConfigKey } from '~/data-provider';
 import useUserKey from '~/hooks/Input/useUserKey';
@@ -40,6 +46,141 @@ const logChatRequest = (request: Record<string, unknown>) => {
   logger.log('=====================================');
 };
 
+const getAppendParentMessageId = ({
+  latestMessage,
+  currentMessages,
+}: {
+  latestMessage: TMessage | null;
+  currentMessages: TMessage[];
+}) => {
+  if (!latestMessage) {
+    return Constants.NO_PARENT;
+  }
+
+  if (!hasStreamStartFailed(latestMessage)) {
+    return latestMessage.messageId;
+  }
+
+  const failedUserMessage = currentMessages.find(
+    (message) => message.messageId === latestMessage.parentMessageId,
+  );
+  if (failedUserMessage?.isCreatedByUser !== true) {
+    return latestMessage.messageId;
+  }
+
+  return failedUserMessage.parentMessageId ?? Constants.NO_PARENT;
+};
+
+const hasPendingAssistantParent = (message: TMessage | null) =>
+  !!message?.messageId &&
+  message.isCreatedByUser !== true &&
+  message.messageId.endsWith('_') &&
+  message.createdAt == null &&
+  message.updatedAt == null &&
+  !hasStreamStartFailed(message);
+
+type RegenerateTargetResponseArgs = {
+  messages: TMessage[];
+  parentMessageId?: string | null;
+  targetResponseMessageId?: string | null;
+  latestMessage?: TMessage | null;
+};
+
+const isAssistantResponseForParent = (
+  message: TMessage | null | undefined,
+  parentMessageId?: string | null,
+): message is TMessage =>
+  !!message &&
+  !message.isCreatedByUser &&
+  !!parentMessageId &&
+  message.parentMessageId === parentMessageId;
+
+export function getPreliminaryRegenerateResponseMessageId(
+  responseMessageId?: string | null,
+): string | null {
+  if (typeof responseMessageId !== 'string' || responseMessageId.length === 0) {
+    return null;
+  }
+
+  return `${responseMessageId.replace(/_+$/, '')}_`;
+}
+
+export function getRegenerateTargetResponseMessage({
+  messages,
+  parentMessageId,
+  targetResponseMessageId,
+  latestMessage,
+}: RegenerateTargetResponseArgs): TMessage | null {
+  if (!parentMessageId) {
+    return null;
+  }
+
+  if (targetResponseMessageId) {
+    const targetResponse = messages.find(
+      (message) =>
+        message.messageId === targetResponseMessageId &&
+        isAssistantResponseForParent(message, parentMessageId),
+    );
+    if (targetResponse) {
+      return targetResponse;
+    }
+  }
+
+  if (isAssistantResponseForParent(latestMessage, parentMessageId)) {
+    return latestMessage;
+  }
+
+  for (let i = messages.length - 1; i >= 0; i--) {
+    const message = messages[i];
+    if (isAssistantResponseForParent(message, parentMessageId)) {
+      return message;
+    }
+  }
+
+  return null;
+}
+
+export function getRegenerateSubmissionMessages({
+  messages,
+  targetResponseMessage,
+  initialResponseId,
+}: {
+  messages: TMessage[];
+  targetResponseMessage?: TMessage | null;
+  initialResponseId?: string | null;
+}): TMessage[] {
+  if (targetResponseMessage?.messageId) {
+    /**
+     * Remove the response being regenerated and its descendants only — NOT a
+     * flat `slice(0, targetIndex)`, which also drops unrelated sibling branches
+     * that merely sit later in the array. That collapse made the optimistic
+     * render briefly lose other branches mid-regenerate (visible flash, and the
+     * scroll jumping to the shrunken content). Keeping them holds the thread —
+     * and scroll — steady. This array is render-only; the server regenerates
+     * from `parentMessageId`, so removing by subtree never affects the payload.
+     */
+    const removed = new Set<string>([targetResponseMessage.messageId]);
+    let grew = true;
+    while (grew) {
+      grew = false;
+      for (const message of messages) {
+        const parentMessageId = message.parentMessageId;
+        if (
+          parentMessageId != null &&
+          removed.has(parentMessageId) &&
+          !removed.has(message.messageId)
+        ) {
+          removed.add(message.messageId);
+          grew = true;
+        }
+      }
+    }
+    return messages.filter((message) => !removed.has(message.messageId));
+  }
+
+  return messages.filter((msg) => msg.messageId !== initialResponseId);
+}
+
 export default function useChatFunctions({
   index = 0,
   files,
@@ -72,6 +213,7 @@ export default function useChatFunctions({
   const { getExpiry } = useUserKey(immutableConversation?.endpoint ?? '');
   const setIsSubmitting = useSetRecoilState(store.isSubmittingFamily(index));
   const setShowStopButton = useSetRecoilState(store.showStopButtonByIndex(index));
+  const focusRegeneratedResponse = useFocusRegeneratedResponse();
 
   /**
    * Atomically read + reset the per-conversation queue of manually-invoked
@@ -114,6 +256,7 @@ export default function useChatFunctions({
       isEdited = false,
       overrideMessages,
       overrideFiles,
+      targetResponseMessageId,
       overrideManualSkills,
       addedConvo,
     } = {},
@@ -144,6 +287,14 @@ export default function useChatFunctions({
       return;
     }
 
+    if (parentMessageId == null && hasPendingAssistantParent(latestMessage)) {
+      logger.warn(
+        '[useChatFunctions] Refusing to append to a preliminary assistant message',
+        latestMessage,
+      );
+      return false;
+    }
+
     const ephemeralAgent = getEphemeralAgent(conversationId ?? Constants.NEW_CONVO);
     /**
      * Manual skill selection resolution:
@@ -165,7 +316,7 @@ export default function useChatFunctions({
     }
     const isEditOrContinue = isEdited || isContinued;
 
-    let currentMessages: TMessage[] | null = overrideMessages ?? getMessages() ?? [];
+    let currentMessages: TMessage[] = overrideMessages ?? getMessages() ?? [];
 
     if (conversation?.promptPrefix) {
       conversation.promptPrefix = replaceSpecialVars({
@@ -175,10 +326,19 @@ export default function useChatFunctions({
       });
     }
 
+    const chatProjectId =
+      conversationId === Constants.NEW_CONVO
+        ? getRouteChatProjectId()
+        : (conversation?.chatProjectId ?? null);
+    const conversationForPayload =
+      chatProjectId != null ? { ...(conversation ?? {}), chatProjectId } : (conversation ?? {});
+
     // construct the query message
     // this is not a real messageId, it is used as placeholder before real messageId returned
     const intermediateId = overrideUserMessageId ?? v4();
-    parentMessageId = parentMessageId ?? latestMessage?.messageId ?? Constants.NO_PARENT;
+    if (parentMessageId == null) {
+      parentMessageId = getAppendParentMessageId({ latestMessage, currentMessages });
+    }
 
     logChatRequest({
       index,
@@ -194,7 +354,8 @@ export default function useChatFunctions({
       parentMessageId = Constants.NO_PARENT;
       currentMessages = [];
       conversationId = null;
-      navigate('/c/new', { state: { focusChat: true } });
+      const projectSearch = chatProjectId ? `?projectId=${encodeURIComponent(chatProjectId)}` : '';
+      navigate(`/c/new${projectSearch}`, { state: { focusChat: true } });
     }
 
     const targetParentMessageId = isRegenerate ? messageId : latestMessage?.parentMessageId;
@@ -206,6 +367,14 @@ export default function useChatFunctions({
     const targetParentMessage = currentMessages.find(
       (msg) => msg.messageId === targetParentMessageId,
     );
+    const targetResponseMessage = isRegenerate
+      ? getRegenerateTargetResponseMessage({
+          messages: currentMessages,
+          parentMessageId: messageId,
+          targetResponseMessageId,
+          latestMessage,
+        })
+      : null;
 
     let thread_id = targetParentMessage?.thread_id ?? latestMessage?.thread_id;
     if (thread_id == null) {
@@ -222,7 +391,7 @@ export default function useChatFunctions({
     const convo = parseCompactConvo({
       endpoint: endpoint as EndpointSchemaKey,
       endpointType: endpointType as EndpointSchemaKey,
-      conversation: conversation ?? {},
+      conversation: conversationForPayload,
       defaultParamsEndpoint,
     });
 
@@ -235,6 +404,7 @@ export default function useChatFunctions({
         overrideUserMessageId,
       },
       convo,
+      chatProjectId ? { chatProjectId } : {},
     ) as TEndpointOption;
     if (endpoint !== EModelEndpoint.agents) {
       endpointOption.key = getExpiry();
@@ -289,8 +459,10 @@ export default function useChatFunctions({
 
     const responseMessageId =
       editedMessageId ??
-      (latestMessage?.messageId && isRegenerate
-        ? latestMessage.messageId.replace(/_+$/, '') + '_'
+      (isRegenerate
+        ? getPreliminaryRegenerateResponseMessageId(
+            targetResponseMessage?.messageId ?? targetResponseMessageId,
+          )
         : null) ??
       null;
     const initialResponseId =
@@ -369,10 +541,20 @@ export default function useChatFunctions({
       currentMessages = currentMessages.filter((msg) => msg.messageId !== responseMessageId);
     }
 
+    const submissionMessages = isRegenerate
+      ? getRegenerateSubmissionMessages({
+          messages: currentMessages,
+          targetResponseMessage,
+          initialResponseId: initialResponse.messageId,
+        })
+      : currentMessages;
+    const regenerateMessages = isRegenerate ? [...currentMessages] : undefined;
+
     logger.log('message_state', initialResponse);
     const submission: TSubmission = {
       conversation: {
         ...conversation,
+        ...(chatProjectId ? { chatProjectId } : {}),
         conversationId,
       },
       endpointOption,
@@ -381,7 +563,8 @@ export default function useChatFunctions({
         responseMessageId,
         overrideParentMessageId: isRegenerate ? messageId : null,
       },
-      messages: currentMessages,
+      messages: submissionMessages,
+      regenerateMessages,
       isEdited: isEditOrContinue,
       isContinued,
       isRegenerate,
@@ -394,17 +577,25 @@ export default function useChatFunctions({
     };
 
     if (isRegenerate) {
-      setMessages([...submission.messages, initialResponse]);
+      setMessages([...submissionMessages, initialResponse]);
+      focusRegeneratedResponse(initialResponse.parentMessageId);
     } else {
-      setMessages([...submission.messages, currentMsg, initialResponse]);
+      setMessages([...submissionMessages, currentMsg, initialResponse]);
     }
 
     setSubmission(submission);
     logger.dir('message_stream', submission, { depth: null });
   };
 
-  const regenerate = ({ parentMessageId }, options?: { addedConvo?: TConversation | null }) => {
+  const regenerate = (
+    message: Partial<Pick<TMessage, 'messageId' | 'parentMessageId' | 'isCreatedByUser'>>,
+    options?: { addedConvo?: TConversation | null },
+  ) => {
     const messages = getMessages();
+    const parentMessageId =
+      message.isCreatedByUser === true ? message.messageId : message.parentMessageId;
+    const targetResponseMessageId =
+      message.isCreatedByUser === true ? undefined : message.messageId;
     const parentMessage = messages?.find((element) => element.messageId == parentMessageId);
 
     if (parentMessage && parentMessage.isCreatedByUser) {
@@ -413,6 +604,7 @@ export default function useChatFunctions({
         {
           isRegenerate: true,
           addedConvo: options?.addedConvo ?? undefined,
+          targetResponseMessageId,
           /** Carry the original user message's manual skill picks forward
            *  so the regenerated response is primed with the same skills.
            *  The compose-time atom was drained on the first submit; without
diff --git a/client/src/hooks/Chat/useFocusRegeneratedResponse.ts b/client/src/hooks/Chat/useFocusRegeneratedResponse.ts
new file mode 100644
index 00000000000..5d5ad3abc09
--- /dev/null
+++ b/client/src/hooks/Chat/useFocusRegeneratedResponse.ts
@@ -0,0 +1,25 @@
+import { useRecoilCallback } from 'recoil';
+import store from '~/store';
+
+/**
+ * Focus a regenerated response's fork on its newest sibling. A regeneration
+ * appends the new response as the newest child of its parent, but when the
+ * parent already had multiple siblings the child count is unchanged (the slice
+ * keeps unrelated branches), so MultiMessage's length-change reset never fires
+ * and the view would otherwise stay on the kept sibling. Selecting reversed
+ * index 0 (newest = the appended response) makes the regenerating branch
+ * visible — applied at the optimistic render and reaffirmed on the `created`
+ * event so there is no flash on the kept sibling in between.
+ */
+export default function useFocusRegeneratedResponse() {
+  return useRecoilCallback(
+    ({ set }) =>
+      (parentMessageId?: string | null) => {
+        if (parentMessageId == null) {
+          return;
+        }
+        set(store.messagesSiblingIdxFamily(parentMessageId), 0);
+      },
+    [],
+  );
+}
diff --git a/client/src/hooks/Chat/useTokenLimits.ts b/client/src/hooks/Chat/useTokenLimits.ts
new file mode 100644
index 00000000000..e2454aae77f
--- /dev/null
+++ b/client/src/hooks/Chat/useTokenLimits.ts
@@ -0,0 +1,66 @@
+import { useMemo } from 'react';
+import { Providers, EModelEndpoint, isAgentsEndpoint } from 'librechat-data-provider';
+import type { TConversation, TModelTokenomics } from 'librechat-data-provider';
+import { useGetStartupConfig, useTokenConfigQuery, useGetAgentByIdQuery } from '~/data-provider';
+import { getModelSpec } from '~/utils';
+
+/** Gemini tokenomics are advertised under the `google` endpoint, so a
+ *  Vertex-backed agent (`provider: 'vertexai'`) must look up there. */
+function normalizeTokenConfigKey(endpoint: string): string {
+  return endpoint === Providers.VERTEXAI ? EModelEndpoint.google : endpoint;
+}
+
+export interface TokenLimits {
+  /** Statically resolved max context; live snapshots override this at run time */
+  maxContextTokens?: number;
+  rates?: TModelTokenomics;
+  endpoint?: string;
+  model?: string;
+}
+
+function toNumber(value: unknown): number | undefined {
+  const num = typeof value === 'string' ? parseFloat(value) : value;
+  return typeof num === 'number' && Number.isFinite(num) && num > 0 ? num : undefined;
+}
+
+/**
+ * Mirrors the backend resolution chain (packages/api agents/initialize.ts):
+ * explicit conversation setting → agent params → model spec preset →
+ * server-resolved token config lookup.
+ */
+export default function useTokenLimits(conversation: TConversation | null): TokenLimits {
+  const { data: startupConfig } = useGetStartupConfig();
+  const { data: tokenConfig } = useTokenConfigQuery();
+
+  const endpoint = conversation?.endpoint ?? '';
+  const agentId = isAgentsEndpoint(endpoint) ? conversation?.agent_id : null;
+  const { data: agent } = useGetAgentByIdQuery(agentId);
+
+  const spec = conversation?.spec;
+  const model = conversation?.model;
+  const maxContextSetting = conversation?.maxContextTokens;
+
+  return useMemo(() => {
+    const specPreset = getModelSpec({ specName: spec, startupConfig })?.preset;
+
+    let lookupEndpoint = endpoint;
+    let lookupModel = model ?? '';
+    if (agent) {
+      lookupEndpoint = agent.provider ?? endpoint;
+      lookupModel = agent.model ?? lookupModel;
+    } else if (specPreset) {
+      lookupEndpoint = specPreset.endpoint ?? lookupEndpoint;
+      lookupModel = lookupModel || (specPreset.model ?? '');
+    }
+    lookupEndpoint = normalizeTokenConfigKey(lookupEndpoint);
+
+    const rates = tokenConfig?.[lookupEndpoint]?.[lookupModel];
+    const maxContextTokens =
+      toNumber(maxContextSetting) ??
+      toNumber(agent?.model_parameters?.maxContextTokens) ??
+      toNumber(specPreset?.maxContextTokens) ??
+      rates?.context;
+
+    return { maxContextTokens, rates, endpoint: lookupEndpoint, model: lookupModel };
+  }, [endpoint, model, spec, maxContextSetting, agent, startupConfig, tokenConfig]);
+}
diff --git a/client/src/hooks/Chat/useTokenUsage.ts b/client/src/hooks/Chat/useTokenUsage.ts
new file mode 100644
index 00000000000..6a6d4ff8459
--- /dev/null
+++ b/client/src/hooks/Chat/useTokenUsage.ts
@@ -0,0 +1,333 @@
+import { useEffect, useMemo, useRef } from 'react';
+import { useAtomValue, useSetAtom } from 'jotai';
+import { useQueryClient } from '@tanstack/react-query';
+import { Constants, QueryKeys } from 'librechat-data-provider';
+import type {
+  TMessage,
+  TConversation,
+  TModelTokenomics,
+  TContextUsageEvent,
+  TContextProjectionRequest,
+} from 'librechat-data-provider';
+import type { BranchTotals, BranchUsage } from '~/utils/tokens';
+import type { ContextSnapshot } from '~/store/usage';
+import {
+  liveTokensFamily,
+  totalUsageFamily,
+  removeUsageAtoms,
+  hydrateSnapshots,
+  pendingUsageFamily,
+  branchTotalsFamily,
+  contextSnapshotFamily,
+  snapshotsByAnchorFamily,
+} from '~/store/usage';
+import {
+  buildIndex,
+  sumBranch,
+  clearIndex,
+  mergeUsage,
+  sumTotalUsage,
+  findBranchSnapshotAnchor,
+} from '~/utils';
+import { useLatestMessageId } from '~/hooks/Messages/useLatestMessage';
+import { useContextProjectionQuery } from '~/data-provider';
+import useTokenLimits from './useTokenLimits';
+
+export interface TokenUsageParams {
+  index: number;
+  conversation: TConversation | null;
+  isSubmitting: boolean;
+}
+
+export interface TokenUsageView {
+  usedTokens: number;
+  maxTokens?: number;
+  /** 0–100, clamped; 0 when max is unknown */
+  percent: number;
+  /** True when derived from per-message counts instead of a backend snapshot */
+  isEstimate: boolean;
+  snapshot: ContextSnapshot | null;
+  snapshotActive: boolean;
+  branchTotals: BranchTotals;
+  /** Provider usage along the active branch (matches the gauge), incl. in-flight */
+  branchUsage: BranchUsage;
+  /** Provider usage across all branches of the conversation */
+  totalUsage: BranchUsage;
+  /** Whether any usage is available to display (branch has token usage) */
+  hasUsage: boolean;
+  /** Authoritative branch cost; the cost row is gated on `interface.contextCost` at render */
+  branchCost: number;
+  /** Authoritative cost across all branches (shown when it differs from branch) */
+  totalCost: number;
+  liveTokens: number;
+  rates?: TModelTokenomics;
+}
+
+/**
+ * View-model for the context usage indicator. Mount only inside the
+ * indicator so its subscriptions never re-render the chat tree.
+ */
+export default function useTokenUsage({
+  index,
+  conversation,
+  isSubmitting,
+}: TokenUsageParams): TokenUsageView {
+  const queryClient = useQueryClient();
+  const conversationKey = conversation?.conversationId ?? Constants.NEW_CONVO;
+
+  const tailId = useLatestMessageId(index);
+  const snapshot = useAtomValue(contextSnapshotFamily(conversationKey));
+  const snapshotsByAnchor = useAtomValue(snapshotsByAnchorFamily(conversationKey));
+  const pendingUsage = useAtomValue(pendingUsageFamily(conversationKey));
+  const totalUsageBase = useAtomValue(totalUsageFamily(conversationKey));
+  const branchTotals = useAtomValue(branchTotalsFamily(conversationKey));
+  const liveTokens = useAtomValue(liveTokensFamily(conversationKey));
+  const setBranchTotals = useSetAtom(branchTotalsFamily(conversationKey));
+  const setTotalUsage = useSetAtom(totalUsageFamily(conversationKey));
+  const limits = useTokenLimits(conversation);
+
+  /** Deepest persisted/live snapshot on the viewed branch (present only for
+   *  turns generated with the feature on). Gates the projection fetch and is a
+   *  render source. */
+  const branchSnapshot = useMemo(() => {
+    if (snapshotsByAnchor.size === 0) {
+      return null;
+    }
+    const anchor = findBranchSnapshotAnchor(
+      conversationKey,
+      branchTotals.tailId,
+      snapshotsByAnchor,
+    );
+    return anchor != null ? (snapshotsByAnchor.get(anchor) ?? null) : null;
+  }, [conversationKey, branchTotals.tailId, snapshotsByAnchor]);
+
+  const resolvedMax = limits.maxContextTokens;
+
+  /** Project the branch (agents SDK, no model call) ONLY when no persisted/live
+   *  snapshot covers it — snapshot-less branches (G2: pre-feature history,
+   *  imports, never-generated branches). A present snapshot stays authoritative;
+   *  reliable window-switch (G1) detection needs the snapshot to carry its
+   *  model/window (deferred to the fidelity follow-up), and the SDK window
+   *  (reserve-derived) doesn't equal the client-resolved raw window, so we must
+   *  NOT mis-flag a valid snapshot as stale here. Cached + refetched by branch/
+   *  endpoint/model/window/revision. */
+  const projectionParams: TContextProjectionRequest | null =
+    !isSubmitting &&
+    branchSnapshot == null &&
+    conversation?.conversationId != null &&
+    conversation.conversationId !== Constants.NEW_CONVO &&
+    branchTotals.tailId != null &&
+    conversation.endpoint != null
+      ? {
+          conversationId: conversation.conversationId,
+          messageId: branchTotals.tailId,
+          /** Resolved provider/model (e.g. an agent's actual provider, not the
+           *  `agents` endpoint) so the server picks the right tokenizer. */
+          endpoint: limits.endpoint || conversation.endpoint,
+          model: limits.model || conversation.model || undefined,
+          agentId: conversation.agent_id ?? undefined,
+          spec: conversation.spec ?? undefined,
+          maxContextTokens: resolvedMax,
+          /** Content revision so an in-place message edit (same tail id) refetches. */
+          revision: branchTotals.input + branchTotals.output,
+        }
+      : null;
+  const { data: projectionData } = useContextProjectionQuery(projectionParams);
+  const projection = projectionData ?? null;
+
+  /** Branch/total provider usage is index-derived; the in-flight response is
+   *  the only live add (the pending holder), counted into both — it sits on the
+   *  active branch tail and inside the conversation. The backend prices each
+   *  call (premium tiers, cache rates), so cost sums authoritatively. */
+  const pendingAsUsage: BranchUsage = useMemo(
+    () => ({
+      input: pendingUsage.input,
+      output: pendingUsage.output,
+      cacheWrite: pendingUsage.cacheWrite,
+      cacheRead: pendingUsage.cacheRead,
+      cost: pendingUsage.costUSD,
+      costKnown: pendingUsage.costKnown,
+    }),
+    [pendingUsage],
+  );
+  const branchUsage = useMemo(
+    () => mergeUsage(branchTotals.usage, pendingAsUsage),
+    [branchTotals.usage, pendingAsUsage],
+  );
+  const totalUsage = useMemo(
+    () => mergeUsage(totalUsageBase, pendingAsUsage),
+    [totalUsageBase, pendingAsUsage],
+  );
+  const hasUsage =
+    branchUsage.input + branchUsage.output + branchUsage.cacheRead + branchUsage.cacheWrite > 0;
+
+  const isSubmittingRef = useRef(isSubmitting);
+  isSubmittingRef.current = isSubmitting;
+  const tailIdRef = useRef(tailId);
+  tailIdRef.current = tailId;
+  const anchorId = snapshot?.anchorMessageId ?? null;
+  const anchorIdRef = useRef(anchorId);
+  anchorIdRef.current = anchorId;
+
+  useEffect(() => {
+    /** Cache `updated` events fire on every state transition — rebuild the
+     *  O(n) index only when the data snapshot reference actually changed */
+    let lastIndexed: TMessage[] | undefined;
+    const rebuild = (messages?: TMessage[]) => {
+      if (messages === lastIndexed && messages !== undefined) {
+        return;
+      }
+      lastIndexed = messages;
+      buildIndex(conversationKey, messages);
+      /** Restore each branch's persisted breakdown (Part A) without clobbering
+       *  a live finalized snapshot for the same response id. */
+      hydrateSnapshots(conversationKey, messages);
+      setBranchTotals(sumBranch(conversationKey, tailIdRef.current, anchorIdRef.current));
+      setTotalUsage(sumTotalUsage(conversationKey));
+    };
+
+    rebuild(queryClient.getQueryData<TMessage[]>([QueryKeys.messages, conversationKey]));
+
+    const unsubscribe = queryClient.getQueryCache().subscribe((event) => {
+      if (isSubmittingRef.current || event.type !== 'updated') {
+        return;
+      }
+      const queryKey = event.query.queryKey;
+      if (
+        !Array.isArray(queryKey) ||
+        queryKey[0] !== QueryKeys.messages ||
+        queryKey[1] !== conversationKey
+      ) {
+        return;
+      }
+      rebuild(event.query.state.data as TMessage[] | undefined);
+    });
+    return () => {
+      unsubscribe();
+      /** Bound memory to open conversations — drop this one's token index and
+       *  usage atoms on switch/unmount; both rebuild from the query cache on
+       *  return. NEW_CONVO is migrated to its real id by finalizeUsage, so
+       *  leave it alone to avoid racing that handoff. */
+      if (conversationKey !== Constants.NEW_CONVO) {
+        clearIndex(conversationKey);
+        removeUsageAtoms(conversationKey);
+      }
+    };
+  }, [conversationKey, queryClient, setBranchTotals, setTotalUsage]);
+
+  useEffect(() => {
+    /** Re-index from the cache on every tail change (created/finalize during a
+     *  stream AND branch switches). Branch switches don't fire a cache `updated`
+     *  event, so the subscriber below can't catch them; without rebuilding here
+     *  the index stays on whatever the last stream left it — which may have
+     *  dropped the now-viewed branch's response, so sumBranch would find no
+     *  tokens/usage and the gauge + branch cost would blank out. Bounded: tailId
+     *  only shifts on created/finalize/branch-switch, never per chunk. Usage for
+     *  responses whose cache message lacks `metadata.usage` is restored from the
+     *  sticky history inside buildIndex. */
+    buildIndex(
+      conversationKey,
+      queryClient.getQueryData<TMessage[]>([QueryKeys.messages, conversationKey]),
+    );
+    setBranchTotals(sumBranch(conversationKey, tailId, anchorId));
+    setTotalUsage(sumTotalUsage(conversationKey));
+  }, [conversationKey, tailId, anchorId, setBranchTotals, setTotalUsage, queryClient]);
+
+  return useMemo(() => {
+    /** The granular snapshot is for one specific generation. Show the live one
+     *  while streaming, or when its (response-message) anchor is on the viewed
+     *  branch. A null-anchor snapshot must NOT match every branch — that leaked
+     *  one branch's breakdown onto its siblings. */
+    const currentActive =
+      snapshot != null &&
+      (isSubmitting || (snapshot.anchorMessageId != null && branchTotals.containsAnchor));
+
+    /** Precedence: live/active snapshot → persisted branch snapshot → server
+     *  projection (snapshot-less branches, G2) → per-message estimate. The first
+     *  two preserve the pre-projection behavior exactly; the projection only
+     *  slots in ahead of the estimate when no snapshot exists. Snapshot and
+     *  projection share the render-relevant fields, so they render uniformly. */
+    let effective: ContextSnapshot | TContextUsageEvent | null = null;
+    /** A server projection is the SDK's windowing but, in this first cut, omits
+     *  instruction/tool overhead — so it's surfaced as an ESTIMATE (a better one
+     *  than sumBranch), never a false-authoritative number. Real snapshots stay
+     *  authoritative. */
+    let projected = false;
+    if (currentActive) {
+      effective = snapshot;
+    } else if (branchSnapshot != null) {
+      effective = branchSnapshot;
+    } else if (projection != null) {
+      effective = projection;
+      projected = true;
+    }
+
+    if (effective != null) {
+      const breakdown = effective.breakdown;
+      const maxTokens = effective.contextBudget ?? breakdown.maxContextTokens;
+      const instructionTokens = effective.effectiveInstructionTokens ?? breakdown.instructionTokens;
+      const baseUsed =
+        effective.remainingContextTokens != null
+          ? maxTokens - effective.remainingContextTokens
+          : instructionTokens + breakdown.messageTokens;
+      /** The snapshot/projection is pre-invoke: in-flight output rides on
+       *  `liveTokens` (0 unless streaming this branch), the last call's finalized
+       *  output on `completedOutputTokens` (absent on a projection → 0). */
+      const usedTokens =
+        Math.max(0, baseUsed) + liveTokens + (effective.completedOutputTokens ?? 0);
+      return {
+        usedTokens,
+        maxTokens,
+        percent: maxTokens > 0 ? Math.min((usedTokens / maxTokens) * 100, 100) : 0,
+        isEstimate: projected,
+        snapshot: projected ? null : (effective as ContextSnapshot),
+        snapshotActive: !projected,
+        branchTotals,
+        branchUsage,
+        totalUsage,
+        hasUsage,
+        branchCost: branchUsage.cost,
+        totalCost: totalUsage.cost,
+        liveTokens,
+        rates: limits.rates,
+      };
+    }
+
+    /** `summaryBaseline` is the compacted-context size from the deepest
+     *  summarized response on the branch (0 if none). The branch walk stops
+     *  there, so input/output are post-summary only — adding the baseline keeps
+     *  the estimate from re-summing the discarded pre-summary history (which
+     *  otherwise pins the gauge at 100% forever after a compaction). */
+    const usedTokens =
+      branchTotals.input + branchTotals.output + branchTotals.summaryBaseline + liveTokens;
+    const maxTokens = limits.maxContextTokens;
+    return {
+      usedTokens,
+      maxTokens,
+      percent:
+        maxTokens != null && maxTokens > 0 ? Math.min((usedTokens / maxTokens) * 100, 100) : 0,
+      isEstimate: true,
+      snapshot: null,
+      snapshotActive: false,
+      branchTotals,
+      branchUsage,
+      totalUsage,
+      hasUsage,
+      branchCost: branchUsage.cost,
+      totalCost: totalUsage.cost,
+      liveTokens,
+      rates: limits.rates,
+    };
+  }, [
+    snapshot,
+    isSubmitting,
+    branchTotals,
+    branchUsage,
+    totalUsage,
+    hasUsage,
+    liveTokens,
+    limits,
+    branchSnapshot,
+    projection,
+  ]);
+}
diff --git a/client/src/hooks/Config/__tests__/useAppStartup.spec.tsx b/client/src/hooks/Config/__tests__/useAppStartup.spec.tsx
index dd767260d8a..b5ad9afa696 100644
--- a/client/src/hooks/Config/__tests__/useAppStartup.spec.tsx
+++ b/client/src/hooks/Config/__tests__/useAppStartup.spec.tsx
@@ -4,14 +4,20 @@ import { renderHook } from '@testing-library/react';
 import { PermissionTypes, Permissions } from 'librechat-data-provider';
 import type { TUser } from 'librechat-data-provider';
 
+type CloudFrontRetryOptions = { getAuthorizationHeader: () => string | undefined };
+
 const mockUseHasAccess = jest.fn();
 const mockUseMCPServersQuery = jest.fn();
 const mockUseMCPToolsQuery = jest.fn();
-const mockInstallCloudFrontImageRetry = jest.fn(() => jest.fn());
+const mockInstallCloudFrontImageRetry = jest.fn(
+  (_startupConfig: unknown, _options: CloudFrontRetryOptions): (() => void) =>
+    () =>
+      undefined,
+);
 const mockGetTokenHeader = jest.fn();
 
 jest.mock('@librechat/client', () => ({
-  installCloudFrontImageRetry: (startupConfig: unknown, options: unknown) =>
+  installCloudFrontImageRetry: (startupConfig: unknown, options: CloudFrontRetryOptions) =>
     mockInstallCloudFrontImageRetry(startupConfig, options),
 }));
 
diff --git a/client/src/hooks/Conversations/useNavigateToConvo.tsx b/client/src/hooks/Conversations/useNavigateToConvo.tsx
index c8e7aa0b05f..390f5b77d78 100644
--- a/client/src/hooks/Conversations/useNavigateToConvo.tsx
+++ b/client/src/hooks/Conversations/useNavigateToConvo.tsx
@@ -119,6 +119,14 @@ const useNavigateToConvo = (index = 0) => {
     clearAllConversations(true);
     clearMessagesCache(queryClient, currentConvoId);
     if (convo.conversationId !== Constants.NEW_CONVO && convo.conversationId) {
+      /**
+       * Remove (not just invalidate) the target's messages so a freshly-mounted
+       * ChatView refetches them. A prior `clearMessagesCache` can leave this
+       * conversation cached as `[]`, which the messages query's `refetchOnMount: false`
+       * would treat as valid — leaving the chat stuck on an empty cache with no
+       * request when navigating in from a non-chat route (e.g. /projects).
+       */
+      queryClient.removeQueries([QueryKeys.messages, convo.conversationId]);
       queryClient.invalidateQueries([QueryKeys.conversation, convo.conversationId]);
       fetchFreshData(convo);
     } else {
diff --git a/client/src/hooks/Conversations/usePresetIndexOptions.ts b/client/src/hooks/Conversations/usePresetIndexOptions.ts
index 9824adef8cd..fda972a6d36 100644
--- a/client/src/hooks/Conversations/usePresetIndexOptions.ts
+++ b/client/src/hooks/Conversations/usePresetIndexOptions.ts
@@ -41,7 +41,7 @@ const usePresetIndexOptions: TUsePresetOptions = (_preset) => {
   const setExample: TSetExample = (i, type, newValue = null) => {
     const update = {};
     const current = preset?.examples?.slice() || [];
-    const currentExample = { ...current[i] } || {};
+    const currentExample = { ...current[i] };
     currentExample[type] = { content: newValue };
     current[i] = currentExample;
     update['examples'] = current;
diff --git a/client/src/hooks/Endpoint/UnknownIcon.tsx b/client/src/hooks/Endpoint/UnknownIcon.tsx
index be7531a34a2..e7b245a797f 100644
--- a/client/src/hooks/Endpoint/UnknownIcon.tsx
+++ b/client/src/hooks/Endpoint/UnknownIcon.tsx
@@ -4,28 +4,49 @@ import { CustomMinimalIcon, XAIcon, MoonshotIcon } from '@librechat/client';
 import { IconContext } from '~/common';
 import { cn } from '~/utils';
 
-const knownEndpointAssets = {
+const knownEndpointAssets: Record<string, string> = {
   [KnownEndpoints.anyscale]: 'assets/anyscale.png',
   [KnownEndpoints.apipie]: 'assets/apipie.png',
   [KnownEndpoints.cohere]: 'assets/cohere.png',
   [KnownEndpoints.deepseek]: 'assets/deepseek.svg',
   [KnownEndpoints.fireworks]: 'assets/fireworks.png',
-  [KnownEndpoints.google]: 'assets/google.svg',
+  google: 'assets/google.svg',
   [KnownEndpoints.groq]: 'assets/groq.png',
-  [KnownEndpoints.helicone]: 'assets/helicone.png',
+  [KnownEndpoints.helicone]: 'assets/helicone.svg',
   [KnownEndpoints.huggingface]: 'assets/huggingface.svg',
   [KnownEndpoints.mistral]: 'assets/mistral.png',
   [KnownEndpoints.mlx]: 'assets/mlx.png',
   [KnownEndpoints.ollama]: 'assets/ollama.png',
-  [KnownEndpoints.openai]: 'assets/openai.svg',
+  openai: 'assets/openai.svg',
   [KnownEndpoints.openrouter]: 'assets/openrouter.png',
   [KnownEndpoints.perplexity]: 'assets/perplexity.png',
-  [KnownEndpoints.qwen]: 'assets/qwen.svg',
+  qwen: 'assets/qwen.svg',
   [KnownEndpoints.shuttleai]: 'assets/shuttleai.png',
   [KnownEndpoints['together.ai']]: 'assets/together.png',
   [KnownEndpoints.unify]: 'assets/unify.webp',
 };
 
+const knownEndpointComponents = new Set<string>([KnownEndpoints.moonshot, KnownEndpoints.xai]);
+
+export function getKnownEndpointAsset(endpoint?: string | null): string {
+  if (!endpoint) {
+    return '';
+  }
+
+  return knownEndpointAssets[endpoint.toLowerCase()] ?? '';
+}
+
+export function hasKnownEndpointIcon(endpoint?: string | null): boolean {
+  if (!endpoint) {
+    return false;
+  }
+
+  const currentEndpoint = endpoint.toLowerCase();
+  return (
+    getKnownEndpointAsset(currentEndpoint) !== '' || knownEndpointComponents.has(currentEndpoint)
+  );
+}
+
 const knownEndpointClasses = {
   [KnownEndpoints.cohere]: {
     [IconContext.landing]: 'p-2',
@@ -81,7 +102,7 @@ function UnknownIcon({
     return <img className={className} src={iconURL} alt={`${endpoint} Icon`} />;
   }
 
-  const assetPath: string = knownEndpointAssets[currentEndpoint] ?? '';
+  const assetPath = getKnownEndpointAsset(currentEndpoint);
 
   if (!assetPath) {
     return <CustomMinimalIcon className={className} />;
diff --git a/client/src/hooks/Endpoint/useEndpoints.ts b/client/src/hooks/Endpoint/useEndpoints.ts
index dc72c0ddec6..6cec38dc2fe 100644
--- a/client/src/hooks/Endpoint/useEndpoints.ts
+++ b/client/src/hooks/Endpoint/useEndpoints.ts
@@ -16,9 +16,9 @@ import type {
   Agent,
 } from 'librechat-data-provider';
 import type { Endpoint } from '~/common';
+import { useHasAccess, useShowMarketplace } from '~/hooks';
 import { useGetEndpointsQuery } from '~/data-provider';
 import { mapEndpoints, getIconKey } from '~/utils';
-import { useHasAccess } from '~/hooks';
 import { icons } from './Icons';
 
 const defaultInterface = getConfigDefaults().interface;
@@ -46,6 +46,7 @@ export const useEndpoints = ({
     permissionType: PermissionTypes.AGENTS,
     permission: Permissions.USE,
   });
+  const showAgentMarketplace = useShowMarketplace();
 
   const assistants: Assistant[] = useMemo(
     () => Object.values(assistantsMap?.[EModelEndpoint.assistants] ?? {}),
@@ -83,18 +84,22 @@ export const useEndpoints = ({
   );
 
   const mappedEndpoints: Endpoint[] = useMemo(() => {
-    return filteredEndpoints.map((ep) => {
+    return filteredEndpoints.reduce<Endpoint[]>((acc, ep) => {
       const endpointType = getEndpointField(endpointsConfig, ep, 'type');
       const iconKey = getIconKey({ endpoint: ep, endpointsConfig, endpointType });
       const Icon = icons[iconKey];
       const endpointIconURL = getEndpointField(endpointsConfig, ep, 'iconURL');
       const hasModels =
-        (ep === EModelEndpoint.agents && (agents?.length ?? 0) > 0) ||
+        (ep === EModelEndpoint.agents && ((agents?.length ?? 0) > 0 || showAgentMarketplace)) ||
         (ep === EModelEndpoint.assistants && assistants?.length > 0) ||
         (ep !== EModelEndpoint.assistants &&
           ep !== EModelEndpoint.agents &&
           (modelsQuery.data?.[ep]?.length ?? 0) > 0);
 
+      if (ep === EModelEndpoint.agents && !hasModels) {
+        return acc;
+      }
+
       // Base result object with formatted default icon
       const result: Endpoint = {
         value: ep,
@@ -110,6 +115,11 @@ export const useEndpoints = ({
           : null,
       };
 
+      if (ep === EModelEndpoint.agents && showAgentMarketplace) {
+        result.showMarketplace = true;
+        result.searchAliases = ['agent marketplace', 'marketplace'];
+      }
+
       // Handle agents case
       if (ep === EModelEndpoint.agents && (agents?.length ?? 0) > 0) {
         result.models = agents?.map((agent) => ({
@@ -179,9 +189,18 @@ export const useEndpoints = ({
         }));
       }
 
-      return result;
-    });
-  }, [filteredEndpoints, endpointsConfig, modelsQuery.data, agents, assistants, azureAssistants]);
+      acc.push(result);
+      return acc;
+    }, []);
+  }, [
+    agents,
+    assistants,
+    azureAssistants,
+    endpointsConfig,
+    filteredEndpoints,
+    modelsQuery.data,
+    showAgentMarketplace,
+  ]);
 
   return {
     mappedEndpoints,
diff --git a/client/src/hooks/Files/__tests__/useAttachmentPreviewSync.spec.tsx b/client/src/hooks/Files/__tests__/useAttachmentPreviewSync.spec.tsx
index 096ec9fd832..85eb353bebd 100644
--- a/client/src/hooks/Files/__tests__/useAttachmentPreviewSync.spec.tsx
+++ b/client/src/hooks/Files/__tests__/useAttachmentPreviewSync.spec.tsx
@@ -16,12 +16,20 @@
  */
 
 import { useEffect } from 'react';
+import { Tools } from 'librechat-data-provider';
 import { renderHook } from '@testing-library/react';
 import { RecoilRoot, useRecoilValue, useSetRecoilState } from 'recoil';
+import type {
+  TAttachment,
+  TFile,
+  TAttachmentMetadata,
+  TFilePreview,
+} from 'librechat-data-provider';
 import type { ReactNode } from 'react';
-import type { TAttachment, TFilePreview } from 'librechat-data-provider';
 import store from '~/store';
 
+type AttachmentFixture = TFile & TAttachmentMetadata;
+
 const mockUseFilePreview = jest.fn();
 jest.mock('~/data-provider', () => ({
   useFilePreview: (...args: unknown[]) => mockUseFilePreview(...args),
@@ -34,19 +42,24 @@ const wrapper = ({ children }: { children: ReactNode }) => <RecoilRoot>{children
 const messageId = 'msg-1';
 const fileId = 'fid-1';
 
-function makeAttachment(overrides: Partial<TAttachment> = {}): TAttachment {
+function makeAttachment(overrides: Partial<AttachmentFixture> = {}): AttachmentFixture {
   return {
+    user: 'user-1',
+    object: 'file',
+    bytes: 1024,
+    embedded: false,
+    usage: 0,
     file_id: fileId,
     filename: 'data.xlsx',
     filepath: '/uploads/data.xlsx',
-    type: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+    type: Tools.execute_code,
     messageId,
     toolCallId: 'tc-1',
-    text: null,
-    textFormat: null,
+    text: undefined,
+    textFormat: undefined,
     status: 'pending',
     ...overrides,
-  } as unknown as TAttachment;
+  };
 }
 
 /** Read messageAttachmentsMap and bridge it out via a mutable ref. */
@@ -261,7 +274,7 @@ describe('useAttachmentPreviewSync', () => {
         textFormat: 'html',
       },
     });
-    const updated = ctx.map[messageId]?.[0] as TAttachment & { text?: string };
+    const updated = ctx.map[messageId]?.[0] as AttachmentFixture;
     expect(updated.status).toBe('ready');
     expect(updated.text).toBe('<table>final</table>');
     expect(ctx.result.current.status).toBe('ready');
@@ -277,7 +290,7 @@ describe('useAttachmentPreviewSync', () => {
         previewError: 'parser-error',
       },
     });
-    const updated = ctx.map[messageId]?.[0] as TAttachment & { previewError?: string };
+    const updated = ctx.map[messageId]?.[0] as AttachmentFixture;
     expect(updated.status).toBe('failed');
     expect(updated.previewError).toBe('parser-error');
     expect(ctx.result.current.status).toBe('failed');
@@ -293,7 +306,7 @@ describe('useAttachmentPreviewSync', () => {
     /* Map should be unchanged from the initial seed — no patch. */
     const list = ctx.map[messageId] ?? [];
     expect(list).toHaveLength(1);
-    expect((list[0] as TAttachment & { status?: string }).status).toBe('pending');
+    expect((list[0] as AttachmentFixture).status).toBe('pending');
   });
 
   it('reports isPolling true when the query is fetching and the gate is open', () => {
@@ -336,7 +349,7 @@ describe('useAttachmentPreviewSync', () => {
     });
     const list = ctx.map[messageId] ?? [];
     expect(list).toHaveLength(1);
-    const inserted = list[0] as TAttachment & { text?: string; textFormat?: string };
+    const inserted = list[0] as AttachmentFixture;
     expect(inserted.file_id).toBe(fileId);
     expect(inserted.status).toBe('ready');
     expect(inserted.text).toBe('<table>resolved-on-reload</table>');
@@ -361,7 +374,7 @@ describe('useAttachmentPreviewSync', () => {
     });
     const list = ctx.map[messageId] ?? [];
     expect(list).toHaveLength(1);
-    const inserted = list[0] as TAttachment & { previewError?: string };
+    const inserted = list[0] as AttachmentFixture;
     expect(inserted.status).toBe('failed');
     expect(inserted.previewError).toBe('render-timeout');
   });
diff --git a/client/src/hooks/Files/__tests__/useFileHandling.test.ts b/client/src/hooks/Files/__tests__/useFileHandling.test.ts
index 1583c1d0219..d7bd6eb7133 100644
--- a/client/src/hooks/Files/__tests__/useFileHandling.test.ts
+++ b/client/src/hooks/Files/__tests__/useFileHandling.test.ts
@@ -4,11 +4,27 @@ import { Constants, EModelEndpoint, getEndpointFileConfig } from 'librechat-data
 beforeAll(() => {
   global.URL.createObjectURL = jest.fn(() => 'blob:mock-url');
   global.URL.revokeObjectURL = jest.fn();
+  Object.defineProperty(global, 'Image', {
+    writable: true,
+    value: class {
+      width = 640;
+      height = 480;
+      onload: (() => void) | null = null;
+
+      set src(_src: string) {
+        queueMicrotask(() => this.onload?.());
+      }
+    },
+  });
 });
 
 const mockShowToast = jest.fn();
 const mockSetFilesLoading = jest.fn();
 const mockMutate = jest.fn();
+const mockProcessFileForUpload = jest.fn(
+  async (_file: File, _quality?: number, _onProgress?: (progress: number) => void) => _file,
+);
+const mockLocalize = jest.fn((key: string) => key);
 
 let mockConversation: Record<string, string | null | undefined> = {};
 let mockIsTemporary = false;
@@ -55,7 +71,7 @@ jest.mock('~/data-provider', () => ({
 }));
 
 jest.mock('~/hooks/useLocalize', () => {
-  const fn = jest.fn((key: string) => key) as jest.Mock & {
+  const fn = jest.fn(() => mockLocalize) as jest.Mock & {
     TranslationKeys: Record<string, never>;
   };
   fn.TranslationKeys = {};
@@ -70,7 +86,7 @@ jest.mock('../useDelayedUploadToast', () => ({
 }));
 
 jest.mock('~/utils/heicConverter', () => ({
-  processFileForUpload: jest.fn(async (file: File) => file),
+  processFileForUpload: mockProcessFileForUpload,
 }));
 
 jest.mock('../useClientResize', () => ({
@@ -98,12 +114,11 @@ jest.mock('~/utils', () => ({
 }));
 
 const mockValidateFiles = jest.requireMock('~/utils').validateFiles;
-const mockProcessFileForUpload = jest.requireMock('~/utils/heicConverter')
-  .processFileForUpload as jest.Mock;
 
 describe('useFileHandling', () => {
   beforeEach(() => {
     jest.clearAllMocks();
+    mockProcessFileForUpload.mockImplementation(async (file: File) => file);
     mockConversation = {};
     mockIsTemporary = false;
   });
@@ -111,7 +126,7 @@ describe('useFileHandling', () => {
   const loadHook = async () => (await import('../useFileHandling')).default;
 
   describe('endpointOverride', () => {
-    it('checks possible image uploads for HEIC conversion without HEIC metadata', async () => {
+    it('uploads non-HEIC images without running HEIC conversion', async () => {
       const useFileHandling = await loadHook();
       const { result } = renderHook(() => useFileHandling());
 
@@ -121,8 +136,8 @@ describe('useFileHandling', () => {
         await result.current.handleFiles([imageFile]);
       });
 
-      expect(mockProcessFileForUpload).toHaveBeenCalledTimes(1);
-      expect(mockProcessFileForUpload).toHaveBeenCalledWith(imageFile, 0.9, expect.any(Function));
+      expect(mockProcessFileForUpload).not.toHaveBeenCalled();
+      expect(mockMutate).toHaveBeenCalledTimes(1);
     });
 
     it('uses conversation endpoint when no override is provided', async () => {
@@ -388,5 +403,36 @@ describe('useFileHandling', () => {
       expect(formData.get('conversationId')).toBeNull();
       expect(formData.get('isTemporary')).toBeNull();
     });
+
+    it('awaits HEIC conversion before uploading the converted file', async () => {
+      const convertedFile = new File(['jpeg data'], 'photo.jpg', { type: 'image/jpeg' });
+      mockProcessFileForUpload.mockImplementationOnce(
+        async (_file: File, _quality?: number, onProgress?: (progress: number) => void) => {
+          onProgress?.(1);
+          return convertedFile;
+        },
+      );
+
+      const useFileHandling = await loadHook();
+      const { result } = renderHook(() => useFileHandling());
+
+      const heicFile = new File(['heic data'], 'photo.bin', { type: 'image/heic' });
+
+      await act(async () => {
+        await result.current.handleFiles([heicFile]);
+      });
+
+      expect(mockShowToast).toHaveBeenCalledWith({
+        message: 'com_info_heic_converting',
+        status: 'info',
+        duration: 3000,
+      });
+      expect(mockProcessFileForUpload).toHaveBeenCalledWith(heicFile, 0.9, expect.any(Function));
+      expect(mockMutate).toHaveBeenCalledTimes(1);
+      const formData: FormData = mockMutate.mock.calls[0][0];
+      const uploadedFile = formData.get('file') as File;
+      expect(uploadedFile.name).toBe('photo.jpg');
+      expect(uploadedFile.type).toBe('image/jpeg');
+    });
   });
 });
diff --git a/client/src/hooks/Files/useDragHelpers.ts b/client/src/hooks/Files/useDragHelpers.ts
index 7c6c3bd1557..847884c9882 100644
--- a/client/src/hooks/Files/useDragHelpers.ts
+++ b/client/src/hooks/Files/useDragHelpers.ts
@@ -83,7 +83,7 @@ export default function useDragHelpers() {
         currentEndpoint,
         agent?.provider,
       );
-      const cfg = queryClient.getQueryData<t.FileConfig>([QueryKeys.fileConfig]);
+      const cfg = queryClient.getQueryData<t.TFileConfig>([QueryKeys.fileConfig]);
       if (cfg) {
         const mergedCfg = mergeFileConfig(cfg);
         const endpointCfg = getEndpointFileConfig({
diff --git a/client/src/hooks/Files/useFileHandling.ts b/client/src/hooks/Files/useFileHandling.ts
index 9a26c219b92..2608a45e11f 100644
--- a/client/src/hooks/Files/useFileHandling.ts
+++ b/client/src/hooks/Files/useFileHandling.ts
@@ -1,8 +1,9 @@
 import React, { useCallback, useEffect, useRef, useMemo, useState } from 'react';
 import { v4 } from 'uuid';
-import { useRecoilValue, useSetRecoilState } from 'recoil';
+import debounce from 'lodash/debounce';
 import { useToastContext } from '@librechat/client';
 import { useQueryClient } from '@tanstack/react-query';
+import { useRecoilValue, useSetRecoilState } from 'recoil';
 import {
   QueryKeys,
   Constants,
@@ -12,10 +13,9 @@ import {
   getEndpointFileConfig,
   defaultAssistantsVersion,
 } from 'librechat-data-provider';
-import debounce from 'lodash/debounce';
 import type { EModelEndpoint, TEndpointsConfig, TError } from 'librechat-data-provider';
-import type { ExtendedFile, FileSetter } from '~/common';
 import type { TConversation } from 'librechat-data-provider';
+import type { ExtendedFile, FileSetter } from '~/common';
 import { logger, validateFiles, cachePreview, getCachedPreview, removePreviewEntry } from '~/utils';
 import { useGetFileConfig, useUploadFileMutation } from '~/data-provider';
 import useLocalize, { TranslationKeys } from '~/hooks/useLocalize';
@@ -345,9 +345,6 @@ const useFileHandlingCore = (params: UseFileHandling | undefined, fileState: Fil
           originalFile.type === 'image/heic' ||
           originalFile.type === 'image/heif' ||
           /\.(heic|heif)$/.test(originalFileName);
-        const isPossibleImage =
-          originalFile.type.startsWith('image/') ||
-          /\.(avif|bmp|gif|heic|heif|jpe?g|png|svg|tiff?|webp)$/.test(originalFileName);
 
         if (isHEIC) {
           showToast({
@@ -357,7 +354,7 @@ const useFileHandlingCore = (params: UseFileHandling | undefined, fileState: Fil
           });
         }
 
-        const heicProcessedFile = isPossibleImage
+        const heicProcessedFile = isHEIC
           ? await import('~/utils/heicConverter').then(({ processFileForUpload }) =>
               processFileForUpload(originalFile, 0.9, (conversionProgress) => {
                 const adjustedProgress = 0.1 + conversionProgress * 0.4;
diff --git a/client/src/hooks/Generic/__tests__/useElementSize.spec.tsx b/client/src/hooks/Generic/__tests__/useElementSize.spec.tsx
new file mode 100644
index 00000000000..57a08edc02d
--- /dev/null
+++ b/client/src/hooks/Generic/__tests__/useElementSize.spec.tsx
@@ -0,0 +1,115 @@
+import { renderHook, act } from '@testing-library/react';
+import useElementSize from '../useElementSize';
+
+class MockResizeObserver {
+  static instances: MockResizeObserver[] = [];
+  callback: ResizeObserverCallback;
+  observed: Element[] = [];
+  disconnected = false;
+
+  constructor(callback: ResizeObserverCallback) {
+    this.callback = callback;
+    MockResizeObserver.instances.push(this);
+  }
+
+  observe(element: Element) {
+    this.observed.push(element);
+  }
+
+  unobserve() {}
+
+  disconnect() {
+    this.disconnected = true;
+  }
+
+  trigger(contentRect: { width: number; height: number }) {
+    this.callback(
+      [{ contentRect, target: this.observed[0] } as ResizeObserverEntry],
+      this as unknown as ResizeObserver,
+    );
+  }
+}
+
+describe('useElementSize', () => {
+  const originalResizeObserver = window.ResizeObserver;
+
+  beforeEach(() => {
+    MockResizeObserver.instances = [];
+    window.ResizeObserver = MockResizeObserver as unknown as typeof ResizeObserver;
+  });
+
+  afterAll(() => {
+    window.ResizeObserver = originalResizeObserver;
+  });
+
+  it('reports zero size before an element is attached', () => {
+    const { result } = renderHook(() => useElementSize<HTMLDivElement>());
+    expect(result.current.width).toBe(0);
+    expect(result.current.height).toBe(0);
+  });
+
+  it('observes the attached element and reports floored content-box size', () => {
+    const { result } = renderHook(() => useElementSize<HTMLDivElement>());
+    const node = document.createElement('div');
+
+    act(() => result.current.ref(node));
+
+    const observer = MockResizeObserver.instances[MockResizeObserver.instances.length - 1];
+    expect(observer.observed).toContain(node);
+
+    act(() => observer.trigger({ width: 320.6, height: 480.2 }));
+    expect(result.current.width).toBe(320);
+    expect(result.current.height).toBe(480);
+
+    act(() => observer.trigger({ width: 360, height: 480 }));
+    expect(result.current.width).toBe(360);
+  });
+
+  it('re-observes when the element remounts', () => {
+    const { result } = renderHook(() => useElementSize<HTMLDivElement>());
+    const first = document.createElement('div');
+    const second = document.createElement('div');
+
+    act(() => result.current.ref(first));
+    const firstObserver = MockResizeObserver.instances[MockResizeObserver.instances.length - 1];
+
+    act(() => result.current.ref(null));
+    expect(firstObserver.disconnected).toBe(true);
+
+    act(() => result.current.ref(second));
+    const secondObserver = MockResizeObserver.instances[MockResizeObserver.instances.length - 1];
+    expect(secondObserver).not.toBe(firstObserver);
+    expect(secondObserver.observed).toContain(second);
+  });
+
+  it('disconnects the observer on unmount', () => {
+    const { result, unmount } = renderHook(() => useElementSize<HTMLDivElement>());
+    const node = document.createElement('div');
+
+    act(() => result.current.ref(node));
+    const observer = MockResizeObserver.instances[MockResizeObserver.instances.length - 1];
+
+    unmount();
+    expect(observer.disconnected).toBe(true);
+  });
+
+  it('falls back to offset measurements when ResizeObserver is unavailable', () => {
+    window.ResizeObserver = undefined as unknown as typeof ResizeObserver;
+
+    const { result } = renderHook(() => useElementSize<HTMLDivElement>());
+    const node = document.createElement('div');
+    let offsetWidth = 280;
+    Object.defineProperty(node, 'offsetWidth', { get: () => offsetWidth, configurable: true });
+    Object.defineProperty(node, 'offsetHeight', { value: 500 });
+
+    act(() => result.current.ref(node));
+    expect(result.current.width).toBe(280);
+    expect(result.current.height).toBe(500);
+
+    offsetWidth = 320;
+    act(() => {
+      window.dispatchEvent(new Event('resize'));
+    });
+    expect(result.current.width).toBe(320);
+  });
+});
diff --git a/client/src/hooks/Generic/index.ts b/client/src/hooks/Generic/index.ts
index 9674014afa2..2dc02f273b3 100644
--- a/client/src/hooks/Generic/index.ts
+++ b/client/src/hooks/Generic/index.ts
@@ -1,2 +1,3 @@
 export * from './useLazyEffect';
 export { default as useShiftKey } from './useShiftKey';
+export { default as useElementSize } from './useElementSize';
diff --git a/client/src/hooks/Generic/useElementSize.ts b/client/src/hooks/Generic/useElementSize.ts
new file mode 100644
index 00000000000..57587696b36
--- /dev/null
+++ b/client/src/hooks/Generic/useElementSize.ts
@@ -0,0 +1,51 @@
+import { useCallback, useLayoutEffect, useState } from 'react';
+
+interface ElementSize {
+  width: number;
+  height: number;
+}
+
+interface UseElementSizeResult<T extends HTMLElement> {
+  ref: (node: T | null) => void;
+  width: number;
+  height: number;
+}
+
+/**
+ * Tracks an element's content-box size via ResizeObserver. Returns a callback
+ * ref so conditionally rendered elements are re-observed when they remount.
+ */
+export default function useElementSize<T extends HTMLElement>(): UseElementSizeResult<T> {
+  const [node, setNode] = useState<T | null>(null);
+  const [size, setSize] = useState<ElementSize>({ width: 0, height: 0 });
+
+  const ref = useCallback((element: T | null) => setNode(element), []);
+
+  useLayoutEffect(() => {
+    if (!node) {
+      return;
+    }
+    const apply = (width: number, height: number) =>
+      setSize((prev) =>
+        prev.width === width && prev.height === height ? prev : { width, height },
+      );
+    const measure = () => apply(node.offsetWidth, node.offsetHeight);
+
+    measure();
+    if (typeof ResizeObserver === 'undefined') {
+      window.addEventListener('resize', measure);
+      return () => window.removeEventListener('resize', measure);
+    }
+    const observer = new ResizeObserver((entries) => {
+      const entry = entries[entries.length - 1];
+      if (!entry) {
+        return;
+      }
+      apply(Math.floor(entry.contentRect.width), Math.floor(entry.contentRect.height));
+    });
+    observer.observe(node);
+    return () => observer.disconnect();
+  }, [node]);
+
+  return { ref, width: size.width, height: size.height };
+}
diff --git a/client/src/hooks/Input/useQueryParams.ts b/client/src/hooks/Input/useQueryParams.ts
index e37e8991882..4c13ddff2fc 100644
--- a/client/src/hooks/Input/useQueryParams.ts
+++ b/client/src/hooks/Input/useQueryParams.ts
@@ -23,6 +23,8 @@ import { startupConfigKey, useGetAgentByIdQuery } from '~/data-provider';
 import { useChatContext, useChatFormContext } from '~/Providers';
 import store from '~/store';
 
+const PROJECT_ID_SEARCH_PARAM = 'projectId';
+
 const injectAgentIntoAgentsMap = (queryClient: QueryClient, agent: any) => {
   const editCacheKey = [QueryKeys.agents, { requiredPermission: PermissionBits.EDIT }];
   const editCache = queryClient.getQueryData<AgentListResponse>(editCacheKey);
@@ -72,6 +74,15 @@ export default function useQueryParams({
   const urlAgentId = searchParams.get('agent_id') || '';
   const { data: urlAgent } = useGetAgentByIdQuery(urlAgentId);
 
+  const getPreservedSearchParams = useCallback(() => {
+    const preservedParams = new URLSearchParams();
+    const projectId = searchParams.get(PROJECT_ID_SEARCH_PARAM);
+    if (projectId) {
+      preservedParams.set(PROJECT_ID_SEARCH_PARAM, projectId);
+    }
+    return preservedParams;
+  }, [searchParams]);
+
   /**
    * Applies settings from URL query parameters to create a new conversation.
    * Handles model spec lookup, endpoint normalization, and conversation switching logic.
@@ -167,7 +178,11 @@ export default function useQueryParams({
         return;
       }
 
-      newConversation({ preset: newPreset, keepAddedConvos: true });
+      newConversation({
+        template: { chatProjectId: conversation?.chatProjectId ?? null },
+        preset: newPreset,
+        keepAddedConvos: true,
+      });
     },
     [
       queryClient,
@@ -223,8 +238,8 @@ export default function useQueryParams({
       }
     })();
 
-    setSearchParams(new URLSearchParams(), { replace: true });
-  }, [methods, submitMessage, setSearchParams]);
+    setSearchParams(getPreservedSearchParams(), { replace: true });
+  }, [methods, submitMessage, setSearchParams, getPreservedSearchParams]);
 
   useEffect(() => {
     const processQueryParams = () => {
@@ -239,6 +254,7 @@ export default function useQueryParams({
       delete queryParams.prompt;
       delete queryParams.q;
       delete queryParams.submit;
+      delete queryParams[PROJECT_ID_SEARCH_PARAM];
       const validSettings = processValidSettings(queryParams);
 
       return { decodedPrompt, validSettings, shouldAutoSubmit };
@@ -281,7 +297,7 @@ export default function useQueryParams({
 
         // Defer URL cleanup until after submission completes (processSubmission handles it)
         if (!pendingSubmitRef.current) {
-          setSearchParams(new URLSearchParams(), { replace: true });
+          setSearchParams(getPreservedSearchParams(), { replace: true });
         }
       };
 
@@ -349,6 +365,7 @@ export default function useQueryParams({
     newConversation,
     submitMessage,
     setSearchParams,
+    getPreservedSearchParams,
     queryClient,
     processSubmission,
     areSettingsApplied,
diff --git a/client/src/hooks/Input/useSelectMention.ts b/client/src/hooks/Input/useSelectMention.ts
index c0996b29d22..62bd9fe13fe 100644
--- a/client/src/hooks/Input/useSelectMention.ts
+++ b/client/src/hooks/Input/useSelectMention.ts
@@ -1,5 +1,6 @@
-import { useCallback } from 'react';
+import { useCallback, useMemo } from 'react';
 import { useRecoilValue } from 'recoil';
+import { useSearchParams } from 'react-router-dom';
 import { EModelEndpoint, isAgentsEndpoint, isAssistantsEndpoint } from 'librechat-data-provider';
 import type {
   TPreset,
@@ -39,6 +40,16 @@ export default function useSelectMention({
   const getDefaultConversation = useDefaultConvo();
   const modularChat = useRecoilValue(store.modularChat);
   const availableTools = useRecoilValue(store.availableTools);
+  const [searchParams] = useSearchParams();
+  /**
+   * Project scope is read from React Router's search params (the same source the
+   * project chip reads), not window.location — new-chat params are written to the
+   * URL via raw history.pushState, so window.location can drift out of sync.
+   */
+  const routeChatProjectId = useMemo(() => {
+    const projectId = searchParams.get('projectId');
+    return projectId != null && /^[a-f\d]{24}$/i.test(projectId) ? projectId : null;
+  }, [searchParams]);
 
   const onSelectSpec = useCallback(
     (spec?: TModelSpec) => {
@@ -107,7 +118,10 @@ export default function useSelectMention({
 
       logger.info('conversation', 'Switching conversation to new spec', conversation);
       newConversation({
-        template: { ...(template as Partial<TConversation>) },
+        template: {
+          ...(template as Partial<TConversation>),
+          chatProjectId: routeChatProjectId ?? conversation?.chatProjectId ?? null,
+        },
         preset,
         keepAddedConvos: isModular,
       });
@@ -119,6 +133,7 @@ export default function useSelectMention({
       newConversation,
       endpointsConfig,
       assistantsMap,
+      routeChatProjectId,
     ],
   );
 
@@ -201,12 +216,22 @@ export default function useSelectMention({
 
       logger.info('conversation', 'Switching conversation to new endpoint/model', template);
       newConversation({
-        template: { ...(template as Partial<TConversation>) },
+        template: {
+          ...(template as Partial<TConversation>),
+          chatProjectId: routeChatProjectId ?? conversation?.chatProjectId ?? null,
+        },
         preset: { ...kwargs, spec: null, iconURL: null, modelLabel: null, endpoint: newEndpoint },
         keepAddedConvos: isNewModular,
       });
     },
-    [getConversation, getDefaultConversation, modularChat, newConversation, endpointsConfig],
+    [
+      getConversation,
+      getDefaultConversation,
+      modularChat,
+      newConversation,
+      endpointsConfig,
+      routeChatProjectId,
+    ],
   );
 
   const onSelectPreset = useCallback(
@@ -264,6 +289,7 @@ export default function useSelectMention({
 
       logger.info('conversation', 'Switching conversation to new preset', template);
       newConversation({
+        template: { chatProjectId: routeChatProjectId ?? conversation?.chatProjectId ?? null },
         preset: newPreset,
         keepAddedConvos: isModular,
         disableParams,
@@ -276,6 +302,7 @@ export default function useSelectMention({
       newConversation,
       endpointsConfig,
       getDefaultConversation,
+      routeChatProjectId,
     ],
   );
 
diff --git a/client/src/hooks/Input/useSpeechToTextBrowser.ts b/client/src/hooks/Input/useSpeechToTextBrowser.ts
index 373c84d005f..5053e31d546 100644
--- a/client/src/hooks/Input/useSpeechToTextBrowser.ts
+++ b/client/src/hooks/Input/useSpeechToTextBrowser.ts
@@ -1,12 +1,31 @@
-import { useEffect, useRef, useMemo } from 'react';
+import { useCallback, useEffect, useRef } from 'react';
 import { useRecoilState } from 'recoil';
 import { useToastContext } from '@librechat/client';
-import SpeechRecognition, { useSpeechRecognition } from 'react-speech-recognition';
 import { useGetCustomConfigSpeechQuery } from 'librechat-data-provider/react-query';
+import SpeechRecognitionImport, { useSpeechRecognition } from 'react-speech-recognition';
 import useGetAudioSettings from './useGetAudioSettings';
 import { useLocalize } from '~/hooks';
 import store from '~/store';
 
+type SpeechRecognitionController = Pick<
+  typeof SpeechRecognitionImport,
+  'startListening' | 'stopListening'
+>;
+type SpeechRecognitionModule = Partial<SpeechRecognitionController> & {
+  default?: Partial<SpeechRecognitionController>;
+};
+
+const hasSpeechRecognitionController = (
+  controller?: Partial<SpeechRecognitionController>,
+): controller is SpeechRecognitionController =>
+  typeof controller?.startListening === 'function' &&
+  typeof controller.stopListening === 'function';
+
+const speechRecognitionModule = SpeechRecognitionImport as SpeechRecognitionModule;
+const SpeechRecognition = hasSpeechRecognitionController(speechRecognitionModule)
+  ? speechRecognitionModule
+  : speechRecognitionModule.default;
+
 const useSpeechToTextBrowser = (
   setText: (text: string) => void,
   onTranscriptionComplete: (text: string) => void,
@@ -33,7 +52,7 @@ const useSpeechToTextBrowser = (
     isMicrophoneAvailable,
     browserSupportsSpeechRecognition,
   } = useSpeechRecognition();
-  const isListening = useMemo(() => listening, [listening]);
+  const isListening = listening;
 
   useEffect(() => {
     if (interimTranscript == null || interimTranscript === '') {
@@ -73,7 +92,7 @@ const useSpeechToTextBrowser = (
     };
   }, [setText, onTranscriptionComplete, resetTranscript, finalTranscript, autoSendText]);
 
-  const toggleListening = () => {
+  const toggleListening = useCallback(() => {
     if (!browserSupportsSpeechRecognition) {
       showToast({
         message: sttExternal
@@ -92,6 +111,16 @@ const useSpeechToTextBrowser = (
       return;
     }
 
+    if (!hasSpeechRecognitionController(SpeechRecognition)) {
+      showToast({
+        message: sttExternal
+          ? localize('com_ui_speech_not_supported_use_external')
+          : localize('com_ui_speech_not_supported'),
+        status: 'error',
+      });
+      return;
+    }
+
     if (isListening === true) {
       SpeechRecognition.stopListening();
     } else {
@@ -100,7 +129,16 @@ const useSpeechToTextBrowser = (
         continuous: autoTranscribeAudio,
       });
     }
-  };
+  }, [
+    autoTranscribeAudio,
+    browserSupportsSpeechRecognition,
+    isListening,
+    isMicrophoneAvailable,
+    languageSTT,
+    localize,
+    showToast,
+    sttExternal,
+  ]);
 
   useEffect(() => {
     const handleKeyDown = (e: KeyboardEvent) => {
@@ -111,7 +149,7 @@ const useSpeechToTextBrowser = (
 
     window.addEventListener('keydown', handleKeyDown);
     return () => window.removeEventListener('keydown', handleKeyDown);
-  }, []);
+  }, [isBrowserSTTEnabled, toggleListening]);
 
   return {
     isListening,
diff --git a/client/src/hooks/Input/useTextToSpeechBrowser.ts b/client/src/hooks/Input/useTextToSpeechBrowser.ts
index 8fb0eecd0b5..dbb59aa1e6c 100644
--- a/client/src/hooks/Input/useTextToSpeechBrowser.ts
+++ b/client/src/hooks/Input/useTextToSpeechBrowser.ts
@@ -1,5 +1,5 @@
-import { useRecoilValue } from 'recoil';
 import { useState, useEffect, useCallback } from 'react';
+import { useRecoilValue } from 'recoil';
 import type { VoiceOption } from '~/common';
 import store from '~/store';
 
@@ -89,6 +89,11 @@ function useTextToSpeechBrowser({
         setIsSpeaking(false);
       };
       utterance.onerror = (event) => {
+        if (event.error === 'interrupted' || event.error === 'canceled') {
+          setIsSpeaking(false);
+          return;
+        }
+
         console.error('Speech synthesis error:', event);
         setIsSpeaking(false);
       };
diff --git a/client/src/hooks/Input/useTextarea.ts b/client/src/hooks/Input/useTextarea.ts
index d132b2299da..b8cd22cfbc9 100644
--- a/client/src/hooks/Input/useTextarea.ts
+++ b/client/src/hooks/Input/useTextarea.ts
@@ -1,5 +1,5 @@
-import debounce from 'lodash/debounce';
 import { useEffect, useRef, useCallback } from 'react';
+import debounce from 'lodash/debounce';
 import { useRecoilValue, useRecoilState } from 'recoil';
 import type { TEndpointOption } from 'librechat-data-provider';
 import type { KeyboardEvent } from 'react';
@@ -11,12 +11,12 @@ import {
   checkIfScrollable,
 } from '~/utils';
 import { useAssistantsMapContext } from '~/Providers/AssistantsMapContext';
+import { useLatestMessage } from '~/hooks/Messages/useLatestMessage';
 import { useAgentsMapContext } from '~/Providers/AgentsMapContext';
 import useGetSender from '~/hooks/Conversations/useGetSender';
 import useFileHandling from '~/hooks/Files/useFileHandling';
 import { useInteractionHealthCheck } from '~/data-provider';
 import { useChatContext } from '~/Providers/ChatContext';
-import { useLatestMessage } from '~/hooks/Messages/useLatestMessage';
 import { globalAudioId } from '~/common';
 import { useLocalize } from '~/hooks';
 import store from '~/store';
@@ -28,11 +28,13 @@ export default function useTextarea({
   submitButtonRef,
   setIsScrollable,
   disabled = false,
+  placeholder,
 }: {
   textAreaRef: React.RefObject<HTMLTextAreaElement>;
   submitButtonRef: React.RefObject<HTMLButtonElement>;
   setIsScrollable: React.Dispatch<React.SetStateAction<boolean>>;
   disabled?: boolean;
+  placeholder?: string;
 }) {
   const localize = useLocalize();
   const getSender = useGetSender();
@@ -57,7 +59,8 @@ export default function useTextarea({
   });
   const entityName = entity?.name ?? '';
 
-  const isNotAppendable = latestMessage?.error === true && !isAssistant;
+  const isNotAppendable =
+    latestMessage?.error === true && latestMessage.isCreatedByUser === true && !isAssistant;
   // && (conversationId?.length ?? 0) > 6; // also ensures that we don't show the wrong placeholder
 
   useEffect(() => {
@@ -95,6 +98,10 @@ export default function useTextarea({
         return localize('com_endpoint_message_not_appendable');
       }
 
+      if (placeholder) {
+        return placeholder;
+      }
+
       const sender =
         isAssistant || isAgent
           ? getEntityName({ name: entityName, isAgent, localize })
@@ -105,17 +112,17 @@ export default function useTextarea({
       })}`;
     };
 
-    const placeholder = getPlaceholderText();
+    const placeholderText = getPlaceholderText();
 
-    if (textAreaRef.current?.getAttribute('placeholder') === placeholder) {
+    if (textAreaRef.current?.getAttribute('placeholder') === placeholderText) {
       return;
     }
 
     const setPlaceholder = () => {
-      const placeholder = getPlaceholderText();
+      const placeholderText = getPlaceholderText();
 
-      if (textAreaRef.current?.getAttribute('placeholder') !== placeholder) {
-        textAreaRef.current?.setAttribute('placeholder', placeholder);
+      if (textAreaRef.current?.getAttribute('placeholder') !== placeholderText) {
+        textAreaRef.current?.setAttribute('placeholder', placeholderText);
         forceResize(textAreaRef.current);
       }
     };
@@ -137,6 +144,7 @@ export default function useTextarea({
     conversation,
     latestMessage,
     isNotAppendable,
+    placeholder,
   ]);
 
   const handleKeyDown = useCallback(
diff --git a/client/src/hooks/MCP/__tests__/useMCPSelect.test.tsx b/client/src/hooks/MCP/__tests__/useMCPSelect.test.tsx
index 783f525b9c9..040bf921392 100644
--- a/client/src/hooks/MCP/__tests__/useMCPSelect.test.tsx
+++ b/client/src/hooks/MCP/__tests__/useMCPSelect.test.tsx
@@ -1,12 +1,12 @@
 import React from 'react';
 import { Provider, createStore } from 'jotai';
 import { renderHook, act, waitFor } from '@testing-library/react';
-import { RecoilRoot, useRecoilState, useRecoilValue, useSetRecoilState } from 'recoil';
 import { Constants, LocalStorageKeys } from 'librechat-data-provider';
+import { RecoilRoot, useRecoilState, useRecoilValue, useSetRecoilState } from 'recoil';
+import { MCPServerDefinition } from '../useMCPServerManager';
 import { ephemeralAgentByConvoId } from '~/store';
 import { setTimestamp } from '~/utils/timestamps';
 import { useMCPSelect } from '../useMCPSelect';
-import { MCPServerDefinition } from '../useMCPServerManager';
 
 // Mock dependencies
 jest.mock('~/utils/timestamps', () => ({
@@ -20,6 +20,7 @@ const createMCPServers = (serverNames: string[]): MCPServerDefinition[] => {
   return serverNames.map((serverName) => ({
     serverName,
     config: {
+      type: 'sse',
       url: 'http://mcp',
     },
     effectivePermissions: 15, // All permissions (VIEW=1, EDIT=2, DELETE=4, SHARE=8)
diff --git a/client/src/hooks/MCP/useMCPServerManager.ts b/client/src/hooks/MCP/useMCPServerManager.ts
index f1af26de0aa..6126545c356 100644
--- a/client/src/hooks/MCP/useMCPServerManager.ts
+++ b/client/src/hooks/MCP/useMCPServerManager.ts
@@ -16,7 +16,12 @@ import {
   useReinitializeMCPServerMutation,
   useGetAllEffectivePermissionsQuery,
 } from 'librechat-data-provider/react-query';
-import type { TUpdateUserPlugins, TPlugin, MCPServersResponse } from 'librechat-data-provider';
+import type {
+  TUpdateUserPlugins,
+  TPlugin,
+  MCPServersResponse,
+  MCPConnectionStatusResponse,
+} from 'librechat-data-provider';
 import type { MCPServerInitState } from '~/store/mcp';
 import type { ConfigFieldDetail } from '~/common';
 import { useLocalize, useHasAccess, useMCPSelect, useMCPConnectionStatus } from '~/hooks';
@@ -197,29 +202,39 @@ export function useMCPServerManager({
       let pollAttempts = 0;
       let timeoutId: NodeJS.Timeout | null = null;
 
-      /** OAuth typically completes in 5 seconds to 3 minutes
-       * We enforce a strict 3-minute timeout with gradual backoff
+      /** OAuth can take several minutes if the user steps away from the consent screen.
+       * Poll for the full server-side handling window (MCP_OAUTH_HANDLING_TIMEOUT
+       * default = 10 minutes) with gradual backoff, so the button stays usable as long
+       * as the server will accept the callback.
        */
       const getPollInterval = (attempt: number): number => {
         if (attempt < 12) return 5000; // First minute: every 5s (12 polls)
         if (attempt < 22) return 6000; // Second minute: every 6s (10 polls)
-        return 7500; // Final minute: every 7.5s (8 polls)
+        return 7500; // Thereafter: every 7.5s
       };
 
-      const maxAttempts = 30; // Exactly 3 minutes (180 seconds) total
-      const OAUTH_TIMEOUT_MS = 180000; // 3 minutes in milliseconds
+      /** Honor the server's configured MCP_OAUTH_HANDLING_TIMEOUT (surfaced on the
+       * connection-status response) so a tuned deadline isn't capped at the default.
+       * The cache may be empty at start, so this is refreshed from the first status
+       * refetch below rather than captured once. */
+      const connectionData = queryClient.getQueryData<MCPConnectionStatusResponse>([
+        QueryKeys.mcpConnectionStatus,
+      ]);
+      let oauthTimeoutMs = connectionData?.oauthTimeout ?? 600000; // default 10 minutes
+      // Backstop only; the elapsed-time guard governs. Sized above the worst-case poll count.
+      let maxAttempts = Math.ceil(oauthTimeoutMs / 5000) + 5;
 
       const pollOnce = async () => {
         try {
           pollAttempts++;
           const state = getServerInitState(serverInitStates, serverName);
 
-          /** Stop polling after 3 minutes or max attempts */
+          /** Stop polling once the handling window or max attempts is exceeded */
           const elapsedTime = state?.oauthStartTime
             ? Date.now() - state.oauthStartTime
             : pollAttempts * 5000; // Rough estimate if no start time
 
-          if (pollAttempts > maxAttempts || elapsedTime > OAUTH_TIMEOUT_MS) {
+          if (pollAttempts > maxAttempts || elapsedTime > oauthTimeoutMs) {
             console.warn(
               `[MCP Manager] OAuth timeout for ${serverName} after ${(elapsedTime / 1000).toFixed(0)}s (attempt ${pollAttempts})`,
             );
@@ -236,9 +251,15 @@ export function useMCPServerManager({
 
           await queryClient.refetchQueries([QueryKeys.mcpConnectionStatus]);
 
-          const freshConnectionData = queryClient.getQueryData([
+          const freshConnectionData = queryClient.getQueryData<MCPConnectionStatusResponse>([
             QueryKeys.mcpConnectionStatus,
-          ]) as any;
+          ]);
+          // Pick up the configured timeout once the status response lands (cache may have
+          // been empty when polling started), so a tuned deadline is honored mid-flight.
+          if (typeof freshConnectionData?.oauthTimeout === 'number') {
+            oauthTimeoutMs = freshConnectionData.oauthTimeout;
+            maxAttempts = Math.ceil(oauthTimeoutMs / 5000) + 5;
+          }
           const freshConnectionStatus = freshConnectionData?.connectionStatus || {};
 
           const serverStatus = freshConnectionStatus[serverName];
@@ -269,7 +290,7 @@ export function useMCPServerManager({
           }
 
           // Check for OAuth timeout (should align with maxAttempts)
-          if (state?.oauthStartTime && Date.now() - state.oauthStartTime > OAUTH_TIMEOUT_MS) {
+          if (state?.oauthStartTime && Date.now() - state.oauthStartTime > oauthTimeoutMs) {
             showToast({
               message: localize('com_ui_mcp_oauth_timeout', { 0: serverName }),
               status: 'error',
@@ -579,6 +600,9 @@ export function useMCPServerManager({
 
       const hasCustomUserVars =
         serverConfig?.customUserVars && Object.keys(serverConfig.customUserVars).length > 0;
+      const hasPendingOAuth =
+        serverStatus?.requiresOAuth === true && serverStatus.connectionState === 'connecting';
+      const canCancelOAuth = isCancellable(serverName) || hasPendingOAuth;
 
       return {
         serverName,
@@ -592,8 +616,8 @@ export function useMCPServerManager({
             } as TPlugin)
           : undefined,
         onConfigClick: handleConfigClick,
-        isInitializing: isInitializing(serverName),
-        canCancel: isCancellable(serverName),
+        isInitializing: isInitializing(serverName) || hasPendingOAuth,
+        canCancel: canCancelOAuth,
         onCancel: handleCancelClick,
         hasCustomUserVars,
       };
diff --git a/client/src/hooks/Messages/__tests__/useAttachments.spec.tsx b/client/src/hooks/Messages/__tests__/useAttachments.spec.tsx
index 61ce0717281..c0d17ba7131 100644
--- a/client/src/hooks/Messages/__tests__/useAttachments.spec.tsx
+++ b/client/src/hooks/Messages/__tests__/useAttachments.spec.tsx
@@ -11,31 +11,39 @@
  */
 
 import { useEffect } from 'react';
+import { Tools } from 'librechat-data-provider';
 import { renderHook } from '@testing-library/react';
 import { RecoilRoot, useSetRecoilState } from 'recoil';
+import type { TAttachment, TFile, TAttachmentMetadata } from 'librechat-data-provider';
 import type { ReactNode } from 'react';
-import type { TAttachment } from 'librechat-data-provider';
 import store from '~/store';
 
+type AttachmentFixture = TFile & TAttachmentMetadata;
+
 jest.mock('~/hooks/useLocalize', () => () => (key: string) => key);
 
 import useAttachments from '../useAttachments';
 
 const messageId = 'msg-1';
 
-function makeAttachment(overrides: Partial<TAttachment> = {}): TAttachment {
+function makeAttachment(overrides: Partial<AttachmentFixture> = {}): AttachmentFixture {
   return {
+    user: 'user-1',
+    object: 'file',
+    bytes: 1024,
+    embedded: false,
+    usage: 0,
     file_id: 'fid-1',
     filename: 'data.xlsx',
     filepath: '/uploads/data.xlsx',
-    type: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+    type: Tools.execute_code,
     messageId,
     toolCallId: 'tc-1',
-    text: null,
-    textFormat: null,
+    text: undefined,
+    textFormat: undefined,
     status: 'pending',
     ...overrides,
-  } as unknown as TAttachment;
+  };
 }
 
 function setup({
@@ -91,7 +99,7 @@ describe('useAttachments', () => {
      * immediate-persist snapshot; the polling layer fetched the
      * resolved record and inserted it into messageAttachmentsMap; the
      * merge here must surface the resolved fields to the renderer. */
-    const db = makeAttachment({ status: 'pending', text: null, textFormat: null });
+    const db = makeAttachment({ status: 'pending', text: undefined, textFormat: undefined });
     const live = makeAttachment({
       status: 'ready',
       text: '<table>resolved</table>',
@@ -102,10 +110,7 @@ describe('useAttachments', () => {
       liveMap: { [messageId]: [live] },
     });
     expect(result.current.attachments).toHaveLength(1);
-    const merged = result.current.attachments[0] as TAttachment & {
-      text?: string;
-      textFormat?: string;
-    };
+    const merged = result.current.attachments[0] as AttachmentFixture;
     expect(merged.status).toBe('ready');
     expect(merged.text).toBe('<table>resolved</table>');
     expect(merged.textFormat).toBe('html');
@@ -123,7 +128,7 @@ describe('useAttachments', () => {
     /* DB attachments are the authoritative list for THIS message — a
      * live entry without a matching file_id must NOT bleed in. */
     expect(result.current.attachments).toHaveLength(1);
-    expect((result.current.attachments[0] as TAttachment).file_id).toBe('fid-A');
-    expect((result.current.attachments[0] as TAttachment).status).toBe('pending');
+    expect((result.current.attachments[0] as AttachmentFixture).file_id).toBe('fid-A');
+    expect((result.current.attachments[0] as AttachmentFixture).status).toBe('pending');
   });
 });
diff --git a/client/src/hooks/Messages/__tests__/useLatestMessage.spec.tsx b/client/src/hooks/Messages/__tests__/useLatestMessage.spec.tsx
index 2e5de871dd7..391168e26c3 100644
--- a/client/src/hooks/Messages/__tests__/useLatestMessage.spec.tsx
+++ b/client/src/hooks/Messages/__tests__/useLatestMessage.spec.tsx
@@ -1,11 +1,11 @@
 import React from 'react';
+import { act, renderHook } from '@testing-library/react';
 import { RecoilRoot, type MutableSnapshot } from 'recoil';
 import { MemoryRouter, Route, Routes } from 'react-router-dom';
-import { act, renderHook } from '@testing-library/react';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import { QueryKeys, type TConversation, type TMessage } from 'librechat-data-provider';
+import { getBranchSiblingIndexesForTarget, getMessageBranchSiblingParentIds } from '~/utils';
 import { useLatestMessage, useLatestMessageId } from '~/hooks/Messages/useLatestMessage';
-import { getMessageBranchSiblingParentIds } from '~/utils';
 import store from '~/store';
 
 function createQueryClient() {
@@ -254,3 +254,26 @@ describe('getMessageBranchSiblingParentIds', () => {
     ).toEqual([userMessage.messageId]);
   });
 });
+
+describe('getBranchSiblingIndexesForTarget', () => {
+  it('returns sibling indexes that select the branch containing the target message', () => {
+    expect(
+      getBranchSiblingIndexesForTarget(
+        [
+          userMessage,
+          olderAssistantMessage,
+          olderFollowUpUserMessage,
+          olderFollowUpAssistantMessage,
+          assistantMessage,
+        ],
+        olderFollowUpAssistantMessage.messageId,
+        conversation.conversationId,
+      ),
+    ).toEqual([
+      {
+        parentMessageId: userMessage.messageId,
+        siblingIdx: 1,
+      },
+    ]);
+  });
+});
diff --git a/client/src/hooks/Messages/__tests__/useSubmitMessage.spec.ts b/client/src/hooks/Messages/__tests__/useSubmitMessage.spec.ts
new file mode 100644
index 00000000000..3e99477aebb
--- /dev/null
+++ b/client/src/hooks/Messages/__tests__/useSubmitMessage.spec.ts
@@ -0,0 +1,85 @@
+import { act, renderHook } from '@testing-library/react';
+import { useRecoilValue, useSetRecoilState } from 'recoil';
+import { useChatContext, useChatFormContext, useAddedChatContext } from '~/Providers';
+import { useLatestMessage } from '~/hooks/Messages/useLatestMessage';
+import { useAuthContext } from '~/hooks/AuthContext';
+import useSubmitMessage from '../useSubmitMessage';
+
+const mockSetActivePrompt = jest.fn();
+
+jest.mock('recoil', () => ({
+  useRecoilValue: jest.fn(),
+  useSetRecoilState: jest.fn(),
+}));
+
+jest.mock('librechat-data-provider', () => ({
+  replaceSpecialVars: jest.fn(({ text }) => text),
+}));
+
+jest.mock('~/Providers', () => ({
+  useChatContext: jest.fn(),
+  useChatFormContext: jest.fn(),
+  useAddedChatContext: jest.fn(),
+}));
+
+jest.mock('~/hooks/AuthContext', () => ({
+  useAuthContext: jest.fn(),
+}));
+
+jest.mock('~/hooks/Messages/useLatestMessage', () => ({
+  useLatestMessage: jest.fn(),
+}));
+
+jest.mock('~/store', () => ({
+  __esModule: true,
+  default: {
+    autoSendPrompts: 'autoSendPrompts',
+    activePromptByIndex: jest.fn(() => 'activePromptByIndex'),
+  },
+}));
+
+const mockUseRecoilValue = useRecoilValue as jest.Mock;
+const mockUseSetRecoilState = useSetRecoilState as jest.Mock;
+const mockUseChatContext = useChatContext as jest.Mock;
+const mockUseChatFormContext = useChatFormContext as jest.Mock;
+const mockUseAddedChatContext = useAddedChatContext as jest.Mock;
+const mockUseAuthContext = useAuthContext as jest.Mock;
+const mockUseLatestMessage = useLatestMessage as jest.Mock;
+
+describe('useSubmitMessage', () => {
+  const ask = jest.fn();
+  const reset = jest.fn();
+  const setMessages = jest.fn();
+  const getMessages = jest.fn();
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockUseRecoilValue.mockReturnValue(false);
+    mockUseSetRecoilState.mockReturnValue(mockSetActivePrompt);
+    mockUseAuthContext.mockReturnValue({ user: { id: 'user-1' } });
+    mockUseAddedChatContext.mockReturnValue({ conversation: null });
+    mockUseChatFormContext.mockReturnValue({ reset, getValues: jest.fn(() => '') });
+    mockUseLatestMessage.mockReturnValue({ messageId: 'assistant-message' });
+    getMessages.mockReturnValue([{ messageId: 'assistant-message' }]);
+    mockUseChatContext.mockReturnValue({
+      ask,
+      index: 0,
+      getMessages,
+      setMessages,
+    });
+  });
+
+  it('propagates blocked submits so direct callers can preserve their text', () => {
+    ask.mockReturnValue(false);
+
+    const { result } = renderHook(() => useSubmitMessage());
+
+    let submitted: false | void = undefined;
+    act(() => {
+      submitted = result.current.submitMessage({ text: 'dictated follow-up' });
+    });
+
+    expect(submitted).toBe(false);
+    expect(reset).not.toHaveBeenCalled();
+  });
+});
diff --git a/client/src/hooks/Messages/useCopyToClipboard.ts b/client/src/hooks/Messages/useCopyToClipboard.ts
index 501ac942032..f827d952005 100644
--- a/client/src/hooks/Messages/useCopyToClipboard.ts
+++ b/client/src/hooks/Messages/useCopyToClipboard.ts
@@ -56,7 +56,7 @@ export default function useCopyToClipboard({
       if (content) {
         messageText = content.reduce((acc, curr, i) => {
           if (curr.type === ContentTypes.TEXT) {
-            const text = typeof curr.text === 'string' ? curr.text : curr.text.value;
+            const text = typeof curr.text === 'string' ? curr.text : (curr.text?.value ?? '');
             return acc + text + (i === content.length - 1 ? '' : '\n');
           }
           return acc;
diff --git a/client/src/hooks/Messages/useSearchResultsByTurn.ts b/client/src/hooks/Messages/useSearchResultsByTurn.ts
index 5005fc48a9d..d7ec2c265b7 100644
--- a/client/src/hooks/Messages/useSearchResultsByTurn.ts
+++ b/client/src/hooks/Messages/useSearchResultsByTurn.ts
@@ -20,6 +20,17 @@ interface DeduplicatedSource {
   metadata?: any;
 }
 
+/**
+ * The `file_search` attachment is typed as {@link SearchResultData} in the
+ * shared schema, but at runtime the agent file-search tool emits a
+ * `{ sources: FileSource[] }` payload. Read the sources defensively.
+ */
+type FileSearchAttachmentData = SearchResultData & { sources?: FileSource[] };
+
+function getFileSearchSources(data: FileSearchAttachmentData): FileSource[] {
+  return Array.isArray(data.sources) ? data.sources : [];
+}
+
 /**
  * Hook that creates a map of turn numbers to SearchResultData from web search and agent file search attachments
  * @param attachments Array of attachment metadata
@@ -42,7 +53,7 @@ export function useSearchResultsByTurn(attachments?: TAttachment[]) {
 
       // Handle agent file search attachments (following web search pattern)
       if (attachment.type === Tools.file_search && attachment[Tools.file_search]) {
-        const sources = attachment[Tools.file_search].sources;
+        const sources = getFileSearchSources(attachment[Tools.file_search]);
 
         // Deduplicate sources by fileId and merge pages
         const deduplicatedSources = new Map<string, DeduplicatedSource>();
diff --git a/client/src/hooks/Messages/useSubmitMessage.ts b/client/src/hooks/Messages/useSubmitMessage.ts
index 29e5d556f91..9f3deb1d6ff 100644
--- a/client/src/hooks/Messages/useSubmitMessage.ts
+++ b/client/src/hooks/Messages/useSubmitMessage.ts
@@ -3,8 +3,8 @@ import { useRecoilValue, useSetRecoilState } from 'recoil';
 import { useParams } from 'react-router-dom';
 import { replaceSpecialVars } from 'librechat-data-provider';
 import { useChatContext, useChatFormContext, useAddedChatContext } from '~/Providers';
-import { useAuthContext } from '~/hooks/AuthContext';
 import { useLatestMessage } from '~/hooks/Messages/useLatestMessage';
+import { useAuthContext } from '~/hooks/AuthContext';
 import { mainTextareaId } from '~/common';
 import store from '~/store';
 
@@ -32,7 +32,7 @@ export default function useSubmitMessage() {
         setMessages([...(rootMessages || []), latestMessage]);
       }
 
-      ask(
+      const submitted = ask(
         {
           text: data.text,
         },
@@ -40,6 +40,9 @@ export default function useSubmitMessage() {
           addedConvo: addedConvo ?? undefined,
         },
       );
+      if (submitted === false) {
+        return false;
+      }
       methods.reset();
     },
     [ask, methods, addedConvo, setMessages, getMessages, latestMessage],
diff --git a/client/src/hooks/SSE/__tests__/useAttachmentHandler.spec.tsx b/client/src/hooks/SSE/__tests__/useAttachmentHandler.spec.tsx
index 5a4b68e79ed..9f922ef266e 100644
--- a/client/src/hooks/SSE/__tests__/useAttachmentHandler.spec.tsx
+++ b/client/src/hooks/SSE/__tests__/useAttachmentHandler.spec.tsx
@@ -14,33 +14,45 @@
  * unrelated citations both show up.
  */
 
-import { renderHook, act } from '@testing-library/react';
+import { Tools } from 'librechat-data-provider';
 import { RecoilRoot, useRecoilValue } from 'recoil';
 import { QueryClient } from '@tanstack/react-query';
-import { Tools } from 'librechat-data-provider';
+import { renderHook, act } from '@testing-library/react';
+import type {
+  TFile,
+  TAttachment,
+  EventSubmission,
+  TAttachmentMetadata,
+} from 'librechat-data-provider';
 import type { ReactNode } from 'react';
-import type { TAttachment, EventSubmission } from 'librechat-data-provider';
 import useAttachmentHandler from '../useAttachmentHandler';
 import store from '~/store';
 
+type AttachmentFixture = TFile & TAttachmentMetadata;
+
 const wrapper = ({ children }: { children: ReactNode }) => <RecoilRoot>{children}</RecoilRoot>;
 
 const submission = {} as EventSubmission;
 const messageId = 'msg-1';
 
-function makeAttachment(overrides: Partial<TAttachment>): TAttachment {
+function makeAttachment(overrides: Partial<AttachmentFixture>): AttachmentFixture {
   return {
+    user: 'user-1',
+    object: 'file',
+    bytes: 1024,
+    embedded: false,
+    usage: 0,
     file_id: 'fid-1',
     filename: 'data.xlsx',
     filepath: '/uploads/data.xlsx',
-    type: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+    type: Tools.execute_code,
     messageId,
     toolCallId: 'tc-1',
-    text: null,
-    textFormat: null,
+    text: undefined,
+    textFormat: undefined,
     status: 'pending',
     ...overrides,
-  } as unknown as TAttachment;
+  };
 }
 
 /* Co-mount the handler and a reader of the messageAttachmentsMap atom in
@@ -162,7 +174,7 @@ describe('useAttachmentHandler upsert-by-file_id', () => {
      * downgrade it. Otherwise the chip flickers back to "pending" and
      * polling restarts until the lazy sweep catches up. (Codex P1.) */
     const ctx = setup();
-    ctx.handle(makeAttachment({ status: 'pending', text: null }));
+    ctx.handle(makeAttachment({ status: 'pending', text: undefined }));
     ctx.handle({
       file_id: 'fid-1',
       messageId,
@@ -171,7 +183,7 @@ describe('useAttachmentHandler upsert-by-file_id', () => {
       textFormat: 'html',
     } as unknown as TAttachment);
     /* Phase-1 replay arrives last (finalHandler at stream end). */
-    ctx.handle(makeAttachment({ status: 'pending', text: null }));
+    ctx.handle(makeAttachment({ status: 'pending', text: undefined }));
     expect(ctx.list).toHaveLength(1);
     expect(ctx.list[0]).toMatchObject({
       status: 'ready',
diff --git a/client/src/hooks/SSE/__tests__/useEventHandlers.spec.ts b/client/src/hooks/SSE/__tests__/useEventHandlers.spec.ts
new file mode 100644
index 00000000000..bd33eacebbd
--- /dev/null
+++ b/client/src/hooks/SSE/__tests__/useEventHandlers.spec.ts
@@ -0,0 +1,175 @@
+import { Constants } from 'librechat-data-provider';
+import type { EventSubmission, TMessage } from 'librechat-data-provider';
+import {
+  buildCreatedInitialResponse,
+  getExistingConversationAbortMessages,
+  isInitialNewConversationSubmission,
+  mergeRegenerateFinalMessages,
+} from '~/hooks/SSE/useEventHandlers';
+
+describe('buildCreatedInitialResponse', () => {
+  const userMessage = {
+    messageId: 'server-user-message',
+    conversationId: 'conversation-1',
+    isCreatedByUser: true,
+    text: 'Hello',
+    sender: 'User',
+  } as TMessage;
+
+  const initialResponse = {
+    messageId: 'prelim-response',
+    parentMessageId: 'original-user-message',
+    conversationId: 'conversation-1',
+    isCreatedByUser: false,
+    text: '',
+    sender: 'Assistant',
+  } as TMessage;
+
+  it('uses the created user message id for new turns', () => {
+    expect(
+      buildCreatedInitialResponse({
+        initialResponse,
+        userMessage,
+        isRegenerate: false,
+      }),
+    ).toEqual(
+      expect.objectContaining({
+        messageId: 'server-user-message_',
+        parentMessageId: 'server-user-message',
+      }),
+    );
+  });
+
+  it('preserves the regenerated prelim response id and parent', () => {
+    expect(
+      buildCreatedInitialResponse({
+        initialResponse,
+        userMessage,
+        isRegenerate: true,
+      }),
+    ).toEqual(
+      expect.objectContaining({
+        messageId: 'prelim-response',
+        parentMessageId: 'original-user-message',
+      }),
+    );
+  });
+});
+
+describe('isInitialNewConversationSubmission', () => {
+  it('treats a root user message as an optimistic new chat', () => {
+    expect(
+      isInitialNewConversationSubmission({
+        userMessage: {
+          messageId: 'user-1',
+          parentMessageId: Constants.NO_PARENT,
+        } as TMessage,
+      } as EventSubmission),
+    ).toBe(true);
+  });
+
+  it('does not treat follow-up turns as optimistic new chats', () => {
+    expect(
+      isInitialNewConversationSubmission({
+        userMessage: {
+          messageId: 'user-2',
+          parentMessageId: 'assistant-1',
+        } as TMessage,
+      } as EventSubmission),
+    ).toBe(false);
+  });
+});
+
+describe('mergeRegenerateFinalMessages', () => {
+  const userMessage = (messageId: string, parentMessageId: string = Constants.NO_PARENT) =>
+    ({
+      messageId,
+      parentMessageId,
+      conversationId: 'conversation-1',
+      isCreatedByUser: true,
+      sender: 'User',
+      text: messageId,
+    }) as TMessage;
+
+  const assistantMessage = (messageId: string, parentMessageId: string) =>
+    ({
+      messageId,
+      parentMessageId,
+      conversationId: 'conversation-1',
+      isCreatedByUser: false,
+      sender: 'Assistant',
+      text: messageId,
+    }) as TMessage;
+
+  it('keeps the original branch siblings when a non-tail regenerate finalizes', () => {
+    const rootUser = userMessage('user-1');
+    const originalResponse = assistantMessage('assistant-1', rootUser.messageId);
+    const followUpUser = userMessage('user-2', originalResponse.messageId);
+    const followUpResponse = assistantMessage('assistant-2', followUpUser.messageId);
+    const finalResponse = assistantMessage('assistant-3', rootUser.messageId);
+
+    expect(
+      mergeRegenerateFinalMessages({
+        messages: [rootUser, originalResponse, followUpUser, followUpResponse],
+        responseMessage: finalResponse,
+        initialResponseId: 'assistant-1_',
+      }).map((message) => message.messageId),
+    ).toEqual([
+      rootUser.messageId,
+      originalResponse.messageId,
+      followUpUser.messageId,
+      followUpResponse.messageId,
+      finalResponse.messageId,
+    ]);
+  });
+
+  it('replaces the streamed preliminary response when it is present', () => {
+    const rootUser = userMessage('user-1');
+    const preliminaryResponse = assistantMessage('assistant-1_', rootUser.messageId);
+    const finalResponse = assistantMessage('assistant-3', rootUser.messageId);
+
+    expect(
+      mergeRegenerateFinalMessages({
+        messages: [rootUser, preliminaryResponse],
+        responseMessage: finalResponse,
+        initialResponseId: preliminaryResponse.messageId,
+      }).map((message) => message.messageId),
+    ).toEqual([rootUser.messageId, finalResponse.messageId]);
+  });
+});
+
+describe('getExistingConversationAbortMessages', () => {
+  const message = (messageId: string) =>
+    ({
+      messageId,
+      conversationId: 'conversation-1',
+      text: messageId,
+    }) as TMessage;
+
+  it('restores the full pre-regenerate branch on early abort', () => {
+    const originalMessages = [message('user-1'), message('assistant-1'), message('user-2')];
+    const scopedRegenerateMessages = [message('user-1')];
+    const currentStreamMessages = [message('user-1'), message('assistant-1_')];
+
+    expect(
+      getExistingConversationAbortMessages({
+        messages: scopedRegenerateMessages,
+        currentMessages: currentStreamMessages,
+        regenerateMessages: originalMessages,
+        isRegenerate: true,
+      }).map(({ messageId }) => messageId),
+    ).toEqual(['user-1', 'assistant-1', 'user-2']);
+  });
+
+  it('keeps the existing non-regenerate abort rollback behavior', () => {
+    const submissionMessages = [message('user-1')];
+    const currentMessages = [message('user-1'), message('assistant-1')];
+
+    expect(
+      getExistingConversationAbortMessages({
+        messages: submissionMessages,
+        currentMessages,
+      }).map(({ messageId }) => messageId),
+    ).toEqual(['user-1']);
+  });
+});
diff --git a/client/src/hooks/SSE/__tests__/useResumableSSE.spec.ts b/client/src/hooks/SSE/__tests__/useResumableSSE.spec.ts
index e9ee6a6b0a6..695fffa3f5a 100644
--- a/client/src/hooks/SSE/__tests__/useResumableSSE.spec.ts
+++ b/client/src/hooks/SSE/__tests__/useResumableSSE.spec.ts
@@ -1,6 +1,12 @@
-import { renderHook, act } from '@testing-library/react';
-import { Constants, LocalStorageKeys, QueryKeys } from 'librechat-data-provider';
-import type { TSubmission } from 'librechat-data-provider';
+import { renderHook, act, waitFor } from '@testing-library/react';
+import {
+  Constants,
+  LocalStorageKeys,
+  QueryKeys,
+  StepEvents,
+  request,
+} from 'librechat-data-provider';
+import type { TMessage, TSubmission } from 'librechat-data-provider';
 
 type SSEEventListener = (e: Partial<MessageEvent> & { responseCode?: number }) => void;
 
@@ -48,6 +54,33 @@ const mockQueryClient = {
   }),
 };
 
+const mockActiveRunAtom = { key: 'activeRun' };
+const mockAbortScrollAtom = { key: 'abortScroll' };
+const mockSubmissionAtom = { key: 'submission' };
+const mockShowStopButtonAtom = { key: 'showStopButton' };
+const mockSetActiveRun = jest.fn();
+const mockSetAbortScroll = jest.fn();
+const mockSetSubmission = jest.fn();
+const mockSetShowStopButton = jest.fn();
+const mockUseSetRecoilStateMock = jest.fn((atom: unknown) => {
+  if (atom === mockActiveRunAtom) {
+    return mockSetActiveRun;
+  }
+  if (atom === mockAbortScrollAtom) {
+    return mockSetAbortScroll;
+  }
+  if (atom === mockSubmissionAtom) {
+    return mockSetSubmission;
+  }
+  if (atom === mockShowStopButtonAtom) {
+    return mockSetShowStopButton;
+  }
+  return jest.fn();
+});
+function mockUseSetRecoilState(atom: unknown) {
+  return mockUseSetRecoilStateMock(atom);
+}
+
 jest.mock('@tanstack/react-query', () => ({
   ...jest.requireActual('@tanstack/react-query'),
   useQueryClient: () => mockQueryClient,
@@ -55,15 +88,16 @@ jest.mock('@tanstack/react-query', () => ({
 
 jest.mock('recoil', () => ({
   ...jest.requireActual('recoil'),
-  useSetRecoilState: () => jest.fn(),
+  useSetRecoilState: mockUseSetRecoilState,
 }));
 
 jest.mock('~/store', () => ({
   __esModule: true,
   default: {
-    activeRunFamily: jest.fn(),
-    abortScrollFamily: jest.fn(),
-    showStopButtonByIndex: jest.fn(),
+    activeRunFamily: jest.fn(() => mockActiveRunAtom),
+    abortScrollFamily: jest.fn(() => mockAbortScrollAtom),
+    submissionByIndex: jest.fn(() => mockSubmissionAtom),
+    showStopButtonByIndex: jest.fn(() => mockShowStopButtonAtom),
   },
 }));
 
@@ -79,29 +113,35 @@ jest.mock('~/data-provider', () => ({
 }));
 
 const mockErrorHandler = jest.fn();
+const mockFinalHandler = jest.fn();
 const mockCreatedHandler = jest.fn();
 const mockStepHandler = jest.fn();
 const mockTitleHandler = jest.fn();
 const mockSetIsSubmitting = jest.fn();
 const mockClearStepMaps = jest.fn();
 
-jest.mock('~/hooks/SSE/useEventHandlers', () =>
-  jest.fn(() => ({
-    errorHandler: mockErrorHandler,
-    finalHandler: jest.fn(),
-    createdHandler: mockCreatedHandler,
-    attachmentHandler: jest.fn(),
-    stepHandler: mockStepHandler,
-    titleHandler: mockTitleHandler,
-    contentHandler: jest.fn(),
-    resetContentHandler: jest.fn(),
-    syncStepMessage: jest.fn(),
-    clearStepMaps: mockClearStepMaps,
-    messageHandler: jest.fn(),
-    setIsSubmitting: mockSetIsSubmitting,
-    setShowStopButton: jest.fn(),
-  })),
-);
+jest.mock('~/hooks/SSE/useEventHandlers', () => {
+  const actual = jest.requireActual('~/hooks/SSE/useEventHandlers');
+  return {
+    __esModule: true,
+    ...actual,
+    default: jest.fn(() => ({
+      errorHandler: mockErrorHandler,
+      finalHandler: mockFinalHandler,
+      createdHandler: mockCreatedHandler,
+      attachmentHandler: jest.fn(),
+      stepHandler: mockStepHandler,
+      titleHandler: mockTitleHandler,
+      contentHandler: jest.fn(),
+      resetContentHandler: jest.fn(),
+      syncStepMessage: jest.fn(),
+      clearStepMaps: mockClearStepMaps,
+      messageHandler: jest.fn(),
+      setIsSubmitting: mockSetIsSubmitting,
+      setShowStopButton: jest.fn(),
+    })),
+  };
+});
 
 jest.mock('librechat-data-provider', () => {
   const actual = jest.requireActual('librechat-data-provider');
@@ -128,7 +168,7 @@ const CONV_ID = 'conv-abc-123';
 type PartialSubmission = {
   conversation: { conversationId?: string };
   userMessage: Record<string, unknown>;
-  messages: never[];
+  messages: TMessage[];
   isTemporary: boolean;
   initialResponse: Record<string, unknown>;
   endpointOption: { endpoint: string };
@@ -162,7 +202,7 @@ const buildSubmission = (overrides: Partial<PartialSubmission> = {}): TSubmissio
 
 const buildChatHelpers = () => ({
   setMessages: jest.fn(),
-  getMessages: jest.fn(() => []),
+  getMessages: jest.fn<TMessage[], []>(() => []),
   setConversation: jest.fn(),
   setIsSubmitting: mockSetIsSubmitting,
   newConversation: jest.fn(),
@@ -174,11 +214,34 @@ const getLastSSE = (): MockSSEInstance => {
   return sse;
 };
 
+const serverNotReadyError = (retryAfter = '0') => ({
+  response: {
+    status: 503,
+    data: { code: 'SERVER_NOT_READY' },
+    headers: { 'retry-after': retryAfter },
+  },
+});
+
+const flushMicrotasks = async () => {
+  await act(async () => {
+    await Promise.resolve();
+  });
+};
+
+const advanceRetryTimer = async (ms: number) => {
+  await act(async () => {
+    jest.advanceTimersByTime(ms);
+    await Promise.resolve();
+  });
+  await flushMicrotasks();
+};
+
 describe('useResumableSSE - 404 error path', () => {
   beforeEach(() => {
     mockSSEInstances.length = 0;
     localStorage.clear();
     mockErrorHandler.mockClear();
+    mockFinalHandler.mockClear();
     mockCreatedHandler.mockClear();
     mockStepHandler.mockClear();
     mockTitleHandler.mockClear();
@@ -189,6 +252,17 @@ describe('useResumableSSE - 404 error path', () => {
     mockInvalidateQueries.mockClear();
     mockRemoveQueries.mockClear();
     mockFindAll.mockClear();
+    mockUseSetRecoilStateMock.mockClear();
+    mockSetActiveRun.mockClear();
+    mockSetAbortScroll.mockClear();
+    mockSetSubmission.mockClear();
+    mockSetShowStopButton.mockClear();
+    (request.post as jest.Mock).mockReset();
+    (request.post as jest.Mock).mockResolvedValue({ streamId: 'stream-123' });
+  });
+
+  afterEach(() => {
+    jest.useRealTimers();
   });
 
   const seedDraft = (conversationId: string) => {
@@ -385,6 +459,46 @@ describe('useResumableSSE - 404 error path', () => {
     unmount();
   });
 
+  it('replaces the new-chat URL when the stream id is known despite a stale parent id', async () => {
+    window.history.pushState({}, '', '/c/new');
+    const submission = buildSubmission({
+      conversation: {},
+      userMessage: {
+        messageId: 'msg-1',
+        conversationId: null,
+        text: 'Hello',
+        isCreatedByUser: true,
+        sender: 'User',
+        parentMessageId: 'stale-parent-message',
+      },
+      initialResponse: {
+        messageId: 'msg-1_',
+        conversationId: null,
+        text: '',
+        isCreatedByUser: false,
+        sender: 'Assistant',
+      },
+    });
+    const chatHelpers = buildChatHelpers();
+
+    const { unmount } = renderHook(() => useResumableSSE(submission, chatHelpers));
+
+    await act(async () => {
+      await Promise.resolve();
+    });
+
+    expect(window.location.pathname).toBe('/c/stream-123');
+    expect(mockSetQueryData).toHaveBeenCalledWith(
+      [QueryKeys.messages, 'stream-123'],
+      expect.arrayContaining([
+        expect.objectContaining({ messageId: 'msg-1', conversationId: 'stream-123' }),
+      ]),
+    );
+
+    unmount();
+    window.history.pushState({}, '', '/');
+  });
+
   it('hydrates the submission conversation id before created handlers run', async () => {
     const submission = buildSubmission({
       conversation: {},
@@ -435,6 +549,349 @@ describe('useResumableSSE - 404 error path', () => {
     unmount();
   });
 
+  it('queues run step events until created hydrates the submission', async () => {
+    const submission = buildSubmission({
+      conversation: {},
+      userMessage: {
+        messageId: 'msg-1',
+        conversationId: null,
+        text: 'Hello',
+        isCreatedByUser: true,
+        sender: 'User',
+        parentMessageId: Constants.NO_PARENT,
+      },
+      initialResponse: {
+        messageId: 'msg-1_',
+        conversationId: null,
+        text: '',
+        isCreatedByUser: false,
+        sender: 'Assistant',
+      },
+    });
+    const chatHelpers = buildChatHelpers();
+
+    const { unmount } = renderHook(() => useResumableSSE(submission, chatHelpers));
+
+    await act(async () => {
+      await Promise.resolve();
+    });
+
+    const runStepEvent = {
+      event: StepEvents.ON_RUN_STEP,
+      data: {
+        id: 'step-oauth',
+        runId: 'msg-1_',
+        index: 0,
+        stepDetails: {
+          type: 'tool_calls',
+          tool_calls: [{ id: 'call-oauth', name: 'Google-Workspace', args: '' }],
+        },
+      },
+    };
+
+    const sse = getLastSSE();
+    await act(async () => {
+      sse._emit('message', { data: JSON.stringify(runStepEvent) });
+    });
+
+    expect(mockStepHandler).not.toHaveBeenCalled();
+
+    await act(async () => {
+      sse._emit('message', {
+        data: JSON.stringify({
+          created: true,
+          message: {
+            messageId: 'msg-1',
+            conversationId: 'stream-123',
+          },
+        }),
+      });
+    });
+
+    expect(mockStepHandler).toHaveBeenCalledWith(
+      runStepEvent,
+      expect.objectContaining({
+        userMessage: expect.objectContaining({
+          messageId: 'msg-1',
+          conversationId: 'stream-123',
+        }),
+      }),
+    );
+    unmount();
+  });
+
+  it('renders OAuth run step events before created while retaining replay after hydration', async () => {
+    const submission = buildSubmission({
+      conversation: {},
+      userMessage: {
+        messageId: 'msg-1',
+        conversationId: null,
+        text: 'Hello',
+        isCreatedByUser: true,
+        sender: 'User',
+        parentMessageId: Constants.NO_PARENT,
+      },
+      initialResponse: {
+        messageId: 'msg-1_',
+        conversationId: null,
+        text: '',
+        isCreatedByUser: false,
+        sender: 'Assistant',
+      },
+    });
+    const chatHelpers = buildChatHelpers();
+
+    const { unmount } = renderHook(() => useResumableSSE(submission, chatHelpers));
+
+    await act(async () => {
+      await Promise.resolve();
+    });
+
+    const runStepEvent = {
+      event: StepEvents.ON_RUN_STEP,
+      data: {
+        id: 'step-oauth',
+        runId: Constants.USE_PRELIM_RESPONSE_MESSAGE_ID,
+        index: 0,
+        stepDetails: {
+          type: 'tool_calls',
+          tool_calls: [{ id: 'call-oauth', name: 'oauth_mcp_Google-Workspace', args: '' }],
+        },
+      },
+    };
+    const runStepDeltaEvent = {
+      event: StepEvents.ON_RUN_STEP_DELTA,
+      data: {
+        id: 'step-oauth',
+        delta: {
+          type: 'tool_calls',
+          tool_calls: [{ id: 'call-oauth', name: 'oauth_mcp_Google-Workspace', args: '' }],
+          auth: 'https://auth.example.com/oauth',
+          expires_at: 1780791946,
+        },
+      },
+    };
+
+    const sse = getLastSSE();
+    await act(async () => {
+      sse._emit('message', { data: JSON.stringify(runStepEvent) });
+      sse._emit('message', { data: JSON.stringify(runStepDeltaEvent) });
+    });
+
+    expect(mockStepHandler).toHaveBeenCalledTimes(2);
+    expect(mockStepHandler).toHaveBeenNthCalledWith(
+      1,
+      runStepEvent,
+      expect.objectContaining({
+        userMessage: expect.objectContaining({
+          messageId: 'msg-1',
+          conversationId: 'stream-123',
+        }),
+      }),
+    );
+    expect(mockStepHandler).toHaveBeenNthCalledWith(
+      2,
+      runStepDeltaEvent,
+      expect.objectContaining({
+        userMessage: expect.objectContaining({
+          messageId: 'msg-1',
+          conversationId: 'stream-123',
+        }),
+      }),
+    );
+
+    await act(async () => {
+      sse._emit('message', {
+        data: JSON.stringify({
+          created: true,
+          message: {
+            messageId: 'msg-1',
+            conversationId: 'stream-123',
+          },
+        }),
+      });
+    });
+
+    expect(mockStepHandler).toHaveBeenCalledTimes(4);
+    expect(mockStepHandler).toHaveBeenNthCalledWith(
+      3,
+      runStepEvent,
+      expect.objectContaining({
+        userMessage: expect.objectContaining({
+          messageId: 'msg-1',
+          conversationId: 'stream-123',
+        }),
+      }),
+    );
+    expect(mockStepHandler).toHaveBeenNthCalledWith(
+      4,
+      runStepDeltaEvent,
+      expect.objectContaining({
+        userMessage: expect.objectContaining({
+          messageId: 'msg-1',
+          conversationId: 'stream-123',
+        }),
+      }),
+    );
+    unmount();
+  });
+
+  it('replays pre-created OAuth completion against the hydrated response id', async () => {
+    const previousUser = {
+      messageId: 'previous-user',
+      conversationId: CONV_ID,
+      text: 'hi',
+      isCreatedByUser: true,
+      sender: 'User',
+      parentMessageId: Constants.NO_PARENT,
+    } as TMessage;
+    const previousResponse = {
+      messageId: 'previous-response',
+      conversationId: CONV_ID,
+      text: 'hello',
+      isCreatedByUser: false,
+      sender: 'Assistant',
+      parentMessageId: previousUser.messageId,
+    } as TMessage;
+    const submission = buildSubmission({
+      conversation: { conversationId: CONV_ID },
+      userMessage: {
+        messageId: 'optimistic-user',
+        conversationId: CONV_ID,
+        text: 'thanks!',
+        isCreatedByUser: true,
+        sender: 'User',
+        parentMessageId: previousResponse.messageId,
+      },
+      messages: [previousUser, previousResponse],
+      initialResponse: {
+        messageId: 'optimistic-user_',
+        conversationId: CONV_ID,
+        text: '',
+        isCreatedByUser: false,
+        sender: 'Assistant',
+        parentMessageId: 'optimistic-user',
+      },
+    });
+    const chatHelpers = buildChatHelpers();
+
+    const { unmount } = renderHook(() => useResumableSSE(submission, chatHelpers));
+
+    await act(async () => {
+      await Promise.resolve();
+    });
+
+    const runStepEvent = {
+      event: StepEvents.ON_RUN_STEP,
+      data: {
+        id: 'step-oauth',
+        runId: Constants.USE_PRELIM_RESPONSE_MESSAGE_ID,
+        index: 0,
+        type: 'tool_calls',
+        stepDetails: {
+          type: 'tool_calls',
+          tool_calls: [{ id: 'call-oauth', name: 'oauth_mcp_Google-Workspace', args: '' }],
+        },
+      },
+    };
+    const runStepDeltaEvent = {
+      event: StepEvents.ON_RUN_STEP_DELTA,
+      data: {
+        id: 'step-oauth',
+        delta: {
+          type: 'tool_calls',
+          tool_calls: [{ id: 'call-oauth', name: 'oauth_mcp_Google-Workspace', args: '' }],
+          auth: 'https://auth.example.com/oauth',
+          expires_at: 1780791946,
+        },
+      },
+    };
+    const completedEvent = {
+      event: StepEvents.ON_RUN_STEP_COMPLETED,
+      data: {
+        result: {
+          id: 'step-oauth',
+          index: 0,
+          tool_call: {
+            id: 'call-oauth',
+            name: 'oauth_mcp_Google-Workspace',
+            args: '',
+            output: 'OAuth authentication completed',
+            type: 'tool_call',
+          },
+        },
+      },
+    };
+    const createdEvent = {
+      created: true,
+      message: {
+        messageId: 'server-user',
+        parentMessageId: previousResponse.messageId,
+        conversationId: CONV_ID,
+        sender: 'User',
+        text: 'thanks!',
+        isCreatedByUser: true,
+      },
+      streamId: CONV_ID,
+    };
+
+    const sse = getLastSSE();
+    await act(async () => {
+      sse._emit('message', { data: JSON.stringify(runStepEvent) });
+      sse._emit('message', { data: JSON.stringify(runStepDeltaEvent) });
+      sse._emit('message', { data: JSON.stringify(completedEvent) });
+    });
+
+    expect(mockStepHandler).toHaveBeenCalledTimes(3);
+    expect(mockStepHandler).toHaveBeenNthCalledWith(
+      3,
+      completedEvent,
+      expect.objectContaining({
+        initialResponse: expect.objectContaining({
+          messageId: 'optimistic-user_',
+          parentMessageId: 'optimistic-user',
+        }),
+      }),
+    );
+
+    await act(async () => {
+      sse._emit('message', { data: JSON.stringify(createdEvent) });
+    });
+
+    expect(mockCreatedHandler).toHaveBeenCalledWith(
+      createdEvent,
+      expect.objectContaining({
+        userMessage: expect.objectContaining({
+          messageId: 'server-user',
+          parentMessageId: previousResponse.messageId,
+        }),
+        initialResponse: expect.objectContaining({
+          messageId: 'server-user_',
+          parentMessageId: 'server-user',
+        }),
+      }),
+    );
+    expect(mockStepHandler).toHaveBeenCalledTimes(6);
+    for (let callIndex = 4; callIndex <= 6; callIndex++) {
+      expect(mockStepHandler).toHaveBeenNthCalledWith(
+        callIndex,
+        expect.any(Object),
+        expect.objectContaining({
+          userMessage: expect.objectContaining({
+            messageId: 'server-user',
+            parentMessageId: previousResponse.messageId,
+          }),
+          initialResponse: expect.objectContaining({
+            messageId: 'server-user_',
+            parentMessageId: 'server-user',
+          }),
+        }),
+      );
+    }
+
+    unmount();
+  });
+
   it('routes title stream events to the title handler', async () => {
     const submission = buildSubmission();
     const chatHelpers = buildChatHelpers();
@@ -462,6 +919,86 @@ describe('useResumableSSE - 404 error path', () => {
     unmount();
   });
 
+  it('continues retrying chat start while the server reports startup readiness pending', async () => {
+    jest.useFakeTimers();
+    for (let i = 0; i < 9; i++) {
+      (request.post as jest.Mock).mockRejectedValueOnce(serverNotReadyError('1'));
+    }
+    (request.post as jest.Mock).mockResolvedValueOnce({ streamId: 'stream-ready' });
+
+    const submission = buildSubmission();
+    const chatHelpers = buildChatHelpers();
+
+    const { unmount } = renderHook(() => useResumableSSE(submission, chatHelpers));
+
+    await flushMicrotasks();
+
+    for (let i = 0; i < 9; i++) {
+      await advanceRetryTimer(1000);
+    }
+
+    expect(request.post).toHaveBeenCalledTimes(10);
+    expect(mockSSEInstances).toHaveLength(1);
+    expect(mockSSEInstances[0].stream).toHaveBeenCalledTimes(1);
+    expect(mockErrorHandler).not.toHaveBeenCalled();
+    unmount();
+    jest.useRealTimers();
+  });
+
+  it('cancels startup readiness retries on cleanup before opening a stream', async () => {
+    jest.useFakeTimers();
+    (request.post as jest.Mock)
+      .mockRejectedValueOnce(serverNotReadyError('1'))
+      .mockResolvedValueOnce({ streamId: 'stale-stream' });
+
+    const submission = buildSubmission();
+    const chatHelpers = buildChatHelpers();
+
+    const { unmount } = renderHook(() => useResumableSSE(submission, chatHelpers));
+
+    await flushMicrotasks();
+    unmount();
+    await advanceRetryTimer(1000);
+
+    expect(request.post).toHaveBeenCalledTimes(1);
+    expect(mockSSEInstances).toHaveLength(0);
+    expect(mockErrorHandler).not.toHaveBeenCalled();
+    jest.useRealTimers();
+  });
+
+  it('clears submission and stop state when starting generation fails', async () => {
+    (request.post as jest.Mock).mockRejectedValueOnce({
+      response: {
+        status: 500,
+        data: { message: 'failed to start' },
+      },
+    });
+    const submission = buildSubmission();
+    const chatHelpers = buildChatHelpers();
+
+    const { unmount } = renderHook(() => useResumableSSE(submission, chatHelpers));
+
+    await waitFor(() => {
+      expect(mockSetSubmission).toHaveBeenCalledWith(null);
+    });
+
+    expect(mockSSEInstances).toHaveLength(0);
+    expect(mockErrorHandler).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: {
+          text: JSON.stringify({ message: 'failed to start' }),
+          metadata: { streamStartFailed: true },
+        },
+        submission,
+      }),
+    );
+    expect(mockSetIsSubmitting).toHaveBeenCalledWith(true);
+    expect(mockSetIsSubmitting).toHaveBeenCalledWith(false);
+    expect(mockSetShowStopButton).toHaveBeenCalledWith(true);
+    expect(mockSetShowStopButton).toHaveBeenCalledWith(false);
+    unmount();
+  });
+
   it('replays title events from resume state sync', async () => {
     const submission = buildSubmission();
     const chatHelpers = buildChatHelpers();
@@ -496,6 +1033,453 @@ describe('useResumableSSE - 404 error path', () => {
     unmount();
   });
 
+  it('replays OAuth run step delta events from resume state sync', async () => {
+    const submission = buildSubmission();
+    const chatHelpers = buildChatHelpers();
+
+    const { unmount } = renderHook(() => useResumableSSE(submission, chatHelpers));
+
+    await act(async () => {
+      await Promise.resolve();
+    });
+
+    const runStep = {
+      id: 'step-oauth',
+      runId: 'resp-1',
+      index: 0,
+      stepDetails: {
+        type: 'tool_calls',
+        tool_calls: [{ id: 'call-oauth', name: 'Google-Workspace', args: '' }],
+      },
+    };
+    const replayEvent = {
+      event: StepEvents.ON_RUN_STEP_DELTA,
+      data: {
+        id: 'step-oauth',
+        delta: {
+          type: 'tool_calls',
+          tool_calls: [{ name: 'Google-Workspace', args: '' }],
+          auth: 'https://auth.example.com/oauth',
+          expires_at: 1780791946,
+        },
+      },
+    };
+
+    const sse = getLastSSE();
+    await act(async () => {
+      sse._emit('message', {
+        data: JSON.stringify({
+          sync: true,
+          resumeState: {
+            runSteps: [runStep],
+            replayEvents: [replayEvent],
+          },
+        }),
+      });
+    });
+
+    expect(mockStepHandler).toHaveBeenNthCalledWith(
+      1,
+      { event: StepEvents.ON_RUN_STEP, data: runStep },
+      expect.objectContaining({ userMessage: expect.objectContaining({ messageId: 'msg-1' }) }),
+    );
+    expect(mockStepHandler).toHaveBeenNthCalledWith(
+      2,
+      replayEvent,
+      expect.objectContaining({ userMessage: expect.objectContaining({ messageId: 'msg-1' }) }),
+    );
+
+    unmount();
+  });
+
+  it('anchors preliminary OAuth replay events to the response message from resume state sync', async () => {
+    const submission = buildSubmission({
+      userMessage: {
+        messageId: 'original-user',
+        conversationId: CONV_ID,
+        text: 'Original prompt',
+        isCreatedByUser: true,
+        sender: 'User',
+        parentMessageId: Constants.NO_PARENT,
+      },
+      initialResponse: {
+        messageId: 'original-response',
+        conversationId: CONV_ID,
+        text: 'Original response',
+        isCreatedByUser: false,
+        sender: 'Assistant',
+        parentMessageId: 'original-user',
+      },
+    });
+    const chatHelpers = buildChatHelpers();
+
+    const { unmount } = renderHook(() => useResumableSSE(submission, chatHelpers));
+
+    await act(async () => {
+      await Promise.resolve();
+    });
+
+    const runStep = {
+      id: 'step-oauth',
+      runId: Constants.USE_PRELIM_RESPONSE_MESSAGE_ID,
+      index: 0,
+      stepDetails: {
+        type: 'tool_calls',
+        tool_calls: [{ id: 'call-oauth', name: 'oauth_mcp_Google-Workspace', args: '' }],
+      },
+    };
+    const replayEvent = {
+      event: StepEvents.ON_RUN_STEP_DELTA,
+      data: {
+        id: 'step-oauth',
+        delta: {
+          type: 'tool_calls',
+          tool_calls: [{ id: 'call-oauth', name: 'oauth_mcp_Google-Workspace', args: '' }],
+          auth: 'https://auth.example.com/oauth',
+          expires_at: 1780791946,
+        },
+      },
+    };
+
+    const sse = getLastSSE();
+    await act(async () => {
+      sse._emit('message', {
+        data: JSON.stringify({
+          sync: true,
+          resumeState: {
+            runSteps: [runStep],
+            replayEvents: [replayEvent],
+            responseMessageId: 'follow-up-response',
+            conversationId: CONV_ID,
+            iconURL: 'https://example.com/spec-icon.png',
+            model: 'gpt-4.1',
+            userMessage: {
+              messageId: 'follow-up-user',
+              parentMessageId: 'original-response',
+              conversationId: CONV_ID,
+              text: 'Follow-up prompt',
+            },
+          },
+        }),
+      });
+    });
+
+    expect(mockStepHandler).toHaveBeenNthCalledWith(
+      1,
+      { event: StepEvents.ON_RUN_STEP, data: runStep },
+      expect.objectContaining({
+        userMessage: expect.objectContaining({ messageId: 'follow-up-user' }),
+        initialResponse: expect.objectContaining({
+          messageId: 'follow-up-response',
+          parentMessageId: 'follow-up-user',
+        }),
+      }),
+    );
+    expect(mockStepHandler).toHaveBeenNthCalledWith(
+      2,
+      replayEvent,
+      expect.objectContaining({
+        userMessage: expect.objectContaining({ messageId: 'follow-up-user' }),
+        initialResponse: expect.objectContaining({
+          messageId: 'follow-up-response',
+          parentMessageId: 'follow-up-user',
+        }),
+      }),
+    );
+
+    unmount();
+  });
+
+  it('merges resumed user and response messages into loaded conversation history', async () => {
+    const originalUser = {
+      messageId: 'original-user',
+      conversationId: CONV_ID,
+      text: 'Original prompt',
+      isCreatedByUser: true,
+      sender: 'User',
+      parentMessageId: '00000000-0000-0000-0000-000000000000',
+    };
+    const originalResponse = {
+      messageId: 'original-response',
+      conversationId: CONV_ID,
+      text: 'Original response',
+      isCreatedByUser: false,
+      sender: 'Assistant',
+      parentMessageId: 'original-user',
+    };
+    const submission = {
+      ...buildSubmission({
+        conversation: { conversationId: CONV_ID },
+        userMessage: originalUser,
+        initialResponse: originalResponse,
+      }),
+      resumeStreamId: CONV_ID,
+    } as TSubmission & { resumeStreamId: string };
+    const chatHelpers = buildChatHelpers();
+    chatHelpers.getMessages.mockReturnValue([originalUser, originalResponse]);
+
+    const { unmount } = renderHook(() => useResumableSSE(submission, chatHelpers));
+
+    await act(async () => {
+      await Promise.resolve();
+    });
+
+    const sse = getLastSSE();
+    await act(async () => {
+      sse._emit('message', {
+        data: JSON.stringify({
+          sync: true,
+          resumeState: {
+            runSteps: [],
+            replayEvents: [],
+            aggregatedContent: [
+              {
+                type: 'tool_call',
+                tool_call: {
+                  id: 'call-oauth',
+                  name: 'oauth_mcp_Google-Workspace',
+                  args: '',
+                },
+              },
+            ],
+            responseMessageId: 'follow-up-response',
+            conversationId: CONV_ID,
+            iconURL: 'https://example.com/spec-icon.png',
+            model: 'gpt-4.1',
+            userMessage: {
+              messageId: 'follow-up-user',
+              parentMessageId: 'original-response',
+              conversationId: CONV_ID,
+              text: 'Follow-up prompt',
+            },
+          },
+        }),
+      });
+    });
+
+    const lastMessages = chatHelpers.setMessages.mock.calls.at(-1)?.[0];
+    expect(lastMessages.map((message: { messageId: string }) => message.messageId)).toEqual([
+      'original-user',
+      'original-response',
+      'follow-up-user',
+      'follow-up-response',
+    ]);
+    expect(lastMessages[2]).toEqual(
+      expect.objectContaining({
+        messageId: 'follow-up-user',
+        parentMessageId: 'original-response',
+        text: 'Follow-up prompt',
+      }),
+    );
+    expect(lastMessages[3]).toEqual(
+      expect.objectContaining({
+        messageId: 'follow-up-response',
+        parentMessageId: 'follow-up-user',
+        content: expect.any(Array),
+        iconURL: 'https://example.com/spec-icon.png',
+        model: 'gpt-4.1',
+      }),
+    );
+
+    unmount();
+  });
+
+  it('uses the resumed submission for final events after sync', async () => {
+    const originalUser = {
+      messageId: 'original-user',
+      conversationId: CONV_ID,
+      text: 'Original prompt',
+      isCreatedByUser: true,
+      sender: 'User',
+      parentMessageId: String(Constants.NO_PARENT),
+    };
+    const originalResponse = {
+      messageId: 'original-response',
+      conversationId: CONV_ID,
+      text: 'Original response',
+      isCreatedByUser: false,
+      sender: 'Assistant',
+      parentMessageId: 'original-user',
+    };
+    const submission = {
+      ...buildSubmission({
+        conversation: { conversationId: CONV_ID },
+        userMessage: originalUser,
+        initialResponse: originalResponse,
+      }),
+      resumeStreamId: CONV_ID,
+    } as TSubmission & { resumeStreamId: string };
+    const chatHelpers = buildChatHelpers();
+    chatHelpers.getMessages.mockReturnValue([originalUser, originalResponse]);
+
+    const { unmount } = renderHook(() => useResumableSSE(submission, chatHelpers));
+
+    await act(async () => {
+      await Promise.resolve();
+    });
+
+    const sse = getLastSSE();
+    await act(async () => {
+      sse._emit('message', {
+        data: JSON.stringify({
+          sync: true,
+          resumeState: {
+            runSteps: [],
+            replayEvents: [],
+            responseMessageId: 'follow-up-response',
+            conversationId: CONV_ID,
+            userMessage: {
+              messageId: 'follow-up-user',
+              parentMessageId: 'original-response',
+              conversationId: CONV_ID,
+              text: 'Follow-up prompt',
+            },
+          },
+        }),
+      });
+    });
+
+    const finalPayload = {
+      final: true,
+      conversation: { conversationId: CONV_ID },
+      requestMessage: {
+        messageId: 'follow-up-user',
+        parentMessageId: 'original-response',
+        conversationId: CONV_ID,
+        text: 'Follow-up prompt',
+        isCreatedByUser: true,
+      },
+      responseMessage: {
+        messageId: 'follow-up-response',
+        parentMessageId: 'follow-up-user',
+        conversationId: CONV_ID,
+        text: 'Done',
+        isCreatedByUser: false,
+      },
+    };
+
+    await act(async () => {
+      sse._emit('message', {
+        data: JSON.stringify(finalPayload),
+      });
+    });
+
+    expect(mockFinalHandler).toHaveBeenCalledWith(
+      finalPayload,
+      expect.objectContaining({
+        userMessage: expect.objectContaining({ messageId: 'follow-up-user' }),
+        initialResponse: expect.objectContaining({
+          messageId: 'follow-up-response',
+          parentMessageId: 'follow-up-user',
+        }),
+      }),
+    );
+
+    unmount();
+  });
+
+  it('uses the resumed submission for final events after reconnecting from sync', async () => {
+    jest.useFakeTimers();
+    const originalUser = {
+      messageId: 'original-user',
+      conversationId: CONV_ID,
+      text: 'Original prompt',
+      isCreatedByUser: true,
+      sender: 'User',
+      parentMessageId: String(Constants.NO_PARENT),
+    };
+    const originalResponse = {
+      messageId: 'original-response',
+      conversationId: CONV_ID,
+      text: 'Original response',
+      isCreatedByUser: false,
+      sender: 'Assistant',
+      parentMessageId: 'original-user',
+    };
+    const submission = {
+      ...buildSubmission({
+        conversation: { conversationId: CONV_ID },
+        userMessage: originalUser,
+        initialResponse: originalResponse,
+      }),
+      resumeStreamId: CONV_ID,
+    } as TSubmission & { resumeStreamId: string };
+    const chatHelpers = buildChatHelpers();
+    chatHelpers.getMessages.mockReturnValue([originalUser, originalResponse]);
+
+    const { unmount } = renderHook(() => useResumableSSE(submission, chatHelpers));
+
+    await act(async () => {
+      await Promise.resolve();
+    });
+
+    const initialSSE = getLastSSE();
+    await act(async () => {
+      initialSSE._emit('message', {
+        data: JSON.stringify({
+          sync: true,
+          resumeState: {
+            runSteps: [],
+            replayEvents: [],
+            responseMessageId: 'follow-up-response',
+            conversationId: CONV_ID,
+            userMessage: {
+              messageId: 'follow-up-user',
+              parentMessageId: 'original-response',
+              conversationId: CONV_ID,
+              text: 'Follow-up prompt',
+            },
+          },
+        }),
+      });
+    });
+
+    await act(async () => {
+      initialSSE._emit('error');
+    });
+    await advanceRetryTimer(1000);
+
+    expect(mockSSEInstances).toHaveLength(2);
+    const reconnectedSSE = getLastSSE();
+    const finalPayload = {
+      final: true,
+      conversation: { conversationId: CONV_ID },
+      requestMessage: {
+        messageId: 'follow-up-user',
+        parentMessageId: 'original-response',
+        conversationId: CONV_ID,
+        text: 'Follow-up prompt',
+        isCreatedByUser: true,
+      },
+      responseMessage: {
+        messageId: 'follow-up-response',
+        parentMessageId: 'follow-up-user',
+        conversationId: CONV_ID,
+        text: 'Done',
+        isCreatedByUser: false,
+      },
+    };
+
+    await act(async () => {
+      reconnectedSSE._emit('message', {
+        data: JSON.stringify(finalPayload),
+      });
+    });
+
+    expect(mockFinalHandler).toHaveBeenLastCalledWith(
+      finalPayload,
+      expect.objectContaining({
+        userMessage: expect.objectContaining({ messageId: 'follow-up-user' }),
+        initialResponse: expect.objectContaining({
+          messageId: 'follow-up-response',
+          parentMessageId: 'follow-up-user',
+        }),
+      }),
+    );
+
+    unmount();
+  });
+
   it.each([undefined, 500, 503])(
     'does not call errorHandler for responseCode %s (reconnect path)',
     async (responseCode) => {
diff --git a/client/src/hooks/SSE/__tests__/useResumeOnLoad.spec.tsx b/client/src/hooks/SSE/__tests__/useResumeOnLoad.spec.tsx
index 9b785b9655c..fdb6d79c9f9 100644
--- a/client/src/hooks/SSE/__tests__/useResumeOnLoad.spec.tsx
+++ b/client/src/hooks/SSE/__tests__/useResumeOnLoad.spec.tsx
@@ -67,6 +67,8 @@ function renderUseResumeOnLoad({
   conversationId = CONVERSATION_ID,
   messagesLoaded = true,
   onSubmission,
+  siblingIndexParentId,
+  onSiblingIndex,
 }: {
   messages?: TMessage[];
   getMessages?: () => TMessage[] | undefined;
@@ -74,6 +76,8 @@ function renderUseResumeOnLoad({
   conversationId?: string;
   messagesLoaded?: boolean;
   onSubmission?: (submission: TSubmission | null) => void;
+  siblingIndexParentId?: string;
+  onSiblingIndex?: (siblingIndex: number) => void;
 }) {
   const getMessages = jest.fn(getMessagesOverride ?? (() => messages));
   const initializeState = (snapshot: MutableSnapshot) => {
@@ -86,10 +90,18 @@ function renderUseResumeOnLoad({
     onSubmission?.(currentSubmission);
     return null;
   };
+  const SiblingIndexProbe = () => {
+    const siblingIndex = useRecoilValue(store.messagesSiblingIdxFamily(siblingIndexParentId));
+    if (siblingIndexParentId) {
+      onSiblingIndex?.(siblingIndex);
+    }
+    return null;
+  };
 
   const wrapper = ({ children }: { children: ReactNode }) => (
     <RecoilRoot initializeState={initializeState}>
       <SubmissionProbe />
+      <SiblingIndexProbe />
       {children}
     </RecoilRoot>
   );
@@ -191,4 +203,178 @@ describe('useResumeOnLoad', () => {
     expect(mockUseStreamStatus).toHaveBeenCalledWith(CONVERSATION_ID, true);
     expect(observedSubmissions[observedSubmissions.length - 1]).toBe(submission);
   });
+
+  it('restores model spec icon metadata on the resumed assistant placeholder', async () => {
+    const observedSubmissions: Array<TSubmission | null> = [];
+    mockUseStreamStatus.mockReturnValue({
+      isSuccess: true,
+      isFetching: false,
+      data: {
+        active: true,
+        status: 'running',
+        streamId: CONVERSATION_ID,
+        resumeState: {
+          runSteps: [],
+          aggregatedContent: [{ type: 'text', text: 'Streaming...' }],
+          responseMessageId: RESPONSE_MESSAGE_ID,
+          conversationId: CONVERSATION_ID,
+          sender: 'Spec Agent',
+          iconURL: 'https://example.com/spec-icon.png',
+          model: 'gpt-4.1',
+          userMessage: {
+            messageId: USER_MESSAGE_ID,
+            parentMessageId: Constants.NO_PARENT,
+            conversationId: CONVERSATION_ID,
+            text: 'Hello',
+          },
+        },
+      },
+    });
+
+    renderUseResumeOnLoad({
+      messages: [
+        buildUserMessage(CONVERSATION_ID),
+        {
+          messageId: RESPONSE_MESSAGE_ID,
+          parentMessageId: USER_MESSAGE_ID,
+          conversationId: CONVERSATION_ID,
+          text: '',
+          isCreatedByUser: false,
+          iconURL: '',
+          model: '',
+        } as TMessage,
+      ],
+      onSubmission: (currentSubmission) => observedSubmissions.push(currentSubmission),
+    });
+
+    await act(async () => {
+      await Promise.resolve();
+    });
+
+    expect(observedSubmissions[observedSubmissions.length - 1]?.initialResponse).toEqual(
+      expect.objectContaining({
+        messageId: RESPONSE_MESSAGE_ID,
+        sender: 'Spec Agent',
+        iconURL: 'https://example.com/spec-icon.png',
+        model: 'gpt-4.1',
+      }),
+    );
+  });
+
+  it('restores the branch that owns a pending OAuth resume user message', async () => {
+    const rootUser = buildUserMessage(CONVERSATION_ID, 'root-user');
+    const branchOneResponse = {
+      messageId: 'branch-one-response',
+      parentMessageId: rootUser.messageId,
+      conversationId: CONVERSATION_ID,
+      text: 'Branch one response',
+      isCreatedByUser: false,
+    } as TMessage;
+    const branchOneFollowUp = buildUserMessage(CONVERSATION_ID, 'branch-one-follow-up');
+    branchOneFollowUp.parentMessageId = branchOneResponse.messageId;
+    const branchOneTail = {
+      messageId: 'branch-one-tail',
+      parentMessageId: branchOneFollowUp.messageId,
+      conversationId: CONVERSATION_ID,
+      text: 'Branch one tail',
+      isCreatedByUser: false,
+    } as TMessage;
+    const branchTwoResponse = {
+      messageId: 'branch-two-response',
+      parentMessageId: rootUser.messageId,
+      conversationId: CONVERSATION_ID,
+      text: 'Branch two response',
+      isCreatedByUser: false,
+    } as TMessage;
+    const observedSiblingIndexes: number[] = [];
+
+    mockUseStreamStatus.mockReturnValue({
+      isSuccess: true,
+      isFetching: false,
+      data: {
+        active: true,
+        status: 'running',
+        streamId: CONVERSATION_ID,
+        resumeState: {
+          runSteps: [],
+          aggregatedContent: [],
+          replayEvents: [],
+          responseMessageId: 'pending-user_',
+          conversationId: CONVERSATION_ID,
+          userMessage: {
+            messageId: 'pending-user',
+            parentMessageId: branchOneTail.messageId,
+            conversationId: CONVERSATION_ID,
+            text: 'Use OAuth tool on branch one',
+          },
+        },
+      },
+    });
+
+    renderUseResumeOnLoad({
+      messages: [rootUser, branchOneResponse, branchOneFollowUp, branchOneTail, branchTwoResponse],
+      siblingIndexParentId: rootUser.messageId,
+      onSiblingIndex: (siblingIndex) => observedSiblingIndexes.push(siblingIndex),
+    });
+
+    await act(async () => {
+      await Promise.resolve();
+    });
+
+    expect(observedSiblingIndexes[observedSiblingIndexes.length - 1]).toBe(1);
+  });
+
+  it('restores the assistant sibling selected by a pending regenerate response', async () => {
+    const rootUser = buildUserMessage(CONVERSATION_ID, 'root-user');
+    const olderResponse = {
+      messageId: 'older-response',
+      parentMessageId: rootUser.messageId,
+      conversationId: CONVERSATION_ID,
+      text: 'Older response',
+      isCreatedByUser: false,
+    } as TMessage;
+    const newerResponse = {
+      messageId: 'newer-response',
+      parentMessageId: rootUser.messageId,
+      conversationId: CONVERSATION_ID,
+      text: 'Newer response',
+      isCreatedByUser: false,
+    } as TMessage;
+    const observedSiblingIndexes: number[] = [];
+
+    mockUseStreamStatus.mockReturnValue({
+      isSuccess: true,
+      isFetching: false,
+      data: {
+        active: true,
+        status: 'running',
+        streamId: CONVERSATION_ID,
+        resumeState: {
+          runSteps: [],
+          aggregatedContent: [],
+          replayEvents: [],
+          responseMessageId: `${olderResponse.messageId}_`,
+          conversationId: CONVERSATION_ID,
+          userMessage: {
+            messageId: rootUser.messageId,
+            parentMessageId: rootUser.parentMessageId,
+            conversationId: CONVERSATION_ID,
+            text: rootUser.text,
+          },
+        },
+      },
+    });
+
+    renderUseResumeOnLoad({
+      messages: [rootUser, olderResponse, newerResponse],
+      siblingIndexParentId: rootUser.messageId,
+      onSiblingIndex: (siblingIndex) => observedSiblingIndexes.push(siblingIndex),
+    });
+
+    await act(async () => {
+      await Promise.resolve();
+    });
+
+    expect(observedSiblingIndexes[observedSiblingIndexes.length - 1]).toBe(1);
+  });
 });
diff --git a/client/src/hooks/SSE/__tests__/useStepHandler.spec.ts b/client/src/hooks/SSE/__tests__/useStepHandler.spec.ts
index ae28a9e6f19..0e04fb43c65 100644
--- a/client/src/hooks/SSE/__tests__/useStepHandler.spec.ts
+++ b/client/src/hooks/SSE/__tests__/useStepHandler.spec.ts
@@ -1,5 +1,5 @@
-import { renderHook, act } from '@testing-library/react';
 import { RecoilRoot, useRecoilCallback } from 'recoil';
+import { renderHook, act } from '@testing-library/react';
 import {
   Constants,
   StepTypes,
@@ -17,8 +17,20 @@ import type {
   SubagentUpdateEvent,
   Agents,
 } from 'librechat-data-provider';
-import useStepHandler from '~/hooks/SSE/useStepHandler';
 import { subagentProgressByToolCallId } from '~/store/subagents';
+import useStepHandler from '~/hooks/SSE/useStepHandler';
+
+/** `Constants` is a heterogeneous enum (`string | number`); annotate as
+ *  `string` so the member is usable where a `string` field is expected. */
+const USE_PRELIM_RESPONSE_MESSAGE_ID: string = Constants.USE_PRELIM_RESPONSE_MESSAGE_ID;
+
+const getToolCallName = (part?: TMessageContentParts): string | undefined => {
+  if (part?.type !== ContentTypes.TOOL_CALL) {
+    return undefined;
+  }
+  const { tool_call: toolCall } = part;
+  return 'name' in toolCall ? toolCall.name : undefined;
+};
 
 type TSubmissionForTest = {
   userMessage: TMessage;
@@ -37,6 +49,7 @@ describe('useStepHandler', () => {
   const mockSetMessages = jest.fn();
   const mockGetMessages = jest.fn();
   const mockAnnouncePolite = jest.fn();
+  const mockOnSkillAuthoringComplete = jest.fn();
   const mockLastAnnouncementTimeRef = { current: 0 };
 
   const createHookParams = () => ({
@@ -44,6 +57,7 @@ describe('useStepHandler', () => {
     getMessages: mockGetMessages,
     announcePolite: mockAnnouncePolite,
     lastAnnouncementTimeRef: mockLastAnnouncementTimeRef,
+    onSkillAuthoringComplete: mockOnSkillAuthoringComplete,
   });
 
   const createUserMessage = (overrides: Partial<TMessage> = {}): TMessage => ({
@@ -234,6 +248,182 @@ describe('useStepHandler', () => {
       );
     });
 
+    it('should preserve multiple tool call steps for the same preliminary response', () => {
+      const responseMessage = createResponseMessage();
+      let currentMessages = [responseMessage];
+      mockGetMessages.mockImplementation(() => currentMessages);
+      mockSetMessages.mockImplementation((messages) => {
+        currentMessages = messages;
+      });
+
+      const { result } = renderHook(() => useStepHandler(createHookParams()));
+      const submission = createSubmission({ initialResponse: responseMessage });
+
+      const firstRunStep = createToolCallRunStep({
+        id: 'step-oauth-eli',
+        runId: USE_PRELIM_RESPONSE_MESSAGE_ID,
+        index: 0,
+        stepDetails: {
+          type: StepTypes.TOOL_CALLS,
+          tool_calls: [
+            {
+              id: 'tool-call-eli',
+              name: `oauth${Constants.mcp_delimiter}ELI`,
+              args: '',
+              type: ToolCallTypes.TOOL_CALL,
+            },
+          ],
+        },
+      });
+      const secondRunStep = createToolCallRunStep({
+        id: 'step-oauth-vespa',
+        runId: USE_PRELIM_RESPONSE_MESSAGE_ID,
+        index: 1,
+        stepDetails: {
+          type: StepTypes.TOOL_CALLS,
+          tool_calls: [
+            {
+              id: 'tool-call-vespa',
+              name: `oauth${Constants.mcp_delimiter}Vespa`,
+              args: '',
+              type: ToolCallTypes.TOOL_CALL,
+            },
+          ],
+        },
+      });
+
+      act(() => {
+        result.current.stepHandler(
+          { event: StepEvents.ON_RUN_STEP, data: firstRunStep },
+          submission,
+        );
+        result.current.stepHandler(
+          { event: StepEvents.ON_RUN_STEP, data: secondRunStep },
+          submission,
+        );
+      });
+
+      const responseMsg = currentMessages.find((m) => !m.isCreatedByUser);
+      expect(responseMsg?.content).toHaveLength(2);
+      expect(getToolCallName(responseMsg?.content?.[0])).toBe(`oauth${Constants.mcp_delimiter}ELI`);
+      expect(getToolCallName(responseMsg?.content?.[1])).toBe(
+        `oauth${Constants.mcp_delimiter}Vespa`,
+      );
+    });
+
+    it('should clear OAuth prompt slots when one occupies the real response slot', () => {
+      const responseMessage = createResponseMessage();
+      let currentMessages = [responseMessage];
+      mockGetMessages.mockImplementation(() => currentMessages);
+      mockSetMessages.mockImplementation((messages) => {
+        currentMessages = messages;
+      });
+
+      const { result } = renderHook(() => useStepHandler(createHookParams()));
+      const submission = createSubmission({ initialResponse: responseMessage });
+
+      act(() => {
+        result.current.stepHandler(
+          {
+            event: StepEvents.ON_RUN_STEP,
+            data: createToolCallRunStep({
+              id: 'step-oauth-eli',
+              runId: USE_PRELIM_RESPONSE_MESSAGE_ID,
+              index: 0,
+              stepDetails: {
+                type: StepTypes.TOOL_CALLS,
+                tool_calls: [
+                  {
+                    id: 'tool-call-eli',
+                    name: `oauth${Constants.mcp_delimiter}ELI`,
+                    args: '',
+                    type: ToolCallTypes.TOOL_CALL,
+                  },
+                ],
+              },
+            }),
+          },
+          submission,
+        );
+        result.current.stepHandler(
+          {
+            event: StepEvents.ON_RUN_STEP,
+            data: createToolCallRunStep({
+              id: 'step-oauth-vespa',
+              runId: USE_PRELIM_RESPONSE_MESSAGE_ID,
+              index: 1,
+              stepDetails: {
+                type: StepTypes.TOOL_CALLS,
+                tool_calls: [
+                  {
+                    id: 'tool-call-vespa',
+                    name: `oauth${Constants.mcp_delimiter}Vespa`,
+                    args: '',
+                    type: ToolCallTypes.TOOL_CALL,
+                  },
+                ],
+              },
+            }),
+          },
+          submission,
+        );
+        result.current.stepHandler(
+          {
+            event: StepEvents.ON_RUN_STEP,
+            data: createRunStep({
+              id: 'step-message',
+              runId: USE_PRELIM_RESPONSE_MESSAGE_ID,
+              index: 0,
+            }),
+          },
+          submission,
+        );
+        result.current.stepHandler(
+          { event: StepEvents.ON_MESSAGE_DELTA, data: createMessageDelta('step-message', 'Ready') },
+          submission,
+        );
+      });
+
+      const responseMsg = currentMessages.find((m) => !m.isCreatedByUser);
+      expect(responseMsg?.content).toEqual([{ type: ContentTypes.TEXT, text: 'Ready' }]);
+    });
+
+    it('should not replace the message list from a shorter refresh during tool call steps', () => {
+      const userMessage = createUserMessage();
+      const responseMessage = createResponseMessage();
+      mockGetMessages.mockReturnValueOnce([userMessage, responseMessage]).mockReturnValueOnce([]);
+
+      const { result } = renderHook(() => useStepHandler(createHookParams()));
+
+      const runStep = createToolCallRunStep({
+        runId: responseMessage.messageId,
+        stepDetails: {
+          type: StepTypes.TOOL_CALLS,
+          tool_calls: [
+            {
+              id: 'tool-call-eli',
+              name: `oauth${Constants.mcp_delimiter}ELI`,
+              args: '',
+              type: ToolCallTypes.TOOL_CALL,
+            },
+          ],
+        },
+      });
+
+      act(() => {
+        result.current.stepHandler(
+          { event: StepEvents.ON_RUN_STEP, data: runStep },
+          createSubmission({ userMessage, initialResponse: responseMessage }),
+        );
+      });
+
+      const lastCall = mockSetMessages.mock.calls[mockSetMessages.mock.calls.length - 1][0];
+      expect(lastCall.map((message: TMessage) => message.messageId)).toEqual([
+        userMessage.messageId,
+        responseMessage.messageId,
+      ]);
+    });
+
     it('should replay buffered deltas after registering step', () => {
       const responseMessage = createResponseMessage();
       mockGetMessages.mockReturnValue([responseMessage]);
@@ -286,6 +476,541 @@ describe('useStepHandler', () => {
       );
     });
 
+    it('keeps the pending user message when replayed OAuth tool calls merge immediately', () => {
+      const rootUser = createUserMessage({ messageId: 'root-user' });
+      const selectedResponse = createResponseMessage({
+        messageId: 'selected-response',
+        parentMessageId: rootUser.messageId,
+      });
+      const followUpUser = createUserMessage({
+        messageId: 'follow-up-user',
+        parentMessageId: selectedResponse.messageId,
+      });
+      const followUpResponse = createResponseMessage({
+        messageId: 'follow-up-response',
+        parentMessageId: followUpUser.messageId,
+      });
+      const siblingResponse = createResponseMessage({
+        messageId: 'sibling-response',
+        parentMessageId: rootUser.messageId,
+      });
+      const pendingUser = createUserMessage({
+        messageId: 'pending-user',
+        parentMessageId: followUpResponse.messageId,
+      });
+      const initialResponse = createResponseMessage({
+        messageId: 'pending-user_',
+        parentMessageId: pendingUser.messageId,
+      });
+
+      let currentMessages = [
+        rootUser,
+        selectedResponse,
+        followUpUser,
+        followUpResponse,
+        siblingResponse,
+      ];
+      mockGetMessages.mockImplementation(() => currentMessages);
+      mockSetMessages.mockImplementation((messages) => {
+        currentMessages = messages;
+      });
+
+      const { result } = renderHook(() => useStepHandler(createHookParams()));
+
+      const runStep = createToolCallRunStep({
+        id: 'step-oauth-login',
+        runId: USE_PRELIM_RESPONSE_MESSAGE_ID,
+        stepDetails: {
+          type: StepTypes.TOOL_CALLS,
+          tool_calls: [
+            {
+              id: 'tool-call-oauth',
+              name: `oauth${Constants.mcp_delimiter}Google-Workspace`,
+              args: '',
+              type: ToolCallTypes.TOOL_CALL,
+            },
+          ],
+        },
+      });
+      const submission = createSubmission({
+        userMessage: pendingUser,
+        messages: currentMessages,
+        initialResponse,
+      });
+
+      act(() => {
+        result.current.stepHandler({ event: StepEvents.ON_RUN_STEP, data: runStep }, submission);
+      });
+
+      expect(currentMessages.map((message) => message.messageId)).toEqual([
+        rootUser.messageId,
+        selectedResponse.messageId,
+        followUpUser.messageId,
+        followUpResponse.messageId,
+        siblingResponse.messageId,
+        pendingUser.messageId,
+        initialResponse.messageId,
+      ]);
+      expect(currentMessages.at(-1)).toEqual(
+        expect.objectContaining({
+          messageId: initialResponse.messageId,
+          parentMessageId: pendingUser.messageId,
+          content: expect.arrayContaining([
+            expect.objectContaining({
+              type: ContentTypes.TOOL_CALL,
+              tool_call: expect.objectContaining({
+                name: `oauth${Constants.mcp_delimiter}Google-Workspace`,
+              }),
+            }),
+          ]),
+        }),
+      );
+    });
+
+    it('keeps pending OAuth ancestry when content arrives after an orphaned refresh', () => {
+      const rootUser = createUserMessage({ messageId: 'root-user' });
+      const existingResponse = createResponseMessage({
+        messageId: 'existing-response',
+        parentMessageId: rootUser.messageId,
+      });
+      const pendingUser = createUserMessage({
+        messageId: 'pending-user',
+        parentMessageId: existingResponse.messageId,
+      });
+      const initialResponse = createResponseMessage({
+        messageId: 'pending-user_',
+        parentMessageId: pendingUser.messageId,
+      });
+
+      let currentMessages = [rootUser, existingResponse];
+      mockGetMessages.mockImplementation(() => currentMessages);
+      mockSetMessages.mockImplementation((messages) => {
+        currentMessages = messages;
+      });
+
+      const { result } = renderHook(() => useStepHandler(createHookParams()));
+      const submission = createSubmission({
+        userMessage: pendingUser,
+        messages: [rootUser, existingResponse],
+        initialResponse,
+      });
+
+      act(() => {
+        result.current.stepHandler(
+          {
+            event: StepEvents.ON_RUN_STEP,
+            data: createToolCallRunStep({
+              id: 'step-oauth-login',
+              runId: USE_PRELIM_RESPONSE_MESSAGE_ID,
+              stepDetails: {
+                type: StepTypes.TOOL_CALLS,
+                tool_calls: [
+                  {
+                    id: 'tool-call-oauth',
+                    name: `oauth${Constants.mcp_delimiter}Google-Workspace`,
+                    args: '',
+                    type: ToolCallTypes.TOOL_CALL,
+                  },
+                ],
+              },
+            }),
+          },
+          submission,
+        );
+        result.current.stepHandler(
+          {
+            event: StepEvents.ON_RUN_STEP,
+            data: createRunStep({
+              id: 'step-message',
+              runId: USE_PRELIM_RESPONSE_MESSAGE_ID,
+              index: 0,
+            }),
+          },
+          submission,
+        );
+      });
+
+      currentMessages = [initialResponse];
+
+      act(() => {
+        result.current.stepHandler(
+          { event: StepEvents.ON_MESSAGE_DELTA, data: createMessageDelta('step-message', 'Ready') },
+          submission,
+        );
+      });
+
+      expect(currentMessages.map((message) => message.messageId)).toEqual([
+        rootUser.messageId,
+        existingResponse.messageId,
+        pendingUser.messageId,
+        initialResponse.messageId,
+      ]);
+      expect(currentMessages.at(-1)).toEqual(
+        expect.objectContaining({
+          parentMessageId: pendingUser.messageId,
+          content: [{ type: ContentTypes.TEXT, text: 'Ready' }],
+        }),
+      );
+    });
+
+    it('replaces the preliminary OAuth response when post-auth streaming uses a stable response id', () => {
+      const rootUser = createUserMessage({ messageId: 'root-user' });
+      const existingResponse = createResponseMessage({
+        messageId: 'existing-response',
+        parentMessageId: rootUser.messageId,
+      });
+      const pendingUser = createUserMessage({
+        messageId: 'pending-user',
+        parentMessageId: existingResponse.messageId,
+      });
+      const preliminaryResponse = createResponseMessage({
+        messageId: 'pending-user_',
+        parentMessageId: pendingUser.messageId,
+        content: [
+          {
+            type: ContentTypes.TOOL_CALL,
+            tool_call: {
+              id: 'tool-call-oauth',
+              name: `oauth${Constants.mcp_delimiter}Google-Workspace`,
+              type: ToolCallTypes.TOOL_CALL,
+              args: '',
+            },
+          },
+        ],
+      });
+      const stableResponse = createResponseMessage({
+        messageId: 'stable-response',
+        parentMessageId: pendingUser.messageId,
+      });
+
+      let currentMessages = [rootUser, existingResponse, preliminaryResponse];
+      mockGetMessages.mockImplementation(() => currentMessages);
+      mockSetMessages.mockImplementation((messages) => {
+        currentMessages = messages;
+      });
+
+      const { result } = renderHook(() => useStepHandler(createHookParams()));
+      const submission = createSubmission({
+        userMessage: pendingUser,
+        messages: [rootUser, existingResponse],
+        initialResponse: preliminaryResponse,
+      });
+
+      act(() => {
+        result.current.stepHandler(
+          {
+            event: StepEvents.ON_RUN_STEP,
+            data: createRunStep({
+              id: 'step-message',
+              runId: stableResponse.messageId,
+              index: 0,
+            }),
+          },
+          submission,
+        );
+      });
+
+      expect(currentMessages.map((message) => message.messageId)).toEqual([
+        rootUser.messageId,
+        existingResponse.messageId,
+        pendingUser.messageId,
+        stableResponse.messageId,
+      ]);
+
+      act(() => {
+        result.current.stepHandler(
+          { event: StepEvents.ON_MESSAGE_DELTA, data: createMessageDelta('step-message', 'Ready') },
+          submission,
+        );
+      });
+
+      expect(currentMessages.map((message) => message.messageId)).toEqual([
+        rootUser.messageId,
+        existingResponse.messageId,
+        pendingUser.messageId,
+        stableResponse.messageId,
+      ]);
+      expect(currentMessages.at(-1)).toEqual(
+        expect.objectContaining({
+          messageId: stableResponse.messageId,
+          parentMessageId: pendingUser.messageId,
+          content: [{ type: ContentTypes.TEXT, text: 'Ready' }],
+        }),
+      );
+    });
+
+    it('should not insert regenerate transport userMessage before preliminary OAuth steps', () => {
+      const originalUser = createUserMessage({ messageId: 'original-user-message' });
+      const originalResponse = createResponseMessage({
+        messageId: 'original-response-message',
+        parentMessageId: originalUser.messageId,
+      });
+      const initialResponse = createResponseMessage({
+        messageId: 'original-response-message_',
+        parentMessageId: originalUser.messageId,
+      });
+      const regenerateUserMessage = createUserMessage({
+        messageId: 'synthetic-regenerate-user-message',
+        parentMessageId: originalResponse.messageId,
+      });
+
+      let currentMessages = [originalUser];
+      mockGetMessages.mockImplementation(() => currentMessages);
+      mockSetMessages.mockImplementation((messages) => {
+        currentMessages = messages;
+      });
+
+      const { result } = renderHook(() => useStepHandler(createHookParams()));
+
+      const runStep = createToolCallRunStep({
+        id: 'step-oauth-login',
+        runId: USE_PRELIM_RESPONSE_MESSAGE_ID,
+        stepDetails: {
+          type: StepTypes.TOOL_CALLS,
+          tool_calls: [
+            {
+              id: 'tool-call-oauth',
+              name: `oauth${Constants.mcp_delimiter}Google-Workspace`,
+              args: '',
+              type: ToolCallTypes.TOOL_CALL,
+            },
+          ],
+        },
+      });
+      const submission = createSubmission({
+        userMessage: regenerateUserMessage,
+        isRegenerate: true,
+        messages: [originalUser, originalResponse],
+        initialResponse,
+      });
+
+      act(() => {
+        result.current.stepHandler({ event: StepEvents.ON_RUN_STEP, data: runStep }, submission);
+      });
+
+      expect(currentMessages).toHaveLength(2);
+      expect(currentMessages.map((message) => message.messageId)).toEqual([
+        originalUser.messageId,
+        initialResponse.messageId,
+      ]);
+      expect(currentMessages).not.toContainEqual(
+        expect.objectContaining({ messageId: regenerateUserMessage.messageId }),
+      );
+      expect(currentMessages[1]?.content).toContainEqual(
+        expect.objectContaining({
+          type: ContentTypes.TOOL_CALL,
+          tool_call: expect.objectContaining({
+            name: `oauth${Constants.mcp_delimiter}Google-Workspace`,
+          }),
+        }),
+      );
+    });
+
+    it('should preserve regenerate history when OAuth steps arrive before optimistic state commits', () => {
+      const originalUser = createUserMessage({ messageId: 'original-user-message' });
+      const originalResponse = createResponseMessage({
+        messageId: 'original-response-message',
+        parentMessageId: originalUser.messageId,
+      });
+      const initialResponse = createResponseMessage({
+        messageId: 'original-response-message_',
+        parentMessageId: originalUser.messageId,
+      });
+      const regenerateUserMessage = createUserMessage({
+        messageId: 'synthetic-regenerate-user-message',
+        parentMessageId: originalResponse.messageId,
+      });
+
+      mockGetMessages.mockReturnValue([]);
+
+      const { result } = renderHook(() => useStepHandler(createHookParams()));
+
+      const runStep = createToolCallRunStep({
+        id: 'step-oauth-login',
+        runId: USE_PRELIM_RESPONSE_MESSAGE_ID,
+        stepDetails: {
+          type: StepTypes.TOOL_CALLS,
+          tool_calls: [
+            {
+              id: 'tool-call-oauth',
+              name: `oauth${Constants.mcp_delimiter}Google-Workspace`,
+              args: '',
+              type: ToolCallTypes.TOOL_CALL,
+            },
+          ],
+        },
+      });
+      const submission = createSubmission({
+        userMessage: regenerateUserMessage,
+        isRegenerate: true,
+        messages: [originalUser],
+        initialResponse,
+      });
+
+      act(() => {
+        result.current.stepHandler({ event: StepEvents.ON_RUN_STEP, data: runStep }, submission);
+      });
+
+      const lastCall = mockSetMessages.mock.calls[mockSetMessages.mock.calls.length - 1][0];
+      expect(lastCall).toHaveLength(2);
+      expect(lastCall.map((message: TMessage) => message.messageId)).toEqual([
+        originalUser.messageId,
+        initialResponse.messageId,
+      ]);
+      expect(lastCall).not.toContainEqual(
+        expect.objectContaining({ messageId: regenerateUserMessage.messageId }),
+      );
+      expect(lastCall[1]?.content).toContainEqual(
+        expect.objectContaining({
+          type: ContentTypes.TOOL_CALL,
+          tool_call: expect.objectContaining({
+            name: `oauth${Constants.mcp_delimiter}Google-Workspace`,
+          }),
+        }),
+      );
+    });
+
+    it('does not seed non-tail regenerate run steps from the latest assistant message', () => {
+      const originalUser = createUserMessage({ messageId: 'original-user-message' });
+      const originalResponse = createResponseMessage({
+        messageId: 'original-response-message',
+        parentMessageId: originalUser.messageId,
+        content: [
+          {
+            type: ContentTypes.TEXT,
+            text: 'Original response',
+          },
+        ],
+      });
+      const followUpUser = createUserMessage({
+        messageId: 'follow-up-user-message',
+        parentMessageId: originalResponse.messageId,
+      });
+      const latestResponse = createResponseMessage({
+        messageId: 'latest-response-message',
+        parentMessageId: followUpUser.messageId,
+        content: [
+          {
+            type: ContentTypes.TEXT,
+            text: 'Latest response content must not leak into regenerate',
+          },
+        ],
+      });
+      const initialResponse = createResponseMessage({
+        messageId: 'original-response-message_',
+        parentMessageId: originalUser.messageId,
+        content: [],
+      });
+      const regenerateUserMessage = createUserMessage({
+        messageId: 'server-regenerate-user-message',
+        parentMessageId: originalResponse.messageId,
+      });
+
+      let currentMessages = [originalUser, originalResponse, followUpUser, latestResponse];
+      mockGetMessages.mockImplementation(() => currentMessages);
+      mockSetMessages.mockImplementation((messages) => {
+        currentMessages = messages;
+      });
+
+      const { result } = renderHook(() => useStepHandler(createHookParams()));
+
+      const runStep = createRunStep({
+        id: 'step-message-create',
+        runId: 'server-regenerated-response-message',
+      });
+      const submission = createSubmission({
+        userMessage: regenerateUserMessage,
+        isRegenerate: true,
+        messages: [originalUser],
+        initialResponse,
+      });
+
+      act(() => {
+        result.current.stepHandler({ event: StepEvents.ON_RUN_STEP, data: runStep }, submission);
+      });
+
+      const regeneratedResponse = currentMessages.find(
+        (message) => message.messageId === 'server-regenerated-response-message',
+      );
+      expect(regeneratedResponse).toEqual(
+        expect.objectContaining({
+          parentMessageId: originalUser.messageId,
+          content: [],
+        }),
+      );
+      expect(regeneratedResponse?.content).not.toEqual(latestResponse.content);
+      expect(currentMessages.map((message) => message.messageId)).toEqual([
+        originalUser.messageId,
+        'server-regenerated-response-message',
+      ]);
+    });
+
+    it('preserves sibling assistant responses when regenerating one response', () => {
+      const originalUser = createUserMessage({ messageId: 'original-user-message' });
+      const selectedResponse = createResponseMessage({
+        messageId: 'selected-response-message',
+        parentMessageId: originalUser.messageId,
+        content: [
+          {
+            type: ContentTypes.TEXT,
+            text: 'Selected response',
+          },
+        ],
+      });
+      const siblingResponse = createResponseMessage({
+        messageId: 'sibling-response-message',
+        parentMessageId: originalUser.messageId,
+        content: [
+          {
+            type: ContentTypes.TEXT,
+            text: 'Sibling response should stay visible',
+          },
+        ],
+      });
+      const initialResponse = createResponseMessage({
+        messageId: 'selected-response-message_',
+        parentMessageId: originalUser.messageId,
+        content: [],
+      });
+      const regenerateUserMessage = createUserMessage({
+        messageId: 'server-regenerate-user-message',
+        parentMessageId: selectedResponse.messageId,
+        responseMessageId: initialResponse.messageId,
+      });
+
+      let currentMessages = [originalUser, selectedResponse, siblingResponse];
+      mockGetMessages.mockImplementation(() => currentMessages);
+      mockSetMessages.mockImplementation((messages) => {
+        currentMessages = messages;
+      });
+
+      const { result } = renderHook(() => useStepHandler(createHookParams()));
+
+      const runStep = createRunStep({
+        id: 'step-message-create',
+        runId: 'server-regenerated-response-message',
+      });
+      const submission = createSubmission({
+        userMessage: regenerateUserMessage,
+        isRegenerate: true,
+        messages: [originalUser, selectedResponse, siblingResponse],
+        initialResponse,
+      });
+
+      act(() => {
+        result.current.stepHandler({ event: StepEvents.ON_RUN_STEP, data: runStep }, submission);
+      });
+
+      expect(currentMessages.map((message) => message.messageId)).toEqual([
+        originalUser.messageId,
+        siblingResponse.messageId,
+        'server-regenerated-response-message',
+      ]);
+      expect(currentMessages).not.toContainEqual(
+        expect.objectContaining({ messageId: selectedResponse.messageId }),
+      );
+    });
+
     it('should propagate step metadata (agentId, groupId) for parallel rendering', () => {
       const responseMessage = createResponseMessage();
       mockGetMessages.mockReturnValue([responseMessage]);
@@ -722,6 +1447,86 @@ describe('useStepHandler', () => {
       expect(toolCallContent?.tool_call?.progress).toBe(1);
     });
 
+    it('signals skill authoring when a completed create_file call targets a skill path', () => {
+      const responseMessage = createResponseMessage();
+      mockGetMessages.mockReturnValue([responseMessage]);
+
+      const { result } = renderHook(() => useStepHandler(createHookParams()));
+
+      const runStep = createToolCallRunStep();
+      const submission = createSubmission();
+
+      act(() => {
+        result.current.stepHandler({ event: StepEvents.ON_RUN_STEP, data: runStep }, submission);
+      });
+
+      const completedEvent = {
+        result: {
+          id: 'step-tool-1',
+          index: 0,
+          tool_call: {
+            id: 'tool-call-1',
+            name: 'create_file',
+            args: JSON.stringify({ file_path: 'skills/demo/SKILL.md', content: '# Demo' }),
+            output: 'Updated skills/demo/SKILL.md (6 chars).',
+            type: ToolCallTypes.TOOL_CALL,
+          },
+        },
+      };
+
+      act(() => {
+        result.current.stepHandler(
+          {
+            event: StepEvents.ON_RUN_STEP_COMPLETED,
+            data: completedEvent as { result: Agents.ToolEndEvent },
+          },
+          submission,
+        );
+      });
+
+      expect(mockOnSkillAuthoringComplete).toHaveBeenCalledTimes(1);
+    });
+
+    it('does not signal skill authoring for non-skill file authoring calls', () => {
+      const responseMessage = createResponseMessage();
+      mockGetMessages.mockReturnValue([responseMessage]);
+
+      const { result } = renderHook(() => useStepHandler(createHookParams()));
+
+      const runStep = createToolCallRunStep();
+      const submission = createSubmission();
+
+      act(() => {
+        result.current.stepHandler({ event: StepEvents.ON_RUN_STEP, data: runStep }, submission);
+      });
+
+      const completedEvent = {
+        result: {
+          id: 'step-tool-1',
+          index: 0,
+          tool_call: {
+            id: 'tool-call-1',
+            name: 'create_file',
+            args: JSON.stringify({ file_path: '/mnt/data/report.md', content: '# Report' }),
+            output: 'Created /mnt/data/report.md (8 chars).',
+            type: ToolCallTypes.TOOL_CALL,
+          },
+        },
+      };
+
+      act(() => {
+        result.current.stepHandler(
+          {
+            event: StepEvents.ON_RUN_STEP_COMPLETED,
+            data: completedEvent as { result: Agents.ToolEndEvent },
+          },
+          submission,
+        );
+      });
+
+      expect(mockOnSkillAuthoringComplete).not.toHaveBeenCalled();
+    });
+
     it('should warn when step not found for completed event', () => {
       const consoleSpy = jest.spyOn(console, 'warn').mockImplementation();
 
@@ -756,6 +1561,59 @@ describe('useStepHandler', () => {
       );
       consoleSpy.mockRestore();
     });
+
+    it('should mark completed OAuth prompts as finished', () => {
+      const responseMessage = createResponseMessage();
+      mockGetMessages.mockReturnValue([responseMessage]);
+
+      const { result } = renderHook(() => useStepHandler(createHookParams()));
+
+      const runStep = createToolCallRunStep({
+        id: 'step-oauth-eli',
+        stepDetails: {
+          type: StepTypes.TOOL_CALLS,
+          tool_calls: [
+            {
+              id: 'tool-call-eli',
+              name: `oauth${Constants.mcp_delimiter}ELI`,
+              args: '',
+              type: ToolCallTypes.TOOL_CALL,
+            },
+          ],
+        },
+      });
+      const submission = createSubmission();
+
+      act(() => {
+        result.current.stepHandler({ event: StepEvents.ON_RUN_STEP, data: runStep }, submission);
+      });
+
+      act(() => {
+        result.current.stepHandler(
+          {
+            event: StepEvents.ON_RUN_STEP_COMPLETED,
+            data: {
+              result: {
+                id: 'step-oauth-eli',
+                index: 0,
+                tool_call: {
+                  id: 'tool-call-eli',
+                  name: `oauth${Constants.mcp_delimiter}ELI`,
+                  args: '',
+                  output: 'OAuth authentication completed',
+                  type: ToolCallTypes.TOOL_CALL,
+                },
+              },
+            },
+          },
+          submission,
+        );
+      });
+
+      const lastCall = mockSetMessages.mock.calls[mockSetMessages.mock.calls.length - 1][0];
+      const responseMsg = lastCall.find((m: TMessage) => !m.isCreatedByUser);
+      expect(responseMsg?.content?.[0]?.tool_call?.progress).toBe(1);
+    });
   });
 
   describe('clearStepMaps', () => {
diff --git a/client/src/hooks/SSE/__tests__/useUsageHandler.spec.tsx b/client/src/hooks/SSE/__tests__/useUsageHandler.spec.tsx
new file mode 100644
index 00000000000..41ba9e35110
--- /dev/null
+++ b/client/src/hooks/SSE/__tests__/useUsageHandler.spec.tsx
@@ -0,0 +1,116 @@
+import { getDefaultStore } from 'jotai';
+import { renderHook } from '@testing-library/react';
+import type { TContextUsageEvent, TTokenUsageEvent } from 'librechat-data-provider';
+import useUsageHandler from '~/hooks/SSE/useUsageHandler';
+import { contextSnapshotFamily } from '~/store/usage';
+
+/** Mirrors a real web-search + summarization turn: calibration pinned at 5
+ *  inflated messageTokens to 187471 (used 213375), while the call's true prompt
+ *  was 53702 + 2071 cache = 55773. */
+const inflatedSnapshot = (over?: Partial<TContextUsageEvent>): TContextUsageEvent => ({
+  runId: 'run-1',
+  breakdown: {
+    maxContextTokens: 250000,
+    instructionTokens: 4205,
+    systemMessageTokens: 384,
+    dynamicInstructionTokens: 1525,
+    toolSchemaTokens: 2296,
+    summaryTokens: 1938,
+    toolCount: 1,
+    messageCount: 2,
+    messageTokens: 187471,
+    availableForMessages: 233295,
+  },
+  contextBudget: 237500,
+  remainingContextTokens: 24125,
+  calibrationRatio: 5,
+  ...over,
+});
+
+const primaryUsage = (over?: Partial<TTokenUsageEvent>): TTokenUsageEvent => ({
+  input_tokens: 55773, // Anthropic input_tokens is cache-inclusive (53702 fresh + 2071 read)
+  output_tokens: 3780,
+  total_tokens: 59553,
+  input_token_details: { cache_read: 2071, cache_creation: 0 },
+  provider: 'anthropic',
+  runId: 'run-1',
+  seq: 1,
+  ...over,
+});
+
+describe('useUsageHandler — live snapshot reconciliation', () => {
+  it('reconciles the live snapshot to the primary call’s actual prompt tokens', () => {
+    const convo = 'convo-recon-1';
+    const submission = {
+      userMessage: { messageId: 'u1', conversationId: convo },
+      conversation: { conversationId: convo },
+    };
+    const { result } = renderHook(() => useUsageHandler());
+    const store = getDefaultStore();
+
+    result.current.contextHandler(inflatedSnapshot(), submission);
+    expect(store.get(contextSnapshotFamily(convo))?.breakdown.messageTokens).toBe(187471);
+
+    result.current.usageHandler(primaryUsage(), submission);
+
+    const snap = store.get(contextSnapshotFamily(convo));
+    /** used = budget − remaining = real prompt (55773), down from 213375 */
+    expect(237500 - (snap?.remainingContextTokens ?? 0)).toBe(55773);
+    expect(snap?.breakdown.messageTokens).toBe(55773 - 4205 - 1938);
+    /** instructions/summary stay raw; the anchor is preserved */
+    expect(snap?.breakdown.instructionTokens).toBe(4205);
+    expect(snap?.anchorMessageId).toBe('u1');
+  });
+
+  it('does not reconcile a replayed (already-folded) primary usage', () => {
+    /** On resume, backfill marks the run's collected usages folded; a replayed
+     *  `on_token_usage` then arrives folded=false. Since tool-loop calls share the
+     *  run id, reconciling with such a duplicate could overwrite the latest
+     *  snapshot with an earlier call's prompt — so it must be skipped. */
+    const convo = 'convo-recon-replay';
+    const submission = {
+      userMessage: { messageId: 'ur', conversationId: convo },
+      conversation: { conversationId: convo },
+    };
+    const { result } = renderHook(() => useUsageHandler());
+    const store = getDefaultStore();
+
+    result.current.contextHandler(inflatedSnapshot(), submission);
+    /** Mark the usage folded (as resume backfill would), then replay it live. */
+    result.current.backfillUsage([primaryUsage()], submission);
+    result.current.usageHandler(primaryUsage(), submission);
+
+    /** Duplicate (folded=false) → no reconcile → snapshot stays the raw estimate. */
+    expect(store.get(contextSnapshotFamily(convo))?.breakdown.messageTokens).toBe(187471);
+  });
+
+  it('does not reconcile when the usage belongs to a different run', () => {
+    const convo = 'convo-recon-2';
+    const submission = {
+      userMessage: { messageId: 'u2', conversationId: convo },
+      conversation: { conversationId: convo },
+    };
+    const { result } = renderHook(() => useUsageHandler());
+    const store = getDefaultStore();
+
+    result.current.contextHandler(inflatedSnapshot({ runId: 'run-A' }), submission);
+    result.current.usageHandler(primaryUsage({ runId: 'run-Z', seq: 9 }), submission);
+
+    expect(store.get(contextSnapshotFamily(convo))?.breakdown.messageTokens).toBe(187471);
+  });
+
+  it('does not let a tagged (summarization) usage touch the gauge', () => {
+    const convo = 'convo-recon-3';
+    const submission = {
+      userMessage: { messageId: 'u3', conversationId: convo },
+      conversation: { conversationId: convo },
+    };
+    const { result } = renderHook(() => useUsageHandler());
+    const store = getDefaultStore();
+
+    result.current.contextHandler(inflatedSnapshot(), submission);
+    result.current.usageHandler(primaryUsage({ usage_type: 'summarization', seq: 2 }), submission);
+
+    expect(store.get(contextSnapshotFamily(convo))?.breakdown.messageTokens).toBe(187471);
+  });
+});
diff --git a/client/src/hooks/SSE/index.ts b/client/src/hooks/SSE/index.ts
index 2829db76f6c..5de4866d49f 100644
--- a/client/src/hooks/SSE/index.ts
+++ b/client/src/hooks/SSE/index.ts
@@ -3,5 +3,6 @@ export { default as useResumableSSE } from './useResumableSSE';
 export { default as useAdaptiveSSE } from './useAdaptiveSSE';
 export { default as useResumeOnLoad } from './useResumeOnLoad';
 export { default as useStepHandler } from './useStepHandler';
+export { default as useUsageHandler } from './useUsageHandler';
 export { default as useContentHandler } from './useContentHandler';
 export { default as useAttachmentHandler } from './useAttachmentHandler';
diff --git a/client/src/hooks/SSE/useEventHandlers.ts b/client/src/hooks/SSE/useEventHandlers.ts
index f8e8f715c71..a01db036c9e 100644
--- a/client/src/hooks/SSE/useEventHandlers.ts
+++ b/client/src/hooks/SSE/useEventHandlers.ts
@@ -19,9 +19,9 @@ import type {
   EventSubmission,
   TStartupConfig,
 } from 'librechat-data-provider';
-import type { TResData, TFinalResData, ConvoGenerator } from '~/common';
 import type { InfiniteData } from '@tanstack/react-query';
 import type { SetterOrUpdater } from 'recoil';
+import type { TResData, TFinalResData, ConvoGenerator } from '~/common';
 import type { ConversationCursorData } from '~/utils';
 import {
   logger,
@@ -38,6 +38,8 @@ import {
   queueTitleGeneration,
   markTitleGenerationProcessed,
 } from '~/data-provider';
+import useFocusRegeneratedResponse from '~/hooks/Chat/useFocusRegeneratedResponse';
+import { shouldResetSubagentAtomsOnConversationChange } from './cleanup';
 import useAttachmentHandler from '~/hooks/SSE/useAttachmentHandler';
 import useContentHandler from '~/hooks/SSE/useContentHandler';
 import useStepHandler from '~/hooks/SSE/useStepHandler';
@@ -45,7 +47,6 @@ import { useApplyAgentTemplate } from '~/hooks/Agents';
 import { useAuthContext } from '~/hooks/AuthContext';
 import { MESSAGE_UPDATE_INTERVAL } from '~/common';
 import { useLiveAnnouncer } from '~/Providers';
-import { shouldResetSubagentAtomsOnConversationChange } from './cleanup';
 import store from '~/store';
 
 type TSyncData = {
@@ -68,6 +69,91 @@ type TTitleEvent = {
 const hasRealTitle = (title?: string | null): title is string =>
   title != null && title !== '' && title !== 'New Chat';
 
+/** Skill caches refreshed when a chat turn authors a skill via `create_file`/`edit_file`. */
+const SKILL_QUERY_KEYS = [
+  QueryKeys.skills,
+  QueryKeys.skill,
+  QueryKeys.skillFiles,
+  QueryKeys.skillFileContent,
+  QueryKeys.skillTree,
+  QueryKeys.skillNodeContent,
+] as const;
+
+export const buildCreatedInitialResponse = ({
+  initialResponse,
+  userMessage,
+  isRegenerate = false,
+}: Pick<EventSubmission, 'initialResponse' | 'userMessage' | 'isRegenerate'>): TMessage => ({
+  ...initialResponse,
+  parentMessageId:
+    isRegenerate && initialResponse.parentMessageId
+      ? initialResponse.parentMessageId
+      : userMessage.messageId,
+  messageId:
+    isRegenerate && initialResponse.messageId
+      ? initialResponse.messageId
+      : `${userMessage.messageId}_`,
+  conversationId: userMessage.conversationId ?? initialResponse.conversationId,
+});
+
+export const isInitialNewConversationSubmission = ({
+  userMessage,
+}: Pick<EventSubmission, 'userMessage'>): boolean =>
+  userMessage?.parentMessageId === Constants.NO_PARENT;
+
+export const mergeRegenerateFinalMessages = ({
+  messages,
+  responseMessage,
+  initialResponseId,
+}: {
+  messages: TMessage[];
+  responseMessage: TMessage;
+  initialResponseId?: string | null;
+}): TMessage[] => {
+  const finalMessages: TMessage[] = [];
+  let inserted = false;
+
+  for (const message of messages) {
+    if (!message?.messageId || message.messageId === initialResponseId) {
+      continue;
+    }
+
+    if (message.messageId === responseMessage.messageId) {
+      finalMessages.push(responseMessage);
+      inserted = true;
+      continue;
+    }
+
+    finalMessages.push(message);
+  }
+
+  if (!inserted) {
+    finalMessages.push(responseMessage);
+  }
+
+  return finalMessages;
+};
+
+export const getExistingConversationAbortMessages = ({
+  messages,
+  currentMessages,
+  regenerateMessages,
+  isRegenerate = false,
+}: Pick<EventSubmission, 'messages' | 'regenerateMessages' | 'isRegenerate'> & {
+  currentMessages?: TMessage[];
+}): TMessage[] => {
+  if (!isRegenerate) {
+    return [...messages];
+  }
+
+  if (regenerateMessages?.length) {
+    return [...regenerateMessages];
+  }
+
+  const sourceMessages = currentMessages?.length ? currentMessages : messages;
+  return [...sourceMessages];
+};
+
 export type EventHandlerParams = {
   isAddedRequest?: boolean;
   setCompleted: React.Dispatch<React.SetStateAction<Set<unknown>>>;
@@ -202,12 +288,21 @@ export default function useEventHandlers({
   const { token } = useAuthContext();
 
   const { contentHandler, resetContentHandler } = useContentHandler({ setMessages, getMessages });
+  /** `refetchType: 'all'` so cached-but-unmounted skill queries refresh too —
+   *  they opt out of `refetchOnMount`, so a plain invalidation would leave
+   *  the Skills panel stale until a manual refresh. */
+  const onSkillAuthoringComplete = useCallback(() => {
+    for (const key of SKILL_QUERY_KEYS) {
+      queryClient.invalidateQueries({ queryKey: [key], refetchType: 'all' });
+    }
+  }, [queryClient]);
   const { stepHandler, clearStepMaps, resetSubagentAtoms, syncStepMessage } = useStepHandler({
     setMessages,
     getMessages,
     announcePolite,
     setIsSubmitting,
     lastAnnouncementTimeRef,
+    onSkillAuthoringComplete,
   });
   const attachmentHandler = useAttachmentHandler(queryClient);
 
@@ -373,6 +468,10 @@ export default function useEventHandlers({
         } else {
           updateConvoInAllQueries(queryClient, update.conversationId!, (_c) => update, true);
         }
+        if (update.chatProjectId) {
+          queryClient.invalidateQueries([QueryKeys.projects]);
+          queryClient.invalidateQueries([QueryKeys.project, update.chatProjectId]);
+        }
       } else if (setConversation) {
         setConversation((prevState) => {
           update = tConvoUpdateSchema.parse({
@@ -390,6 +489,8 @@ export default function useEventHandlers({
     [queryClient, setMessages, isAddedRequest, announcePolite, setConversation, setShowStopButton],
   );
 
+  const focusRegeneratedResponse = useFocusRegeneratedResponse();
+
   const createdHandler = useCallback(
     (data: TResData, submission: EventSubmission) => {
       queryClient.invalidateQueries([QueryKeys.mcpConnectionStatus]);
@@ -405,14 +506,14 @@ export default function useEventHandlers({
        * drops it, which is the right behavior: by finalize the real
        * `skill` tool_call is in `content` and takes over rendering.
        */
-      const initialResponse = {
-        ...submission.initialResponse,
-        parentMessageId: userMessage.messageId,
-        messageId: userMessage.messageId + '_',
-        conversationId: userMessage.conversationId ?? submission.initialResponse.conversationId,
-      };
+      const initialResponse = buildCreatedInitialResponse({
+        initialResponse: submission.initialResponse,
+        userMessage,
+        isRegenerate,
+      });
       if (isRegenerate) {
         setMessages([...messages, initialResponse]);
+        focusRegeneratedResponse(initialResponse.parentMessageId);
       } else {
         setMessages([...messages, userMessage, initialResponse]);
       }
@@ -448,6 +549,10 @@ export default function useEventHandlers({
           } else {
             updateConvoInAllQueries(queryClient, update.conversationId!, (_c) => update, true);
           }
+          if (update.chatProjectId) {
+            queryClient.invalidateQueries([QueryKeys.projects]);
+            queryClient.invalidateQueries([QueryKeys.project, update.chatProjectId]);
+          }
         }
       } else if (setConversation) {
         setConversation((prevState) => {
@@ -479,6 +584,7 @@ export default function useEventHandlers({
       announcePolite,
       setConversation,
       applyAgentTemplate,
+      focusRegeneratedResponse,
     ],
   );
 
@@ -530,15 +636,40 @@ export default function useEventHandlers({
       const serverConversation = conversation as TConversation;
 
       try {
-        // Handle early abort - aborted during tool loading before any messages saved
-        // Don't update conversation state, just reset UI and stay on new chat
+        // Handle early abort - aborted before any response message was saved.
         if ((data as Record<string, unknown>).earlyAbort) {
-          console.log(
-            '[finalHandler] Early abort detected - no messages saved, staying on new chat',
-          );
+          console.log('[finalHandler] Early abort detected - no response message saved');
           setShowStopButton(false);
           setIsSubmitting(false);
-          // Navigate to new chat if not already there
+
+          const currentConvoId = submissionConvo.conversationId;
+          const isInitialNewConvo = isInitialNewConversationSubmission(submission);
+          const isExistingConvo =
+            currentConvoId && currentConvoId !== Constants.NEW_CONVO && !isInitialNewConvo;
+          if (isExistingConvo) {
+            const abortMessages = getExistingConversationAbortMessages({
+              messages,
+              isRegenerate,
+              currentMessages: getMessages(),
+              regenerateMessages: submission.regenerateMessages,
+            });
+            setMessages(abortMessages);
+            queryClient.setQueryData<TMessage[]>(
+              [QueryKeys.messages, currentConvoId],
+              abortMessages,
+            );
+            setDraft({ id: currentConvoId, value: requestMessage?.text });
+            return;
+          }
+
+          if (currentConvoId && currentConvoId !== Constants.NEW_CONVO) {
+            removeConvoFromAllQueries(queryClient, currentConvoId);
+            queryClient.removeQueries({ queryKey: [QueryKeys.conversation, currentConvoId] });
+            queryClient.removeQueries({ queryKey: [QueryKeys.messages, currentConvoId] });
+          }
+          setMessages([]);
+          queryClient.setQueryData<TMessage[]>([QueryKeys.messages, Constants.NEW_CONVO], []);
+          setDraft({ id: String(Constants.NEW_CONVO), value: requestMessage?.text });
           if (location.pathname !== `/c/${Constants.NEW_CONVO}`) {
             navigate(`/c/${Constants.NEW_CONVO}`, { replace: true });
           }
@@ -614,7 +745,11 @@ export default function useEventHandlers({
         if (runMessages) {
           finalMessages = [...runMessages];
         } else if (isRegenerate && responseMessage) {
-          finalMessages = [...messages, responseMessage];
+          finalMessages = mergeRegenerateFinalMessages({
+            messages: submission.regenerateMessages ?? currentMessages ?? messages,
+            responseMessage,
+            initialResponseId: submission.initialResponse.messageId,
+          });
         } else if (requestMessage != null && responseMessage != null) {
           finalMessages = [...messages, requestMessage, responseMessage];
         }
@@ -655,25 +790,9 @@ export default function useEventHandlers({
         /** A title applied locally (e.g. an immediate-mode title fetched while the
          *  response was still streaming) must survive the final event, whose
          *  `conversation` was built before the title was saved and so carries no
-         *  title yet — otherwise the chat reverts to "New Chat" until reload.
-         *  Skip preservation for a stopped (unfinished) turn: the server cancels
-         *  and discards that title, so the local one would diverge from server state. */
-        const titlePreservable = responseMessage?.unfinished !== true;
-        const finalConversationId = conversation.conversationId;
-        const shouldRollbackStreamedTitle =
-          !titlePreservable && finalConversationId && !hasRealTitle(serverConversation.title);
-
-        if (shouldRollbackStreamedTitle && finalConversationId) {
-          updateConvoInAllQueries(queryClient, finalConversationId, (convo) => ({
-            ...convo,
-            title: null,
-          }));
-          if (location.pathname.includes(finalConversationId)) {
-            const startupConfig = queryClient.getQueryData<TStartupConfig>(startupConfigKey(true));
-            document.title = startupConfig?.appTitle ?? 'LibreChat';
-          }
-        }
-
+         *  title yet — otherwise the chat reverts to "New Chat" until reload. This
+         *  holds for a stopped turn too: the server persists a title that finished
+         *  generating before the Stop, so the local one stays in sync. */
         if (setConversation && isAddedRequest !== true) {
           setConversation((prevState) => {
             const update = {
@@ -684,7 +803,7 @@ export default function useEventHandlers({
               update.model = prevState.model;
             }
             const prevTitle = prevState?.title;
-            if (titlePreservable && !hasRealTitle(conversation.title) && hasRealTitle(prevTitle)) {
+            if (!hasRealTitle(conversation.title) && hasRealTitle(prevTitle)) {
               update.title = prevTitle;
             }
             if (conversation.conversationId) {
@@ -696,11 +815,7 @@ export default function useEventHandlers({
                     ...serverConversation,
                   } as TConversation;
                   const cachedTitle = cachedConvo?.title;
-                  if (
-                    titlePreservable &&
-                    !hasRealTitle(serverConversation.title) &&
-                    hasRealTitle(cachedTitle)
-                  ) {
+                  if (!hasRealTitle(serverConversation.title) && hasRealTitle(cachedTitle)) {
                     merged.title = cachedTitle;
                   }
                   return merged;
@@ -720,6 +835,11 @@ export default function useEventHandlers({
             });
           }
 
+          if (conversation.chatProjectId) {
+            queryClient.invalidateQueries([QueryKeys.projects]);
+            queryClient.invalidateQueries([QueryKeys.project, conversation.chatProjectId]);
+          }
+
           if (location.pathname === `/c/${Constants.NEW_CONVO}`) {
             preserveSubagentAtomsForNewConvoIdRef.current = conversation.conversationId;
             navigate(`/c/${conversation.conversationId}`, { replace: true });
diff --git a/client/src/hooks/SSE/useResumableSSE.ts b/client/src/hooks/SSE/useResumableSSE.ts
index f10a7f16c96..1eb72670448 100644
--- a/client/src/hooks/SSE/useResumableSSE.ts
+++ b/client/src/hooks/SSE/useResumableSSE.ts
@@ -10,11 +10,13 @@ import {
   ErrorTypes,
   StepEvents,
   apiBaseUrl,
+  UsageEvents,
   createPayload,
   ViolationTypes,
   removeNullishValues,
 } from 'librechat-data-provider';
 import type {
+  Agents,
   TMessage,
   TPayload,
   TSubmission,
@@ -22,16 +24,24 @@ import type {
   EventSubmission,
 } from 'librechat-data-provider';
 import type { EventHandlerParams } from './useEventHandlers';
+import type { ActiveJobsResponse } from '~/data-provider';
+import type { TResData } from '~/common';
+import {
+  clearAllDrafts,
+  removeConvoFromAllQueries,
+  upsertConvoInAllQueries,
+  countTrailingOutputChars,
+  markStreamStartFailedMetadata,
+} from '~/utils';
 import {
   useGetUserBalance,
   useGetStartupConfig,
   queueTitleGeneration,
   streamStatusQueryKey,
 } from '~/data-provider';
-import type { ActiveJobsResponse } from '~/data-provider';
+import useEventHandlers, { buildCreatedInitialResponse } from './useEventHandlers';
 import { useAuthContext } from '~/hooks/AuthContext';
-import useEventHandlers from './useEventHandlers';
-import { clearAllDrafts, removeConvoFromAllQueries, upsertConvoInAllQueries } from '~/utils';
+import useUsageHandler from './useUsageHandler';
 import store from '~/store';
 
 type ChatHelpers = Pick<
@@ -39,7 +49,84 @@ type ChatHelpers = Pick<
   'setMessages' | 'getMessages' | 'setConversation' | 'setIsSubmitting' | 'newConversation'
 >;
 
+const getStreamStartFailureData = (errorData?: Record<string, unknown>): TResData =>
+  ({
+    text: errorData
+      ? JSON.stringify(errorData)
+      : 'Error connecting to server, try refreshing the page.',
+    metadata: markStreamStartFailedMetadata(),
+  }) as unknown as TResData;
+
 const MAX_RETRIES = 5;
+const START_GENERATION_NETWORK_RETRIES = 3;
+const START_GENERATION_READINESS_TIMEOUT_MS = 120000;
+const SERVER_NOT_READY_CODE = 'SERVER_NOT_READY';
+
+type StartGenerationError = {
+  code?: string;
+  response?: {
+    status?: number;
+    data?: {
+      code?: string;
+    };
+    headers?: Record<string, string | number | string[] | undefined>;
+  };
+};
+
+const toStartGenerationError = (error: unknown): StartGenerationError | undefined =>
+  error != null && typeof error === 'object' ? (error as StartGenerationError) : undefined;
+
+const isRetryableNetworkError = (error: unknown) => {
+  if (!(error instanceof Error)) {
+    return false;
+  }
+
+  const { code } = toStartGenerationError(error) ?? {};
+  return code === 'ERR_NETWORK' || code === 'ERR_INTERNET_DISCONNECTED';
+};
+
+const isServerNotReadyError = (error: unknown) => {
+  const candidate = toStartGenerationError(error);
+  return (
+    candidate?.response?.status === 503 && candidate.response?.data?.code === SERVER_NOT_READY_CODE
+  );
+};
+
+const getRetryAfterDelay = (error: unknown, fallbackDelay: number) => {
+  const headers = toStartGenerationError(error)?.response?.headers;
+  const rawValue = headers?.['retry-after'] ?? headers?.['Retry-After'];
+  const retryAfter = Array.isArray(rawValue) ? rawValue[0] : rawValue;
+  const seconds = typeof retryAfter === 'number' ? retryAfter : Number(retryAfter);
+
+  if (!Number.isFinite(seconds) || seconds < 0) {
+    return fallbackDelay;
+  }
+
+  return Math.min(seconds * 1000, 30000);
+};
+
+const waitForRetryDelay = (delay: number, signal?: AbortSignal): Promise<boolean> =>
+  new Promise((resolve) => {
+    if (signal?.aborted) {
+      resolve(false);
+      return;
+    }
+
+    function cleanup() {
+      signal?.removeEventListener('abort', onAbort);
+    }
+    function onAbort() {
+      clearTimeout(timeout);
+      cleanup();
+      resolve(false);
+    }
+    const timeout = setTimeout(() => {
+      cleanup();
+      resolve(true);
+    }, delay);
+
+    signal?.addEventListener('abort', onAbort, { once: true });
+  });
 
 const hasConcreteConversationId = (conversationId?: string | null) =>
   !!conversationId &&
@@ -48,9 +135,73 @@ const hasConcreteConversationId = (conversationId?: string | null) =>
 
 const isInitialNewConversation = (submission: TSubmission) => {
   const conversationId = submission.conversation?.conversationId;
-  return (
-    submission.userMessage?.parentMessageId === Constants.NO_PARENT &&
-    !hasConcreteConversationId(conversationId)
+  return !hasConcreteConversationId(conversationId);
+};
+
+const getToolCallName = (toolCall: unknown) =>
+  toolCall != null && typeof toolCall === 'object' && 'name' in toolCall
+    ? (toolCall.name as unknown)
+    : undefined;
+
+const isOAuthToolCallName = (name: unknown) =>
+  typeof name === 'string' && name.startsWith(`oauth${Constants.mcp_delimiter}`);
+
+const hasOAuthToolCall = (toolCalls: unknown) =>
+  Array.isArray(toolCalls) &&
+  toolCalls.some((toolCall) => isOAuthToolCallName(getToolCallName(toolCall)));
+
+const isOAuthStepEvent = (data: unknown) => {
+  if (data == null || typeof data !== 'object' || !('event' in data)) {
+    return false;
+  }
+
+  const event = data.event;
+  const payload = 'data' in data ? data.data : undefined;
+  if (payload == null || typeof payload !== 'object') {
+    return false;
+  }
+
+  if (event === StepEvents.ON_RUN_STEP) {
+    const stepDetails = 'stepDetails' in payload ? payload.stepDetails : undefined;
+    return (
+      stepDetails != null &&
+      typeof stepDetails === 'object' &&
+      'tool_calls' in stepDetails &&
+      hasOAuthToolCall(stepDetails.tool_calls)
+    );
+  }
+
+  if (event === StepEvents.ON_RUN_STEP_DELTA) {
+    const delta = 'delta' in payload ? payload.delta : undefined;
+    if (delta == null || typeof delta !== 'object') {
+      return false;
+    }
+    return (
+      ('auth' in delta && delta.auth != null) ||
+      ('tool_calls' in delta && hasOAuthToolCall(delta.tool_calls))
+    );
+  }
+
+  if (event === StepEvents.ON_RUN_STEP_COMPLETED) {
+    const result = 'result' in payload ? payload.result : undefined;
+    if (result == null || typeof result !== 'object' || !('tool_call' in result)) {
+      return false;
+    }
+    return isOAuthToolCallName(getToolCallName(result.tool_call));
+  }
+
+  return false;
+};
+
+const replaceNewConversationUrl = (conversationId: string) => {
+  if (window.location.pathname !== `/c/${Constants.NEW_CONVO}`) {
+    return;
+  }
+
+  window.history.replaceState(
+    window.history.state,
+    '',
+    `/c/${conversationId}${window.location.search}`,
   );
 };
 
@@ -60,6 +211,9 @@ const shouldHydrateMessage = (message: TMessage) =>
 const hydrateMessageConversationId = (message: TMessage, conversationId: string): TMessage =>
   shouldHydrateMessage(message) ? { ...message, conversationId } : message;
 
+const preferDefinedString = (value?: string | null, fallback?: string): string | undefined =>
+  value != null && value !== '' ? value : fallback;
+
 const getOptimisticMessages = (
   submission: TSubmission,
   conversationId: string,
@@ -111,6 +265,97 @@ const hydrateSubmissionMessages = (
     : submission.initialResponse,
 });
 
+const buildResumeEventSubmission = (
+  currentSubmission: TSubmission,
+  currentUserMessage: TMessage,
+  resumeState?: Agents.ResumeState | null,
+): EventSubmission => {
+  if (!resumeState) {
+    return { ...currentSubmission, userMessage: currentUserMessage } as EventSubmission;
+  }
+
+  const conversationId =
+    resumeState.conversationId ??
+    resumeState.userMessage?.conversationId ??
+    currentUserMessage.conversationId ??
+    currentSubmission.conversation?.conversationId;
+
+  const userMessage = {
+    ...currentUserMessage,
+    ...resumeState.userMessage,
+    conversationId,
+    isCreatedByUser: true,
+  } as TMessage;
+
+  const responseMessageId =
+    resumeState.responseMessageId ??
+    currentSubmission.initialResponse?.messageId ??
+    `${userMessage.messageId}_`;
+
+  const initialResponse = {
+    ...(currentSubmission.initialResponse as TMessage),
+    messageId: responseMessageId,
+    parentMessageId: userMessage.messageId,
+    conversationId,
+    content:
+      resumeState.aggregatedContent ??
+      (currentSubmission.initialResponse as TMessage | undefined)?.content,
+    sender: resumeState.sender ?? currentSubmission.initialResponse?.sender,
+    iconURL: preferDefinedString(currentSubmission.initialResponse?.iconURL, resumeState.iconURL),
+    model: preferDefinedString(currentSubmission.initialResponse?.model, resumeState.model),
+    isCreatedByUser: false,
+  } as TMessage;
+
+  return {
+    ...currentSubmission,
+    conversation: {
+      ...currentSubmission.conversation,
+      conversationId,
+    },
+    userMessage,
+    initialResponse,
+  } as EventSubmission;
+};
+
+const mergeResumeMessages = (
+  messages: TMessage[],
+  userMessage: TMessage,
+  responseMessage: TMessage,
+): TMessage[] => {
+  const nextMessages = [...messages];
+  const userIndex = nextMessages.findIndex(
+    (message) => message.messageId === userMessage.messageId,
+  );
+  const responseIndex = nextMessages.findIndex(
+    (message) => message.messageId === responseMessage.messageId,
+  );
+
+  if (userIndex >= 0) {
+    nextMessages[userIndex] = { ...nextMessages[userIndex], ...userMessage };
+  }
+
+  if (responseIndex >= 0) {
+    nextMessages[responseIndex] = { ...nextMessages[responseIndex], ...responseMessage };
+  }
+
+  if (userIndex >= 0 && responseIndex >= 0) {
+    return nextMessages;
+  }
+
+  if (userIndex >= 0) {
+    const insertAt = userIndex + 1;
+    nextMessages.splice(insertAt, 0, responseMessage);
+    return nextMessages;
+  }
+
+  if (responseIndex >= 0) {
+    nextMessages.splice(responseIndex, 0, userMessage);
+    return nextMessages;
+  }
+
+  return [...nextMessages, userMessage, responseMessage];
+};
+
 /**
  * Hook for resumable SSE streams.
  * Separates generation start (POST) from stream subscription (GET EventSource).
@@ -194,6 +439,7 @@ export default function useResumableSSE(
   const [_completed, setCompleted] = useState(new Set());
   const [streamId, setStreamId] = useState<string | null>(null);
   const setAbortScroll = useSetRecoilState(store.abortScrollFamily(runIndex));
+  const setSubmission = useSetRecoilState(store.submissionByIndex(runIndex));
   const setShowStopButton = useSetRecoilState(store.showStopButtonByIndex(runIndex));
 
   const sseRef = useRef<SSE | null>(null);
@@ -230,6 +476,16 @@ export default function useResumableSSE(
   const balanceQuery = useGetUserBalance({
     enabled: !!isAuthenticated && startupConfig?.balance?.enabled,
   });
+  const {
+    contextHandler,
+    usageHandler,
+    tapStream,
+    tapContent,
+    finalizeUsage,
+    backfillUsage,
+    resetLive,
+    seedLive,
+  } = useUsageHandler();
 
   /**
    * Subscribe to stream via SSE library (supports custom headers)
@@ -240,6 +496,17 @@ export default function useResumableSSE(
     (currentStreamId: string, currentSubmission: TSubmission, isResume = false) => {
       let { userMessage } = currentSubmission;
       let textIndex: number | null = null;
+      const preCreatedStepEvents: Array<Parameters<typeof stepHandler>[0]> = [];
+      const replayPreCreatedStepEvents = () => {
+        if (preCreatedStepEvents.length === 0) {
+          return;
+        }
+
+        const submission = { ...currentSubmission, userMessage } as EventSubmission;
+        for (const event of preCreatedStepEvents.splice(0)) {
+          stepHandler(event, submission);
+        }
+      };
 
       const baseUrl = `${apiBaseUrl()}/api/agents/chat/stream/${encodeURIComponent(currentStreamId)}`;
       const url = isResume ? `${baseUrl}?resume=true` : baseUrl;
@@ -276,6 +543,7 @@ export default function useResumableSSE(
             }
             try {
               finalHandler(data, currentSubmission as EventSubmission);
+              finalizeUsage(data, { ...currentSubmission, userMessage });
             } catch (error) {
               console.error('[ResumableSSE] Error in finalHandler:', error);
               setIsSubmitting(false);
@@ -306,7 +574,19 @@ export default function useResumableSSE(
               ...data.message,
               overrideParentMessageId: userMessage.overrideParentMessageId,
             };
-            createdHandler(data, { ...currentSubmission, userMessage } as EventSubmission);
+            const createdInitialResponse = buildCreatedInitialResponse({
+              initialResponse: currentSubmission.initialResponse as TMessage,
+              userMessage,
+              isRegenerate: currentSubmission.isRegenerate,
+            });
+            currentSubmission = {
+              ...currentSubmission,
+              userMessage,
+              initialResponse: createdInitialResponse,
+            };
+            submissionRef.current = currentSubmission;
+            createdHandler(data, currentSubmission as EventSubmission);
+            replayPreCreatedStepEvents();
             return;
           }
 
@@ -323,7 +603,32 @@ export default function useResumableSSE(
             return;
           }
 
+          if (data.event === UsageEvents.ON_CONTEXT_USAGE) {
+            contextHandler(data.data, { ...currentSubmission, userMessage });
+            return;
+          }
+
+          if (data.event === UsageEvents.ON_TOKEN_USAGE) {
+            usageHandler(data.data, { ...currentSubmission, userMessage });
+            return;
+          }
+
           if (data.event != null) {
+            if (
+              data.event === StepEvents.ON_MESSAGE_DELTA ||
+              data.event === StepEvents.ON_REASONING_DELTA
+            ) {
+              tapStream(data.data, { ...currentSubmission, userMessage });
+            }
+            if (!isResume && !createdStreamIdsRef.current.has(currentStreamId)) {
+              if (isOAuthStepEvent(data)) {
+                preCreatedStepEvents.push(data);
+                stepHandler(data, { ...currentSubmission, userMessage } as EventSubmission);
+                return;
+              }
+              preCreatedStepEvents.push(data);
+              return;
+            }
             stepHandler(data, { ...currentSubmission, userMessage } as EventSubmission);
             return;
           }
@@ -336,13 +641,45 @@ export default function useResumableSSE(
 
             const runId = v4();
             setActiveRunId(runId);
+            const resumeSubmission = buildResumeEventSubmission(
+              currentSubmission,
+              userMessage,
+              data.resumeState,
+            );
+            currentSubmission = resumeSubmission;
+            submissionRef.current = resumeSubmission;
+            userMessage = resumeSubmission.userMessage;
+            /**
+             * Totals rebuild from the persisted backfill at sync. Replayed or
+             * gap usage events already represented in the snapshot are skipped
+             * via multiset matching; events that raced past the snapshot read
+             * still fold so multi-call runs don't undercount.
+             */
+            /** Fold the run's persisted usage; events also replayed below are
+             *  deduped by (runId, seq) inside the handler, so prior prompts in
+             *  this conversation keep their usage and gap events still count */
+            backfillUsage(data.resumeState?.collectedUsage ?? [], resumeSubmission);
+            if (data.resumeState?.contextUsage) {
+              /** Already reconciled to the call's real prompt tokens server-side
+               *  (GenerationJobManager.persistTokenUsage) when the snapshot's call
+               *  completed, so install it as-is — no client backfill reconcile. */
+              contextHandler(data.resumeState.contextUsage, resumeSubmission);
+            }
+            /** Output streamed before this resume is not re-delivered as deltas
+             *  — estimate it from the trailing aggregated content. This is
+             *  needed even with a snapshot: the snapshot is pre-invoke, so the
+             *  in-flight output it precedes rides on the live estimate.
+             *  countTrailingOutputChars only counts output at the very end (0
+             *  when paused at a tool call), so a snapshot's budget is never
+             *  double-counted. */
+            seedLive(
+              countTrailingOutputChars(data.resumeState?.aggregatedContent),
+              resumeSubmission,
+            );
 
             if (data.resumeState?.runSteps) {
               for (const runStep of data.resumeState.runSteps) {
-                stepHandler({ event: StepEvents.ON_RUN_STEP, data: runStep }, {
-                  ...currentSubmission,
-                  userMessage,
-                } as EventSubmission);
+                stepHandler({ event: StepEvents.ON_RUN_STEP, data: runStep }, resumeSubmission);
               }
             }
 
@@ -373,20 +710,25 @@ export default function useResumableSSE(
               });
 
               if (responseIdx >= 0) {
-                const updated = [...messages];
-                const oldContent = updated[responseIdx]?.content;
-                updated[responseIdx] = {
-                  ...updated[responseIdx],
+                const oldContent = messages[responseIdx]?.content;
+                const responseMessage = {
+                  ...messages[responseIdx],
                   content: data.resumeState.aggregatedContent,
-                };
+                  iconURL: preferDefinedString(
+                    messages[responseIdx]?.iconURL,
+                    data.resumeState.iconURL,
+                  ),
+                  model: preferDefinedString(messages[responseIdx]?.model, data.resumeState.model),
+                } as TMessage;
+                const updated = mergeResumeMessages(messages, userMessage, responseMessage);
                 console.log('[ResumableSSE] SYNC updating message', {
-                  messageId: updated[responseIdx]?.messageId,
+                  messageId: responseMessage.messageId,
                   oldContentLength: Array.isArray(oldContent) ? oldContent.length : 0,
                   newContentLength: data.resumeState.aggregatedContent?.length,
                 });
                 setMessages(updated);
                 resetContentHandler();
-                syncStepMessage(updated[responseIdx]);
+                syncStepMessage(responseMessage);
                 console.log('[ResumableSSE] SYNC complete, handlers synced');
               } else {
                 const responseId = serverResponseId ?? `${userMsgId}_`;
@@ -397,8 +739,10 @@ export default function useResumableSSE(
                   text: '',
                   content: data.resumeState.aggregatedContent,
                   isCreatedByUser: false,
+                  iconURL: data.resumeState.iconURL,
+                  model: data.resumeState.model,
                 } as TMessage;
-                setMessages([...messages, newMessage]);
+                setMessages(mergeResumeMessages(messages, userMessage, newMessage));
                 resetContentHandler();
                 syncStepMessage(newMessage);
               }
@@ -408,16 +752,49 @@ export default function useResumableSSE(
               titleHandler(data.resumeState.titleEvent);
             }
 
+            if (data.resumeState?.replayEvents?.length > 0) {
+              console.log(
+                `[ResumableSSE] Replaying ${data.resumeState.replayEvents.length} resume events`,
+              );
+              for (const replayEvent of data.resumeState.replayEvents) {
+                if (replayEvent.event === UsageEvents.ON_CONTEXT_USAGE) {
+                  contextHandler(replayEvent.data, resumeSubmission);
+                } else if (replayEvent.event === UsageEvents.ON_TOKEN_USAGE) {
+                  usageHandler(replayEvent.data, resumeSubmission);
+                } else if (replayEvent.event != null) {
+                  if (
+                    replayEvent.event === StepEvents.ON_MESSAGE_DELTA ||
+                    replayEvent.event === StepEvents.ON_REASONING_DELTA
+                  ) {
+                    tapStream(replayEvent.data, resumeSubmission);
+                  }
+                  stepHandler(replayEvent, resumeSubmission);
+                }
+              }
+            }
+
             if (data.pendingEvents?.length > 0) {
               console.log(`[ResumableSSE] Replaying ${data.pendingEvents.length} pending events`);
-              const submission = { ...currentSubmission, userMessage } as EventSubmission;
               for (const pendingEvent of data.pendingEvents) {
                 if (pendingEvent.event === 'title') {
                   titleHandler(pendingEvent);
+                } else if (pendingEvent.event === UsageEvents.ON_CONTEXT_USAGE) {
+                  contextHandler(pendingEvent.data, resumeSubmission);
+                } else if (pendingEvent.event === UsageEvents.ON_TOKEN_USAGE) {
+                  usageHandler(pendingEvent.data, resumeSubmission);
                 } else if (pendingEvent.event != null) {
-                  stepHandler(pendingEvent, submission);
+                  if (
+                    pendingEvent.event === StepEvents.ON_MESSAGE_DELTA ||
+                    pendingEvent.event === StepEvents.ON_REASONING_DELTA
+                  ) {
+                    tapStream(pendingEvent.data, resumeSubmission);
+                  }
+                  stepHandler(pendingEvent, resumeSubmission);
                 } else if (pendingEvent.type != null) {
-                  contentHandler({ data: pendingEvent, submission });
+                  /** Gap output streamed past the resume snapshot must reach the
+                   *  live estimate too, not just the message UI */
+                  tapContent(pendingEvent.text, resumeSubmission);
+                  contentHandler({ data: pendingEvent, submission: resumeSubmission });
                 }
               }
             }
@@ -432,6 +809,7 @@ export default function useResumableSSE(
             if (text != null && index !== textIndex) {
               textIndex = index;
             }
+            tapContent(text, { ...currentSubmission, userMessage });
             contentHandler({ data, submission: currentSubmission as EventSubmission });
             return;
           }
@@ -443,6 +821,9 @@ export default function useResumableSSE(
               parentMessageId: data.parentMessageId,
               messageId: data.messageId,
             };
+            /** Legacy non-agent streams send cumulative text here — feed the
+             *  live estimate like the content path above */
+            tapContent(text, { ...currentSubmission, userMessage });
             messageHandler(text, { ...currentSubmission, userMessage, initialResponse });
           }
         } catch (error) {
@@ -470,6 +851,9 @@ export default function useResumableSSE(
           console.log('[ResumableSSE] Stream 404, invalidating messages for:', convoId);
           sse.close();
           removeActiveJob(currentStreamId);
+          /** Terminal: drop any in-flight live estimate so the gauge doesn't
+           *  keep counting stale streamed output after the stream ends */
+          resetLive({ ...currentSubmission, userMessage });
           clearAllDrafts(convoId);
           if (optimisticStreamIdsRef.current.has(currentStreamId)) {
             clearAllDrafts(Constants.NEW_CONVO);
@@ -524,6 +908,7 @@ export default function useResumableSSE(
           console.log('[ResumableSSE] Server-sent error event received:', e.data);
           sse.close();
           removeActiveJob(currentStreamId);
+          resetLive({ ...currentSubmission, userMessage });
           if (
             !createdStreamIdsRef.current.has(currentStreamId) &&
             optimisticStreamIdsRef.current.has(currentStreamId)
@@ -607,6 +992,9 @@ export default function useResumableSSE(
           console.error('[ResumableSSE] Max reconnect attempts reached');
           sse.close();
           errorHandler({ data: undefined, submission: currentSubmission as EventSubmission });
+          /** Terminal: clear the in-flight live estimate like the other
+           *  stop-reconnecting paths so the gauge doesn't show stale tokens */
+          resetLive({ ...currentSubmission, userMessage });
           // Optimistically remove from active jobs on max retries
           removeActiveJob(currentStreamId);
           if (
@@ -646,6 +1034,11 @@ export default function useResumableSSE(
         setIsSubmitting(false);
         setShowStopButton(false);
         setStreamId(null);
+        /** Intentional close without a final event (explicit stop, or navigation
+         *  while generating): discard the in-flight pending usage so it can't
+         *  merge into the next response in this conversation. On a resume the
+         *  collected usage is re-folded via backfillUsage, so nothing is lost. */
+        resetLive({ ...currentSubmission, userMessage });
       });
 
       // Start the SSE connection
@@ -697,16 +1090,25 @@ export default function useResumableSSE(
       balanceQuery,
       removeActiveJob,
       queryClient,
+      contextHandler,
+      usageHandler,
+      tapStream,
+      tapContent,
+      finalizeUsage,
+      backfillUsage,
+      resetLive,
+      seedLive,
     ],
   );
 
   /**
    * Start generation (POST request that returns streamId)
    * Uses request.post which has axios interceptors for automatic token refresh.
-   * Retries up to 3 times on network errors with exponential backoff.
+   * Retries transient network failures and startup readiness responses.
+   * Readiness retries honor Retry-After until cleanup or the readiness window expires.
    */
   const startGeneration = useCallback(
-    async (currentSubmission: TSubmission): Promise<string | null> => {
+    async (currentSubmission: TSubmission, signal?: AbortSignal): Promise<string | null> => {
       const payloadData = createPayload(currentSubmission);
       let { payload } = payloadData;
       payload = removeNullishValues(payload) as TPayload;
@@ -715,29 +1117,54 @@ export default function useResumableSSE(
 
       const url = payloadData.server;
 
-      const maxRetries = 3;
       let lastError: unknown = null;
+      let requestAttempts = 0;
+      let networkAttempts = 0;
+      let readinessAttempts = 0;
+      const readinessDeadline = Date.now() + START_GENERATION_READINESS_TIMEOUT_MS;
 
-      for (let attempt = 1; attempt <= maxRetries; attempt++) {
+      while (!signal?.aborted) {
+        requestAttempts += 1;
         try {
           // Use request.post which handles auth token refresh via axios interceptors
           const data = (await request.post(url, payload)) as { streamId: string };
+          if (signal?.aborted) {
+            return null;
+          }
           console.log('[ResumableSSE] Generation started:', { streamId: data.streamId });
           return data.streamId;
         } catch (error) {
+          if (signal?.aborted) {
+            return null;
+          }
+
           lastError = error;
-          // Check if it's a network error (retry) vs server error (don't retry)
-          const isNetworkError =
-            error instanceof Error &&
-            'code' in error &&
-            (error.code === 'ERR_NETWORK' || error.code === 'ERR_INTERNET_DISCONNECTED');
-
-          if (isNetworkError && attempt < maxRetries) {
-            const delay = Math.min(1000 * Math.pow(2, attempt - 1), 8000);
+          const isNetworkError = isRetryableNetworkError(error);
+          const isServerNotReady = isServerNotReadyError(error);
+          const remainingReadinessMs = readinessDeadline - Date.now();
+          const shouldRetryNetwork =
+            isNetworkError && networkAttempts < START_GENERATION_NETWORK_RETRIES - 1;
+          const shouldRetryServerNotReady = isServerNotReady && remainingReadinessMs > 0;
+
+          if (shouldRetryNetwork || shouldRetryServerNotReady) {
+            networkAttempts += isNetworkError ? 1 : 0;
+            readinessAttempts += isServerNotReady ? 1 : 0;
+            const fallbackDelay = Math.min(1000 * Math.pow(2, requestAttempts - 1), 8000);
+            const retryDelay = isServerNotReady
+              ? Math.min(getRetryAfterDelay(error, fallbackDelay), remainingReadinessMs)
+              : fallbackDelay;
+            const reason = isServerNotReady ? 'Server not ready' : 'Network error';
+            const attempt = isServerNotReady ? readinessAttempts : networkAttempts;
+            const limit = isServerNotReady
+              ? `${Math.ceil(START_GENERATION_READINESS_TIMEOUT_MS / 1000)}s readiness window`
+              : `${START_GENERATION_NETWORK_RETRIES}`;
             console.log(
-              `[ResumableSSE] Network error starting generation, retrying in ${delay}ms (attempt ${attempt}/${maxRetries})`,
+              `[ResumableSSE] ${reason} starting generation, retrying in ${retryDelay}ms (attempt ${attempt}/${limit})`,
             );
-            await new Promise((resolve) => setTimeout(resolve, delay));
+            const shouldContinue = await waitForRetryDelay(retryDelay, signal);
+            if (!shouldContinue) {
+              return null;
+            }
             continue;
           }
 
@@ -746,24 +1173,24 @@ export default function useResumableSSE(
         }
       }
 
+      if (signal?.aborted) {
+        return null;
+      }
+
       console.error('[ResumableSSE] Error starting generation:', lastError);
 
       const axiosError = lastError as { response?: { data?: Record<string, unknown> } };
       const errorData = axiosError?.response?.data;
-      if (errorData) {
-        errorHandler({
-          data: { text: JSON.stringify(errorData) } as unknown as Parameters<
-            typeof errorHandler
-          >[0]['data'],
-          submission: currentSubmission as EventSubmission,
-        });
-      } else {
-        errorHandler({ data: undefined, submission: currentSubmission as EventSubmission });
-      }
+      errorHandler({
+        data: getStreamStartFailureData(errorData),
+        submission: currentSubmission as EventSubmission,
+      });
+      setShowStopButton(false);
       setIsSubmitting(false);
+      setSubmission(null);
       return null;
     },
-    [clearStepMaps, errorHandler, setIsSubmitting],
+    [clearStepMaps, errorHandler, setIsSubmitting, setShowStopButton, setSubmission],
   );
 
   useEffect(() => {
@@ -794,12 +1221,21 @@ export default function useResumableSSE(
     });
 
     submissionRef.current = submission;
+    const startController = new AbortController();
+    const { signal } = startController;
 
     const initStream = async () => {
+      if (signal.aborted) {
+        return;
+      }
+
       setIsSubmitting(true);
       setShowStopButton(true);
 
       if (resumeStreamId) {
+        if (signal.aborted) {
+          return;
+        }
         // Resume: just subscribe to existing stream, don't start new generation
         console.log('[ResumableSSE] Resuming existing stream:', resumeStreamId);
         setStreamId(resumeStreamId);
@@ -809,7 +1245,10 @@ export default function useResumableSSE(
       } else {
         // New generation: start and then subscribe
         console.log('[ResumableSSE] Starting NEW generation');
-        const newStreamId = await startGeneration(submission);
+        const newStreamId = await startGeneration(submission, signal);
+        if (signal.aborted) {
+          return;
+        }
         if (newStreamId) {
           setStreamId(newStreamId);
           // Optimistically add to active jobs
@@ -817,12 +1256,13 @@ export default function useResumableSSE(
           // Queue title generation if this is a new conversation (first message).
           // Skip temporary conversations — the server never generates titles for
           // them, so polling would 404 indefinitely.
-          const isNewConvo = submission.userMessage?.parentMessageId === Constants.NO_PARENT;
+          const isNewConvo = isInitialNewConversation(submission);
           if (isNewConvo && !submission.isTemporary) {
             queueTitleGeneration(newStreamId);
           }
           if (isInitialNewConversation(submission)) {
             optimisticStreamIdsRef.current.add(newStreamId);
+            replaceNewConversationUrl(newStreamId);
           }
           const streamSubmission = addOptimisticConversation(newStreamId, submission);
           submissionRef.current = streamSubmission;
@@ -837,6 +1277,7 @@ export default function useResumableSSE(
 
     return () => {
       console.log('[ResumableSSE] Cleanup - closing SSE, resetting UI state');
+      startController.abort();
       // Cleanup on unmount/navigation - close connection but DO NOT abort backend
       // Reset UI state so it doesn't leak to other conversations
       // If user returns to this conversation, useResumeOnLoad will restore the state
diff --git a/client/src/hooks/SSE/useResumeOnLoad.ts b/client/src/hooks/SSE/useResumeOnLoad.ts
index a0d0b6c4d5d..97c1bc91c0e 100644
--- a/client/src/hooks/SSE/useResumeOnLoad.ts
+++ b/client/src/hooks/SSE/useResumeOnLoad.ts
@@ -1,8 +1,9 @@
 import { useEffect, useRef } from 'react';
-import { useSetRecoilState, useRecoilValue } from 'recoil';
+import { useSetRecoilState, useRecoilValue, useRecoilCallback } from 'recoil';
 import { Constants, tMessageSchema, isAssistantsEndpoint } from 'librechat-data-provider';
 import type { TMessage, TConversation, TSubmission, Agents } from 'librechat-data-provider';
 import type { StreamStatusResponse } from '~/data-provider';
+import { getBranchSiblingIndexesForTarget } from '~/utils';
 import { useStreamStatus } from '~/data-provider';
 import store from '~/store';
 
@@ -42,6 +43,45 @@ function resumeStateMatchesSubmission(
   return !!responseMessageId && resumeState.responseMessageId === responseMessageId;
 }
 
+function getResumeBranchTargetMessageId(
+  resumeState: Agents.ResumeState,
+  messages: TMessage[],
+): string | null | undefined {
+  const responseMessageId = resumeState.responseMessageId;
+  if (!responseMessageId) {
+    return resumeState.userMessage?.parentMessageId;
+  }
+
+  const unpaddedResponseMessageId = responseMessageId.replace(/_+$/, '');
+  let hasResponseMessage = false;
+  let hasUnpaddedResponseMessage = false;
+
+  for (const message of messages) {
+    if (message.messageId === responseMessageId) {
+      hasResponseMessage = true;
+      break;
+    }
+
+    if (message.messageId === unpaddedResponseMessageId) {
+      hasUnpaddedResponseMessage = true;
+    }
+  }
+
+  if (hasResponseMessage) {
+    return responseMessageId;
+  }
+
+  if (hasUnpaddedResponseMessage) {
+    return unpaddedResponseMessageId;
+  }
+
+  return resumeState.userMessage?.parentMessageId;
+}
+
+function preferDefinedString(value?: string | null, fallback?: string): string | undefined {
+  return value != null && value !== '' ? value : fallback;
+}
+
 /**
  * Build a submission object from resume state for reconnected streams.
  * This provides the minimum data needed for useResumableSSE to subscribe.
@@ -100,7 +140,8 @@ function buildSubmissionFromResumeState(
     isCreatedByUser: false,
     role: 'assistant',
     sender: existingResponseMessage?.sender ?? resumeState.sender,
-    model: existingResponseMessage?.model,
+    model: preferDefinedString(existingResponseMessage?.model, resumeState.model),
+    iconURL: preferDefinedString(existingResponseMessage?.iconURL, resumeState.iconURL),
   } as TMessage;
 
   const conversation: TConversation = {
@@ -148,6 +189,22 @@ export default function useResumeOnLoad(
   const resumableEnabled = !isAssistantsEndpoint(actualEndpoint);
   // Track conversations we've already processed (either resumed or skipped)
   const processedConvoRef = useRef<string | null>(null);
+  const restoreResumeBranch = useRecoilCallback(
+    ({ set }) =>
+      (resumeState: Agents.ResumeState, messages: TMessage[], activeConversationId: string) => {
+        const targetMessageId = getResumeBranchTargetMessageId(resumeState, messages);
+        const branchIndexes = getBranchSiblingIndexesForTarget(
+          messages,
+          targetMessageId,
+          activeConversationId,
+        );
+
+        for (const { parentMessageId, siblingIdx } of branchIndexes) {
+          set(store.messagesSiblingIdxFamily(parentMessageId), siblingIdx);
+        }
+      },
+    [],
+  );
 
   // Check for active stream when conversation changes
   const submissionConvoId = currentSubmission?.conversation?.conversationId;
@@ -266,6 +323,7 @@ export default function useResumeOnLoad(
 
     // Build submission from resume state if available
     if (streamStatus.resumeState) {
+      restoreResumeBranch(streamStatus.resumeState, messages, conversationId);
       const submission = buildSubmissionFromResumeState(
         streamStatus.resumeState,
         streamStatus.streamId,
@@ -308,6 +366,7 @@ export default function useResumeOnLoad(
     streamStatus,
     getMessages,
     setSubmission,
+    restoreResumeBranch,
   ]);
 
   // Reset processedConvoRef when conversation changes to allow re-checking
diff --git a/client/src/hooks/SSE/useSSE.ts b/client/src/hooks/SSE/useSSE.ts
index 509b7c213e0..8f18f1d556b 100644
--- a/client/src/hooks/SSE/useSSE.ts
+++ b/client/src/hooks/SSE/useSSE.ts
@@ -2,13 +2,20 @@ import { useEffect, useState } from 'react';
 import { v4 } from 'uuid';
 import { SSE } from 'sse.js';
 import { useSetRecoilState } from 'recoil';
-import { request, createPayload, removeNullishValues } from 'librechat-data-provider';
+import {
+  request,
+  UsageEvents,
+  StepEvents,
+  createPayload,
+  removeNullishValues,
+} from 'librechat-data-provider';
 import type { TMessage, TPayload, TSubmission, EventSubmission } from 'librechat-data-provider';
 import type { EventHandlerParams } from './useEventHandlers';
 import type { TResData } from '~/common';
 import { useGetStartupConfig, useGetUserBalance } from '~/data-provider';
 import { useAuthContext } from '~/hooks/AuthContext';
 import useEventHandlers from './useEventHandlers';
+import useUsageHandler from './useUsageHandler';
 import { clearAllDrafts } from '~/utils';
 import store from '~/store';
 
@@ -60,6 +67,15 @@ export default function useSSE(
   const balanceQuery = useGetUserBalance({
     enabled: !!isAuthenticated && startupConfig?.balance?.enabled,
   });
+  const {
+    contextHandler,
+    usageHandler,
+    tapStream,
+    tapContent,
+    finalizeUsage,
+    resetLive,
+    attributePending,
+  } = useUsageHandler();
 
   useEffect(() => {
     if (submission == null || Object.keys(submission).length === 0) {
@@ -96,6 +112,7 @@ export default function useSSE(
         clearAllDrafts(submission.conversation?.conversationId);
         try {
           finalHandler(data, submission as EventSubmission);
+          finalizeUsage(data, { ...submission, userMessage });
         } catch (error) {
           console.error('Error in finalHandler:', error);
           setIsSubmitting(false);
@@ -116,7 +133,17 @@ export default function useSSE(
         createdHandler(data, { ...submission, userMessage } as EventSubmission);
       } else if (data.event === 'title') {
         titleHandler(data);
+      } else if (data.event === UsageEvents.ON_CONTEXT_USAGE) {
+        contextHandler(data.data, { ...submission, userMessage });
+      } else if (data.event === UsageEvents.ON_TOKEN_USAGE) {
+        usageHandler(data.data, { ...submission, userMessage });
       } else if (data.event != null) {
+        if (
+          data.event === StepEvents.ON_MESSAGE_DELTA ||
+          data.event === StepEvents.ON_REASONING_DELTA
+        ) {
+          tapStream(data.data, { ...submission, userMessage });
+        }
         stepHandler(data, { ...submission, userMessage } as EventSubmission);
       } else if (data.sync != null) {
         const runId = v4();
@@ -129,6 +156,7 @@ export default function useSSE(
           textIndex = index;
         }
 
+        tapContent(text, { ...submission, userMessage });
         contentHandler({ data, submission: submission as EventSubmission });
       } else {
         const text = data.text ?? data.response;
@@ -140,6 +168,9 @@ export default function useSSE(
         };
 
         if (data.message != null) {
+          /** Legacy non-agent streams (handleText) send cumulative text here,
+           *  not via the content path — feed it to the live estimate too */
+          tapContent(text, { ...submission, userMessage });
           messageHandler(text, { ...submission, userMessage, initialResponse });
         }
       }
@@ -164,6 +195,13 @@ export default function useSSE(
       setCompleted((prev) => new Set(prev.add(streamKey)));
       const latestMessages = getMessages();
       const conversationId = latestMessages?.[latestMessages.length - 1]?.conversationId;
+      /** Attribute usage billed before the stop to the partial response (the
+       *  branch tail), then reset pending — so it neither drops nor leaks into
+       *  the next response. Falls back to a plain reset when no response exists. */
+      const tail = latestMessages?.[latestMessages.length - 1];
+      const partialResponseId =
+        tail != null && tail.isCreatedByUser === false ? tail.messageId : null;
+      attributePending(partialResponseId, { ...submission, userMessage });
       try {
         await abortConversation(
           conversationId ??
@@ -206,6 +244,7 @@ export default function useSSE(
 
       console.log('error in server stream.');
       (startupConfig?.balance?.enabled ?? false) && balanceQuery.refetch();
+      resetLive({ ...submission, userMessage });
 
       let data: TResData | undefined = undefined;
       try {
diff --git a/client/src/hooks/SSE/useStepHandler.ts b/client/src/hooks/SSE/useStepHandler.ts
index e4c62832692..e9ef6e3227a 100644
--- a/client/src/hooks/SSE/useStepHandler.ts
+++ b/client/src/hooks/SSE/useStepHandler.ts
@@ -20,14 +20,14 @@ import type {
 } from 'librechat-data-provider';
 import type { SetterOrUpdater } from 'recoil';
 import type { AnnounceOptions } from '~/common';
-import { MESSAGE_UPDATE_INTERVAL } from '~/common';
-import { subagentProgressByToolCallId } from '~/store';
 import {
   foldSubagentEvent,
   foldSubagentEventIntoTicker,
   initSubagentAggregatorState,
   initSubagentTickerState,
 } from '~/utils/subagentContent';
+import { subagentProgressByToolCallId } from '~/store';
+import { MESSAGE_UPDATE_INTERVAL } from '~/common';
 
 type TUseStepHandler = {
   announcePolite: (options: AnnounceOptions) => void;
@@ -36,6 +36,12 @@ type TUseStepHandler = {
   /** @deprecated - isSubmitting should be derived from submission state */
   setIsSubmitting?: SetterOrUpdater<boolean>;
   lastAnnouncementTimeRef: React.MutableRefObject<number>;
+  /**
+   * Fired when a completed `create_file`/`edit_file` call targeted a
+   * `skills/...` path. The caller owns the side effect (skill query cache
+   * invalidation) so this hook stays free of query-client coupling.
+   */
+  onSkillAuthoringComplete?: () => void;
 };
 
 type TStepEvent =
@@ -63,11 +69,52 @@ type AllContentTypes =
   | ContentTypes.SUMMARY
   | ContentTypes.ERROR;
 
+/** Mirrors `SKILL_FILE_PREFIX` in `@librechat/api` file-authoring handlers. */
+const SKILL_FILE_PREFIX = 'skills/';
+const FILE_AUTHORING_TOOLS = new Set(['create_file', 'edit_file']);
+
+/**
+ * True when a completed tool call authored a skill file (`create_file` /
+ * `edit_file` targeting a `skills/...` path). Skills created or edited
+ * mid-chat must invalidate the cached skill queries, or the Skills panel
+ * and builder keep showing the pre-authoring catalog.
+ */
+function isSkillAuthoringToolCall(toolCall?: Agents.ToolCall): boolean {
+  if (!toolCall?.name || !FILE_AUTHORING_TOOLS.has(toolCall.name)) {
+    return false;
+  }
+  const { args } = toolCall;
+  let filePath: unknown;
+  if (typeof args === 'object' && args !== null) {
+    filePath = (args as { file_path?: unknown }).file_path;
+  } else if (typeof args === 'string') {
+    try {
+      filePath = (JSON.parse(args) as { file_path?: unknown }).file_path;
+    } catch {
+      return false;
+    }
+  }
+  return typeof filePath === 'string' && filePath.startsWith(SKILL_FILE_PREFIX);
+}
+
+const isOAuthToolCallName = (name?: string) =>
+  typeof name === 'string' && name.startsWith(`oauth${Constants.mcp_delimiter}`);
+
+const isOAuthToolCallContent = (part?: Partial<TMessageContentParts>) => {
+  if (part?.type !== ContentTypes.TOOL_CALL || !('tool_call' in part)) {
+    return false;
+  }
+  const { tool_call: toolCall } = part;
+  const name = toolCall != null && 'name' in toolCall ? toolCall.name : undefined;
+  return isOAuthToolCallName(name);
+};
+
 export default function useStepHandler({
   setMessages,
   getMessages,
   announcePolite,
   lastAnnouncementTimeRef,
+  onSkillAuthoringComplete,
 }: TUseStepHandler) {
   const toolCallIdMap = useRef(new Map<string, string | undefined>());
   const messageMap = useRef(new Map<string, TMessage>());
@@ -100,6 +147,14 @@ export default function useStepHandler({
    */
   const knownSubagentAtomKeys = useRef(new Set<string>());
 
+  const getCurrentMessages = useCallback(
+    (messages: TMessage[]) => {
+      const freshMessages = getMessages();
+      return freshMessages && freshMessages.length >= messages.length ? freshMessages : messages;
+    },
+    [getMessages],
+  );
+
   /** Both content parts and ticker lines are aggregated incrementally
    *  into the atom as each `ON_SUBAGENT_UPDATE` arrives — we never
    *  retain the raw event array, so no rolling window is needed. A
@@ -270,9 +325,20 @@ export default function useStepHandler({
       return message;
     }
 
-    const updatedContent = [...(message.content || [])] as Array<
+    const incomingOAuthToolCall =
+      contentType === ContentTypes.TOOL_CALL &&
+      'tool_call' in contentPart &&
+      isOAuthToolCallName(contentPart.tool_call?.name);
+
+    let updatedContent = [...(message.content || [])] as Array<
       Partial<TMessageContentParts> | undefined
     >;
+
+    const oauthPromptOccupiesSlot = isOAuthToolCallContent(updatedContent[index]);
+    if (!incomingOAuthToolCall && oauthPromptOccupiesSlot) {
+      updatedContent = updatedContent.filter((part) => !isOAuthToolCallContent(part));
+    }
+
     if (!updatedContent[index] && contentType !== ContentTypes.TOOL_CALL) {
       updatedContent[index] = { type: contentPart.type as AllContentTypes };
     }
@@ -413,9 +479,105 @@ export default function useStepHandler({
 
   const stepHandler = useCallback(
     (stepEvent: TStepEvent, submission: EventSubmission) => {
-      const messages = getMessages() || [];
+      const submissionMessages = submission.messages ?? [];
+      const getEventMessages = (candidateMessages: TMessage[]) =>
+        submission.isRegenerate ? candidateMessages : getCurrentMessages(candidateMessages);
+      const messages = getEventMessages(submissionMessages);
       const { userMessage } = submission;
-      let parentMessageId = userMessage.messageId;
+      const getRegenerateResponseIds = (responseMessageId: string) => {
+        const ids = new Set<string>();
+        const addId = (id?: string | null) => {
+          if (!id) {
+            return;
+          }
+          ids.add(id);
+          ids.add(id.replace(/_+$/, ''));
+        };
+        addId(responseMessageId);
+        addId(submission.initialResponse?.messageId);
+        addId(submission.userMessage?.responseMessageId);
+        return ids;
+      };
+      const shouldRemoveRegenerateResponse = (message: TMessage, responseMessageId: string) =>
+        submission.isRegenerate &&
+        !message.isCreatedByUser &&
+        getRegenerateResponseIds(responseMessageId).has(message.messageId);
+      const shouldRemoveInitialResponse = (message: TMessage, responseMessageId: string) => {
+        const initialResponseId = submission.initialResponse?.messageId;
+        return (
+          !submission.isRegenerate &&
+          !message.isCreatedByUser &&
+          initialResponseId != null &&
+          initialResponseId !== responseMessageId &&
+          message.messageId === initialResponseId &&
+          message.parentMessageId === userMessage.messageId
+        );
+      };
+      const ensureUserMessagePresent = (
+        candidateMessages: TMessage[],
+        responseMessageId: string,
+      ) => {
+        if (
+          submission.isRegenerate ||
+          !userMessage?.messageId ||
+          candidateMessages.some((message) => message.messageId === userMessage.messageId)
+        ) {
+          return candidateMessages;
+        }
+
+        const responseIndex = candidateMessages.findIndex(
+          (message) => message.messageId === responseMessageId,
+        );
+        if (responseIndex < 0) {
+          return [...candidateMessages, userMessage as TMessage];
+        }
+
+        const nextMessages = [...candidateMessages];
+        nextMessages.splice(responseIndex, 0, userMessage as TMessage);
+        return nextMessages;
+      };
+      const getResponseBaseMessages = (
+        candidateMessages: TMessage[],
+        responseMessageId: string,
+        ensureUserMessage = false,
+      ) => {
+        const currentMessages = getEventMessages(candidateMessages);
+        if (!submission.isRegenerate) {
+          const nextMessages = currentMessages.filter(
+            (message) => !shouldRemoveInitialResponse(message, responseMessageId),
+          );
+          return ensureUserMessage
+            ? ensureUserMessagePresent(nextMessages, responseMessageId)
+            : nextMessages;
+        }
+        return currentMessages.filter(
+          (message) => !shouldRemoveRegenerateResponse(message, responseMessageId),
+        );
+      };
+      const mergeResponseMessage = (
+        candidateMessages: TMessage[],
+        updatedResponse: TMessage,
+        responseMessageId: string,
+        options?: { ensureUserMessage?: boolean },
+      ) => {
+        const currentMessages = getResponseBaseMessages(
+          candidateMessages,
+          responseMessageId,
+          options?.ensureUserMessage === true,
+        );
+        const hasResponseMessage = currentMessages.some(
+          (msg) => msg.messageId === responseMessageId,
+        );
+        return hasResponseMessage
+          ? currentMessages.map((msg) =>
+              msg.messageId === responseMessageId ? updatedResponse : msg,
+            )
+          : [...currentMessages, updatedResponse];
+      };
+      let parentMessageId =
+        submission.isRegenerate && submission.initialResponse?.parentMessageId
+          ? submission.initialResponse.parentMessageId
+          : userMessage.messageId;
 
       const currentTime = Date.now();
       if (currentTime - lastAnnouncementTimeRef.current > MESSAGE_UPDATE_INTERVAL) {
@@ -449,10 +611,13 @@ export default function useStepHandler({
         let response = messageMap.current.get(responseMessageId);
 
         if (!response) {
-          // Find the actual response message - check if last message is a response, otherwise use initialResponse
+          // Find the actual response message. Regenerate submissions can target
+          // an earlier branch while the visible history still ends at a later
+          // assistant message, so never seed a regenerated response from the
+          // conversation tail.
           const lastMessage = messages[messages.length - 1] as TMessage;
           const responseMessage =
-            lastMessage && !lastMessage.isCreatedByUser
+            !submission.isRegenerate && lastMessage && !lastMessage.isCreatedByUser
               ? lastMessage
               : (submission?.initialResponse as TMessage);
 
@@ -474,14 +639,23 @@ export default function useStepHandler({
 
           // Get fresh messages to handle multi-tab scenarios where messages may have loaded
           // after this handler started (Tab 2 may have more complete history now)
-          const freshMessages = getMessages() || [];
-          const currentMessages = freshMessages.length > messages.length ? freshMessages : messages;
+          const currentMessages = getResponseBaseMessages(messages, responseMessageId, true);
 
           // Remove any existing response placeholder
-          let updatedMessages = currentMessages.filter((m) => m.messageId !== responseMessageId);
+          let updatedMessages = currentMessages.filter(
+            (message) =>
+              message.messageId !== responseMessageId &&
+              !shouldRemoveRegenerateResponse(message, responseMessageId) &&
+              !shouldRemoveInitialResponse(message, responseMessageId),
+          );
 
-          // Ensure userMessage is present (multi-tab: Tab 2 may not have it yet)
-          if (!updatedMessages.some((m) => m.messageId === userMessage.messageId)) {
+          // Ensure userMessage is present (multi-tab: Tab 2 may not have it yet).
+          // Regenerate reuses an existing user turn; its submission userMessage is only
+          // a transport placeholder and must not become a new visible branch.
+          if (
+            !submission.isRegenerate &&
+            !updatedMessages.some((m) => m.messageId === userMessage.messageId)
+          ) {
             updatedMessages = [...updatedMessages, userMessage as TMessage];
           }
 
@@ -517,11 +691,11 @@ export default function useStepHandler({
           });
 
           messageMap.current.set(responseMessageId, updatedResponse);
-          const updatedMessages = messages.map((msg) =>
-            msg.messageId === responseMessageId ? updatedResponse : msg,
+          setMessages(
+            mergeResponseMessage(messages, updatedResponse, responseMessageId, {
+              ensureUserMessage: true,
+            }),
           );
-
-          setMessages(updatedMessages);
         }
 
         if (runStep.summary != null) {
@@ -543,8 +717,11 @@ export default function useStepHandler({
           );
 
           messageMap.current.set(responseMessageId, updatedResponse);
-          const currentMessages = getMessages() || [];
-          setMessages([...currentMessages.slice(0, -1), updatedResponse]);
+          setMessages(
+            mergeResponseMessage(messages, updatedResponse, responseMessageId, {
+              ensureUserMessage: true,
+            }),
+          );
         }
 
         const bufferedDeltas = pendingDeltaBuffer.current.get(runStep.id);
@@ -582,8 +759,11 @@ export default function useStepHandler({
             agentUpdateMeta,
           );
           messageMap.current.set(responseMessageId, updatedResponse);
-          const currentMessages = getMessages() || [];
-          setMessages([...currentMessages.slice(0, -1), updatedResponse]);
+          setMessages(
+            mergeResponseMessage(messages, updatedResponse, responseMessageId, {
+              ensureUserMessage: true,
+            }),
+          );
         }
       } else if (stepEvent.event === StepEvents.ON_MESSAGE_DELTA) {
         const messageDelta = stepEvent.data;
@@ -625,8 +805,11 @@ export default function useStepHandler({
             getStepMetadata(runStep),
           );
           messageMap.current.set(responseMessageId, updatedResponse);
-          const currentMessages = getMessages() || [];
-          setMessages([...currentMessages.slice(0, -1), updatedResponse]);
+          setMessages(
+            mergeResponseMessage(messages, updatedResponse, responseMessageId, {
+              ensureUserMessage: true,
+            }),
+          );
         }
       } else if (stepEvent.event === StepEvents.ON_REASONING_DELTA) {
         const reasoningDelta = stepEvent.data;
@@ -668,8 +851,11 @@ export default function useStepHandler({
             getStepMetadata(runStep),
           );
           messageMap.current.set(responseMessageId, updatedResponse);
-          const currentMessages = getMessages() || [];
-          setMessages([...currentMessages.slice(0, -1), updatedResponse]);
+          setMessages(
+            mergeResponseMessage(messages, updatedResponse, responseMessageId, {
+              ensureUserMessage: true,
+            }),
+          );
         }
       } else if (stepEvent.event === StepEvents.ON_RUN_STEP_DELTA) {
         const runStepDelta = stepEvent.data;
@@ -724,11 +910,11 @@ export default function useStepHandler({
           });
 
           messageMap.current.set(responseMessageId, updatedResponse);
-          const updatedMessages = messages.map((msg) =>
-            msg.messageId === responseMessageId ? updatedResponse : msg,
+          setMessages(
+            mergeResponseMessage(messages, updatedResponse, responseMessageId, {
+              ensureUserMessage: true,
+            }),
           );
-
-          setMessages(updatedMessages);
         }
       } else if (stepEvent.event === StepEvents.ON_RUN_STEP_COMPLETED) {
         const { result } = stepEvent.data;
@@ -747,6 +933,10 @@ export default function useStepHandler({
           return;
         }
 
+        if (isSkillAuthoringToolCall(result.tool_call)) {
+          onSkillAuthoringComplete?.();
+        }
+
         const response = messageMap.current.get(responseMessageId);
         if (response) {
           let updatedResponse = { ...response };
@@ -767,11 +957,11 @@ export default function useStepHandler({
           );
 
           messageMap.current.set(responseMessageId, updatedResponse);
-          const updatedMessages = messages.map((msg) =>
-            msg.messageId === responseMessageId ? updatedResponse : msg,
+          setMessages(
+            mergeResponseMessage(messages, updatedResponse, responseMessageId, {
+              ensureUserMessage: true,
+            }),
           );
-
-          setMessages(updatedMessages);
         }
       } else if (stepEvent.event === StepEvents.ON_SUBAGENT_UPDATE) {
         applySubagentUpdate(stepEvent.data);
@@ -814,8 +1004,8 @@ export default function useStepHandler({
               summarizeDeltaRaf.current = null;
               const latest = messageMap.current.get(responseMessageId);
               if (latest) {
-                const msgs = getMessages() || [];
-                setMessages([...msgs.slice(0, -1), latest]);
+                const currentMessages = submission.isRegenerate ? messages : getMessages() || [];
+                setMessages(mergeResponseMessage(currentMessages, latest, responseMessageId));
               }
             });
           }
@@ -833,9 +1023,6 @@ export default function useStepHandler({
           return;
         }
 
-        const currentMessages = getMessages() || [];
-        const targetIndex = currentMessages.findIndex((m) => m.messageId === completeMessageId);
-
         if (completeData.error) {
           const filtered = targetMessage.content.filter(
             (part) =>
@@ -844,12 +1031,9 @@ export default function useStepHandler({
           if (filtered.length !== targetMessage.content.length) {
             announcePolite({ message: 'summarize_failed', isStatus: true });
             const cleaned = { ...targetMessage, content: filtered };
+            const currentMessages = submission.isRegenerate ? messages : getMessages() || [];
             messageMap.current.set(completeMessageId, cleaned);
-            if (targetIndex >= 0) {
-              const updated = [...currentMessages];
-              updated[targetIndex] = cleaned;
-              setMessages(updated);
-            }
+            setMessages(mergeResponseMessage(currentMessages, cleaned, completeMessageId));
           }
         } else {
           let didFinalize = false;
@@ -863,13 +1047,12 @@ export default function useStepHandler({
             }
             return part;
           });
-          if (didFinalize && targetIndex >= 0) {
+          if (didFinalize) {
             announcePolite({ message: 'summarize_completed', isStatus: true });
             const finalized = { ...targetMessage, content: updatedContent };
+            const currentMessages = submission.isRegenerate ? messages : getMessages() || [];
             messageMap.current.set(completeMessageId, finalized);
-            const updated = [...currentMessages];
-            updated[targetIndex] = finalized;
-            setMessages(updated);
+            setMessages(mergeResponseMessage(currentMessages, finalized, completeMessageId));
           }
         }
       } else {
@@ -883,7 +1066,9 @@ export default function useStepHandler({
       announcePolite,
       setMessages,
       calculateContentIndex,
+      getCurrentMessages,
       applySubagentUpdate,
+      onSkillAuthoringComplete,
     ],
   );
 
diff --git a/client/src/hooks/SSE/useUsageHandler.ts b/client/src/hooks/SSE/useUsageHandler.ts
new file mode 100644
index 00000000000..46252826445
--- /dev/null
+++ b/client/src/hooks/SSE/useUsageHandler.ts
@@ -0,0 +1,400 @@
+import { useRef, useMemo } from 'react';
+import { getDefaultStore } from 'jotai';
+import { Constants, reconcileContextUsage, promptTokensFromUsage } from 'librechat-data-provider';
+import type {
+  TMessage,
+  TConversation,
+  TTokenUsageEvent,
+  TContextUsageEvent,
+} from 'librechat-data-provider';
+import type { ContextSnapshot } from '~/store/usage';
+import {
+  markUsageFolded,
+  liveTokensFamily,
+  totalUsageFamily,
+  removeUsageAtoms,
+  clearUsageFolded,
+  calibrationFamily,
+  pendingUsageFamily,
+  branchTotalsFamily,
+  migrateUsageFolded,
+  EMPTY_USAGE_TOTALS,
+  contextSnapshotFamily,
+  snapshotsByAnchorFamily,
+} from '~/store/usage';
+import {
+  sumBranch,
+  setEntryUsage,
+  upsertEntries,
+  migrateIndex,
+  sumTotalUsage,
+  estimateTokens,
+  normalizeUsageUnits,
+} from '~/utils';
+
+const FLUSH_INTERVAL_MS = 250;
+
+interface UsageSubmissionLike {
+  userMessage?: Pick<TMessage, 'messageId' | 'conversationId'> | null;
+  conversation?: Partial<Pick<TConversation, 'conversationId' | 'endpoint' | 'model'>> | null;
+}
+
+interface FinalDataLike {
+  requestMessage?: Partial<TMessage> | null;
+  responseMessage?: Partial<TMessage> | null;
+  conversation?: Partial<TConversation> | null;
+}
+
+export interface UsageHandlers {
+  contextHandler: (data: TContextUsageEvent, submission: UsageSubmissionLike) => void;
+  usageHandler: (data: TTokenUsageEvent, submission: UsageSubmissionLike) => void;
+  tapStream: (data: { delta?: { content?: unknown } }, submission: UsageSubmissionLike) => void;
+  /** Live estimate for the legacy content path, which streams cumulative
+   *  (not incremental) text per part — sets rather than accumulates */
+  tapContent: (text: unknown, submission: UsageSubmissionLike) => void;
+  finalizeUsage: (data: FinalDataLike, submission: UsageSubmissionLike) => void;
+  resetLive: (submission: UsageSubmissionLike) => void;
+  /** Terminal stop: attribute the in-flight pending usage to the stopped partial
+   *  response (so its billed tokens aren't dropped), then reset pending so it
+   *  can't leak into the next response. Discards when no response id is known. */
+  attributePending: (responseId: string | null, submission: UsageSubmissionLike) => void;
+  /** Idempotently folds the resumed run's collected usage into the totals */
+  backfillUsage: (entries: TTokenUsageEvent[], submission: UsageSubmissionLike) => void;
+  /** Seeds the live estimate from already-streamed output chars on resume */
+  seedLive: (chars: number, submission: UsageSubmissionLike) => void;
+}
+
+function getConvoKey(submission: UsageSubmissionLike): string {
+  /** On a new chat's first turn the `created` event stamps the real id onto
+   *  the user message while the submission's conversation is still `new`;
+   *  prefer the real id so live writes land where TokenUsage is subscribed */
+  const fromUserMessage = submission.userMessage?.conversationId;
+  if (fromUserMessage != null && fromUserMessage !== Constants.NEW_CONVO) {
+    return fromUserMessage;
+  }
+  return submission.conversation?.conversationId ?? Constants.NEW_CONVO;
+}
+
+/** Cumulative text of a content-path part: a raw string or a `{ value }` part */
+function extractContentText(text: unknown): string {
+  if (typeof text === 'string') {
+    return text;
+  }
+  const value = (text as { value?: unknown })?.value;
+  return typeof value === 'string' ? value : '';
+}
+
+function countDeltaChars(content: unknown): number {
+  const parts = Array.isArray(content) ? content : [content];
+  let chars = 0;
+  for (const part of parts) {
+    if (part == null || typeof part !== 'object') {
+      continue;
+    }
+    const { text, think } = part as { text?: unknown; think?: unknown };
+    if (typeof text === 'string') {
+      chars += text.length;
+    } else if (typeof think === 'string') {
+      chars += think.length;
+    }
+  }
+  return chars;
+}
+
+/**
+ * Imperative writers for the per-conversation token usage atoms, driven by
+ * SSE events. All state lives in refs/atoms — the returned handlers are
+ * stable and never cause re-renders themselves.
+ */
+export default function useUsageHandler(): UsageHandlers {
+  /** Streamed chars since the last snapshot or model end (current call only) */
+  const streamCharsRef = useRef(0);
+  /** Provider-confirmed output tokens since the last snapshot (current run) */
+  const confirmedRef = useRef(0);
+  const lastFlushRef = useRef(0);
+
+  return useMemo<UsageHandlers>(() => {
+    const jotai = getDefaultStore();
+
+    const setLive = (convoKey: string, value: number) => {
+      jotai.set(liveTokensFamily(convoKey), value);
+    };
+
+    /** Flush the in-flight pending usage into a response's index entry, then
+     *  reset pending. Only flushes when events were actually folded this session
+     *  (eventCount > 0), so a finalize that carries persisted `metadata.usage`
+     *  but folded nothing — a late/second resumable subscriber — keeps the entry
+     *  loaded by `upsertEntries` instead of overwriting it with an empty record. */
+    const flushPendingInto = (convoKey: string, responseId: string | null) => {
+      const pendingAtom = pendingUsageFamily(convoKey);
+      const pending = jotai.get(pendingAtom);
+      if (responseId != null && pending.eventCount > 0) {
+        setEntryUsage(convoKey, responseId, {
+          input: pending.input,
+          output: pending.output,
+          cacheWrite: pending.cacheWrite,
+          cacheRead: pending.cacheRead,
+          cost: pending.costUSD,
+          costKnown: pending.costKnown,
+        });
+      }
+      jotai.set(pendingAtom, EMPTY_USAGE_TOTALS);
+    };
+
+    const contextHandler: UsageHandlers['contextHandler'] = (data, submission) => {
+      const convoKey = getConvoKey(submission);
+      jotai.set(contextSnapshotFamily(convoKey), {
+        ...data,
+        anchorMessageId: submission.userMessage?.messageId ?? null,
+      });
+      if (data.calibrationRatio != null && data.calibrationRatio > 0) {
+        jotai.set(calibrationFamily(convoKey), data.calibrationRatio);
+      }
+      streamCharsRef.current = 0;
+      confirmedRef.current = 0;
+      setLive(convoKey, 0);
+    };
+
+    /** Folds one usage event into the in-flight pending holder exactly once per
+     *  conversation. Returns false when the event was already counted (live then
+     *  replayed on resume), so callers can skip the live-estimate bump too.
+     *  `finalizeUsage` flushes the accumulated pending into the per-message index
+     *  and resets it, so branch/total stay index-derived (no double count). */
+    const foldUsage = (data: TTokenUsageEvent, submission: UsageSubmissionLike): boolean => {
+      const convoKey = getConvoKey(submission);
+      /** runId+seq is unique per model call; fall back to the payload when a
+       *  source predates the sequence tag */
+      const usageKey =
+        data.runId != null && data.seq != null ? `${data.runId}:${data.seq}` : JSON.stringify(data);
+      if (!markUsageFolded(convoKey, usageKey)) {
+        return false;
+      }
+
+      /** Displayed counts use the same normalized units billing does: input is
+       *  the uncached portion, output includes repaired completion tokens */
+      const units = normalizeUsageUnits(data);
+
+      const pendingAtom = pendingUsageFamily(convoKey);
+      const prev = jotai.get(pendingAtom);
+      jotai.set(pendingAtom, {
+        input: prev.input + units.input,
+        output: prev.output + units.output,
+        cacheWrite: prev.cacheWrite + units.cacheWrite,
+        cacheRead: prev.cacheRead + units.cacheRead,
+        eventCount: prev.eventCount + 1,
+        /** Authoritative per-event cost from the backend (premium tiers, cache
+         *  rates); absent when contextCost is disabled — sums to 0 then */
+        costUSD: prev.costUSD + (data.cost ?? 0),
+        /** Coverage is complete only if EVERY folded event carried a cost */
+        costKnown: prev.costKnown && data.cost != null,
+      });
+      return true;
+    };
+
+    /** Reconcile the live snapshot's calibrated estimate to a primary call's
+     *  ACTUAL prompt tokens. The snapshot is pre-invoke for that call; this usage
+     *  is its post-invoke truth, so the gauge stops showing the SDK multiplier's
+     *  inflation (severe when a provider injects server-side content like web
+     *  search). Resume is handled server-side (the job-store snapshot is reconciled
+     *  when the call's usage is persisted), so no backfill reconcile is needed. */
+    const reconcileLiveSnapshot = (data: TTokenUsageEvent, submission: UsageSubmissionLike) => {
+      const convoKey = getConvoKey(submission);
+      const snapshotAtom = contextSnapshotFamily(convoKey);
+      const snapshot = jotai.get(snapshotAtom);
+      if (snapshot == null) {
+        return;
+      }
+      /** The snapshot precedes this call, so it must belong to the same run */
+      if (snapshot.runId != null && data.runId != null && snapshot.runId !== data.runId) {
+        return;
+      }
+      const reconciled = reconcileContextUsage(snapshot, promptTokensFromUsage(data));
+      jotai.set(snapshotAtom, { ...reconciled, anchorMessageId: snapshot.anchorMessageId });
+    };
+
+    const usageHandler: UsageHandlers['usageHandler'] = (data, submission) => {
+      const folded = foldUsage(data, submission);
+
+      /** Only a NEWLY folded primary call drives the live gauge. A replayed
+       *  duplicate (folded=false on resume) can be an EARLIER tool-loop call that
+       *  shares this run's id — reconciling with it would overwrite the latest
+       *  snapshot with an earlier, smaller prompt. Tagged buckets (summarization,
+       *  subagent) never touch the context gauge. */
+      if (!folded || data.usage_type != null) {
+        return;
+      }
+      /** This primary's provider-reported prompt is the post-invoke truth for the
+       *  call the latest snapshot precedes — reconcile the gauge to it. */
+      reconcileLiveSnapshot(data, submission);
+      /** Use the repaired completion count (not raw output_tokens) so the
+       *  snapshot gauge keeps the full response for under-reporting providers */
+      confirmedRef.current += normalizeUsageUnits(data).output;
+      streamCharsRef.current = 0;
+      setLive(getConvoKey(submission), confirmedRef.current);
+    };
+
+    const tapStream: UsageHandlers['tapStream'] = (data, submission) => {
+      const chars = countDeltaChars(data?.delta?.content);
+      if (chars <= 0) {
+        return;
+      }
+      streamCharsRef.current += chars;
+      const now = Date.now();
+      if (now - lastFlushRef.current < FLUSH_INTERVAL_MS) {
+        return;
+      }
+      lastFlushRef.current = now;
+      const convoKey = getConvoKey(submission);
+      const ratio = jotai.get(calibrationFamily(convoKey));
+      setLive(convoKey, confirmedRef.current + estimateTokens(streamCharsRef.current, ratio));
+    };
+
+    const tapContent: UsageHandlers['tapContent'] = (text, submission) => {
+      const value = extractContentText(text);
+      if (value.length === 0) {
+        return;
+      }
+      /** Cumulative per part — replace the running char count, don't add */
+      streamCharsRef.current = value.length;
+      const now = Date.now();
+      if (now - lastFlushRef.current < FLUSH_INTERVAL_MS) {
+        return;
+      }
+      lastFlushRef.current = now;
+      const convoKey = getConvoKey(submission);
+      const ratio = jotai.get(calibrationFamily(convoKey));
+      setLive(convoKey, confirmedRef.current + estimateTokens(streamCharsRef.current, ratio));
+    };
+
+    const resetLive: UsageHandlers['resetLive'] = (submission) => {
+      streamCharsRef.current = 0;
+      confirmedRef.current = 0;
+      const convoKey = getConvoKey(submission);
+      setLive(convoKey, 0);
+      /** Terminal path with no salvageable response (stream error / intentional
+       *  close): discard the in-flight pending usage so it can't merge into the
+       *  next response. The user-stop path uses `attributePending` to keep it on
+       *  the partial reply. Also forget the folded-event identities so a resume's
+       *  `backfillUsage` can rebuild pending — otherwise it sees them as already
+       *  folded and the response's usage stays missing until a full reload. */
+      jotai.set(pendingUsageFamily(convoKey), EMPTY_USAGE_TOTALS);
+      clearUsageFolded(convoKey);
+    };
+
+    const attributePending: UsageHandlers['attributePending'] = (responseId, submission) => {
+      const convoKey = getConvoKey(submission);
+      /** Flush the billed-but-uncommitted usage onto the stopped partial reply
+       *  (when its id is known and events were folded), then reset pending and
+       *  the live estimate. Index-derived branch/total then reflect it. */
+      flushPendingInto(convoKey, responseId);
+      if (responseId != null) {
+        jotai.set(branchTotalsFamily(convoKey), sumBranch(convoKey, responseId, responseId));
+        jotai.set(totalUsageFamily(convoKey), sumTotalUsage(convoKey));
+      }
+      streamCharsRef.current = 0;
+      confirmedRef.current = 0;
+      setLive(convoKey, 0);
+    };
+
+    const backfillUsage: UsageHandlers['backfillUsage'] = (entries, submission) => {
+      /** Fold the resumed run's persisted events idempotently — never reset
+       *  the conversation totals, or a reconnect mid-stream would drop the
+       *  usage of prompts already completed earlier in the session */
+      for (const entry of entries) {
+        foldUsage(entry, submission);
+      }
+    };
+
+    const seedLive: UsageHandlers['seedLive'] = (chars, submission) => {
+      if (chars <= 0) {
+        return;
+      }
+      const convoKey = getConvoKey(submission);
+      streamCharsRef.current = chars;
+      confirmedRef.current = 0;
+      setLive(convoKey, estimateTokens(chars, jotai.get(calibrationFamily(convoKey))));
+    };
+
+    const finalizeUsage: UsageHandlers['finalizeUsage'] = (data, submission) => {
+      const fromKey = getConvoKey(submission);
+      const realId = data.conversation?.conversationId ?? fromKey;
+      /** From the refs, not the atom — the throttle may not have flushed */
+      const liveAtFinalize =
+        confirmedRef.current +
+        estimateTokens(streamCharsRef.current, jotai.get(calibrationFamily(fromKey)));
+
+      upsertEntries(fromKey, [data.requestMessage, data.responseMessage]);
+
+      if (realId !== fromKey) {
+        migrateIndex(fromKey, realId);
+        migrateUsageFolded(fromKey, realId);
+        jotai.set(contextSnapshotFamily(realId), jotai.get(contextSnapshotFamily(fromKey)));
+        jotai.set(snapshotsByAnchorFamily(realId), jotai.get(snapshotsByAnchorFamily(fromKey)));
+        jotai.set(pendingUsageFamily(realId), jotai.get(pendingUsageFamily(fromKey)));
+        jotai.set(calibrationFamily(realId), jotai.get(calibrationFamily(fromKey)));
+        removeUsageAtoms(fromKey);
+      }
+
+      const responseMeta = data.responseMessage?.contextMeta;
+      if (responseMeta?.calibrationRatio != null && responseMeta.calibrationRatio > 0) {
+        jotai.set(calibrationFamily(realId), responseMeta.calibrationRatio);
+      }
+
+      const userMsgId = submission.userMessage?.messageId ?? null;
+      const responseId = data.responseMessage?.messageId ?? null;
+
+      /** Flush the in-flight response's pending usage into its index entry, then
+       *  reset pending. Branch/total are summed from the index, so this single
+       *  add is counted exactly once; the persisted `metadata.usage` reproduces
+       *  it on reload. */
+      flushPendingInto(realId, responseId);
+
+      const tailId = responseId ?? data.requestMessage?.messageId ?? null;
+      if (tailId) {
+        jotai.set(branchTotalsFamily(realId), sumBranch(realId, tailId, responseId ?? userMsgId));
+      }
+      jotai.set(totalUsageFamily(realId), sumTotalUsage(realId));
+
+      const snapshotAtom = contextSnapshotFamily(realId);
+      const snapshot = jotai.get(snapshotAtom);
+      /** Re-anchor the snapshot from the user message — shared by both branches
+       *  when a response is regenerated — to the branch-unique response message,
+       *  so switching to a sibling branch falls back to that branch's own
+       *  totals instead of showing this generation's snapshot. Also carry the
+       *  output streamed since the pre-invoke snapshot, kept after live resets. */
+      if (snapshot != null && snapshot.anchorMessageId === userMsgId) {
+        const finalized: ContextSnapshot = {
+          ...snapshot,
+          anchorMessageId: responseId ?? snapshot.anchorMessageId,
+          ...(liveAtFinalize > 0 && { completedOutputTokens: liveAtFinalize }),
+        };
+        jotai.set(snapshotAtom, finalized);
+        /** Retain this generation's breakdown keyed by the branch-unique
+         *  response id so a later run on a sibling branch (which overwrites the
+         *  live snapshot) doesn't strip this branch's granular rows. */
+        if (responseId != null) {
+          const historyAtom = snapshotsByAnchorFamily(realId);
+          const next = new Map(jotai.get(historyAtom));
+          next.set(responseId, finalized);
+          jotai.set(historyAtom, next);
+        }
+      }
+
+      streamCharsRef.current = 0;
+      confirmedRef.current = 0;
+      setLive(realId, 0);
+    };
+
+    return {
+      contextHandler,
+      usageHandler,
+      tapStream,
+      tapContent,
+      finalizeUsage,
+      resetLive,
+      attributePending,
+      backfillUsage,
+      seedLive,
+    };
+  }, []);
+}
diff --git a/client/src/hooks/Sharing/useCanSharePublic.ts b/client/src/hooks/Sharing/useCanSharePublic.ts
index e93a3dcc82c..521dd1ef4e7 100644
--- a/client/src/hooks/Sharing/useCanSharePublic.ts
+++ b/client/src/hooks/Sharing/useCanSharePublic.ts
@@ -7,6 +7,7 @@ const resourceToPermissionMap: Partial<Record<ResourceType, PermissionTypes>> =
   [ResourceType.MCPSERVER]: PermissionTypes.MCP_SERVERS,
   [ResourceType.REMOTE_AGENT]: PermissionTypes.REMOTE_AGENTS,
   [ResourceType.SKILL]: PermissionTypes.SKILLS,
+  [ResourceType.SHARED_LINK]: PermissionTypes.SHARED_LINKS,
 };
 
 /**
@@ -17,7 +18,7 @@ const resourceToPermissionMap: Partial<Record<ResourceType, PermissionTypes>> =
 export const useCanSharePublic = (resourceType: ResourceType): boolean => {
   const permissionType = resourceToPermissionMap[resourceType];
   const hasAccess = useHasAccess({
-    permissionType,
+    permissionType: permissionType as PermissionTypes,
     permission: Permissions.SHARE_PUBLIC,
   });
   return hasAccess;
diff --git a/client/src/hooks/useLocalize.ts b/client/src/hooks/useLocalize.ts
index f87ee5932b5..4e2384f6c01 100644
--- a/client/src/hooks/useLocalize.ts
+++ b/client/src/hooks/useLocalize.ts
@@ -1,21 +1,12 @@
-import { useCallback, useEffect } from 'react';
+import { useCallback } from 'react';
 import { TOptions } from 'i18next';
-import { useRecoilValue } from 'recoil';
 import { useTranslation } from 'react-i18next';
-import { resources } from '~/locales/i18n';
-import store from '~/store';
+import translationEn from '~/locales/en/translation.json';
 
-export type TranslationKeys = keyof typeof resources.en.translation;
+export type TranslationKeys = keyof typeof translationEn;
 
 export default function useLocalize() {
-  const lang = useRecoilValue(store.lang);
-  const { t, i18n } = useTranslation();
-
-  useEffect(() => {
-    if (i18n.language !== lang) {
-      i18n.changeLanguage(lang);
-    }
-  }, [lang, i18n]);
+  const { t } = useTranslation();
 
   return useCallback(
     (phraseKey: TranslationKeys, options?: TOptions) => t(phraseKey, options),
diff --git a/client/src/hooks/useNewConvo.ts b/client/src/hooks/useNewConvo.ts
index 0c5d6dd6db2..fb34897a228 100644
--- a/client/src/hooks/useNewConvo.ts
+++ b/client/src/hooks/useNewConvo.ts
@@ -30,10 +30,12 @@ import {
   getDefaultModelSpec,
   getDefaultEndpoint,
   getModelSpecPreset,
+  hasModelSelection,
   buildDefaultConvo,
   logger,
 } from '~/utils';
 import { useDeleteFilesMutation, useGetEndpointsQuery, useGetStartupConfig } from '~/data-provider';
+import useGetConversation from './Conversations/useGetConversation';
 import useAssistantListMap from './Assistants/useAssistantListMap';
 import { useResetChatBadges } from './useChatBadges';
 import { useApplyModelSpecEffects } from './Agents';
@@ -45,6 +47,7 @@ const useNewConvo = (index = 0) => {
   const navigate = useNavigate();
   const [searchParams] = useSearchParams();
   const { data: startupConfig } = useGetStartupConfig();
+  const getConversation = useGetConversation(index);
   const applyModelSpecEffects = useApplyModelSpecEffects();
   const clearAllConversations = store.useClearConvoState();
   const defaultPreset = useRecoilValue(store.defaultPreset);
@@ -88,6 +91,11 @@ const useNewConvo = (index = 0) => {
         const modelsConfig = modelsData ?? modelsQuery.data;
         const { endpoint = null } = conversation;
         const buildDefaultConversation = (endpoint === null || buildDefault) ?? false;
+        const hasExplicitChatProjectId = Object.prototype.hasOwnProperty.call(
+          conversation,
+          'chatProjectId',
+        );
+        const explicitChatProjectId = conversation.chatProjectId;
         const activePreset =
           // use default preset only when it's defined,
           // preset is not provided,
@@ -198,6 +206,12 @@ const useNewConvo = (index = 0) => {
             models,
             defaultParamsEndpoint,
           });
+
+          if (hasExplicitChatProjectId) {
+            conversation.chatProjectId = explicitChatProjectId ?? null;
+          } else {
+            delete conversation.chatProjectId;
+          }
         }
 
         if (disableParams === true) {
@@ -227,26 +241,44 @@ const useNewConvo = (index = 0) => {
           return;
         }
 
-        const searchParamsString = searchParams?.toString();
-        const getParams = () => (searchParamsString ? `?${searchParamsString}` : '');
+        const getParams = (nextConversation: TConversation) => {
+          const nextParams = new URLSearchParams(searchParams);
+          nextParams.delete('projectId');
+          if (
+            nextConversation.conversationId === Constants.NEW_CONVO &&
+            nextConversation.chatProjectId
+          ) {
+            nextParams.set('projectId', nextConversation.chatProjectId);
+          }
+
+          const searchParamsString = nextParams.toString();
+          return searchParamsString ? `?${searchParamsString}` : '';
+        };
 
         if (conversation.conversationId === Constants.NEW_CONVO && !modelsData) {
           const appTitle = localStorage.getItem(LocalStorageKeys.APP_TITLE) ?? '';
           if (appTitle) {
             document.title = appTitle;
           }
-          const path = `/c/${Constants.NEW_CONVO}${getParams()}`;
+          const path = `/c/${Constants.NEW_CONVO}${getParams(conversation)}`;
           navigate(path, { state: { focusChat: true } });
           return;
         }
 
-        const path = `/c/${conversation.conversationId}${getParams()}`;
+        const path = `/c/${conversation.conversationId}${getParams(conversation)}`;
         navigate(path, {
           replace: true,
           state: disableFocus ? {} : { focusChat: true },
         });
       },
-    [endpointsConfig, defaultPreset, assistantsListMap, modelsQuery.data, hasAgentAccess],
+    [
+      endpointsConfig,
+      defaultPreset,
+      assistantsListMap,
+      modelsQuery.data,
+      hasAgentAccess,
+      searchParams,
+    ],
   );
 
   const newConversation = useCallback(
@@ -278,7 +310,7 @@ const useNewConvo = (index = 0) => {
         isParamEndpoint(_preset?.endpoint ?? '', _preset?.endpointType ?? '');
       const template =
         paramEndpoint === true && templateConvoId && templateConvoId === Constants.NEW_CONVO
-          ? { endpoint: _template.endpoint }
+          ? { endpoint: _template.endpoint, chatProjectId: _template.chatProjectId }
           : _template;
 
       const conversation = {
@@ -291,23 +323,26 @@ const useNewConvo = (index = 0) => {
       };
 
       let preset = _preset;
-      const result = getDefaultModelSpec(startupConfig);
-      const defaultModelSpec = result?.default ?? result?.last;
-      if (
-        !preset &&
-        startupConfig &&
-        (startupConfig.modelSpecs?.prioritize === true ||
-          (startupConfig.interface?.modelSelect ?? true) !== true ||
-          (result?.last != null && Object.keys(_template).length === 0)) &&
-        defaultModelSpec
-      ) {
+      const result = getDefaultModelSpec(startupConfig, endpointsConfig);
+      const defaultModelSpec = result?.default ?? result?.last ?? result?.softDefault;
+      const shouldApplyModelSpec =
+        result?.softDefault != null
+          ? !hasModelSelection(_template)
+          : startupConfig?.modelSpecs?.prioritize === true ||
+            (startupConfig?.interface?.modelSelect ?? true) !== true ||
+            (result?.last != null &&
+              Object.keys(_template).filter((key) => key !== 'chatProjectId').length === 0);
+      if (!preset && startupConfig && shouldApplyModelSpec && defaultModelSpec) {
         preset = getModelSpecPreset(defaultModelSpec);
       }
 
+      const prevConversation = getConversation();
       applyModelSpecEffects({
         startupConfig,
         specName: preset?.spec,
         convoId: conversation.conversationId,
+        prevConvoId: prevConversation?.conversationId,
+        prevSpecName: prevConversation?.spec,
       });
 
       if (conversation.conversationId === Constants.NEW_CONVO && !modelsData) {
@@ -353,6 +388,8 @@ const useNewConvo = (index = 0) => {
       resetBadges,
       startupConfig,
       saveBadgesState,
+      endpointsConfig,
+      getConversation,
       pauseGlobalAudio,
       switchToConversation,
       applyModelSpecEffects,
diff --git a/client/src/hooks/useTimeTick.ts b/client/src/hooks/useTimeTick.ts
new file mode 100644
index 00000000000..1528ffe83ec
--- /dev/null
+++ b/client/src/hooks/useTimeTick.ts
@@ -0,0 +1,33 @@
+import { useSyncExternalStore } from 'react';
+
+const listeners = new Set<() => void>();
+let tick = 0;
+let intervalId: ReturnType<typeof setInterval> | null = null;
+
+const subscribe = (onStoreChange: () => void): (() => void) => {
+  listeners.add(onStoreChange);
+  if (intervalId === null) {
+    intervalId = setInterval(() => {
+      tick += 1;
+      listeners.forEach((listener) => listener());
+    }, 60_000);
+  }
+  return () => {
+    listeners.delete(onStoreChange);
+    if (listeners.size === 0 && intervalId !== null) {
+      clearInterval(intervalId);
+      intervalId = null;
+    }
+  };
+};
+
+const getSnapshot = (): number => tick;
+
+/**
+ * Subscribes to a shared, ref-counted ticker that fires once a minute, so components
+ * displaying relative time stay current while a view is left open. A single interval
+ * is shared across all subscribers and is cleared when the last one unsubscribes.
+ */
+export default function useTimeTick(): number {
+  return useSyncExternalStore(subscribe, getSnapshot, getSnapshot);
+}
diff --git a/client/src/lib/rum/useRum.spec.tsx b/client/src/lib/rum/useRum.spec.tsx
index 6386a55aead..431c20829ef 100644
--- a/client/src/lib/rum/useRum.spec.tsx
+++ b/client/src/lib/rum/useRum.spec.tsx
@@ -105,8 +105,11 @@ describe('useRum', () => {
   });
 
   it('initializes proxy RUM with the LibreChat bearer token for same-origin ingest', async () => {
-    const fetchMock = jest.fn(() => Promise.resolve({}));
-    window.fetch = fetchMock;
+    const fetchMock = jest.fn(
+      (_input: RequestInfo | URL, _init?: RequestInit): Promise<Response> =>
+        Promise.resolve({ ok: true, status: 200 } as Response),
+    );
+    window.fetch = Object.assign(fetchMock, { preconnect: () => undefined });
     mockUseGetStartupConfig.mockReturnValue({
       data: {
         rum: {
diff --git a/client/src/lib/rum/useRum.ts b/client/src/lib/rum/useRum.ts
index d3d0627fc88..937e809d13a 100644
--- a/client/src/lib/rum/useRum.ts
+++ b/client/src/lib/rum/useRum.ts
@@ -76,7 +76,7 @@ function ensureRumProxyAuth(proxyUrl: string): void {
   }
 
   const originalFetch = window.fetch.bind(window);
-  window.fetch = (input: RequestInfo | URL, init?: RequestInit) => {
+  const patchedFetch = (input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
     if (rumProxyToken && isRumProxyRequest(input, proxyUrl)) {
       const [authorizedInput, authorizedInit] = withAuthorization(input, init, rumProxyToken);
       return originalFetch(authorizedInput, authorizedInit);
@@ -84,6 +84,7 @@ function ensureRumProxyAuth(proxyUrl: string): void {
 
     return originalFetch(input, init);
   };
+  window.fetch = Object.assign(patchedFetch, { preconnect: window.fetch.preconnect });
   rumProxyFetchPatched = true;
 }
 
diff --git a/client/src/locales/Translation.spec.ts b/client/src/locales/Translation.spec.ts
index 6c6e1b7ac83..994edf41662 100644
--- a/client/src/locales/Translation.spec.ts
+++ b/client/src/locales/Translation.spec.ts
@@ -1,48 +1,193 @@
-import i18n from './i18n';
+import type { TranslationResource } from './i18n';
+import {
+  __resetLocaleForTests,
+  __setLocaleLoaderForTests,
+  changeLanguageSafely,
+  ensureLocale,
+  initializeI18n,
+  normalizeLocale,
+} from './i18n';
 import English from './en/translation.json';
-import French from './fr/translation.json';
 import Spanish from './es/translation.json';
+import French from './fr/translation.json';
 import { TranslationKeys } from '~/hooks';
+import i18n from './i18n';
+
+function deferred<T>() {
+  let resolve!: (value: T) => void;
+  let reject!: (reason?: unknown) => void;
+  const promise = new Promise<T>((promiseResolve, promiseReject) => {
+    resolve = promiseResolve;
+    reject = promiseReject;
+  });
+
+  return { promise, resolve, reject };
+}
 
 describe('i18next translation tests', () => {
   // Ensure i18next is initialized before any tests run
   beforeAll(async () => {
-    if (!i18n.isInitialized) {
-      await i18n.init();
-    }
+    await initializeI18n();
   });
 
-  it('should return the correct translation for a valid key in English', () => {
-    i18n.changeLanguage('en');
+  afterEach(async () => {
+    await changeLanguageSafely('en');
+  });
+
+  it('should return the correct translation for a valid key in English', async () => {
+    await changeLanguageSafely('en');
     expect(i18n.t('com_ui_examples')).toBe(English.com_ui_examples);
   });
 
-  it('should return the correct translation for a valid key in French', () => {
-    i18n.changeLanguage('fr');
+  it('should return the correct translation for a valid key in French', async () => {
+    await changeLanguageSafely('fr');
     expect(i18n.t('com_ui_examples')).toBe(French.com_ui_examples);
   });
 
-  it('should return the correct translation for a valid key in Spanish', () => {
-    i18n.changeLanguage('es');
+  it('should return the correct translation for a valid key in Spanish', async () => {
+    await changeLanguageSafely('es');
     expect(i18n.t('com_ui_examples')).toBe(Spanish.com_ui_examples);
   });
 
-  it('should fallback to English for an invalid language code', () => {
+  it('should fallback to English for an invalid language code', async () => {
     // When an invalid language is provided, i18next should fallback to English
-    i18n.changeLanguage('invalid-code');
+    await changeLanguageSafely('invalid-code');
     expect(i18n.t('com_ui_examples')).toBe(English.com_ui_examples);
   });
 
-  it('should return the key itself for an invalid key', () => {
-    i18n.changeLanguage('en');
+  it('should return the key itself for an invalid key', async () => {
+    await changeLanguageSafely('en');
     expect(i18n.t('invalid-key' as TranslationKeys)).toBe('invalid-key'); // Returns the key itself
   });
 
-  it('should correctly format placeholders in the translation', () => {
-    i18n.changeLanguage('en');
+  it('should correctly format placeholders in the translation', async () => {
+    await changeLanguageSafely('en');
     expect(i18n.t('com_endpoint_default_with_num', { 0: 'John' })).toBe('default: John');
 
-    i18n.changeLanguage('fr');
+    await changeLanguageSafely('fr');
     expect(i18n.t('com_endpoint_default_with_num', { 0: 'Marie' })).toBe('par défaut : Marie');
   });
+
+  it('should normalize language selector values to locale files', () => {
+    expect(normalizeLocale('en-US')).toBe('en');
+    expect(normalizeLocale('de-DE')).toBe('de');
+    expect(normalizeLocale('fr-FR')).toBe('fr');
+    expect(normalizeLocale('ar-EG')).toBe('ar');
+    expect(normalizeLocale('he-IL')).toBe('he');
+    expect(normalizeLocale('nl-NL')).toBe('nl');
+    expect(normalizeLocale('pl-PL')).toBe('pl');
+    expect(normalizeLocale('uk-UA')).toBe('uk');
+    expect(normalizeLocale('zh-Hans')).toBe('zh-Hans');
+    expect(normalizeLocale('zh-Hant')).toBe('zh-Hant');
+    expect(normalizeLocale('pt-BR')).toBe('pt-BR');
+    expect(normalizeLocale('pt-PT')).toBe('pt-PT');
+  });
+
+  it('should reuse an in-flight locale load', async () => {
+    __resetLocaleForTests('sv');
+    const pendingLocale = deferred<{ default: TranslationResource }>();
+    const loadLocale = jest.fn(() => pendingLocale.promise);
+    const restoreLoader = __setLocaleLoaderForTests('sv', loadLocale);
+
+    const firstLoad = ensureLocale('sv-SE');
+    const secondLoad = ensureLocale('sv-SE');
+
+    expect(loadLocale).toHaveBeenCalledTimes(1);
+
+    pendingLocale.resolve({ default: { com_ui_examples: 'svenska exempel' } });
+
+    await expect(Promise.all([firstLoad, secondLoad])).resolves.toEqual(['sv', 'sv']);
+    expect(i18n.getResource('sv', 'translation', 'com_ui_examples')).toBe('svenska exempel');
+
+    restoreLoader();
+    __resetLocaleForTests('sv');
+  });
+
+  it('should retry a locale load after a transient failure', async () => {
+    __resetLocaleForTests('ka');
+    const consoleErrorSpy = jest.spyOn(console, 'error').mockImplementation(() => undefined);
+    let callCount = 0;
+    const restoreLoader = __setLocaleLoaderForTests('ka', async () => {
+      callCount += 1;
+      if (callCount === 1) {
+        throw new Error('temporary chunk failure');
+      }
+
+      return { default: { com_ui_examples: 'ქართული მაგალითები' } };
+    });
+
+    await expect(ensureLocale('ka-GE')).resolves.toBe('en');
+    await expect(ensureLocale('ka-GE')).resolves.toBe('ka');
+
+    expect(callCount).toBe(2);
+    expect(i18n.getResource('ka', 'translation', 'com_ui_examples')).toBe('ქართული მაგალითები');
+
+    restoreLoader();
+    __resetLocaleForTests('ka');
+    consoleErrorSpy.mockRestore();
+  });
+
+  it('should only apply the newest rapid language switch', async () => {
+    __resetLocaleForTests('sv');
+    __resetLocaleForTests('ka');
+    __resetLocaleForTests('sl');
+
+    const svLocale = deferred<{ default: TranslationResource }>();
+    const kaLocale = deferred<{ default: TranslationResource }>();
+    const slLocale = deferred<{ default: TranslationResource }>();
+    const restoreSv = __setLocaleLoaderForTests('sv', () => svLocale.promise);
+    const restoreKa = __setLocaleLoaderForTests('ka', () => kaLocale.promise);
+    const restoreSl = __setLocaleLoaderForTests('sl', () => slLocale.promise);
+
+    const firstSwitch = changeLanguageSafely('sv-SE');
+    const secondSwitch = changeLanguageSafely('ka-GE');
+    const latestSwitch = changeLanguageSafely('sl');
+
+    svLocale.resolve({ default: { com_ui_examples: 'svenska exempel' } });
+    await firstSwitch;
+    expect(i18n.language).not.toBe('sv');
+
+    kaLocale.resolve({ default: { com_ui_examples: 'ქართული მაგალითები' } });
+    await secondSwitch;
+    expect(i18n.language).not.toBe('ka');
+
+    slLocale.resolve({ default: { com_ui_examples: 'slovenski primeri' } });
+    await expect(latestSwitch).resolves.toBe('sl');
+    expect(i18n.language).toBe('sl');
+    expect(document.documentElement.lang).toBe('sl');
+
+    restoreSv();
+    restoreKa();
+    restoreSl();
+    __resetLocaleForTests('sv');
+    __resetLocaleForTests('ka');
+    __resetLocaleForTests('sl');
+  });
+
+  it('should restore the newest language if an older change finishes late', async () => {
+    __resetLocaleForTests('sv');
+    __resetLocaleForTests('sl');
+
+    const svLocale = deferred<{ default: TranslationResource }>();
+    const slLocale = deferred<{ default: TranslationResource }>();
+    const restoreSv = __setLocaleLoaderForTests('sv', () => svLocale.promise);
+    const restoreSl = __setLocaleLoaderForTests('sl', () => slLocale.promise);
+
+    const firstSwitch = changeLanguageSafely('sv-SE');
+    const latestSwitch = changeLanguageSafely('sl');
+
+    slLocale.resolve({ default: { com_ui_examples: 'slovenski primeri' } });
+    await expect(latestSwitch).resolves.toBe('sl');
+    expect(i18n.language).toBe('sl');
+
+    svLocale.resolve({ default: { com_ui_examples: 'svenska exempel' } });
+    await firstSwitch;
+    expect(i18n.language).toBe('sl');
+    expect(document.documentElement.lang).toBe('sl');
+
+    restoreSv();
+    restoreSl();
+    __resetLocaleForTests('sv');
+    __resetLocaleForTests('sl');
+  });
 });
diff --git a/client/src/locales/ar/translation.json b/client/src/locales/ar/translation.json
index fe9ff280f34..9d95bc81b0a 100644
--- a/client/src/locales/ar/translation.json
+++ b/client/src/locales/ar/translation.json
@@ -264,9 +264,8 @@
   "com_nav_balance_day": "يوم",
   "com_nav_balance_days": "أيام",
   "com_nav_balance_every": "كل",
-  "com_nav_balance_hour": "ساع",
   "com_nav_balance_hours": "ساعات",
-  "com_nav_balance_interval": "الفترة",
+  "com_nav_balance_interval": "المدة",
   "com_nav_balance_minute": "دقيقة",
   "com_nav_balance_minutes": "دقائق",
   "com_nav_balance_month": "شهر",
diff --git a/client/src/locales/cs/translation.json b/client/src/locales/cs/translation.json
index b8ccb07d85c..d9698375e70 100644
--- a/client/src/locales/cs/translation.json
+++ b/client/src/locales/cs/translation.json
@@ -12,6 +12,7 @@
   "com_agents_instructions_placeholder": "Systémové instrukce, které agent používá",
   "com_agents_link_copied": "Odkaz zkopírován",
   "com_agents_link_copy_failed": "Kopírování odkazu se nezdařilo",
+  "com_agents_marketplace": "Tržiště agentů",
   "com_agents_missing_provider_model": "Před vytvořením agenta vyberte poskytovatele a model.",
   "com_agents_name_placeholder": "Volitelné: Název agenta",
   "com_agents_no_access": "Nemáte oprávnění upravovat tohoto agenta.",
@@ -548,6 +549,7 @@
   "com_ui_locked": "Zamčeno",
   "com_ui_logo": "Logo {{0}}",
   "com_ui_manage": "Spravovat",
+  "com_ui_marketplace": "Tržiště",
   "com_ui_max_tags": "Maximální povolený počet je {{0}}, používám nejnovější hodnoty.",
   "com_ui_mention": "Zmiňte koncový bod, asistenta nebo předvolbu pro rychlé přepnutí",
   "com_ui_min_tags": "Nelze odebrat další hodnoty, minimální počet je {{0}}.",
diff --git a/client/src/locales/de/translation.json b/client/src/locales/de/translation.json
index 100a9b1a597..e19999abf2c 100644
--- a/client/src/locales/de/translation.json
+++ b/client/src/locales/de/translation.json
@@ -2,6 +2,7 @@
   "chat_direction_left_to_right": "Links nach Rechts",
   "chat_direction_right_to_left": "Rechts nach Links",
   "com_a11y_ai_composing": "Die KI erstellt noch ihre Antwort.\n",
+  "com_a11y_chats_date_section": "Chats vom {{date}}",
   "com_a11y_end": "Die KI hat die Antwort fertiggestellt.",
   "com_a11y_selected": "ausgewählt",
   "com_a11y_start": "Die KI hat mit ihrer Antwort begonnen. ",
@@ -393,9 +394,13 @@
   "com_hide_examples": "Beispiele ausblenden",
   "com_info_heic_converting": "HEIC-Bild wird in JPEG konventiert...",
   "com_nav_2fa": "Zwei-Faktor-Authentifizierung (2FA)",
+  "com_nav_about_commit": "Commit",
+  "com_nav_about_diagnostics_copied": "In die Ablage kopiert",
+  "com_nav_about_diagnostics_description": "Diesen Abschnitt kopieren, damit Maintainer den konkreten Build identifizieren können",
+  "com_nav_about_diagnostics_heading": "Diagnose",
   "com_nav_account_settings": "Kontoeinstellungen",
   "com_nav_advanced_prompts": "Erweiterter Prompt-Editor",
-  "com_nav_always_make_prod": "Neue Versionen direkt produktiv nehmen",
+  "com_nav_always_make_prod": "Übernehme neue Prompt Versionen immer auf Produktiv",
   "com_nav_archive_created_at": "Archivierungsdatum",
   "com_nav_archive_name": "Name",
   "com_nav_archived_chats": "Archivierte Chats",
@@ -404,7 +409,7 @@
   "com_nav_audio_play_error": "Fehler beim Abspielen des Audios: {{0}}",
   "com_nav_audio_process_error": "Fehler bei der Verarbeitung des Audios: {{0}}",
   "com_nav_auto_scroll": "Automatisch zur neuesten Nachricht scrollen, wenn der Chat geöffnet wird",
-  "com_nav_auto_send_prompts": "Prompts automatisch senden",
+  "com_nav_auto_send_prompts": "Prompts beim Auswählen automatisch senden",
   "com_nav_auto_send_text": "Text automatisch senden",
   "com_nav_auto_transcribe_audio": "Audio automatisch transkribieren",
   "com_nav_automatic_playback": "Automatische Wiedergabe der neuesten Nachricht",
@@ -817,6 +822,7 @@
   "com_ui_clear_presets": "Voreinstellungen löschen",
   "com_ui_clear_search": "Suche löschen",
   "com_ui_click_to_close": "Zum Schließen klicken",
+  "com_ui_click_to_edit": "Klicken zum Bearbeiten",
   "com_ui_click_to_view_var": "Klicken, um {{0}} anzusehen",
   "com_ui_client_id": "Client-ID",
   "com_ui_client_secret": "Client Secret",
@@ -860,6 +866,7 @@
   "com_ui_copied_to_clipboard": "In die Zwischenablage kopiert",
   "com_ui_copy": "Kopieren",
   "com_ui_copy_code": "Code kopieren",
+  "com_ui_copy_failed": "Kopieren in die Zwischenablage fehlgeschlagen",
   "com_ui_copy_link": "Link kopieren",
   "com_ui_copy_stack_trace": "Stack-Trace kopieren",
   "com_ui_copy_thoughts_to_clipboard": "Gedanken in die Zwischenablage kopieren",
@@ -876,6 +883,7 @@
   "com_ui_create_prompt_page": "Neue Prompt-Konfigurationsseite",
   "com_ui_create_skill": "Skill erstellen",
   "com_ui_create_skill_upload": "SKILL.md hochladen",
+  "com_ui_create_skill_upload_error": "Die hochgeladene Datei konnte nicht gelesen werden",
   "com_ui_created": "Erstellt",
   "com_ui_creating": "Wird erstellt...",
   "com_ui_creating_image": "Bild wird erstellt. Kann einen Moment dauern",
@@ -1273,6 +1281,7 @@
   "com_ui_privacy_policy_url": "Datenschutzrichtlinie-URL",
   "com_ui_prompt": "Prompt",
   "com_ui_prompt_delete_error": "Beim Löschen des Prompts ist ein Fehler aufgetreten",
+  "com_ui_prompt_deleted_group": "Prompt-Gruppe \"{{0}}\" gelöscht",
   "com_ui_prompt_group_button": "{{name}}-Prompt, Kategorie {{category}}",
   "com_ui_prompt_group_button_no_category": "{{name}}-Prompt",
   "com_ui_prompt_groups": "Prompt-Gruppenliste",
@@ -1376,6 +1385,8 @@
   "com_ui_search_agent_category": "Kategorien suchen...",
   "com_ui_search_default_placeholder": "Suche nach Name oder E-Mail (min. 2 Zeichen)",
   "com_ui_search_people_placeholder": "Suche nach Personen oder Gruppen per Name oder E-Mail",
+  "com_ui_search_skills": "Skills suchen...",
+  "com_ui_searching_files": "Durchsuche deine Dateien...",
   "com_ui_seconds": "Sekunden",
   "com_ui_secret_key": "Geheimschlüssel",
   "com_ui_select": "Auswählen",
@@ -1431,6 +1442,7 @@
   "com_ui_skill_new_folder": "Neuer Ordner",
   "com_ui_skill_no_selection": "Skill wählen",
   "com_ui_skill_not_found": "Skill nicht gefunden",
+  "com_ui_skill_role_viewer_desc": "Kann die Ansicht ansehen und nutzen aber nicht bearbeiten",
   "com_ui_skill_running": "Läuft {{0}}",
   "com_ui_skill_sr_public": "Öffentlicher Skill",
   "com_ui_skill_update_error": "Speichern des Skills fehlgeschlagen",
@@ -1439,6 +1451,7 @@
   "com_ui_skill_upload_file": "Datei hochladen",
   "com_ui_skill_upload_req_size": "Dateigröße darf {{0}} MB nicht überschreiten.",
   "com_ui_skill_upload_req_zip": ".zip- oder .skill-Dateien müssen eine SKILL.md-Datei beinhalten",
+  "com_ui_skill_upload_requirements": "Dateianforderungen",
   "com_ui_skill_upload_title": "Skill hochladen",
   "com_ui_skill_version": "v{{0}}",
   "com_ui_skill_view_source": "Quelle ansehen",
@@ -1449,16 +1462,18 @@
   "com_ui_skills_allow_use": "Erlaube das Benutzen von Skills",
   "com_ui_skills_empty": "Noch keine Skills",
   "com_ui_skills_enable_toggle": "Aktiviere Skills für diesen Agenten",
+  "com_ui_skills_load_error": "Fehler beim Laden der Skills",
   "com_ui_special": "Spezial",
   "com_ui_special_var_current_date": "Aktuelles Datum",
   "com_ui_special_var_current_datetime": "Aktuelles Datum & Uhrzeit",
   "com_ui_special_var_current_user": "Aktueller Nutzer",
   "com_ui_special_var_desc_current_date": "Das heutige Datum und der Wochentag",
+  "com_ui_special_var_desc_current_datetime": "Lokales Datum und Uhrzeit in deiner Zeitzone",
   "com_ui_special_var_desc_current_user": "Dein Anzeigename",
   "com_ui_special_var_desc_iso_datetime": "UTC-Zeitangabe im ISO 8601-Format",
   "com_ui_special_var_iso_datetime": "UTC ISO Datum/Zeit",
   "com_ui_special_variable_added": "Spezialvariable {{0}} hinzugefügt.",
-  "com_ui_special_variables": "Spezielle Variablen:",
+  "com_ui_special_variables": "Besonder Variablen:",
   "com_ui_speech_not_supported": "Ihr Browser unterstützt keine Spracherkennung",
   "com_ui_speech_not_supported_use_external": "Dein Browser unterstützt keine Spracherkennung. Versuche in den Einstellungen unter „Sprache“ zu „Externes STT“ zu wechseln.",
   "com_ui_speech_while_submitting": "Spracheingabe nicht möglich während eine Antwort generiert wird",
@@ -1472,9 +1487,14 @@
   "com_ui_subagent_cancelled": "Agent abgebrochen",
   "com_ui_subagent_complete": "Agent gestartet",
   "com_ui_subagent_dialog_title_self": "Agent",
+  "com_ui_subagent_empty_result": "Keine Antwort erhalten.",
+  "com_ui_subagent_errored": "Agent-Fehler aufgetreten",
   "com_ui_subagent_no_result_yet": "Läuft noch - bisher kein Endergebnis.",
   "com_ui_subagent_running": "Agent arbeitet",
+  "com_ui_subagent_scroll_to_bottom": "Scrolle zum Neuesten",
   "com_ui_subagent_ticker_error": "Fehler",
+  "com_ui_subagent_ticker_reasoning": "Nachdenken",
+  "com_ui_subagent_ticker_tool_done": "Fertig",
   "com_ui_subagent_ticker_using": "Nutze",
   "com_ui_subagent_ticker_writing": "Schreibe",
   "com_ui_submit": "Absenden",
@@ -1508,6 +1528,7 @@
   "com_ui_tool_name_file_search": "Dateisuche",
   "com_ui_tool_name_image_edit": "Bild bearbeiten",
   "com_ui_tool_name_image_gen": "Bildgenerierung",
+  "com_ui_tool_name_web_search": "Web-Suche",
   "com_ui_tools": "Werkzeuge",
   "com_ui_tools_and_actions": "Werkzeuge und Aktionen",
   "com_ui_transferred_to": "Übergeben an",
@@ -1577,6 +1598,7 @@
   "com_ui_web_search_provider_serper": "Serper API\n",
   "com_ui_web_search_provider_serper_key": "Einen Serper API Schlüssel holen",
   "com_ui_web_search_provider_tavily": "Tavily API",
+  "com_ui_web_search_provider_tavily_key": "Hole dir deinen Tavily API-Schlüssel",
   "com_ui_web_search_reading": "Lesen der Suchergebnisse",
   "com_ui_web_search_reranker": "Reranker",
   "com_ui_web_search_reranker_cohere": "Cohere",
@@ -1589,6 +1611,7 @@
   "com_ui_web_search_scraper_firecrawl_key": "Einen Firecrawl API Schlüssel holen",
   "com_ui_web_search_scraper_serper": "Serper Scrape API",
   "com_ui_web_search_scraper_serper_key": "Hole einen Serper API Schlüssel",
+  "com_ui_web_search_scraper_tavily_key": "Hole dir deinen Tavily API-Schlüssel",
   "com_ui_web_search_searxng_api_key": "SearXNG API Key (optional) einfügen",
   "com_ui_web_search_searxng_instance_url": "SearXNG Instanz URL",
   "com_ui_web_search_source": "{{count}} Quelle",
@@ -1602,6 +1625,7 @@
   "com_ui_x_selected": "{{0}} ausgewählt",
   "com_ui_xhigh": "Extra hoch",
   "com_ui_yes": "Ja",
+  "com_ui_you": "Du",
   "com_ui_your_api_key": "Dein API Key",
   "com_ui_zoom": "Zoom",
   "com_ui_zoom_in": "Heranzoomen",
diff --git a/client/src/locales/en/translation.json b/client/src/locales/en/translation.json
index 3375ca82979..694619d9651 100644
--- a/client/src/locales/en/translation.json
+++ b/client/src/locales/en/translation.json
@@ -750,6 +750,7 @@
   "com_ui_agents_allow_share_public": "Allow sharing Agents publicly",
   "com_ui_agents_allow_use": "Allow using Agents",
   "com_ui_all": "all",
+  "com_ui_all_projects": "All projects",
   "com_ui_all_proper": "All",
   "com_ui_analyzing": "Analyzing",
   "com_ui_analyzing_finished": "Finished analyzing",
@@ -836,10 +837,13 @@
   "com_ui_branch_error": "Failed to create branch",
   "com_ui_branch_message": "Create branch from this response",
   "com_ui_by_author": "by {{0}}",
+  "com_ui_cache_read": "Cache read",
+  "com_ui_cache_write": "Cache write",
   "com_ui_callback_url": "Callback URL",
   "com_ui_cancel": "Cancel",
   "com_ui_cancelled": "Cancelled",
   "com_ui_category": "Category",
+  "com_ui_change_project": "Change project",
   "com_ui_change_version": "Change Version",
   "com_ui_chat": "Chat",
   "com_ui_chat_history": "Chat History",
@@ -880,7 +884,27 @@
   "com_ui_connecting": "Connecting",
   "com_ui_contact_admin_if_issue_persists": "Contact the Admin if the issue persists",
   "com_ui_context": "Context",
+  "com_ui_context_cost": "Cost",
+  "com_ui_context_cost_branch": "Cost (this branch)",
+  "com_ui_context_cost_total": "All branches",
   "com_ui_context_filter_sort": "Filter and Sort by Context",
+  "com_ui_context_free": "Free space",
+  "com_ui_context_messages": "Messages",
+  "com_ui_context_subagents": "Subagents",
+  "com_ui_context_summary": "Summary",
+  "com_ui_context_system": "System prompt",
+  "com_ui_context_tools": "Tool schemas",
+  "com_ui_context_tools_mcp": "MCP tools",
+  "com_ui_context_tools_mcp_deferred": "MCP tools (deferred)",
+  "com_ui_context_tools_system": "System tools",
+  "com_ui_context_tools_system_deferred": "System tools (deferred)",
+  "com_ui_context_unknown": "Context size unknown",
+  "com_ui_context_usage": "Context usage",
+  "com_ui_context_usage_label": "Context window: {{0}} of {{1}} tokens used ({{2}}%)",
+  "com_ui_context_usage_label_unknown": "Context usage: {{0}} tokens used",
+  "com_ui_context_usage_snapshot": "Context {{0}} / {{1}} ({{2}}%)",
+  "com_ui_context_usage_snapshot_unknown": "Context {{0}}",
+  "com_ui_context_window": "Context window",
   "com_ui_continue": "Continue",
   "com_ui_continue_oauth": "Continue with OAuth",
   "com_ui_control_bar": "Control bar",
@@ -910,13 +934,16 @@
   "com_ui_create_mcp_server": "Create MCP server",
   "com_ui_create_memory": "Create Memory",
   "com_ui_create_new_agent": "Create New Agent",
+  "com_ui_create_project": "Create project",
   "com_ui_create_prompt": "Create Prompt",
   "com_ui_create_prompt_page": "New Prompt Configuration Page",
   "com_ui_create_skill": "Create Skill",
   "com_ui_create_skill_upload": "Upload SKILL.md",
   "com_ui_create_skill_upload_error": "Failed to read the uploaded file",
   "com_ui_created": "Created",
+  "com_ui_created_file": "Created {{0}}",
   "com_ui_creating": "Creating...",
+  "com_ui_creating_file": "Creating {{0}}",
   "com_ui_creating_image": "Creating image. May take a moment",
   "com_ui_current": "Current",
   "com_ui_currently_production": "Currently in production",
@@ -961,6 +988,8 @@
   "com_ui_delete_memory": "Delete Memory",
   "com_ui_delete_not_allowed": "Delete operation is not allowed",
   "com_ui_delete_preset": "Delete Preset?",
+  "com_ui_delete_project": "Delete project?",
+  "com_ui_delete_project_confirm": "Delete \"{{name}}\"? The chats inside won't be deleted.",
   "com_ui_delete_prompt": "Delete Prompt?",
   "com_ui_delete_shared_link": "Delete shared link?",
   "com_ui_delete_shared_link_heading": "Delete Shared Link",
@@ -1002,6 +1031,8 @@
   "com_ui_edit_prompt_page": "Edit Prompt Page",
   "com_ui_edit_skill": "Edit Skill",
   "com_ui_editable_message": "Editable Message",
+  "com_ui_edited_file": "Edited {{0}}",
+  "com_ui_editing_file": "Editing {{0}}",
   "com_ui_editor_instructions": "Drag the image to reposition • Use zoom slider or buttons to adjust size",
   "com_ui_empty_category": "-",
   "com_ui_endpoint": "Endpoint",
@@ -1020,6 +1051,7 @@
   "com_ui_error_try_following_prefix": "Please try one of the following",
   "com_ui_error_unexpected": "Oops! Something Unexpected Occurred",
   "com_ui_error_updating_preferences": "Error updating preferences",
+  "com_ui_estimated": "Estimated from message history",
   "com_ui_everyone_permission_level": "Everyone's permission level",
   "com_ui_examples": "Examples",
   "com_ui_expand": "Expand",
@@ -1054,6 +1086,7 @@
   "com_ui_file_token_limit": "File Token Limit",
   "com_ui_file_token_limit_desc": "Set maximum token limit for file processing to control costs and resource usage",
   "com_ui_files": "Files",
+  "com_ui_files_count_size": "{{0}} Files ({{1}}KB)",
   "com_ui_filter_mcp_servers": "Filter MCP servers by name",
   "com_ui_filter_prompts": "Filter Prompts",
   "com_ui_filter_prompts_name": "Filter prompts by name",
@@ -1140,6 +1173,7 @@
   "com_ui_last_used": "Last used",
   "com_ui_late_night": "Happy late night",
   "com_ui_latest": "latest",
+  "com_ui_latest_activity": "Latest activity",
   "com_ui_latest_footer": "Every AI for Everyone.",
   "com_ui_latest_version": "Latest version",
   "com_ui_leave_blank_to_keep": "Leave blank to keep existing",
@@ -1149,6 +1183,7 @@
   "com_ui_link_copied": "Link copied",
   "com_ui_link_refreshed": "Link refreshed",
   "com_ui_live": "live",
+  "com_ui_load_more": "Load more",
   "com_ui_loading": "Loading...",
   "com_ui_locked": "Locked",
   "com_ui_logo": "{{0}} Logo",
@@ -1250,7 +1285,9 @@
   "com_ui_model_parameters_reset": "Model Parameters have been reset.",
   "com_ui_model_selected": "{{0}} selected",
   "com_ui_model_spec": "Model Spec",
+  "com_ui_more_count": "{{0}} more",
   "com_ui_more_info": "More info",
+  "com_ui_more_options": "More options",
   "com_ui_my_prompts": "My Prompts",
   "com_ui_my_skills": "My Skills",
   "com_ui_n_files": "{{0}} files",
@@ -1259,7 +1296,9 @@
   "com_ui_navigate_results": "Navigate results",
   "com_ui_new": "New",
   "com_ui_new_chat": "New chat",
+  "com_ui_new_chat_in_project": "New chat in {{name}}",
   "com_ui_new_conversation_title": "New Conversation Title",
+  "com_ui_new_project": "New project",
   "com_ui_next": "Next",
   "com_ui_next_result": "Next result",
   "com_ui_no": "No",
@@ -1279,6 +1318,8 @@
   "com_ui_no_memories_match": "No memories match your search",
   "com_ui_no_memories_title": "No memories yet",
   "com_ui_no_personalization_available": "No personalization options are currently available",
+  "com_ui_no_project_chats": "No chats yet",
+  "com_ui_no_projects": "No projects yet",
   "com_ui_no_prompts_title": "No prompts yet",
   "com_ui_no_read_access": "You don't have permission to view memories",
   "com_ui_no_results_found": "No results found",
@@ -1307,6 +1348,7 @@
   "com_ui_omitted": "Omitted",
   "com_ui_on": "On",
   "com_ui_open_archived_chat_new_tab_title": "{{title}} (opens in new tab)",
+  "com_ui_open_project": "Open project",
   "com_ui_open_source_chat_new_tab": "Open Source Chat in New Tab",
   "com_ui_open_source_chat_new_tab_title": "Open Source Chat in New Tab - {{title}}",
   "com_ui_open_var": "Open {{0}}",
@@ -1337,6 +1379,17 @@
   "com_ui_privacy_policy": "Privacy policy",
   "com_ui_privacy_policy_url": "Privacy Policy URL",
   "com_ui_production": "Production",
+  "com_ui_project_chat_count": "{{count}} chats",
+  "com_ui_project_chat_count_single": "1 chat",
+  "com_ui_project_create_error": "Failed to create project",
+  "com_ui_project_delete_error": "Failed to delete project",
+  "com_ui_project_name": "Project name",
+  "com_ui_project_name_placeholder": "New project",
+  "com_ui_project_not_found": "Project not found",
+  "com_ui_project_rename_error": "Failed to rename project",
+  "com_ui_project_update_error": "Failed to update project assignment",
+  "com_ui_project_updated": "Project assignment updated",
+  "com_ui_projects": "Projects",
   "com_ui_prompt": "Prompt",
   "com_ui_prompt_category_selector_aria": "Prompt's category selector",
   "com_ui_prompt_delete_confirm": "Are you sure you want to delete the '{{0}}' prompt?",
@@ -1393,11 +1446,13 @@
   "com_ui_remote_agents_allow_share_public": "Allow users to grant API access to agents to all users",
   "com_ui_remote_agents_allow_use": "Allow users to create API keys and query agents remotely",
   "com_ui_remove_agent_from_chain": "Remove {{0}} from chain",
+  "com_ui_remove_from_project": "Remove from project",
   "com_ui_remove_skill_var": "Remove {{0}}",
   "com_ui_remove_user": "Remove {{0}}",
   "com_ui_rename": "Rename",
   "com_ui_rename_conversation": "Rename Conversation",
   "com_ui_rename_failed": "Failed to rename conversation",
+  "com_ui_rename_project": "Rename project",
   "com_ui_requires_auth": "Requires Authentication",
   "com_ui_reset": "Reset",
   "com_ui_reset_adjustments": "Reset adjustments",
@@ -1454,6 +1509,7 @@
   "com_ui_search_agent_category": "Search categories...",
   "com_ui_search_default_placeholder": "Search by name or email (min 2 chars)",
   "com_ui_search_people_placeholder": "Search for people or groups by name or email",
+  "com_ui_search_projects": "Search projects",
   "com_ui_search_result_count": "{{count}} result found",
   "com_ui_search_results_count": "{{count}} results found",
   "com_ui_search_skills": "Search skills...",
@@ -1467,6 +1523,7 @@
   "com_ui_select_model": "Select a model",
   "com_ui_select_options": "Select options...",
   "com_ui_select_or_create_prompt": "Select or Create a Prompt",
+  "com_ui_select_project": "Select project",
   "com_ui_select_provider": "Select a provider",
   "com_ui_select_provider_first": "Select a provider first",
   "com_ui_select_region": "Select a region",
@@ -1485,7 +1542,9 @@
   "com_ui_share_qr_code_description": "QR code for sharing this conversation link",
   "com_ui_share_update_message": "Your name, custom instructions, and any messages you add after sharing stay private.",
   "com_ui_share_var": "Share {{0}}",
+  "com_ui_shared_link": "shared link",
   "com_ui_shared_link_delete_success": "Successfully deleted shared link",
+  "com_ui_shared_link_manage_access": "Manage Access",
   "com_ui_shared_link_not_found": "Shared link not found",
   "com_ui_shared_prompts": "Shared Prompts",
   "com_ui_shop": "Shopping",
@@ -1539,6 +1598,7 @@
   "com_ui_skill_sr_public": "Public skill",
   "com_ui_skill_states_limit": "You've reached the limit of {{0}} active/inactive skill overrides. Remove some overrides to toggle new skills.",
   "com_ui_skill_toggle_active": "Toggle skill active state",
+  "com_ui_skill_unavailable": "Unavailable skill",
   "com_ui_skill_update_conflict": "Another edit was saved before yours. Reloading the latest version.",
   "com_ui_skill_update_error": "Failed to save skill",
   "com_ui_skill_updated": "Skill saved",
@@ -1572,6 +1632,11 @@
   "com_ui_skills_load_error": "Failed to load skills",
   "com_ui_skills_manual_invoked": "Manually invoked skills",
   "com_ui_skills_queued": "Skills queued for next submission",
+  "com_ui_sort_by": "Sort by",
+  "com_ui_sort_chats_by": "Sort chats by",
+  "com_ui_sort_created": "Created",
+  "com_ui_sort_projects_by": "Sort projects by",
+  "com_ui_sort_updated": "Updated",
   "com_ui_special": "special",
   "com_ui_special_var_current_date": "Current Date",
   "com_ui_special_var_current_datetime": "Current Date & Time",
@@ -1654,6 +1719,7 @@
   "com_ui_unarchive": "Unarchive",
   "com_ui_unarchive_conversation": "Unarchive conversation",
   "com_ui_unarchive_error": "Failed to unarchive conversation",
+  "com_ui_unassigned": "Unassigned",
   "com_ui_unavailable": "Unavailable",
   "com_ui_unfavorite": "Remove from favorites",
   "com_ui_unknown": "Unknown",
@@ -1663,6 +1729,7 @@
   "com_ui_untitled": "Untitled",
   "com_ui_update": "Update",
   "com_ui_update_mcp_server": "Update MCP server",
+  "com_ui_updated_file": "Updated {{0}}",
   "com_ui_updating": "Updating...",
   "com_ui_upload": "Upload",
   "com_ui_upload_agent_avatar": "Successfully updated agent avatar",
@@ -1743,6 +1810,7 @@
   "com_ui_yes": "Yes",
   "com_ui_you": "You",
   "com_ui_your_api_key": "Your API Key",
+  "com_ui_your_projects": "Your projects",
   "com_ui_zoom": "Zoom",
   "com_ui_zoom_in": "Zoom in",
   "com_ui_zoom_level": "Zoom level",
diff --git a/client/src/locales/es/translation.json b/client/src/locales/es/translation.json
index 2c45563b055..a66407f4739 100644
--- a/client/src/locales/es/translation.json
+++ b/client/src/locales/es/translation.json
@@ -1,14 +1,19 @@
 {
-  "chat_direction_left_to_right": "Izquierda a Derecha",
+  "chat_direction_left_to_right": "De izquierda a derecha",
   "chat_direction_right_to_left": "Derecha a Izquierda",
-  "com_a11y_ai_composing": "La IA está componiendo la respuesta ",
-  "com_a11y_end": "La IA ha finalizado su respuesta ",
-  "com_a11y_selected": "Seleccionado",
+  "com_a11y_ai_composing": "La IA está redactando una respuesta.",
+  "com_a11y_chats_date_section": "Chats del {{date}}",
+  "com_a11y_end": "La IA ha finalizado su respuesta",
+  "com_a11y_selected": "seleccionado",
   "com_a11y_start": "La IA ha comenzado su respuesta",
+  "com_a11y_summarize_completed": "Contexto resumido.",
+  "com_a11y_summarize_failed": "Error al resumir, continuando con el contexto disponible.",
+  "com_a11y_summarize_started": "Resumiendo contexto.",
   "com_agents_agent_card_label": "{{name}} agente. {{description}}",
-  "com_agents_all": "Todos los agentes",
+  "com_agents_all": "Todos los Agentes",
   "com_agents_all_category": "Todos",
   "com_agents_all_description": "Explora todos los agentes compartidos en todas las categorías",
+  "com_agents_avatar_upload_error": "Error al subir el avatar del agente",
   "com_agents_category_aftersales": "Posventa",
   "com_agents_category_aftersales_description": "Agentes especializados en soporte postventa, mantenimiento y atención al cliente",
   "com_agents_category_empty": "No se encontraron agentes en la categoría {{category}}",
@@ -23,11 +28,11 @@
   "com_agents_category_rd": "Investigación y desarrollo",
   "com_agents_category_rd_description": "Agentes centrados en procesos de I+D, innovación e investigación técnica",
   "com_agents_category_sales": "Ventas",
-  "com_agents_category_sales_description": "Agentes enfocados en procesos de venta, relaciones con el client",
+  "com_agents_category_sales_description": "Agentes enfocados en procesos de venta, relaciones con el cliente",
   "com_agents_category_tab_label": "{{category}} categoría, {{position}} de {{total}}",
   "com_agents_category_tabs_label": "Categorías de agentes",
   "com_agents_chat_with": "Chatear con {{name}}",
-  "com_agents_clear_search": "Limpiar Busqueda",
+  "com_agents_clear_search": "Limpiar búsqueda",
   "com_agents_contact": "Contacto",
   "com_agents_copy_link": "Copiar enlace",
   "com_agents_create_error": "Hubo un error al crear su agente.",
@@ -36,11 +41,11 @@
   "com_agents_description_placeholder": "Opcional: Describa su Agente aquí",
   "com_agents_empty_state_heading": "No se encontró ningún agente",
   "com_agents_enable_file_search": "Habilitar búsqueda de archivos",
-  "com_agents_error_bad_request_message": "No se ha podido procesar la solicitud.",
+  "com_agents_error_bad_request_message": "No se pudo procesar la solicitud.",
   "com_agents_error_category_title": "Error de categoría",
   "com_agents_error_generic": "Hemos encontrado un problema al cargar el contenido.",
   "com_agents_error_invalid_request": "Petición inválida",
-  "com_agents_error_loading": "Error al cargar los agente",
+  "com_agents_error_loading": "Error al cargar los agentes",
   "com_agents_error_network_message": "No se puede conectar con el servidor.",
   "com_agents_error_network_suggestion": "Comprueba tu conexión a Internet y vuelve a intentarlo.",
   "com_agents_error_network_title": "Problema de conexión",
@@ -65,36 +70,36 @@
   "com_agents_link_copied": "Enlace copiado",
   "com_agents_link_copy_failed": "No se pudo copiar el enlace",
   "com_agents_loading": "Cargando...",
-  "com_agents_marketplace": "Marketplace de Agentes",
+  "com_agents_marketplace": "Tienda de Agentes",
   "com_agents_marketplace_subtitle": "Descubre y usa el poder de los agentes de inteligencia artificial para mejorar tu productividad y tus flujos de trabajo",
-  "com_agents_mcp_description_placeholder": "Explica que hace en pocas palabras",
-  "com_agents_mcp_icon_size": "Tamaño minimo 128 x128 px",
-  "com_agents_mcp_name_placeholder": "Herramienta Personalizada",
-  "com_agents_mcp_trust_subtext": "LibreChat no verifica los conectores personalizado",
+  "com_agents_mcp_description_placeholder": "Explica brevemente qué hace",
+  "com_agents_mcp_icon_size": "Tamaño mínimo 128 x 128 px",
+  "com_agents_mcp_name_placeholder": "Herramienta personalizada",
+  "com_agents_mcp_trust_subtext": "LibreChat no verifica los conectores personalizados",
   "com_agents_missing_name": "Por favor, escriba un nombre antes de crear un agente.",
   "com_agents_missing_provider_model": "Por favor, seleccione un proveedor y un modelo antes de crear un agente.",
   "com_agents_name_placeholder": "Opcional: El nombre del agente",
-  "com_agents_no_access": "No tiene acceso para editar este agente",
-  "com_agents_no_agent_id_error": "No se encontró ningún ID de agente. Asegúrese de crear primero el agente.",
-  "com_agents_no_more_results": "Ha llegado al final de los resultados.",
+  "com_agents_no_access": "No tienes acceso para editar este agente.",
+  "com_agents_no_agent_id_error": "No se encontró ID de agente. Asegúrese de que el agente esté creado primero.",
+  "com_agents_no_more_results": "Ha llegado al final de los resultados",
   "com_agents_not_available": "Agente no disponible",
   "com_agents_recommended": "Nuestros agentes recomendados",
   "com_agents_results_for": "Resultados para '{{query}}'",
   "com_agents_search_aria": "Buscar agentes",
   "com_agents_search_empty_heading": "Sin resultados de búsqueda",
   "com_agents_search_name": "Buscar agentes por nombre",
-  "com_agents_search_no_results": "No se han encontrado agentes para \"{{query}}\".",
+  "com_agents_search_no_results": "No se encontraron agentes para \"{{query}}\"",
   "com_agents_search_placeholder": "Buscar agentes...",
-  "com_agents_see_more": "Mostrar más",
+  "com_agents_see_more": "Ver más",
   "com_agents_start_chat": "Iniciar Chat",
-  "com_agents_top_picks": "Selección destacada",
+  "com_agents_top_picks": "Los más destacados",
   "com_agents_update_error": "Hubo un error al actualizar su agente.",
   "com_assistants_actions": "Acciones",
   "com_assistants_actions_disabled": "Necesita crear un asistente antes de añadir acciones.",
   "com_assistants_actions_info": "Permita que su Asistente recupere información o realice acciones a través de API's",
   "com_assistants_add_actions": "Añadir Acciones",
-  "com_assistants_add_mcp_server_tools": "Añadir herramientas de servidor MCP",
-  "com_assistants_add_tools": "Añadir herramientas",
+  "com_assistants_add_mcp_server_tools": "Agregar herramientas de servidor MCP",
+  "com_assistants_add_tools": "Añadir Herramientas",
   "com_assistants_allow_sites_you_trust": "Solo permite sitios en los que confíes.",
   "com_assistants_append_date": "Añadir Fecha y Hora Actual",
   "com_assistants_append_date_tooltip": "Cuando está habilitado, la fecha y hora actual del cliente se adjuntarán a las instrucciones del sistema del asistente.",
@@ -113,13 +118,13 @@
   "com_assistants_delete_actions_success": "Acción eliminada del Asistente con éxito",
   "com_assistants_description_placeholder": "Opcional: Describa su Asistente aquí",
   "com_assistants_file_search": "Búsqueda de Archivos",
-  "com_assistants_file_search_info": "La búsqueda de archivos permite que el asistente utilice conocimiento proveniente de archivos que tú o tus usuarios suban. Una vez que se sube un archivo, el asistente decide automáticamente cuándo recuperar contenido según las solicitudes del usuario. Adjuntar vector stores para la búsqueda de archivos aún no está disponible. Puedes adjuntarlos desde el Provider Playground o adjuntar archivos a los mensajes para usar la búsqueda de archivos a nivel de hilo de conversación.",
+  "com_assistants_file_search_info": "La búsqueda de archivos permite al asistente acceder al conocimiento de los archivos que usted o sus usuarios suban. Una vez subido un archivo, el asistente decide automáticamente cuándo recuperar su contenido según las solicitudes del usuario. Adjuntar almacenes vectoriales para la Búsqueda de Archivos aún no está soportado. Puede adjuntarlos desde el Área de Pruebas del Proveedor o adjuntar archivos a los mensajes para la búsqueda de archivos por conversación.",
   "com_assistants_function_use": "El Asistente usó {{0}}",
   "com_assistants_image_vision": "Visión de Imagen",
   "com_assistants_instructions_placeholder": "Las instrucciones del sistema que utiliza el asistente",
   "com_assistants_knowledge": "Conocimiento",
   "com_assistants_knowledge_disabled": "El Asistente debe ser creado, y el Intérprete de Código o la Recuperación deben estar habilitados y guardados antes de subir archivos como Conocimiento.",
-  "com_assistants_knowledge_info": "Si sube archivos en el Conocimiento, las conversaciones con su Asistente pueden incluir el contenido de los archivos.",
+  "com_assistants_knowledge_info": "Si sube archivos en Conocimiento, las conversaciones con su Asistente pueden incluir el contenido de los archivos.",
   "com_assistants_max_starters_reached": "Se alcanzó el número máximo de iniciadores de conversación",
   "com_assistants_name_placeholder": "Opcional: El nombre del asistente",
   "com_assistants_non_retrieval_model": "La búsqueda de archivos no está habilitada en este modelo. Por favor, seleccione otro modelo.",
@@ -131,14 +136,14 @@
   "com_assistants_update_actions_success": "Acción creada o actualizada con éxito",
   "com_assistants_update_error": "Hubo un error al actualizar su asistente.",
   "com_assistants_update_success": "Actualizado con éxito",
-  "com_assistants_update_success_name": "Actualización correcta de {{name}}.",
-  "com_auth_already_have_account": "¿Ya tienes una cuenta?",
+  "com_assistants_update_success_name": "{{name}} actualizado con éxito",
+  "com_auth_already_have_account": "¿Ya tiene una cuenta?",
   "com_auth_apple_login": "Inicia con Apple",
   "com_auth_back_to_login": "Volver al inicio de sesión",
-  "com_auth_click": "Haz clic",
+  "com_auth_click": "Haga clic",
   "com_auth_click_here": "Haz clic aquí",
   "com_auth_continue": "Continuar",
-  "com_auth_create_account": "Crear tu cuenta",
+  "com_auth_create_account": "Crear su cuenta",
   "com_auth_discord_login": "Continuar con Discord",
   "com_auth_email": "Correo electrónico",
   "com_auth_email_address": "Dirección de correo electrónico",
@@ -154,48 +159,48 @@
   "com_auth_email_verification_in_progress": "Verificando su correo electrónico, por favor espere",
   "com_auth_email_verification_invalid": "Verificación de correo electrónico no válida",
   "com_auth_email_verification_redirecting": "Redirigiendo en {{0}} segundos...",
-  "com_auth_email_verification_resend_prompt": "¿No recibiste el correo electrónico?",
+  "com_auth_email_verification_resend_prompt": "¿No recibió el correo electrónico?",
   "com_auth_email_verification_success": "Correo electrónico verificado exitosamente",
   "com_auth_email_verifying_ellipsis": "Verificando...",
-  "com_auth_error_create": "Hubo un error al intentar registrar tu cuenta. Inténtalo de nuevo.",
+  "com_auth_error_create": "Hubo un error al intentar registrar su cuenta. Inténtelo de nuevo.",
   "com_auth_error_invalid_reset_token": "Este token de restablecimiento de contraseña ya no es válido.",
   "com_auth_error_login": "No se puede iniciar sesión con la información proporcionada. Verifique sus credenciales y vuelva a intentarlo.",
-  "com_auth_error_login_ban": "Tu cuenta ha sido bloqueada temporalmente debido a violaciones de nuestro servicio.",
-  "com_auth_error_login_rl": "Demasiados intentos de inicio de sesión en un corto período de tiempo. Inténtalo de nuevo más tarde.",
-  "com_auth_error_login_server": "Hubo un error interno del servidor. Espera unos momentos y vuelva a intentarlo.",
-  "com_auth_error_login_unverified": "Tu cuenta no ha sido verificada. Por favor, revisa tu correo electrónico para encontrar el enlace de verificación.",
-  "com_auth_error_oauth_failed": "Error en la autenticación. Comprueba tu método de inicio de sesión e intenta de nuevo.",
+  "com_auth_error_login_ban": "Su cuenta ha sido suspendida temporalmente por incumplimiento de nuestras condiciones de servicio.",
+  "com_auth_error_login_rl": "Demasiados intentos de inicio de sesión en un corto período de tiempo. Inténtelo de nuevo más tarde.",
+  "com_auth_error_login_server": "Hubo un error interno del servidor. Espere unos momentos y vuelva a intentarlo.",
+  "com_auth_error_login_unverified": "Su cuenta no ha sido verificada. Por favor, revise su correo electrónico para encontrar el enlace de verificación.",
+  "com_auth_error_oauth_failed": "La autenticación falló. Por favor, verifique su método de inicio de sesión e inténtelo de nuevo.",
   "com_auth_facebook_login": "Continuar con Facebook",
   "com_auth_full_name": "Nombre completo",
   "com_auth_github_login": "Continuar con Github",
   "com_auth_google_login": "Continuar con Google",
   "com_auth_here": "AQUÍ",
   "com_auth_login": "Iniciar sesión",
-  "com_auth_login_with_new_password": "Ahora puedes iniciar sesión con tu nueva contraseña.",
+  "com_auth_login_with_new_password": "Ahora puede iniciar sesión con su nueva contraseña.",
   "com_auth_name_max_length": "El nombre debe tener menos de 80 caracteres",
   "com_auth_name_min_length": "El nombre debe tener al menos 3 caracteres",
   "com_auth_name_required": "Se requiere nombre",
-  "com_auth_no_account": "¿No tienes una cuenta?",
+  "com_auth_no_account": "¿No tiene una cuenta?",
   "com_auth_password": "Contraseña",
   "com_auth_password_confirm": "Confirmar contraseña",
-  "com_auth_password_forgot": "¿Olvidaste tu contraseña?",
+  "com_auth_password_forgot": "¿Olvidó su contraseña?",
   "com_auth_password_max_length": "La contraseña debe tener menos de 128 caracteres",
   "com_auth_password_min_length": "La contraseña debe tener al menos 8 caracteres",
   "com_auth_password_not_match": "Las contraseñas no coinciden",
   "com_auth_password_required": "Se requiere contraseña",
-  "com_auth_registration_success_generic": "Por favor, revisa tu correo electrónico para verificar tu dirección de correo.",
+  "com_auth_registration_success_generic": "Por favor, revise su correo electrónico para verificar su dirección.",
   "com_auth_registration_success_insecure": "Registro completado exitosamente.",
   "com_auth_reset_password": "Restablecer su contraseña",
-  "com_auth_reset_password_if_email_exists": "Si existe una cuenta con ese correo electrónico, se le ha enviado un mensaje con instrucciones para restablecer su contraseña. Por favor, asegúrate de revisar tu carpeta de correo no deseado.",
+  "com_auth_reset_password_if_email_exists": "Si existe una cuenta con ese correo electrónico, se le ha enviado un mensaje con instrucciones para restablecer su contraseña. Por favor, asegúrese de revisar su carpeta de correo no deseado.",
   "com_auth_reset_password_link_sent": "Correo electrónico enviado",
   "com_auth_reset_password_success": "Éxito al restablecer la contraseña",
-  "com_auth_saml_login": "Continua con SAML",
+  "com_auth_saml_login": "Continuar con SAML",
   "com_auth_sign_in": "Iniciar sesión",
   "com_auth_sign_up": "Regístrese",
   "com_auth_submit_registration": "Enviar registro",
   "com_auth_to_reset_your_password": "para restablecer su contraseña.",
-  "com_auth_to_try_again": "para intentarlo de nuevo.",
-  "com_auth_two_factor": "Revisa tu aplicación preferida de OTP para obtener el código",
+  "com_auth_to_try_again": "para intentar de nuevo.",
+  "com_auth_two_factor": "Consulta tu aplicación de contraseña de un solo uso para obtener el código",
   "com_auth_username": "Nombre de usuario (opcional)",
   "com_auth_username_max_length": "El nombre de usuario debe tener menos de 20 caracteres",
   "com_auth_username_min_length": "El nombre de usuario debe tener al menos 2 caracteres",
@@ -210,9 +215,9 @@
   "com_endpoint_ai": "IA",
   "com_endpoint_anthropic_maxoutputtokens": "Número máximo de tokens que se pueden generar en la respuesta. Especifique un valor más bajo para respuestas más cortas y un valor más alto para respuestas más largas.",
   "com_endpoint_anthropic_prompt_cache": "El almacenamiento en caché de instrucciones permite reutilizar contextos o instrucciones extensas entre llamadas a la API, reduciendo costos y tiempo de respuesta",
-  "com_endpoint_anthropic_temp": "Rango de 0 a 1. Utilice una temperatura más cercana a 0 para tareas analíticas/de opción múltiple y más cercana a 1 para tareas creativas y generativas. Recomendamos alterar esto o Top P, pero no ambos.",
-  "com_endpoint_anthropic_topk": "Top-k cambia la forma en que el modelo selecciona tokens para la salida. Un top-k de 1 significa que el token seleccionado es el más probable entre todos los tokens en el vocabulario del modelo (también llamado decodificación codiciosa), mientras que un top-k de 3 significa que el siguiente token se selecciona entre los 3 tokens más probables (usando temperatura).",
-  "com_endpoint_anthropic_topp": "Top-p cambia la forma en que el modelo selecciona tokens para la salida. Los tokens se seleccionan desde los más K (ver parámetro topK) probables hasta los menos probables hasta que la suma de sus probabilidades sea igual al valor top-p.",
+  "com_endpoint_anthropic_temp": "Rango de 0 a 1. Use valores cercanos a 0 para tareas analíticas o de opción múltiple, y cercanos a 1 para tareas creativas y generativas. Se recomienda ajustar este parámetro o Top P, pero no ambos.",
+  "com_endpoint_anthropic_topk": "Top-k cambia cómo el modelo selecciona tokens en la salida. Con top-k de 1, se elige el token más probable del vocabulario (decodificación voraz); con top-k de 3, el siguiente token se elige entre los 3 más probables (usando la temperatura).",
+  "com_endpoint_anthropic_topp": "Top-p cambia cómo el modelo selecciona tokens en la salida. Los tokens se seleccionan desde los más probables hasta que la suma de sus probabilidades iguale el valor de top-p.",
   "com_endpoint_assistant": "Asistente",
   "com_endpoint_assistant_model": "Modelo de asistente",
   "com_endpoint_assistant_placeholder": "Por favor, seleccione un Asistente desde el panel lateral derecho",
@@ -250,9 +255,9 @@
   "com_endpoint_frequency_penalty": "Penalización de frecuencia",
   "com_endpoint_google_custom_name_placeholder": "Establecer un nombre personalizado para Google",
   "com_endpoint_google_maxoutputtokens": "Número máximo de tokens que se pueden generar en la respuesta. Especifique un valor más bajo para respuestas más cortas y un valor más alto para respuestas más largas.",
-  "com_endpoint_google_temp": "Los valores más altos = más aleatorios, mientras que los valores más bajos = más enfocados y deterministas. Recomendamos alterar esto o Top P, pero no ambos.",
-  "com_endpoint_google_topk": "Top-k cambia la forma en que el modelo selecciona tokens para la salida. Un top-k de 1 significa que el token seleccionado es el más probable entre todos los tokens en el vocabulario del modelo (también llamado decodificación codiciosa), mientras que un top-k de 3 significa que el siguiente token se selecciona entre los 3 tokens más probables (usando temperatura).",
-  "com_endpoint_google_topp": "Top-p cambia la forma en que el modelo selecciona tokens para la salida. Los tokens se seleccionan desde los más K (ver parámetro topK) probables hasta los menos probables hasta que la suma de sus probabilidades sea igual al valor top-p.",
+  "com_endpoint_google_temp": "Valores más altos = más aleatorio; valores más bajos = más enfocado y determinista. Se recomienda ajustar este parámetro o Top P, pero no ambos.",
+  "com_endpoint_google_topk": "Top-k cambia cómo el modelo selecciona tokens en la salida. Con top-k de 1, se elige el token más probable del vocabulario (decodificación voraz); con top-k de 3, el siguiente token se elige entre los 3 más probables (usando la temperatura).",
+  "com_endpoint_google_topp": "Top-p cambia cómo el modelo selecciona tokens en la salida. Los tokens se seleccionan desde los más probables hasta que la suma de sus probabilidades iguale el valor de top-p.",
   "com_endpoint_instructions_assistants": "Anular instrucciones",
   "com_endpoint_instructions_assistants_placeholder": "Anula las instrucciones del asistente. Esto es útil para modificar el comportamiento por ejecución.",
   "com_endpoint_max_output_tokens": "Tokens de Salida Máximos",
@@ -263,16 +268,16 @@
   "com_endpoint_no_presets": "Aún no hay configuraciones preestablecidas, utiliza el botón de configuración para crear una",
   "com_endpoint_openai_custom_name_placeholder": "Establecer un nombre personalizado para ChatGPT",
   "com_endpoint_openai_detail": "La resolución para las solicitudes de Vision. \"Baja\" es más económica y rápida, \"Alta\" es más detallada y costosa, y \"Automática\" elegirá automáticamente entre las dos en función de la resolución de la imagen.",
-  "com_endpoint_openai_freq": "Número entre -2.0 y 2.0. Los valores positivos penalizan los nuevos tokens basados en su frecuencia existente en el texto hasta el momento, disminuyendo la probabilidad del modelo de repetir la misma línea textualmente.",
+  "com_endpoint_openai_freq": "Número entre -2.0 y 2.0. Los valores positivos penalizan los tokens nuevos según su frecuencia en el texto hasta el momento, reduciendo la probabilidad de que el modelo repita la misma línea literalmente.",
   "com_endpoint_openai_max": "Los tokens máximos a generar. La longitud total de los tokens de entrada y los tokens generados está limitada por la longitud del contexto del modelo.",
   "com_endpoint_openai_max_tokens": "Campo opcional `max_tokens`, que representa el número máximo de tokens que se pueden generar en la finalización del chat.\n\nLa longitud total de los tokens de entrada y los tokens generados está limitada por la longitud del contexto del modelo. Puede experimentar errores si este número excede los tokens máximos de contexto.",
-  "com_endpoint_openai_pres": "Número entre -2.0 y 2.0. Los valores positivos penalizan los nuevos tokens basados en si aparecen o no en el texto hasta el momento, aumentando la probabilidad del modelo de hablar sobre nuevos temas.",
+  "com_endpoint_openai_pres": "Número entre -2.0 y 2.0. Los valores positivos penalizan los tokens nuevos si ya aparecieron en el texto, incentivando al modelo a hablar sobre temas nuevos.",
   "com_endpoint_openai_prompt_prefix_placeholder": "Establecer instrucciones personalizadas para incluir en el Mensaje del sistema. Predeterminado: ninguno",
   "com_endpoint_openai_resend": "Reenviar todas las imágenes adjuntas previamente. Nota: esto puede aumentar significativamente el costo de tokens y puede experimentar errores con muchos archivos adjuntos de imágenes.",
   "com_endpoint_openai_resend_files": "Reenviar todos los archivos adjuntos anteriormente. Nota: esto aumentará el costo de tokens y puede experimentar errores con muchos archivos adjuntos.",
   "com_endpoint_openai_stop": "Hasta 4 secuencias donde la API dejará de generar más tokens.",
-  "com_endpoint_openai_temp": "Los valores más altos = más aleatorios, mientras que los valores más bajos = más enfocados y deterministas. Recomendamos alterar esto o Top P, pero no ambos.",
-  "com_endpoint_openai_topp": "Una alternativa al muestreo con temperatura, llamada muestreo de núcleo, donde el modelo considera los resultados de los tokens con la masa de probabilidad superior al top_p. Entonces, 0.1 significa que solo se consideran los tokens que comprenden la masa de probabilidad superior al 10%. Recomendamos alterar esto o la temperatura, pero no ambos.",
+  "com_endpoint_openai_temp": "Valores más altos = más aleatorio; valores más bajos = más enfocado y determinista. Se recomienda ajustar este parámetro o Top P, pero no ambos.",
+  "com_endpoint_openai_topp": "Alternativa al muestreo por temperatura. Con nucleus sampling, el modelo considera solo los tokens cuya probabilidad acumulada llega al valor top_p. Por ejemplo, 0.1 significa que solo se consideran los tokens que componen el 10% más probable. Se recomienda ajustar este parámetro o la temperatura, pero no ambos.",
   "com_endpoint_output": "Salida",
   "com_endpoint_plug_image_detail": "Detalle de imagen",
   "com_endpoint_plug_resend_files": "Reenviar archivos",
@@ -283,11 +288,11 @@
   "com_endpoint_preset_default_none": "No hay configuración preestablecida predeterminada activa.",
   "com_endpoint_preset_default_removed": "ya no es la configuración preestablecida predeterminada.",
   "com_endpoint_preset_delete_confirm": "¿Estás seguro de que quieres eliminar esta configuración preestablecida?",
-  "com_endpoint_preset_delete_error": "Hubo un error al eliminar tu configuración preestablecida. Por favor, inténtalo de nuevo.",
+  "com_endpoint_preset_delete_error": "Hubo un error al eliminar la configuración preestablecida. Por favor, inténtelo de nuevo.",
   "com_endpoint_preset_import": "¡Configuración preestablecida importada!",
-  "com_endpoint_preset_import_error": "Hubo un error al importar tu configuración preestablecida. Por favor, inténtalo de nuevo.",
+  "com_endpoint_preset_import_error": "Hubo un error al importar la configuración preestablecida. Por favor, inténtelo de nuevo.",
   "com_endpoint_preset_name": "Nombre de la configuración preestablecida",
-  "com_endpoint_preset_save_error": "Hubo un error al guardar tu configuración preestablecida. Por favor, inténtalo de nuevo.",
+  "com_endpoint_preset_save_error": "Hubo un error al guardar la configuración preestablecida. Por favor, inténtelo de nuevo.",
   "com_endpoint_preset_selected": "¡Configuración preestablecida activa!",
   "com_endpoint_preset_selected_title": "¡Activo!",
   "com_endpoint_preset_title": "Configuración preestablecida",
@@ -303,7 +308,7 @@
   "com_endpoint_search": "Buscar punto de conexión por nombre",
   "com_endpoint_search_models": "Buscar modelos...",
   "com_endpoint_search_var": "Buscar {{0}}...",
-  "com_endpoint_set_custom_name": "Establece un nombre personalizado, en caso de que puedas encontrar esta configuración preestablecida",
+  "com_endpoint_set_custom_name": "Establezca un nombre personalizado para identificar esta configuración preestablecida",
   "com_endpoint_stop": "Secuencias de detención",
   "com_endpoint_stop_placeholder": "Separe los valores presionando `Intro`",
   "com_endpoint_temperature": "Temperatura",
@@ -312,18 +317,20 @@
   "com_endpoint_top_p": "Top P",
   "com_endpoint_use_active_assistant": "Utilizar asistente activo",
   "com_error_expired_user_key": "La clave proporcionada para {{0}} expiró en {{1}}. Por favor, proporcione una clave nueva e inténtelo de nuevo.",
-  "com_error_files_dupe": "Se detectó un archivo duplicado",
+  "com_error_files_dupe": "Se detectó un archivo duplicado.",
   "com_error_files_empty": "No se permiten archivos vacíos.",
   "com_error_files_process": "Se produjo un error al procesar el archivo.",
-  "com_error_files_upload": "Se produjo un error durante la subida del archivo",
+  "com_error_files_upload": "Ocurrió un error al subir el archivo.",
   "com_error_files_upload_canceled": "La solicitud de carga del archivo fue cancelada. Nota: es posible que la carga del archivo aún esté en proceso y necesite ser eliminada manualmente.",
   "com_error_files_validation": "Se produjo un error durante la validación del archivo.",
-  "com_error_input_length": "El recuento de tokens del último mensaje es demasiado largo, supera el límite de tokens o los parámetros de límite de tokens están mal configurados, lo que afecta negativamente a la ventana de contexto. Más información: {{0}}. Reduce la longitud de tu mensaje, ajusta el tamaño máximo de contexto en los parámetros de la conversación o bifurca la conversación para continuar.",
+  "com_error_input_length": "El último mensaje excede el límite de tokens o los parámetros de contexto están mal configurados. Más información: {{0}}. Acorte su mensaje, ajuste el tamaño máximo de contexto en los parámetros de la conversación, o bifurque la conversación para continuar.",
   "com_error_invalid_agent_provider": "El proveedor \"{{0}}\" no está disponible para el uso con Agentes. Por favor, ve a las configuraciones de tu agente y selecciona un proveedor que se encuentre disponible.",
+  "com_error_invalid_base_url": "La URL base proporcionada apunta a una dirección restringida. Use una URL externa válida e inténtelo de nuevo.",
   "com_error_invalid_user_key": "Clave proporcionada no válida. Por favor proporcione una clave válida e inténtelo de nuevo.",
-  "com_error_moderation": "Parece que el contenido enviado ha sido marcado por nuestro sistema de moderación por no estar alineado con nuestras pautas comunitarias. No podemos proceder con este tema específico. Si tiene alguna otra pregunta o tema que le gustaría explorar, por favor edite su mensaje o cree una nueva conversación.",
+  "com_error_moderation": "El contenido enviado fue marcado por nuestro sistema de moderación por no alinearse con nuestras normas comunitarias. No es posible continuar con este tema. Si tiene otras preguntas o temas que desee explorar, edite su mensaje o inicie una nueva conversación.",
   "com_error_no_base_url": "No se encontró URL base. Por favor proporcione una y vuelva a intentarlo.",
   "com_error_no_user_key": "No se encontró ninguna clave. Por favor, proporcione una clave e inténtelo de nuevo.",
+  "com_error_stream_expired": "El flujo de respuesta ha expirado o ya se completó. Por favor, inténtelo de nuevo.",
   "com_files_filter": "Filtrar archivos...",
   "com_files_no_results": "Sin resultados.",
   "com_files_number_selected": "{{0}} de {{1}} archivo(s) seleccionado(s)",
@@ -332,15 +339,17 @@
   "com_nav_2fa": "Autenticación en dos pasos",
   "com_nav_account_settings": "Configuración de la cuenta",
   "com_nav_always_make_prod": "Convertir siempre las nuevas versiones en producción",
-  "com_nav_archive_created_at": "CreadoEn",
+  "com_nav_archive_created_at": "Fecha de archivo",
   "com_nav_archive_name": "Nombre",
   "com_nav_archived_chats": "Conversaciones archivadas",
   "com_nav_at_command": "Comando @",
-  "com_nav_at_command_description": "Alternar comando \"@\" para cambiar entre puntos de conexión, modelos, ajustes predefinidos, etc.",
+  "com_nav_at_command_description": "Activa el comando \"@\" para cambiar entre endpoints, modelos, configuraciones preestablecidas, etc.",
   "com_nav_audio_play_error": "Error al reproducir el audio: {{0}}",
   "com_nav_audio_process_error": "Error al procesar el audio: {{0}}",
-  "com_nav_auto_scroll": "Desplazamiento automático al más reciente al abrir",
+  "com_nav_auto_expand_tools": "Expandir detalles de herramientas automáticamente",
+  "com_nav_auto_scroll": "Desplazamiento automático al mensaje más reciente al abrir el chat",
   "com_nav_auto_send_prompts": "Envío automático de mensajes",
+  "com_nav_auto_send_prompts_desc": "Enviar el prompt al chat automáticamente al seleccionarlo",
   "com_nav_auto_send_text": "Envío automático de texto",
   "com_nav_auto_transcribe_audio": "Transcribir audio automáticamente",
   "com_nav_automatic_playback": "Reproducción automática del último mensaje",
@@ -351,15 +360,15 @@
   "com_nav_browser": "Navegador",
   "com_nav_change_picture": "Cambiar imagen",
   "com_nav_chat_commands": "Comandos de chat",
-  "com_nav_chat_commands_info": "Estos comandos se activan al escribir caracteres específicos al inicio de su mensaje. Cada comando se activa mediante su prefijo designado. Puede desactivarlos si utiliza frecuentemente estos caracteres para comenzar mensajes.",
-  "com_nav_chat_direction": "Dirección del chat",
+  "com_nav_chat_commands_info": "Estos comandos se activan escribiendo caracteres específicos al inicio del mensaje. Puede desactivarlos si usa frecuentemente esos caracteres para comenzar mensajes.",
+  "com_nav_chat_direction": "Dirección del texto",
   "com_nav_clear_all_chats": "Borrar todos los chats",
   "com_nav_clear_cache_confirm_message": "¿Está seguro de que desea borrar el caché?",
   "com_nav_clear_conversation": "Borrar conversaciones",
-  "com_nav_clear_conversation_confirm_message": "¿Estás seguro de que quieres borrar todas las conversaciones? Esta acción es irreversible.",
+  "com_nav_clear_conversation_confirm_message": "¿Está seguro de que desea borrar todas las conversaciones? Esta acción es irreversible.",
   "com_nav_close_sidebar": "Cerrar barra lateral",
   "com_nav_commands": "Comandos",
-  "com_nav_confirm_clear": "Confirmar borrado",
+  "com_nav_confirm_clear": "Confirmar limpieza",
   "com_nav_conversation_mode": "Modo de conversación",
   "com_nav_convo_menu_options": "Opciones del menú de conversación",
   "com_nav_db_sensitivity": "Sensibilidad en decibelios",
@@ -368,7 +377,7 @@
   "com_nav_delete_account_confirm": "Eliminar cuenta - ¿Está seguro?",
   "com_nav_delete_account_email_placeholder": "Por favor ingrese el correo electrónico de su cuenta",
   "com_nav_delete_cache_storage": "Eliminar almacenamiento caché de TTS",
-  "com_nav_delete_data_info": "Se eliminarán todos sus datos",
+  "com_nav_delete_data_info": "Todos sus datos serán eliminados.",
   "com_nav_delete_warning": "ADVERTENCIA: Esta acción eliminará su cuenta de forma permanente.",
   "com_nav_enable_cache_tts": "Habilitar caché de texto a voz",
   "com_nav_enable_cloud_browser_voice": "Usar voces basadas en la nube",
@@ -379,12 +388,12 @@
   "com_nav_export_conversation": "Exportar conversación",
   "com_nav_export_filename": "Nombre de archivo",
   "com_nav_export_filename_placeholder": "Establecer el nombre de archivo",
-  "com_nav_export_include_endpoint_options": "Incluir opciones de punto final",
+  "com_nav_export_include_endpoint_options": "Incluir opciones del endpoint",
   "com_nav_export_recursive": "Recursivo",
   "com_nav_export_recursive_or_sequential": "¿Recursivo o secuencial?",
   "com_nav_export_type": "Tipo",
   "com_nav_external": "Externo",
-  "com_nav_font_size": "Tamaño de fuente",
+  "com_nav_font_size": "Tamaño de fuente del mensaje",
   "com_nav_font_size_base": "Mediano",
   "com_nav_font_size_lg": "Grande",
   "com_nav_font_size_sm": "Pequeño",
@@ -392,15 +401,15 @@
   "com_nav_font_size_xs": "Extra pequeño",
   "com_nav_help_faq": "Ayuda y preguntas frecuentes",
   "com_nav_info_code_artifacts": "Permite mostrar artefactos de código experimentales junto al chat",
-  "com_nav_info_code_artifacts_agent": "Habilita el uso de artefactos de código para este agente. De forma predeterminada, instrucciones adicionales específicas para el uso de artefactos son añadidas, a menos que \"Modo personalizado de indicación\" esté habilitado.",
+  "com_nav_info_code_artifacts_agent": "Habilita el uso de artefactos de código para este agente. De forma predeterminada, se añaden instrucciones adicionales para el uso de artefactos, a menos que el \"Modo de Prompt Personalizado\" esté habilitado.",
   "com_nav_info_custom_prompt_mode": "Cuando está habilitado, no se incluirá el mensaje del sistema predeterminado para artefactos. En este modo, todas las instrucciones para generar artefactos deberán proporcionarse manualmente.",
   "com_nav_info_enter_to_send": "Cuando está habilitado, al presionar `ENTER` se enviará su mensaje. Cuando está deshabilitado, al presionar Enter se agregará una nueva línea, y necesitará presionar `CTRL + ENTER` / `⌘ + ENTER` para enviar su mensaje.",
-  "com_nav_info_fork_change_default": "\"Mostrar únicamente mensajes visibles\" incluye solo la ruta directa hacia el mensaje seleccionado. \"Incluir ramas relacionadas\" añade las ramificaciones a lo largo de la ruta. \"Incluir todo desde/hacia aquí\" incluye todos los mensajes y ramificaciones conectados.",
+  "com_nav_info_fork_change_default": "\"Solo mensajes visibles\" incluye únicamente la ruta directa al mensaje seleccionado. \"Incluir ramas relacionadas\" añade las bifurcaciones a lo largo de esa ruta. \"Incluir todo desde/hacia aquí\" incluye todos los mensajes y bifurcaciones conectados.",
   "com_nav_info_fork_split_target_setting": "Cuando está habilitado, la bifurcación comenzará desde el mensaje objetivo hasta el último mensaje de la conversación, según el comportamiento seleccionado.",
   "com_nav_info_include_shadcnui": "Cuando está habilitado, se incluirán instrucciones para el uso de los componentes de shadcn/ui. shadcn/ui es una colección de componentes reutilizables construidos utilizando Radix UI y Tailwind CSS. Nota: estas son instrucciones extensas, debe habilitarlas solo si es importante para usted informar al LLM sobre las importaciones y componentes correctos. Para más información sobre estos componentes, visite: https://ui.shadcn.com/",
-  "com_nav_info_latex_parsing": "Cuando está habilitado, el código LaTeX en los mensajes se mostrará como ecuaciones matemáticas. Si usted no necesita el renderizado de LaTeX, puede deshabilitarlo para mejorar el rendimiento.",
+  "com_nav_info_latex_parsing": "Cuando está habilitado, el código LaTeX en los mensajes se renderiza como ecuaciones matemáticas. Desactívelo si no necesita renderizado LaTeX para mejorar el rendimiento.",
   "com_nav_info_save_badges_state": "Al habilitar esta opción, se guardará el estado de las insignias del chat. Esto significa que si crea un nuevo chat, las insignias permanecerán en el mismo estado que el chat anterior. Si desactiva esta opción, las insignias se restablecerán a su estado predeterminado cada vez que cree un nuevo chat.",
-  "com_nav_info_save_draft": "Cuando está habilitado, el texto y los archivos adjuntos que ingrese en el formulario de chat se guardarán automáticamente como borradores en su dispositivo local. Estos borradores estarán disponibles incluso si recarga la página o cambia a una conversación diferente. Los borradores se almacenan localmente en su dispositivo y se eliminan una vez que el mensaje es enviado.",
+  "com_nav_info_save_draft": "Cuando está habilitado, el texto y los archivos adjuntos del campo de chat se guardan automáticamente como borradores en su dispositivo. Los borradores persisten al recargar la página o cambiar de conversación, y se eliminan al enviar el mensaje.",
   "com_nav_info_user_name_display": "Cuando está habilitado, se mostrará su nombre de usuario sobre cada mensaje que envíe. Cuando está deshabilitado, solo verá \"Usted\" sobre sus mensajes.",
   "com_nav_lang_arabic": "العربية",
   "com_nav_lang_auto": "Detección automática",
@@ -432,27 +441,27 @@
   "com_nav_log_out": "Cerrar sesión",
   "com_nav_long_audio_warning": "Los textos más extensos tomarán más tiempo en procesarse.",
   "com_nav_maximize_chat_space": "Maximizar espacio del chat",
-  "com_nav_modular_chat": "Habilitar el cambio de puntos finales en medio de una conversación",
+  "com_nav_modular_chat": "Permitir cambiar de endpoint a mitad de una conversación",
   "com_nav_my_files": "Mis archivos",
   "com_nav_not_supported": "No soportado",
   "com_nav_open_sidebar": "Abrir barra lateral",
   "com_nav_playback_rate": "Velocidad de reproducción de audio",
   "com_nav_plugin_auth_error": "Hubo un error al intentar autenticar este plugin. Por favor, inténtalo de nuevo.",
-  "com_nav_plus_command": "+ Comando",
-  "com_nav_plus_command_description": "Alternar comando ' + ' para agregar una configuración de respuestas múltiples",
+  "com_nav_plus_command": "Comando +",
+  "com_nav_plus_command_description": "Activa el comando \"+\" para agregar una configuración de respuestas múltiples",
   "com_nav_profile_picture": "Imagen de perfil",
   "com_nav_save_drafts": "Guardar borradores localmente",
   "com_nav_search_placeholder": "Buscar mensajes",
   "com_nav_send_message": "Enviar mensaje",
   "com_nav_setting_account": "Cuenta",
-  "com_nav_setting_chat": "Configuración del chat",
+  "com_nav_setting_chat": "Chat",
   "com_nav_setting_data": "Controles de datos",
   "com_nav_setting_general": "General",
   "com_nav_setting_speech": "Voz y habla",
   "com_nav_settings": "Configuración",
-  "com_nav_shared_links": "Links Compartidos",
+  "com_nav_shared_links": "Enlaces compartidos",
   "com_nav_slash_command": "Comando /",
-  "com_nav_slash_command_description": "Alternar comando '/' para seleccionar un mensaje predefinido mediante el teclado",
+  "com_nav_slash_command_description": "Activa el comando \"/\" para seleccionar un prompt desde el teclado",
   "com_nav_speech_to_text": "Voz a texto",
   "com_nav_stop_generating": "Detener generación",
   "com_nav_text_to_speech": "Texto a voz",
@@ -462,7 +471,7 @@
   "com_nav_theme_system": "Sistema",
   "com_nav_tool_dialog": "Herramientas del asistente",
   "com_nav_tool_dialog_agents": "Herramientas del agente",
-  "com_nav_tool_dialog_description": "El asistente debe guardarse para que las selecciones de herramientas persistan.",
+  "com_nav_tool_dialog_description": "Guarde el asistente para que la selección de herramientas persista.",
   "com_nav_tool_remove": "Eliminar",
   "com_nav_tool_search": "Buscar herramientas",
   "com_nav_user": "USUARIO",
@@ -478,13 +487,15 @@
   "com_sidepanel_manage_files": "Administrar Archivos",
   "com_sidepanel_parameters": "Parámetros",
   "com_ui_2fa_disable": "Deshabilitar 2FA",
-  "com_ui_2fa_disable_error": "Hubo en error deshabilitando la autenticación en dos pasos",
-  "com_ui_2fa_enable": "Activa 2FA",
-  "com_ui_2fa_enabled": "2FA ha sido activada",
+  "com_ui_2fa_disable_error": "Hubo un error al deshabilitar la autenticación de dos factores",
+  "com_ui_2fa_enable": "Habilitar 2FA",
+  "com_ui_2fa_enabled": "2FA habilitado",
+  "com_ui_2fa_verification_required": "Ingrese su código 2FA para continuar",
   "com_ui_accept": "Acepto",
   "com_ui_add": "Agregar",
+  "com_ui_add_labels": "Agregar etiquetas",
   "com_ui_add_model_preset": "Agregar un modelo o configuración preestablecida para una respuesta adicional",
-  "com_ui_add_multi_conversation": "Agregar múltiples conversaciones",
+  "com_ui_add_multi_conversation": "Agregar conversación múltiple",
   "com_ui_admin": "Administrador",
   "com_ui_admin_access_warning": "Deshabilitar el acceso de Administrador a esta función puede causar problemas inesperados en la interfaz que requieran actualizar la página. Si se guarda este cambio, la única forma de revertirlo es mediante la configuración de interfaz en el archivo librechat.yaml, lo cual afectará a todos los roles.",
   "com_ui_admin_settings": "Configuración de Administrador",
@@ -492,8 +503,8 @@
   "com_ui_advanced_settings": "Configuración avanzada",
   "com_ui_agent": "Agente",
   "com_ui_agent_delete_error": "Se produjo un error al eliminar el agente",
-  "com_ui_agent_deleted": "Asistente eliminado exitosamente",
-  "com_ui_agent_duplicate_error": "Se produjo un error al duplicar el asistente",
+  "com_ui_agent_deleted": "Agente eliminado con éxito",
+  "com_ui_agent_duplicate_error": "Hubo un error al duplicar el agente",
   "com_ui_agent_duplicated": "Agente duplicado exitosamente",
   "com_ui_agent_var": "{{0}} agente",
   "com_ui_agent_version_restore_success": "Versión restaurada correctamente",
@@ -505,7 +516,7 @@
   "com_ui_all": "todas",
   "com_ui_all_proper": "Todos",
   "com_ui_analyzing": "Analizando",
-  "com_ui_analyzing_finished": "Acabando el análisis",
+  "com_ui_analyzing_finished": "Análisis completado",
   "com_ui_api_key": "Clave API",
   "com_ui_archive": "Archivar",
   "com_ui_archive_delete_error": "Error al borrar conversación archivada",
@@ -513,7 +524,7 @@
   "com_ui_artifact_click": "Haga clic para abrir",
   "com_ui_artifacts": "Artefactos",
   "com_ui_artifacts_options": "Opciones de artefactos",
-  "com_ui_artifacts_toggle": "Alternar Interfaz de Artefactos",
+  "com_ui_artifacts_toggle": "Mostrar/ocultar interfaz de artefactos",
   "com_ui_artifacts_toggle_agent": "Habilitar artefactos",
   "com_ui_ascending": "Asc",
   "com_ui_assistant": "Asistente",
@@ -523,16 +534,19 @@
   "com_ui_assistants_output": "Salida de Asistentes",
   "com_ui_at_least_one_owner_required": "Se requiere al menos un propietario",
   "com_ui_attach_error": "No se puede adjuntar el archivo. Cree o seleccione una conversación, o intente actualizar la página.",
+  "com_ui_attach_error_limit": "Límite de archivos alcanzado:",
   "com_ui_attach_error_openai": "No se pueden adjuntar archivos del Asistente a otros puntos de conexión",
-  "com_ui_attach_error_size": "Se excedió el límite de tamaño de archivo para el endpoint:",
-  "com_ui_attach_error_type": "Tipo de archivo no admitido para el endpoint:",
+  "com_ui_attach_error_size": "Se superó el límite de tamaño de archivo para el endpoint:",
+  "com_ui_attach_error_total_size": "Se superó el límite de tamaño total de archivos para el endpoint:",
+  "com_ui_attach_error_type": "Tipo de archivo no compatible con el endpoint:",
   "com_ui_attach_remove": "Eliminar archivo",
-  "com_ui_attach_warn_endpoint": "Es posible que los archivos no compatibles con la herramienta sean ignorados",
+  "com_ui_attach_warn_endpoint": "Los archivos sin herramienta compatible podrían ser ignorados",
   "com_ui_attachment": "Adjunto",
-  "com_ui_auth_type": "Tipo de autorización",
+  "com_ui_auth_type": "Tipo de autenticación",
   "com_ui_authentication": "Autenticación",
+  "com_ui_available_options": "Opciones disponibles",
   "com_ui_avatar": "Avatar",
-  "com_ui_back_to_prompts": "Volver a las Indicaciones",
+  "com_ui_back_to_prompts": "Volver a Prompts",
   "com_ui_bookmark_delete_confirm": "¿Está seguro de que desea eliminar este marcador?",
   "com_ui_bookmarks": "Marcadores",
   "com_ui_bookmarks_add": "Agregar Marcadores",
@@ -555,25 +569,31 @@
   "com_ui_chat_history": "Historial de Chat",
   "com_ui_clear": "Limpiar",
   "com_ui_clear_all": "Limpiar todo",
+  "com_ui_click_to_edit": "Haga clic para editar",
   "com_ui_close": "Cerrar",
   "com_ui_close_menu": "Cerrar menú",
   "com_ui_code": "Código",
-  "com_ui_collapse_chat": "Contraer Chat",
-  "com_ui_command_placeholder": "Opcional: Ingrese un comando para la indicación o se utilizará el nombre",
-  "com_ui_command_usage_placeholder": "Seleccione una indicación por comando o nombre",
+  "com_ui_collapse_chat": "Contraer chat",
+  "com_ui_collapse_summary": "Contraer resumen",
+  "com_ui_command_placeholder": "Opcional: Ingrese un comando para el prompt o se utilizará el nombre",
+  "com_ui_command_usage_placeholder": "Seleccione un Prompt por comando o nombre",
+  "com_ui_complete": "¡Completado!",
   "com_ui_confirm_action": "Confirmar Acción",
   "com_ui_confirm_change": "Confirmar cambio",
   "com_ui_context": "Contexto",
   "com_ui_continue": "Continuar",
+  "com_ui_conversation_summarized": "Conversación resumida",
   "com_ui_copied": "¡Copiado!",
   "com_ui_copied_to_clipboard": "Copiado al portapapeles",
   "com_ui_copy_code": "Copiar código",
+  "com_ui_copy_failed": "Error al copiar al portapapeles",
   "com_ui_copy_link": "Copiar enlace",
+  "com_ui_copy_summary": "Copiar resumen al portapapeles",
   "com_ui_copy_to_clipboard": "Copiar al portapapeles",
   "com_ui_create": "Crear",
   "com_ui_create_link": "Crear enlace",
-  "com_ui_create_prompt": "Crear Indicación",
-  "com_ui_custom_prompt_mode": "Modo de Indicación Personalizado",
+  "com_ui_create_prompt": "Crear Prompt",
+  "com_ui_custom_prompt_mode": "Modo de prompt personalizado",
   "com_ui_date": "Fecha",
   "com_ui_date_april": "Abril",
   "com_ui_date_august": "Agosto",
@@ -598,15 +618,17 @@
   "com_ui_delete_agent_confirm": "¿Está seguro de que desea eliminar este agente?",
   "com_ui_delete_assistant_confirm": "¿Está seguro de que desea eliminar este Asistente? Esta acción no se puede deshacer.",
   "com_ui_delete_confirm": "Esto eliminará",
-  "com_ui_delete_confirm_prompt_version_var": "Esto eliminará la versión seleccionada para \"{{0}}\". Si no existen otras versiones, la indicación será eliminada.",
+  "com_ui_delete_confirm_prompt_version_var": "Esto eliminará la versión seleccionada para \"{{0}}\". Si no existen otras versiones, el prompt será eliminado.",
   "com_ui_delete_conversation": "¿Eliminar Chat?",
-  "com_ui_delete_prompt": "¿Eliminar Indicación?",
+  "com_ui_delete_prompt": "¿Eliminar Prompt?",
   "com_ui_delete_shared_link": "¿Eliminar enlace compartido?",
   "com_ui_delete_tool": "Eliminar Herramienta",
   "com_ui_delete_tool_confirm": "¿Está seguro de que desea eliminar esta herramienta?",
+  "com_ui_deploy": "Publicar",
   "com_ui_descending": "Desc",
   "com_ui_description": "Descripción",
-  "com_ui_description_placeholder": "Opcional: Ingrese una descripción para mostrar en la indicación",
+  "com_ui_description_placeholder": "Opcional: Ingrese una descripción para mostrar en el prompt",
+  "com_ui_details": "Detalles",
   "com_ui_download": "Descargar",
   "com_ui_download_error": "Hubo un error al descargar el archivo. Es posible que el archivo haya sido eliminado.",
   "com_ui_dropdown_variables": "Variables desplegables:",
@@ -616,19 +638,21 @@
   "com_ui_duplication_success": "Conversación duplicada exitosamente",
   "com_ui_edit": "Editar",
   "com_ui_endpoint": "Punto de conexión",
-  "com_ui_endpoint_menu": "Menú de Punto de Conexión LLM",
+  "com_ui_endpoint_menu": "Menú de endpoints LLM",
   "com_ui_enter": "Intro",
   "com_ui_enter_api_key": "Ingrese la clave API",
   "com_ui_enter_openapi_schema": "Ingrese su esquema OpenAPI aquí",
   "com_ui_error": "Error",
-  "com_ui_error_connection": "Error al conectarse al servidor. Intente actualizar la página.",
+  "com_ui_error_connection": "Error al conectar con el servidor. Intente recargar la página.",
   "com_ui_error_save_admin_settings": "Se produjo un error al guardar su configuración de administrador.",
   "com_ui_examples": "Ejemplos",
   "com_ui_export_convo_modal": "Exportar Conversación",
-  "com_ui_feedback_more": "Más....",
+  "com_ui_failed": "Fallido",
+  "com_ui_feedback_more": "Más...",
   "com_ui_field_required": "Este campo es obligatorio",
-  "com_ui_filter_prompts": "Filtrar Indicaciones",
-  "com_ui_filter_prompts_name": "Filtrar indicaciones por nombre",
+  "com_ui_file": "Archivo",
+  "com_ui_filter_prompts": "Filtrar Prompts",
+  "com_ui_filter_prompts_name": "Filtrar prompts por nombre",
   "com_ui_finance": "Finanzas",
   "com_ui_fork": "Bifurcar",
   "com_ui_fork_all_target": "Incluir todo desde/hacia aquí",
@@ -637,7 +661,7 @@
   "com_ui_fork_default": "Utilizar opción de bifurcación predeterminada",
   "com_ui_fork_error": "Hubo un error al bifurcar la conversación",
   "com_ui_fork_from_message": "Seleccione una opción de bifurcación",
-  "com_ui_fork_info_1": "com_ui_fork_info_1: 'Utilice esta configuración para bifurcar los mensajes con el comportamiento deseado.'",
+  "com_ui_fork_info_1": "Use esta configuración para bifurcar mensajes con el comportamiento deseado.",
   "com_ui_fork_info_2": "\"Bifurcar\" se refiere a crear una nueva conversación que comienza/termina desde mensajes específicos en la conversación actual, creando una copia según las opciones seleccionadas.",
   "com_ui_fork_info_3": "El término \"mensaje objetivo\" se refiere ya sea al mensaje desde el cual se abrió este popup, o, si marca \"{{0}}\", al último mensaje en la conversación.",
   "com_ui_fork_info_branches": "Esta opción bifurca los mensajes visibles, junto con las ramas relacionadas; en otras palabras, la ruta directa hacia el mensaje objetivo, incluyendo las ramas a lo largo de esa ruta.",
@@ -651,8 +675,9 @@
   "com_ui_fork_split_target": "Iniciar bifurcación aquí",
   "com_ui_fork_split_target_setting": "Iniciar bifurcación desde el mensaje objetivo de forma predeterminada",
   "com_ui_fork_success": "Se ha bifurcado la conversación con éxito",
-  "com_ui_fork_visible": "Mostrar únicamente mensajes visibles",
+  "com_ui_fork_visible": "Solo mensajes visibles",
   "com_ui_generating": "Generando...",
+  "com_ui_generating_image": "Generando imagen...",
   "com_ui_go_back": "Volver",
   "com_ui_go_to_conversation": "Ir a la conversación",
   "com_ui_good_afternoon": "Buenas tardes",
@@ -662,64 +687,90 @@
   "com_ui_host": "Host",
   "com_ui_idea": "Ideas",
   "com_ui_image_gen": "Gen Imágenes",
-  "com_ui_import_conversation_error": "Hubo un error al importar tus chats",
-  "com_ui_import_conversation_file_type_error": "com_ui_import_conversation_file_type_error: Tipo de archivo no compatible para importar",
-  "com_ui_import_conversation_info": "Importar chats de un archivo JSON",
-  "com_ui_import_conversation_success": "Chats importados exitosamente",
+  "com_ui_image_gen_failed": "Error al generar la imagen",
+  "com_ui_import_conversation_error": "Hubo un error al importar las conversaciones",
+  "com_ui_import_conversation_file_type_error": "Tipo de archivo no compatible para importar",
+  "com_ui_import_conversation_info": "Importar conversaciones desde un archivo JSON",
+  "com_ui_import_conversation_success": "Conversaciones importadas con éxito",
   "com_ui_include_shadcnui": "Incluir instrucciones de componentes shadcn/ui",
   "com_ui_input": "Entrada",
   "com_ui_instructions": "Instrucciones",
+  "com_ui_labels": "Etiquetas",
+  "com_ui_latest": "más reciente",
   "com_ui_latest_footer": "IA para todos.",
   "com_ui_latest_version": "Última versión",
+  "com_ui_live": "en vivo",
   "com_ui_loading": "Cargando...",
   "com_ui_locked": "Bloqueado",
   "com_ui_logo": "Logotipo de {{0}}",
+  "com_ui_make_production": "Establecer como producción",
   "com_ui_manage": "Administrar",
+  "com_ui_marketplace": "Tienda",
+  "com_ui_marketplace_allow_use": "Permitir el uso de la Tienda",
+  "com_ui_max": "Máximo",
   "com_ui_max_tags": "El número máximo permitido es {{0}}, utilizando los valores más recientes.",
-  "com_ui_mention": "Menciona un punto de conexión, asistente o preconfiguración para cambiar rápidamente a él.",
+  "com_ui_mention": "Mencione un endpoint, asistente o configuración preestablecida para cambiar rápidamente",
   "com_ui_min_tags": "No se pueden eliminar más valores, se requiere un mínimo de {{0}}.",
   "com_ui_model": "Modelo",
-  "com_ui_model_parameters": "Parámetros del Modelo",
+  "com_ui_model_parameters": "Parámetros del modelo",
   "com_ui_more_info": "Más información",
-  "com_ui_my_prompts": "Mis Indicaciones",
+  "com_ui_my_prompts": "Mis Prompts",
   "com_ui_name": "Nombre",
+  "com_ui_navigate_results": "Navegar por los resultados",
   "com_ui_new": "Nuevo",
-  "com_ui_new_chat": "Nuevo Chat",
-  "com_ui_new_conversation_title": "Título de Nueva Conversación",
+  "com_ui_new_chat": "Nuevo chat",
+  "com_ui_new_conversation_title": "Título de nueva conversación",
   "com_ui_next": "Sig",
+  "com_ui_next_result": "Resultado siguiente",
   "com_ui_no": "No",
-  "com_ui_no_bookmarks": "Parece que aún no tiene marcadores. Haga clic en un chat y agregue uno nuevo",
+  "com_ui_no_bookmarks": "Parece que aún no tiene marcadores. Haga clic en un chat y agregue uno.",
   "com_ui_no_category": "Sin categoría",
+  "com_ui_no_labels": "Sin etiquetas",
   "com_ui_no_terms_content": "No hay contenido de términos y condiciones para mostrar",
   "com_ui_none": "Ninguno",
   "com_ui_nothing_found": "No se encontró nada",
   "com_ui_of": "de",
   "com_ui_off": "Desactivado",
-  "com_ui_on": "Encendido",
+  "com_ui_on": "Activado",
+  "com_ui_options": "opciones",
+  "com_ui_output": "Salida",
   "com_ui_page": "Página",
+  "com_ui_pagination": "Paginación",
+  "com_ui_parameters": "Parámetros",
+  "com_ui_pin": "Anclar",
   "com_ui_prev": "Ant",
+  "com_ui_prev_result": "Resultado anterior",
   "com_ui_preview": "Previsualizar",
+  "com_ui_preview_unavailable": "Vista previa no disponible para este tipo de archivo",
   "com_ui_privacy_policy": "Política de privacidad",
   "com_ui_privacy_policy_url": "URL de la Política de Privacidad",
-  "com_ui_prompt": "Indicación",
-  "com_ui_prompt_name": "Nombre de la Indicación",
-  "com_ui_prompt_name_required": "El nombre de la indicación es obligatorio",
-  "com_ui_prompt_preview_not_shared": "El autor no ha permitido la colaboración para esta indicación",
+  "com_ui_production": "Producción",
+  "com_ui_prompt": "Prompt",
+  "com_ui_prompt_category_selector_aria": "Selector de categoría del prompt",
+  "com_ui_prompt_delete_confirm": "¿Está seguro de que desea eliminar el prompt '{{0}}'?",
+  "com_ui_prompt_deleted_group": "Grupo de prompts \"{{0}}\" eliminado",
+  "com_ui_prompt_details": "Detalles del prompt {{name}}",
+  "com_ui_prompt_name": "Nombre del Prompt",
+  "com_ui_prompt_name_required": "El nombre del prompt es obligatorio",
+  "com_ui_prompt_preview_not_shared": "El autor no ha permitido la colaboración para este prompt",
   "com_ui_prompt_text": "Texto",
   "com_ui_prompt_text_required": "El texto es obligatorio",
-  "com_ui_prompt_update_error": "Hubo un error al actualizar la indicación",
-  "com_ui_prompts": "Indicaciones",
-  "com_ui_prompts_allow_create": "Permitir crear Indicaciones",
-  "com_ui_prompts_allow_use": "Permitir uso de Indicaciones",
+  "com_ui_prompt_update_error": "Hubo un error al actualizar el prompt",
+  "com_ui_prompt_variables_list": "Lista de variables del prompt",
+  "com_ui_prompts": "Prompts",
+  "com_ui_prompts_allow_create": "Permitir crear prompts",
+  "com_ui_prompts_allow_use": "Permitir usar prompts",
   "com_ui_provider": "Proveedor",
   "com_ui_read_aloud": "Leer en voz alta",
   "com_ui_regenerate": "Regenerar",
   "com_ui_regenerating": "Regenerando...",
   "com_ui_region": "Región",
+  "com_ui_relevance": "Relevancia",
   "com_ui_rename": "Renombrar",
   "com_ui_rename_conversation": "Renombrar conversación",
   "com_ui_reset_var": "Restablecer {{0}}",
   "com_ui_result": "Resultado",
+  "com_ui_retrieved_files": "Se buscó en sus archivos",
   "com_ui_revoke": "Revocar",
   "com_ui_revoke_info": "Revocar todas las credenciales proporcionadas por el usuario",
   "com_ui_revoke_key_confirm": "¿Está seguro de que desea revocar esta clave?",
@@ -729,12 +780,17 @@
   "com_ui_role_select": "Rol",
   "com_ui_run_code": "Ejecutar código",
   "com_ui_run_code_error": "Se produjo un error al ejecutar el código",
+  "com_ui_running": "Ejecutando...",
   "com_ui_save": "Guardar",
   "com_ui_save_submit": "Guardar y Enviar",
   "com_ui_saved": "¡Guardado!",
   "com_ui_schema": "Esquema",
   "com_ui_search": "Buscar",
   "com_ui_search_agent_category": "Buscar categorías...",
+  "com_ui_search_result_count": "{{count}} resultado encontrado",
+  "com_ui_search_results_count": "{{count}} resultados encontrados",
+  "com_ui_searching_files": "Buscando en sus archivos",
+  "com_ui_seconds": "segundos",
   "com_ui_select": "Seleccionar",
   "com_ui_select_file": "Seleccionar un archivo",
   "com_ui_select_model": "Seleccionar un modelo",
@@ -744,62 +800,113 @@
   "com_ui_select_search_model": "Buscar modelo por nombre",
   "com_ui_select_search_provider": "Buscar proveedor por nombre",
   "com_ui_select_search_region": "Buscar región por nombre",
+  "com_ui_set": "Set",
   "com_ui_share": "Compartir",
   "com_ui_share_create_message": "Tu nombre y cualquier mensaje que agregues después de compartir se mantendrán privados.",
   "com_ui_share_delete_error": "Hubo un error al eliminar el enlace compartido.",
   "com_ui_share_error": "Hubo un error al compartir el enlace del chat",
-  "com_ui_share_link_to_chat": "Compartir enlace en el chat",
+  "com_ui_share_link_to_chat": "Compartir enlace del chat",
   "com_ui_share_update_message": "Tu nombre, instrucciones personalizadas y cualquier mensaje que agregues después de compartir se mantendrán privados.",
   "com_ui_share_var": "Compartir {{0}}",
   "com_ui_shared_link_not_found": "Enlace compartido no encontrado",
-  "com_ui_shared_prompts": "Indicaciones Compartidas",
+  "com_ui_shared_prompts": "Prompts compartidos",
   "com_ui_shop": "Compras",
+  "com_ui_show": "Mostrar",
   "com_ui_show_all": "Mostrar Todo",
+  "com_ui_show_less": "Mostrar menos",
+  "com_ui_show_more": "Mostrar más",
   "com_ui_simple": "Simple",
   "com_ui_size": "Tamaño",
-  "com_ui_special_variables": "Variables especiales:",
+  "com_ui_size_sort": "Ordenar por Tamaño",
+  "com_ui_special": "especial",
+  "com_ui_special_var_current_date": "Fecha actual",
+  "com_ui_special_var_current_user": "Usuario actual",
+  "com_ui_special_var_desc_current_date": "Fecha actual y día de la semana",
+  "com_ui_special_var_desc_current_datetime": "Fecha y hora local en su zona horaria",
+  "com_ui_special_var_desc_current_user": "Nombre de visualización de su cuenta",
+  "com_ui_special_var_desc_iso_datetime": "Fecha y hora UTC en formato ISO 8601",
+  "com_ui_special_variables": "Variables especiales",
   "com_ui_speech_while_submitting": "No se puede enviar un mensaje de voz mientras se está generando una respuesta",
+  "com_ui_status_prefix": "Estado:",
   "com_ui_stop": "Detener",
   "com_ui_storage": "Almacenamiento",
   "com_ui_submit": "Enviar",
+  "com_ui_summarizing": "Resumiendo...",
+  "com_ui_support_contact_email_placeholder": "support@example.com",
+  "com_ui_support_contact_name": "Nombre",
   "com_ui_teach_or_explain": "Aprendizaje",
   "com_ui_terms_and_conditions": "Términos y Condiciones",
   "com_ui_terms_of_service": "Términos de servicio",
+  "com_ui_text_variables": "Variables de texto",
   "com_ui_thinking": "Pensando...",
   "com_ui_thoughts": "Pensamientos",
+  "com_ui_token": "token",
+  "com_ui_tokens": "tokens",
+  "com_ui_tool_failed": "falló",
+  "com_ui_tool_name_code": "Código",
+  "com_ui_tool_name_code_analysis": "Análisis de código",
+  "com_ui_tool_name_file_search": "Búsqueda de archivos",
+  "com_ui_tool_name_image_edit": "Edición de imagen",
+  "com_ui_tool_name_image_gen": "Generación de imagen",
+  "com_ui_tool_name_web_search": "Búsqueda web",
   "com_ui_tools": "Herramientas",
   "com_ui_travel": "Viaje",
   "com_ui_unarchive": "Desarchivar",
+  "com_ui_unarchive_conversation": "Desarchivar conversacion",
   "com_ui_unarchive_error": "Error al desarchivar la conversación",
+  "com_ui_unavailable": "No disponible",
   "com_ui_unknown": "Desconocido",
+  "com_ui_unpin": "Desanclar",
+  "com_ui_untitled": "Sin Titulo",
   "com_ui_update": "Actualizar",
+  "com_ui_update_mcp_server": "Actualizar servidor de MCP",
+  "com_ui_updating": "Actualizando…",
   "com_ui_upload": "Subir",
+  "com_ui_upload_agent_avatar_label": "Subir imagen de Avatar de agente",
   "com_ui_upload_delay": "La carga de \"{{0}}\" está tomando más tiempo del esperado. Espere mientras el archivo termina de indexarse para su recuperación.",
   "com_ui_upload_error": "Hubo un error al subir su archivo",
   "com_ui_upload_file_search": "Subir para búsqueda de archivos",
   "com_ui_upload_files": "Subir archivos",
+  "com_ui_upload_icon": "Subir imagen de ícono",
   "com_ui_upload_image": "Subir una imagen",
   "com_ui_upload_image_input": "Subir imagen",
   "com_ui_upload_invalid": "Archivo no válido para subir. Debe ser una imagen que no exceda el límite",
   "com_ui_upload_invalid_var": "Archivo inválido para subir. Debe ser una imagen que no exceda los {{0}} MB",
+  "com_ui_upload_ocr_text": "Subir como texto",
   "com_ui_upload_success": "Archivo subido con éxito",
   "com_ui_upload_type": "Seleccionar tipo de carga",
+  "com_ui_usage": "Uso",
+  "com_ui_use_memory": "Usar Memoria",
   "com_ui_use_micrphone": "Usar micrófono",
+  "com_ui_use_prompt": "Usar Prompt",
+  "com_ui_used": "Usado",
+  "com_ui_used_n_tools": "Se usaron {{0}} herramientas",
+  "com_ui_user": "Usuarios",
+  "com_ui_user_provides_key": "Cada usuario provee su propia key",
+  "com_ui_value": "Valores",
+  "com_ui_variable_with_options": "Variable {{name}} con {{count}} opciones",
   "com_ui_variables": "Variables",
   "com_ui_verify": "Verificar",
   "com_ui_version_var": "Versión {{0}}",
   "com_ui_versions": "Versiones",
-  "com_ui_web_searching": "Buscando en internet",
-  "com_ui_web_searching_again": "Buscando en internet nuevamente",
+  "com_ui_via_server": "en {{0}}",
+  "com_ui_view_memory": "Ver memoria",
+  "com_ui_web_search_reranker_cohere_key": "Obtén tu clave API de Cohere",
+  "com_ui_web_search_searxng_instance_url": "URL de la instancia de SearXNG",
+  "com_ui_web_search_source": "{{count}} fuente",
+  "com_ui_web_search_sources": "{{count}} fuentes",
+  "com_ui_web_searched": "Se buscó en la web",
+  "com_ui_web_searching": "Buscando en la web",
+  "com_ui_web_searching_again": "Buscando en la web nuevamente",
   "com_ui_weekend_morning": "Feliz fin de semana",
   "com_ui_write": "Escribiendo",
   "com_ui_x_selected": "{{0}} seleccionado",
-  "com_ui_xhigh": "Extra High",
+  "com_ui_xhigh": "Extra alto",
   "com_ui_yes": "Sí",
-  "com_ui_your_api_key": "Tu API Key",
+  "com_ui_your_api_key": "Su clave API",
   "com_ui_zoom": "Zoom",
-  "com_ui_zoom_in": "Menos Zoom",
-  "com_ui_zoom_level": "Nivelar Zoom",
-  "com_ui_zoom_out": "Mas Zoom",
+  "com_ui_zoom_in": "Acercar",
+  "com_ui_zoom_level": "Nivel de zoom",
+  "com_ui_zoom_out": "Alejar",
   "com_user_message": "Usted"
 }
diff --git a/client/src/locales/fr/translation.json b/client/src/locales/fr/translation.json
index 4a9f2f56dca..a47f2ff6b8c 100644
--- a/client/src/locales/fr/translation.json
+++ b/client/src/locales/fr/translation.json
@@ -1,9 +1,13 @@
 {
-  "chat_direction_left_to_right": "il faut mettre quelque chose ici. c'était vide.",
-  "chat_direction_right_to_left": "Il faut mettre quelque chose ici. C'était vide.",
+  "chat_direction_left_to_right": "De gauche à droite",
+  "chat_direction_right_to_left": "De droite à gauche",
   "com_a11y_ai_composing": "L'IA est en train de réfléchir",
+  "com_a11y_chats_date_section": "Conversations du {{date}}",
   "com_a11y_end": "L'IA a terminé sa réponse",
+  "com_a11y_selected": "sélectionné",
   "com_a11y_start": "L'IA a commencé sa réponse",
+  "com_a11y_summarize_completed": "Contexte résumé.",
+  "com_a11y_summarize_failed": "Le résumé a échoué, poursuite avec le contexte disponible.",
   "com_agents_agent_card_label": "{{nom}} agent. {{description}}",
   "com_agents_all": "Tous les agents",
   "com_agents_all_category": "Tous",
@@ -14,7 +18,7 @@
   "com_agents_category_empty": "Aucun agent trouvé dans la catégorie {{category}}",
   "com_agents_category_finance": "Finance",
   "com_agents_category_finance_description": "Agents spécialisés dans l'analyse financière, la budgétisation et la comptabilité",
-  "com_agents_category_general": "Générale",
+  "com_agents_category_general": "Général",
   "com_agents_category_general_description": "Agents génériques pour tâches et requêtes standards",
   "com_agents_category_hr": "Ressources Humaines",
   "com_agents_category_hr_description": "Agents spécialisés dans les procédures RH, les politiques et le soutien aux employés",
@@ -28,9 +32,11 @@
   "com_agents_category_tabs_label": "Catégories d'agent",
   "com_agents_chat_with": "Chatter avec {{name}}",
   "com_agents_clear_search": "Effacer la recherche",
+  "com_agents_contact": "Contact",
   "com_agents_copy_link": "Copier le lien",
   "com_agents_create_error": "Une erreur s'est produite lors de la création de votre agent.",
   "com_agents_created_by": "par",
+  "com_agents_description_card": "Description : {{description}}",
   "com_agents_description_placeholder": "Décrivez votre Agent ici (facultatif)",
   "com_agents_empty_state_heading": "Aucun agent trouvé",
   "com_agents_enable_file_search": "Activer la recherche de fichiers",
@@ -60,7 +66,7 @@
   "com_agents_file_context_description": "Les fichiers uploadés comme \"Contexte\" sont traités en tant que texte pour compléter les instructions de l'agent. Si l'OCR est configuré pour le type de fichier uploadé, il est utilisé pour extraire le texte. Parfait pour les documents, les images avec du texte ou les PDF où vous avez besoin du contenu textuel complet d'un fichier.",
   "com_agents_file_context_disabled": "L'agent doit être créé avant de charger des fichiers pour le contexte de fichiers.",
   "com_agents_file_context_label": "Contexte de fichiers",
-  "com_agents_file_search_disabled": "L'agent doit être créé avant de pouvoir télécharger des fichiers pour la Recherche de Fichiers.",
+  "com_agents_file_search_disabled": "L'agent doit être créé avant de pouvoir téléverser des fichiers pour la Recherche de fichiers.",
   "com_agents_file_search_info": "Lorsque cette option est activée, l'agent sera informé des noms exacts des fichiers listés ci-dessous, lui permettant d'extraire le contexte pertinent de ces fichiers.",
   "com_agents_grid_announcement": "{{count}} agents affichés dans la catégorie {{category}}",
   "com_agents_instructions_placeholder": "Les instructions système que l'agent utilise",
@@ -69,7 +75,7 @@
   "com_agents_load_more_label": "Afficher plus d'agents de la catégorie {{category}}",
   "com_agents_loading": "Chargement...",
   "com_agents_marketplace": "Marketplace d'Agents",
-  "com_agents_marketplace_subtitle": "Découvres et profites d'agents IA puissants pour améliorer tes processus et ta productivité",
+  "com_agents_marketplace_subtitle": "Découvrez et profitez d'agents IA puissants pour améliorer vos processus et votre productivité.",
   "com_agents_mcp_description_placeholder": "Décrivez ce qu'il fait en quelques mots",
   "com_agents_mcp_icon_size": "Taille minimale de 128 x 128 pixels",
   "com_agents_mcp_name_placeholder": "Outil personnalisé",
@@ -136,6 +142,7 @@
   "com_assistants_update_actions_success": "Action créée ou mise à jour avec succès",
   "com_assistants_update_error": "Une erreur s'est produite lors de la mise à jour de votre assistant.",
   "com_assistants_update_success": "Mise à jour réussie",
+  "com_assistants_update_success_name": "{{name}} mis à jour avec succès",
   "com_auth_already_have_account": "Vous avez déjà un compte ?",
   "com_auth_apple_login": "S'identifier avec Apple",
   "com_auth_back_to_login": "Retour à la connexion",
@@ -213,10 +220,11 @@
   "com_endpoint_agent": "Agent",
   "com_endpoint_agent_placeholder": "Veuillez sélectionner un Agent",
   "com_endpoint_ai": "IA",
+  "com_endpoint_anthropic_effort": "Contrôle la puissance de calcul que Claude utilise. Un effort réduit économise des jetons et réduit la latence ; un effort élevé produit des réponses plus approfondies. « Max » active le raisonnement le plus profond (Opus 4.6 uniquement).",
   "com_endpoint_anthropic_maxoutputtokens": "Nombre maximum de jetons qui peuvent être générés dans la réponse. Spécifiez une valeur plus faible pour des réponses plus courtes et une valeur plus élevée pour des réponses plus longues.",
   "com_endpoint_anthropic_prompt_cache": "La mise en cache des prompts permet de réutiliser les contextes ou instructions volumineux entre les appels API, réduisant ainsi les coûts et la latence",
   "com_endpoint_anthropic_temp": "Varie de 0 à 1. Utilisez une température proche de 0 pour l'analyse / le choix multiple, et proche de 1 pour les tâches créatives et génératives. Nous vous recommandons de modifier ceci ou Top P mais pas les deux.",
-  "com_endpoint_anthropic_thinking": "Activez le raisonnement pour les modèles Claude pris en charge (3.7 Sonnet). Note : nécessite que le \"l'option de réflexion\" soit activée et inférieur au \"nombre maximum de jetons de sortie\".",
+  "com_endpoint_anthropic_thinking": "Active le raisonnement interne pour les modèles Claude pris en charge. Pour les modèles récents (Opus 4.6+), utilise une réflexion adaptative contrôlée par le paramètre Effort. Pour les modèles antérieurs, nécessite que le \"Budget de réflexion\" soit défini et inférieur au \"Nombre maximum de jetons de sortie\".",
   "com_endpoint_anthropic_thinking_budget": "Détermine le nombre maximum de jetons que Claude est autorisé à utiliser pour son processus de raisonnement interne. Des budgets plus importants peuvent améliorer la qualité des réponses en permettant une analyse plus approfondie des problèmes complexes, bien que Claude puisse ne pas utiliser la totalité du budget alloué, en particulier dans les plages supérieures à 32K. Ce paramètre doit être inférieur à \"Max Output Tokens\".",
   "com_endpoint_anthropic_topk": "Top-k change la façon dont le modèle sélectionne les jetons pour la sortie. Un top-k de 1 signifie que le jeton sélectionné est le plus probable parmi tous les jetons du vocabulaire du modèle (également appelé décodage glouton), tandis qu'un top-k de 3 signifie que le jeton suivant est sélectionné parmi les 3 jetons les plus probables (en utilisant la température).",
   "com_endpoint_anthropic_topp": "Top-p change la façon dont le modèle sélectionne les jetons pour la sortie. Les jetons sont sélectionnés du plus K (voir le paramètre topK) probable au moins jusqu'à ce que la somme de leurs probabilités égale la valeur top-p.",
@@ -224,6 +232,7 @@
   "com_endpoint_assistant": "Assistant de point de terminaison",
   "com_endpoint_assistant_model": "Modèle d'assistant",
   "com_endpoint_assistant_placeholder": "Veuillez sélectionner un assistant dans le panneau latéral droit",
+  "com_endpoint_bedrock_reasoning_effort": "Contrôle le niveau de raisonnement pour les modèles Bedrock compatibles (ex. Kimi K2.5, GLM). Des niveaux plus élevés produisent un raisonnement plus approfondi au prix d'une latence et d'une consommation de jetons accrues.",
   "com_endpoint_config_click_here": "Cliquez ici",
   "com_endpoint_config_google_api_info": "Pour obtenir votre clé API de langage génératif (pour Gemini),",
   "com_endpoint_config_google_api_key": "Clé API Google",
@@ -252,7 +261,9 @@
   "com_endpoint_default": "par défaut",
   "com_endpoint_default_blank": "par défaut : vide",
   "com_endpoint_default_with_num": "par défaut : {{0}}",
+  "com_endpoint_disable_streaming": "Désactiver le streaming des réponses et recevoir la réponse complète en une seule fois. Utile pour les modèles comme o3 qui nécessitent une vérification d'organisation pour le streaming.",
   "com_endpoint_disable_streaming_label": "Désactiver le streaming",
+  "com_endpoint_effort": "Effort",
   "com_endpoint_examples": " Exemples",
   "com_endpoint_export": "Exporter",
   "com_endpoint_export_share": "Exporter/Partager",
@@ -260,8 +271,9 @@
   "com_endpoint_google_custom_name_placeholder": "Définir un nom personnalisé pour Google",
   "com_endpoint_google_maxoutputtokens": "Nombre maximum de jetons qui peuvent être générés dans la réponse. Spécifiez une valeur plus faible pour des réponses plus courtes et une valeur plus élevée pour des réponses plus longues.",
   "com_endpoint_google_temp": "Des valeurs plus élevées = plus aléatoires, tandis que des valeurs plus faibles = plus concentrées et déterministes. Nous vous recommandons de modifier ceci ou Top P mais pas les deux.",
-  "com_endpoint_google_thinking": "Active / désactive le raisonnement. Ce réglage n'est pris en charge que par certains modèles (de la série des 2.5). Pour les modèles plus anciens, ce réglage peut n'avoir aucun effet ou l'empêcher de fonctionner.",
-  "com_endpoint_google_thinking_budget": "Indique au modèle sur le nombre de jetons à utiliser pour la réflexion. Selon le message, le nombre de jetons effectivement consommés peut être supérieur ou inférieur à la valeur spécifiée.\n\nCe réglage n'est pris en charge que par certains modèles (de la série des 2.5). Gemini 2.5 Pro accepte une valeur comprise entre 128 et 32 768 jetons. Gemini 2.5 Flash accepte entre 0 et 24 576 jetons. Gemini 2.5 Flash Lite accepte entre 512 et 24 576 jetons.\n\nLaissez vide ou avec une valeur de \"-1\" pour laisser le model décider seul s'il doit réfléchir et à quel point il doit réfléchir. Par défaut, Gemini 2.5 Flash Lite ne réfléchit pas.",
+  "com_endpoint_google_thinking": "Active ou désactive le raisonnement. Pris en charge par les séries Gemini 2.5 et 3. Remarque : Gemini 3 Pro ne peut pas désactiver complètement la réflexion.",
+  "com_endpoint_google_thinking_budget": "Indique le nombre de jetons de réflexion que le modèle utilise. Le nombre effectif peut être supérieur ou inférieur à cette valeur selon le prompt.\n\nCe réglage ne s'applique qu'aux modèles Gemini 2.5 et antérieurs. Pour Gemini 3 et les versions suivantes, utilisez plutôt le paramètre Niveau de réflexion.\n\nGemini 2.5 Pro accepte entre 128 et 32 768 jetons. Gemini 2.5 Flash accepte entre 0 et 24 576 jetons. Gemini 2.5 Flash Lite accepte entre 512 et 24 576 jetons.\n\nLaissez vide ou saisissez \"-1\" pour laisser le modèle décider automatiquement quand et combien réfléchir. Par défaut, Gemini 2.5 Flash Lite ne réfléchit pas.",
+  "com_endpoint_google_thinking_level": "Contrôle la profondeur de raisonnement pour les modèles Gemini 3 et ultérieurs. N'a aucun effet sur Gemini 2.5 et les versions antérieures, utilisez le budget de réflexion pour ceux-ci.\n\nLaissez sur Auto pour utiliser la valeur par défaut du modèle.",
   "com_endpoint_google_topk": "Top-k change la façon dont le modèle sélectionne les jetons pour la sortie. Un top-k de 1 signifie que le jeton sélectionné est le plus probable parmi tous les jetons du vocabulaire du modèle (également appelé décodage glouton), tandis qu'un top-k de 3 signifie que le jeton suivant est sélectionné parmi les 3 jetons les plus probables (en utilisant la température).",
   "com_endpoint_google_topp": "Top-p change la façon dont le modèle sélectionne les jetons pour la sortie. Les jetons sont sélectionnés du plus K (voir le paramètre topK) probable au moins jusqu'à ce que la somme de leurs probabilités égale la valeur top-p.",
   "com_endpoint_google_use_search_grounding": "Utilise la fonctionnalité d'ancrage aux recherches de google pour ajouter des résultats de recherches web en temps réels aux réponses. Cela permet aux modèles d'accéder aux informations récentes et de fournir une réponse plus précise et à jour.",
@@ -289,6 +301,7 @@
   "com_endpoint_openai_topp": "Une alternative à l'échantillonnage avec température, appelée échantillonnage du noyau, où le modèle considère les résultats des jetons avec une masse de probabilité top_p. Ainsi, 0,1 signifie que seuls les jetons représentant les 10 % de masse de probabilité les plus élevés sont pris en compte. Nous vous recommandons de modifier ceci ou la température mais pas les deux.",
   "com_endpoint_openai_use_responses_api": "Utilise l'API de Réponses plutôt que la completion de messages, ce qui offre plus de fonctionnalités auprès d'OpenAI. Obligatoire pour o1-pro, o3-pro et pour activer la synthèse du raisonnement",
   "com_endpoint_openai_use_web_search": "Activer l'utilisation des capacités de recherche de OpenAI pour faire des recherches web. Cela permet au modèle de chercher des informations récentes sur internet et de fournir des réponses plus précises.",
+  "com_endpoint_openai_verbosity": "Contrôle la verbosité de la réponse du modèle. Des valeurs plus basses produisent des réponses plus concises, tandis que des valeurs plus élevées produisent des réponses plus détaillées. Les valeurs actuellement prises en charge sont faible, moyen et élevé.",
   "com_endpoint_output": "Sortie",
   "com_endpoint_plug_image_detail": "Détail de l'image",
   "com_endpoint_plug_resend_files": "Renvoyer les fichiers",
@@ -301,6 +314,7 @@
   "com_endpoint_preset_default_removed": "n'est plus le préréglage par défaut.",
   "com_endpoint_preset_delete_confirm": "Êtes-vous sûr de vouloir supprimer ce préréglage?",
   "com_endpoint_preset_delete_error": "Il y a eu une erreur lors de la suppression de votre préréglage. Veuillez réessayer.",
+  "com_endpoint_preset_delete_success": "Préréglage supprimé avec succès",
   "com_endpoint_preset_import": "Préréglage importé!",
   "com_endpoint_preset_import_error": "Il y a eu une erreur lors de l'importation de votre préréglage. Veuillez réessayer.",
   "com_endpoint_preset_name": "Nom du préréglage",
@@ -328,6 +342,7 @@
   "com_endpoint_temperature": "Température",
   "com_endpoint_thinking": "Je réfléchi",
   "com_endpoint_thinking_budget": "Budget de réflexion",
+  "com_endpoint_thinking_level": "Niveau de réflexion",
   "com_endpoint_top_k": "Top K",
   "com_endpoint_top_p": "Top P",
   "com_endpoint_use_active_assistant": "Utiliser l'assistant actif",
@@ -341,19 +356,22 @@
   "com_error_files_process": "Une erreur s'est produite lors du traitement du fichier.",
   "com_error_files_upload": "Une erreur s'est produite lors du téléversement du fichier",
   "com_error_files_upload_canceled": "La demande de téléversement du fichier a été annulée. Remarque : le téléversement peut être toujours en cours de traitement et devra être supprimé manuellement.",
-  "com_error_files_upload_too_large": "Le fichier est trop volumineux. Veuillez télécharger un fichier de moins de {{0}} Mo.",
+  "com_error_files_upload_too_large": "Le fichier est trop volumineux. Veuillez téléverser un fichier de moins de {{0}} Mo.",
   "com_error_files_validation": "Une erreur s'est produite lors de la validation du fichier.",
   "com_error_google_tool_conflict": "L'utilisation combinée des outils intégrés de Google et d'outils externes n'est pas prise en charge. Veuillez désactiver soit les outils intégrés soit les outils externes.",
   "com_error_heic_conversion": "La conversion de l'image HEIC en JPEG a échoué. Essayez de convertir l'image manuellement ou utilisez un autre format.",
   "com_error_illegal_model_request": "Le modèle \"{{0}}\" n'est pas disponible pour {{1}}. Veuillez sélectionner un autre modèle.",
   "com_error_input_length": "Le nombre de jetons du dernier message est trop élevé et dépasse la limite autorisée ({{0}}). Veuillez raccourcir votre message, ajuster la taille maximale du contexte dans les paramètres de conversation, ou créer une nouvelle conversation pour continuer.",
   "com_error_invalid_agent_provider": "Le \"fournisseur {{0}} \" n'est pas disponible pour les agents. Veuillez vous rendre dans les paramètres de votre agent et sélectionner un fournisseur actuellement disponible.",
+  "com_error_invalid_base_url": "L'URL de base fournie cible une adresse restreinte. Veuillez utiliser une URL externe valide et réessayer.",
   "com_error_invalid_user_key": "Clé fournie non valide. Veuillez fournir une clé valide et réessayer.",
   "com_error_missing_model": "Aucun modele pour {{0}}, Veuillez sélectionner un modèle et réessayer. ",
   "com_error_models_not_loaded": "Impossible de charger la configuration des modèles. Rafraîchissez la page et essayez à nouveau.",
   "com_error_moderation": "Il semble que le contenu soumis ait été signalé par notre système de modération pour ne pas être conforme à nos lignes directrices communautaires. Nous ne pouvons pas procéder avec ce sujet spécifique. Si vous avez d'autres questions ou sujets que vous souhaitez explorer, veuillez modifier votre message ou créer une nouvelle conversation.",
   "com_error_no_base_url": "Aucune URL de base trouvée. Veuillez en fournir une et réessayer.",
   "com_error_no_user_key": "Aucune clé trouvée. Veuillez fournir une clé et réessayer.",
+  "com_error_refusal": "Réponse refusée par les filtres de sécurité. Reformulez votre message et réessayez. Si vous rencontrez cela fréquemment avec Claude Sonnet 4.5 ou Opus 4.1, vous pouvez essayer Sonnet 4, qui a des restrictions d'utilisation différentes.",
+  "com_error_stream_expired": "Le flux de réponse a expiré ou est déjà terminé. Veuillez réessayer.",
   "com_file_pages": "Pages: {{pages}}",
   "com_file_source": "Fichier",
   "com_file_unknown": "Fichier Inconnu\n",
@@ -366,8 +384,10 @@
   "com_files_no_results": "Aucun résultat.",
   "com_files_number_selected": "{{0}} sur {{1}} fichier(s) sélectionné(s)",
   "com_files_preparing_download": "Préparation du téléchargement",
+  "com_files_result_found": "{{count}} résultat trouvé",
+  "com_files_results_found": "{{count}} résultats trouvés",
   "com_files_sharepoint_picker_title": "Sélectionner un fichier",
-  "com_files_table": "quelquechose doit être renseigné ici. c'était vide",
+  "com_files_table": "Tableau des fichiers",
   "com_files_upload_local_machine": "Depuis ordinateur local",
   "com_files_upload_sharepoint": "Depuis Sharepoint",
   "com_generated_files": "Fichiers générés :",
@@ -375,7 +395,7 @@
   "com_info_heic_converting": "Convertir les images HEIC en JPEG...",
   "com_nav_2fa": "Authentification à deux facteurs (2FA)",
   "com_nav_account_settings": "Paramètres du compte",
-  "com_nav_always_make_prod": "Rendre toujours les nouvelles versions en production",
+  "com_nav_always_make_prod": "Toujours mettre les nouvelles versions de prompts en production",
   "com_nav_archive_created_at": "Créé Le",
   "com_nav_archive_name": "Nom",
   "com_nav_archived_chats": "Conversations archivées",
@@ -384,7 +404,8 @@
   "com_nav_audio_play_error": "Erreur de lecture audio : {{0}}",
   "com_nav_audio_process_error": "Erreur de traitement audio : {{0}}",
   "com_nav_auto_scroll": "Défilement automatique jusqu'au plus récent à l'ouverture",
-  "com_nav_auto_send_prompts": "Envoi automatique des prompts",
+  "com_nav_auto_send_prompts": "Envoyer les prompts à la sélection",
+  "com_nav_auto_send_prompts_desc": "Envoyer automatiquement le prompt dans la conversation lorsqu'il est sélectionné",
   "com_nav_auto_send_text": "Envoi automatique du texte (après 3 sec)",
   "com_nav_auto_transcribe_audio": "Transcription audio automatique",
   "com_nav_automatic_playback": "Lecture automatique du dernier message (externe seulement)",
@@ -416,6 +437,7 @@
   "com_nav_chat_commands": "Commandes de chat",
   "com_nav_chat_commands_info": "Ces commandes sont activées en tapant des caractères spécifiques au début de votre message. Chaque commande est déclenchée par son préfixe désigné. Vous pouvez les désactiver si vous utilisez fréquemment ces caractères pour commencer vos messages.",
   "com_nav_chat_direction": "Direction de la conversation",
+  "com_nav_chat_direction_selected": "Direction de la conversation : {{direction}}",
   "com_nav_clear_all_chats": "Effacer toutes les conversations",
   "com_nav_clear_cache_confirm_message": "Êtes-vous sûr de vouloir vider le cache ?",
   "com_nav_clear_conversation": "Effacer les conversations",
@@ -423,9 +445,11 @@
   "com_nav_close_sidebar": "Fermer la barre latérale",
   "com_nav_commands": "Commandes",
   "com_nav_confirm_clear": "Confirmer l'effacement",
+  "com_nav_control_panel": "Panneau de contrôle",
   "com_nav_conversation_mode": "Mode conversation",
   "com_nav_convo_menu_options": "Options du menu de conversation",
   "com_nav_db_sensitivity": "Sensibilité en décibels",
+  "com_nav_default_temporary_chat": "Conversation temporaire par défaut",
   "com_nav_delete_account": "Supprimer le compte",
   "com_nav_delete_account_button": "Supprimer définitivement mon compte",
   "com_nav_delete_account_confirm": "Supprimer le compte - êtes-vous sûr?",
@@ -458,6 +482,7 @@
   "com_nav_info_code_artifacts": "Active l'affichage des artéfacts de code expérimentaux à côté du chat",
   "com_nav_info_code_artifacts_agent": "Active l'utilisation d'artefacts de code pour cet agent. Par défaut, des instructions supplémentaires spécifiques à l'utilisation des artefacts sont ajoutées, à moins que le \"Mode d'invite personnalisé\" ne soit activé.",
   "com_nav_info_custom_prompt_mode": "Lorsqu'activé, le prompt système par défaut pour les artéfacts ne sera pas inclus. Toutes les instructions de génération d'artéfacts doivent être fournies manuellement dans ce mode.",
+  "com_nav_info_default_temporary_chat": "Lorsque cette option est activée, les nouvelles conversations démarrent en mode temporaire par défaut. Les conversations temporaires ne sont pas enregistrées dans votre historique.",
   "com_nav_info_enter_to_send": "Lorsqu'activée, appuyez sur la touche ENTRÉE pour envoyer votre message. Lorsque désactivée, appuyez sur Entrée ajoutera une nouvelle ligne, et vous devrez appuyer sur CTRL + ENTRÉE pour envoyer votre message.",
   "com_nav_info_fork_change_default": "Messages visibles uniquement, inclut uniquement le chemin direct vers le message sélectionné. Inclure les branches liées, ajoute des branches tout au long du chemin. Inclure tous depuis/jusque là, inclut tous les messages et branches connectés.",
   "com_nav_info_fork_split_target_setting": "Lorsqu'activé, le forking commencera du message cible jusqu'au dernier message de la conversation, selon le comportement sélectionné.",
@@ -486,16 +511,20 @@
   "com_nav_lang_german": "Deutsch",
   "com_nav_lang_hebrew": "עברית",
   "com_nav_lang_hungarian": "Hongrois",
+  "com_nav_lang_icelandic": "Íslenska",
   "com_nav_lang_indonesia": "Indonesia",
   "com_nav_lang_italian": "Italiano",
   "com_nav_lang_japanese": "日本語",
   "com_nav_lang_korean": "한국어",
   "com_nav_lang_latvian": "Latviski",
+  "com_nav_lang_lithuanian": "Lietuvių",
   "com_nav_lang_norwegian_bokmal": "Norvegien",
+  "com_nav_lang_norwegian_nynorsk": "Norsk Nynorsk",
   "com_nav_lang_persian": "Persan",
   "com_nav_lang_polish": "Polski",
   "com_nav_lang_portuguese": "Português",
   "com_nav_lang_russian": "Русский",
+  "com_nav_lang_slovak": "Slovenčina",
   "com_nav_lang_slovenian": "Slovène",
   "com_nav_lang_spanish": "Español",
   "com_nav_lang_swedish": "Svenska",
@@ -511,8 +540,18 @@
   "com_nav_log_out": "Se déconnecter",
   "com_nav_long_audio_warning": "Les textes plus longs prendront plus de temps à traiter.",
   "com_nav_maximize_chat_space": "Maximiser l'espace de discussion",
+  "com_nav_mcp_access_revoked": "Accès au serveur MCP révoqué avec succès.",
   "com_nav_mcp_configure_server": "Configurer {{0}}",
+  "com_nav_mcp_connect": "Connecter",
+  "com_nav_mcp_connect_server": "Connecter {{0}}",
+  "com_nav_mcp_reconnect": "Reconnecter",
+  "com_nav_mcp_status_connected": "Connecté",
   "com_nav_mcp_status_connecting": "{{0}} - Connexion en cours",
+  "com_nav_mcp_status_disconnected": "Déconnecté",
+  "com_nav_mcp_status_error": "Erreur",
+  "com_nav_mcp_status_initializing": "Initialisation",
+  "com_nav_mcp_status_needs_auth": "Authentification requise",
+  "com_nav_mcp_status_unknown": "Inconnu",
   "com_nav_mcp_vars_update_error": "Erreur lors de l'actualisation des variables MCP de l'utilisateur",
   "com_nav_mcp_vars_updated": "Actualisation réussie des variables de l'utilisateur MCP personnalisé.",
   "com_nav_modular_chat": "Activer le changement de points de terminaison en cours de conversation",
@@ -595,28 +634,40 @@
   "com_ui_2fa_generate_error": "Une erreur s'est produite lors de la génération des paramètres d'authentification à deux facteurs",
   "com_ui_2fa_invalid": "Code d'authentification à deux facteurs invalide",
   "com_ui_2fa_setup": "Configuration de l'authentification à deux facteurs (2FA)",
+  "com_ui_2fa_verification_required": "Entrez votre code 2FA pour continuer",
   "com_ui_2fa_verified": "Vérification de l'authentification à deux facteurs réussie",
   "com_ui_accept": "J'accepte",
   "com_ui_action_button": "Bouton d'action",
   "com_ui_active": "Actif",
   "com_ui_add": "Ajouter",
+  "com_ui_add_first_bookmark": "Cliquez sur une conversation pour en ajouter un",
+  "com_ui_add_first_mcp_server": "Créez votre premier serveur MCP pour commencer",
+  "com_ui_add_first_prompt": "Créez votre premier prompt pour commencer",
+  "com_ui_add_labels": "Ajouter des étiquettes",
   "com_ui_add_mcp": "Ajouter MCP",
   "com_ui_add_mcp_server": "Ajouter un server MCP",
   "com_ui_add_model_preset": "Ajouter un modèle ou un préréglage pour une réponse supplémentaire",
   "com_ui_add_multi_conversation": "Ajouter plusieurs conversations",
+  "com_ui_add_special_variables": "Ajouter des variables spéciales",
+  "com_ui_add_web_search_api_keys": "Ajouter des clés API de recherche web",
   "com_ui_adding_details": "Ajouter des détails",
+  "com_ui_additional_details": "Détails supplémentaires",
   "com_ui_admin": "Administrateur",
   "com_ui_admin_access_warning": "La désactivation de l'accès administrateur à cette fonctionnalité peut entraîner des problèmes d'interface imprévus nécessitant une actualisation. Une fois sauvegardé, le seul moyen de rétablir l'accès est via le paramètre d'interface dans la configuration librechat.yaml, ce qui affecte tous les rôles.",
   "com_ui_admin_settings": "Paramètres administratifs",
+  "com_ui_admin_settings_section": "Paramètres administrateur - {{section}}",
   "com_ui_advanced": "Avancé",
   "com_ui_advanced_settings": "Réglages avancés",
   "com_ui_agent": "Agent",
+  "com_ui_agent_api_keys": "Clés API des agents",
+  "com_ui_agent_api_keys_description": "Créez des clés API pour accéder aux agents à distance via l'API",
   "com_ui_agent_category_aftersales": "Après-Vente",
   "com_ui_agent_category_finance": "Finance",
   "com_ui_agent_category_general": "Général",
   "com_ui_agent_category_hr": "RH",
   "com_ui_agent_category_it": "IT",
   "com_ui_agent_category_rd": "R&D",
+  "com_ui_agent_category_sales": "Ventes",
   "com_ui_agent_category_selector_aria": "Sélecteur de catégorie de l'agent",
   "com_ui_agent_chain": "Chaîne d'agents (mélange d'agents)",
   "com_ui_agent_chain_info": "Active la création des séquences d'agents. Chaque agent peut accéder aux résultats des agents précédents de la chaîne. Basé sur l'architecture \"mélange d'agents\" où les agents utilisent les résultats précédents comme information auxiliaire.",
@@ -625,8 +676,17 @@
   "com_ui_agent_deleted": "Agent supprimé avec succès",
   "com_ui_agent_duplicate_error": "Une erreur s'est produite lors de la duplication de l'agent",
   "com_ui_agent_duplicated": "Agent dupliqué avec succès",
+  "com_ui_agent_handoff_add": "Ajouter un agent de transfert",
+  "com_ui_agent_handoff_description": "Description du transfert",
   "com_ui_agent_handoff_description_placeholder": "ex. : Transfert à un data analyste pour analyse statistique",
   "com_ui_agent_handoff_info": "Configurer les agents vers lesquels cet agent peut transférer les conversations lorsqu'une expertise spécifique est nécessaire.",
+  "com_ui_agent_handoff_info_2": "Chaque transfert crée un outil de routage permettant une redirection fluide vers des agents spécialisés avec le contexte approprié.",
+  "com_ui_agent_handoff_max": "Nombre maximum de {{0}} agents de transfert atteint.",
+  "com_ui_agent_handoff_prompt": "Contenu transmis",
+  "com_ui_agent_handoff_prompt_key": "Nom du paramètre de contenu (par défaut : 'instructions')",
+  "com_ui_agent_handoff_prompt_key_placeholder": "Nommez le contenu transmis (par défaut : 'instructions')",
+  "com_ui_agent_handoff_prompt_placeholder": "Indiquez à cet agent quel contenu générer et transmettre à l'agent de transfert. Vous devez ajouter quelque chose ici pour activer cette fonctionnalité",
+  "com_ui_agent_handoffs": "Transferts d'agent",
   "com_ui_agent_name_is_required": "Le nom de l'agent est obligatoire.",
   "com_ui_agent_recursion_limit": "Nombre maximal d'étapes de l'agent",
   "com_ui_agent_recursion_limit_info": "Limite le nombre d'étapes que l'agent peut exécuter avant de donner son résultat final. Par défaut, la limite est de 25 étapes. Une étape est soit une requête API soit une utilisation d'un outil. Par exemple, une utilisation simple d'un outil demande 3 étapes : requête initiale, utilisation de l'outil et envoi de la réponse.",
@@ -648,12 +708,23 @@
   "com_ui_agents": "Agents",
   "com_ui_agents_allow_create": "Autoriser la création d'Agents",
   "com_ui_agents_allow_share": "Autoriser le partage Agents",
+  "com_ui_agents_allow_share_public": "Autoriser le partage public d'agents",
   "com_ui_agents_allow_use": "Autoriser l'utilisation des Agents",
   "com_ui_all": "tout",
   "com_ui_all_proper": "Tout",
   "com_ui_analyzing": "Analyse en cours",
   "com_ui_analyzing_finished": "Analyse terminée",
   "com_ui_api_key": "Clé API",
+  "com_ui_api_key_copied": "Clé API copiée dans le presse-papiers",
+  "com_ui_api_key_create_error": "Échec de la création de la clé API",
+  "com_ui_api_key_created": "Clé API créée avec succès",
+  "com_ui_api_key_delete_error": "Échec de la suppression de la clé API",
+  "com_ui_api_key_deleted": "Clé API supprimée avec succès",
+  "com_ui_api_key_name": "Nom de la clé",
+  "com_ui_api_key_name_placeholder": "Ma clé API",
+  "com_ui_api_key_name_required": "Le nom de la clé API est requis",
+  "com_ui_api_key_warning": "Copiez votre clé API maintenant. Vous ne pourrez plus la voir ensuite !",
+  "com_ui_api_keys_load_error": "Échec du chargement des clés API",
   "com_ui_archive": "Archiver",
   "com_ui_archive_delete_error": "Suppression de la conversation archivée échouée",
   "com_ui_archive_error": "échec de l'archivage de la conversation",
@@ -671,8 +742,10 @@
   "com_ui_at_least_one_owner_required": "Au moins un propriétaire est requis.",
   "com_ui_attach_error": "Impossible de joindre le fichier. Créez ou sélectionnez une conversation, ou essayez d'actualiser la page.",
   "com_ui_attach_error_disabled": "Les téléchargements de fichiers sont désactivés pour cet endpoint",
+  "com_ui_attach_error_limit": "Limite de fichiers atteinte :",
   "com_ui_attach_error_openai": "Impossible de joindre les fichiers de l'Assistant à d'autres points d'accès",
   "com_ui_attach_error_size": "Limite de taille de fichier dépassée pour le point de terminaison :",
+  "com_ui_attach_error_total_size": "Taille totale des fichiers dépassée pour le endpoint :",
   "com_ui_attach_error_type": "Type de fichier non pris en charge pour ce point d'accès :",
   "com_ui_attach_remove": "Supprimer le fichier",
   "com_ui_attach_warn_endpoint": "Les fichiers non compatibles avec l'outil peuvent être ignorés",
@@ -683,6 +756,7 @@
   "com_ui_authentication": "Authentification",
   "com_ui_authentication_type": "Type d'authentification",
   "com_ui_auto": "Automatique",
+  "com_ui_available_options": "Options disponibles",
   "com_ui_avatar": "Avatar",
   "com_ui_azure": "Azure",
   "com_ui_azure_ad": "Entra ID",
@@ -703,6 +777,7 @@
   "com_ui_bookmarks": "Signets",
   "com_ui_bookmarks_add": "Ajouter des signets",
   "com_ui_bookmarks_add_to_conversation": "Ajouter à la conversation en cours",
+  "com_ui_bookmarks_count_selected": "Signets, {{count}} sélectionnés",
   "com_ui_bookmarks_create_error": "Une erreur est survenue lors de la création du signet",
   "com_ui_bookmarks_create_exists": "Ce signet existe déjà",
   "com_ui_bookmarks_create_success": "Signet créé avec succès",
@@ -717,6 +792,10 @@
   "com_ui_bookmarks_title": "Titre",
   "com_ui_bookmarks_update_error": "Une erreur est survenue lors de la mise à jour du signet",
   "com_ui_bookmarks_update_success": "Signet mis à jour avec succès",
+  "com_ui_branch_created": "Branche créée avec succès",
+  "com_ui_branch_error": "Échec de la création de la branche",
+  "com_ui_branch_message": "Créer une branche à partir de cette réponse",
+  "com_ui_by_author": "par {{0}}",
   "com_ui_callback_url": "Adresse URL de callback",
   "com_ui_cancel": "Annuler",
   "com_ui_cancelled": "Annulé",
@@ -724,50 +803,82 @@
   "com_ui_change_version": "Changer la version",
   "com_ui_chat": "Discussion",
   "com_ui_chat_history": "Historique des discussions",
+  "com_ui_chats": "Conversations",
+  "com_ui_check_internet": "Vérifiez votre connexion internet",
   "com_ui_clear": "Effacer",
   "com_ui_clear_all": "Tout effacer",
+  "com_ui_clear_browser_cache": "Videz le cache de votre navigateur",
+  "com_ui_clear_presets": "Effacer les préréglages",
+  "com_ui_clear_search": "Effacer la recherche",
   "com_ui_click_to_close": "Cliquer pour fermer",
+  "com_ui_click_to_edit": "Cliquez pour modifier",
+  "com_ui_click_to_view_var": "Cliquez pour afficher {{0}}",
   "com_ui_client_id": "Identifiant (ID) du client",
   "com_ui_client_secret": "Secret du client",
   "com_ui_close": "Fermer",
   "com_ui_close_menu": "Fermer le menu",
   "com_ui_close_settings": "Fermer les paramètres",
+  "com_ui_close_var": "Fermer {{0}}",
   "com_ui_close_window": "Fermer la fenêtre",
   "com_ui_code": "Code",
+  "com_ui_collapse": "Réduire",
   "com_ui_collapse_chat": "Réduire la discussion",
+  "com_ui_collapse_summary": "Réduire le résumé",
+  "com_ui_collapse_thoughts": "Réduire les pensées",
   "com_ui_command_placeholder": "Facultatif : Saisissez une commande pour l'invite ou le nom sera utilisé",
   "com_ui_command_usage_placeholder": "Sélectionnez un prompt par commande ou par nom",
   "com_ui_complete_setup": "Configuration complete",
   "com_ui_concise": "Concis",
+  "com_ui_configure": "Configurer",
   "com_ui_configure_mcp_variables_for": "Configurer les variables pour {{0}}",
   "com_ui_confirm": "Confirmer",
   "com_ui_confirm_action": "Confirmer l'action",
   "com_ui_confirm_admin_use_change": "La modification de ce paramètre bloquera l'accès aux administrateurs, y compris vous-même. Êtes-vous sûr de vouloir continuer ?",
   "com_ui_confirm_change": "Confirmer la modification",
   "com_ui_connecting": "Connexion en cours",
+  "com_ui_contact_admin_if_issue_persists": "Contactez l'administrateur si le problème persiste",
   "com_ui_context": "Contexte",
+  "com_ui_context_filter_sort": "Filtrer et trier par contexte",
   "com_ui_continue": "Continuer",
   "com_ui_continue_oauth": "Continuer avec OAuth",
+  "com_ui_control_bar": "Barre de contrôle",
+  "com_ui_conversation": "conversation",
+  "com_ui_conversation_label": "Conversation {{title}}",
+  "com_ui_conversation_not_found": "Conversation introuvable",
+  "com_ui_conversation_summarized": "Conversation résumée",
+  "com_ui_conversations": "conversations",
+  "com_ui_convo_archived": "Conversation archivée",
   "com_ui_convo_delete_error": "Suppression de conversation échouée",
   "com_ui_convo_delete_success": "Conversation supprimée avec succès",
   "com_ui_copied": "Copié !",
   "com_ui_copied_to_clipboard": "Copié dans le presse-papier",
+  "com_ui_copy": "Copier",
   "com_ui_copy_code": "Copier le code",
+  "com_ui_copy_failed": "Échec de la copie dans le presse-papiers",
   "com_ui_copy_link": "Copier le lien",
   "com_ui_copy_stack_trace": "Copier la stack trace",
+  "com_ui_copy_summary": "Copier le résumé dans le presse-papiers",
   "com_ui_copy_thoughts_to_clipboard": "Copier les pensées dans le presse-papiers",
   "com_ui_copy_to_clipboard": "Copier dans le presse-papier",
   "com_ui_copy_url_to_clipboard": "Copier l'URL dans le presse-papiers",
   "com_ui_create": "Créer",
+  "com_ui_create_api_key": "Créer une clé API",
+  "com_ui_create_assistant": "Créer un assistant",
   "com_ui_create_link": "Créer un lien",
+  "com_ui_create_mcp_server": "Créer un serveur MCP",
   "com_ui_create_memory": "Créer une Mémoire",
+  "com_ui_create_new_agent": "Créer un nouvel agent",
   "com_ui_create_prompt": "Créer un prompt",
+  "com_ui_create_prompt_page": "Page de configuration d'un nouveau prompt",
+  "com_ui_created": "Créé",
+  "com_ui_creating": "Création...",
   "com_ui_creating_image": "Création de l'image en cours. Cela peut prendre un moment",
   "com_ui_current": "Actuel",
   "com_ui_currently_production": "En cours de production",
   "com_ui_custom": "Personnalisé",
   "com_ui_custom_header_name": "Nom d'en-tête personnalisé",
   "com_ui_custom_prompt_mode": "Mode de prompt personnalisé",
+  "com_ui_dark_theme_enabled": "Thème sombre activé",
   "com_ui_date": "Date",
   "com_ui_date_april": "Avril",
   "com_ui_date_august": "Août",
@@ -783,6 +894,7 @@
   "com_ui_date_previous_30_days": "30 derniers jours",
   "com_ui_date_previous_7_days": "7 derniers jours",
   "com_ui_date_september": "Septembre",
+  "com_ui_date_sort": "Trier par date",
   "com_ui_date_today": "Aujourd'hui",
   "com_ui_date_yesterday": "Hier",
   "com_ui_decline": "Je n'accepte pas",
@@ -790,27 +902,38 @@
   "com_ui_delete": "Supprimer",
   "com_ui_delete_action": "Supprimer l'action",
   "com_ui_delete_action_confirm": "Êtes-vous sûr de vouloir supprimer cette action ?",
+  "com_ui_delete_agent": "Supprimer l'agent",
   "com_ui_delete_agent_confirm": "Êtes-vous sûr de vouloir supprimer cet agent ?",
+  "com_ui_delete_assistant": "Supprimer l'assistant",
   "com_ui_delete_assistant_confirm": "Êtes-vous sûr de vouloir supprimer cet Assistant ? Cette action est irréversible.",
   "com_ui_delete_confirm": "Cela supprimera",
   "com_ui_delete_confirm_prompt_version_var": "Cela supprimera la version sélectionnée pour \"{{0}}.\" S'il n'existe aucune autre version, le prompt sera supprimé.",
+  "com_ui_delete_confirm_strong": "Cela supprimera <strong>{{title}}</strong>",
   "com_ui_delete_conversation": "Supprimer la discussion?",
+  "com_ui_delete_conversation_tooltip": "Supprimer la conversation",
+  "com_ui_delete_mcp_server": "Supprimer le serveur MCP ?",
+  "com_ui_delete_mcp_server_name": "Supprimer le serveur MCP {{0}}",
   "com_ui_delete_memory": "Supprimer les données mémorisées ",
   "com_ui_delete_not_allowed": "La suppression n'est pas permise",
+  "com_ui_delete_preset": "Supprimer le préréglage ?",
   "com_ui_delete_prompt": "Supprimer le Prompt?",
   "com_ui_delete_shared_link": "Supprimer le lien partagé ?",
+  "com_ui_delete_shared_link_heading": "Supprimer le lien partagé",
   "com_ui_delete_success": "Supprimé avec succès",
   "com_ui_delete_tool": "Supprimer l'outil",
   "com_ui_delete_tool_confirm": "Êtes-vous sûr de vouloir supprimer cet outil ?",
   "com_ui_delete_tool_save_reminder": "Outil supprimé. Sauvegardez l'agent pour appliquer les modifications.",
   "com_ui_deleted": "Supprimé",
+  "com_ui_deleting": "Suppression...",
   "com_ui_deleting_file": "Suppression du fichier en cours...",
+  "com_ui_deploy": "Déployer",
   "com_ui_descending": "Décroissant",
   "com_ui_description": "Description",
   "com_ui_description_placeholder": "Optionnel : Entrez une description à afficher dans le prompt",
   "com_ui_deselect_all": "Tout désélectionner ",
   "com_ui_detailed": "Détaillée",
   "com_ui_disabling": "Désactivation en cours...",
+  "com_ui_done": "Terminé",
   "com_ui_download": "Télécharger",
   "com_ui_download_artifact": "Télécharger Artifact",
   "com_ui_download_backup": "Télécharger les codes de sauvegarde",
@@ -820,13 +943,17 @@
   "com_ui_drag_drop": "Déposer des fichiers ici afin de les ajouter à la conversation",
   "com_ui_dropdown_variables": "Variables déroulantes :",
   "com_ui_duplicate": "Dupliquer",
+  "com_ui_duplicate_agent": "Dupliquer l'agent",
   "com_ui_duplication_error": "Une erreur s'est produite lors de la duplication de la conversation",
   "com_ui_duplication_processing": "Duplication de la conversation en cours...",
   "com_ui_duplication_success": "Conversation dupliquée avec succès",
   "com_ui_edit": "Modifier",
   "com_ui_edit_editing_image": "Edition de l'image",
   "com_ui_edit_mcp_server": "Editer le serveur MCP",
+  "com_ui_edit_mcp_server_dialog_description": "Identifiant unique du serveur : {{serverName}}",
   "com_ui_edit_memory": "Editer la Mémoire",
+  "com_ui_edit_preset_title": "Modifier le préréglage - {{title}}",
+  "com_ui_edit_prompt_page": "Modifier la page du prompt",
   "com_ui_editable_message": "Message modifiable",
   "com_ui_editor_instructions": "Faites glisser l'image pour la repositionner • Utilisez le curseur de zoom ou les boutons pour ajuster la taille",
   "com_ui_empty_category": "-",
@@ -834,16 +961,23 @@
   "com_ui_endpoint_menu": "Menu des points de terminaison LLM",
   "com_ui_enter": "Entrer",
   "com_ui_enter_api_key": "Saisir la clé API",
+  "com_ui_enter_description": "Entrez une description (facultatif)",
   "com_ui_enter_key": "Entrez la clé",
+  "com_ui_enter_name": "Entrez un nom",
   "com_ui_enter_openapi_schema": "Saisissez votre schéma OpenAPI ici",
   "com_ui_enter_value": "Entrez la valeur",
   "com_ui_error": "Erreur",
   "com_ui_error_connection": "Erreur de connexion au serveur, essayez de rafraîchir la page.",
+  "com_ui_error_message_prefix": "Message d'erreur :",
   "com_ui_error_save_admin_settings": "Une erreur est survenue lors de la sauvegarde de vos paramètres administratifs.",
+  "com_ui_error_try_following_prefix": "Veuillez essayer l'une des solutions suivantes",
+  "com_ui_error_unexpected": "Oups ! Une erreur inattendue s'est produite",
   "com_ui_error_updating_preferences": "Une erreur est survenue lors de l'édition des préférences",
   "com_ui_everyone_permission_level": "Niveau de permission de tout le monde",
   "com_ui_examples": "Exemples",
+  "com_ui_expand": "Développer",
   "com_ui_expand_chat": "Etendre le message",
+  "com_ui_expand_thoughts": "Développer les pensées",
   "com_ui_export_convo_modal": "Exporter la conversation",
   "com_ui_feedback_more": "Plus...",
   "com_ui_feedback_more_information": "Envoyer des retours supplémentaires",
@@ -865,8 +999,12 @@
   "com_ui_feedback_tag_unjustified_refusal": "A refusé sans raison",
   "com_ui_field_max_length": "{{field}} doit contenir moins de {{length}} caractères",
   "com_ui_field_required": "Ce champ est obligatoire",
+  "com_ui_file_input_avatar_label": "Champ de fichier pour l'avatar",
   "com_ui_file_size": "Taille du fichier",
+  "com_ui_file_token_limit": "Limite de jetons par fichier",
+  "com_ui_file_token_limit_desc": "Définir la limite maximale de jetons pour le traitement des fichiers afin de contrôler les coûts et l'utilisation des ressources",
   "com_ui_files": "Fichiers",
+  "com_ui_filter_mcp_servers": "Filtrer les serveurs MCP par nom",
   "com_ui_filter_prompts": "Filtrer les messages",
   "com_ui_filter_prompts_name": "Filtrer les prompts par nom",
   "com_ui_final_touch": "Touche finale",
@@ -890,6 +1028,7 @@
   "com_ui_fork_info_visible": "Cette option permet de diviser uniquement les messages visibles ; en d'autres termes, le chemin direct vers le message cible, sans aucune branche.",
   "com_ui_fork_more_details_about": "Voir plus d'informations sur l'option de fouche \"{{0}}",
   "com_ui_fork_more_info_options": "Voir des explications détaillées sur toutes les options de fourches et leurs effets",
+  "com_ui_fork_open_menu": "Ouvrir le menu de fork",
   "com_ui_fork_processing": "Bifurquer la conversation...",
   "com_ui_fork_remember": "Se souvenir",
   "com_ui_fork_remember_checked": "Votre sélection sera mémorisée après utilisation. Vous pouvez la modifier à tout moment dans les paramètres.",
@@ -907,7 +1046,11 @@
   "com_ui_good_evening": "Bonsoir",
   "com_ui_good_morning": "Bonjour",
   "com_ui_group": "Groupe",
+  "com_ui_handoff_instructions": "Instructions de transfert",
   "com_ui_happy_birthday": "C'est mon premier anniversaire !",
+  "com_ui_header_format": "Format d'en-tête",
+  "com_ui_hide": "Masquer",
+  "com_ui_hide_code": "Masquer le code",
   "com_ui_hide_image_details": "Cacher les informations de l'images",
   "com_ui_hide_qr": "Cacher le QR code",
   "com_ui_high": "Elevé",
@@ -924,34 +1067,82 @@
   "com_ui_import_conversation_info": "Importer des conversations à partir d'un fichier JSON",
   "com_ui_import_conversation_success": "Conversations importées avec succès",
   "com_ui_import_conversation_upload_error": "Erreur lors du téléchargement du fichier. Veuillez réessayer.",
+  "com_ui_importing": "Importation",
   "com_ui_include_shadcnui": "Inclure les instructions des composants shadcn/ui",
   "com_ui_initializing": "Initialisation...",
   "com_ui_input": "Entrée",
   "com_ui_instructions": "Instructions",
   "com_ui_key": "Clé",
   "com_ui_key_required": "Une clé API est requise",
+  "com_ui_labels": "Étiquettes",
+  "com_ui_last_used": "Dernière utilisation",
   "com_ui_late_night": "Bonne fin de nuit",
+  "com_ui_latest": "dernière",
   "com_ui_latest_footer": "Chaque IA pour tout le monde.",
   "com_ui_latest_version": "Dernière version",
+  "com_ui_leave_blank_to_keep": "Laissez vide pour conserver l'existant",
+  "com_ui_light_theme_enabled": "Thème clair activé",
+  "com_ui_link_copied": "Lien copié",
+  "com_ui_link_refreshed": "Lien actualisé",
+  "com_ui_live": "live",
   "com_ui_loading": "Chargement en cours...",
   "com_ui_locked": "Verrouillé",
   "com_ui_logo": "Logo {{0}}",
   "com_ui_low": "Faible",
+  "com_ui_make_production": "Mettre en production",
   "com_ui_manage": "Gérer",
   "com_ui_marketplace": "Marketplace",
   "com_ui_marketplace_allow_use": "Autoriser l'utilisation de la Marketplace",
+  "com_ui_max": "Max",
+  "com_ui_max_favorites_reached": "Nombre maximum d'éléments épinglés atteint ({{0}}). Détachez un élément pour en ajouter d'autres.",
   "com_ui_max_file_size": "PNG, JPG ou JPEG (max {{0}})",
   "com_ui_max_tags": "Le nombre maximum autorisé est {{0}}, en utilisant les dernières valeurs.",
   "com_ui_mcp_authenticated_success": "Serveur MCP '{{0}}' authentifié avec succès",
+  "com_ui_mcp_click_to_defer": "Cliquez pour différer - l'outil sera découvrable via la recherche mais ne sera chargé qu'en cas de besoin",
+  "com_ui_mcp_click_to_programmatic": "Activer l'appel programmatique - l'outil ne peut être invoqué que via l'exécution de code",
   "com_ui_mcp_configure_server": "Configurer {{0}}",
   "com_ui_mcp_configure_server_description": "Configurer des variables personnalisées pour {{0}}",
+  "com_ui_mcp_defer": "Différer",
+  "com_ui_mcp_defer_all": "Différer tous les outils",
+  "com_ui_mcp_defer_loading": "Différer le chargement",
+  "com_ui_mcp_dialog_title": "Configurer les variables pour {{serverName}}. Statut du serveur : {{status}}",
+  "com_ui_mcp_domain_not_allowed": "Le domaine du serveur MCP ne figure pas dans la liste des domaines autorisés. Veuillez contacter votre administrateur.",
   "com_ui_mcp_enter_var": "Saisissez la valeur de {{0}}",
   "com_ui_mcp_init_failed": "Échec de l'initialisation du serveur MCP",
   "com_ui_mcp_initialize": "Initialiser",
   "com_ui_mcp_initialized_success": "Serveur MCP '{{0}}' initialisé avec succès",
+  "com_ui_mcp_invalid_url": "Veuillez entrer une URL valide",
+  "com_ui_mcp_no_description": "Aucune description disponible",
   "com_ui_mcp_oauth_cancelled": "Authentification OAuth annulée pour {{0}}",
   "com_ui_mcp_oauth_timeout": "Délai d'authentification OAuth dépassé pour {{0}}",
+  "com_ui_mcp_programmatic": "Programmatique",
+  "com_ui_mcp_programmatic_all": "Marquer tous comme programmatiques",
+  "com_ui_mcp_server": "Serveur MCP",
+  "com_ui_mcp_server_connection_failed": "La connexion au serveur MCP fourni a échoué. Vérifiez que l'URL, le type de serveur et la configuration d'authentification sont corrects, puis réessayez. Assurez-vous également que l'URL est accessible.",
+  "com_ui_mcp_server_created": "Serveur MCP créé avec succès",
+  "com_ui_mcp_server_delete_confirm": "Êtes-vous sûr de vouloir supprimer ce serveur MCP ?",
+  "com_ui_mcp_server_deleted": "Serveur MCP supprimé avec succès",
+  "com_ui_mcp_server_role_editor": "Éditeur de serveur MCP",
+  "com_ui_mcp_server_role_editor_desc": "Peut afficher, utiliser et modifier les serveurs MCP",
+  "com_ui_mcp_server_role_owner": "Propriétaire de serveur MCP",
+  "com_ui_mcp_server_role_owner_desc": "Contrôle total sur les serveurs MCP",
+  "com_ui_mcp_server_role_viewer": "Observateur de serveur MCP",
+  "com_ui_mcp_server_role_viewer_desc": "Peut afficher et utiliser les serveurs MCP",
+  "com_ui_mcp_server_updated": "Serveur MCP mis à jour avec succès",
+  "com_ui_mcp_server_url_placeholder": "https://mcp.example.com",
   "com_ui_mcp_servers": "Serveurs MCP",
+  "com_ui_mcp_servers_allow_create": "Autoriser les utilisateurs à créer des serveurs MCP",
+  "com_ui_mcp_servers_allow_share": "Autoriser les utilisateurs à partager des serveurs MCP",
+  "com_ui_mcp_servers_allow_share_public": "Autoriser les utilisateurs à partager publiquement des serveurs MCP",
+  "com_ui_mcp_servers_allow_use": "Autoriser les utilisateurs à utiliser des serveurs MCP",
+  "com_ui_mcp_title_invalid": "Le titre ne peut contenir que des lettres, des chiffres et des espaces",
+  "com_ui_mcp_tool_options": "Options des outils",
+  "com_ui_mcp_transport": "Transport",
+  "com_ui_mcp_type_sse": "SSE",
+  "com_ui_mcp_type_streamable_http": "HTTPS Streamable",
+  "com_ui_mcp_undefer": "Activer",
+  "com_ui_mcp_undefer_all": "Activer tous les outils",
+  "com_ui_mcp_unprogrammatic_all": "Retirer le marquage programmatique de tous",
   "com_ui_mcp_update_var": "Modifier {{0}}",
   "com_ui_mcp_url": "Adresse URL du serveur MCP",
   "com_ui_medium": "Modéré",
@@ -969,32 +1160,51 @@
   "com_ui_memory_deleted_items": "Mémoires supprimées",
   "com_ui_memory_error": "Erreur de mémoire",
   "com_ui_memory_key_exists": "Une Mémoire existe déjà avec cette clé. Veuillez utiliser une autre clé.",
+  "com_ui_memory_key_hint": "Utilisez uniquement des lettres minuscules et des underscores",
   "com_ui_memory_key_validation": "La clé mémoire ne doit comporter que des lettres minuscules et des underscores.",
   "com_ui_memory_storage_full": "Stockage memory plein",
   "com_ui_memory_updated": "Actualiser la Mémoire",
   "com_ui_memory_updated_items": "Souvenirs enregistrés",
   "com_ui_memory_would_exceed": "Enregistrement impossible - excédent de {{tokens}} jetons. Effacez des mémoires existantes pour libérer de la place.",
   "com_ui_mention": "Mentionnez un point de terminaison, un assistant ou un préréglage pour basculer rapidement vers celui-ci",
+  "com_ui_mermaid": "mermaid",
+  "com_ui_mermaid_failed": "Échec du rendu du diagramme :",
+  "com_ui_mermaid_source": "Code source :",
+  "com_ui_message_input": "Saisie du message",
+  "com_ui_microphone_unavailable": "Le microphone n'est pas disponible",
   "com_ui_min_tags": "Impossible de supprimer plus de valeurs, un minimum de {{0}} est requis.",
   "com_ui_minimal": "Minimal",
   "com_ui_misc": "Divers",
   "com_ui_model": "Modèle",
   "com_ui_model_parameters": "Paramètres du modèle",
+  "com_ui_model_parameters_reset": "Les paramètres du modèle ont été réinitialisés.",
+  "com_ui_model_selected": "{{0}} sélectionné",
   "com_ui_more_info": "Plus d'informations",
   "com_ui_my_prompts": "Mes Prompts",
   "com_ui_name": "Nom",
+  "com_ui_name_sort": "Trier par nom",
   "com_ui_new": "Nouveau",
   "com_ui_new_chat": "Nouvelle conversation",
   "com_ui_new_conversation_title": "Nouveau titre de conversation",
   "com_ui_next": "Suivant",
   "com_ui_no": "Non",
+  "com_ui_no_api_keys": "Aucune clé API pour le moment. Créez-en une pour commencer.",
+  "com_ui_no_auth": "Aucune (Détection automatique)",
   "com_ui_no_bookmarks": "Il semble que vous n'ayez pas encore de favoris. Cliquez sur une discussion pour en ajouter un",
+  "com_ui_no_bookmarks_match": "Aucun signet ne correspond à votre recherche",
+  "com_ui_no_bookmarks_title": "Aucun signet pour le moment",
   "com_ui_no_categories": "Aucune catégorie disponible",
   "com_ui_no_category": "Aucune catégorie",
   "com_ui_no_changes": "Aucune modification n'a été réalisée",
   "com_ui_no_individual_access": "Aucun utilisateur ou groupe n'a accès à cet agent",
+  "com_ui_no_labels": "Aucune étiquette",
+  "com_ui_no_mcp_servers": "Aucun serveur MCP pour le moment",
+  "com_ui_no_mcp_servers_match": "Aucun serveur MCP ne correspond à votre filtre",
   "com_ui_no_memories": "Aucune mémoire. Créez-les manuellement ou incitez l'IA de se mémoriser quelque chose",
+  "com_ui_no_memories_match": "Aucun souvenir ne correspond à votre recherche",
+  "com_ui_no_memories_title": "Aucun souvenir pour le moment",
   "com_ui_no_personalization_available": "Aucune personnalisation disponible",
+  "com_ui_no_prompts_title": "Aucun prompt pour le moment",
   "com_ui_no_read_access": "Vous n'avez pas l'autorisation de voir les données mémorisées.",
   "com_ui_no_results_found": "Aucun résultat trouvé",
   "com_ui_no_terms_content": "Aucun contenu de conditions d'utilisation à afficher",
@@ -1013,37 +1223,59 @@
   "com_ui_oauth_success_title": "Authentification réussie",
   "com_ui_of": "des",
   "com_ui_off": "Désactivé",
+  "com_ui_offline": "Hors ligne",
   "com_ui_on": "Activé",
+  "com_ui_open_archived_chat_new_tab_title": "{{title}} (ouvrir dans un nouvel onglet)",
+  "com_ui_open_source_chat_new_tab": "Ouvrir la conversation source dans un nouvel onglet",
+  "com_ui_open_source_chat_new_tab_title": "Ouvrir la conversation source dans un nouvel onglet - {{title}}",
+  "com_ui_open_var": "Ouvrir {{0}}",
   "com_ui_openai": "OpenAI",
   "com_ui_optional": "(optionnel)",
+  "com_ui_options": "options",
   "com_ui_page": "Page",
+  "com_ui_pagination": "Pagination",
   "com_ui_people": "utilisateur",
   "com_ui_people_picker": "Sélecteur d'utilisateurs",
   "com_ui_people_picker_allow_view_groups": "Autoriser la visualisation des groupes",
   "com_ui_people_picker_allow_view_roles": "Autoriser la visualisation des rôles",
   "com_ui_people_picker_allow_view_users": "Autoriser la visualisation des utilisateurs",
+  "com_ui_permissions_failed_load": "Échec du chargement des permissions. Veuillez réessayer.",
   "com_ui_permissions_failed_update": "Échec du chargement des permissions. Veuillez réessayer.",
   "com_ui_permissions_updated_success": "Permissions mises à jour avec succès",
+  "com_ui_pin": "Épingler",
   "com_ui_preferences_updated": "Préférences enregistrées avec succès",
   "com_ui_prev": "Précédent",
   "com_ui_preview": "Aperçu",
   "com_ui_privacy_policy": "Politique de confidentialité",
   "com_ui_privacy_policy_url": "URL de la politique de confidentialité",
+  "com_ui_production": "Production",
   "com_ui_prompt": "Prompt",
+  "com_ui_prompt_category_selector_aria": "Sélecteur de catégorie du prompt",
+  "com_ui_prompt_delete_confirm": "Êtes-vous sûr de vouloir supprimer le prompt « {{0}} » ?",
+  "com_ui_prompt_deleted_group": "Groupe de prompts « {{0}} » supprimé",
+  "com_ui_prompt_details": "Détails du prompt {{name}}",
+  "com_ui_prompt_group_button": "Prompt {{name}}, catégorie {{category}}",
+  "com_ui_prompt_group_button_no_category": "Prompt {{name}}",
   "com_ui_prompt_groups": "Liste des groupes de prompts",
+  "com_ui_prompt_input": "Saisie du prompt",
+  "com_ui_prompt_input_field": "Champ de saisie du texte du prompt",
   "com_ui_prompt_name": "Nom du Prompt",
   "com_ui_prompt_name_required": "Un nom pour le Prompt est requis",
   "com_ui_prompt_preview_not_shared": "L'auteur n'a pas autorisé la collaboration pour ce prompt.",
   "com_ui_prompt_text": "Texte",
   "com_ui_prompt_text_required": "Un texte est requis",
   "com_ui_prompt_update_error": "Une erreur s'est produite lors de la mise à jour du prompt",
+  "com_ui_prompt_variables_list": "Liste des variables du prompt",
   "com_ui_prompts": "Prompts",
   "com_ui_prompts_allow_create": "Autoriser la création de Prompts",
   "com_ui_prompts_allow_share": "Autoriser le partage de prompts",
+  "com_ui_prompts_allow_share_public": "Autoriser le partage public de prompts",
   "com_ui_prompts_allow_use": "Autoriser l'utilisation de Prompts",
   "com_ui_provider": "Fournisseur",
   "com_ui_quality": "Qualité",
   "com_ui_read_aloud": "Lire à haute voix",
+  "com_ui_redirect_uri": "URI de redirection",
+  "com_ui_redirect_uri_instructions": "Copiez cette URI de redirection et configurez-la dans les paramètres de votre fournisseur OAuth.",
   "com_ui_redirecting_to_provider": "Redirection en cours vers {{0}}, veuillez patienter...",
   "com_ui_reference_saved_memories": "Indexer les Souvenirs enregistrés",
   "com_ui_reference_saved_memories_description": "Autoriser l'assistant à accéder aux index des données mémorisées enregistrées et à les utiliser pour répondre",
@@ -1055,6 +1287,18 @@
   "com_ui_regenerating": "Régénération en cours...",
   "com_ui_region": "Région",
   "com_ui_reinitialize": "Réinitialiser",
+  "com_ui_remote_access": "Accès distant",
+  "com_ui_remote_agent_role_editor": "Éditeur",
+  "com_ui_remote_agent_role_editor_desc": "Peut afficher et modifier l'agent via l'API",
+  "com_ui_remote_agent_role_owner": "Propriétaire API",
+  "com_ui_remote_agent_role_owner_desc": "Accès API complet et peut accorder l'accès distant à d'autres utilisateurs",
+  "com_ui_remote_agent_role_viewer": "Observateur API",
+  "com_ui_remote_agent_role_viewer_desc": "Peut interroger l'agent via l'API",
+  "com_ui_remote_agents": "Agents distants (API)",
+  "com_ui_remote_agents_allow_create": "Autoriser les utilisateurs à créer des agents via l'API",
+  "com_ui_remote_agents_allow_share": "Autoriser les utilisateurs à accorder l'accès API aux agents à d'autres utilisateurs",
+  "com_ui_remote_agents_allow_share_public": "Autoriser les utilisateurs à accorder l'accès API aux agents à tous les utilisateurs",
+  "com_ui_remote_agents_allow_use": "Autoriser les utilisateurs à créer des clés API et à interroger les agents à distance",
   "com_ui_remove_agent_from_chain": "Retirer {{0}} de la chaîne",
   "com_ui_remove_user": "Retirer {{0}}",
   "com_ui_rename": "Renommer",
@@ -1068,10 +1312,15 @@
   "com_ui_resource": "Ressource",
   "com_ui_response": "Réponse",
   "com_ui_result": "Résultat",
+  "com_ui_result_found": "{{count}} résultat trouvé",
+  "com_ui_results_found": "{{count}} résultats trouvés",
+  "com_ui_retry": "Réessayer",
   "com_ui_revoke": "Révoquer",
   "com_ui_revoke_info": "Révoquer toutes les informations d'identification fournies par l'utilisateur",
   "com_ui_revoke_key_confirm": "Êtes-vous sûr de vouloir révoquer cette clé ?",
   "com_ui_revoke_key_endpoint": "Révoquer la clé pour {{0}}",
+  "com_ui_revoke_key_error": "Échec de la révocation de la clé API. Veuillez réessayer.",
+  "com_ui_revoke_key_success": "Clé API révoquée avec succès",
   "com_ui_revoke_keys": "Révoquer les clés",
   "com_ui_revoke_keys_confirm": "Êtes-vous sûr de vouloir révoquer toutes les clés ?",
   "com_ui_role": "Rôle",
@@ -1106,9 +1355,12 @@
   "com_ui_search_agent_category": "Recherche de catégories...",
   "com_ui_search_default_placeholder": "Rechercher par nom ou email (min 2 caractères)",
   "com_ui_search_people_placeholder": "Rechercher des utilisateurs ou des groupes par nom ou email",
+  "com_ui_search_result_count": "{{count}} résultat trouvé",
+  "com_ui_search_results_count": "{{count}} résultats trouvés",
   "com_ui_seconds": "secondes",
   "com_ui_secret_key": "Clé secrète",
   "com_ui_select": "Sélectionner",
+  "com_ui_select_agent": "Sélectionner un agent",
   "com_ui_select_all": "Tout sélectionner",
   "com_ui_select_file": "Sélectionner un fichier",
   "com_ui_select_model": "Sélectionner un modèle",
@@ -1117,6 +1369,7 @@
   "com_ui_select_provider": "Sélectionner un fournisseur",
   "com_ui_select_provider_first": "Sélectionnez d'abord un fournisseur",
   "com_ui_select_region": "Sélectionner une région",
+  "com_ui_select_row": "Sélectionner la ligne",
   "com_ui_select_search_model": "Rechercher un modèle par nom",
   "com_ui_select_search_provider": "Rechercher un fournisseur par nom",
   "com_ui_select_search_region": "Rechercher une région par nom",
@@ -1135,21 +1388,37 @@
   "com_ui_shared_link_not_found": "Lien partagé introuvable",
   "com_ui_shared_prompts": "Prompts partagés",
   "com_ui_shop": "Faire des achats",
+  "com_ui_show": "Afficher",
   "com_ui_show_all": "Tout afficher",
+  "com_ui_show_code": "Afficher le code",
   "com_ui_show_image_details": "Montrer les informations de l'image",
   "com_ui_show_qr": "Afficher le QR code",
   "com_ui_sign_in_to_domain": "S'identifier à {{0}}",
   "com_ui_simple": "Simple",
   "com_ui_size": "Taille",
+  "com_ui_size_sort": "Trier par taille",
+  "com_ui_special": "spécial",
   "com_ui_special_var_current_date": "Date actuelle",
   "com_ui_special_var_current_datetime": "Date et heure actuelle",
   "com_ui_special_var_current_user": "Utilisateur actuel",
+  "com_ui_special_var_desc_current_date": "Date du jour et jour de la semaine",
+  "com_ui_special_var_desc_current_datetime": "Date et heure locales dans votre fuseau horaire",
+  "com_ui_special_var_desc_current_user": "Votre nom d'affichage de compte",
+  "com_ui_special_var_desc_iso_datetime": "Date et heure UTC au format ISO 8601",
   "com_ui_special_var_iso_datetime": "Date et heure ISO UTC",
-  "com_ui_special_variables": "Variables spéciales : Utilisez {{current_date}} pour la date actuelle, et {{current_user}} pour le nom de votre compte donné.",
+  "com_ui_special_variable_added": "Variable spéciale {{0}} ajoutée.",
+  "com_ui_special_variables": "Variables spéciales",
+  "com_ui_speech_not_supported": "Votre navigateur ne prend pas en charge la reconnaissance vocale",
+  "com_ui_speech_not_supported_use_external": "Votre navigateur ne prend pas en charge la reconnaissance vocale. Essayez de passer au STT externe dans Paramètres > Parole.",
   "com_ui_speech_while_submitting": "Impossible de soumettre un message vocal pendant la génération d'une réponse",
+  "com_ui_sr_global_prompt": "Groupe de prompts global",
+  "com_ui_stack_trace": "Stack Trace",
+  "com_ui_status_prefix": "Statut :",
   "com_ui_stop": "Arrêt ",
   "com_ui_storage": "Stockage",
+  "com_ui_storage_filter_sort": "Filtrer et trier par stockage",
   "com_ui_submit": "Soumettre",
+  "com_ui_summarizing": "Résumé en cours...",
   "com_ui_support_contact": "Contact d'assistance",
   "com_ui_support_contact_email": "Email",
   "com_ui_support_contact_email_invalid": "Veuillez entrer un email valide",
@@ -1161,40 +1430,52 @@
   "com_ui_temporary": "Message éphémère",
   "com_ui_terms_and_conditions": "Conditions d'utilisation",
   "com_ui_terms_of_service": "Conditions d'utilisation",
+  "com_ui_text_variables": "Variables texte",
   "com_ui_thinking": "Réflexion en cours...",
   "com_ui_thoughts": "Pensées",
+  "com_ui_toggle_theme": "Changer de thème",
   "com_ui_token": "jeton",
   "com_ui_token_exchange_method": "Méthode d'échange de jetons",
   "com_ui_token_url": "Adresse URL du jeton",
   "com_ui_tokens": "jetons",
   "com_ui_tool_collection_prefix": "Une collection d'outils de",
+  "com_ui_tool_list_collapse": "Réduire la liste d'outils de {{serverName}}",
+  "com_ui_tool_list_expand": "Développer la liste d'outils de {{serverName}}",
   "com_ui_tools": "Outils",
+  "com_ui_tools_and_actions": "Outils et actions",
   "com_ui_transferred_to": "Transféré à",
   "com_ui_travel": "Voyage",
   "com_ui_trust_app": "J'ai confiance en cette application",
   "com_ui_try_adjusting_search": "Essayez d'ajuster vos termes de recherche",
+  "com_ui_ui_resource_error": "Erreur de ressource d'interface ({{0}})",
+  "com_ui_ui_resource_not_found": "Ressource d'interface introuvable (index : {{0}})",
   "com_ui_unarchive": "Désarchiver",
+  "com_ui_unarchive_conversation": "Désarchiver la conversation",
   "com_ui_unarchive_error": "Échec du désarchivage de la conversation",
   "com_ui_unavailable": "Indisponible",
   "com_ui_unknown": "Inconnu",
+  "com_ui_unpin": "Détacher",
   "com_ui_unset": "Non défini",
   "com_ui_untitled": "Sans titre",
   "com_ui_update": "Mettre à jour",
-  "com_ui_upload": "Télécharger",
+  "com_ui_update_mcp_server": "Mettre à jour le serveur MCP",
+  "com_ui_updating": "Mise à jour...",
+  "com_ui_upload": "Téléverser",
   "com_ui_upload_agent_avatar": "Avatar de l'agent mis à jour avec succès",
-  "com_ui_upload_agent_avatar_label": "Télécharger l'image d'avatar de l'agent",
-  "com_ui_upload_avatar_label": "Télécharger l'image d'avatar",
+  "com_ui_upload_agent_avatar_label": "Téléverser l'image d'avatar de l'agent",
+  "com_ui_upload_avatar_label": "Téléverser l'image d'avatar",
   "com_ui_upload_delay": "Le téléversement de \"{{0}}\" prend plus de temps que prévu. Veuillez patienter pendant que le fichier termine son indexation pour la récupération.",
   "com_ui_upload_error": "Une erreur s'est produite lors du téléversement de votre fichier",
-  "com_ui_upload_file_context": "Télécharger le contexte du fichier",
-  "com_ui_upload_file_search": "Télécharger pour la recherche dans un fichier",
-  "com_ui_upload_files": "Télécharger des fichiers",
-  "com_ui_upload_image": "Télécharger une image",
+  "com_ui_upload_file_context": "Téléverser le contexte du fichier",
+  "com_ui_upload_file_search": "Téléverser pour la recherche dans un fichier",
+  "com_ui_upload_files": "Téléverser des fichiers",
+  "com_ui_upload_icon": "Téléverser une image d'icône",
+  "com_ui_upload_image": "Téléverser une image",
   "com_ui_upload_image_input": "Téléverser une image",
   "com_ui_upload_invalid": "Fichier non valide pour le téléchargement. L'image ne doit pas dépasser la limite",
   "com_ui_upload_invalid_var": "Fichier non valide pour le téléchargement. L'image ne doit pas dépasser {{0}} Mo",
-  "com_ui_upload_ocr_text": "Télécharger en tant que texte",
-  "com_ui_upload_provider": "Télécharger vers le fournisseur",
+  "com_ui_upload_ocr_text": "Téléverser en tant que texte",
+  "com_ui_upload_provider": "Téléverser vers le fournisseur",
   "com_ui_upload_success": "Fichier téléversé avec succès",
   "com_ui_upload_type": "Sélectionner le type de téléversement",
   "com_ui_usage": "Utilisation",
@@ -1202,10 +1483,13 @@
   "com_ui_use_backup_code": "Utiliser un code de sauvegarde à la place",
   "com_ui_use_memory": "Utiliser le Souvenir",
   "com_ui_use_micrphone": "Utiliser le microphone",
+  "com_ui_use_prompt": "Utiliser le prompt",
   "com_ui_used": "Déjà utilisé",
   "com_ui_user": "Utilisateur",
   "com_ui_user_group_permissions": "Permissions utilisateur et groupe",
+  "com_ui_user_provides_key": "Chaque utilisateur fournit sa propre clé",
   "com_ui_value": "Valeur",
+  "com_ui_variable_with_options": "Variable {{name}} avec {{count}} options",
   "com_ui_variables": "Variables",
   "com_ui_verify": "Vérifier",
   "com_ui_version_var": "Version {{0}}",
@@ -1240,7 +1524,9 @@
   "com_ui_weekend_morning": "Joyeux week-end",
   "com_ui_write": "Ecriture",
   "com_ui_x_selected": "{{0}} sélectionné",
+  "com_ui_xhigh": "Très élevé",
   "com_ui_yes": "Oui",
+  "com_ui_your_api_key": "Votre clé API",
   "com_ui_zoom": "Zoom",
   "com_ui_zoom_in": "Zoomer",
   "com_ui_zoom_level": "Niveau de zoom",
diff --git a/client/src/locales/he/translation.json b/client/src/locales/he/translation.json
index 207ae5fd4b6..89afccf7972 100644
--- a/client/src/locales/he/translation.json
+++ b/client/src/locales/he/translation.json
@@ -2,12 +2,18 @@
   "chat_direction_left_to_right": "משמאל לימין",
   "chat_direction_right_to_left": "מימין לשמאל",
   "com_a11y_ai_composing": "הבינה המלאכותית (AI) עדיין יוצרת",
+  "com_a11y_chats_date_section": "\"צ'אטים מ-{{date}}",
   "com_a11y_end": "הבינה המלאכותית (AI) סיימה להשיב.",
+  "com_a11y_selected": "נבחרו",
   "com_a11y_start": "הבינה המלאכותית (AI) מתחילה להשיב.",
+  "com_a11y_summarize_completed": "ההקשר סוכם בהצלחה",
+  "com_a11y_summarize_failed": "שגיאה בסיכום ההקשר, ממשיך עם ההקשר הקיים",
+  "com_a11y_summarize_started": "מסכם את ההקשר",
   "com_agents_agent_card_label": "{{name}} סוכן. {{description}}",
   "com_agents_all": "כל הסוכנים",
   "com_agents_all_category": "כל",
   "com_agents_all_description": "צפה בכל הסוכנים המשותפים מכל הקטגוריות",
+  "com_agents_avatar_upload_error": "העלאת האווטר של הסוכן נכשלה",
   "com_agents_category_aftersales": "אחרי המכירה",
   "com_agents_category_aftersales_description": "סוכנים המתמחים בתמיכה, תחזוקה ושירות לקוחות לאחר המכירה",
   "com_agents_category_empty": "לא נמצאו סוכנים בקטגוריה {{category}}",
@@ -31,6 +37,7 @@
   "com_agents_copy_link": "העתק קישור",
   "com_agents_create_error": "אירעה שגיאה ביצירת הסוכן שלך.",
   "com_agents_created_by": "מאת",
+  "com_agents_description_card": "תיאור: {{description}}",
   "com_agents_description_placeholder": "אופציונלי: תאר את הסוכן שלך כאן",
   "com_agents_empty_state_heading": "לא נמצאו סוכנים",
   "com_agents_enable_file_search": "אפשר חיפוש בקבצים",
@@ -83,13 +90,15 @@
   "com_agents_not_available": "הסוכן לא זמין",
   "com_agents_recommended": "הסוכנים המומלצים שלנו",
   "com_agents_results_for": "תוצאות עבור '{{query}}'",
+  "com_agents_run_code_files": "הקבצים למטה מיועדים לסביבת קוד בלבד:",
+  "com_agents_run_code_info": "כאשר מופעל, מאפשר לסוכן שלך להריץ קוד שנוצר בצורה מאובטחת, כולל עיבוד קבצים.",
   "com_agents_search_aria": "חפש סוכנים",
   "com_agents_search_empty_heading": "אין תוצאות לחיפוש",
   "com_agents_search_info": "כאשר מופעל, מאפשר לסוכן שלך לחפש באינטרנט מידע עדכני. דורש מפתח API תקף.",
   "com_agents_search_instructions": "הקלד כדי לחפש סוכנים לפי שם או תיאור",
   "com_agents_search_name": "חפש סוכן לפי שם",
   "com_agents_search_no_results": "לא נמצאו סוכנים עבור \"{{query}}\"",
-  "com_agents_search_placeholder": "מחפש סוכנים...",
+  "com_agents_search_placeholder": "חפש סוכנים...",
   "com_agents_see_more": "ראה יותר",
   "com_agents_start_chat": "התחל צ'אט",
   "com_agents_top_picks": "הבחירות המובילות",
@@ -117,7 +126,7 @@
   "com_assistants_delete_actions_error": "אירעה שגיאה במחיקת הפעולה.",
   "com_assistants_delete_actions_success": "הפעולה נמחקה בהצלחה מהסייען",
   "com_assistants_description_placeholder": "אופציונלי: תאר את הסייען שלך כאן",
-  "com_assistants_file_search": "חיפוש קבצים",
+  "com_assistants_file_search": "חיפוש בקבצים",
   "com_assistants_file_search_info": "חיפוש קבצים מאפשר לסייען לקבל ידע מהקבצים שאתה או המשתמשים שלך מעלים. לאחר העלאת קובץ, העוזר מחליט באופן אוטומטי מתי לאחזר תוכן על סמך בקשות המשתמש. אין תמיכה בצירוף מאגרי וקטורים לחיפוש קבצים. אתה יכול לצרף אותם ממגרש החול או לצרף קבצים להודעות לחיפוש קבצים על בסיס שרשור.",
   "com_assistants_function_use": "הסייען השתמש ב{{0}}",
   "com_assistants_image_vision": "מציג תמונות",
@@ -136,6 +145,7 @@
   "com_assistants_update_actions_success": "הפעולה נוצרה או עודכנה בהצלחה",
   "com_assistants_update_error": "אירעה שגיאה בעדכון הסייען שלך.",
   "com_assistants_update_success": "עודכן בהצלחה",
+  "com_assistants_update_success_name": "{{name}} עודכן בהצלחה",
   "com_auth_already_have_account": "כבר יש לך חשבון?",
   "com_auth_apple_login": "היכנס באמצעות חשבון אפל",
   "com_auth_back_to_login": "חזור להתחברות",
@@ -216,14 +226,22 @@
   "com_endpoint_anthropic_maxoutputtokens": "מספר האסימונים המרבי שניתן להפיק בתגובה. ציין ערך נמוך יותר עבור תגובות קצרות יותר וערך גבוה יותר עבור תגובות ארוכות יותר.",
   "com_endpoint_anthropic_prompt_cache": "שמירת מטמון מהירה מאפשרת שימוש חוזר בהקשר גדול או בהוראות בקריאות API, תוך הפחתת העלויות וההשהייה",
   "com_endpoint_anthropic_temp": "נע בין 0 ל-1. השתמש בטמפ' הקרובה יותר ל-0 עבור בחירה אנליטית / מרובה, וקרוב יותר ל-1 עבור משימות יצירתיות ויצירתיות. אנו ממליצים לשנות את זה או את Top P אבל לא את שניהם.",
-  "com_endpoint_anthropic_thinking": "מאפשר חשיבה פנימית עבור דגמי Claude נתמכים (3.7 Sonnet). הערה: דורש שההגדרה של 'תקציב חשיבה' תהיה נמוכה מ'מקסימום טוקנים לפלט'",
+  "com_endpoint_anthropic_thinking": "מפעיל חשיבה פנימית עבור מודלי Claude נתמכים. עבור מודלים חדשים (Opus 4.6 ומעלה), נעשה שימוש בחשיבה אדפטיבית הנשלטת על ידי פרמטר המאמץ. עבור מודלים ישנים, יש להגדיר את \"תקציב החשיבה\" לערך נמוך מ\"מקסימום טוקני פלט\".",
   "com_endpoint_anthropic_thinking_budget": "קובע את מספר הטוקנים המקסימלי שקלוד רשאי להשתמש בו עבור תהליך החשיבה הפנימי. תקציב גבוה יותר עשוי לשפר את איכות התשובה על ידי מתן אפשרות לניתוח מעמיק יותר של בעיות מורכבות, אם כי קלוד לא בהכרח ישתמש בכל התקציב שהוקצה, במיוחד בטווחים שמעל 32K. הגדרה זו חייבת להיות נמוכה מ'מקסימום טוקנים לפלט'.",
+  "com_endpoint_anthropic_thinking_display": "הצגת תהליך החשיבה",
+  "com_endpoint_anthropic_thinking_display_desc": "קובע האם תהליך החשיבה של Claude מוצג. 'אוטומטי' מציג מחשבות מסוכמות עבור מודלים שמסתירים אותן כברירת מחדל (Opus 4.7 ומעלה); 'מסוכם' תמיד מציג אותן; 'מוסתר' תמיד מסתיר אותן לזמן תגובה מעט מהיר יותר.",
   "com_endpoint_anthropic_topk": "Top-k משנה את האופן שבו המודל בוחר אסימונים לפלט. Top-k של 1 פירושו שהאסימון שנבחר הוא הסביר ביותר מבין כל האסימונים באוצר המילים של הדגם (נקרא גם פענוח חמדן), בעוד ש-top-k של 3 פירושו שהאסימון הבא נבחר מבין 3 הכי הרבה. אסימונים סבירים (באמצעות טמפרטורה).",
   "com_endpoint_anthropic_topp": "Top-p משנה את האופן שבו המודל בוחר אסימונים לפלט. אסימונים נבחרים מבין רוב K (ראה פרמטר topK) הסביר לפחות עד שסכום ההסתברויות שלהם שווה לערך העליון-p.",
   "com_endpoint_anthropic_use_web_search": "הפעל אפשרות חיפוש ברשת באמצעות יכולות החיפוש המובנות של קלוד. זה מאפשר למודל לחפש באינטרנט מידע עדכני ולספק תשובות מדויקות ועדכניות יותר.",
   "com_endpoint_assistant": "סייען",
   "com_endpoint_assistant_model": "מודל סייען",
   "com_endpoint_assistant_placeholder": "אנא בחר סייען מלוח הצד הימני",
+  "com_endpoint_bedrock_reasoning_effort": "קובע את רמת החשיבה עבור מודלי Bedrock נתמכים (לדוגמה Kimi K2.5, GLM). רמות גבוהות יותר מייצרות חשיבה מעמיקה יותר, אך דורשות זמן תגובה וטוקנים רבים יותר.",
+  "com_endpoint_config_bedrock_access_key_id": "מזהה מפתח גישה AWS (Access Key ID)",
+  "com_endpoint_config_bedrock_bearer_token": "מפתח API של AWS Bedrock",
+  "com_endpoint_config_bedrock_credentials_required": "יש לספק מפתח API של AWS Bedrock או מפתחות גישה של AWS (במקרה של מפתחות גישה יש לספק: Access Key ID + Secret Access Key)",
+  "com_endpoint_config_bedrock_secret_access_key": "מפתח גישה סודי (Secret Access Key) AWS",
+  "com_endpoint_config_bedrock_session_token": "אסימון הפעלה (Session Token) AWS",
   "com_endpoint_config_click_here": "לחץ כאן",
   "com_endpoint_config_google_api_info": "כדי לקבל את מפתח ה-API של Generative Language (עבור תאומים),",
   "com_endpoint_config_google_api_key": "מפתח Google API",
@@ -244,6 +262,7 @@
   "com_endpoint_config_key_name": "מפתח",
   "com_endpoint_config_key_never_expires": "המפתח שלך לא יפוג לעולם",
   "com_endpoint_config_placeholder": "הגדר את המפתח שלך בתפריט הכותרת לצאט.",
+  "com_endpoint_config_required_fields": "יש למלא את השדות הבאים:",
   "com_endpoint_config_value": "הזן ערך עבור",
   "com_endpoint_context": "הקשר",
   "com_endpoint_context_info": "המספר המרבי של הטוקנים שניתן להשתמש בהם בחלון ההקשר. השתמש בזה כדי לשלוט בכמה טוקנים ישלחו בכל בקשה. אם לא צוין, יתבצע שימוש בברירת המחדל של המערכת המבוססות על גודל חלון ההקשר ברירת המחדל של המודלים. הגדרת ערכים גבוהים יותר עלולה לגרום לשגיאות ו/או עלות טוקנים גבוהה יותר.",
@@ -254,6 +273,7 @@
   "com_endpoint_default_with_num": "ברירת מחדל: {{0}}",
   "com_endpoint_disable_streaming": "השבתת תגובות סטרימינג וקבלת התגובה המלאה בבת אחת. שימושי עבור דגמים כמו o3 הדורשים ארגון מאומת כדי לאפשר סטרימינג",
   "com_endpoint_disable_streaming_label": "השבתת סטרימינג",
+  "com_endpoint_effort": "רמת המאמץ",
   "com_endpoint_examples": "הגדרות קבועות מראש",
   "com_endpoint_export": "ייצוא",
   "com_endpoint_export_share": "ייצא/שתף",
@@ -261,8 +281,9 @@
   "com_endpoint_google_custom_name_placeholder": "הגדר שם מותאם אישית עבור Google",
   "com_endpoint_google_maxoutputtokens": " המספר המרבי של אסימונים שניתן להפיק בתגובה. ציין ערך נמוך יותר עבור תגובות קצרות יותר וערך גבוה יותר עבור תגובות ארוכות יותר.",
   "com_endpoint_google_temp": "ערכים גבוהים יותר = יותר אקראיים, בעוד שערכים נמוכים יותר = יותר ממוקד ודטרמיניסטי. אנו ממליצים לשנות את זה או את Top P אבל לא את שניהם.",
-  "com_endpoint_google_thinking": "מאפשר או מבטל את החשיבה. הגדרה זו נתמכת רק על ידי דגמים מסוימים (סדרה 2.5). עבור דגמים ישנים יותר, ייתכן שלהגדרה זו לא תהיה השפעה.",
-  "com_endpoint_google_thinking_budget": "מנחה את מספר טוקני החשיבה שהמודל משתמש בהם. הכמות בפועל עלולה לחרוג או להיות נמוכה מערך זה בהתאם לפרומפט.\n\nהגדרה זו נתמכת רק על ידי מודלים מסוימים (סדרת 2.5). Gemini 2.5 Pro תומך ב-128-32,768 טוקנים. Gemini 2.5 Flash תומך ב-0-24,576 טוקנים. Gemini 2.5 Flash Lite תומך ב-512-24,576 טוקנים.\n\nהשאירו ריק או הגדירו ל-\"-1\" כדי לאפשר למודל להחליט באופן אוטומטי מתי וכמה לחשוב. כברירת מחדל, Gemini 2.5 Flash Lite לא חושב.",
+  "com_endpoint_google_thinking": "מפעיל או משבית חשיבה. נתמך על ידי סדרות Gemini 2.5 ו-3. הערה: לא ניתן להשבית את החשיבה במלואה ב-Gemini 3 Pro",
+  "com_endpoint_google_thinking_budget": "מנחה את מספר טוקני החשיבה שבהם משתמש המודל. הכמות בפועל עשויה להיות גבוהה או נמוכה מערך זה, בהתאם להנחיה.\n\nהגדרה זו חלה רק על Gemini 2.5 ומודלים ישנים יותר. עבור Gemini 3 ואילך, השתמש בהגדרת \"רמת החשיבה\".\n\nGemini 2.5 Pro תומך ב-128 עד 32,768 טוקנים. Gemini 2.5 Flash תומך ב-0 עד 24,576 טוקנים. Gemini 2.5 Flash Lite תומך ב-512 עד 24,576 טוקנים.\n\nהשאר ריק או הגדר ל-\"-1\" כדי לאפשר למודל להחליט באופן אוטומטי מתי וכמה לחשוב. כברירת מחדל, Gemini 2.5 Flash Lite אינו חושב.",
+  "com_endpoint_google_thinking_level": "קובע את עומק החשיבה עבור Gemini 3 ואילך. אין לו השפעה על Gemini 2.5 וקודמים - עבורם השתמש ב'תקציב חשיבה'.\n\nהשאר על 'אוטומטי' לברירת מחדל של המודל.",
   "com_endpoint_google_topk": "Top-k משנה את האופן שבו המודל בוחר אסימונים לפלט. Top-k של 1 פירושו שהאסימון שנבחר הוא הסביר ביותר מבין כל האסימונים באוצר המילים של הדגם (נקרא גם פענוח חמדן), בעוד ש-top-k של 3 פירושו שהאסימון הבא נבחר מבין 3 הכי הרבה. אסימונים סבירים (באמצעות טמפרטורה).",
   "com_endpoint_google_topp": "Top-p משנה את האופן שבו המודל בוחר אסימונים לפלט. אסימונים נבחרים מרוב K (ראה פרמטר topK) ככל הנראה לפחות עד ה-sum של ההסתברויות שלהם שווה לערך ה-p העליון.",
   "com_endpoint_google_use_search_grounding": "השתמשו בחיפוש גוגל כדי לשפר את התגובות עם תוצאות חיפוש בזמן אמת. זה מאפשר למודלים לגשת למידע עדכני ולספק תשובות מדויקות ועדכניות יותר",
@@ -303,6 +324,7 @@
   "com_endpoint_preset_default_removed": "איננו עוד ברירת המחדל המוגדרת מראש.",
   "com_endpoint_preset_delete_confirm": "האם אתה בטוח שברצונך למחוק את הקביעה המוגדרת מראש הזו?",
   "com_endpoint_preset_delete_error": "אירעה שגיאה במחיקת הקביעה המוגדרת מראש שלך. בבקשה נסה שוב.",
+  "com_endpoint_preset_delete_success": "ההגדרה השמורה נמחקה בהצלחה",
   "com_endpoint_preset_import": "הגדרה מראש מיובאת!",
   "com_endpoint_preset_import_error": "אירעה שגיאה בייבוא הקביעה המוגדרת מראש שלך. בבקשה נסה שוב.",
   "com_endpoint_preset_name": "שם מוגדר מראש",
@@ -322,7 +344,7 @@
   "com_endpoint_save_as_preset": "שמור כתבנית",
   "com_endpoint_search": "חפש נקודת קצה לפי שם",
   "com_endpoint_search_endpoint_models": "חפש מודלים של {{0}}...",
-  "com_endpoint_search_models": "חפש מו",
+  "com_endpoint_search_models": "חפש מודלים...",
   "com_endpoint_search_var": "חפש {{0}}...",
   "com_endpoint_set_custom_name": "הגדר שם מותאם אישית, למקרה שתוכל למצוא את הקביעה המוגדרת מראש",
   "com_endpoint_stop": "רצף לעצירה",
@@ -330,6 +352,7 @@
   "com_endpoint_temperature": "טמפרטורה",
   "com_endpoint_thinking": "חשיבה",
   "com_endpoint_thinking_budget": "תקציב חשיבה",
+  "com_endpoint_thinking_level": "רמת חשיבה",
   "com_endpoint_top_k": "Top K",
   "com_endpoint_top_p": "Top P",
   "com_endpoint_use_active_assistant": "השתמש ב-סייען פעיל",
@@ -350,12 +373,15 @@
   "com_error_illegal_model_request": "המודל \"{{0}}\" אינו זמין עבור {{1}}. אנא בחר מודל אחר",
   "com_error_input_length": "מספר הטוקנים של ההודעות האחרונות גבוה מדי, והוא חורג ממגבלת האסימונים ({{0}} בהתאמה. אנא קצר את ההודעה שלך, שנה את גודל ההקשר המקסימלי בפרמטרי השיחה, או התחל שיחה חדשה.",
   "com_error_invalid_agent_provider": "המודלים של \"{{0}}\" אינם זמינים לשימוש עם סוכנים. אנא עבור להגדרות הסוכן שלך ובחר ספק הזמין כרגע.",
+  "com_error_invalid_base_url": "כתובת ה-URL שסיפקת מכוונת לכתובת מוגבלת. אנא השתמש בכתובת URL חיצונית תקינה ונסה שוב.",
   "com_error_invalid_user_key": "מפתח שסופק אינו חוקי. אנא ספק מפתח חוקי ונסה שוב.",
   "com_error_missing_model": "לא נבחר מודל עבור {{0}}. אנא בחר מודל ונסה שוב",
   "com_error_models_not_loaded": "לא ניתן היה לטעון את תצורת המודלים. אנא רענן את העמוד ונסה שוב",
   "com_error_moderation": "נראה שהתוכן שנשלח סומן על ידי מערכת הניהול שלנו בגלל שהוא אינו תואם את הנחיות הקהילה שלנו. אנחנו לא יכולים להמשיך עם הנושא הספציפי הזה. אם יש לך שאלות או נושאים אחרים שתרצה לחקור, אנא ערוך את ההודעה שלך, או צור שיחה חדשה.",
   "com_error_no_base_url": "לא נמצאה כתובת URL. אנא ספק כתובת ונסה שוב.",
   "com_error_no_user_key": "לא נמצא מפתח. אנא ספק מפתח ונסה שוב.",
+  "com_error_refusal": "התשובה נחסמה על ידי מסנני בטיחות. נסח מחדש את ההודעה שלך ונסה שוב. אם אתה נתקל בבעיה זו לעתים קרובות בשימוש ב-Claude Sonnet 4.5 או Opus 4.1, אתה יכול לנסות את Sonnet 4, שיש לו מגבלות שימוש שונות.",
+  "com_error_stream_expired": "החיבור לתגובה פג או הסתיים. נא לנסות שוב.",
   "com_file_pages": "עמודים: {{דפים}}",
   "com_file_source": "קובץ",
   "com_file_unknown": "קובץ לא ידוע",
@@ -364,19 +390,32 @@
   "com_files_download_progress": "{{0}} מתוך {{1}} קבצים",
   "com_files_downloading": "הורדת קבצים",
   "com_files_filter": "סינון קבצים...",
+  "com_files_filter_by": "סנן קבצים לפי...",
   "com_files_no_results": "אין תוצאות",
   "com_files_number_selected": "{{0}} מתוך {{1}} פריטים נבחרו",
   "com_files_preparing_download": "מכין את ההורדה...",
+  "com_files_results_found": "נמצאו {{count}} תוצאות",
   "com_files_sharepoint_picker_title": "בחירת קבצים",
-  "com_files_table": "השדה חייב להכיל תוכן, הוא אינו יכול להישאר ריק",
+  "com_files_table": "רשימת קבצים",
   "com_files_upload_local_machine": "מהמחשב המקומי",
   "com_files_upload_sharepoint": "מ-SharePoint",
   "com_generated_files": "קבצים שנוצרו:",
   "com_hide_examples": "הסתר דוגמאות",
   "com_info_heic_converting": "המרת התמונה מפורמט HEIC לפורמט JPEG...",
   "com_nav_2fa": "אימות דו-שלבי (2FA)",
+  "com_nav_about_branch": "ענף (Branch)",
+  "com_nav_about_build_date": "תאריך בנייה",
+  "com_nav_about_commit": "קומיט (Commit)",
+  "com_nav_about_diagnostics_copied": "הועתק ללוח",
+  "com_nav_about_diagnostics_copy": "העתק אבחון",
+  "com_nav_about_diagnostics_description": "העתק את המידע הזה כשאתה פונה לתמיכה, כדי שנוכל לדעת בדיוק איזו גרסה אתה משתמש.",
+  "com_nav_about_diagnostics_heading": "אבחון",
+  "com_nav_about_version": "גרסה",
+  "com_nav_about_version_heading": "פרטי גרסת בנייה (Build)",
   "com_nav_account_settings": "הגדרות חשבון",
-  "com_nav_always_make_prod": "ייצר תמיד גרסאות חדשות",
+  "com_nav_advanced_prompts": "עורך הנחיות (פרומפטים - Prompts) מתקדם",
+  "com_nav_advanced_prompts_desc": "הפעל ניהול גרסאות ובקרת ייצור עבור הנחיות (פרומפטים - Prompts)",
+  "com_nav_always_make_prod": "הגדר תמיד גרסאות פרומפט חדשות כגרסת ייצור",
   "com_nav_archive_created_at": "תאריך ייצור",
   "com_nav_archive_name": "שם",
   "com_nav_archived_chats": "שיחות בארכיון",
@@ -384,8 +423,10 @@
   "com_nav_at_command_description": "הפקודה \"@\" משמשת כמנגנון הפעלה/החלפה של נקודות קצה, מודלים, הגדרות קבועות מראש וכו'.",
   "com_nav_audio_play_error": "שגיאה בהפעלת אודיו: {{0}}",
   "com_nav_audio_process_error": "שגיאה בעיבוד האודיו: {{0}}",
+  "com_nav_auto_expand_tools": "הצג פרטי כלים באופן אוטומטי",
   "com_nav_auto_scroll": "בפתיחת צ׳אט גלול אוטומטית להודעה האחרונה",
-  "com_nav_auto_send_prompts": "שליחת הנחיות (פרומפטים) אוטומטית",
+  "com_nav_auto_send_prompts": "שלח פרומפטים אוטומטית בעת בחירה",
+  "com_nav_auto_send_prompts_desc": "שלח את ההנחיות (פרומפטים - Prompts) אוטומטית לצ'אט עם הבחירה",
   "com_nav_auto_send_text": "טקסט לשליחה אוטומטית",
   "com_nav_auto_transcribe_audio": "תמלול אוטומטי של אודיו",
   "com_nav_automatic_playback": "הפעלה אוטומטית של ההודעה האחרונה",
@@ -417,6 +458,7 @@
   "com_nav_chat_commands": "פקודות צ'אט",
   "com_nav_chat_commands_info": "פקודות אלו מופעלות על ידי הקלדת תווים ספציפיים בתחילת ההודעה. כל פקודה מופעלת על ידי הקידומת המיועדת לה. אתה יכול להשבית אותם אם אתה משתמש בתווים אלה לעתים קרובות כדי להתחיל הודעות.",
   "com_nav_chat_direction": "כיוון הכתיבה",
+  "com_nav_chat_direction_selected": "כיוון הצ'אט: {{direction}}",
   "com_nav_clear_all_chats": "נקה את כל השיחות",
   "com_nav_clear_cache_confirm_message": "האם אתה בטוח שברצונך לנקות את המטמון?",
   "com_nav_clear_conversation": "נקה שיחות",
@@ -424,6 +466,7 @@
   "com_nav_close_sidebar": "סגור סרגל צד",
   "com_nav_commands": "פקודות",
   "com_nav_confirm_clear": "אשר ניקוי",
+  "com_nav_control_panel": "לוח בקרה",
   "com_nav_conversation_mode": "מצב שיחה ",
   "com_nav_convo_menu_options": "אפשרויות מצב שיחה",
   "com_nav_db_sensitivity": "רגישות דציבלים",
@@ -459,6 +502,7 @@
   "com_nav_info_code_artifacts": "אפשר הצגה של רכיבי תצוגת קוד ניסיוניים לצד הצ'אט",
   "com_nav_info_code_artifacts_agent": "אפשר שימוש ברכיבי תצוגת קוד עבור סוכן זה כברירת מחדל, מתווספות הוראות נוספות ספציפיות לשימוש ברכיבי התצוגה אלא אם \"מצב הנחיה מותאם אישית\" מופעל.",
   "com_nav_info_custom_prompt_mode": "כאשר אפשרות זו מופעלת, הנחיית ברירת המחדל של מערכת רכיבי תצוגה לא תיכלל. כל ההוראות ליצירת רכיבי תצוגה יהיו חייבות להינתן באופן ידני במצב זה.",
+  "com_nav_info_default_temporary_chat": "כאשר מופעל, כל שיחה חדשה תתחיל כצ'אט זמני אוטומטית. צ'אטים זמניים לא נשמרים בהיסטוריה",
   "com_nav_info_enter_to_send": "כאשר מופעל, לחיצה על \"ENTER\" תשלח את ההודעה שלך, כאשר מושבת לחיצה על \"Enter\" תוסיף שורה חדשה, ותצטרך ללחוץ על \"CTRL + ENTER\" כדי לשלוח את ההודעה.",
   "com_nav_info_fork_change_default": "'הודעות ישירות בלבד' כולל רק את הנתיב הישיר להודעה שנבחרה. 'כלול הסתעפויות קשורות' מוסיף את כל ההסתעפויות הקשורות לאורך הנתיב. 'כלול הכל עד כאן/מכאן' כולל את כל ההודעות וההסתעפויות המחוברות.",
   "com_nav_info_fork_split_target_setting": "כאשר אפשרות זו מופעלת, הפיצול יתחיל מהודעת היעד ועד להודעה האחרונה בשיחה, בהתאם להתנהגות שנבחרה",
@@ -468,6 +512,7 @@
   "com_nav_info_save_draft": "כאשר אפשרות זו מופעלת, הטקסט והקבצים המצורפים שאתה מזין בטופס הצ'אט יישמרו באופן אוטומטי כטיוטות במכשיר שלך. טיוטות אלו יהיו זמינות גם אם תטען מחדש את הדף או תעבור לשיחה אחרת. הטיוטות נשמרות באופן מקומי במכשיר שלך ונמחקות לאחר שליחת ההודעה.",
   "com_nav_info_show_thinking": "כאשר אפשרות זו מופעלת, תיבות תצוגה שמציגות את תהליך החשיבה של הבינה המלאכותית יופיעו פתוחות כברירת מחדל, כך שתוכל לראות את תהליך הניתוח בזמן אמת. כאשר האפשרות מושבתת, תיבות הבחירה יישארו סגורות כברירת מחדל, מה שיוצר ממשק נקי וזורם יותר.",
   "com_nav_info_user_name_display": "כאשר אפשרות זו מופעלת, שם המשתמש של השולח יוצג מעל כל הודעה שאתה שולח. כאשר האפשרות מושבתת, יוצג רק הכיתוב \"אתה\" מעל ההודעות שלך.",
+  "com_nav_keep_screen_awake": "מנע את כיבוי המסך בזמן יצירת תשובה",
   "com_nav_lang_arabic": "ערבית (العربية)",
   "com_nav_lang_armenian": "ארמנית (Հայերեն)",
   "com_nav_lang_auto": "זיהוי באופן אוטומטי",
@@ -486,16 +531,20 @@
   "com_nav_lang_german": "גרמנית (Deutsch)",
   "com_nav_lang_hebrew": "עברית",
   "com_nav_lang_hungarian": "הונגרית",
+  "com_nav_lang_icelandic": "איסלנדית (Íslenska)",
   "com_nav_lang_indonesia": "אינדונזית (Indonesia)",
   "com_nav_lang_italian": "איטלקית (Italiano)",
   "com_nav_lang_japanese": "יפנית (日本語)",
   "com_nav_lang_korean": "קוראנית (한국어)",
   "com_nav_lang_latvian": "לטבית (Latviski)",
+  "com_nav_lang_lithuanian": "ליטאית (Lietuvių)",
   "com_nav_lang_norwegian_bokmal": "נורווגית (Norsk Bokmål)",
+  "com_nav_lang_norwegian_nynorsk": "נורווגית ניינורסק (Norsk Nynorsk)",
   "com_nav_lang_persian": "פרסית",
   "com_nav_lang_polish": "פולנית (Polski)",
   "com_nav_lang_portuguese": "פורטוגזית (Português)",
   "com_nav_lang_russian": "רוסית (Русский)",
+  "com_nav_lang_slovak": "סלובקית (Slovenčina)",
   "com_nav_lang_slovenian": "סלובנית (Slovenščina)",
   "com_nav_lang_spanish": "ספרדית (Español)",
   "com_nav_lang_swedish": "שוודית (Svenska)",
@@ -511,12 +560,23 @@
   "com_nav_log_out": "צא",
   "com_nav_long_audio_warning": "העיבוד של טקסטים ארוכים ייקח יותר זמן.",
   "com_nav_maximize_chat_space": "הגדל את שטח הצ'אט",
+  "com_nav_mcp_access_revoked": "הגישה לשרת MCP בוטלה בהצלחה",
   "com_nav_mcp_configure_server": "הגדרת {{0}}",
+  "com_nav_mcp_connect": "חבר",
+  "com_nav_mcp_connect_server": "חבר את {{0}}",
+  "com_nav_mcp_reconnect": "חבר מחדש",
+  "com_nav_mcp_status_connected": "מחובר",
   "com_nav_mcp_status_connecting": "{{0}} - חיבור",
+  "com_nav_mcp_status_disconnected": "מנותק",
+  "com_nav_mcp_status_error": "שגיאה",
+  "com_nav_mcp_status_initializing": "מאתחל",
+  "com_nav_mcp_status_needs_auth": "דורש אימות",
+  "com_nav_mcp_status_unknown": "לא ידוע",
   "com_nav_mcp_vars_update_error": "שגיאה בעדכון משתנה משתמש מותאם אישית של MCP",
   "com_nav_mcp_vars_updated": "משתני משתמש מותאמים אישית של MCP עודכנו בהצלחה.",
   "com_nav_modular_chat": "אפשר החלפת נקודות קצה באמצע שיחה",
   "com_nav_my_files": "הקבצים שלי",
+  "com_nav_new_chat_switch_to_history": "הצג היסטוריית צ'אט כשנוצרת שיחה חדשה",
   "com_nav_not_supported": "לא נתמך",
   "com_nav_open_sidebar": "פתח סרגל צד",
   "com_nav_playback_rate": "קצב השמעת האודיו",
@@ -529,6 +589,7 @@
   "com_nav_scroll_button": "לחצן לגלילה עד הסוף",
   "com_nav_search_placeholder": "חפש הודעות",
   "com_nav_send_message": "שלח הודעה",
+  "com_nav_setting_about": "אודות",
   "com_nav_setting_account": "חשבון",
   "com_nav_setting_balance": "לאזן",
   "com_nav_setting_chat": "צ'אט",
@@ -561,7 +622,7 @@
   "com_nav_user_name_display": "הצג שם משתמש בהודעות",
   "com_nav_voice_select": "קול",
   "com_show_examples": "הצג דוגמאות",
-  "com_sidepanel_agent_builder": "בניית סוכן",
+  "com_sidepanel_agent_builder": "בניית ועריכת סוכנים",
   "com_sidepanel_assistant_builder": "בניית סייען",
   "com_sidepanel_attach_files": "צרף קבצים",
   "com_sidepanel_conversation_tags": "סימניות",
@@ -595,22 +656,34 @@
   "com_ui_2fa_generate_error": "תרחשה שגיאה בעת יצירת הגדרות האימות הדו-שלבי (2FA)",
   "com_ui_2fa_invalid": "קוד האימות הדו-שלבי שגוי",
   "com_ui_2fa_setup": "הגדר אימות דו-שלבי (2FA)",
+  "com_ui_2fa_verification_required": "הזן את קוד האימות הדו-שלבי (2FA) שלך כדי להמשיך",
   "com_ui_2fa_verified": "האימות הדו-שלבי אומת בהצלחה",
   "com_ui_accept": "אני מקבל",
   "com_ui_action_button": "לחצן פעולה",
   "com_ui_active": "פעיל",
   "com_ui_add": "הוסף",
+  "com_ui_add_first_bookmark": "לחץ על שיחה כדי להוסיף",
+  "com_ui_add_first_mcp_server": "צור את שרת ה-MCP הראשון שלך כדי להתחיל",
+  "com_ui_add_first_prompt": "צור את ההנחיה (פרומפט - prompt) הראשונה שלך כדי להתחיל",
+  "com_ui_add_labels": "הוסף תוויות",
   "com_ui_add_mcp": "הוסף MCP",
   "com_ui_add_mcp_server": "הוסף שרת MCP",
   "com_ui_add_model_preset": "הוספת מודל או הגדרה קבועה לתגובה נוספת",
   "com_ui_add_multi_conversation": "הוספת תמיכה בשיחות מרובות",
+  "com_ui_add_skills": "הוסף מיומנויות (Skills)",
+  "com_ui_add_special_variables": "הוסף משתנים מיוחדים",
+  "com_ui_add_web_search_api_keys": "הוסף מפתחות API לחיפוש ברשת",
   "com_ui_adding_details": "הוספת פרטים",
+  "com_ui_additional_details": "פרטים נוספים",
   "com_ui_admin": "אדמין",
   "com_ui_admin_access_warning": "השבתת גישת המנהל לתכונה זו עלולה לגרום לבעיות בלתי צפויות בממשק המשתמש שידרשו רענון. אם השינוי נשמר, הדרך היחידה להחזיר את ההגדרה היא דרך הגדרת הממשק בקובץ librechat.yaml, שמשפיעה על כל התפקידים.",
   "com_ui_admin_settings": "הגדרות אדמין",
+  "com_ui_admin_settings_section": "הגדרות ניהול - {{section}}",
   "com_ui_advanced": "מתקדם",
   "com_ui_advanced_settings": "הגדרות מתקדמות",
   "com_ui_agent": "סוכן",
+  "com_ui_agent_api_keys": "מפתחות API של סוכנים",
+  "com_ui_agent_api_keys_description": "צור מפתחות API כדי לגשת לסוכנים מרחוק דרך ה-API",
   "com_ui_agent_category_aftersales": "אחרי המכירה",
   "com_ui_agent_category_finance": "פיננסי",
   "com_ui_agent_category_general": "כללי",
@@ -624,11 +697,35 @@
   "com_ui_agent_chain_max": "הגעת למקסימום של {{0}} סוכנים.",
   "com_ui_agent_delete_error": "אירעה שגיאה בעת מחיקת הסוכן.",
   "com_ui_agent_deleted": "הסוכן נמחק בהצלחה.",
+  "com_ui_agent_description": "תיאור הסוכן",
   "com_ui_agent_duplicate_error": "אירעה שגיאה בעת שכפול הסוכן",
   "com_ui_agent_duplicated": "הסוכן שוכפל בהצלחה",
+  "com_ui_agent_handoff_add": "הוסף סוכן להעברת שיחה",
+  "com_ui_agent_handoff_description": "תיאור ההעברה",
+  "com_ui_agent_handoff_description_placeholder": "לדוגמה, העברה לאנליסט נתונים לניתוח סטטיסטי",
+  "com_ui_agent_handoff_info": "הגדר סוכנים שסוכן זה יכול להעביר אליהם שיחות כשנדרשת מומחיות ספציפית.",
+  "com_ui_agent_handoff_info_2": "כל העברה יוצרת כלי שמאפשר ניתוב חלק לסוכנים מומחים יחד עם ההקשר.",
+  "com_ui_agent_handoff_max": "הגעת למספר המקסימלי של {{0}} סוכני העברה.",
+  "com_ui_agent_handoff_prompt": "תוכן מועבר",
+  "com_ui_agent_handoff_prompt_key": "שם משתנה התוכן (ברירת מחדל: 'instructions')",
+  "com_ui_agent_handoff_prompt_key_placeholder": "תן תווית לתוכן המועבר (ברירת מחדל: 'instructions')",
+  "com_ui_agent_handoff_prompt_placeholder": "ציין לסוכן זה איזה תוכן ליצור ולהעביר לסוכן היעד. עליך להוסיף משהו כאן כדי להפעיל תכונה זו",
+  "com_ui_agent_handoffs": "העברות סוכנים",
+  "com_ui_agent_name": "שם הסוכן",
   "com_ui_agent_name_is_required": "שם הסוכן הוא שדה חובה",
   "com_ui_agent_recursion_limit": "מספר מרבי של שלבי סוכן",
   "com_ui_agent_recursion_limit_info": "מגביל את מספר השלבים שהסוכן יכול לבצע בריצה לפני מתן תגובה סופית. ברירת המחדל היא 25 שלבים. שלב הוא בקשת API של בינה מלאכותית או סבב שימוש בכלי. לדוגמה, אינטראקציה בסיסית עם כלי לוקחת 3 שלבים: בקשה ראשונית, שימוש בכלי, ובקשת המשך.",
+  "com_ui_agent_subagents": "תת-סוכנים",
+  "com_ui_agent_subagents_add": "הוסף תת-סוכן",
+  "com_ui_agent_subagents_agents": "תת-סוכנים נוספים",
+  "com_ui_agent_subagents_allow_self": "אפשר הפעלה עצמאית",
+  "com_ui_agent_subagents_allow_self_info": "אפשר לסוכן זה להאציל משימות-משנה ממוקדות להעתק של עצמו בחלון הקשר מבודד.",
+  "com_ui_agent_subagents_empty": "אין תת-סוכנים זמינים: הפעל יצירה עצמית או הוסף לפחות סוכן אחד.",
+  "com_ui_agent_subagents_enable": "הפעל תת-סוכנים",
+  "com_ui_agent_subagents_info": "תת-סוכנים רצים בחלונות הקשר מבודדים. פלט מפורט של כלים נשאר מוגבל לתת-הסוכן; רק סיכום חוזר לסוכן זה.",
+  "com_ui_agent_subagents_info_2": "הפעלה ללא סוכנים ברשימה עדיין מאפשרת יצירה עצמית, כך שהסוכן יכול להאציל משימות-משנה ממוקדות לעותק חדש של עצמו.",
+  "com_ui_agent_subagents_max": "הגעת למספר המקסימלי של {{0}} תת-סוכנים.",
+  "com_ui_agent_subagents_remove": "הסר את {{0}} מתת-הסוכנים",
   "com_ui_agent_url_copied": "כתובת ה-URL של הסוכן הועתקה ללוח",
   "com_ui_agent_var": "{{0}} סוכנים",
   "com_ui_agent_version": "גרסה",
@@ -647,16 +744,28 @@
   "com_ui_agents": "סוכנים",
   "com_ui_agents_allow_create": "אפשר יצירת סוכנים",
   "com_ui_agents_allow_share": "אפשר שיתוף סוכנים",
+  "com_ui_agents_allow_share_public": "אפשר שיתוף סוכנים באופן ציבורי",
   "com_ui_agents_allow_use": "אפשר שימוש בסוכנים",
   "com_ui_all": "הכל",
   "com_ui_all_proper": "הכל",
   "com_ui_analyzing": "ניתוח",
   "com_ui_analyzing_finished": "סיים ניתוח",
   "com_ui_api_key": "מפתח API",
+  "com_ui_api_key_copied": "מפתח API הועתק ללוח ההעתקה",
+  "com_ui_api_key_create_error": "יצירת מפתח API נכשלה",
+  "com_ui_api_key_created": "מפתח API נוצר בהצלחה",
+  "com_ui_api_key_delete_error": "מחיקת מפתח API נכשלה",
+  "com_ui_api_key_deleted": "מפתח API נמחק בהצלחה",
+  "com_ui_api_key_name": "שם המפתח",
+  "com_ui_api_key_name_placeholder": "מפתח ה-API שלי",
+  "com_ui_api_key_name_required": "שם מפתח API הוא שדה חובה",
+  "com_ui_api_key_warning": "הקפד להעתיק את מפתח ה-API עכשיו. לא תוכל לראות אותו שוב!",
+  "com_ui_api_keys_load_error": "טעינת מפתחות API נכשלה",
   "com_ui_archive": "לארכיון",
   "com_ui_archive_delete_error": "מחיקת השיחה מהארכיון נכשלה",
   "com_ui_archive_error": "אירעה שגיאה באירכוב השיחה",
   "com_ui_artifact_click": "לחץ לפתיחה",
+  "com_ui_artifact_preview_pending": "_התצוגה המקדימה עדיין לא זמינה — לחץ על **הורדה** כדי לצפות בקובץ._",
   "com_ui_artifacts": "רכיבי תצוגה",
   "com_ui_artifacts_options": "אפשרויות ארטיפקטים",
   "com_ui_artifacts_toggle": "הפעל/כבה רכיבי תצוגה",
@@ -669,8 +778,11 @@
   "com_ui_assistants_output": "פלט סייענים",
   "com_ui_at_least_one_owner_required": "נדרש לפחות בעלים אחד",
   "com_ui_attach_error": "לא ניתן לצרף קובץ. צור או בחר שיחה, או נסה לרענן את הדף.",
+  "com_ui_attach_error_disabled": "העלאת קבצים מושבתת עבור נקודת קצה זו",
+  "com_ui_attach_error_limit": "הגעת למגבלת הקבצים:",
   "com_ui_attach_error_openai": "לא ניתן לצרף את קבצי הסייען לנקודות קצה אחרות",
   "com_ui_attach_error_size": "חרגת ממגבלת גודל הקובץ עבור נקודת הקצה:",
+  "com_ui_attach_error_total_size": "חריגה ממגבלת הגודל הכולל של קבצים עבור נקודת קצה:",
   "com_ui_attach_error_type": "סוג קובץ לא נתמך עבור נקודת קצה:",
   "com_ui_attach_remove": "הסר את הקובץ",
   "com_ui_attach_warn_endpoint": "עשוי להתעלם מקבצים שאינם של הסייען שאין להם כלי תואם",
@@ -681,10 +793,12 @@
   "com_ui_authentication": "אימות",
   "com_ui_authentication_type": "סוג אימות",
   "com_ui_auto": "אוטומטי",
+  "com_ui_available_options": "אפשרויות זמינות",
   "com_ui_avatar": "אווטאר",
   "com_ui_azure": "אז'ור (Azure)",
   "com_ui_azure_ad": "שירות ניהול זהויות וגישה של מיקרוסופט (Entra ID)",
   "com_ui_back": "חזור",
+  "com_ui_back_to_builder": "חזרה לבונה",
   "com_ui_back_to_prompts": "חזור להנחיות (פרומפטים)",
   "com_ui_backup_code_number": "קוד {{number}}#",
   "com_ui_backup_codes": "קודי גיבוי",
@@ -695,10 +809,12 @@
   "com_ui_basic": "בסיסי",
   "com_ui_basic_auth_header": "כותרת אימות בסיסי",
   "com_ui_bearer": "נושא הרשאה",
+  "com_ui_beta": "בטא",
   "com_ui_bookmark_delete_confirm": "האם אתה בטוח שברצונך למחוק את הסימניה הזו?",
   "com_ui_bookmarks": "סימניות",
   "com_ui_bookmarks_add": "הוסף סימניות",
   "com_ui_bookmarks_add_to_conversation": "הוסף לשיחה הנוכחית",
+  "com_ui_bookmarks_count_selected": "{{count}} סימניות נבחרו",
   "com_ui_bookmarks_create_error": "אירעה שגיאה בעת יצירת הסימניה",
   "com_ui_bookmarks_create_exists": "סימניה זו כבר קיימת",
   "com_ui_bookmarks_create_success": "הסימניה נוצרה בהצלחה",
@@ -713,52 +829,98 @@
   "com_ui_bookmarks_title": "כותרת",
   "com_ui_bookmarks_update_error": "אירעה שגיאה בעת עדכון הסימניה",
   "com_ui_bookmarks_update_success": "הסימניה עודכנה בהצלחה",
+  "com_ui_branch_created": "הענף נוצר בהצלחה",
+  "com_ui_branch_error": "יצירת הענף נכשלה",
+  "com_ui_branch_message": "צור ענף מתגובה זו",
+  "com_ui_by_author": "מאת {{0}}",
   "com_ui_callback_url": "כתובת URL להחזרת המידע",
   "com_ui_cancel": "בטל",
   "com_ui_cancelled": "בוטל",
   "com_ui_category": "קָטֵגוֹרִיָה",
+  "com_ui_change_version": "שנה גרסה",
   "com_ui_chat": "צ'אט",
-  "com_ui_chat_history": "נקה היסטוריה",
+  "com_ui_chat_history": "היסטוריית הצ׳אטים",
+  "com_ui_chats": "צ'אטים",
+  "com_ui_check_internet": "בדוק את חיבור האינטרנט שלך",
   "com_ui_clear": "נקה",
   "com_ui_clear_all": "נקה הכל",
+  "com_ui_clear_browser_cache": "נקה את המטמון של הדפדפן",
+  "com_ui_clear_presets": "נקה הגדרות קבועות",
+  "com_ui_clear_search": "נקה חיפוש",
+  "com_ui_click_to_close": "לחץ כדי לסגור",
+  "com_ui_click_to_edit": "לחץ כדי לערוך",
+  "com_ui_click_to_view_var": "לחץ כדי לראות את {{0}}",
   "com_ui_client_id": "מזהה לקוח",
   "com_ui_client_secret": "ב",
   "com_ui_close": "סגור",
   "com_ui_close_menu": "סגור תפריט",
   "com_ui_close_settings": "סגור הגדרות",
+  "com_ui_close_var": "סגור את {{0}}",
   "com_ui_close_window": "סגור חלון",
   "com_ui_code": "קוד",
+  "com_ui_collapse": "כווץ",
   "com_ui_collapse_chat": "כווץ צ'אט",
+  "com_ui_collapse_summary": "כווץ סיכום",
+  "com_ui_collapse_thoughts": "כווץ מחשבות",
+  "com_ui_command_finished": "הריצה הושלמה",
   "com_ui_command_placeholder": "אופציונלי: הזן פקודה להנחיה (פרומפט), או שיעשה שימוש בשם",
   "com_ui_command_usage_placeholder": "בחר הנחיה (פרומפט) לפי פקודה או שם",
+  "com_ui_complete": "הושלם!",
   "com_ui_complete_setup": "ההגדרה הושלמה",
   "com_ui_concise": "תמציתי",
+  "com_ui_configure": "הגדר",
   "com_ui_configure_mcp_variables_for": "הגדרת משתנים עבור {{0}}",
   "com_ui_confirm": "אישור",
   "com_ui_confirm_action": "אשר פעולה",
   "com_ui_confirm_admin_use_change": "שינוי הגדרה זו יחסום גישה למנהלים, כולל אותך. האם אתה בטוח שברצונך להמשיך?",
   "com_ui_confirm_change": "אשר את השינוי",
   "com_ui_connecting": "חיבור",
+  "com_ui_contact_admin_if_issue_persists": "צור קשר עם המנהל אם הבעיה ממשיכה",
   "com_ui_context": "הקשר",
+  "com_ui_context_filter_sort": "סנן ומיין לפי הקשר",
   "com_ui_continue": "המשך",
   "com_ui_continue_oauth": "המשך עם OAuth",
+  "com_ui_control_bar": "סרגל בקרה",
+  "com_ui_conversation": "שיחה",
+  "com_ui_conversation_label": "שיחת {{title}}",
+  "com_ui_conversation_not_found": "השיחה לא נמצאה",
+  "com_ui_conversation_summarized": "השיחה סוכמה בהצלחה",
+  "com_ui_conversations": "שיחות",
+  "com_ui_convo_archived": "השיחה הועברה לארכיון",
   "com_ui_convo_delete_error": "מחיקת הצ'אט נכשלה",
+  "com_ui_convo_delete_success": "השיחה נמחקה",
   "com_ui_copied": "הועתק!",
   "com_ui_copied_to_clipboard": "הועתק ללוח",
+  "com_ui_copy": "הועתק",
   "com_ui_copy_code": "העתק קוד",
+  "com_ui_copy_failed": "לא ניתן להעתיק ללוח",
   "com_ui_copy_link": "העתק קישור",
+  "com_ui_copy_stack_trace": "העתק פרטי שגיאה",
+  "com_ui_copy_summary": "העתק סיכום ללוח",
+  "com_ui_copy_thoughts_to_clipboard": "העתק את המחשבות ללוח",
   "com_ui_copy_to_clipboard": "העתק ללוח",
   "com_ui_copy_url_to_clipboard": "העתקת כתובת URL ללוח",
   "com_ui_create": "צור",
+  "com_ui_create_api_key": "העתק מפתח API",
+  "com_ui_create_assistant": "צור עוזר (Assistant)",
   "com_ui_create_link": "צור קישור",
+  "com_ui_create_mcp_server": "צור שרת MCP",
   "com_ui_create_memory": "צור זכרון",
+  "com_ui_create_new_agent": "צור סוכן חדש",
   "com_ui_create_prompt": "צור הנחיה (פרומפט)",
+  "com_ui_create_prompt_page": "דף הגדרות הנחיה (פרומפט - Prompt) חדש",
+  "com_ui_create_skill": "צור מיומנות (Skill)",
+  "com_ui_create_skill_upload": "העלה קובץ מיומנות (SKILL.md)",
+  "com_ui_create_skill_upload_error": "לא ניתן לקרוא את הקובץ",
+  "com_ui_created": "נוצר",
+  "com_ui_creating": "יוצר...",
   "com_ui_creating_image": "יוצר תמונה. ייתכן שייקח מספר רגעים.",
   "com_ui_current": "נוכחי",
   "com_ui_currently_production": "נוצר עכשיו",
   "com_ui_custom": "מותאם אישית",
   "com_ui_custom_header_name": "שם כותרת מותאם אישית",
   "com_ui_custom_prompt_mode": "מצב הנחיה (פרומפט) מותאם אישית",
+  "com_ui_dark_theme_enabled": "ערכת נושא כהה הופעלה",
   "com_ui_date": "תאריך",
   "com_ui_date_april": "אפריל",
   "com_ui_date_august": "אוגוסט",
@@ -774,6 +936,7 @@
   "com_ui_date_previous_30_days": "30 ימים אחרונים",
   "com_ui_date_previous_7_days": "7 ימים אחרונים",
   "com_ui_date_september": "ספטמבר",
+  "com_ui_date_sort": "מיין לפי תאריך",
   "com_ui_date_today": "היום",
   "com_ui_date_yesterday": "אתמול",
   "com_ui_decline": "אני לא מקבל",
@@ -781,59 +944,88 @@
   "com_ui_delete": "מחק",
   "com_ui_delete_action": "מחק פעולה",
   "com_ui_delete_action_confirm": "האם אתה בטוח שברצונך למחוק פעולה זו?",
+  "com_ui_delete_agent": "מחק סוכן",
   "com_ui_delete_agent_confirm": "האם אתה בטוח שברצונך למחוק את הסייען הזה?",
+  "com_ui_delete_assistant": "מחק עוזר (Assistant)",
   "com_ui_delete_assistant_confirm": "האם אתה בטוח שאתה רוצה למחוק את הסייען הזה? אי אפשר לבטל את זה.",
   "com_ui_delete_confirm": "זה ימחק",
   "com_ui_delete_confirm_prompt_version_var": "פעולה זו תמחק את הגרסה שנבחרה עבור \"{{0}}\". אם לא קיימות גרסאות נוספות, ההנחיה תימחק.",
+  "com_ui_delete_confirm_strong": "פעולה זו תמחק את <strong>{{title}}</strong>",
   "com_ui_delete_conversation": "למחוק את השיחה (צאט)?",
+  "com_ui_delete_conversation_tooltip": "מחק שיחה",
+  "com_ui_delete_mcp_server": "מחק שרת MCP",
+  "com_ui_delete_mcp_server_name": "מחק שרת MCP {{0}}",
   "com_ui_delete_memory": "מחק זיכרון",
   "com_ui_delete_not_allowed": "פעולת המחיקה אינה אפשרית",
+  "com_ui_delete_preset": "למחוק את ההגדרה הקבועה מראש?",
   "com_ui_delete_prompt": "מחק הנחיה (פרומפט)",
   "com_ui_delete_shared_link": "מחק קישור שיתוף",
+  "com_ui_delete_shared_link_heading": "מחק קישור משותף",
   "com_ui_delete_success": "נמחק בהצלחה",
   "com_ui_delete_tool": "מחק כלי",
   "com_ui_delete_tool_confirm": "האת אתה בטוח שאתה רוצה למחוק את הכלי הזה?",
   "com_ui_delete_tool_save_reminder": "הכלי הוסר. שמור את הסוכן כדי להחיל את השינויים",
   "com_ui_deleted": "נמחק",
+  "com_ui_deleting": "מוחק...",
   "com_ui_deleting_file": "מוחק קובץ...",
+  "com_ui_deploy": "פרוס",
   "com_ui_descending": "תיאור",
   "com_ui_description": "תיאור",
   "com_ui_description_placeholder": "אופציונלי: הזן תיאור שיוצג עבור ההנחיה (פרומפט)",
   "com_ui_deselect_all": "בטל את הבחירה של הכל",
   "com_ui_detailed": "מפורט",
+  "com_ui_details": "פרטים",
   "com_ui_disabling": "מבטל הפעלה...",
+  "com_ui_done": "הסתיים",
   "com_ui_download": "הורדות",
   "com_ui_download_artifact": "רכיב תצוגת הורדות",
   "com_ui_download_backup": "הורד קודי גיבוי",
   "com_ui_download_backup_tooltip": "לפני שתמשיך, הורד את קודי הגיבוי שלך. תזדקק להם כדי לשחזר גישה במקרה שתאבד את מכשיר האימות שלך",
   "com_ui_download_error": "וזה: שגיאה בהורדת הקובץ. ייתכן שהקובץ נמחק",
+  "com_ui_download_error_logs": "הורד יומני שגיאות",
   "com_ui_drag_drop": "גרור קובץ לכאן כדי להוסיף אותו לשיחה",
   "com_ui_dropdown_variables": "רשימה נפתחת של משתנים",
   "com_ui_duplicate": "שכפל",
+  "com_ui_duplicate_agent": "שכפל סוכן",
   "com_ui_duplication_error": "אירעה שגיאה בעת שכפול השיחה",
   "com_ui_duplication_processing": "משכפל את השיחה...",
   "com_ui_duplication_success": "השיחה שוכפלה בהצלחה",
   "com_ui_edit": "ערוך",
   "com_ui_edit_editing_image": "עורך את התמונה",
   "com_ui_edit_mcp_server": "עריכת שרת MCP",
+  "com_ui_edit_mcp_server_dialog_description": "מזהה שרת ייחודי: {{serverName}}",
   "com_ui_edit_memory": "ערוך זכרון",
+  "com_ui_edit_preset_title": "עריכת הגדרה קבועה מראש - {{title}}",
+  "com_ui_edit_prompt_page": "ערוך דף הנחיה (פרומפט)",
+  "com_ui_edit_skill": "ערוך מיומנות (Skill)",
+  "com_ui_editable_message": "הודעה ניתנת לעריכה",
   "com_ui_editor_instructions": "גרור את התמונה כדי למקם אותה מחדש • השתמש במחוון הזום או בלחצנים כדי להתאים את הגודל",
   "com_ui_empty_category": "-",
   "com_ui_endpoint": "נקודת קצה",
   "com_ui_endpoint_menu": "תפריט נקודת קצה LLM",
   "com_ui_enter": "Enter",
   "com_ui_enter_api_key": "הכנס מפתח API",
+  "com_ui_enter_description": "הזן תיאור (אופציונלי)",
   "com_ui_enter_key": "מקש Enter",
+  "com_ui_enter_name": "הזן שם",
   "com_ui_enter_openapi_schema": "הזן כאן את סכימת OpenAPI שלך",
   "com_ui_enter_value": "הזן ערך",
   "com_ui_error": "שגיאה",
   "com_ui_error_connection": "שגיאה בחיבור לשרת, נסה לרענן את הדף",
+  "com_ui_error_message_prefix": "הודעת שגיאה:",
   "com_ui_error_save_admin_settings": "אירעה שגיאה בשמירת הגדרות הניהול שלך",
+  "com_ui_error_try_following_prefix": "אנא נסה אחת מהאפשרויות הבאות",
+  "com_ui_error_unexpected": "אופס! אירעה שגיאה בלתי צפויה",
   "com_ui_error_updating_preferences": "אירעה שגיאה בעדכון העדפות",
   "com_ui_everyone_permission_level": "רמת ההרשאה של כולם",
   "com_ui_examples": "דוגמאות",
+  "com_ui_expand": "הרחב",
   "com_ui_expand_chat": "הרחב צ'אט",
+  "com_ui_expand_thoughts": "הרחב את המחשבות",
   "com_ui_export_convo_modal": "חלון ייצוא שיחה",
+  "com_ui_failed": "נכשל",
+  "com_ui_favorite": "הוסף למועדפים",
+  "com_ui_favorites": "מועדפים",
   "com_ui_feedback_more": "יותר...",
   "com_ui_feedback_more_information": "ספק משוב נוסף",
   "com_ui_feedback_negative": "טעון שיפור",
@@ -852,13 +1044,17 @@
   "com_ui_feedback_tag_unjustified_refusal": "סורב ללא סיבה",
   "com_ui_field_max_length": "{{field}} חייב להיות קצר מ-{{length}} תווים",
   "com_ui_field_required": "שדה זה נדרש",
+  "com_ui_file": "קובץ",
   "com_ui_file_input_avatar_label": "קובץ קלט לאווטאר",
+  "com_ui_file_modified": "תאריך שינוי",
   "com_ui_file_size": "גודל הקובץ",
   "com_ui_file_token_limit": "מגבלת טוקנים לקובץ",
   "com_ui_file_token_limit_desc": "הגדר מגבלת טוקנים מקסימלית לעיבוד קבצים כדי לשלוט בעלויות ובשימוש במשאבים",
   "com_ui_files": "קבצים",
+  "com_ui_filter_mcp_servers": "סנן שרתי MCP לפי שם",
   "com_ui_filter_prompts": "סינון הנחיות (פרומפטים)",
   "com_ui_filter_prompts_name": "סינון הנחיות (פרומפטים) לפי שם",
+  "com_ui_filter_skills_name": "סנן מיומניות (skills) לפי שם",
   "com_ui_final_touch": "גימור סופי",
   "com_ui_finance": "פיננסי",
   "com_ui_fork": "הסתעפות",
@@ -880,6 +1076,7 @@
   "com_ui_fork_info_visible": "אפשרות זו תיצור הסתעפות רק של ההודעות הגלויות; במילים אחרות, רק את המסלול הישיר להודעת היעד, ללא הסתעפויות נוספות.",
   "com_ui_fork_more_details_about": "הצג מידע ופרטים נוספים על אפשרות פורק \"{{0}}\"",
   "com_ui_fork_more_info_options": "הצג הסבר מפורט על כל אפשרויות המזלג והתנהגויותיהן",
+  "com_ui_fork_open_menu": "פתח את תפריט הפיצול (Fork)",
   "com_ui_fork_processing": "יוצר הסתעפות בשיחה...",
   "com_ui_fork_remember": "זכור",
   "com_ui_fork_remember_checked": "הבחירה שלך תישמר אחרי השימוש. תוכל לשנות זאת בכל זמן בהגדרות.",
@@ -889,6 +1086,7 @@
   "com_ui_fork_visible": "הודעות גלויות בלבד",
   "com_ui_generate_qrcode": "צור קוד QR",
   "com_ui_generating": "יוצר...",
+  "com_ui_generating_image": "יוצר תמונה...",
   "com_ui_generation_settings": "הגדרות יצירה",
   "com_ui_getting_started": "תחילת העבודה",
   "com_ui_go_back": "חזור",
@@ -897,8 +1095,13 @@
   "com_ui_good_evening": "ערב טוב",
   "com_ui_good_morning": "בוקר טוב",
   "com_ui_group": "קבוצה",
+  "com_ui_handoff_instructions": "הוראות העברה",
   "com_ui_happy_birthday": "זה יום ההולדת הראשון שלי!",
+  "com_ui_header_format": "פורמט כותרת",
+  "com_ui_hide": "הסתר",
+  "com_ui_hide_code": "הסתר קוד",
   "com_ui_hide_image_details": "הסתר פרטי תמונה",
+  "com_ui_hide_n_files": "הסתר {{0}} קבצים",
   "com_ui_hide_qr": "הסתר קוד QR",
   "com_ui_high": "גבוה",
   "com_ui_host": "מארח",
@@ -908,40 +1111,96 @@
   "com_ui_image_details": "פרטי התמונה",
   "com_ui_image_edited": "התמונה נערכה",
   "com_ui_image_gen": "מחולל תמונות",
+  "com_ui_image_gen_failed": "יצירת התמונה נכשלה",
   "com_ui_import": "ייבוא",
   "com_ui_import_conversation_error": "אירעה שגיאה בעת ייבוא השיחות שלך",
   "com_ui_import_conversation_file_type_error": "סוג ייבוא לא נתמך",
   "com_ui_import_conversation_info": "ייבא שיחות מקובץ JSON",
   "com_ui_import_conversation_success": "השיחות יובאו בהצלחה",
   "com_ui_import_conversation_upload_error": "שגיאה בהעלאת הקובץ. אנא נסה שוב.",
+  "com_ui_importing": "מייבא",
   "com_ui_include_shadcnui": "יש לכלול הוראות לשימוש ברכיבי ממשק המשתמש של shadcn/ui",
   "com_ui_initializing": "מאתחל...",
   "com_ui_input": "קלט",
   "com_ui_instructions": "הוראות",
+  "com_ui_invocation_auto": "אוטומטי",
+  "com_ui_invocation_auto_info": "המיומנות (skill) מופעלת אוטומטית על ידי הסוכן כאשר היא רלוונטית לשיחה",
+  "com_ui_invocation_both": "שניהם",
+  "com_ui_invocation_both_info": "המיומנות (skill) יכולה להיות מופעלת אוטומטית או ידנית על ידי המשתמש",
+  "com_ui_invocation_manual": "ידני",
+  "com_ui_invocation_manual_info": "המיומנות (skill) משמשת רק כאשר המשתמש מפעיל אותה במפורש",
+  "com_ui_invocation_mode": "מצב הפעלה",
+  "com_ui_invoked_by": "הופעל על ידי",
   "com_ui_key": "מפתח",
   "com_ui_key_required": "נדרש מפתח API",
+  "com_ui_labels": "תוויות",
+  "com_ui_last_used": "שימוש אחרון",
   "com_ui_late_night": "לילה טוב",
+  "com_ui_latest": "העדכני ביותר",
   "com_ui_latest_footer": "גישה לכל הבינות המלאכותיות (AI) לכולם",
   "com_ui_latest_version": "גרסה אחרונה",
+  "com_ui_leave_blank_to_keep": "השאר ריק כדי לשמור את הערך הקיים",
+  "com_ui_light_theme_enabled": "ערכת נושא בהירה מופעלת",
+  "com_ui_line_count": "שורה {0}",
+  "com_ui_lines_count": "{0} שורות",
+  "com_ui_link_copied": "הקישור הועתק",
+  "com_ui_link_refreshed": "הקישור עודכן",
+  "com_ui_live": "פעיל",
   "com_ui_loading": "טוען...",
   "com_ui_locked": "נעול",
   "com_ui_logo": "\"לוגו {{0}}\"",
   "com_ui_low": "נמוך",
+  "com_ui_make_production": "העבר לייצור",
   "com_ui_manage": "נהל",
   "com_ui_marketplace": "מרכז הסוכנים",
   "com_ui_marketplace_allow_use": "אפשר שימוש במרכז הסוכנים",
+  "com_ui_max": "מקסימום",
+  "com_ui_max_favorites_reached": "הגעת למגבלת הפריטים המוצמדים ({{0}}). הסר הצמדה מפריט כדי להוסיף עוד.",
   "com_ui_max_file_size": "PNG, JPG או JPEG (מקסימום {{0}})",
   "com_ui_max_tags": "המספר המקסימלי המותר על פי הערכים העדכניים הוא {{0}}.",
   "com_ui_mcp_authenticated_success": "{{0}} שרתי MCP אומתו בהצלחה",
+  "com_ui_mcp_click_to_defer": "לחץ כדי לדחות את הטעינה – הכלי יהיה נגיש דרך החיפוש אך לא ייטען עד שיידרש",
+  "com_ui_mcp_click_to_programmatic": "אפשר קריאה פרוגרמטית – הכלי יופעל רק באמצעות הרצת קוד",
   "com_ui_mcp_configure_server": "הגדר את {{0}}",
   "com_ui_mcp_configure_server_description": "הגדר משתנים מותאמים אישית עבור {{0}}",
+  "com_ui_mcp_defer": "דחה",
+  "com_ui_mcp_defer_all": "דחה את כל הכלים",
+  "com_ui_mcp_defer_loading": "דחה את הטעינה",
+  "com_ui_mcp_dialog_title": "הגדר משתנים עבור {{serverName}}. סטטוס שרת: {{status}}",
+  "com_ui_mcp_domain_not_allowed": "הדומיין של שרת ה-MCP אינו ברשימת הדומיינים המורשים. אנא פנה למנהל המערכת.",
   "com_ui_mcp_enter_var": "הזן ערך עבור {{0}}",
   "com_ui_mcp_init_failed": "אתחול שרת MCP נכשל",
   "com_ui_mcp_initialize": "אתחול",
   "com_ui_mcp_initialized_success": "{{0}} שרתי MCP אותחלו בהצלחה",
+  "com_ui_mcp_invalid_url": "אנא הזן כתובת URL תקינה",
+  "com_ui_mcp_no_description": "אין תיאור זמין",
   "com_ui_mcp_oauth_cancelled": "התחברות באמצעות OAuth בוטלה עבור {{0}}",
   "com_ui_mcp_oauth_timeout": "תם הזמן שהוקצב להתחברות OAuth עבור {{0}}",
+  "com_ui_mcp_programmatic": "פרוגרמטי",
+  "com_ui_mcp_programmatic_all": "סמן הכל כפרוגרמטי",
+  "com_ui_mcp_server": "שרת MCP",
+  "com_ui_mcp_server_connection_failed": "ניסיון החיבור לשרת ה-MCP נכשל. אנא ודא שכתובת ה-URL, סוג השרת וכל הגדרות האימות נכונות, ונסה שוב. כמו כן, ודא שכתובת ה-URL נגישה.",
+  "com_ui_mcp_server_created": "שרת ה-MCP נוצר בהצלחה",
+  "com_ui_mcp_server_delete_confirm": "אתה בטוח שברצונך למחוק את שרת ה-MCP הזה?",
+  "com_ui_mcp_server_deleted": "שרת ה-MCP נמחק בהצלחה",
+  "com_ui_mcp_server_role_editor": "עורך שרת MCP",
+  "com_ui_mcp_server_role_editor_desc": "יכול לצפות, להשתמש ולערוך שרתי MCP",
+  "com_ui_mcp_server_role_owner": "בעלים של שרת MCP",
+  "com_ui_mcp_server_role_owner_desc": "שליטה מלאה על שרתי MCP",
+  "com_ui_mcp_server_role_viewer": "צופה בשרת MCP",
+  "com_ui_mcp_server_role_viewer_desc": "יכול לצפות ולהשתמש בשרתי MCP",
+  "com_ui_mcp_server_updated": "שרת ה-MCP עודכן בהצלחה",
   "com_ui_mcp_servers": "שרתי MCP",
+  "com_ui_mcp_servers_allow_create": "אפשר למשתמשים ליצור שרתי MCP",
+  "com_ui_mcp_servers_allow_share": "אפשר למשתמשים לשתף שרתי MCP",
+  "com_ui_mcp_servers_allow_share_public": "אפשר למשתמשים לשתף שרתי MCP באופן ציבור",
+  "com_ui_mcp_servers_allow_use": "אפשר למשתמשים להשתמש בשרתי MCP",
+  "com_ui_mcp_title_invalid": "הכותרת יכולה להכיל רק אותיות, מספרים ורווחים",
+  "com_ui_mcp_tool_options": "אפשרויות הכלי",
+  "com_ui_mcp_transport": "תעבורה",
+  "com_ui_mcp_undefer": "בטל את דחיית הטעינה",
+  "com_ui_mcp_undefer_all": "בטל את דחיית הטעינה של כל הכלים",
+  "com_ui_mcp_unprogrammatic_all": "בטל את הסימון של הכול כפרוגרמטי",
   "com_ui_mcp_update_var": "עדכון {{0}}",
   "com_ui_mcp_url": "קישור לשרת ה-MCP",
   "com_ui_medium": "בינוני",
@@ -959,34 +1218,63 @@
   "com_ui_memory_deleted_items": "זכרונות שנמחקו",
   "com_ui_memory_error": "שגיאת זיכרון",
   "com_ui_memory_key_exists": "זיכרון עם מפתח זה כבר קיים. אנא השתמש במפתח אחר.",
+  "com_ui_memory_key_hint": "השתמש באותיות קטנות ובקווים תחתונים בלבד",
   "com_ui_memory_key_validation": "מפתח הזיכרון חייב להכיל רק אותיות קטנות או קו תחתון.",
   "com_ui_memory_storage_full": "אחסון הזיכרונות מלא",
   "com_ui_memory_updated": "זיכרון שמור מעודכן",
   "com_ui_memory_updated_items": "זיכרונות מעודכנים",
   "com_ui_memory_would_exceed": "לא ניתן לשמור - זה יעבור את המגבלה ב-{{tokens}} אסימונים. מחק זיכרונות קיימים כדי לפנות מקום לזיכרונות חדשים.",
   "com_ui_mention": "ציין נקודת קצה, סייען, או הנחייה (פרופמט) כדי לעבור אליה במהירות",
+  "com_ui_mermaid_failed": "עיבוד התרשים נכשל:",
+  "com_ui_mermaid_source": "קוד מקור:",
+  "com_ui_message_input": "שדה הקלדת הודעה",
+  "com_ui_message_nav": "ניווט בין הודעות",
+  "com_ui_message_nav_go_to_assistant": "עבור להודעת העוזר: {{0}}",
+  "com_ui_message_nav_go_to_user": "עבור להודעת המשתמש: {{0}}\t",
+  "com_ui_message_nav_next": "עבור להודעה הבאה",
+  "com_ui_message_nav_previous": "עבור להודעה הקודמת",
+  "com_ui_microphone_unavailable": "המיקרופון אינו זמין",
   "com_ui_min_tags": "לא ניתן למחוק ערכים נוספים, יש צורך במינימום {{0}} ערכים.",
   "com_ui_minimal": "מינימלי",
   "com_ui_misc": "כללי",
   "com_ui_model": "דגם",
   "com_ui_model_parameters": "הגדרות המודל",
+  "com_ui_model_parameters_reset": "פרמטרי המודל אופסו.",
+  "com_ui_model_selected": "{{0}} נבחרו",
+  "com_ui_model_spec": "מפרט המודל",
   "com_ui_more_info": "מידע נוסף",
   "com_ui_my_prompts": "ההנחיות (פרומפטים) שלי",
+  "com_ui_my_skills": "המיומניות (Skills) שלי",
+  "com_ui_n_files": "{{0}} קבצים",
   "com_ui_name": "שם",
+  "com_ui_name_sort": "מיין לפי שם",
+  "com_ui_navigate_results": "ניווט בין תוצאות",
   "com_ui_new": "חדש",
   "com_ui_new_chat": "שיחה חדשה",
   "com_ui_new_conversation_title": "כותרת חדשה לצ'אט",
   "com_ui_next": "הבא",
+  "com_ui_next_result": "התוצאה הבאה",
   "com_ui_no": "לא",
+  "com_ui_no_api_keys": "אין מפתחות API עדיין. צור מפתח כדי להתחיל.",
+  "com_ui_no_auth": "ללא (זיהוי אוטומטי)",
   "com_ui_no_bookmarks": "עדיין אין לך סימניות. בחר שיחה והוסף סימניה חדשה",
+  "com_ui_no_bookmarks_match": "לא נמצאו סימניות התואמות את החיפוש",
+  "com_ui_no_bookmarks_title": "אין סימניות עדיין",
   "com_ui_no_categories": "אין קטגוריות זמינות",
   "com_ui_no_category": "אין קטגוריה",
   "com_ui_no_changes": "לא בוצע שום שינוי",
   "com_ui_no_individual_access": "אין גישה לסוכן זה למשתמשים או לקבוצות בודדות",
+  "com_ui_no_labels": "אין תוויות",
+  "com_ui_no_mcp_servers": "אין שרתי MCP עדיין",
+  "com_ui_no_mcp_servers_match": "לא נמצאו שרתי MCP התואמים את הסינון",
   "com_ui_no_memories": "אין זיכרונות. ניתן ליצור אותם ידנית או לבקש מה-AI לזכור משהו",
+  "com_ui_no_memories_match": "לא נמצאו זיכרונות התואמים את החיפוש",
+  "com_ui_no_memories_title": "אין זכרונות עדיין",
   "com_ui_no_personalization_available": "אין אפשרויות התאמה אישית זמינות כרגע",
+  "com_ui_no_prompts_title": "אין הנחיות (prompts) עדיין",
   "com_ui_no_read_access": "אין לך הרשאה לצפות בזיכרונות",
   "com_ui_no_results_found": "לא נמצאו תוצאות",
+  "com_ui_no_skills_found": "לא נמצאו מיומניות (skills)",
   "com_ui_no_terms_content": "אין תוכן תנאים והגבלות להצגה",
   "com_ui_none": "אף אחד",
   "com_ui_not_used": "לא בשימוש",
@@ -1004,10 +1292,19 @@
   "com_ui_of": "של",
   "com_ui_off": "של",
   "com_ui_offline": "לא מקוון",
+  "com_ui_omitted": "לא כלול",
   "com_ui_on": "פעיל",
+  "com_ui_open_archived_chat_new_tab_title": "{{title}} (נפתח בלשונית חדשה)",
+  "com_ui_open_source_chat_new_tab": "פתח את הצ'אט המקורי בלשונית חדשה",
+  "com_ui_open_source_chat_new_tab_title": "פתח את הצ'אט המקורי בלשונית חדשה - {{title}}",
+  "com_ui_open_var": "פתח את {{0}}",
   "com_ui_openai": "אופן אֵי-אַיי (OpenAI)",
   "com_ui_optional": "(אופציונלי)",
+  "com_ui_options": "אפשרויות",
+  "com_ui_output": "פלט",
   "com_ui_page": "עמוד",
+  "com_ui_pagination": "עימוד",
+  "com_ui_parameters": "פרמטרים",
   "com_ui_people": "אנשים",
   "com_ui_people_picker": "בורר אנשים",
   "com_ui_people_picker_allow_view_groups": "אפשר צפייה בקבוצות",
@@ -1016,36 +1313,75 @@
   "com_ui_permissions_failed_load": "טעינת ההרשאות נכשלה. אנא נסה שוב",
   "com_ui_permissions_failed_update": "עדכון ההרשאות נכשל. אנא נסה שוב",
   "com_ui_permissions_updated_success": "ההרשאות עודכנו בהצלחה",
+  "com_ui_pin": "הצמד",
+  "com_ui_plus_n_more": "+{{0}} נוספים",
   "com_ui_preferences_updated": "ההעדפות עודכנו בהצלחה",
   "com_ui_prev": "הקודם",
+  "com_ui_prev_result": "התוצאה הקודמת",
   "com_ui_preview": "תצוגה מקדימה",
+  "com_ui_preview_failed": "התצוגה המקדימה אינה זמינה",
+  "com_ui_preview_preparing": "מכין את התצוגה המקדימה...",
+  "com_ui_preview_unavailable": "התצוגה המקדימה אינה זמינה עבור סוג קובץ זה",
   "com_ui_privacy_policy": "מדיניות פרטיות",
   "com_ui_privacy_policy_url": "קישור למדיניות הפרטיות",
+  "com_ui_production": "ייצור",
   "com_ui_prompt": "הנחיה (פרומפט)",
+  "com_ui_prompt_category_selector_aria": "בחירת קטגוריה להנחיה (פרומפט)",
+  "com_ui_prompt_delete_confirm": "האם אתה בטוח שברצונך למחוק את ההנחיה (פרומפט) '{{0}}'?",
+  "com_ui_prompt_delete_error": "אירעה שגיאה במחיקת ההנחיה (פרומפט)",
+  "com_ui_prompt_deleted_group": "קבוצת ההנחיות (פרומפטים) \"{{0}}\" נמחקה",
+  "com_ui_prompt_details": "פרטי הפרומפט {{name}}",
+  "com_ui_prompt_group_button": "פרומפט {{name}}, קטגוריה {{category}}",
+  "com_ui_prompt_group_button_no_category": "פרומפט {{name}}",
   "com_ui_prompt_groups": "רשימת קבוצות הנחיות (פרומפטים)",
+  "com_ui_prompt_input": "שדה הזנת הפרומפט",
+  "com_ui_prompt_input_field": "שדה הזנת טקסט לפרומפט",
   "com_ui_prompt_name": "שם הנחיה (פרומפט)",
   "com_ui_prompt_name_required": "נדרש שם הנחיה (פרומפט)",
   "com_ui_prompt_preview_not_shared": "היוצר לא אפשר שיתוף פעולה להנחיה זו",
   "com_ui_prompt_text": "טקסט",
   "com_ui_prompt_text_required": "נדרש טקסט",
   "com_ui_prompt_update_error": "אירעה שגיאה בעדכון ההנחיה (פרומפט)",
+  "com_ui_prompt_variables_list": "רשימת משתני הפרומפט",
   "com_ui_prompts": "הנחיות (פרומפטים)",
   "com_ui_prompts_allow_create": "אפשר יצירת הנחיות",
   "com_ui_prompts_allow_share": "אפשר שיתוף הנחיות",
+  "com_ui_prompts_allow_share_public": "אפשר שיתוף פרומפטים באופן ציבורי",
   "com_ui_prompts_allow_use": "אפשר שימוש בהנחיות (פרומפטים)",
   "com_ui_provider": "ספק",
   "com_ui_quality": "איכות",
+  "com_ui_ran_n_agents": "הריץ {{0}} סוכנים",
   "com_ui_read_aloud": "הקראה",
+  "com_ui_read_file": "קרא את {{0}}",
+  "com_ui_reading_file": "קורא את {{0}}",
+  "com_ui_redirect_uri": "כתובת הפניה מחדש (Redirect URI)",
+  "com_ui_redirect_uri_instructions": "העתק את ה־URI להפניה מחדש והגדר אותו בהגדרות ספק ה־OAuth שלך.",
   "com_ui_redirecting_to_provider": "מבצע הפניה ל-{{0}}, אנא המתן...",
   "com_ui_reference_saved_memories": "הפניה לזכרונות שמורים",
   "com_ui_reference_saved_memories_description": "אפשר לסוכן להתייחס ולהשתמש בזיכרונות השמורים שלך בעת התגובה",
   "com_ui_refresh": "רענן",
   "com_ui_refresh_link": "רענון קישור",
+  "com_ui_refresh_page": "רענן עמוד",
   "com_ui_regenerate": "לחדש",
   "com_ui_regenerate_backup": "צור קודי גיבוי מחדש",
   "com_ui_regenerating": "יוצר מחדש...",
   "com_ui_region": "איזור",
   "com_ui_reinitialize": "אתחול מחדש",
+  "com_ui_relevance": "רלוונטיות",
+  "com_ui_remote_access": "גישה מרחוק",
+  "com_ui_remote_agent_role_editor": "עורך",
+  "com_ui_remote_agent_role_editor_desc": "יכול לצפות ולשנות את הסוכן דרך API",
+  "com_ui_remote_agent_role_owner": "הבעלים של ה-API",
+  "com_ui_remote_agent_role_owner_desc": "גישת API מלאה ויכולת להעניק גישה מרחוק לאחרים",
+  "com_ui_remote_agent_role_viewer": "צופה ב-API",
+  "com_ui_remote_agent_role_viewer_desc": "יכול לשלוח שאילתות לסוכן דרך API",
+  "com_ui_remote_agents": "סוכנים מרוחקים (API)",
+  "com_ui_remote_agents_allow_create": "אפשר למשתמשים ליצור סוכנים דרך API",
+  "com_ui_remote_agents_allow_share": "אפשר למשתמשים להעניק גישת API לסוכנים לאחרים",
+  "com_ui_remote_agents_allow_share_public": "אפשר למשתמשים להעניק גישת API לסוכנים לכלל המשתמשים",
+  "com_ui_remote_agents_allow_use": "אפשר למשתמשים ליצור מפתחות API ולשלוח שאילתות לסוכנים מרחוק",
+  "com_ui_remove_agent_from_chain": "הסר את {{0}} מהשרשור",
+  "com_ui_remove_skill_var": "הסר את {{0}}",
   "com_ui_remove_user": "הסר את {{0}}",
   "com_ui_rename": "שנה שם",
   "com_ui_rename_conversation": "החלפת שם הצ'אט",
@@ -1056,7 +1392,11 @@
   "com_ui_reset_var": "איפוס {{0}}",
   "com_ui_reset_zoom": "איפוס זום",
   "com_ui_resource": "משאב",
+  "com_ui_response": "תגובה",
   "com_ui_result": "תוצאה",
+  "com_ui_results_found": "נמצאו {{count}} תגובות",
+  "com_ui_retrieved_files": "חיפש בקבצים שלך",
+  "com_ui_retry": "נסה שנית",
   "com_ui_revoke": "בטל",
   "com_ui_revoke_info": "בטל את כל האישורים שסופקו על ידי המשתמש",
   "com_ui_revoke_key_confirm": "האם אתה בטוח שברצונך לבטל את המפתח הזה?",
@@ -1080,6 +1420,9 @@
   "com_ui_rotate_90": "סיבוב ב-90 מעלות",
   "com_ui_run_code": "הרץ קוד",
   "com_ui_run_code_error": "אירעה שגיאה בהרצת הקוד",
+  "com_ui_running": "רץ...",
+  "com_ui_running_command": "מריץ פקודה",
+  "com_ui_running_n_agents": "מריץ {{0}} סוכנים",
   "com_ui_save": "שמור",
   "com_ui_save_badge_changes": "האם לשמור את השינויים בתגים?",
   "com_ui_save_changes": "שמור שינויים",
@@ -1090,6 +1433,7 @@
   "com_ui_saving": "שומר...",
   "com_ui_schema": "סכמה",
   "com_ui_scope": "תחום",
+  "com_ui_scroll_to_bottom": "גלול לתחתית",
   "com_ui_search": "חיפוש",
   "com_ui_search_above_to_add": "חפש למעלה כדי להוסיף משתמשים או קבוצות",
   "com_ui_search_above_to_add_all": "חפש למעלה כדי להוסיף משתמשים, קבוצות או תפקידים",
@@ -1097,9 +1441,14 @@
   "com_ui_search_agent_category": "חיפוש קטגוריות...",
   "com_ui_search_default_placeholder": "חיפוש לפי שם או דוא\"ל (מינימום 2 תווים)",
   "com_ui_search_people_placeholder": "חיפוש אנשים או קבוצות לפי שם או דוא\"ל",
+  "com_ui_search_result_count": "נמצאה תוצאה {{count}}",
+  "com_ui_search_results_count": "נמצאו {{count}} תוצאות",
+  "com_ui_search_skills": "חפס מיומניות (Skills)...",
+  "com_ui_searching_files": "\tמחפש בקבצים שלך",
   "com_ui_seconds": "שניות",
   "com_ui_secret_key": "מפתח סודי",
   "com_ui_select": "בחר",
+  "com_ui_select_agent": "בחר סוכן",
   "com_ui_select_all": "בחר הכל",
   "com_ui_select_file": "בחר קובץ",
   "com_ui_select_model": "בחר מודל",
@@ -1108,6 +1457,7 @@
   "com_ui_select_provider": "בחר ספק",
   "com_ui_select_provider_first": "ראשית בחר ספק",
   "com_ui_select_region": "בחר איזור",
+  "com_ui_select_row": "בחר שורה",
   "com_ui_select_search_model": "חפש מודל לפי שם",
   "com_ui_select_search_provider": "חפש ספק לפי שם",
   "com_ui_select_search_region": "חפש איזור לפי שם",
@@ -1119,27 +1469,135 @@
   "com_ui_share_everyone": "שתף עם כולם",
   "com_ui_share_everyone_description_var": "{{resource}} זה יהיה זמין לכולם. אנא ודא שה-{{resource}} באמת נועד להיות משותף עם כולם. היזהר עם הנתונים שלך.",
   "com_ui_share_link_to_chat": "שתף קישור בצ'אט",
+  "com_ui_share_qr_code_description": "קוד QR לשיתוף קישור לשיחה זו",
   "com_ui_share_update_message": "השם שלך, ההוראות המותאמות אישית וכל ההודעות שתוסיף לאחר השיתוף יישארו פרטיים.",
   "com_ui_share_var": "שתף {{0}}",
   "com_ui_shared_link_delete_success": "הקישור המשותף נמחק בהצלחה",
   "com_ui_shared_link_not_found": "הקישור המשותף לא נמצא",
   "com_ui_shared_prompts": "הנחיות (פרומפטים) משותפות",
   "com_ui_shop": "קניות",
+  "com_ui_show": "הצג",
   "com_ui_show_all": "הראה הכל",
+  "com_ui_show_code": "הצג קוד",
   "com_ui_show_image_details": "הצג את פרטי התמונה",
+  "com_ui_show_less": "הצג פחות",
+  "com_ui_show_more": "הצג יותר",
+  "com_ui_show_n_files": "הצג {{0}} קבצים",
   "com_ui_show_qr": "הראה קוד QR",
   "com_ui_sign_in_to_domain": "היכנס אל {{0}}",
   "com_ui_simple": "פשוט",
   "com_ui_size": "סוג",
+  "com_ui_size_sort": "מיין לפי גודל",
+  "com_ui_skill": "מיומנות (skill)",
+  "com_ui_skill_content": "תוכן המיומנות (skill)",
+  "com_ui_skill_content_placeholder": "הזן את הוראות המיומנות (skill) בפורמט מרקדאון...",
+  "com_ui_skill_create_error": "יצירת המיומנות (skill) נכשלה",
+  "com_ui_skill_create_title": "צור מיומנות (skill)",
+  "com_ui_skill_created": "המיומנות (skill) נוצרה",
+  "com_ui_skill_delete_confirm": "האם אתה בטוח שברצונך למחוק את \"{{0}}\"? לא ניתן לבטל פעולה זו.",
+  "com_ui_skill_delete_error": "מחיקת המיומנות (skill) נכשלה",
+  "com_ui_skill_deleted": "המיומנות (skill) נמחקה",
+  "com_ui_skill_description_field_hint": "תהיה ספציפי לגבי מתי המיומנות (skill) זו אמורה להיות מופעלת.",
+  "com_ui_skill_description_placeholder": "החל את הנחיות המיתוג של Acme Corp על מצגות ומסמכים...",
+  "com_ui_skill_description_required": "תיאור הוא שדה חובה",
+  "com_ui_skill_description_too_long": "התיאור לא יעלה על {{0}} תווים",
+  "com_ui_skill_edit_title": "ערוך מיומנות (skill)",
+  "com_ui_skill_file_binary": "קובץ בינארי — לא ניתן להציג תצוגה מקדימה",
+  "com_ui_skill_file_download": "הורדה",
+  "com_ui_skill_file_load_error": "טעינת תוכן הקובץ נכשלה",
+  "com_ui_skill_finished": "הרץ את {{0}}",
+  "com_ui_skill_instructions": "הוראות",
+  "com_ui_skill_instructions_placeholder": "הזן את הוראות המיומנות (skill) בפורמט מרקדאון...",
+  "com_ui_skill_name_invalid": "השתמש באותיות קטנות, ספרות ומקפים בלבד (kebab-case)",
+  "com_ui_skill_name_placeholder": "brand-guidelines",
+  "com_ui_skill_name_required": "שם הוא שדה חובה",
+  "com_ui_skill_name_too_long": "השם לא יעלה על {{0}} תווים",
+  "com_ui_skill_new_file": "קובץ חדש",
+  "com_ui_skill_new_folder": "תיקייה חדשה",
+  "com_ui_skill_no_edit_permission": "אין לך הרשאה לערוך את המיומנות (skill) הזו",
+  "com_ui_skill_no_selection": "בחר מיומנות (skill)",
+  "com_ui_skill_no_selection_desc": "בחר מיומנות (skill) מסרגל הצד כדי לצפות בפרטים שלה.",
+  "com_ui_skill_not_found": "המיומנות (skill) לא נמצאה",
+  "com_ui_skill_not_found_description": "ייתכן שהיא נמחקה או שאין לך גישה אליה יותר.",
+  "com_ui_skill_role_editor_desc": "יכול לצפות ולערוך את המיומנות (skill)",
+  "com_ui_skill_role_owner_desc": "שליטה מלאה במיומנות (skill) כולל שיתוף ומחיקה",
+  "com_ui_skill_role_viewer_desc": "יכול לצפות ולהשתמש במיומנות (skill) אך לא לערוך אותה",
+  "com_ui_skill_running": "מריץ את {{0}}",
+  "com_ui_skill_sr_public": "מיומנות (skill) ציבורית",
+  "com_ui_skill_states_limit": "הגעת למגבלה של {{0}} עקיפות מיומניות (skills) פעילות/לא פעילות. הסר חלק מהעקיפות כדי להפעיל או לכבות מיומניות נוספות.",
+  "com_ui_skill_toggle_active": "שנה את מצב הפעילות של המיומנות (skill)",
+  "com_ui_skill_update_conflict": "עריכה אחרת נשמרה לפני העריכה שלך. טוען את הגרסה העדכנית.",
+  "com_ui_skill_update_error": "שמירת המיומנות (skill) נכשלה",
+  "com_ui_skill_updated": "המיומנות (skill) נשמרה",
+  "com_ui_skill_upload": "העלה מיומנות (skill)",
+  "com_ui_skill_upload_drag": "גרור ושחרר או לחץ להעלאה",
+  "com_ui_skill_upload_file": "העלה קובץ",
+  "com_ui_skill_upload_req_md": "קובץ ‎.md חייב להכיל שם ותיאור של המיומנות (skill) בפורמט YAML",
+  "com_ui_skill_upload_req_size": "גודל הקובץ לא יעלה על {{0}} MB",
+  "com_ui_skill_upload_req_zip": "קובץ ‎.zip או ‎.skill חייב לכלול קובץ SKILL.md",
+  "com_ui_skill_upload_requirements": "דרישות קובץ",
+  "com_ui_skill_upload_size_error": "ייבוא מיומנות (skill) לא יעלה על {{0}} MB",
+  "com_ui_skill_upload_title": "העלה מיומנות (skill)",
+  "com_ui_skill_version": "v{{0}}",
+  "com_ui_skill_view_rendered": "הצג אחרי עיבוד",
+  "com_ui_skill_view_source": "הצג מקור",
+  "com_ui_skill_warnings": "שים לב",
+  "com_ui_skill_write_instructions": "כתוב את הוראות המיומנות (skill)",
+  "com_ui_skills": "מיומניות (Skills)",
+  "com_ui_skills_allow_create": "אפשר יצירת מיומניות (Skills)",
+  "com_ui_skills_allow_share": "אפשר שיתוף מיומניות (Skills)",
+  "com_ui_skills_allow_share_public": "אפשר שיתוף מיומניות (Skills) באופן ציבורי",
+  "com_ui_skills_allow_use": "אפשר שימוש במיומניות (Skills)",
+  "com_ui_skills_always_apply_invoked": "מיומניות (skills) המוחלות אוטומטית",
+  "com_ui_skills_always_apply_pin_title": "מיומנות (skill) המוחלת תמיד (מופעלת אוטומטית בכל תור)",
+  "com_ui_skills_command_placeholder": "בחר מיומנות (Skill) לפי שם",
+  "com_ui_skills_disabled_hint": "המיומניות (Skills) מושבתות עבור סוכן זה. הפעל כדי לאפשר למודל להשתמש בקטלוג המיומניות (Skills) שלך.",
+  "com_ui_skills_empty": "אין עדיין מיומניות (Skills)",
+  "com_ui_skills_enable_toggle": "הפעל את המיומניות (skills) עבור הסוכן הזה",
+  "com_ui_skills_enabled_all_hint": "מופעל. הקטלוג המלא זמין; צמצם למטה אם ברצונך להגביל באילו מיומניות (skills) הסוכן הזה יוכל להשתמש.",
+  "com_ui_skills_enabled_allowlist_hint": "מופעל. מוגבל למיומניות (skills) שנבחרו מקודם.",
+  "com_ui_skills_load_error": "טעינת המיומניות (skills) נכשלה",
+  "com_ui_skills_manual_invoked": "מיומניות (skills) שהופעלו ידנית",
+  "com_ui_skills_queued": "המיומניות (Skills) בהמתנה לשליחה הבאה",
+  "com_ui_special": "מיוחד",
   "com_ui_special_var_current_date": "תאריך נוכחי",
   "com_ui_special_var_current_datetime": "תאריך ושעה נוכחיים",
   "com_ui_special_var_current_user": "משתמש נוכחי",
+  "com_ui_special_var_desc_current_date": "התאריך והיום בשבוע הנוכחיים",
+  "com_ui_special_var_desc_current_datetime": "התאריך והשעה המקומיים לפי אזור הזמן שלך",
+  "com_ui_special_var_desc_current_user": "שם התצוגה של החשבון שלך",
+  "com_ui_special_var_desc_iso_datetime": "תאריך ושעה UTC בפורמט ISO 8601",
   "com_ui_special_var_iso_datetime": "תאריך ושעה ISO UTC",
-  "com_ui_special_variables": "משתנים מיוחדים:",
+  "com_ui_special_variable_added": "נוסף משתנה מיוחד {{0}}.",
+  "com_ui_special_variables": "משתנים מיוחדים",
+  "com_ui_speech_not_supported": "הדפדפן שלך אינו תומך בזיהוי דיבור",
+  "com_ui_speech_not_supported_use_external": "הדפדפן שלך אינו תומך בזיהוי דיבור. נסה לעבור ל־STT חיצוני בהגדרות > דיבור.",
   "com_ui_speech_while_submitting": "לא ניתן לשלוח אודיו בזמן שנוצרת תגובה",
+  "com_ui_sr_global_prompt": "קבוצת הנחיות גלובלית",
+  "com_ui_sr_public_skill": "מיומנות (skill) ציבורית",
+  "com_ui_stack_trace": "מעקב ערימה",
+  "com_ui_status_prefix": "סטטוס:",
   "com_ui_stop": "עצור",
   "com_ui_storage": "אחסון",
+  "com_ui_storage_filter_sort": "סנן ומיין לפי אחסון",
+  "com_ui_subagent_cancelled": "בטל סוכן",
+  "com_ui_subagent_complete": "הרץ סוכן",
+  "com_ui_subagent_dialog_description": "הרצת תת-תהליך בהקשר מבודד. פעילות ותוצאה סופית מוצגות למטה.",
+  "com_ui_subagent_dialog_title": "סוכן \"{{0}}\"",
+  "com_ui_subagent_dialog_title_self": "סוכן",
+  "com_ui_subagent_empty_result": "לא הוחזר טקסט.",
+  "com_ui_subagent_errored": "הסוכן נתקל בשגיאה",
+  "com_ui_subagent_no_result_yet": "עדיין פועל — אין תוצאה סופית עדיין.",
+  "com_ui_subagent_running": "מריץ סוכן",
+  "com_ui_subagent_ticker_error": "שגיאה",
+  "com_ui_subagent_ticker_reasoning": "מסיק",
+  "com_ui_subagent_ticker_tool_done": "הושלם",
+  "com_ui_subagent_ticker_using": "משתמש",
+  "com_ui_subagent_ticker_writing": "כותב",
+  "com_ui_subagent_waiting": "ממתין לעדכון ראשון…",
   "com_ui_submit": "שלח",
+  "com_ui_summarized": "סוכם",
+  "com_ui_summarizing": "מסכם...",
   "com_ui_support_contact": "פניה לתמיכה",
   "com_ui_support_contact_email": "דוא\"ל",
   "com_ui_support_contact_email_invalid": "אנא הזן כתובת דוא\"ל חוקית",
@@ -1150,32 +1608,56 @@
   "com_ui_temporary": "צ'אט זמני",
   "com_ui_terms_and_conditions": "תנאים והגבלות",
   "com_ui_terms_of_service": "תנאי השירות",
+  "com_ui_text_variables": "משתני טקסט",
   "com_ui_thinking": "חושב...",
-  "com_ui_thoughts": "מחשבות",
+  "com_ui_thoughts": "הצגת תהליך החשיבה של המודל",
+  "com_ui_toggle_theme": "החלף ערכת נושא",
   "com_ui_token": "טוקן",
   "com_ui_token_exchange_method": "שיטת החלפת טוקנים",
   "com_ui_token_url": "קישור URL לטוקן",
   "com_ui_tokens": "טוקנים",
   "com_ui_tool_collection_prefix": "אוסף כלים מבית",
+  "com_ui_tool_failed": "נכשל",
+  "com_ui_tool_list_collapse": "כווץ רשימת כלים של {{serverName}}",
+  "com_ui_tool_list_expand": "הרחב רשימת כלים של {{serverName}}",
+  "com_ui_tool_name_code": "קוד",
+  "com_ui_tool_name_code_analysis": "ניתוח קוד",
+  "com_ui_tool_name_file_search": "חיפוש קבצים",
+  "com_ui_tool_name_image_edit": "עריכת תמונה",
+  "com_ui_tool_name_image_gen": "יצירת תמונה",
+  "com_ui_tool_name_web_search": "חיפוש באינטרנט",
   "com_ui_tools": "כלים",
+  "com_ui_tools_and_actions": "כלים ופעולות",
+  "com_ui_transferred_to": "הועבר אל",
   "com_ui_travel": "מסע",
   "com_ui_trust_app": "אני סומך על האפליקציה הזו",
   "com_ui_try_adjusting_search": "נסה להתאים את מונחי החיפוש שלך",
+  "com_ui_ui_resource_error": "שגיאת משאב ממשק ({{0}})",
+  "com_ui_ui_resource_not_found": "משאב ממשק לא נמצא (אינדקס: {{0}})",
   "com_ui_unarchive": "הוצא מהארכיון",
+  "com_ui_unarchive_conversation": "הוצא את השיחה מהארכיון",
   "com_ui_unarchive_error": "הוצאת השיחה מהארכיון נכשלה",
   "com_ui_unavailable": "לא זמין",
+  "com_ui_unfavorite": "הסר מהמועדפים",
   "com_ui_unknown": "לא ידוע",
+  "com_ui_unknown_file_type": "סוג קובץ לא ידוע",
+  "com_ui_unpin": "בטל את ההצמדה",
   "com_ui_unset": "בטל הגדרה",
   "com_ui_untitled": "ללא כותר",
   "com_ui_update": "עדכון",
+  "com_ui_update_mcp_server": "עדכן שרת MCP",
+  "com_ui_updating": "מעדכן...",
   "com_ui_upload": "העלה",
   "com_ui_upload_agent_avatar": "האווטר של הסוכן עודכן בהצלחה",
+  "com_ui_upload_agent_avatar_label": "העלה תמונת אווטאר לסוכן",
   "com_ui_upload_avatar_label": "העלה תמונת אווטאר",
+  "com_ui_upload_code_environment": "העלה לסביבת הקוד",
   "com_ui_upload_delay": "העלאת \"{{0}}\" לוקחת יותר זמן מהצפוי. אנא המתן בזמן שהקובץ מסיים את האינדוקס לאחזור.",
   "com_ui_upload_error": "אירעה שגיאה בהעלאת הקובץ שלך",
   "com_ui_upload_file_context": "העלה קובץ כקובץ הקשר",
   "com_ui_upload_file_search": "העלאה לחיפוש בקבצים",
   "com_ui_upload_files": "העלה קבצים",
+  "com_ui_upload_icon": "העלה תמונת אייקון",
   "com_ui_upload_image": "העלה תמונה",
   "com_ui_upload_image_input": "העלה תמונה",
   "com_ui_upload_invalid": "אין אפשרות להעלות את הקובץ. התמונה חורגת מהמגבלה",
@@ -1189,14 +1671,19 @@
   "com_ui_use_backup_code": "השתמש בקוד גיבוי במקום",
   "com_ui_use_memory": "השתמש בזיכרון",
   "com_ui_use_micrphone": "שימוש במיקורפון",
+  "com_ui_use_prompt": "השתמש בהנחיה (פרומפט)",
   "com_ui_used": "נוצל",
+  "com_ui_used_n_tools": "נעשה שימוש ב־{{0}} כלים",
   "com_ui_user": "משתמש",
   "com_ui_user_group_permissions": "הרשאות משתמשים וקבוצות",
+  "com_ui_user_provides_key": "כל משתמש מספק מפתח משלו",
   "com_ui_value": "ערך",
+  "com_ui_variable_with_options": "משתנה {{name}} עם {{count}} אפשרויות",
   "com_ui_variables": "משתנים",
   "com_ui_verify": "אמת",
   "com_ui_version_var": "גרסה {{0}}",
   "com_ui_versions": "גרסה",
+  "com_ui_via_server": "ב־{{0}}",
   "com_ui_view_memory": "הצג זיכרון",
   "com_ui_web_search": "חיפוש ברשת",
   "com_ui_web_search_cohere_key": "הכנס מפתח API של Cohere",
@@ -1205,24 +1692,39 @@
   "com_ui_web_search_jina_url": "כתובת URL של מפתח API של Jina (אופציונלי)",
   "com_ui_web_search_processing": "עיבוד התוצאות",
   "com_ui_web_search_provider": "ספק החיפוש",
+  "com_ui_web_search_provider_searxng": "SearXNG",
   "com_ui_web_search_provider_serper": "ממשק ה-API של Serper",
   "com_ui_web_search_provider_serper_key": "קבל מפתח API של Serper ",
+  "com_ui_web_search_provider_tavily": "Tavily API",
+  "com_ui_web_search_provider_tavily_key": "קבל את מפתח ה־API של Tavily",
   "com_ui_web_search_reading": "קריאת התוצאות",
   "com_ui_web_search_reranker": "למד עוד על דירוג מחדש באמצעות Jina",
   "com_ui_web_search_reranker_cohere": "קוֹהִיר (Cohere)",
   "com_ui_web_search_reranker_cohere_key": "קבל מפתח API של Cohere",
+  "com_ui_web_search_reranker_jina": "Jina AI",
   "com_ui_web_search_reranker_jina_key": "קבל מפתח API של Jina",
   "com_ui_web_search_reranker_jina_url_help": "למד עוד על דירוג מחדש באמצעות Jina",
+  "com_ui_web_search_scraper_firecrawl": "Firecrawl API",
   "com_ui_web_search_scraper_firecrawl_key": "קבל מפתח API של Firecrawl",
+  "com_ui_web_search_scraper_serper": "Serper Scrape API",
   "com_ui_web_search_scraper_serper_key": "השג מפתח API של Serper",
+  "com_ui_web_search_scraper_tavily": "Tavily Extract API",
+  "com_ui_web_search_scraper_tavily_key": "קבל את מפתח ה־API של Tavily",
   "com_ui_web_search_searxng_api_key": "הזן מפתח API של SearXNG (אופציונלי)",
   "com_ui_web_search_searxng_instance_url": "כתובת URL של מופע SearXNG",
+  "com_ui_web_search_source": "מקור {{count}}",
+  "com_ui_web_search_sources": "{{count}} מקורות",
+  "com_ui_web_searched": "חיפוש באינטרנט",
   "com_ui_web_searching": "חיפוש ברשת",
   "com_ui_web_searching_again": "חיפוש נוסף ברשת",
   "com_ui_weekend_morning": "סוף שבוע נעים!",
   "com_ui_write": "כתיבה",
+  "com_ui_writing_command": "כתיבת פקודה",
   "com_ui_x_selected": "{{0}} נבחר",
+  "com_ui_xhigh": "מאוד גבוה",
   "com_ui_yes": "כן",
+  "com_ui_you": "אתה",
+  "com_ui_your_api_key": "מפתח ה־API שלך",
   "com_ui_zoom": "זום",
   "com_ui_zoom_in": "להתקרב (זום אין)",
   "com_ui_zoom_level": "רמת זום",
diff --git a/client/src/locales/i18n.ts b/client/src/locales/i18n.ts
index cbebd4d5e38..02f1d0e6913 100644
--- a/client/src/locales/i18n.ts
+++ b/client/src/locales/i18n.ts
@@ -1,112 +1,337 @@
 import i18n from 'i18next';
 import { initReactI18next } from 'react-i18next';
-import LanguageDetector from 'i18next-browser-languagedetector';
 
-// Import your JSON translations
 import translationEn from './en/translation.json';
-import translationAr from './ar/translation.json';
-import translationCa from './ca/translation.json';
-import translationCs from './cs/translation.json';
-import translationDa from './da/translation.json';
-import translationDe from './de/translation.json';
-import translationEs from './es/translation.json';
-import translationEt from './et/translation.json';
-import translationFa from './fa/translation.json';
-import translationFr from './fr/translation.json';
-import translationIt from './it/translation.json';
-import translationPl from './pl/translation.json';
-import translationPt_BR from './pt-BR/translation.json';
-import translationPt_PT from './pt-PT/translation.json';
-import translationRu from './ru/translation.json';
-import translationJa from './ja/translation.json';
-import translationKa from './ka/translation.json';
-import translationSv from './sv/translation.json';
-import translationKo from './ko/translation.json';
-import translationLt from './lt/translation.json';
-import translationLv from './lv/translation.json';
-import translationTh from './th/translation.json';
-import translationTr from './tr/translation.json';
-import translationUg from './ug/translation.json';
-import translationVi from './vi/translation.json';
-import translationNl from './nl/translation.json';
-import translationNn from './nn/translation.json';
-import translationId from './id/translation.json';
-import translationIs from './is/translation.json';
-import translationHe from './he/translation.json';
-import translationHu from './hu/translation.json';
-import translationHy from './hy/translation.json';
-import translationFi from './fi/translation.json';
-import translationZh_Hans from './zh-Hans/translation.json';
-import translationZh_Hant from './zh-Hant/translation.json';
-import translationSk from './sk/translation.json';
-import translationBo from './bo/translation.json';
-import translationUk from './uk/translation.json';
-import translationBs from './bs/translation.json';
-import translationNb from './nb/translation.json';
-import translationSl from './sl/translation.json';
 
 export const defaultNS = 'translation';
 
+export const supportedLocales = [
+  'ar',
+  'bo',
+  'bs',
+  'ca',
+  'cs',
+  'da',
+  'de',
+  'en',
+  'es',
+  'et',
+  'fa',
+  'fi',
+  'fr',
+  'he',
+  'hu',
+  'hy',
+  'id',
+  'is',
+  'it',
+  'ja',
+  'ka',
+  'ko',
+  'lt',
+  'lv',
+  'nb',
+  'nl',
+  'nn',
+  'pl',
+  'pt-BR',
+  'pt-PT',
+  'ru',
+  'sk',
+  'sl',
+  'sv',
+  'th',
+  'tr',
+  'ug',
+  'uk',
+  'vi',
+  'zh-Hans',
+  'zh-Hant',
+] as const;
+
+export type SupportedLocale = (typeof supportedLocales)[number];
+export type TranslationResource = Record<string, string>;
+
 export const resources = {
   en: { translation: translationEn },
-  ar: { translation: translationAr },
-  bs: { translation: translationBs },
-  ca: { translation: translationCa },
-  cs: { translation: translationCs },
-  'zh-Hans': { translation: translationZh_Hans },
-  'zh-Hant': { translation: translationZh_Hant },
-  da: { translation: translationDa },
-  de: { translation: translationDe },
-  es: { translation: translationEs },
-  et: { translation: translationEt },
-  fa: { translation: translationFa },
-  fr: { translation: translationFr },
-  it: { translation: translationIt },
-  nb: { translation: translationNb },
-  pl: { translation: translationPl },
-  'pt-BR': { translation: translationPt_BR },
-  'pt-PT': { translation: translationPt_PT },
-  ru: { translation: translationRu },
-  ja: { translation: translationJa },
-  ka: { translation: translationKa },
-  sv: { translation: translationSv },
-  ko: { translation: translationKo },
-  lt: { translation: translationLt },
-  lv: { translation: translationLv },
-  th: { translation: translationTh },
-  tr: { translation: translationTr },
-  ug: { translation: translationUg },
-  vi: { translation: translationVi },
-  nl: { translation: translationNl },
-  nn: { translation: translationNn },
-  id: { translation: translationId },
-  is: { translation: translationIs },
-  he: { translation: translationHe },
-  hu: { translation: translationHu },
-  hy: { translation: translationHy },
-  fi: { translation: translationFi },
-  sk: { translation: translationSk },
-  bo: { translation: translationBo },
-  sl: { translation: translationSl },
-  uk: { translation: translationUk },
 } as const;
 
-i18n
-  .use(LanguageDetector)
-  .use(initReactI18next)
-  .init({
-    fallbackLng: {
-      'zh-TW': ['zh-Hant', 'en'],
-      'zh-HK': ['zh-Hant', 'en'],
-      zh: ['zh-Hans', 'en'],
-      default: ['en'],
-    },
-    fallbackNS: 'translation',
-    ns: ['translation'],
-    debug: false,
-    defaultNS,
-    resources,
-    interpolation: { escapeValue: false },
-  });
+const localeLoaders: Record<
+  Exclude<SupportedLocale, 'en'>,
+  () => Promise<{ default: TranslationResource }>
+> = {
+  ar: () => import('./ar/translation.json'),
+  bo: () => import('./bo/translation.json'),
+  bs: () => import('./bs/translation.json'),
+  ca: () => import('./ca/translation.json'),
+  cs: () => import('./cs/translation.json'),
+  da: () => import('./da/translation.json'),
+  de: () => import('./de/translation.json'),
+  es: () => import('./es/translation.json'),
+  et: () => import('./et/translation.json'),
+  fa: () => import('./fa/translation.json'),
+  fi: () => import('./fi/translation.json'),
+  fr: () => import('./fr/translation.json'),
+  he: () => import('./he/translation.json'),
+  hu: () => import('./hu/translation.json'),
+  hy: () => import('./hy/translation.json'),
+  id: () => import('./id/translation.json'),
+  is: () => import('./is/translation.json'),
+  it: () => import('./it/translation.json'),
+  ja: () => import('./ja/translation.json'),
+  ka: () => import('./ka/translation.json'),
+  ko: () => import('./ko/translation.json'),
+  lt: () => import('./lt/translation.json'),
+  lv: () => import('./lv/translation.json'),
+  nb: () => import('./nb/translation.json'),
+  nl: () => import('./nl/translation.json'),
+  nn: () => import('./nn/translation.json'),
+  pl: () => import('./pl/translation.json'),
+  'pt-BR': () => import('./pt-BR/translation.json'),
+  'pt-PT': () => import('./pt-PT/translation.json'),
+  ru: () => import('./ru/translation.json'),
+  sk: () => import('./sk/translation.json'),
+  sl: () => import('./sl/translation.json'),
+  sv: () => import('./sv/translation.json'),
+  th: () => import('./th/translation.json'),
+  tr: () => import('./tr/translation.json'),
+  ug: () => import('./ug/translation.json'),
+  uk: () => import('./uk/translation.json'),
+  vi: () => import('./vi/translation.json'),
+  'zh-Hans': () => import('./zh-Hans/translation.json'),
+  'zh-Hant': () => import('./zh-Hant/translation.json'),
+};
+
+const localeByLowercase = supportedLocales.reduce<Record<string, SupportedLocale>>(
+  (acc, locale) => {
+    acc[locale.toLowerCase()] = locale;
+    return acc;
+  },
+  {},
+);
+
+const localeAliases: Record<string, SupportedLocale> = {
+  'ar-eg': 'ar',
+  'ca-es': 'ca',
+  'cs-cz': 'cs',
+  'da-dk': 'da',
+  'de-de': 'de',
+  'en-us': 'en',
+  'es-es': 'es',
+  'et-ee': 'et',
+  'fa-ir': 'fa',
+  'fi-fi': 'fi',
+  'fr-fr': 'fr',
+  'he-he': 'he',
+  'he-il': 'he',
+  'hu-hu': 'hu',
+  'hy-am': 'hy',
+  'id-id': 'id',
+  'it-it': 'it',
+  'ja-jp': 'ja',
+  'ka-ge': 'ka',
+  'ko-kr': 'ko',
+  'lt-lt': 'lt',
+  'lv-lv': 'lv',
+  'nl-nl': 'nl',
+  'pl-pl': 'pl',
+  pt: 'pt-PT',
+  'ru-ru': 'ru',
+  'sv-se': 'sv',
+  'th-th': 'th',
+  'tr-tr': 'tr',
+  'uk-ua': 'uk',
+  'vi-vn': 'vi',
+  zh: 'zh-Hans',
+  'zh-cn': 'zh-Hans',
+  'zh-sg': 'zh-Hans',
+  'zh-tw': 'zh-Hant',
+  'zh-hk': 'zh-Hant',
+  'zh-mo': 'zh-Hant',
+};
+
+const loadedLocales = new Set<SupportedLocale>(['en']);
+const loadingLocales: Partial<Record<SupportedLocale, Promise<SupportedLocale>>> = {};
+let languageRequestId = 0;
+let latestRequestedLocale: SupportedLocale = 'en';
+
+function readCookie(name: string) {
+  if (typeof document === 'undefined') {
+    return undefined;
+  }
+
+  const prefix = `${name}=`;
+  return document.cookie
+    .split(';')
+    .map((cookie) => cookie.trim())
+    .find((cookie) => cookie.startsWith(prefix))
+    ?.slice(prefix.length);
+}
+
+function readStoredLanguage() {
+  if (typeof localStorage === 'undefined') {
+    return undefined;
+  }
+
+  const raw = localStorage.getItem('lang');
+  if (!raw) {
+    return undefined;
+  }
+
+  try {
+    const parsed = JSON.parse(raw);
+    return typeof parsed === 'string' ? parsed : raw;
+  } catch {
+    return raw;
+  }
+}
+
+function getNavigatorLanguage() {
+  if (typeof navigator === 'undefined') {
+    return 'en';
+  }
+
+  return navigator.language || navigator.languages?.[0] || 'en';
+}
+
+export function normalizeLocale(locale?: string | null): SupportedLocale {
+  const requested = locale === 'auto' ? getNavigatorLanguage() : locale;
+  if (!requested) {
+    return 'en';
+  }
+
+  const normalized = requested.replace(/_/g, '-').toLowerCase();
+  const exact = localeByLowercase[normalized];
+  if (exact) {
+    return exact;
+  }
+
+  const alias = localeAliases[normalized];
+  if (alias) {
+    return alias;
+  }
+
+  const base = normalized.split('-')[0];
+  return localeByLowercase[base] ?? localeAliases[base] ?? 'en';
+}
+
+export function detectInitialLanguage() {
+  const cookieLang = readCookie('lang');
+  const storedLang = readStoredLanguage();
+  return normalizeLocale(cookieLang || storedLang || getNavigatorLanguage());
+}
+
+export async function ensureLocale(locale?: string | null): Promise<SupportedLocale> {
+  const normalized = normalizeLocale(locale);
+
+  if (normalized === 'en') {
+    return normalized;
+  }
+
+  if (loadedLocales.has(normalized)) {
+    return normalized;
+  }
+
+  if (i18n.hasResourceBundle(normalized, defaultNS)) {
+    loadedLocales.add(normalized);
+    return normalized;
+  }
+
+  if (!loadingLocales[normalized]) {
+    const loader = localeLoaders[normalized];
+    loadingLocales[normalized] = loader()
+      .then((module) => {
+        i18n.addResourceBundle(normalized, defaultNS, module.default, true, true);
+        loadedLocales.add(normalized);
+        return normalized;
+      })
+      .catch((error): SupportedLocale => {
+        console.error(`[i18n] Failed to load locale "${normalized}"`, error);
+        return 'en';
+      })
+      .finally(() => {
+        delete loadingLocales[normalized];
+      });
+  }
+
+  return loadingLocales[normalized] ?? Promise.resolve('en');
+}
+
+export function __setLocaleLoaderForTests(
+  locale: Exclude<SupportedLocale, 'en'>,
+  loader: () => Promise<{ default: TranslationResource }>,
+) {
+  const previousLoader = localeLoaders[locale];
+  localeLoaders[locale] = loader;
+  return () => {
+    localeLoaders[locale] = previousLoader;
+  };
+}
+
+export function __resetLocaleForTests(locale: Exclude<SupportedLocale, 'en'>) {
+  delete loadingLocales[locale];
+  loadedLocales.delete(locale);
+  if (i18n.hasResourceBundle(locale, defaultNS)) {
+    i18n.removeResourceBundle(locale, defaultNS);
+  }
+}
+
+export function syncDocumentLanguage(locale: SupportedLocale) {
+  if (typeof document === 'undefined') {
+    return;
+  }
+
+  document.documentElement.lang = locale;
+  document.documentElement.dir = i18n.dir(locale);
+}
+
+export const i18nInitPromise = i18n.use(initReactI18next).init({
+  lng: 'en',
+  fallbackLng: {
+    'zh-TW': ['zh-Hant', 'en'],
+    'zh-HK': ['zh-Hant', 'en'],
+    zh: ['zh-Hans', 'en'],
+    default: ['en'],
+  },
+  fallbackNS: defaultNS,
+  ns: [defaultNS],
+  debug: false,
+  defaultNS,
+  resources,
+  supportedLngs: [...supportedLocales],
+  partialBundledLanguages: true,
+  load: 'currentOnly',
+  react: { useSuspense: false },
+  interpolation: { escapeValue: false },
+});
+
+export async function changeLanguageSafely(locale?: string | null) {
+  const requestId = ++languageRequestId;
+  const requestedLocale = normalizeLocale(locale);
+  latestRequestedLocale = requestedLocale;
+  await i18nInitPromise;
+
+  const loadedLocale = await ensureLocale(requestedLocale);
+  if (requestId !== languageRequestId) {
+    return i18n.language;
+  }
+
+  await i18n.changeLanguage(loadedLocale);
+  if (requestId !== languageRequestId) {
+    const latestLocale = await ensureLocale(latestRequestedLocale);
+    await i18n.changeLanguage(latestLocale);
+    syncDocumentLanguage(latestLocale);
+    return i18n.language;
+  }
+
+  syncDocumentLanguage(loadedLocale);
+  return loadedLocale;
+}
+
+export async function initializeI18n() {
+  const initialLanguage = detectInitialLanguage();
+  await changeLanguageSafely(initialLanguage);
+  return initialLanguage;
+}
 
 export default i18n;
diff --git a/client/src/locales/it/translation.json b/client/src/locales/it/translation.json
index 6e963a021c0..f703e7273e5 100644
--- a/client/src/locales/it/translation.json
+++ b/client/src/locales/it/translation.json
@@ -2,19 +2,26 @@
   "chat_direction_left_to_right": "Da Sinistra a Destra",
   "chat_direction_right_to_left": "Da destra a sinistra\n",
   "com_a11y_ai_composing": "L'IA sta ancora componendo",
+  "com_a11y_chats_date_section": "Chat del {{date}}",
   "com_a11y_end": "L'IA ha terminato la sua risposta",
   "com_a11y_selected": "Selezionato",
   "com_a11y_start": "L'IA ha iniziato la sua risposta",
-  "com_agents_agent_card_label": "{{nome}} agente. {{descrizione}}",
+  "com_a11y_summarize_completed": "Contesto riassunto",
+  "com_a11y_summarize_failed": "procedura di riassunto fallita, continuo con il contesto disponibilie",
+  "com_agents_agent_card_label": "Agente {{name}}. {{description}}",
+  "com_agents_all": "Tutti gli agenti",
   "com_agents_all_category": "Tutti",
   "com_agents_all_description": "Sfoglia tutti gli agenti condivisi in tutte le categorie",
   "com_agents_avatar_upload_error": "Il caricamento dell'avatar d'agente è fallito",
+  "com_agents_category_aftersales": "Post vendita",
+  "com_agents_category_aftersales_description": "Agenti specializzati nell'assistenza post-vendita, nella manutenzione e nel servizio clienti",
   "com_agents_category_empty": "Non sono stati trovati agenti nella categoria {{category}}",
   "com_agents_category_finance": "Finanza",
   "com_agents_category_finance_description": "Agenti specializzati in analisi finanziaria, budgeting e contabilità",
   "com_agents_category_general": "Generale",
   "com_agents_category_general_description": "Agenti di uso generale per compiti e richieste comuni",
   "com_agents_category_hr": "Risorse Umane",
+  "com_agents_category_hr_description": "Agenti specializzati nei processi, nelle politiche e nell'assistenza ai dipendenti in ambito HR",
   "com_agents_category_it": "IT",
   "com_agents_category_it_description": "Agenti per supporto IT, risoluzione dei problemi tecnici e amministrazione del sistema",
   "com_agents_category_rd": "Ricerca e sviluppo",
@@ -29,7 +36,7 @@
   "com_agents_copy_link": "Copia Link",
   "com_agents_create_error": "Si è verificato un errore durante la creazione del tuo agente.",
   "com_agents_created_by": "da",
-  "com_agents_description_card": "Descrizione: {{descrizione}}",
+  "com_agents_description_card": "Descrizione: {{description}}",
   "com_agents_description_placeholder": "Opzionale: Descrivi qui il tuo Agente",
   "com_agents_empty_state_heading": "Nessun agente trovato",
   "com_agents_enable_file_search": "Abilita Ricerca File",
@@ -82,6 +89,7 @@
   "com_agents_not_available": "Agente Non Disponibile",
   "com_agents_recommended": "I nostri agenti consigliati",
   "com_agents_results_for": "Risultati per '{{query}}'",
+  "com_agents_run_code_files": "I file qui sotto sono solo per il Code Environment",
   "com_agents_search_aria": "Cerca agenti",
   "com_agents_search_empty_heading": "Nessun risultato di ricerca",
   "com_agents_search_info": "Se abilitato, consente all'agente di cercare informazioni aggiornate sul web. Richiede una chiave API valida.",
@@ -213,12 +221,13 @@
   "com_endpoint_agent": "Agente",
   "com_endpoint_agent_placeholder": "Seleziona un Agente",
   "com_endpoint_ai": "IA",
-  "com_endpoint_anthropic_effort": "Controlla la quantità di sforzo computazionale applicato da Claude. Uno sforzo minore fa risparmiare gettoni e riduce la latenza; uno sforzo maggiore produce risposte più approfondite. 'Max' consente il ragionamento più approfondito (solo Opus 4.6).",
+  "com_endpoint_anthropic_effort": "Controlla lo sforzo computazionale di Claude. Minore sforzo consuma meno token e riduce la latenza; un maggiore sforzo produce risposte più accurate. \"Max\" abilita lo sforzo di ragionamento maggiore nei modelli con ragionamento adattivo",
   "com_endpoint_anthropic_maxoutputtokens": "Numero massimo di token che possono essere generati nella risposta. Specifica un valore più basso per risposte più brevi e un valore più alto per risposte più lunghe.",
   "com_endpoint_anthropic_prompt_cache": "La cache dei prompt permette di riutilizzare contesti o istruzioni estese tra le chiamate API, riducendo costi e latenza",
   "com_endpoint_anthropic_temp": "Varia da 0 a 1. Usa temp più vicino a 0 per analitica / scelta multipla, e più vicino a 1 per compiti creativi e generativi. Consigliamo di modificare questo o Top P ma non entrambi.",
-  "com_endpoint_anthropic_thinking": "Abilita il ragionamento interno per i modelli Claude supportati (3.7 Sonnet). Nota: richiede che \"Thinking Budget\" sia impostato e inferiore a \"Massimo Output Token\"",
+  "com_endpoint_anthropic_thinking": "Abilita il ragionamento interno per i modelli Claude supportati. Per modelli più nuovi (Opus 4.6+), utilizza \"Adaptive Thinking\" controllato dal parametro Effort. Per modelli legacy, richiede che \"Thinking Budget\" sia impostato e inferiore a \"Massimo Output Token\"",
   "com_endpoint_anthropic_thinking_budget": "Determina il numero massimo di token che Claude può utilizzare per il suo processo di ragionamento interno. Un budget maggiore può migliorare la qualità della risposta, consentendo un'analisi più approfondita di problemi complessi, anche se Claude potrebbe non utilizzare l'intero budget assegnato, soprattutto con intervalli superiori a 32K. Questa impostazione deve essere inferiore a \"Massimo Output Token\".",
+  "com_endpoint_anthropic_thinking_display_desc": "Decide se restituire il ragionamento di Claude. 'Auto' abilita i pensieri riassunti per modelli che li nascondono di default (Opus 4.7+); 'Summarized' li mostra sempre; 'Omitted' li nasconde sempre per avere una latenza leggermente ridotta.",
   "com_endpoint_anthropic_topk": "Top-k cambia il modo in cui il modello seleziona i token per l'output. Un top-k di 1 significa che il token selezionato è il più probabile tra tutti i token nel vocabolario del modello (anche chiamato greedy decoding), mentre un top-k di 3 significa che il prossimo token è selezionato tra i 3 più probabili (usando la temperatura).",
   "com_endpoint_anthropic_topp": "Top-p cambia il modo in cui il modello seleziona i token per l'output. I token vengono selezionati dai più probabili K (vedi parametro topK) ai meno probabili fino a quando la somma delle loro probabilità eguaglia il valore top-p.",
   "com_endpoint_anthropic_use_web_search": "Abilitare la funzionalità di ricerca sul web utilizzando le capacità di ricerca integrate di Anthropic. In questo modo il modello può cercare informazioni aggiornate sul web e fornire risposte più precise e attuali.",
@@ -263,8 +272,8 @@
   "com_endpoint_google_custom_name_placeholder": "Imposta un nome personalizzato per Google",
   "com_endpoint_google_maxoutputtokens": "Numero massimo di token che possono essere generati nella risposta. Specifica un valore più basso per risposte più brevi e un valore più alto per risposte più lunghe.",
   "com_endpoint_google_temp": "Valori più alti = più casualità, mentre valori più bassi = più focalizzati e deterministici. Consigliamo di modificare questo o Top P ma non entrambi.",
-  "com_endpoint_google_thinking": "Abilita o disabilita il ragionamento. Questa impostazione è supportata solo da alcuni modelli (serie 2.5). Per i modelli più vecchi, questa impostazione potrebbe non avere alcun effetto.",
-  "com_endpoint_google_thinking_budget": "Indica il numero di token di riflessione utilizzati dal modello. La quantità effettiva può essere superiore o inferiore a questo valore, a seconda della richiesta.\n\nQuesta impostazione è supportata solo da alcuni modelli (serie 2.5). Gemini 2.5 Pro supporta 128-32.768 token. Gemini 2.5 Flash supporta 0-24.576 token. Gemini 2.5 Flash Lite supporta 512-24.576 token.\n\nLasciare vuoto o impostare \"-1\" per lasciare che il modello decida automaticamente quando e quanto pensare. Per impostazione predefinita, Gemini 2.5 Flash Lite non pensa.",
+  "com_endpoint_google_thinking": "Abilita o disabilita il ragionamento. Questa impostazione è supportata solo dai modelli delle serie Gemini 2.5 e 3. Nota: Gemini 3 pro non può disattivare completamente la modalità thinking.",
+  "com_endpoint_google_thinking_budget": "Guida il numero di token di pensiero (thinking tokens) utilizzati dal modello. La quantità effettiva può essere superiore o inferiore a questo valore in base al prompt.\n\nQuesta impostazione si applica solo a Gemini 2.5 e versioni precedenti. Per Gemini 3 e versioni successive, utilizza invece l'impostazione 'Thinking Level'.\n\nGemini 2.5 Pro supporta 128-32.768 token. Gemini 2.5 Flash supporta 0-24.576 token. Gemini 2.5 Flash Lite supporta 512-24.576 token.\n\nLascia vuoto o imposta a '-1' per permettere al modello di decidere automaticamente quando e quanto ragionare. Per impostazione predefinita, Gemini 2.5 Flash Lite non utilizza il ragionamento.",
   "com_endpoint_google_topk": "Top-k cambia il modo in cui il modello seleziona i token per l'output. Un top-k di 1 significa che il token selezionato è il più probabile tra tutti i token nel vocabolario del modello (anche chiamato greedy decoding), mentre un top-k di 3 significa che il prossimo token è selezionato tra i 3 più probabili (usando la temperatura).",
   "com_endpoint_google_topp": "Top-p cambia il modo in cui il modello seleziona i token per l'output. I token vengono selezionati dai più probabili K (vedi parametro topK) ai meno probabili fino a quando la somma delle loro probabilità eguaglia il valore top-p.",
   "com_endpoint_google_use_search_grounding": "Utilizzate la funzione di messa a terra della ricerca di Google per migliorare le risposte con risultati di ricerca sul Web in tempo reale. Ciò consente ai modelli di accedere alle informazioni attuali e di fornire risposte più precise e aggiornate.",
@@ -283,7 +292,7 @@
   "com_endpoint_openai_max_tokens": "Campo `max_tokens` opzionale, che rappresenta il numero massimo di token che possono essere generati nel completamento della chat.\n\nLa lunghezza totale dei token di input e dei token generati è limitata dalla lunghezza del contesto del modello. Potresti riscontrare errori se questo numero supera il massimo dei token di contesto.",
   "com_endpoint_openai_pres": "Numero compreso tra -2.0 e 2.0. Valori positivi penalizzano i nuovi token in base a se compaiono nel testo fino a quel momento, aumentando la probabilità del modello di parlare di nuovi argomenti.",
   "com_endpoint_openai_prompt_prefix_placeholder": "Imposta istruzioni personalizzate da includere nel Messaggio di Sistema. Predefinito: nessuno",
-  "com_endpoint_openai_reasoning_effort": "solo per modelli o1: limita lo sforzo sul ragionamento per i modelli di ragionamento. Ridurre lo sforzo di ragionamento può portare a risposte più veloci e a un minor numero di token utilizzati per il ragionamento in una risposta",
+  "com_endpoint_openai_reasoning_effort": "Solo per modelli di ragionamento: limita lo sforzo sul ragionamento. Ridurre lo sforzo può portare a risposte più veloci e a un minor numero di token utilizzati. \"Minimale\" produce pochissimi token di ragionamento per il time-to-first-token più rapido, particolarmente indicato per programmazione e seguire istruzioni.",
   "com_endpoint_openai_reasoning_summary": "Solo per Responses API: Un riassunto del ragionamento eseguito dal modello. Può essere utile per il debug e la comprensione del processo di ragionamento del modello. Impostare su nessuno, auto, conciso o dettagliato.",
   "com_endpoint_openai_resend": "Invia nuovamente tutte le immagini allegate in precedenza. Nota: questo può aumentare significativamente il costo dei token e potresti incontrare errori con molti allegati di immagini.",
   "com_endpoint_openai_resend_files": "Invia nuovamente tutti i file allegati in precedenza. Nota: questo aumenterà il costo dei token e potresti incontrare errori con molti allegati.",
@@ -291,7 +300,7 @@
   "com_endpoint_openai_temp": "Valori più alti = più casualità, mentre valori più bassi = più focalizzati e deterministici. Consigliamo di modificare questo o Top P ma non entrambi.",
   "com_endpoint_openai_topp": "Un'alternativa al campionamento con temperatura, chiamata nucleus sampling, in cui il modello considera i risultati dei token con probabilità di massa top_p. Quindi 0,1 significa che vengono considerati solo i token che compongono la massa di probabilità superiore al 10%. Consigliamo di modificare questo o la temperatura ma non entrambi.",
   "com_endpoint_openai_use_responses_api": "Utilizzare il Responses API invece di Chat Completions, che include funzioni estese di OpenAI. Richiesto per o1-pro, o3-pro e per abilitare i riassunti dei ragionamenti.",
-  "com_endpoint_openai_use_web_search": "Abilitare la funzionalità di ricerca sul web utilizzando le capacità di ricerca integrate di OpenAI. In questo modo il modello può cercare informazioni aggiornate sul web e fornire risposte più precise e attuali.",
+  "com_endpoint_openai_use_web_search": "Abilita la funzionalità di ricerca sul web utilizzando le capacità di ricerca integrate di OpenAI. In questo modo il modello può cercare informazioni aggiornate sul web e fornire risposte più precise e attuali.",
   "com_endpoint_openai_verbosity": "Limita la verbosità della risposta del modello. I valori più bassi daranno luogo a risposte più concise, mentre i valori più alti daranno luogo a risposte più verbose. I valori attualmente supportati sono basso, medio e alto.",
   "com_endpoint_output": "Output",
   "com_endpoint_plug_image_detail": "Dettaglio immagine",
@@ -333,13 +342,14 @@
   "com_endpoint_temperature": "Temperatura",
   "com_endpoint_thinking": "Ragionando",
   "com_endpoint_thinking_budget": "Budget Ragionamento",
+  "com_endpoint_thinking_level": "Livello di thinking",
   "com_endpoint_top_k": "Top K",
   "com_endpoint_top_p": "Top P",
   "com_endpoint_use_active_assistant": "Usa Assistente Attivo",
   "com_endpoint_use_responses_api": "Utilizzare le risposte API",
   "com_endpoint_use_search_grounding": "Messa a terra con la ricerca su Google",
   "com_endpoint_verbosity": "Verbosità",
-  "com_error_endpoint_models_not_loaded": "Modelli per {{0}} non è stato possibile caricarlo. Aggiornare la pagina e riprovare.",
+  "com_error_endpoint_models_not_loaded": "Non è stato possibile caricare modelli per {{0}}. Aggiornare la pagina e riprovare.",
   "com_error_expired_user_key": "La chiave fornita per {{0}} è scaduta il {{1}}. Fornisci una chiave e riprova.",
   "com_error_files_dupe": "File duplicato rilevato.",
   "com_error_files_empty": "I file vuoti non sono consentiti.",
@@ -351,7 +361,7 @@
   "com_error_google_tool_conflict": "L'uso degli strumenti integrati di Google non è supportato da strumenti esterni. Disattivare gli strumenti integrati o quelli esterni.",
   "com_error_heic_conversion": "Impossibile convertire l'immagine HEIC in JPEG. Provare a convertire l'immagine manualmente o utilizzare un altro formato.",
   "com_error_illegal_model_request": "Il modello \"{{0}}\" non è disponibile per {{1}}. Selezionare un modello diverso.",
-  "com_error_input_length": "Il conteggio dei token dell'ultimo messaggio è troppo lungo e supera il limite consentito ({{0}}). Per favore, accorcia il tuo messaggio, modifica la dimensione massima del contesto dai parametri della conversazione, oppure crea una diramazione della conversazione per continuare.",
+  "com_error_input_length": "Il conteggio dei token dell'ultimo messaggio è troppo elevato e supera il limite consentito, oppure i parametri del limite di token sono configurati in modo errato, compromettendo la finestra di contesto. Maggiori informazioni: {{0}}. Accorcia il messaggio, regola la dimensione massima del contesto dai parametri della conversazione o esegui un fork della conversazione per continuare.",
   "com_error_invalid_agent_provider": "Il \"{{0}}Il provider \" non è disponibile per l'uso con gli agenti. Accedere alle impostazioni dell'agente e selezionare un provider attualmente disponibile.",
   "com_error_invalid_user_key": "Chiave fornita non valida. Fornisci una chiave e riprova.",
   "com_error_missing_model": "Nessun modello selezionato per {{0}}. Selezionare un modello e riprovare.",
@@ -374,7 +384,7 @@
   "com_files_preparing_download": "Preparazione del download...",
   "com_files_result_found": "{{count}} risultato trovato",
   "com_files_results_found": "{{count}} risultati trovati",
-  "com_files_sharepoint_picker_title": "File di prelievo",
+  "com_files_sharepoint_picker_title": "Seleziona file",
   "com_files_table": "Tabella dei file",
   "com_files_upload_local_machine": "Dal computer locale",
   "com_files_upload_sharepoint": "Da SharePoint",
@@ -383,7 +393,8 @@
   "com_info_heic_converting": "Conversione dell'immagine HEIC in JPEG...",
   "com_nav_2fa": "Autenticazione a due fattori (2FA)",
   "com_nav_account_settings": "Impostazioni account",
-  "com_nav_always_make_prod": "Rendi sempre produttive le nuove versioni",
+  "com_nav_advanced_prompts": "Editor avanzato di prompt",
+  "com_nav_always_make_prod": "Imposta sempre le nuove versioni del prompt come 'production'",
   "com_nav_archive_created_at": "DateCreated",
   "com_nav_archive_name": "Nome",
   "com_nav_archived_chats": "Chat archiviate",
@@ -392,7 +403,7 @@
   "com_nav_audio_play_error": "Errore durante la riproduzione audio: {{0}}",
   "com_nav_audio_process_error": "Errore durante l'elaborazione dell'audio: {{0}}",
   "com_nav_auto_scroll": "Scorri automaticamente ai nuovi messaggi all'apertura",
-  "com_nav_auto_send_prompts": "Invio automatico dei prompt",
+  "com_nav_auto_send_prompts": "Invio dei prompt alla selezione",
   "com_nav_auto_send_text": "Invio automatico del testo",
   "com_nav_auto_transcribe_audio": "Trascrivi audio automaticamente",
   "com_nav_automatic_playback": "Riproduzione automatica ultimo messaggio",
@@ -533,11 +544,11 @@
   "com_nav_mcp_connect_server": "Collegare {{0}}",
   "com_nav_mcp_reconnect": "Ricollegarsi",
   "com_nav_mcp_status_connected": "Collegato",
-  "com_nav_mcp_status_connecting": "{{0}} - Collegamento",
+  "com_nav_mcp_status_connecting": "{{0}} - Collegamento in corso",
   "com_nav_mcp_status_disconnected": "Disconnesso",
   "com_nav_mcp_status_error": "Errore",
   "com_nav_mcp_status_initializing": "Inizializzazione",
-  "com_nav_mcp_status_needs_auth": "Necessità di autorizzazione",
+  "com_nav_mcp_status_needs_auth": "Necessita autorizzazione",
   "com_nav_mcp_status_unknown": "Sconosciuto",
   "com_nav_mcp_vars_update_error": "Errore nell'aggiornamento delle variabili utente personalizzate di MCP",
   "com_nav_mcp_vars_updated": "Le variabili utente personalizzate di MCP sono state aggiornate con successo.",
@@ -633,6 +644,7 @@
   "com_ui_add_mcp_server": "Aggiungere il server MCP",
   "com_ui_add_model_preset": "Aggiungi un modello o una preimpostazione per una risposta aggiuntiva",
   "com_ui_add_multi_conversation": "Aggiungi conversazioni multiple",
+  "com_ui_add_skills": "Aggiungi skill",
   "com_ui_add_special_variables": "Aggiungere variabili speciali",
   "com_ui_add_web_search_api_keys": "Aggiungere le chiavi API di ricerca web",
   "com_ui_adding_details": "Aggiunta di dettagli",
@@ -652,13 +664,14 @@
   "com_ui_agent_category_hr": "HR",
   "com_ui_agent_category_it": "IT",
   "com_ui_agent_category_rd": "R&S",
-  "com_ui_agent_category_sales": "Saldi",
+  "com_ui_agent_category_sales": "Vendita",
   "com_ui_agent_category_selector_aria": "Selettore di categoria dell'agente",
   "com_ui_agent_chain": "Catena di agenti (Mixture-of-Agents)",
   "com_ui_agent_chain_info": "Consente di creare sequenze di agenti. Ogni agente può accedere agli output degli agenti precedenti nella catena. Si basa sull'architettura \"Mixture-of-Agents\", in cui gli agenti utilizzano le uscite precedenti come informazioni ausiliarie.",
   "com_ui_agent_chain_max": "Avete raggiunto il massimo di {{0}} agenti.",
   "com_ui_agent_delete_error": "Si è verificato un errore durante l'eliminazione dell'agente",
   "com_ui_agent_deleted": "Agente eliminato con successo",
+  "com_ui_agent_description": "Descrizione dell agente",
   "com_ui_agent_duplicate_error": "Si è verificato un errore durante la duplicazione dell'assistente",
   "com_ui_agent_duplicated": "Agente duplicato con successo",
   "com_ui_agent_handoff_add": "Aggiungere l'agente di handoff",
@@ -672,9 +685,16 @@
   "com_ui_agent_handoff_prompt_key_placeholder": "Etichetta del contenuto passato (predefinito: 'istruzioni')",
   "com_ui_agent_handoff_prompt_placeholder": "Indica a questo agente quale contenuto generare e passare all'agente di handoff. È necessario aggiungere qualcosa qui per abilitare questa funzione",
   "com_ui_agent_handoffs": "Passaggio dell'agente",
+  "com_ui_agent_name": "Nome dell'agente",
   "com_ui_agent_name_is_required": "Il nome dell'agente è obbligatorio",
   "com_ui_agent_recursion_limit": "Passi massimi dell'agente",
   "com_ui_agent_recursion_limit_info": "Limita il numero di passaggi che l'agente può effettuare in un'esecuzione prima di fornire una risposta finale. Il valore predefinito è 25 passaggi. Un passaggio è una richiesta API AI o un round di utilizzo dello strumento. Ad esempio, un'interazione di base con uno strumento richiede 3 passaggi: richiesta iniziale, utilizzo dello strumento e richiesta di follow-up",
+  "com_ui_agent_subagents": "Sottoagenti",
+  "com_ui_agent_subagents_add": "A",
+  "com_ui_agent_subagents_agents": "Aggiunti sottoagenti",
+  "com_ui_agent_subagents_enable": "Abilita sottoagenti",
+  "com_ui_agent_subagents_max": "Massimo di {{0}} sottoagenti raggiunto",
+  "com_ui_agent_subagents_remove": "Rimuovi {{0}} dai sottoagenti",
   "com_ui_agent_url_copied": "URL agente copiato negli appunti",
   "com_ui_agent_var": "{{0}} agente",
   "com_ui_agent_version": "Versione",
@@ -727,8 +747,10 @@
   "com_ui_at_least_one_owner_required": "È necessario almeno un proprietario",
   "com_ui_attach_error": "Impossibile allegare il file. Crea o seleziona una conversazione, oppure prova a ricaricare la pagina.",
   "com_ui_attach_error_disabled": "Il caricamento dei file è disabilitato per questo endpoint",
+  "com_ui_attach_error_limit": "Limite di file raggiunto:",
   "com_ui_attach_error_openai": "Non è possibile allegare file dell'Assistente ad altri endpoint",
   "com_ui_attach_error_size": "Limite dimensione file superato per l'endpoint:",
+  "com_ui_attach_error_total_size": "Totale della taglia dei file raggiunto per l'endpoint:",
   "com_ui_attach_error_type": "Tipo di file non supportato per l'endpoint:",
   "com_ui_attach_remove": "Rimuovere il file",
   "com_ui_attach_warn_endpoint": "Attenzione: i file non compatibili con lo strumento potrebbero essere ignorati",
@@ -739,6 +761,7 @@
   "com_ui_authentication": "Autenticazione",
   "com_ui_authentication_type": "Tipo di autenticazione",
   "com_ui_auto": "Auto",
+  "com_ui_available_options": "Opzioni disponibili",
   "com_ui_avatar": "Avatar",
   "com_ui_azure": "Azure",
   "com_ui_azure_ad": "ID Entra",
@@ -793,6 +816,7 @@
   "com_ui_clear_presets": "Cancella le preimpostazioni",
   "com_ui_clear_search": "Pulisci ricerca",
   "com_ui_click_to_close": "Fare clic per chiudere",
+  "com_ui_click_to_edit": "Clicca per modificare",
   "com_ui_click_to_view_var": "Clicca per vedere {{0}}",
   "com_ui_client_id": "Client ID",
   "com_ui_client_secret": "Client Secret",
@@ -804,9 +828,11 @@
   "com_ui_code": "Codice",
   "com_ui_collapse": "Crollo",
   "com_ui_collapse_chat": "Comprimi Chat",
+  "com_ui_collapse_summary": "Comprimi il riassunto",
   "com_ui_collapse_thoughts": "Pensieri al collasso",
   "com_ui_command_placeholder": "Opzionale: Inserisci un comando per il prompt o verrà utilizzato il nome",
   "com_ui_command_usage_placeholder": "Seleziona un prompt tramite comando o nome",
+  "com_ui_complete": "Completato!",
   "com_ui_complete_setup": "Completa Setup",
   "com_ui_concise": "Conciso",
   "com_ui_configure": "Configurare",
@@ -825,6 +851,7 @@
   "com_ui_conversation": "conversazione",
   "com_ui_conversation_label": "{{title}} conversazione",
   "com_ui_conversation_not_found": "Conversazione non trovata",
+  "com_ui_conversation_summarized": "Conversazione riassunta",
   "com_ui_conversations": "conversazioni",
   "com_ui_convo_archived": "Conversazione archiviata",
   "com_ui_convo_delete_error": "Eliminazione fallita della conversazione",
@@ -847,6 +874,8 @@
   "com_ui_create_new_agent": "Creare un nuovo agente",
   "com_ui_create_prompt": "Crea prompt",
   "com_ui_create_prompt_page": "Pagina di configurazione del nuovo prompt",
+  "com_ui_create_skill": "Crea Skill",
+  "com_ui_create_skill_upload": "Carica SKILL.md",
   "com_ui_created": "Creato",
   "com_ui_creating": "Creare...",
   "com_ui_creating_image": "Creazione dell'immagine. Può richiedere un momento",
@@ -903,11 +932,13 @@
   "com_ui_deleted": "Soppresso",
   "com_ui_deleting": "Eliminazione...",
   "com_ui_deleting_file": "Eliminazione del file...",
+  "com_ui_deploy": "Rilascia",
   "com_ui_descending": "Decrescente",
   "com_ui_description": "Descrizione",
   "com_ui_description_placeholder": "Opzionale: Inserisci una descrizione da mostrare per il prompt",
   "com_ui_deselect_all": "Deselezionare tutto",
   "com_ui_detailed": "Dettagliato",
+  "com_ui_details": "Dettagli",
   "com_ui_disabling": "Disattivazione...",
   "com_ui_done": "Fatto",
   "com_ui_download": "Scarica",
@@ -930,6 +961,7 @@
   "com_ui_edit_memory": "Modifica della memoria",
   "com_ui_edit_preset_title": "Modifica della preimpostazione - {{title}}",
   "com_ui_edit_prompt_page": "Modifica della pagina di prompt",
+  "com_ui_edit_skill": "Modifica skill",
   "com_ui_editable_message": "Messaggio modificabile",
   "com_ui_editor_instructions": "Trascinare l'immagine per riposizionarla - Usare il cursore dello zoom o i pulsanti per regolare le dimensioni",
   "com_ui_empty_category": "-",
@@ -955,6 +987,8 @@
   "com_ui_expand_chat": "Espandi Chat",
   "com_ui_expand_thoughts": "Espandere i pensieri",
   "com_ui_export_convo_modal": "Esporta Conversazione",
+  "com_ui_favorite": "Aggiung",
+  "com_ui_favorites": "Preferiti",
   "com_ui_feedback_more": "Altro...",
   "com_ui_feedback_more_information": "Fornire un ulteriore feedback",
   "com_ui_feedback_negative": "Necessità di miglioramento",
@@ -975,7 +1009,9 @@
   "com_ui_feedback_tag_unjustified_refusal": "Rifiutato senza motivo",
   "com_ui_field_max_length": "{{field}} deve essere inferiore a {{length}} caratteri",
   "com_ui_field_required": "Questo campo è obbligatorio",
+  "com_ui_file": "File",
   "com_ui_file_input_avatar_label": "Inserimento del file per l'avatar",
+  "com_ui_file_modified": "Modif",
   "com_ui_file_size": "Dimensione del file",
   "com_ui_file_token_limit": "Limite del token del file",
   "com_ui_file_token_limit_desc": "Impostare il limite massimo di token per l'elaborazione dei file per controllare i costi e l'utilizzo delle risorse.",
@@ -983,6 +1019,7 @@
   "com_ui_filter_mcp_servers": "Filtrare i server MCP per nome",
   "com_ui_filter_prompts": "Filtra Prompt",
   "com_ui_filter_prompts_name": "Filtra prompt per nome",
+  "com_ui_filter_skills_name": "Modificato",
   "com_ui_final_touch": "Tocco finale",
   "com_ui_finance": "Finanza",
   "com_ui_fork": "Duplica",
@@ -1037,6 +1074,7 @@
   "com_ui_image_details": "Dettagli immagine",
   "com_ui_image_edited": "Immagine modificata",
   "com_ui_image_gen": "Generazione immagine",
+  "com_ui_image_gen_failed": "Generazione dell'immagine fallita",
   "com_ui_import": "Importa",
   "com_ui_import_conversation_error": "Si è verificato un errore durante l'importazione delle conversazioni",
   "com_ui_import_conversation_file_type_error": "Tipo di importazione non supportato",
@@ -1048,6 +1086,11 @@
   "com_ui_initializing": "Inizializzazione...",
   "com_ui_input": "Input",
   "com_ui_instructions": "Istruzioni",
+  "com_ui_invocation_auto": "A",
+  "com_ui_invocation_both": "Entrambi",
+  "com_ui_invocation_manual": "Manuale",
+  "com_ui_invocation_mode": "M",
+  "com_ui_invoked_by": "Chiamato da",
   "com_ui_key": "Chiave",
   "com_ui_key_required": "È richiesta la chiave API",
   "com_ui_last_used": "Ultimo utilizzo",
@@ -1056,8 +1099,11 @@
   "com_ui_latest_version": "Ultima versione",
   "com_ui_leave_blank_to_keep": "Lasciare in bianco per mantenere l'esistente",
   "com_ui_light_theme_enabled": "Tema luminoso abilitato",
+  "com_ui_line_count": "linea {0}",
+  "com_ui_lines_count": "{0} linee",
   "com_ui_link_copied": "Link copiato",
   "com_ui_link_refreshed": "Link aggiornato",
+  "com_ui_live": "live",
   "com_ui_loading": "Caricamento...",
   "com_ui_locked": "Bloccato",
   "com_ui_logo": "{{0}} Logo",
@@ -1143,6 +1189,7 @@
   "com_ui_mermaid_failed": "Impossibile eseguire il rendering del diagramma:",
   "com_ui_mermaid_source": "Codice sorgente:",
   "com_ui_message_input": "Inserimento del messaggio",
+  "com_ui_message_nav": "Na",
   "com_ui_microphone_unavailable": "Il microfono non è disponibile",
   "com_ui_min_tags": "Impossibile rimuovere altri valori, è richiesto un minimo di {{0}}.",
   "com_ui_minimal": "Minimo",
@@ -1195,6 +1242,7 @@
   "com_ui_of": "di",
   "com_ui_off": "Disattivo",
   "com_ui_offline": "Non in linea",
+  "com_ui_omitted": "Omesso",
   "com_ui_on": "Attivo",
   "com_ui_open_archived_chat_new_tab_title": "{{title}} (si apre in una nuova scheda)",
   "com_ui_open_source_chat_new_tab": "Chat Open Source in una nuova scheda",
@@ -1202,7 +1250,11 @@
   "com_ui_open_var": "Aperto {{0}}",
   "com_ui_openai": "OpenAI",
   "com_ui_optional": "(opzionale)",
+  "com_ui_options": "opzioni",
+  "com_ui_output": "Output",
   "com_ui_page": "Pagina",
+  "com_ui_pagination": "paginazione",
+  "com_ui_parameters": "Paramet",
   "com_ui_people": "persone",
   "com_ui_people_picker": "Picker per le persone",
   "com_ui_people_picker_allow_view_groups": "Consentire la visualizzazione di gruppi",
@@ -1214,9 +1266,12 @@
   "com_ui_pin": "Spillo",
   "com_ui_preferences_updated": "Le preferenze sono state aggiornate con successo",
   "com_ui_prev": "Prec",
+  "com_ui_prev_result": "Risultato precedente",
   "com_ui_preview": "Anteprima",
+  "com_ui_preview_failed": "Anteprima non disponibile",
   "com_ui_privacy_policy": "Informativa sulla privacy",
   "com_ui_privacy_policy_url": "URL Informativa Privacy",
+  "com_ui_production": "Produzione",
   "com_ui_prompt": "Prompt",
   "com_ui_prompt_group_button": "{{name}} richiesta, {{category}} categoria",
   "com_ui_prompt_group_button_no_category": "{{name}} tempestivamente",
@@ -1236,7 +1291,10 @@
   "com_ui_prompts_allow_use": "Consenti uso dei prompt",
   "com_ui_provider": "Fornitore",
   "com_ui_quality": "Qualità",
+  "com_ui_ran_n_agents": "Lanciato {{0}} agenti",
   "com_ui_read_aloud": "Leggi ad alta voce",
+  "com_ui_read_file": "Le",
+  "com_ui_reading_file": "Leggendo  {{0}}",
   "com_ui_redirect_uri": "Reindirizzamento URI",
   "com_ui_redirect_uri_instructions": "Copia questo URI di reindirizzamento e configuralo nelle impostazioni del tuo provider OAuth.",
   "com_ui_redirecting_to_provider": "Reindirizzamento a {{0}}, attendere prego...",
@@ -1263,6 +1321,7 @@
   "com_ui_remote_agents_allow_share_public": "Consentire agli utenti di concedere l'accesso API agli agenti a tutti gli utenti",
   "com_ui_remote_agents_allow_use": "Consentire agli utenti di creare chiavi API e interrogare gli agenti da remoto.",
   "com_ui_remove_agent_from_chain": "Rimuovere {{0}} dalla catena",
+  "com_ui_remove_skill_var": "Elimina {{0}}",
   "com_ui_remove_user": "Rimuovere {{0}}",
   "com_ui_rename": "Rinomina",
   "com_ui_rename_conversation": "Rinominare la conversazione",
@@ -1301,6 +1360,9 @@
   "com_ui_rotate_90": "Ruota di 90 gradi",
   "com_ui_run_code": "Esegui Codice",
   "com_ui_run_code_error": "Si è verificato un errore durante l'esecuzione del codice",
+  "com_ui_running": "Eseguendo...",
+  "com_ui_running_command": "Lanciando il comando",
+  "com_ui_running_n_agents": "Lanciando {{0}} agenti",
   "com_ui_save": "Salva",
   "com_ui_save_badge_changes": "Salvare le modifiche ai badge?",
   "com_ui_save_changes": "Salva le modifiche",
@@ -1311,6 +1373,7 @@
   "com_ui_saving": "Risparmio...",
   "com_ui_schema": "Schema",
   "com_ui_scope": "Ambito",
+  "com_ui_scroll_to_bottom": "Scorri in fondo",
   "com_ui_search": "Cerca",
   "com_ui_search_above_to_add": "Cercare sopra per aggiungere utenti o gruppi",
   "com_ui_search_above_to_add_all": "Ricerca in alto per aggiungere utenti, gruppi o ruoli",
@@ -1318,6 +1381,9 @@
   "com_ui_search_agent_category": "Ricerca per categorie...",
   "com_ui_search_default_placeholder": "Ricerca per nome o e-mail (minimo 2 caratteri)",
   "com_ui_search_people_placeholder": "Ricerca di persone o gruppi per nome o e-mail",
+  "com_ui_search_result_count": "{",
+  "com_ui_search_results_count": "{{count}} risultati trovati",
+  "com_ui_search_skills": "Cerca skill",
   "com_ui_seconds": "secondi",
   "com_ui_secret_key": "Chiave segreta",
   "com_ui_select": "Seleziona",
@@ -1358,12 +1424,41 @@
   "com_ui_simple": "Semplice",
   "com_ui_size": "Dimensione",
   "com_ui_size_sort": "Ordina per dimensione",
+  "com_ui_skill": "Skill",
+  "com_ui_skill_content": "Conte",
+  "com_ui_skill_create_error": "Impossibile creare skill",
+  "com_ui_skill_create_title": "Crea skill",
+  "com_ui_skill_created": "Skill creata",
+  "com_ui_skill_delete_error": "Impossibile eliminare skill",
+  "com_ui_skill_deleted": "Skill eliminata",
+  "com_ui_skill_description_required": "Descrizione obbligatoria",
+  "com_ui_skill_edit_title": "Modifica skill",
+  "com_ui_skill_instructions": "Istruzioni",
+  "com_ui_skill_name_required": "Nome è obbligatorio",
+  "com_ui_skill_new_file": "Nuovo File",
+  "com_ui_skill_new_folder": "Nu",
+  "com_ui_skill_no_edit_permission": "Non hai i permessi per modificare questa skill",
+  "com_ui_skill_no_selection": "Seleziona una skill",
+  "com_ui_skill_no_selection_desc": "Scegli una skill dalla barra laterale per vederne i dettagli.",
+  "com_ui_skill_not_found": "Skill non trovata",
+  "com_ui_skill_sr_public": "Skill pubblica",
+  "com_ui_skill_update_error": "Impossibil salvare skill",
+  "com_ui_skill_updated": "Skill salvata",
+  "com_ui_skill_upload": "Carica una skill",
+  "com_ui_skill_upload_file": "Carica File",
+  "com_ui_skill_upload_req_zip": "I file .zip o .skill devono includere un file SKILL.md",
+  "com_ui_skill_view_source": "Vedi fonte",
+  "com_ui_skills": "Skills",
+  "com_ui_skills_enable_toggle": "Abilita skills per questo agente",
+  "com_ui_skills_load_error": "Impossibile caricare skill",
+  "com_ui_skills_manual_invoked": "Skill invocate manualmente",
+  "com_ui_special": "speciale",
   "com_ui_special_var_current_date": "Data attuale",
   "com_ui_special_var_current_datetime": "Data e ora corrente",
   "com_ui_special_var_current_user": "Utente corrente",
   "com_ui_special_var_iso_datetime": "Ora solare UTC ISO",
   "com_ui_special_variable_added": "{{0}} aggiunta di una variabile speciale.",
-  "com_ui_special_variables": "Variabili speciali:",
+  "com_ui_special_variables": "Variabili speciali",
   "com_ui_speech_not_supported": "Il tuo browser non supporta il riconoscimento vocale",
   "com_ui_speech_not_supported_use_external": "Il browser non supporta il riconoscimento vocale. Provare a passare a STT esterno in Impostazioni > Parlato.",
   "com_ui_speech_while_submitting": "Impossibile inviare il messaggio mentre è in corso la generazione di una risposta",
@@ -1373,7 +1468,21 @@
   "com_ui_stop": "Ferma",
   "com_ui_storage": "Archiviazione",
   "com_ui_storage_filter_sort": "Filtrare e ordinare per stoccaggio",
+  "com_ui_subagent_cancelled": "Agente cancellato",
+  "com_ui_subagent_complete": "Eseguito l'agente",
+  "com_ui_subagent_dialog_title": "agente \"{{0}}\"",
+  "com_ui_subagent_dialog_title_self": "Agente",
+  "com_ui_subagent_empty_result": "Nessun testo restituito",
+  "com_ui_subagent_scroll_to_bottom": "Scorri al più recente",
+  "com_ui_subagent_ticker_error": "Errore",
+  "com_ui_subagent_ticker_reasoning": "Ragionamento",
+  "com_ui_subagent_ticker_tool_done": "fi",
+  "com_ui_subagent_ticker_using": "finito",
+  "com_ui_subagent_ticker_writing": "Scrivendo...",
+  "com_ui_subagent_waiting": "In attesa del primo aggiornamento",
   "com_ui_submit": "Invia",
+  "com_ui_summarized": "Riassunto",
+  "com_ui_summarizing": "Riassumendo...",
   "com_ui_support_contact": "Contatto di supporto",
   "com_ui_support_contact_email": "Email",
   "com_ui_support_contact_email_invalid": "Inserire un indirizzo e-mail valido",
@@ -1385,6 +1494,7 @@
   "com_ui_temporary": "Chat temporanea",
   "com_ui_terms_and_conditions": "Termini d'uso",
   "com_ui_terms_of_service": "Termini di servizio",
+  "com_ui_text_variables": "Variabili testuali",
   "com_ui_thinking": "Pensando...",
   "com_ui_thoughts": "Pensieri",
   "com_ui_toggle_theme": "Toggle theme",
@@ -1393,8 +1503,13 @@
   "com_ui_token_url": "URL del token",
   "com_ui_tokens": "gettoni",
   "com_ui_tool_collection_prefix": "Una raccolta di strumenti da",
+  "com_ui_tool_failed": "fallito",
   "com_ui_tool_list_collapse": "Crollo {{serverName}} elenco degli strumenti",
   "com_ui_tool_list_expand": "Espandi {{serverName}} elenco degli strumenti",
+  "com_ui_tool_name_code": "Codice",
+  "com_ui_tool_name_code_analysis": "Analisi del Codice",
+  "com_ui_tool_name_image_gen": "Generazione immagine",
+  "com_ui_tool_name_web_search": "Ricerca Web",
   "com_ui_tools": "Strumenti",
   "com_ui_tools_and_actions": "Strumenti e azioni",
   "com_ui_transferred_to": "Trasferito a",
@@ -1408,6 +1523,7 @@
   "com_ui_unarchive_error": "Impossibile disarchiviare la conversazione",
   "com_ui_unavailable": "Non disponibile",
   "com_ui_unknown": "Sconosciuto",
+  "com_ui_unknown_file_type": "Tipo di file sconosciuto",
   "com_ui_unpin": "Spillare",
   "com_ui_unset": "Non impostato",
   "com_ui_untitled": "Senza titolo",
@@ -1437,6 +1553,7 @@
   "com_ui_use_backup_code": "Usa invece il codice di backup",
   "com_ui_use_memory": "Usa la memoria",
   "com_ui_use_micrphone": "Usa microfono",
+  "com_ui_use_prompt": "Usa Prompt",
   "com_ui_used": "Usato",
   "com_ui_user": "Utente",
   "com_ui_user_group_permissions": "Autorizzazioni per utenti e gruppi",
@@ -1457,6 +1574,8 @@
   "com_ui_web_search_provider_searxng": "SearXNG",
   "com_ui_web_search_provider_serper": "API Serper",
   "com_ui_web_search_provider_serper_key": "Ottenere la chiave API di Serper",
+  "com_ui_web_search_provider_tavily": "Tavily API",
+  "com_ui_web_search_provider_tavily_key": "Ottieni la tua API key Tavily",
   "com_ui_web_search_reading": "Risultati della lettura",
   "com_ui_web_search_reranker": "Reranker",
   "com_ui_web_search_reranker_cohere": "Cohere",
@@ -1469,19 +1588,26 @@
   "com_ui_web_search_scraper_firecrawl_key": "Ottieni la tua chiave API Firecrawl",
   "com_ui_web_search_scraper_serper": "API di raschiamento Serper",
   "com_ui_web_search_scraper_serper_key": "Ottenere la chiave API di Serper",
+  "com_ui_web_search_scraper_tavily": "Tavily Extract API",
+  "com_ui_web_search_scraper_tavily_key": "Ottieni la tua API key Tavily",
   "com_ui_web_search_searxng_api_key": "Inserire la chiave API di SearXNG (facoltativa)",
   "com_ui_web_search_searxng_instance_url": "URL dell'istanza SearXNG",
+  "com_ui_web_search_source": "{{count}} fonte",
+  "com_ui_web_search_sources": "{{count}} fonti",
+  "com_ui_web_searched": "Cercato sul web",
   "com_ui_web_searching": "Ricerca sul web",
   "com_ui_web_searching_again": "Cercare di nuovo sul web",
   "com_ui_weekend_morning": "Buon fine settimana",
   "com_ui_write": "Scrittura",
+  "com_ui_writing_command": "Scrivendo il comando",
   "com_ui_x_selected": "{{0}} selezionato",
   "com_ui_xhigh": "Extra alto",
   "com_ui_yes": "Sì",
+  "com_ui_you": "Tu",
   "com_ui_your_api_key": "La vostra chiave API",
   "com_ui_zoom": "Zoom",
   "com_ui_zoom_in": "Ingrandisci",
   "com_ui_zoom_level": "Livello di zoom",
   "com_ui_zoom_out": "Zoom out",
-  "com_user_message": "Mostra nome utente nei messaggi"
+  "com_user_message": "Tu"
 }
diff --git a/client/src/locales/ja/translation.json b/client/src/locales/ja/translation.json
index d6aec3ccf58..7f2a6aa0483 100644
--- a/client/src/locales/ja/translation.json
+++ b/client/src/locales/ja/translation.json
@@ -2,9 +2,13 @@
   "chat_direction_left_to_right": "左から右へ",
   "chat_direction_right_to_left": "右から左へ",
   "com_a11y_ai_composing": "AIはまだ作成中です。",
+  "com_a11y_chats_date_section": "{{date}} からのチャット",
   "com_a11y_end": "AIは返信を完了しました。",
   "com_a11y_selected": "選択済み",
   "com_a11y_start": "AIが返信を開始しました。",
+  "com_a11y_summarize_completed": "コンテキストを要約しました。",
+  "com_a11y_summarize_failed": "要約に失敗しました。利用可能なコンテキストで続行します。",
+  "com_a11y_summarize_started": "コンテキストの要約。",
   "com_agents_agent_card_label": "{{name}} エージェント。 {{description}}",
   "com_agents_all": "すべてのエージェント",
   "com_agents_all_category": "全て",
@@ -12,7 +16,7 @@
   "com_agents_avatar_upload_error": "エージェントのアバターをアップロードできませんでした",
   "com_agents_category_aftersales": "アフターセールス",
   "com_agents_category_aftersales_description": "販売後のサポート、メンテナンス、顧客サービスに特化したエージェント",
-  "com_agents_category_empty": "エージェントは見つかりませんでした {{category}} カテゴリ",
+  "com_agents_category_empty": "{{category}} カテゴリ内からエージェントが見つかりませんでした ",
   "com_agents_category_finance": "財務",
   "com_agents_category_finance_description": "財務分析、予算編成、会計を専門とするエージェント",
   "com_agents_category_general": "一般",
@@ -25,7 +29,7 @@
   "com_agents_category_rd_description": "研究開発プロセス、イノベーション、技術研究に焦点を当てたエージェント",
   "com_agents_category_sales": "販売",
   "com_agents_category_sales_description": "販売プロセス、顧客関係に重点を置くエージェント",
-  "com_agents_category_tab_label": "{{category}} カテゴリ、 {{total}} の{{position}} ",
+  "com_agents_category_tab_label": "{{category}} カテゴリ。 {{total}} 分の {{position}} ",
   "com_agents_category_tabs_label": "エージェントのカテゴリー",
   "com_agents_chat_with": "{{name}}とチャットする ",
   "com_agents_clear_search": "検索をクリア",
@@ -47,7 +51,7 @@
   "com_agents_error_network_suggestion": "インターネット接続を確認して、もう一度お試しください。",
   "com_agents_error_network_title": "接続の問題",
   "com_agents_error_not_found_message": "要求されたコンテンツが見つかりません。",
-  "com_agents_error_not_found_suggestion": "他のオプションを見てみるか、マーケットプレイスに戻る。",
+  "com_agents_error_not_found_suggestion": "他のオプションを参照してみるか、マーケットプレイスに戻ってください。",
   "com_agents_error_not_found_title": "見つかりません",
   "com_agents_error_retry": "もう一度やり直してください",
   "com_agents_error_search_title": "検索エラー",
@@ -99,7 +103,7 @@
   "com_agents_update_error": "エージェントの更新中にエラーが発生しました。",
   "com_assistants_actions": "アクション",
   "com_assistants_actions_disabled": "アクションを追加する前にアシスタントを作成する必要があります。",
-  "com_assistants_actions_info": "アシスタントが API を介して情報を取得したり、アクションを実行したりできるようにします's",
+  "com_assistants_actions_info": "アシスタントが API を介して情報を取得したり、アクションを実行したりできるようにします",
   "com_assistants_add_actions": "アクションを追加",
   "com_assistants_add_mcp_server_tools": "MCPサーバーツールの追加",
   "com_assistants_add_tools": "ツールを追加",
@@ -221,7 +225,7 @@
   "com_endpoint_anthropic_maxoutputtokens": "レスポンスで生成できるトークンの最大数。短い応答には低い値を、長い応答には高い値を指定します。注：モデルはこの最大値に達する前に停止することがあります。",
   "com_endpoint_anthropic_prompt_cache": "プロンプトキャッシュを使用すると、API呼び出し間で大きなコンテキストや指示を再利用でき、コストとレイテンシを削減できます",
   "com_endpoint_anthropic_temp": "0から1の値。分析的・多岐の選択になる課題には0に近い値を入力する。創造的・生成的な課題には1に近い値を入力する。この値か Top P の変更をおすすめしますが、両方の変更はおすすめしません。",
-  "com_endpoint_anthropic_thinking": "サポートされているClaudeモデル（3.7 Sonnet）の内部推論を有効にします。注：「思考予算」が「最大出力トークン」よりも低く設定されている必要があります。",
+  "com_endpoint_anthropic_thinking": "サポートされているClaudeモデルの内部推論を有効にします。新しいモデル（Opus 4.6+）では、Effortパラメーターで制御される「Adaptive Thinking」を使用します。レガシーモデルでは、「Thinking Budget」を設定し、「最大出力トークン」より低くする必要があります。",
   "com_endpoint_anthropic_thinking_budget": "Claude が内部推論プロセスで使用できるトークンの最大数を指定します。予算を大きくすると、複雑な問題に対するより徹底的な分析が可能になり、応答品質が向上します。ただし、特に 32K を超える範囲では、Claude は割り当てられた予算をすべて使用できない可能性があります。この設定は「最大出力トークン」よりも小さくする必要があります。",
   "com_endpoint_anthropic_topk": "Top-k はモデルがトークンをどのように選択して出力するかを変更します。top-kが1の場合はモデルの語彙に含まれるすべてのトークンの中で最も確率が高い1つが選択されます(greedy decodingと呼ばれている)。top-kが3の場合は上位3つのトークンの中から選択されます。(temperatureを使用)",
   "com_endpoint_anthropic_topp": "Top-p はモデルがトークンをどのように選択して出力するかを変更します。K(topKを参照)の確率の合計がtop-pの確率と等しくなるまでのトークンが選択されます。",
@@ -368,6 +372,7 @@
   "com_error_no_base_url": "ベースURLが見つかりません。ベースURLを入力して再試行してください。",
   "com_error_no_user_key": "キーが見つかりません。キーを入力して再試行してください。",
   "com_error_refusal": "安全フィルターにより応答が拒否されました。メッセージを書き直し、再度お試しください。Claude Sonnet 4.5またはOpus 4.1使用中にこの現象が頻繁に発生する場合は、使用制限が異なるSonnet 4をお試しください。",
+  "com_error_stream_expired": "Claudeの推論が返されるかどうかを制御します。「自動」は、デフォルトでそれらを非表示にするモデルの要約された考えにオプトインします（ Opus 4.7以降）。「要約」は常にそれらを表示します。「省略」は、レイテンシをわずかに低くするために常にそれらを非表示にします。",
   "com_file_pages": "ページ： {{pages}}",
   "com_file_source": "ファイル",
   "com_file_unknown": "不明ファイル",
@@ -382,7 +387,7 @@
   "com_files_preparing_download": "ダウンロードの準備...",
   "com_files_results_found": "{{count}} 件の結果が見つかりました",
   "com_files_sharepoint_picker_title": "ファイルを選択",
-  "com_files_table": "ここに何かを入れる必要があります。空でした",
+  "com_files_table": "ファイルテーブル",
   "com_files_upload_local_machine": "ローカルコンピュータから",
   "com_files_upload_sharepoint": "SharePointから",
   "com_generated_files": "生成されたファイル:",
@@ -549,6 +554,7 @@
   "com_nav_mcp_vars_updated": "MCP カスタムユーザー変数が正常に更新されました。",
   "com_nav_modular_chat": "会話の途中でのエンドポイント切替を有効化",
   "com_nav_my_files": "自分のファイル",
+  "com_nav_new_chat_switch_to_history": "新規チャットでチャット履歴に切り替える",
   "com_nav_not_supported": "サポートされていません",
   "com_nav_open_sidebar": "サイドバーを開く",
   "com_nav_playback_rate": "オーディオ再生速度",
@@ -636,10 +642,12 @@
   "com_ui_add_first_bookmark": "チャットを追加するにはクリックしてください",
   "com_ui_add_first_mcp_server": "最初のMCPサーバーを作成して始めましょう",
   "com_ui_add_first_prompt": "始めるにはプロンプトを作成してください",
+  "com_ui_add_labels": "ラベルの追加",
   "com_ui_add_mcp": "MCPの追加",
   "com_ui_add_mcp_server": "MCPサーバーの追加",
   "com_ui_add_model_preset": "追加の応答のためのモデルまたはプリセットを追加する",
   "com_ui_add_multi_conversation": "複数のチャットを追加",
+  "com_ui_add_skills": "スキルを追加",
   "com_ui_add_special_variables": "特別な変数を追加",
   "com_ui_add_web_search_api_keys": "Web検索APIキーを追加する",
   "com_ui_adding_details": "詳細を追加する",
@@ -666,6 +674,7 @@
   "com_ui_agent_chain_max": "{{0}} エージェントの上限に達しました。",
   "com_ui_agent_delete_error": "エージェントの削除中にエラーが発生しました",
   "com_ui_agent_deleted": "エージェントを正常に削除しました",
+  "com_ui_agent_description": "エージェントの説明",
   "com_ui_agent_duplicate_error": "アシスタントの複製中にエラーが発生しました",
   "com_ui_agent_duplicated": "アシスタントを複製しました",
   "com_ui_agent_handoff_add": "ハンドオフ・エージェントの追加",
@@ -679,9 +688,21 @@
   "com_ui_agent_handoff_prompt_key_placeholder": "渡されたコンテンツにラベルを付ける (デフォルト: 'instructions')",
   "com_ui_agent_handoff_prompt_placeholder": "このエージェントに、どのコンテンツを生成してハンドオフエージェントに渡すかを伝えます。この機能を有効にするには、ここに何かを追加する必要があります。",
   "com_ui_agent_handoffs": "エージェント・ハンドオフ",
+  "com_ui_agent_name": "エージェント名",
   "com_ui_agent_name_is_required": "エージェント名は必須",
   "com_ui_agent_recursion_limit": "最大エージェントステップ数",
   "com_ui_agent_recursion_limit_info": "エージェントが最終応答を返す前に実行できるステップ数を制限します。デフォルトは25ステップです。ステップとは、AI APIリクエストまたはツール使用ラウンドのいずれかです。例えば、基本的なツールインタラクションは、最初のリクエスト、ツール使用、そしてフォローアップリクエストの3ステップで構成されます。",
+  "com_ui_agent_subagents": "サブエージェント",
+  "com_ui_agent_subagents_add": "サブエージェントの追加",
+  "com_ui_agent_subagents_agents": "追加のサブエージェント",
+  "com_ui_agent_subagents_allow_self": "セルフスポーンを許可する",
+  "com_ui_agent_subagents_allow_self_info": "このエージェントが、隔離されたコンテキストウィンドウ内で、自分自身のコピーに集中したサブタスクを委任できるようにする。",
+  "com_ui_agent_subagents_empty": "サブエージェントがいません：セルフスポーンを有効にするか、少なくとも1人のエージェントを追加してください。",
+  "com_ui_agent_subagents_enable": "サブエージェントを有効にする",
+  "com_ui_agent_subagents_info": "サブエージェントは隔離されたコンテキストウィンドウ内で実行される。\n詳細なツール出力は子エージェントの内部にとどまり、このエージェントには要約だけが返ってくる。",
+  "com_ui_agent_subagents_info_2": "エージェントを一つも指定せずにこの機能を有効化しても、self‑spawn は依然として可能である。\nつまり、このエージェントは自分自身の新しいコピーを生成し、集中したサブタスクをそのコピーに委任できる。",
+  "com_ui_agent_subagents_max": "最大 {{0}} サブエージェントに到達しました。",
+  "com_ui_agent_subagents_remove": "サブエージェントより {{0}} を削除",
   "com_ui_agent_url_copied": "エージェントのURLをクリップボードにコピー",
   "com_ui_agent_var": "{{0}}エージェント",
   "com_ui_agent_version": "バージョン",
@@ -713,6 +734,7 @@
   "com_ui_api_key_delete_error": "APIキーの削除に失敗しました",
   "com_ui_api_key_deleted": "APIキーの削除に成功しました",
   "com_ui_api_key_name": "キー名",
+  "com_ui_api_key_name_placeholder": "私のAPIキー",
   "com_ui_api_key_name_required": "APIキー名は必須",
   "com_ui_api_key_warning": "APIキーをコピーしてください。二度と見ることができなくなります！",
   "com_ui_api_keys_load_error": "APIキーのロードに失敗しました",
@@ -720,6 +742,7 @@
   "com_ui_archive_delete_error": "アーカイブされた会話の削除に失敗しました",
   "com_ui_archive_error": "アーカイブに失敗しました。",
   "com_ui_artifact_click": "クリックして開く",
+  "com_ui_artifact_preview_pending": "プレビューはまだ利用できません - ファイルを表示するには**ダウンロード**をクリックしてください。",
   "com_ui_artifacts": "アーティファクト",
   "com_ui_artifacts_options": "アーティファクト・オプション",
   "com_ui_artifacts_toggle": "アーティファクト UI の切替",
@@ -747,6 +770,7 @@
   "com_ui_authentication": "認証",
   "com_ui_authentication_type": "認証タイプ",
   "com_ui_auto": "自動",
+  "com_ui_available_options": "利用可能なオプション",
   "com_ui_avatar": "アバター",
   "com_ui_azure": "Azure",
   "com_ui_azure_ad": "Entra ID",
@@ -801,6 +825,7 @@
   "com_ui_clear_presets": "プリセットをクリア",
   "com_ui_clear_search": "検索をクリア",
   "com_ui_click_to_close": "クリックして閉じる",
+  "com_ui_click_to_edit": "クリックして編集する",
   "com_ui_click_to_view_var": "クリックして表示 {{0}}",
   "com_ui_client_id": "クライアントID",
   "com_ui_client_secret": "クライアントシークレット",
@@ -812,9 +837,12 @@
   "com_ui_code": "コード",
   "com_ui_collapse": "折りたたむ",
   "com_ui_collapse_chat": "チャットを折りたたむ",
+  "com_ui_collapse_summary": "概要を折りたたむ",
   "com_ui_collapse_thoughts": "思考を折りたたむ",
+  "com_ui_command_finished": "実行を終了しました",
   "com_ui_command_placeholder": "オプション:プロンプトのコマンドまたは名前を入力",
   "com_ui_command_usage_placeholder": "コマンドまたは名前でプロンプトを選択してください",
+  "com_ui_complete": "完了！",
   "com_ui_complete_setup": "セットアップ完了",
   "com_ui_concise": "簡潔",
   "com_ui_configure": "設定",
@@ -824,6 +852,7 @@
   "com_ui_confirm_admin_use_change": "この設定を変更すると、あなた自身を含む管理者のアクセスがブロックされます。本当によろしいですか？",
   "com_ui_confirm_change": "変更の確認",
   "com_ui_connecting": "接続中",
+  "com_ui_contact_admin_if_issue_persists": "問題が解決しない場合は、管理者に連絡してください。",
   "com_ui_context": "コンテキスト",
   "com_ui_context_filter_sort": "コンテキストによるフィルターと並べ替え",
   "com_ui_continue": "続ける",
@@ -842,6 +871,7 @@
   "com_ui_copy_code": "コードをコピーする",
   "com_ui_copy_link": "リンクをコピー",
   "com_ui_copy_stack_trace": "スタックトレースをコピーする",
+  "com_ui_copy_summary": "要約をクリップボードにコピー",
   "com_ui_copy_thoughts_to_clipboard": "考えをクリップボードにコピーする",
   "com_ui_copy_to_clipboard": "クリップボードへコピー",
   "com_ui_copy_url_to_clipboard": "URLをクリップボードにコピー",
@@ -854,6 +884,9 @@
   "com_ui_create_new_agent": "新しいエージェントを作成",
   "com_ui_create_prompt": "プロンプトを作成する",
   "com_ui_create_prompt_page": "新しいプロンプト設定ページ",
+  "com_ui_create_skill": "スキルを作成",
+  "com_ui_create_skill_upload": "SKILL.md をアップロード",
+  "com_ui_create_skill_upload_error": "アップロードされたファイルが読めませんでした。",
   "com_ui_created": "作成済",
   "com_ui_creating": "作成...",
   "com_ui_creating_image": "画像を作成しています。しばらく時間がかかる場合があります",
@@ -896,6 +929,7 @@
   "com_ui_delete_conversation": "チャットを削除しますか？",
   "com_ui_delete_conversation_tooltip": "会話の削除",
   "com_ui_delete_mcp_server": "MCPサーバーを削除しますか？",
+  "com_ui_delete_mcp_server_name": "MCPサーバーを削除する {{0}}",
   "com_ui_delete_memory": "メモリの削除",
   "com_ui_delete_not_allowed": "削除操作は許可されていません",
   "com_ui_delete_preset": "プリセットを削除しますか?",
@@ -909,11 +943,13 @@
   "com_ui_deleted": "削除済み",
   "com_ui_deleting": "削除しています...",
   "com_ui_deleting_file": "ファイルの削除...",
+  "com_ui_deploy": "展開する",
   "com_ui_descending": "降順",
   "com_ui_description": "説明",
   "com_ui_description_placeholder": "オプション:プロンプトを表示するときの説明を入力",
   "com_ui_deselect_all": "すべて選択解除",
   "com_ui_detailed": "詳細",
+  "com_ui_details": "詳細",
   "com_ui_disabling": "無効化...",
   "com_ui_done": "完了",
   "com_ui_download": "ダウンロード",
@@ -936,6 +972,7 @@
   "com_ui_edit_memory": "メモリ編集",
   "com_ui_edit_preset_title": "プリセットの編集 - {{title}}",
   "com_ui_edit_prompt_page": "プロンプトページを編集",
+  "com_ui_edit_skill": "スキルを編集",
   "com_ui_editable_message": "編集可能なメッセージ",
   "com_ui_editor_instructions": "画像をドラッグして位置を変更 - ズームスライダーまたはボタンでサイズを調整",
   "com_ui_empty_category": "-",
@@ -961,6 +998,9 @@
   "com_ui_expand_chat": "チャットを展開",
   "com_ui_expand_thoughts": "思考を展開",
   "com_ui_export_convo_modal": "エクスポート",
+  "com_ui_failed": "失敗",
+  "com_ui_favorite": "お気に入りに追加",
+  "com_ui_favorites": "お気に入り",
   "com_ui_feedback_more": "もっと...",
   "com_ui_feedback_more_information": "追加フィードバックの提供",
   "com_ui_feedback_negative": "改善が必要",
@@ -979,7 +1019,9 @@
   "com_ui_feedback_tag_unjustified_refusal": "理由もなく拒否された",
   "com_ui_field_max_length": "{{field}} 以下でなければならない。 {{length}} 文字",
   "com_ui_field_required": "必須入力項目です",
+  "com_ui_file": "ファイル",
   "com_ui_file_input_avatar_label": "アバター用ファイル入力",
+  "com_ui_file_modified": "修正済み",
   "com_ui_file_size": "ファイルサイズ",
   "com_ui_file_token_limit": "ファイル・トークンの制限",
   "com_ui_file_token_limit_desc": "ファイル処理のトークン上限を設定し、コストとリソースの使用量を管理する。",
@@ -987,6 +1029,7 @@
   "com_ui_filter_mcp_servers": "名前でMCPサーバーをフィルタリング",
   "com_ui_filter_prompts": "フィルタープロンプト",
   "com_ui_filter_prompts_name": "名前でプロンプトをフィルタ",
+  "com_ui_filter_skills_name": "スキルを名前でフィルタリングする",
   "com_ui_final_touch": "最後の仕上げ",
   "com_ui_finance": "財務",
   "com_ui_fork": "分岐",
@@ -1018,6 +1061,7 @@
   "com_ui_fork_visible": "表示メッセージのみ",
   "com_ui_generate_qrcode": "QRコードを生成する",
   "com_ui_generating": "生成中...",
+  "com_ui_generating_image": "画像を生成中...",
   "com_ui_generation_settings": "生成設定",
   "com_ui_getting_started": "はじめに",
   "com_ui_go_back": "戻る",
@@ -1032,6 +1076,7 @@
   "com_ui_hide": "隠す",
   "com_ui_hide_code": "コードを隠す",
   "com_ui_hide_image_details": "画像の詳細を隠す",
+  "com_ui_hide_n_files": " {{0}} ファイルを隠す",
   "com_ui_hide_qr": "QRコードを非表示にする",
   "com_ui_high": "高い",
   "com_ui_host": "ホスト",
@@ -1041,6 +1086,7 @@
   "com_ui_image_details": "画像詳細",
   "com_ui_image_edited": "画像編集済み",
   "com_ui_image_gen": "画像生成",
+  "com_ui_image_gen_failed": "画像生成に失敗",
   "com_ui_import": "読み込む",
   "com_ui_import_conversation_error": "会話のインポート時にエラーが発生しました",
   "com_ui_import_conversation_file_type_error": "サポートされていないインポート形式です",
@@ -1052,20 +1098,33 @@
   "com_ui_initializing": "初期化中...",
   "com_ui_input": "入力",
   "com_ui_instructions": "指示文",
+  "com_ui_invocation_auto": "自動",
+  "com_ui_invocation_auto_info": "スキルは、会話に関連する場合、エージェントによって自動的に適用されます",
+  "com_ui_invocation_both": "両方",
+  "com_ui_invocation_both_info": "スキルは自動的にトリガーすることも、ユーザーが手動で呼び出すこともできます",
+  "com_ui_invocation_manual": "手動",
+  "com_ui_invocation_manual_info": "スキルは、ユーザーによって明示的に呼び出された場合にのみ使用されます",
+  "com_ui_invocation_mode": "呼び出しモード",
+  "com_ui_invoked_by": "呼び出し元",
   "com_ui_key": "キー",
   "com_ui_key_required": "APIキーが必要です。",
+  "com_ui_labels": "ラベル",
   "com_ui_last_used": "前回使用",
   "com_ui_late_night": "遅い夜を楽しんで",
+  "com_ui_latest": "最新",
   "com_ui_latest_footer": "Every AI for Everyone.",
   "com_ui_latest_version": "最新バージョン",
   "com_ui_leave_blank_to_keep": "既存を維持する場合は空白のままにして下さい",
   "com_ui_light_theme_enabled": "ライトテーマが有効",
+  "com_ui_line_count": "{0}行",
+  "com_ui_lines_count": "{0}行",
   "com_ui_link_copied": "リンクをコピーしました",
   "com_ui_link_refreshed": "リンクを更新しました",
   "com_ui_loading": "読み込み中...",
   "com_ui_locked": "ロック",
   "com_ui_logo": "{{0}}のロゴ",
   "com_ui_low": "低い",
+  "com_ui_make_production": "制作を行う",
   "com_ui_manage": "管理",
   "com_ui_marketplace": "マーケットプレイス",
   "com_ui_marketplace_allow_use": "マーケットプレイスの利用を許可する",
@@ -1147,6 +1206,11 @@
   "com_ui_mermaid_failed": "図のレンダリングに失敗しました :",
   "com_ui_mermaid_source": "ソースコード:",
   "com_ui_message_input": "メッセージ入力",
+  "com_ui_message_nav": "メッセージナビゲーション",
+  "com_ui_message_nav_go_to_assistant": "アシスタント メッセージに移動します: {{0}}",
+  "com_ui_message_nav_go_to_user": "ユーザーメッセージに移動します: {{0}}",
+  "com_ui_message_nav_next": "次のメッセージに移動する",
+  "com_ui_message_nav_previous": "前のメッセージに移動する",
   "com_ui_microphone_unavailable": "マイクを使用できません",
   "com_ui_min_tags": "これ以上の値を削除できません。少なくとも {{0}} が必要です。",
   "com_ui_minimal": "最小限",
@@ -1155,14 +1219,18 @@
   "com_ui_model_parameters": "モデルパラメータ",
   "com_ui_model_parameters_reset": "モデルパラメータがリセットされました。",
   "com_ui_model_selected": "{{0}} 選択された",
+  "com_ui_model_spec": "モデル仕様",
   "com_ui_more_info": "詳細",
   "com_ui_my_prompts": "マイ プロンプト",
+  "com_ui_my_skills": "マイ スキル",
+  "com_ui_n_files": "{{0}} ファイル",
   "com_ui_name": "名前",
   "com_ui_name_sort": "名前順",
   "com_ui_new": "New",
   "com_ui_new_chat": "新規チャット",
   "com_ui_new_conversation_title": "新しい会話タイトル",
   "com_ui_next": "次",
+  "com_ui_next_result": "次の結果",
   "com_ui_no": "いいえ",
   "com_ui_no_api_keys": "APIキーはまだありません。APIキーを作成してください。",
   "com_ui_no_auth": "認証なし",
@@ -1173,6 +1241,7 @@
   "com_ui_no_category": "カテゴリなし",
   "com_ui_no_changes": "変更なし",
   "com_ui_no_individual_access": "個々のユーザーやグループがこのエージェントにアクセスすることはできません。",
+  "com_ui_no_labels": "ラベルなし",
   "com_ui_no_mcp_servers": "MCPサーバーはまだありません",
   "com_ui_no_mcp_servers_match": "フィルターに一致するMCPサーバーはありません",
   "com_ui_no_memories": "メモリ登録はありません。新規に作成するか、AIに覚えるよう指示してください。",
@@ -1182,6 +1251,7 @@
   "com_ui_no_prompts_title": "まだプロンプトはありません",
   "com_ui_no_read_access": "メモリを見る権限がありません",
   "com_ui_no_results_found": "結果は見つかりませんでした",
+  "com_ui_no_skills_found": "スキルが見つかりません",
   "com_ui_no_terms_content": "表示する利用規約の内容はありません",
   "com_ui_none": "なし",
   "com_ui_not_used": "未使用",
@@ -1199,13 +1269,18 @@
   "com_ui_of": "of",
   "com_ui_off": "オフ",
   "com_ui_offline": "オフライン",
+  "com_ui_omitted": "省略",
   "com_ui_on": "オン",
   "com_ui_open_source_chat_new_tab": "新しいタブでチャットを開く",
   "com_ui_open_source_chat_new_tab_title": "新しいタブでチャットを開く- {{title}}",
   "com_ui_open_var": "開く {{0}}",
   "com_ui_openai": "OpenAI",
   "com_ui_optional": "（任意）",
+  "com_ui_options": "オプション",
+  "com_ui_output": "出力",
   "com_ui_page": "ページ",
+  "com_ui_pagination": "ページネーション",
+  "com_ui_parameters": "パラメータ",
   "com_ui_people": "人々",
   "com_ui_people_picker": "ピープルピッカー",
   "com_ui_people_picker_allow_view_groups": "グループの閲覧を許可する",
@@ -1215,12 +1290,23 @@
   "com_ui_permissions_failed_update": "権限の更新に失敗しました。再試行してください。",
   "com_ui_permissions_updated_success": "パーミッションの更新に成功",
   "com_ui_pin": "ピン留め",
+  "com_ui_plus_n_more": "+{{0}} もっと",
   "com_ui_preferences_updated": "環境設定が正常に更新されました",
   "com_ui_prev": "前",
+  "com_ui_prev_result": "前回の結果",
   "com_ui_preview": "プレビュー",
+  "com_ui_preview_failed": "プレビュー不可",
+  "com_ui_preview_preparing": "プレビューを準備しています…",
+  "com_ui_preview_unavailable": "このファイルタイプではプレビューは利用できません",
   "com_ui_privacy_policy": "プライバシーポリシー",
   "com_ui_privacy_policy_url": "プライバシーポリシーURL",
+  "com_ui_production": "プロダクション",
   "com_ui_prompt": "プロンプト",
+  "com_ui_prompt_category_selector_aria": "プロンプトのカテゴリー・セレクタ",
+  "com_ui_prompt_delete_confirm": "プロンプト「{{0}}」を削除してもよろしいですか？",
+  "com_ui_prompt_delete_error": "プロンプトの削除でエラーが発生しました",
+  "com_ui_prompt_deleted_group": "プロンプトグループ {{0}} 削除されました",
+  "com_ui_prompt_details": "{{name}} プロンプトの詳細",
   "com_ui_prompt_group_button": "{{name}} プロンプト、 {{category}} カテゴリ",
   "com_ui_prompt_group_button_no_category": "{{name}} プロンプト",
   "com_ui_prompt_groups": "プロンプトグループリスト",
@@ -1232,13 +1318,18 @@
   "com_ui_prompt_text": "テキスト",
   "com_ui_prompt_text_required": "テキストは必須です",
   "com_ui_prompt_update_error": "プロンプトの更新中にエラーが発生しました",
+  "com_ui_prompt_variables_list": "プロンプト変数リスト",
   "com_ui_prompts": "プロンプト",
   "com_ui_prompts_allow_create": "プロンプトの作成を許可",
   "com_ui_prompts_allow_share": "プロンプトの共有を許可する",
+  "com_ui_prompts_allow_share_public": "プロンプトの公開共有を許可する",
   "com_ui_prompts_allow_use": "プロンプトの使用を許可",
   "com_ui_provider": "プロバイダ",
   "com_ui_quality": "品質",
+  "com_ui_ran_n_agents": "{{0}} 個のエージェントを実行しました。",
   "com_ui_read_aloud": "読み上げる",
+  "com_ui_read_file": "読む {{0}}",
+  "com_ui_reading_file": "読む {{0}}",
   "com_ui_redirect_uri": "リダイレクトURI",
   "com_ui_redirecting_to_provider": "{{0}}にリダイレクト、 お待ちください...",
   "com_ui_reference_saved_memories": "保存されたメモリを参照",
@@ -1251,8 +1342,10 @@
   "com_ui_regenerating": "再生成中...",
   "com_ui_region": "地域",
   "com_ui_reinitialize": "再初期化",
+  "com_ui_relevance": "関連性",
   "com_ui_remote_access": "リモートアクセス",
   "com_ui_remote_agent_role_editor": "エディター",
+  "com_ui_remote_agent_role_editor_desc": "API経由でエージェントを表示および変更できます",
   "com_ui_remote_agent_role_owner": "APIオーナー",
   "com_ui_remote_agent_role_owner_desc": "APIへのフルアクセス、他者へのリモートアクセスの許可",
   "com_ui_remote_agent_role_viewer": "APIビューア",
@@ -1263,6 +1356,7 @@
   "com_ui_remote_agents_allow_share_public": "エージェントへのAPIアクセスをすべてのユーザーに許可する",
   "com_ui_remote_agents_allow_use": "ユーザーがリモートでAPIキーを作成し、エージェントに問い合わせができるようにする。",
   "com_ui_remove_agent_from_chain": "チェーンから {{0}} を取り除く",
+  "com_ui_remove_skill_var": "取り除く {{0}}",
   "com_ui_remove_user": "削除 {{0}}",
   "com_ui_rename": "タイトル変更",
   "com_ui_rename_conversation": "会話の名前を変更する",
@@ -1277,6 +1371,7 @@
   "com_ui_result": "結果",
   "com_ui_result_found": "{{count}} 件の結果が見つかりました",
   "com_ui_results_found": "{{count}} 件の結果が見つかりました",
+  "com_ui_retrieved_files": "ファイルを検索しました",
   "com_ui_retry": "リトライ",
   "com_ui_revoke": "無効にする",
   "com_ui_revoke_info": "ユーザへ発行した認証情報をすべて無効にする。",
@@ -1301,6 +1396,9 @@
   "com_ui_rotate_90": "90度回転",
   "com_ui_run_code": "コードを実行",
   "com_ui_run_code_error": "コードの実行中にエラーが発生しました",
+  "com_ui_running": "実行中…",
+  "com_ui_running_command": "コマンドを実行しています",
+  "com_ui_running_n_agents": "{{0}} 個のエージェントを実行中",
   "com_ui_save": "保存",
   "com_ui_save_badge_changes": "バッジの変更を保存しますか？",
   "com_ui_save_changes": "変更を保存する",
@@ -1311,6 +1409,7 @@
   "com_ui_saving": "保存中...",
   "com_ui_schema": "スキーマ",
   "com_ui_scope": "範囲",
+  "com_ui_scroll_to_bottom": "一番下までスクロール",
   "com_ui_search": "検索",
   "com_ui_search_above_to_add": "上記の検索でユーザーまたはグループを追加",
   "com_ui_search_above_to_add_all": "上記の検索でユーザー、グループ、ロールを追加する",
@@ -1318,6 +1417,10 @@
   "com_ui_search_agent_category": "カテゴリを検索...",
   "com_ui_search_default_placeholder": "名前またはEメールで検索（2文字以上）",
   "com_ui_search_people_placeholder": "名前またはEメールから人やグループを検索",
+  "com_ui_search_result_count": "{{count}} 結果が見つかりました",
+  "com_ui_search_results_count": "{{count}} 結果が見つかりました",
+  "com_ui_search_skills": "スキルを検索",
+  "com_ui_searching_files": "ファイルの検索",
   "com_ui_seconds": "秒",
   "com_ui_secret_key": "秘密鍵",
   "com_ui_select": "選択",
@@ -1353,27 +1456,123 @@
   "com_ui_show_all": "すべて表示",
   "com_ui_show_code": "コード表示",
   "com_ui_show_image_details": "画像の詳細を表示",
+  "com_ui_show_less": "表示を少なくする",
+  "com_ui_show_more": "もっと見る",
+  "com_ui_show_n_files": "{{0}} 個のファイルを表示",
   "com_ui_show_qr": "QR コードを表示",
   "com_ui_sign_in_to_domain": "{{0}}にサインインする",
   "com_ui_simple": "シンプル",
   "com_ui_size": "サイズ",
   "com_ui_size_sort": "サイズ順",
+  "com_ui_skill": "スキル",
+  "com_ui_skill_content": "スキルコンテンツ",
+  "com_ui_skill_create_error": "スキルの作成に失敗しました",
+  "com_ui_skill_create_title": "スキルの作成",
+  "com_ui_skill_delete_confirm": "次の項目を本当に削除しますか？{{0}}この操作を取り消すことはできません。",
+  "com_ui_skill_delete_error": "スキルの削除に失敗しました",
+  "com_ui_skill_deleted": "スキルが削除されました",
+  "com_ui_skill_description_field_hint": "このスキルがいつ適用されるかについて具体的に記述してください。",
+  "com_ui_skill_description_placeholder": "プレゼンテーションやドキュメントにACME Corpのブランドガイドラインを適用する...",
+  "com_ui_skill_description_required": "説明は必須です",
+  "com_ui_skill_description_too_long": "説明は {{0}} 文字以下にする必要があります",
+  "com_ui_skill_edit_title": "スキルの編集",
+  "com_ui_skill_file_binary": "バイナリ ファイル — インラインでプレビューできません",
+  "com_ui_skill_file_download": "ダウンロード",
+  "com_ui_skill_file_load_error": "コンテンツを読み込めませんでした。",
+  "com_ui_skill_finished": "実行 {{0}}",
+  "com_ui_skill_instructions": "手順",
+  "com_ui_skill_instructions_placeholder": "スキルの指示をマークダウンで入力します...",
+  "com_ui_skill_name_invalid": "小文字、数字、ハイフンのみを使用してください (ケバブケース)",
+  "com_ui_skill_name_placeholder": "ブランドガイドライン",
+  "com_ui_skill_name_required": "名前は必須です",
+  "com_ui_skill_name_too_long": "名前は次のとおりでなければなりません {{0}} 文字以下",
+  "com_ui_skill_new_file": "新しいファイル",
+  "com_ui_skill_new_folder": "新しいフォルダー",
+  "com_ui_skill_no_edit_permission": "このスキルを編集する権限がありません",
+  "com_ui_skill_no_selection": "スキルを選択してください",
+  "com_ui_skill_no_selection_desc": "サイドバーからスキルを選択すると、その詳細が表示されます。",
+  "com_ui_skill_not_found": "スキルが見つかりません",
+  "com_ui_skill_not_found_description": "削除されているか、アクセスできなくなっている可能性があります。",
+  "com_ui_skill_role_editor_desc": "スキルの表示と編集が可能",
+  "com_ui_skill_role_owner_desc": "共有や削除を含むスキルの完全なコントロール",
+  "com_ui_skill_role_viewer_desc": "スキルの表示と使用は可能ですが、編集はできません",
+  "com_ui_skill_running": "実行中 {{0}}",
+  "com_ui_skill_sr_public": "パブリックスキル",
+  "com_ui_skill_states_limit": "上限に達しました {{0}} アクティブ/非アクティブなスキルの上書き。いくつかのオーバーライドを削除して、新しいスキルを切り替えます。",
+  "com_ui_skill_toggle_active": "スキルのアクティブ状態を切り替えます",
+  "com_ui_skill_update_conflict": "あなたの前に別の編集が保存されました。最新バージョンを再読み込みしています。",
+  "com_ui_skill_update_error": "スキルの保存に失敗しました",
+  "com_ui_skill_updated": "スキルを保存しました",
+  "com_ui_skill_upload": "スキルをアップロードする",
+  "com_ui_skill_upload_drag": "ドラッグアンドドロップまたはクリックしてアップロード",
+  "com_ui_skill_upload_file": "ファイルをアップロード",
+  "com_ui_skill_upload_req_md": ".md ファイルには、YAML 形式のスキル名と説明が含まれている必要があります",
+  "com_ui_skill_upload_req_size": "ファイルサイズは以下を超えてはなりません {{0}} MB",
+  "com_ui_skill_upload_req_zip": ".zipまたは.skillファイルには、SKILL.mdファイルを含める必要があります",
+  "com_ui_skill_upload_requirements": "ファイル要件",
+  "com_ui_skill_upload_size_error": "スキルのインポートは次を超えてはなりません {{0}} MB",
+  "com_ui_skill_upload_title": "スキルをアップロード",
+  "com_ui_skill_version": "v{{0}}",
+  "com_ui_skill_view_rendered": "レンダリングされたビュー",
+  "com_ui_skill_view_source": "出処を確認",
+  "com_ui_skill_warnings": "注意喚起",
+  "com_ui_skill_write_instructions": "スキルに関する指示を書く",
+  "com_ui_skills": "スキル",
+  "com_ui_skills_allow_create": "スキルの作成を許可する",
+  "com_ui_skills_allow_share": "スキルの共有を許可する",
+  "com_ui_skills_allow_share_public": "スキルの共有を許可",
+  "com_ui_skills_allow_use": "スキルの使用を許可する",
+  "com_ui_skills_always_apply_invoked": "自動適用されるスキル",
+  "com_ui_skills_always_apply_pin_title": "常に適用されるスキル (ターンごとに自動発動)",
+  "com_ui_skills_command_placeholder": "名前でスキルを選択",
+  "com_ui_skills_disabled_hint": "このエージェントのスキルはオフになっています。有効にすると、モデルがスキルカタログを使用できるようになります。",
+  "com_ui_skills_empty": "まだスキルがありません",
+  "com_ui_skills_enable_toggle": "このエージェントのスキルを有効にする",
+  "com_ui_skills_enabled_all_hint": "有効。完全にアクセス可能なカタログが利用可能です。このエージェントが使用できるスキルを制限する場合は、以下に絞り込みます。",
+  "com_ui_skills_enabled_allowlist_hint": "有効。以下で選択したスキルに限定されます。",
+  "com_ui_skills_load_error": "スキルの読み込みに失敗しました",
+  "com_ui_skills_manual_invoked": "手動で呼び出されたスキル",
+  "com_ui_skills_queued": "次のサブミッションのためにキューに入れられたスキル",
+  "com_ui_special": "特別",
   "com_ui_special_var_current_date": "現在の日付",
   "com_ui_special_var_current_datetime": "現在の日時",
   "com_ui_special_var_current_user": "現在のユーザー",
+  "com_ui_special_var_desc_current_date": "今日の日付と曜日",
+  "com_ui_special_var_desc_current_datetime": "あなたのタイムゾーンの現地日付と時刻",
+  "com_ui_special_var_desc_current_user": "アカウントの表示名",
+  "com_ui_special_var_desc_iso_datetime": "ISO 8601形式のUTC日付時刻",
   "com_ui_special_var_iso_datetime": "UTC ISO 日時",
   "com_ui_special_variable_added": "{{0}} 特殊変数が追加された。",
-  "com_ui_special_variables": "特殊変数:",
+  "com_ui_special_variables": "特殊変数",
   "com_ui_speech_not_supported": "お使いのブラウザは音声認識をサポートしていません",
   "com_ui_speech_not_supported_use_external": "お使いのブラウザは音声認識をサポートしていません。[設定] > [音声]で[外部STT]に切り替えてみてください。",
   "com_ui_speech_while_submitting": "応答の生成中は音声を送信できません",
   "com_ui_sr_global_prompt": "グローバルプロンプトグループ",
+  "com_ui_sr_public_skill": "共有スキル",
   "com_ui_stack_trace": "スタックトレース",
   "com_ui_status_prefix": "ステータス:",
   "com_ui_stop": "止める",
   "com_ui_storage": "ストレージ",
   "com_ui_storage_filter_sort": "ストレージによるフィルタリングと並べ替え",
+  "com_ui_subagent_cancelled": "キャンセルされたエージェント",
+  "com_ui_subagent_complete": "エージェントを実行した",
+  "com_ui_subagent_dialog_description": "隔離コンテキストでの子エージェント実行。アクティビティと最終結果は以下に示す。",
+  "com_ui_subagent_dialog_title": "{{0}}エージェント",
+  "com_ui_subagent_dialog_title_self": "エージェント",
+  "com_ui_subagent_empty_result": "テキストは返されませんでした。",
+  "com_ui_subagent_errored": "エージェントにエラーが発生しました",
+  "com_ui_subagent_no_result_yet": "まだ実行中です - 最終的な結果はまだありません。",
+  "com_ui_subagent_running": "実行中のエージェント",
+  "com_ui_subagent_scroll_to_bottom": "最新までスクロール",
+  "com_ui_subagent_ticker_error": "エラー",
+  "com_ui_subagent_ticker_reasoning": "推論",
+  "com_ui_subagent_ticker_tool_done": "完了",
+  "com_ui_subagent_ticker_using": "使用する",
+  "com_ui_subagent_ticker_writing": "書き込み",
+  "com_ui_subagent_waiting": "最初の更新を待っています…",
   "com_ui_submit": "送信する",
+  "com_ui_summarized": "要約した",
+  "com_ui_summarizing": "要約中…",
   "com_ui_support_contact": "サポート窓口",
   "com_ui_support_contact_email": "電子メール",
   "com_ui_support_contact_email_invalid": "有効なEメールアドレスを入力してください。",
@@ -1385,6 +1584,7 @@
   "com_ui_temporary": "一時チャット",
   "com_ui_terms_and_conditions": "利用規約",
   "com_ui_terms_of_service": "利用規約",
+  "com_ui_text_variables": "テキスト変数",
   "com_ui_thinking": "考え中...",
   "com_ui_thoughts": "推論",
   "com_ui_toggle_theme": "テーマを切り替える",
@@ -1395,6 +1595,12 @@
   "com_ui_tool_collection_prefix": "ツールのコレクション",
   "com_ui_tool_list_collapse": "折りたたむ {{serverName}} ツールリスト",
   "com_ui_tool_list_expand": "展開 {{serverName}} ツールリスト",
+  "com_ui_tool_name_code": "コード",
+  "com_ui_tool_name_code_analysis": "コード解析",
+  "com_ui_tool_name_file_search": "ファイル検索",
+  "com_ui_tool_name_image_edit": "画像編集",
+  "com_ui_tool_name_image_gen": "画像生成",
+  "com_ui_tool_name_web_search": "ウェブ検索",
   "com_ui_tools": "ツール",
   "com_ui_tools_and_actions": "ツールとアクション",
   "com_ui_transferred_to": "転送先",
@@ -1407,7 +1613,10 @@
   "com_ui_unarchive_conversation": "会話のアーカイブ解除",
   "com_ui_unarchive_error": "アーカイブ解除に失敗しました。",
   "com_ui_unavailable": "使用不可",
+  "com_ui_unfavorite": "お気に入りから削除する",
   "com_ui_unknown": "不明",
+  "com_ui_unknown_file_type": "不明なファイルタイプ",
+  "com_ui_unpin": "ピンを解除する",
   "com_ui_unset": "設定解除",
   "com_ui_untitled": "無題",
   "com_ui_update": "更新",
@@ -1417,6 +1626,7 @@
   "com_ui_upload_agent_avatar": "エージェントアバターの更新に成功",
   "com_ui_upload_agent_avatar_label": "エージェントのアバター画像をアップロードする",
   "com_ui_upload_avatar_label": "アバター画像のアップロード",
+  "com_ui_upload_code_environment": "コード環境へのアップロード",
   "com_ui_upload_delay": "ファイル \"{{0}}\"のアップロードに時間がかかっています。ファイルの検索のためのインデックス作成が完了するまでお待ちください。",
   "com_ui_upload_error": "ファイルのアップロード中にエラーが発生しました。",
   "com_ui_upload_file_context": "ファイルコンテキストをアップロード",
@@ -1436,15 +1646,19 @@
   "com_ui_use_backup_code": "代わりにバックアップコードを使用する",
   "com_ui_use_memory": "メモリを使用する",
   "com_ui_use_micrphone": "マイクを使用する",
+  "com_ui_use_prompt": "プロンプトを使用",
   "com_ui_used": "使用済み",
+  "com_ui_used_n_tools": "使用済み {{0}} ツール",
   "com_ui_user": "ユーザー",
   "com_ui_user_group_permissions": "ユーザーとグループの権限",
   "com_ui_user_provides_key": "ユーザーは個人キーを登録する",
   "com_ui_value": "値",
+  "com_ui_variable_with_options": "{{name}} 変数付き {{count}} オプション",
   "com_ui_variables": "変数",
   "com_ui_verify": "確認する",
   "com_ui_version_var": "バージョン {{0}}",
   "com_ui_versions": "バージョン",
+  "com_ui_via_server": "で {{0}}",
   "com_ui_view_memory": "メモリを表示",
   "com_ui_web_search": "ウェブ検索",
   "com_ui_web_search_cohere_key": "Cohere API キーの入力",
@@ -1456,6 +1670,8 @@
   "com_ui_web_search_provider_searxng": "SearXNG",
   "com_ui_web_search_provider_serper": "Serper API",
   "com_ui_web_search_provider_serper_key": "Serper APIキーを取得する",
+  "com_ui_web_search_provider_tavily": "Tavily API",
+  "com_ui_web_search_provider_tavily_key": "Tavily API キーを取得する",
   "com_ui_web_search_reading": "読み取り結果",
   "com_ui_web_search_reranker": "Reranker",
   "com_ui_web_search_reranker_cohere": "Cohere",
@@ -1468,15 +1684,22 @@
   "com_ui_web_search_scraper_firecrawl_key": "FirecrawlのAPIキーを取得する",
   "com_ui_web_search_scraper_serper": "Serper Scrape API",
   "com_ui_web_search_scraper_serper_key": "SerperのAPIキーを取得する",
+  "com_ui_web_search_scraper_tavily": "Tavily Extract API",
+  "com_ui_web_search_scraper_tavily_key": "Tavily API キーを取得する",
   "com_ui_web_search_searxng_api_key": "SearXNG APIキーを入力（オプション）",
   "com_ui_web_search_searxng_instance_url": "SearXNGインスタンスURL",
+  "com_ui_web_search_source": "{{count}} ソース",
+  "com_ui_web_search_sources": "{{count}} ソース",
+  "com_ui_web_searched": "ウェブで検索した",
   "com_ui_web_searching": "ウェブ検索",
   "com_ui_web_searching_again": "もう一度ウェブを検索します",
   "com_ui_weekend_morning": "楽しい週末を",
   "com_ui_write": "執筆",
+  "com_ui_writing_command": "書き込みコマンド",
   "com_ui_x_selected": "{{0}}が選択された",
   "com_ui_xhigh": "最上位",
   "com_ui_yes": "はい",
+  "com_ui_you": "あなた",
   "com_ui_your_api_key": "API キー",
   "com_ui_zoom": "ズーム",
   "com_ui_zoom_in": "ズームイン",
diff --git a/client/src/locales/ko/translation.json b/client/src/locales/ko/translation.json
index b2d851d4659..47c3c235a11 100644
--- a/client/src/locales/ko/translation.json
+++ b/client/src/locales/ko/translation.json
@@ -1,6 +1,6 @@
 {
-  "chat_direction_left_to_right": "왼쪽에서 오른쪽으로의 채팅 방향입니다. 내용이 비어 있었습니다.",
-  "chat_direction_right_to_left": "오른쪽에서 왼쪽으로의 채팅 방향입니다. 내용이 비어 있었습니다.",
+  "chat_direction_left_to_right": "왼쪽에서 오른쪽",
+  "chat_direction_right_to_left": "오른쪽에서 왼쪽",
   "com_a11y_ai_composing": "AI가 응답을 작성 중입니다",
   "com_a11y_end": "AI의 답변이 끝났습니다.",
   "com_a11y_start": "AI가 응답 중입니다",
@@ -285,7 +285,7 @@
   "com_files_filter": "파일 필터링...",
   "com_files_no_results": "결과가 없습니다.",
   "com_files_number_selected": "{{0}}개의 파일({{1}}개 중)이 선택되었습니다",
-  "com_files_table": "내용이 비어 있었습니다.",
+  "com_files_table": "파일 테이블",
   "com_generated_files": "생성된 파일:",
   "com_hide_examples": "예시 숨기기",
   "com_info_heic_converting": "HEIC 이미지를 JPEG로 변환 중...",
diff --git a/client/src/locales/lv/translation.json b/client/src/locales/lv/translation.json
index 87c02fd32b8..01db2cb5d31 100644
--- a/client/src/locales/lv/translation.json
+++ b/client/src/locales/lv/translation.json
@@ -500,7 +500,7 @@
   "com_nav_font_size_sm": "Mazs",
   "com_nav_font_size_xl": "Īpaši liels",
   "com_nav_font_size_xs": "Īpaši mazs",
-  "com_nav_help_faq": "Palīdzība un bieži uzdotie jautājumi",
+  "com_nav_help_faq": "Lietošanas instrukcija un palīdzība",
   "com_nav_info_balance": "Bilance parāda, cik daudz tokenu kredītu jums ir atlicis izmantot. Tokenu kredīti tiek pārvērsti naudas vērtībā (piemēram, 1000 kredīti = 0,001 USD).",
   "com_nav_info_code_artifacts": "Iespējo eksperimentāla koda artefaktu rādīšanu blakus sarunai",
   "com_nav_info_code_artifacts_agent": "Iespējo koda artefaktu izmantošanu šim aģentam. Pēc noklusējuma tiek pievienotas papildu instrukcijas, kas attiecas uz artefaktu izmantošanu, ja vien nav iespējots \"Pielāgots uzvednes režīms\".",
@@ -613,7 +613,7 @@
   "com_nav_theme": "Tēma",
   "com_nav_theme_dark": "Tumšs",
   "com_nav_theme_light": "Gaišs",
-  "com_nav_theme_system": "Sistēmas uzstādījums",
+  "com_nav_theme_system": "Sistēmas",
   "com_nav_tool_dialog": "Asistenta rīki",
   "com_nav_tool_dialog_agents": "Aģenta rīki",
   "com_nav_tool_dialog_description": "Lai saglabātu rīku atlasi, ir jāsaglabā asistents.",
@@ -725,12 +725,12 @@
   "com_ui_agent_subagents_allow_self_info": "Ļaujiet šim aģentam deleģēt fokusētos apakšuzdevumus paša kopijai izolētā konteksta logā.",
   "com_ui_agent_subagents_empty": "Nav pieejami apakšaģenti: iespējojiet paš-izveidi vai pievienojiet vismaz vienu aģentu.",
   "com_ui_agent_subagents_enable": "Iespējot apakšaģentus",
-  "com_ui_agent_subagents_info": "Apakšaģenti darbojas izolētos konteksta logos. Izvērstā rīka izvade paliek pieejama bērnam; tikai kopsavilkums atgriežas pie šī aģenta.",
+  "com_ui_agent_subagents_info": "Apakšaģenti darbojas izolētos konteksta logos. Izvērstā rīka izvade paliek pieejama apakšaģentam; tikai kopsavilkums atgriežas pie šī aģenta.",
   "com_ui_agent_subagents_info_2": "Iespējojot bez uzskaitītajiem aģentiem, joprojām ir iespējams veikt paš-izveidi, tāpēc šis aģents var deleģēt fokusētus apakšuzdevumus svaigai savai kopijai.",
   "com_ui_agent_subagents_max": "Maksimums {{0}} apakšaģentu ir sasniegts.",
   "com_ui_agent_subagents_remove": "Noņemt {{0}} no apakšaģentiem",
   "com_ui_agent_url_copied": "Aģenta URL kopēts starpliktuvē",
-  "com_ui_agent_var": "{{0}} aģents",
+  "com_ui_agent_var": "{{0}} aģentu",
   "com_ui_agent_version": "Versija",
   "com_ui_agent_version_active": "Aktīvā versija",
   "com_ui_agent_version_empty": "Nav pieejamu versiju",
@@ -750,6 +750,7 @@
   "com_ui_agents_allow_share_public": "Atļaut koplietot aģentus publiski",
   "com_ui_agents_allow_use": "Atļaut aģentu izmantošanu",
   "com_ui_all": "visu",
+  "com_ui_all_projects": "Visi projekti",
   "com_ui_all_proper": "Visi",
   "com_ui_analyzing": "Analīze",
   "com_ui_analyzing_finished": "Analīze pabeigta",
@@ -836,10 +837,13 @@
   "com_ui_branch_error": "Neizdevās izveidot atzaru",
   "com_ui_branch_message": "Izveidot atzaru no šīs atbildes",
   "com_ui_by_author": "līdz {{0}}",
+  "com_ui_cache_read": "Kešatmiņa lasīta",
+  "com_ui_cache_write": "Rakstīšana kešatmiņā",
   "com_ui_callback_url": "Atzvanīšanas URL",
   "com_ui_cancel": "Atcelt",
   "com_ui_cancelled": "Atcelts",
   "com_ui_category": "Kategorija",
+  "com_ui_change_project": "Mainīt projektu",
   "com_ui_change_version": "Mainīt versiju",
   "com_ui_chat": "Saruna",
   "com_ui_chat_history": "Sarunu vēsture",
@@ -880,7 +884,27 @@
   "com_ui_connecting": "Savienojas",
   "com_ui_contact_admin_if_issue_persists": "Sazinieties ar administratoru, ja problēma turpina pastāvēt",
   "com_ui_context": "Konteksts",
+  "com_ui_context_cost": "Izmaksa",
+  "com_ui_context_cost_branch": "Izmaksa (šis zars)",
+  "com_ui_context_cost_total": "Visi zari",
   "com_ui_context_filter_sort": "Filtrēšana un šķirošana pēc konteksta",
+  "com_ui_context_free": "Brīva vieta",
+  "com_ui_context_messages": "Ziņas",
+  "com_ui_context_subagents": "Apakšagenti",
+  "com_ui_context_summary": "Kopsavilkums",
+  "com_ui_context_system": "Sistēmas uzvedne",
+  "com_ui_context_tools": "Rīku shēmas",
+  "com_ui_context_tools_mcp": "MCP rīki",
+  "com_ui_context_tools_mcp_deferred": "MCP rīki (atliktie)",
+  "com_ui_context_tools_system": "Sistēmas rīki",
+  "com_ui_context_tools_system_deferred": "Sistēmas rīki (atliktie)",
+  "com_ui_context_unknown": "Konteksta izmērs nav zināms",
+  "com_ui_context_usage": "Konteksta lietojums",
+  "com_ui_context_usage_label": "Konteksta logs: {{0}} no {{1}} izmantotie tokeni ({{2}}%)",
+  "com_ui_context_usage_label_unknown": "Konteksta lietojums: {{0}} tokeni izmantoti",
+  "com_ui_context_usage_snapshot": "Konteksts {{0}} / {{1}} ({{2}}%)",
+  "com_ui_context_usage_snapshot_unknown": "Konteksts {{0}}",
+  "com_ui_context_window": "Konteksta logs",
   "com_ui_continue": "Turpināt",
   "com_ui_continue_oauth": "Turpināt ar OAuth",
   "com_ui_control_bar": "Vadības josla",
@@ -910,13 +934,16 @@
   "com_ui_create_mcp_server": "Izveidot MCP serveri",
   "com_ui_create_memory": "Izveidot atmiņu",
   "com_ui_create_new_agent": "Izveidot jaunu aģentu",
+  "com_ui_create_project": "Izveidot projektu",
   "com_ui_create_prompt": "Izveidot uzvedni",
   "com_ui_create_prompt_page": "Jauna uzvedņu konfigurācijas lapa",
   "com_ui_create_skill": "Izveidot prasmi",
   "com_ui_create_skill_upload": "Augšupielādēt SKILL.md",
   "com_ui_create_skill_upload_error": "Neizdevās nolasīt augšupielādēto failu",
   "com_ui_created": "Izveidots",
+  "com_ui_created_file": "Izveidots {{0}}",
   "com_ui_creating": "Notiek izveide...",
+  "com_ui_creating_file": "Izveido {{0}}",
   "com_ui_creating_image": "Attēla izveide. Var aizņemt brīdi.",
   "com_ui_current": "Pašreizējais",
   "com_ui_currently_production": "Pašlaik produkcijā",
@@ -961,6 +988,8 @@
   "com_ui_delete_memory": "Dzēst atmiņu",
   "com_ui_delete_not_allowed": "Dzēšanas darbība nav atļauta",
   "com_ui_delete_preset": "Vai dzēst iestatījumu?",
+  "com_ui_delete_project": "Vai dzēst projektu?",
+  "com_ui_delete_project_confirm": "Dzēst \"{{name}}\"? Iekšā esošās sarunas netiks dzēstas.",
   "com_ui_delete_prompt": "Vai dzēst uzvedni?",
   "com_ui_delete_shared_link": "Vai dzēst kopīgoto saiti?",
   "com_ui_delete_shared_link_heading": "Dzēst koplietoto saiti",
@@ -1002,6 +1031,8 @@
   "com_ui_edit_prompt_page": "Rediģēt uzvedņu lapu",
   "com_ui_edit_skill": "Rediģēt prasmi",
   "com_ui_editable_message": "Rediģējams ziņojums",
+  "com_ui_edited_file": "Rediģēts {{0}}",
+  "com_ui_editing_file": "Rediģē {{0}}",
   "com_ui_editor_instructions": "Velciet attēlu, lai mainītu tā atrašanās vietu - Izmantojiet tālummaiņas slīdni vai pogas, lai pielāgotu izmēru.",
   "com_ui_empty_category": "-",
   "com_ui_endpoint": "Galapunkts",
@@ -1020,6 +1051,7 @@
   "com_ui_error_try_following_prefix": "Lūdzu, izmēģiniet kādu no šīm iespējām",
   "com_ui_error_unexpected": "Ak! Notika kaut kas neparedzēts",
   "com_ui_error_updating_preferences": "Kļūda, atjauninot preferences",
+  "com_ui_estimated": "Aprēķināts no ziņojumu vēstures",
   "com_ui_everyone_permission_level": "Visu lietotāju atļaujas līmenis",
   "com_ui_examples": "Piemēri",
   "com_ui_expand": "Izvērst",
@@ -1056,6 +1088,7 @@
   "com_ui_file_token_limit": "Failu tokenu ierobežojums",
   "com_ui_file_token_limit_desc": "Iestatiet maksimālo tokenu ierobežojumu failu apstrādei, lai kontrolētu izmaksas un resursu izmantošanu",
   "com_ui_files": "Faili",
+  "com_ui_files_count_size": "{{0}} Faili ({{1}}KB)",
   "com_ui_filter_mcp_servers": "MCP serveru filtrēšana pēc nosaukuma",
   "com_ui_filter_prompts": "Filtrēt uzvednes",
   "com_ui_filter_prompts_name": "Filtrēt uzvednes pēc nosaukuma",
@@ -1142,6 +1175,7 @@
   "com_ui_last_used": "Pēdējais izmantotais",
   "com_ui_late_night": "Priecīgu vēlu nakti",
   "com_ui_latest": "jaunākais",
+  "com_ui_latest_activity": "Pēdējā aktivitāte",
   "com_ui_latest_footer": "Mākslīgais intelekts ikvienam.",
   "com_ui_latest_version": "Jaunākā versija",
   "com_ui_leave_blank_to_keep": "Atstājiet tukšu, lai saglabātu esošo",
@@ -1151,6 +1185,7 @@
   "com_ui_link_copied": "Saite nokopēta",
   "com_ui_link_refreshed": "Saites atsvaidzināta",
   "com_ui_live": "aktuālais",
+  "com_ui_load_more": "Ielādēt vairāk",
   "com_ui_loading": "Notiek ielāde...",
   "com_ui_locked": "Bloķēts",
   "com_ui_logo": "{{0}} Logotips",
@@ -1197,6 +1232,7 @@
   "com_ui_mcp_server_updated": "MCP serveris veiksmīgi atjaunināts",
   "com_ui_mcp_server_url_placeholder": "https://mcp.piemers.lv",
   "com_ui_mcp_servers": "MCP serveri",
+  "com_ui_mcp_servers_allow_configure_obo": "Ļaut lietotājiem konfigurēt On-Behalf-Of (OBO) MCP serveros",
   "com_ui_mcp_servers_allow_create": "Atļaut lietotājiem izveidot MCP serverus",
   "com_ui_mcp_servers_allow_share": "Atļaut lietotājiem koplietot MCP serverus",
   "com_ui_mcp_servers_allow_share_public": "Ļaujiet lietotājiem publiski koplietot MCP serverus",
@@ -1251,7 +1287,9 @@
   "com_ui_model_parameters_reset": "Modeļa parametri ir atiestatīti.",
   "com_ui_model_selected": "{{0}} atlasīts",
   "com_ui_model_spec": "Modeļa specifikācija",
+  "com_ui_more_count": "{{0}} vairāk",
   "com_ui_more_info": "Vairāk informācijas",
+  "com_ui_more_options": "Vairāk opciju",
   "com_ui_my_prompts": "Manas uzvednes",
   "com_ui_my_skills": "Manas prasmes",
   "com_ui_n_files": "{{0}} faili",
@@ -1260,7 +1298,9 @@
   "com_ui_navigate_results": "Pārskatīt rezultātus",
   "com_ui_new": "Jauns",
   "com_ui_new_chat": "Jauna saruna",
+  "com_ui_new_chat_in_project": "Jauna saruna iekš {{name}}",
   "com_ui_new_conversation_title": "Jaunas sarunas nosaukums",
+  "com_ui_new_project": "Jauns projekts",
   "com_ui_next": "Nākamais",
   "com_ui_next_result": "Nākamais rezultāts",
   "com_ui_no": "Nē",
@@ -1280,6 +1320,8 @@
   "com_ui_no_memories_match": "Nav atmiņu, kas atbilstu jūsu meklēšanas vaicājumam",
   "com_ui_no_memories_title": "Vēl nav atmiņu",
   "com_ui_no_personalization_available": "Pašlaik nav pieejamas personalizācijas opcijas",
+  "com_ui_no_project_chats": "Vēl nav sarunu",
+  "com_ui_no_projects": "Vēl nav projektu",
   "com_ui_no_prompts_title": "Vēl nav uzvedņu",
   "com_ui_no_read_access": "Jums nav atļaujas skatīt atmiņas",
   "com_ui_no_results_found": "Nav atrastu rezultātu",
@@ -1298,12 +1340,17 @@
   "com_ui_oauth_error_title": "Autentifikācija neizdevās",
   "com_ui_oauth_success_description": "Jūsu autentifikācija bija veiksmīga. Šis logs aizvērsies pēc",
   "com_ui_oauth_success_title": "Autentifikācija veiksmīga",
+  "com_ui_obo": "On-Behalf-Of (OBO)",
+  "com_ui_obo_readonly_no_permission": "OBO ir konfigurēts šim serverim, bet jūsu lomai vairs nav atļaujas to modificēt. Sazinieties ar administratoru, lai veiktu izmaiņas.",
+  "com_ui_obo_scopes": "OBO darbības jomas",
+  "com_ui_obo_scopes_description": "Jomas, kas jāpieprasa lejupstraumes MCP serverim, izmantojot On-Behalf-Of plūsmu. Nepieciešama OpenID Connect autentifikācija (piemēram, Entra ID).",
   "com_ui_of": "no",
   "com_ui_off": "Izslēgts",
   "com_ui_offline": "Bezsaistē",
   "com_ui_omitted": "Izlaists",
   "com_ui_on": "Ieslēgts",
   "com_ui_open_archived_chat_new_tab_title": "{{title}} (atveras jaunā cilnē)",
+  "com_ui_open_project": "Atvērt projektu",
   "com_ui_open_source_chat_new_tab": "Atvērtā koda saruna jaunā cilnē",
   "com_ui_open_source_chat_new_tab_title": "Atvērtā koda saruna jaunā cilnē - {{title}}",
   "com_ui_open_var": "Atvērt {{0}}",
@@ -1334,6 +1381,17 @@
   "com_ui_privacy_policy": "Privātuma politika",
   "com_ui_privacy_policy_url": "Privātuma politika web adrese",
   "com_ui_production": "Produkcija",
+  "com_ui_project_chat_count": "{{count}} sarunas",
+  "com_ui_project_chat_count_single": "1 saruna",
+  "com_ui_project_create_error": "Neizdevās izveidot projektu",
+  "com_ui_project_delete_error": "Neizdevās dzēst projektu",
+  "com_ui_project_name": "Projekta nosaukums",
+  "com_ui_project_name_placeholder": "Jauns projekts",
+  "com_ui_project_not_found": "Projekts nav atrasts",
+  "com_ui_project_rename_error": "Neizdevās pārdēvēt projektu",
+  "com_ui_project_update_error": "Neizdevās atjaunināt projekta uzdevumu",
+  "com_ui_project_updated": "Projekta uzdevums atjaunināts",
+  "com_ui_projects": "Projekti",
   "com_ui_prompt": "Uzvedne",
   "com_ui_prompt_category_selector_aria": "Uzvednes kategorijas atlasītājs",
   "com_ui_prompt_delete_confirm": "Vai esat pārliecināts, ka vēlaties dzēst '{{0}}' uzvedni?",
@@ -1390,11 +1448,13 @@
   "com_ui_remote_agents_allow_share_public": "Atļaut lietotājiem piešķirt API piekļuvi aģentiem visiem lietotājiem",
   "com_ui_remote_agents_allow_use": "Atļaut lietotājiem attālināti izveidot API atslēgas un vaicājumu aģentus",
   "com_ui_remove_agent_from_chain": "Noņemt {{0}} no ķēdes",
+  "com_ui_remove_from_project": "Izņemt no projekta",
   "com_ui_remove_skill_var": "Noņemt {{0}}",
   "com_ui_remove_user": "Noņemt {{0}}",
   "com_ui_rename": "Pārdēvēt",
   "com_ui_rename_conversation": "Pārdēvēt sarunu",
   "com_ui_rename_failed": "Neizdevās pārdēvēt sarunu",
+  "com_ui_rename_project": "Pārdēvēt projektu",
   "com_ui_requires_auth": "Nepieciešama autentifikācija",
   "com_ui_reset": "Attiestatīt",
   "com_ui_reset_adjustments": "Atiestatīt korekcijas",
@@ -1451,6 +1511,7 @@
   "com_ui_search_agent_category": "Meklēt kategorijas...",
   "com_ui_search_default_placeholder": "Meklēt pēc vārda vai e-pasta adreses (vismaz 2 rakstu zīmes)",
   "com_ui_search_people_placeholder": "Meklēt personas vai grupas pēc vārda vai e-pasta adreses",
+  "com_ui_search_projects": "Meklēt projektus",
   "com_ui_search_result_count": "{{count}} atrasts rezultāts",
   "com_ui_search_results_count": "{{count}} Atrastie rezultāti",
   "com_ui_search_skills": "Meklēt prasmes...",
@@ -1464,6 +1525,7 @@
   "com_ui_select_model": "Izvēlieties modeli",
   "com_ui_select_options": "Izvēlieties opcijas...",
   "com_ui_select_or_create_prompt": "Izvēlieties vai izveidot uzvedni",
+  "com_ui_select_project": "Izvēlēties projektu",
   "com_ui_select_provider": "Izvēlieties pakalpojumu sniedzēju",
   "com_ui_select_provider_first": "Vispirms izvēlieties pakalpojumu sniedzēju",
   "com_ui_select_region": "Izvēlieties reģionu",
@@ -1482,7 +1544,9 @@
   "com_ui_share_qr_code_description": "QR kods šīs sarunas saites kopīgošanai",
   "com_ui_share_update_message": "Jūsu vārds, pielāgotie norādījumi un visas ziņas, ko pievienojat pēc kopīgošanas, paliek privātas.",
   "com_ui_share_var": "Kopīgot {{0}}",
+  "com_ui_shared_link": "koplietota saite",
   "com_ui_shared_link_delete_success": "Kopīgotā saite ir veiksmīgi dzēsta.",
+  "com_ui_shared_link_manage_access": "Pārvaldīt piekļuvi",
   "com_ui_shared_link_not_found": "Kopīgotā saite nav atrasta",
   "com_ui_shared_prompts": "Kopīgotas uzvednes",
   "com_ui_shop": "Iepirkšanās",
@@ -1536,6 +1600,7 @@
   "com_ui_skill_sr_public": "Publiskā prasme",
   "com_ui_skill_states_limit": "Jūs esat sasniedzis šādu ierobežojumu: {{0}} aktīva/neaktīva prasmju ignorēšana. Noņemiet dažas ignorēšanas iespējas, lai pārslēgtu jaunas prasmes.",
   "com_ui_skill_toggle_active": "Pārslēgt prasmju aktīvo stāvokli",
+  "com_ui_skill_unavailable": "Nepieejama prasme",
   "com_ui_skill_update_conflict": "Cits labojums tika saglabāts pirms jūsu. Jaunākās versijas atkārtota ielāde.",
   "com_ui_skill_update_error": "Neizdevās saglabāt prasmi",
   "com_ui_skill_updated": "Prasme saglabāta",
@@ -1569,6 +1634,11 @@
   "com_ui_skills_load_error": "Neizdevās ielādēt prasmes",
   "com_ui_skills_manual_invoked": "Manuāli izsauktas prasmes",
   "com_ui_skills_queued": "Prasmes, kas ierindotas nākamajai iesniegšanai",
+  "com_ui_sort_by": "Kārtot pēc",
+  "com_ui_sort_chats_by": "Kārtot sarunas pēc",
+  "com_ui_sort_created": "Izveidots",
+  "com_ui_sort_projects_by": "Kārtot projektus pēc",
+  "com_ui_sort_updated": "Atjaunināts",
   "com_ui_special": "īpašs",
   "com_ui_special_var_current_date": "Pašreizējais datums",
   "com_ui_special_var_current_datetime": "Pašreizējais datums un laiks",
@@ -1649,6 +1719,7 @@
   "com_ui_unarchive": "Atarhivēt",
   "com_ui_unarchive_conversation": "Atarhivēt sarunu",
   "com_ui_unarchive_error": "Neizdevās atarhivēt sarunu",
+  "com_ui_unassigned": "Nav piešķirts",
   "com_ui_unavailable": "Nav pieejams",
   "com_ui_unfavorite": "Noņemt no izlases",
   "com_ui_unknown": "Nezināms",
@@ -1658,6 +1729,7 @@
   "com_ui_untitled": "Bez nosaukuma",
   "com_ui_update": "Atjauninājums",
   "com_ui_update_mcp_server": "Atjaunināt MCP serveri",
+  "com_ui_updated_file": "Atjaunināts {{0}}",
   "com_ui_updating": "Atjaunina...",
   "com_ui_upload": "Augšupielādēt",
   "com_ui_upload_agent_avatar": "Aģenta avatars veiksmīgi atjaunināts",
@@ -1738,6 +1810,7 @@
   "com_ui_yes": "Jā",
   "com_ui_you": "Tu",
   "com_ui_your_api_key": "Tava API atslēga",
+  "com_ui_your_projects": "Jūsu projekti",
   "com_ui_zoom": "Tālummaiņa",
   "com_ui_zoom_in": "Pietuvināt",
   "com_ui_zoom_level": "Pietuvināšanas līmenis",
diff --git a/client/src/locales/pl/translation.json b/client/src/locales/pl/translation.json
index 41756b81847..c982bd10348 100644
--- a/client/src/locales/pl/translation.json
+++ b/client/src/locales/pl/translation.json
@@ -74,7 +74,7 @@
   "com_agents_loading": "Ładowanie...",
   "com_agents_marketplace": "Agent Marketplace",
   "com_agents_marketplace_subtitle": "Odkrywaj i używaj potężnych agentów AI, aby ulepszyć swoje przepływy pracy i wydajność",
-  "com_agents_mcp_description_placeholder": "MCP pozwala na wyposażenie twojego agenta w niestandardowe narzędzia i funkcje poprzez integrację z serwerami MCP. Skonfiguruj niestandardowe zmienne dla każdego serwera, aby umożliwić agentowi korzystanie z tych narzędzi.",
+  "com_agents_mcp_description_placeholder": "Wyjaśnij, co to robi, w kilku słowach",
   "com_agents_mcp_icon_size": "Minimalny rozmiar: 128 x 128 px",
   "com_agents_mcp_name_placeholder": "Niestandardowe Narzędzie",
   "com_agents_mcp_trust_subtext": "Niestandardowe konektory MCP nie są weryfikowane przez LibreChat",
diff --git a/client/src/locales/pt-BR/translation.json b/client/src/locales/pt-BR/translation.json
index 09cc27f3690..43c6ce0bd3c 100644
--- a/client/src/locales/pt-BR/translation.json
+++ b/client/src/locales/pt-BR/translation.json
@@ -2,13 +2,18 @@
   "chat_direction_left_to_right": "algo precisa ir aqui. Está vazio",
   "chat_direction_right_to_left": "algo precisa ir aqui. esta vazio",
   "com_a11y_ai_composing": "A IA ainda está compondo.",
+  "com_a11y_chats_date_section": "Chats de {{date}}",
   "com_a11y_end": "A IA terminou de responder.",
   "com_a11y_selected": "selecionado",
   "com_a11y_start": "A IA começou a responder.",
+  "com_a11y_summarize_completed": "Contexto resumido.",
+  "com_a11y_summarize_failed": "Falha no resumo, continuando com o contexto disponível.",
+  "com_a11y_summarize_started": "Resumindo o contexto.",
   "com_agents_agent_card_label": "Agente {{name}}. {{description}}",
   "com_agents_all": "Todos os Agentes",
   "com_agents_all_category": "Todos",
   "com_agents_all_description": "Navegar por todos os agentes compartilhados em todas as categorias",
+  "com_agents_avatar_upload_error": "Falha ao enviar o avatar do agente",
   "com_agents_category_aftersales": "Pós-vendas",
   "com_agents_category_aftersales_description": "Agentes especializados em atendimento pós-venda, manutenção e atendimento ao cliente",
   "com_agents_category_empty": "Não foram encontrados agentes na categoria {{category}}",
@@ -26,11 +31,13 @@
   "com_agents_category_sales_description": "Agentes focados em processos de vendas, relações com o cliente",
   "com_agents_category_tab_label": "Categoria {{category}}, {{position}} de {{total}}",
   "com_agents_category_tabs_label": "Categorias de Agentes",
+  "com_agents_chat_with": "Conversar com {{name}}",
   "com_agents_clear_search": "Limpar pesquisa",
   "com_agents_contact": "Contato",
   "com_agents_copy_link": "Copiar link",
   "com_agents_create_error": "Houve um erro ao criar seu agente.",
   "com_agents_created_by": "por",
+  "com_agents_description_card": "Descrição: {{description}}",
   "com_agents_description_placeholder": "Opcional: Descreva seu Agente aqui",
   "com_agents_empty_state_heading": "Nenhum agente encontrado",
   "com_agents_enable_file_search": "Permitir Pesquisa de Ficheiros",
@@ -57,7 +64,9 @@
   "com_agents_error_timeout_suggestion": "Por favor verifique sua conexão com a internet e tente novamente.",
   "com_agents_error_timeout_title": "A conexão expirou",
   "com_agents_error_title": "Algo deu errado",
+  "com_agents_file_context_description": "Arquivos enviados como \"Contexto\" são processados como texto para complementar as instruções do agente. Se OCR estiver disponível, ou se estiver configurado para o tipo de arquivo enviado, o processo será usado para extrair texto. Ideal para documentos, imagens com texto ou PDFs em que você precisa do conteúdo textual completo de um arquivo",
   "com_agents_file_context_disabled": "O agente deve ser criado antes de carregar arquivos para o Contexto de Arquivo.",
+  "com_agents_file_context_label": "Contexto do arquivo",
   "com_agents_file_search_disabled": "O agente deve ser criado antes de carregar arquivos para Pesquisa de Arquivos.",
   "com_agents_file_search_info": "Quando ativado, o agente será informado dos nomes exatos dos arquivos listados abaixo, permitindo que ele recupere o contexto relevante desses arquivos.",
   "com_agents_grid_announcement": "Mostrando {{count}} agentes na categoria {{category}}",
@@ -133,6 +142,7 @@
   "com_assistants_update_actions_success": "Ação criada ou atualizada com sucesso",
   "com_assistants_update_error": "Houve um erro ao atualizar seu assistente.",
   "com_assistants_update_success": "Atualizado com sucesso",
+  "com_assistants_update_success_name": "{{name}} atualizado com sucesso",
   "com_auth_already_have_account": "Já tem uma conta?",
   "com_auth_apple_login": "Iniciar sessão com a Apple",
   "com_auth_back_to_login": "Voltar para Login",
@@ -210,17 +220,21 @@
   "com_endpoint_agent": "Agente",
   "com_endpoint_agent_placeholder": "Selecione um agente",
   "com_endpoint_ai": "AI",
+  "com_endpoint_anthropic_effort": "Controla quanto esforço computacional Claude aplica. Esforço menor economiza tokens e reduz a latência; esforço maior produz respostas mais completas. 'Max' ativa o raciocínio mais profundo (somente Opus 4.6).",
   "com_endpoint_anthropic_maxoutputtokens": "Número máximo de tokens que podem ser gerados na resposta. Especifique um valor mais baixo para respostas mais curtas e um valor mais alto para respostas mais longas. Nota: os modelos podem parar antes de atingir esse máximo.",
   "com_endpoint_anthropic_prompt_cache": "O cache de prompt permite reutilizar um grande contexto ou instruções em chamadas de API, reduzindo custos e latência",
   "com_endpoint_anthropic_temp": "Varia de 0 a 1. Use temperatura mais próxima de 0 para tarefas analíticas / de múltipla escolha, e mais próxima de 1 para tarefas criativas e generativas. Recomendamos alterar isso ou Top P, mas não ambos.",
   "com_endpoint_anthropic_thinking": "Permite o raciocínio interno para os modelos Claude suportados (3.7 Sonnet). Nota: requer que o \"Orçamento de raciocínio\" esteja definido e seja inferior ao \"Máximo de tokens de saída\"",
   "com_endpoint_anthropic_thinking_budget": "Determina o número máximo de tokens que o Claude pode utilizar para o seu processo de raciocínio interno. Orçamentos maiores podem melhorar a qualidade da resposta, permitindo uma análise mais completa para problemas complexos, embora o Claude possa não usar todo o orçamento alocado, especialmente em intervalos acima de 32K. Essa configuração deve ser menor que \"Máximo de tokens de saída\".",
+  "com_endpoint_anthropic_thinking_display": "Visibilidade do raciocínio",
+  "com_endpoint_anthropic_thinking_display_desc": "Controla se o raciocínio de Claude é retornado. 'Auto' ativa raciocínios resumidos para modelos que os ocultam por padrão (Opus 4.7+); 'Resumido' sempre os mostra; 'Omitido' sempre os oculta para uma latência um pouco menor.",
   "com_endpoint_anthropic_topk": "Top-k altera como o modelo seleciona tokens para saída. Um top-k de 1 significa que o token selecionado é o mais provável entre todos os tokens no vocabulário do modelo (também chamado de decodificação gananciosa), enquanto um top-k de 3 significa que o próximo token é selecionado entre os 3 tokens mais prováveis (usando temperatura).",
   "com_endpoint_anthropic_topp": "Top-p altera como o modelo seleciona tokens para saída. Os tokens são selecionados dos mais prováveis (veja o parâmetro topK) até os menos prováveis até que a soma de suas probabilidades atinja o valor top-p.",
   "com_endpoint_anthropic_use_web_search": "Habilita a funcionalidade de pesquisa na web usando o recurso integrado da Anthropic. Isso permite que o modelo pesquise informações atualizadas na web e forneça respostas mais precisas e atuais.",
   "com_endpoint_assistant": "Assistente",
   "com_endpoint_assistant_model": "Modelo de Assistente",
   "com_endpoint_assistant_placeholder": "Por favor, selecione um Assistente no Painel Lateral Direito",
+  "com_endpoint_bedrock_reasoning_effort": "Controla o nível de raciocínio para modelos Bedrock suportados (por exemplo, Kimi K2.5, GLM). Níveis mais altos produzem um raciocínio mais completo ao custo de maior latência e tokens.",
   "com_endpoint_config_click_here": "Clique Aqui",
   "com_endpoint_config_google_api_info": "Para obter sua chave API de Linguagem Generativa (para Gemini),",
   "com_endpoint_config_google_api_key": "Chave API do Google",
@@ -251,6 +265,7 @@
   "com_endpoint_default_with_num": "padrão: {{0}}",
   "com_endpoint_disable_streaming": "Desativar o streaming de respostas e receber a resposta de uma vez. Útil para modelos como o GPT-o3 que precisam de verificação da organização para streaming",
   "com_endpoint_disable_streaming_label": "Desativar Streaming",
+  "com_endpoint_effort": "Esforço",
   "com_endpoint_examples": "Presets",
   "com_endpoint_export": "Exportar",
   "com_endpoint_export_share": "Exportar/Compartilhar",
@@ -260,6 +275,7 @@
   "com_endpoint_google_temp": "Valores mais altos = mais aleatório, enquanto valores mais baixos = mais focado e determinístico. Recomendamos alterar isso ou Top P, mas não ambos.",
   "com_endpoint_google_thinking": "Habilita ou desabilita o pensamento. Essa opção é suportada apenas por certos modelos (série 2.5). Para modelos antigos, esta opção pode não ter efeito.",
   "com_endpoint_google_thinking_budget": "Dita o número de tokens de pensamento que o modelo usa. A quantidade atual pode exceder ou ficar abaixo desse valor dependendo do prompt.\n\nEssa configuração é suportada apenas por certos modelos (2.5 series). Gemini 2.5 Pro suporta 128-32,768 tokens. Gemini 2.5 Flash suporta 0-24,576 tokens. Gemini 2.5 Flash Lite suporta 512-24,576 tokens.\n\nDeixe em branco ou defina como \"-1\" para deixar que o modelo decida automaticamente quando e quanto pensar. Por padrão, o Gemini 2.5 Flash Lite não pensa.",
+  "com_endpoint_google_thinking_level": "Controla a profundidade do raciocínio para Gemini 3 e modelos posteriores. Não tem efeito no Gemini 2.5 e anteriores; use Thinking Budget para esses modelos.\n\nDeixe em Automático para usar o padrão do modelo.",
   "com_endpoint_google_topk": "Top-k altera como o modelo seleciona tokens para saída. Um top-k de 1 significa que o token selecionado é o mais provável entre todos os tokens no vocabulário do modelo (também chamado de decodificação gananciosa), enquanto um top-k de 3 significa que o próximo token é selecionado entre os 3 tokens mais prováveis (usando temperatura).",
   "com_endpoint_google_topp": "Top-p altera como o modelo seleciona tokens para saída. Os tokens são selecionados dos mais prováveis (veja o parâmetro topK) até os menos prováveis até que a soma de suas probabilidades atinja o valor top-p.",
   "com_endpoint_google_use_search_grounding": "Use o recurso de base de pesquisa do Google para aprimorar as respostas com resultados de pesquisa na web em tempo real. Isso permite que os modelos acessem informações atuais e forneçam respostas mais precisas e atualizadas.",
@@ -300,6 +316,7 @@
   "com_endpoint_preset_default_removed": "não é mais o preset padrão.",
   "com_endpoint_preset_delete_confirm": "Tem certeza de que deseja excluir este preset?",
   "com_endpoint_preset_delete_error": "Houve um erro ao excluir seu preset. Por favor, tente novamente.",
+  "com_endpoint_preset_delete_success": "Predefinição excluída com sucesso",
   "com_endpoint_preset_import": "Preset Importado!",
   "com_endpoint_preset_import_error": "Houve um erro ao importar seu preset. Por favor, tente novamente.",
   "com_endpoint_preset_name": "Nome do Preset",
@@ -318,37 +335,70 @@
   "com_endpoint_reasoning_summary": "Resumo do raciocínio",
   "com_endpoint_save_as_preset": "Salvar Como Preset",
   "com_endpoint_search": "Procurar endpoint por nome",
+  "com_endpoint_search_endpoint_models": "Pesquisar modelos de {{0}}...",
   "com_endpoint_search_models": "Buscar modelos...",
+  "com_endpoint_search_var": "Procurar {{0}}...",
   "com_endpoint_set_custom_name": "Defina um nome personalizado, caso você possa encontrar este preset",
   "com_endpoint_stop": "Sequências de Parada",
   "com_endpoint_stop_placeholder": "Separe os valores pressionando `Enter`",
   "com_endpoint_temperature": "Temperatura",
   "com_endpoint_thinking": "Pensamento",
   "com_endpoint_thinking_budget": "Pensar no orçamento",
+  "com_endpoint_thinking_level": "Nível de raciocínio",
   "com_endpoint_top_k": "Top K",
   "com_endpoint_top_p": "Top P",
   "com_endpoint_use_active_assistant": "Usar Assistente Ativo",
   "com_endpoint_use_responses_api": "Usar Responses API",
+  "com_endpoint_use_search_grounding": "Grounding com Pesquisa Google",
+  "com_endpoint_verbosity": "Verbosidade",
+  "com_error_endpoint_models_not_loaded": "Não foi possível carregar modelos para {{0}}. Atualize a página e tente novamente.",
   "com_error_expired_user_key": "A chave fornecida para {{0}} expirou em {{1}}. Por favor, forneça uma nova chave e tente novamente.",
   "com_error_files_dupe": "Foi detectado um arquivo duplicado.",
   "com_error_files_empty": "Pensamento",
   "com_error_files_process": "Ocorreu um erro ao processar o arquivo.",
   "com_error_files_upload": "Ocorreu um erro ao carregar o arquivo.",
   "com_error_files_upload_canceled": "O pedido de carregamento de arquivos foi cancelado. Nota: o carregamento de arquivo pode ainda estar a ser processado e terá de ser eliminado manualmente.",
+  "com_error_files_upload_too_large": "O arquivo é muito grande. Envie um arquivo menor que {{0}} MB",
   "com_error_files_validation": "Ocorreu um erro durante a validação do arquivo.",
+  "com_error_google_tool_conflict": "O uso de ferramentas integradas do Google não é compatível com ferramentas externas. Desative as ferramentas integradas ou as ferramentas externas.",
+  "com_error_heic_conversion": "Falha ao converter a imagem HEIC em JPEG. Tente converter a imagem manualmente ou use um formato diferente.",
+  "com_error_illegal_model_request": "O modelo \"{{0}}\" não está disponível para {{1}}. Selecione um modelo diferente.",
   "com_error_input_length": "A contagem de tokens da última mensagem é muito longa, excedendo o limite de tokens, ou seus parâmetros de limite de tokens estão configurados incorretamente, afetando negativamente a janela de contexto. Mais informações: {{0}}. Encurte sua mensagem, ajuste o tamanho máximo do contexto nos parâmetros da conversa ou bifurque a conversa para continuar.",
+  "com_error_invalid_agent_provider": "O provedor \"{{0}}\" não está disponível para uso com Agentes. Acesse as configurações do seu agente e selecione um provedor disponível no momento.",
+  "com_error_invalid_base_url": "O URL base que você forneceu tem como alvo um endereço restrito. Use um URL externo válido e tente novamente.",
   "com_error_invalid_user_key": "Chave fornecida inválida. Por favor, forneça uma chave válida e tente novamente.",
+  "com_error_missing_model": "Nenhum modelo selecionado para {{0}}. Selecione um modelo e tente novamente.",
+  "com_error_models_not_loaded": "A configuração dos modelos não pôde ser carregada. Atualize a página e tente novamente.",
   "com_error_moderation": "Parece que o conteúdo enviado foi sinalizado pelo nosso sistema de moderação por não estar alinhado com nossas diretrizes da comunidade. Não podemos prosseguir com este tópico específico. Se você tiver outras perguntas ou tópicos que gostaria de explorar, edite sua mensagem ou crie uma nova conversa.",
   "com_error_no_base_url": "Nenhuma URL base encontrada. Por favor, forneça uma e tente novamente.",
   "com_error_no_user_key": "Nenhuma chave encontrada. Por favor, forneça uma chave e tente novamente.",
+  "com_error_refusal": "Resposta recusada por filtros de segurança. Reescreva sua mensagem e tente novamente. Se você encontrar isso com frequência ao usar o Claude Sonnet 4.5 ou Opus 4.1, você pode tentar o Sonnet 4, que tem diferentes restrições de uso.",
+  "com_error_stream_expired": "O fluxo de resposta expirou ou já foi concluído. Por favor, tente novamente.",
+  "com_file_pages": "Páginas: {{pages}}",
+  "com_file_source": "Arquivo",
+  "com_file_unknown": "Arquivo desconhecido",
+  "com_files_download_failed": "Falha em {{0}} arquivos",
+  "com_files_download_percent_complete": "{{0}}% concluído",
+  "com_files_download_progress": "{{0}} de {{1}} arquivos",
+  "com_files_downloading": "Baixando arquivos",
   "com_files_filter": "Filtrar arquivos...",
+  "com_files_filter_by": "Filtrar arquivos por...",
   "com_files_no_results": "Nenhum resultado.",
   "com_files_number_selected": "{{0}} de {{1}} arquivo(s) selecionado(s)",
+  "com_files_preparing_download": "Preparando download...",
+  "com_files_result_found": "{{count}} resultado encontrado",
+  "com_files_results_found": "{{count}} resultados encontrados",
+  "com_files_sharepoint_picker_title": "Escolher arquivos",
   "com_files_table": "algo precisa ir aqui. esta vazio",
+  "com_files_upload_local_machine": "Do computador local",
+  "com_files_upload_sharepoint": "De SharePoint",
   "com_generated_files": "Arquivos gerados:",
   "com_hide_examples": "Ocultar Exemplos",
+  "com_info_heic_converting": "Convertendo imagem HEIC em JPEG...",
   "com_nav_2fa": "Autenticação de dois fatores (2FA)",
   "com_nav_account_settings": "Configurações da Conta",
+  "com_nav_advanced_prompts": "Editor de prompts avançados",
+  "com_nav_advanced_prompts_desc": "Habilite o controle de versão e produção para prompts",
   "com_nav_always_make_prod": "Sempre tornar novas versões produção",
   "com_nav_archive_created_at": "Data de Arquivamento",
   "com_nav_archive_name": "Nome",
@@ -357,28 +407,42 @@
   "com_nav_at_command_description": "Alternar comando \"@\" para alternar endpoints, modelos, predefinições, etc.",
   "com_nav_audio_play_error": "Erro ao reproduzir áudio: {{0}}",
   "com_nav_audio_process_error": "Erro ao processar áudio: {{0}}",
+  "com_nav_auto_expand_tools": "Expandir automaticamente detalhes das ferramentas",
   "com_nav_auto_scroll": "Rolagem Automática para a última mensagem ao abrir o chat",
   "com_nav_auto_send_prompts": "Enviar prompts automaticamente",
+  "com_nav_auto_send_prompts_desc": "Enviar prompt automaticamente para o chat quando selecionado",
   "com_nav_auto_send_text": "Enviar texto automaticamente",
   "com_nav_auto_transcribe_audio": "Transcrever áudio automaticamente",
   "com_nav_automatic_playback": "Reprodução Automática da Última Mensagem",
   "com_nav_balance": "Crédito",
+  "com_nav_balance_auto_refill_disabled": "A recarga automática está desativada.",
+  "com_nav_balance_auto_refill_error": "Erro ao carregar as configurações de recarga automática.",
+  "com_nav_balance_auto_refill_settings": "Configurações de recarga automática",
   "com_nav_balance_day": "dia",
   "com_nav_balance_days": "dias",
+  "com_nav_balance_every": "A cada",
   "com_nav_balance_hour": "hora",
   "com_nav_balance_hours": "horas",
+  "com_nav_balance_interval": "Intervalo:",
+  "com_nav_balance_last_refill": "Última recarga:",
   "com_nav_balance_minute": "minuto",
   "com_nav_balance_minutes": "minutos",
   "com_nav_balance_month": "mês",
   "com_nav_balance_months": "meses",
   "com_nav_balance_next_refill": "Próximo Reabastecimento:",
+  "com_nav_balance_next_refill_info": "A próxima recarga ocorrerá automaticamente somente quando ambas as condições forem atendidas: o intervalo definido tiver passado desde a última recarga e o envio de um prompt faria seu saldo cair abaixo de zero.",
+  "com_nav_balance_refill_amount": "Quantidade de recarga:",
   "com_nav_balance_second": "segundo",
   "com_nav_balance_seconds": "segundos",
+  "com_nav_balance_week": "semana",
+  "com_nav_balance_weeks": "semanas",
   "com_nav_browser": "Navegador",
+  "com_nav_center_chat_input": "Centralizar entrada do chat na tela de boas-vindas",
   "com_nav_change_picture": "Mudar foto",
   "com_nav_chat_commands": "Comandos do chat",
   "com_nav_chat_commands_info": "Estes comandos são ativados digitando caracteres específicos no início da sua mensagem. Cada comando é acionado pelo seu prefixo designado. Pode desativá-los se utilizar frequentemente estes caracteres para iniciar mensagens.",
   "com_nav_chat_direction": "Direção do chat",
+  "com_nav_chat_direction_selected": "Direção do chat: {{direction}}",
   "com_nav_clear_all_chats": "Limpar todos os chats",
   "com_nav_clear_cache_confirm_message": "Tem a certeza de que quer limpar a cache?",
   "com_nav_clear_conversation": "Limpar conversas",
@@ -386,9 +450,11 @@
   "com_nav_close_sidebar": "Fechar barra lateral",
   "com_nav_commands": "Comandos",
   "com_nav_confirm_clear": "Confirmar Limpeza",
+  "com_nav_control_panel": "Painel de controle",
   "com_nav_conversation_mode": "Modo de Conversa",
   "com_nav_convo_menu_options": "Opções do Menu de Conversa",
   "com_nav_db_sensitivity": "Sensibilidade de decibéis",
+  "com_nav_default_temporary_chat": "Chat temporário por padrão",
   "com_nav_delete_account": "Excluir conta",
   "com_nav_delete_account_button": "Excluir minha conta permanentemente",
   "com_nav_delete_account_confirm": "Excluir conta - você tem certeza?",
@@ -417,22 +483,29 @@
   "com_nav_font_size_xl": "Extra Grande",
   "com_nav_font_size_xs": "Extra Pequeno",
   "com_nav_help_faq": "Ajuda & FAQ",
+  "com_nav_info_balance": "O saldo mostra quantos créditos de token você ainda tem para usar. Os créditos de token são convertidos em valor monetário (por exemplo, 1.000 créditos = US$ 0,001)",
   "com_nav_info_code_artifacts": "Habilita a exibição de artefatos de código experimental ao lado do chat",
   "com_nav_info_code_artifacts_agent": "Ativa a utilização de artefatos de código para este agente. Por predefinição, são adicionadas instruções adicionais específicas para a utilização de artefatos, a menos que o \"Modo de aviso personalizado\" esteja ativado.",
   "com_nav_info_custom_prompt_mode": "Quando habilitado, o prompt padrão do sistema de artefatos não será incluído. Todas as instruções de geração de artefatos devem ser fornecidas manualmente neste modo.",
+  "com_nav_info_default_temporary_chat": "Quando ativado, novos chats começarão com o modo de chat temporário ativado por padrão. Os chats temporários não são salvos no seu histórico.",
   "com_nav_info_enter_to_send": "Quando habilitado, pressionar `ENTER` enviará sua mensagem. Quando desabilitado, pressionar Enter adicionará uma nova linha, e você precisará pressionar `CTRL + ENTER` / `⌘ + ENTER` para enviar sua mensagem.",
   "com_nav_info_fork_change_default": "`Apenas mensagens visíveis` inclui apenas o caminho direto para a mensagem selecionada. `Incluir ramos relacionados` adiciona ramos ao longo do caminho. `Incluir tudo de/para aqui` inclui todas as mensagens e ramos conectados.",
   "com_nav_info_fork_split_target_setting": "Quando habilitado, a bifurcação começará da mensagem alvo até a última mensagem na conversa, de acordo com o comportamento selecionado.",
   "com_nav_info_include_shadcnui": "Quando habilitado, as instruções para usar componentes shadcn/ui serão incluídas. shadcn/ui é uma coleção de componentes reutilizáveis construídos usando Radix UI e Tailwind CSS. Nota: estas são instruções longas, você deve habilitar apenas se for importante informar o LLM sobre as importações e componentes corretos. Para mais informações sobre esses componentes, visite: https://ui.shadcn.com/",
   "com_nav_info_latex_parsing": "Quando habilitado, o código LaTeX nas mensagens será renderizado como equações matemáticas. Desabilitar isso pode melhorar o desempenho se você não precisar de renderização LaTeX.",
+  "com_nav_info_save_badges_state": "Quando ativado, o estado dos emblemas do chat será salvo. Isso significa que se você criar um novo chat, os emblemas permanecerão no mesmo estado do chat anterior. Se você desabilitar esta opção, os emblemas serão redefinidos para o estado padrão sempre que você criar um novo chat",
   "com_nav_info_save_draft": "Quando habilitado, o texto e os anexos que você inserir no formulário de chat serão salvos automaticamente localmente como rascunhos. Esses rascunhos estarão disponíveis mesmo se você recarregar a página ou mudar para uma conversa diferente. Os rascunhos são armazenados localmente no seu dispositivo e são excluídos uma vez que a mensagem é enviada.",
   "com_nav_info_show_thinking": "Quando ativado, o chat apresentará os menus pendentes de raciocínio abertos por predefinição, permitindo-lhe ver o raciocínio da IA em tempo real. Quando desativado, os menus suspensos de raciocínio permanecerão fechados por predefinição para uma interface mais limpa e simplificada",
   "com_nav_info_user_name_display": "Quando habilitado, o nome de usuário do remetente será mostrado acima de cada mensagem que você enviar. Quando desabilitado, você verá apenas \"Você\" acima de suas mensagens.",
+  "com_nav_keep_screen_awake": "Manter a tela acordada durante a geração da resposta",
   "com_nav_lang_arabic": "العربية",
   "com_nav_lang_armenian": "Armênio",
   "com_nav_lang_auto": "Detecção automática",
+  "com_nav_lang_bosnian": "Босански",
   "com_nav_lang_brazilian_portuguese": "Português Brasileiro",
+  "com_nav_lang_catalan": "Català",
   "com_nav_lang_chinese": "中文",
+  "com_nav_lang_czech": "Čeština",
   "com_nav_lang_danish": "Dinamarquês",
   "com_nav_lang_dutch": "Nederlands",
   "com_nav_lang_english": "English",
@@ -442,26 +515,53 @@
   "com_nav_lang_georgian": "Georgiano",
   "com_nav_lang_german": "Deutsch",
   "com_nav_lang_hebrew": "עברית",
+  "com_nav_lang_hungarian": "Magyar",
+  "com_nav_lang_icelandic": "Íslenska",
   "com_nav_lang_indonesia": "Indonesia",
   "com_nav_lang_italian": "Italiano",
   "com_nav_lang_japanese": "日本語",
   "com_nav_lang_korean": "한국어",
+  "com_nav_lang_latvian": "Latviski",
+  "com_nav_lang_lithuanian": "Lietuvių",
+  "com_nav_lang_norwegian_bokmal": "Norsk Bokmål",
+  "com_nav_lang_norwegian_nynorsk": "Norsk Nynorsk",
+  "com_nav_lang_persian": "فارسی",
   "com_nav_lang_polish": "Polski",
   "com_nav_lang_portuguese": "Português",
   "com_nav_lang_russian": "Русский",
+  "com_nav_lang_slovak": "Slovenčina",
+  "com_nav_lang_slovenian": "Slovenščina",
   "com_nav_lang_spanish": "Español",
   "com_nav_lang_swedish": "Svenska",
   "com_nav_lang_thai": "Tailandês",
+  "com_nav_lang_tibetan": "བོད་སྐད་",
   "com_nav_lang_traditional_chinese": "繁體中文",
   "com_nav_lang_turkish": "Türkçe",
+  "com_nav_lang_ukrainian": "Українська",
+  "com_nav_lang_uyghur": "Uyƣur tili",
   "com_nav_lang_vietnamese": "Tiếng Việt",
   "com_nav_language": "Idioma",
   "com_nav_latex_parsing": "Análise de LaTeX em mensagens (pode afetar o desempenho)",
   "com_nav_log_out": "Sair",
   "com_nav_long_audio_warning": "Textos mais longos levarão mais tempo para processar.",
   "com_nav_maximize_chat_space": "Maximizar o espaço de conversa",
+  "com_nav_mcp_access_revoked": "Acesso ao servidor MCP revogado com sucesso.",
+  "com_nav_mcp_configure_server": "Configurar {{0}}",
+  "com_nav_mcp_connect": "Conectar",
+  "com_nav_mcp_connect_server": "Conectar {{0}}",
+  "com_nav_mcp_reconnect": "Reconectar",
+  "com_nav_mcp_status_connected": "Conectado",
+  "com_nav_mcp_status_connecting": "{{0}} - Conectando",
+  "com_nav_mcp_status_disconnected": "Desconectado",
+  "com_nav_mcp_status_error": "Erro",
+  "com_nav_mcp_status_initializing": "Inicializando",
+  "com_nav_mcp_status_needs_auth": "Precisa de autenticação",
+  "com_nav_mcp_status_unknown": "Desconhecido",
+  "com_nav_mcp_vars_update_error": "Erro ao atualizar variáveis personalizadas de usuário do MCP",
+  "com_nav_mcp_vars_updated": "Variáveis personalizadas de usuário do MCP atualizadas com sucesso.",
   "com_nav_modular_chat": "Habilitar troca de Endpoints no meio da conversa",
   "com_nav_my_files": "Meus Arquivos",
+  "com_nav_new_chat_switch_to_history": "Mudar para o histórico de chat em um novo chat",
   "com_nav_not_supported": "Não Suportado",
   "com_nav_open_sidebar": "Abrir barra lateral",
   "com_nav_playback_rate": "Taxa de Reprodução de Áudio",
@@ -469,6 +569,7 @@
   "com_nav_plus_command": "Comando +",
   "com_nav_plus_command_description": "Alternar comando \"+\" para adicionar uma configuração de resposta múltipla",
   "com_nav_profile_picture": "Foto de Perfil",
+  "com_nav_save_badges_state": "Salvar estado dos emblemas",
   "com_nav_save_drafts": "Salvar rascunhos localmente",
   "com_nav_scroll_button": "Ir para o botão final",
   "com_nav_search_placeholder": "Buscar mensagens",
@@ -477,7 +578,10 @@
   "com_nav_setting_balance": "Créditos",
   "com_nav_setting_chat": "Chat",
   "com_nav_setting_data": "Controles de dados",
+  "com_nav_setting_delay": "Atraso(s)",
   "com_nav_setting_general": "Geral",
+  "com_nav_setting_mcp": "Configurações MCP",
+  "com_nav_setting_personalization": "Personalização",
   "com_nav_setting_speech": "Fala",
   "com_nav_settings": "Configurações",
   "com_nav_shared_links": "Links compartilhados",
@@ -494,6 +598,7 @@
   "com_nav_tool_dialog": "Ferramentas do Assistente",
   "com_nav_tool_dialog_agents": "Ferramentas do agente",
   "com_nav_tool_dialog_description": "O assistente deve ser salvo para persistir as seleções de ferramentas.",
+  "com_nav_tool_dialog_mcp_server_tools": "Ferramentas do servidor MCP",
   "com_nav_tool_remove": "Remover",
   "com_nav_tool_search": "Buscar ferramentas",
   "com_nav_user": "USUÁRIO",
@@ -508,7 +613,24 @@
   "com_sidepanel_hide_panel": "Ocultar Painel",
   "com_sidepanel_manage_files": "Gerenciar Arquivos",
   "com_sidepanel_parameters": "Parâmetros",
+  "com_sources_agent_file": "Documento de origem",
+  "com_sources_agent_files": "Arquivos do agente",
+  "com_sources_download_aria_label": "Baixar {{filename}}{{status}}",
+  "com_sources_download_failed": "Falha no download",
+  "com_sources_download_local_unavailable": "Não é possível baixar: o arquivo não foi salvo",
+  "com_sources_downloading_status": "(baixando...)",
+  "com_sources_error_fallback": "Não foi possível carregar fontes",
+  "com_sources_image_alt": "Imagem do resultado da pesquisa",
+  "com_sources_more_files": "+{{count}} arquivos",
+  "com_sources_more_sources": "+{{count}} fontes",
+  "com_sources_pages": "Páginas",
+  "com_sources_region_label": "Resultados e fontes da pesquisa",
+  "com_sources_reload_page": "Recarregar página",
+  "com_sources_tab_all": "Todos",
+  "com_sources_tab_files": "Arquivos",
   "com_sources_tab_images": "Imagens",
+  "com_sources_tab_news": "Notícias",
+  "com_sources_title": "Fontes",
   "com_ui_2fa_account_security": "A autenticação de dois fatores acrescenta uma camada extra de segurança à sua conta",
   "com_ui_2fa_disable": "Desabilitar 2FA",
   "com_ui_2fa_disable_error": "Ocorreu um erro ao desativar a autenticação de dois fatores",
@@ -518,42 +640,103 @@
   "com_ui_2fa_generate_error": "Ocorreu um erro ao gerar as configurações de autenticação de dois fatores",
   "com_ui_2fa_invalid": "Código de autenticação de dois fatores inválido",
   "com_ui_2fa_setup": "Configurar 2FA",
+  "com_ui_2fa_verification_required": "Digite seu código 2FA para continuar",
   "com_ui_2fa_verified": "Autenticação de dois fatores verificada com sucesso",
   "com_ui_accept": "Eu aceito",
+  "com_ui_action_button": "Botão de ação",
   "com_ui_active": "Ativo",
   "com_ui_add": "Adicionar",
+  "com_ui_add_first_bookmark": "Clique em um chat para adicionar um",
+  "com_ui_add_first_mcp_server": "Crie seu primeiro servidor MCP para começar",
+  "com_ui_add_first_prompt": "Crie seu primeiro prompt para começar",
+  "com_ui_add_labels": "Adicionar rótulos",
   "com_ui_add_mcp": "Adicionar MCP",
   "com_ui_add_mcp_server": "Adicionar Servidor MCP",
   "com_ui_add_model_preset": "Adicionar um modelo ou predefinição para uma resposta adicional",
   "com_ui_add_multi_conversation": "Adicionar multi-conversação",
+  "com_ui_add_special_variables": "Adicionar variáveis especiais",
+  "com_ui_add_web_search_api_keys": "Adicionar chaves de API de pesquisa na web",
+  "com_ui_adding_details": "Adicionando detalhes",
+  "com_ui_additional_details": "Detalhes adicionais",
   "com_ui_admin": "Admin",
   "com_ui_admin_access_warning": "Desabilitar o acesso de Admin a esse recurso pode causar problemas inesperados na IU que exigem atualização. Se salvo, a única maneira de reverter é por meio da configuração de interface na configuração librechat.yaml que afeta todas as funções.",
   "com_ui_admin_settings": "Configurações de Admin",
+  "com_ui_admin_settings_section": "Configurações de administrador - {{section}}",
   "com_ui_advanced": "Avançado",
   "com_ui_advanced_settings": "Opções Avançadas",
   "com_ui_agent": "Agente",
+  "com_ui_agent_api_keys": "Chaves de API do agente",
+  "com_ui_agent_api_keys_description": "Crie chaves de API para acessar agentes remotamente pela API",
+  "com_ui_agent_category_aftersales": "Pós-venda",
+  "com_ui_agent_category_finance": "Finanças",
+  "com_ui_agent_category_general": "Geral",
+  "com_ui_agent_category_hr": "RH",
+  "com_ui_agent_category_it": "TI",
+  "com_ui_agent_category_rd": "P&D",
+  "com_ui_agent_category_sales": "Vendas",
+  "com_ui_agent_category_selector_aria": "Seletor de categoria do agente",
+  "com_ui_agent_chain": "Cadeia de Agentes (Mixture-of-Agents)",
+  "com_ui_agent_chain_info": "Permite criar sequências de agentes. Cada agente pode acessar saídas dos agentes anteriores na cadeia. Baseado na arquitetura \"Mixture-of-Agents\", em que agentes usam saídas anteriores como informações auxiliares.",
+  "com_ui_agent_chain_max": "Você atingiu o máximo de {{0}} agentes.",
   "com_ui_agent_delete_error": "Houve um erro ao excluir o agente",
   "com_ui_agent_deleted": "Agente excluído com sucesso",
   "com_ui_agent_duplicate_error": "Ocorreu um erro ao duplicar o agente",
   "com_ui_agent_duplicated": "Agente duplicado com sucesso",
+  "com_ui_agent_handoff_add": "Adicionar agente de transferência",
+  "com_ui_agent_handoff_description": "Descrição da transferência",
+  "com_ui_agent_handoff_description_placeholder": "ex.: Transferir para analista de dados para análise estatística",
+  "com_ui_agent_handoff_info": "Configure agentes para os quais esse agente possa transferir conversas quando for necessária experiência específica.",
+  "com_ui_agent_handoff_info_2": "Cada transferência cria uma ferramenta de transferência que permite o roteamento contínuo para agentes especializados com contexto.",
+  "com_ui_agent_handoff_max": "Máximo de agentes de transferência {{0}} atingido.",
+  "com_ui_agent_handoff_prompt": "Conteúdo repassado",
+  "com_ui_agent_handoff_prompt_key": "Nome do parâmetro de conteúdo (padrão: 'instructions')",
+  "com_ui_agent_handoff_prompt_key_placeholder": "Nomeie o conteúdo repassado (padrão: 'instructions')",
+  "com_ui_agent_handoff_prompt_placeholder": "Diga a este agente qual conteúdo gerar e passar para o agente de transferência. Você precisa adicionar algo aqui para ativar este recurso",
+  "com_ui_agent_handoffs": "Transferências de agente",
+  "com_ui_agent_name_is_required": "O nome do agente é obrigatório",
+  "com_ui_agent_recursion_limit": "Máximo de etapas do agente",
+  "com_ui_agent_recursion_limit_info": "Limita quantas etapas o agente pode executar em uma rodada antes de fornecer uma resposta final. O padrão é 25 etapas. Uma etapa é uma solicitação à API de IA ou uma rodada de uso de ferramenta. Por exemplo, uma interação básica com ferramenta usa 3 etapas: solicitação inicial, uso da ferramenta e solicitação de acompanhamento.",
+  "com_ui_agent_url_copied": "URL do agente copiada para a área de transferência",
+  "com_ui_agent_var": "Agente {{0}}",
   "com_ui_agent_version": "Versão",
   "com_ui_agent_version_active": "Versão Ativa",
   "com_ui_agent_version_empty": "Não há versões disponíveis",
+  "com_ui_agent_version_error": "Erro ao buscar versões",
   "com_ui_agent_version_history": "Histórico de Versões",
+  "com_ui_agent_version_no_agent": "Nenhum agente selecionado. Selecione um agente para visualizar o histórico de versões.",
   "com_ui_agent_version_no_date": "Data não disponível",
+  "com_ui_agent_version_restore": "Restaurar",
+  "com_ui_agent_version_restore_confirm": "Tem certeza de que deseja restaurar esta versão?",
+  "com_ui_agent_version_restore_error": "Falha ao restaurar a versão",
+  "com_ui_agent_version_restore_success": "Versão restaurada com sucesso",
+  "com_ui_agent_version_title": "Versão {{versionNumber}}",
   "com_ui_agent_version_unknown_date": "Data desconhecida",
   "com_ui_agents": "Agentes",
   "com_ui_agents_allow_create": "Permitir a criação de agentes",
+  "com_ui_agents_allow_share": "Permitir compartilhamento de agentes",
+  "com_ui_agents_allow_share_public": "Permitir o compartilhamento público de Agentes",
   "com_ui_agents_allow_use": "Permitir o uso de agentes",
   "com_ui_all": "todos",
   "com_ui_all_proper": "Todos",
   "com_ui_analyzing": "Analisando",
   "com_ui_analyzing_finished": "Análise concluída",
   "com_ui_api_key": "Chave API",
+  "com_ui_api_key_copied": "Chave de API copiada para a área de transferência",
+  "com_ui_api_key_create_error": "Falha ao criar a chave de API",
+  "com_ui_api_key_created": "Chave de API criada com sucesso",
+  "com_ui_api_key_delete_error": "Falha ao excluir a chave de API",
+  "com_ui_api_key_deleted": "Chave de API excluída com sucesso",
+  "com_ui_api_key_name": "Nome da chave",
+  "com_ui_api_key_name_placeholder": "Minha chave de API",
+  "com_ui_api_key_name_required": "O nome da chave de API é obrigatório",
+  "com_ui_api_key_warning": "Copie sua chave de API agora. Você não poderá vê-la novamente!",
+  "com_ui_api_keys_load_error": "Falha ao carregar chaves de API",
   "com_ui_archive": "Arquivar",
+  "com_ui_archive_delete_error": "Falha ao excluir conversa arquivada",
   "com_ui_archive_error": "Falha ao arquivar conversa",
   "com_ui_artifact_click": "Clique para abrir",
   "com_ui_artifacts": "Artefatos",
+  "com_ui_artifacts_options": "Opções de artefatos",
   "com_ui_artifacts_toggle": "Alternar UI de Artefatos",
   "com_ui_artifacts_toggle_agent": "Habilitar artefatos",
   "com_ui_ascending": "Asc",
@@ -562,9 +745,13 @@
   "com_ui_assistant_deleted": "Assistente excluído com sucesso",
   "com_ui_assistants": "Assistentes",
   "com_ui_assistants_output": "Saída dos Assistentes",
+  "com_ui_at_least_one_owner_required": "É necessário pelo menos um proprietário",
   "com_ui_attach_error": "Não é possível anexar o arquivo. Crie ou selecione uma conversa, ou tente atualizar a página.",
+  "com_ui_attach_error_disabled": "Os uploads de arquivos estão desativados para este endpoint",
+  "com_ui_attach_error_limit": "Limite de arquivos atingido:",
   "com_ui_attach_error_openai": "Não é possível anexar arquivos de Assistente a outros endpoints",
   "com_ui_attach_error_size": "Limite de tamanho de arquivo excedido para o endpoint:",
+  "com_ui_attach_error_total_size": "Limite total de tamanho de arquivo excedido para endpoint:",
   "com_ui_attach_error_type": "Tipo de arquivo não suportado para o endpoint:",
   "com_ui_attach_remove": "Remover arquivo",
   "com_ui_attach_warn_endpoint": "Arquivos não compatíveis podem ser ignorados sem uma ferramenta compatível",
@@ -574,19 +761,29 @@
   "com_ui_authenticate": "Autenticar",
   "com_ui_authentication": "Autenticação",
   "com_ui_authentication_type": "Tipo de Autenticação",
+  "com_ui_auto": "Auto",
+  "com_ui_available_options": "Opções disponíveis",
   "com_ui_avatar": "Avatar",
   "com_ui_azure": "Azure",
+  "com_ui_azure_ad": "Entra ID",
+  "com_ui_back": "Voltar",
+  "com_ui_back_to_builder": "Voltar ao construtor",
   "com_ui_back_to_prompts": "Voltar aos Prompts",
+  "com_ui_backup_code_number": "Código #{{number}}",
   "com_ui_backup_codes": "Códigos de Backup",
   "com_ui_backup_codes_regenerate_error": "Ocorreu um erro ao regerar os códigos de backup",
   "com_ui_backup_codes_regenerated": "Os códigos de backup foram regerados com sucesso",
+  "com_ui_backup_codes_security_info": "Por motivos de segurança, os códigos de backup são exibidos apenas uma vez quando gerados. Guarde-os em um local seguro.",
+  "com_ui_backup_codes_status": "Status dos códigos de backup",
   "com_ui_basic": "Básico",
   "com_ui_basic_auth_header": "Cabeçalho de autorização básico",
   "com_ui_bearer": "Portador",
+  "com_ui_beta": "Beta",
   "com_ui_bookmark_delete_confirm": "Tem certeza de que deseja excluir este favorito?",
   "com_ui_bookmarks": "Favoritos",
   "com_ui_bookmarks_add": "Adicionar marcadores",
   "com_ui_bookmarks_add_to_conversation": "Adicionar à conversa atual",
+  "com_ui_bookmarks_count_selected": "Favoritos, {{count}} selecionados",
   "com_ui_bookmarks_create_error": "Houve um erro ao criar o favorito",
   "com_ui_bookmarks_create_exists": "Este favorito já existe",
   "com_ui_bookmarks_create_success": "Favorito criado com sucesso",
@@ -597,49 +794,98 @@
   "com_ui_bookmarks_edit": "Editar marcadores",
   "com_ui_bookmarks_filter": "Filtrar favoritos...",
   "com_ui_bookmarks_new": "Novo Favorito",
+  "com_ui_bookmarks_tag_exists": "Já existe um marcador com este título",
   "com_ui_bookmarks_title": "Título",
   "com_ui_bookmarks_update_error": "Houve um erro ao atualizar o favorito",
   "com_ui_bookmarks_update_success": "Favorito atualizado com sucesso",
+  "com_ui_branch_created": "Branch criado com sucesso",
+  "com_ui_branch_error": "Falha ao criar branch",
+  "com_ui_branch_message": "Criar branch a partir desta resposta",
+  "com_ui_by_author": "por {{0}}",
   "com_ui_callback_url": "URL de retorno de chamada",
   "com_ui_cancel": "Cancelar",
   "com_ui_cancelled": "Cancelado",
   "com_ui_category": "Categoria",
+  "com_ui_change_version": "Alterar versão",
   "com_ui_chat": "Chat",
   "com_ui_chat_history": "Histórico de Chat",
+  "com_ui_chats": "Chats",
+  "com_ui_check_internet": "Verifique sua conexão com a internet",
   "com_ui_clear": "Limpar",
   "com_ui_clear_all": "Limpar tudo",
+  "com_ui_clear_browser_cache": "Limpe o cache do seu navegador",
+  "com_ui_clear_presets": "Limpar predefinições",
+  "com_ui_clear_search": "Limpar pesquisa",
+  "com_ui_click_to_close": "Clique para fechar",
+  "com_ui_click_to_edit": "Clique para editar",
+  "com_ui_click_to_view_var": "Clique para visualizar {{0}}",
   "com_ui_client_id": "ID do cliente",
   "com_ui_client_secret": "Segredo do cliente",
   "com_ui_close": "Fechar",
   "com_ui_close_menu": "Fechar Menu",
+  "com_ui_close_settings": "Fechar configurações",
+  "com_ui_close_var": "Fechar {{0}}",
   "com_ui_close_window": "Fechar Janela",
   "com_ui_code": "Código",
+  "com_ui_collapse": "Recolher",
   "com_ui_collapse_chat": "Recolher bate-papo",
+  "com_ui_collapse_summary": "Recolher Resumo",
+  "com_ui_collapse_thoughts": "Recolher pensamentos",
   "com_ui_command_placeholder": "Opcional: Insira um comando para o prompt ou o nome será usado.",
   "com_ui_command_usage_placeholder": "Selecione um Prompt por comando ou nome",
+  "com_ui_complete": "Concluído!",
   "com_ui_complete_setup": "Configuração completa",
+  "com_ui_concise": "Conciso",
+  "com_ui_configure": "Configurar",
+  "com_ui_configure_mcp_variables_for": "Configurar variáveis para {{0}}",
+  "com_ui_confirm": "Confirmar",
   "com_ui_confirm_action": "Confirmar Ação",
   "com_ui_confirm_admin_use_change": "Alterar esta configuração bloqueará o acesso para administradores, incluindo você. Tem certeza de que deseja prosseguir?",
   "com_ui_confirm_change": "Confirmar alteração",
   "com_ui_connecting": "Conectando",
+  "com_ui_contact_admin_if_issue_persists": "Entre em contato com o administrador se o problema persistir",
   "com_ui_context": "Contexto",
+  "com_ui_context_filter_sort": "Filtrar e classificar por contexto",
   "com_ui_continue": "Continuar",
   "com_ui_continue_oauth": "Continuar com OAuth",
+  "com_ui_control_bar": "Barra de controle",
+  "com_ui_conversation": "conversa",
+  "com_ui_conversation_label": "Conversa {{title}}",
+  "com_ui_conversation_not_found": "Conversa não encontrada",
+  "com_ui_conversation_summarized": "Conversa resumida",
+  "com_ui_conversations": "conversas",
+  "com_ui_convo_archived": "Conversa arquivada",
   "com_ui_convo_delete_error": "Falha ao excluir conversa",
+  "com_ui_convo_delete_success": "Conversa excluída com sucesso",
   "com_ui_copied": "Copiado!",
   "com_ui_copied_to_clipboard": "Copiado para a área de transferência",
+  "com_ui_copy": "Copiar",
   "com_ui_copy_code": "Copiar código",
+  "com_ui_copy_failed": "Falha ao copiar para a área de transferência",
   "com_ui_copy_link": "Copiar link",
+  "com_ui_copy_stack_trace": "Copiar rastreamento de pilha",
+  "com_ui_copy_summary": "Copiar resumo para a área de transferência",
+  "com_ui_copy_thoughts_to_clipboard": "Copiar raciocínios para a área de transferência",
   "com_ui_copy_to_clipboard": "Copiar para a área de transferência",
+  "com_ui_copy_url_to_clipboard": "Copiar URL para a área de transferência",
   "com_ui_create": "Criar",
+  "com_ui_create_api_key": "Criar chave de API",
+  "com_ui_create_assistant": "Criar assistente",
   "com_ui_create_link": "Criar link",
+  "com_ui_create_mcp_server": "Criar servidor MCP",
   "com_ui_create_memory": "Criar Memória",
+  "com_ui_create_new_agent": "Criar novo agente",
   "com_ui_create_prompt": "Criar Prompt",
+  "com_ui_create_prompt_page": "Nova página de configuração de prompt",
+  "com_ui_created": "Criado",
+  "com_ui_creating": "Criando...",
   "com_ui_creating_image": "Criando a imagem. Pode levar algum tempo",
+  "com_ui_current": "Atual",
   "com_ui_currently_production": "Atualmente em produção",
   "com_ui_custom": "Personalizado",
   "com_ui_custom_header_name": "Nome do cabeçalho personalizado",
   "com_ui_custom_prompt_mode": "Modo de Prompt Personalizado",
+  "com_ui_dark_theme_enabled": "Tema escuro ativado",
   "com_ui_date": "Data",
   "com_ui_date_april": "Abril",
   "com_ui_date_august": "Agosto",
@@ -655,6 +901,7 @@
   "com_ui_date_previous_30_days": "Últimos 30 dias",
   "com_ui_date_previous_7_days": "Últimos 7 dias",
   "com_ui_date_september": "Setembro",
+  "com_ui_date_sort": "Classificar por data",
   "com_ui_date_today": "Hoje",
   "com_ui_date_yesterday": "Ontem",
   "com_ui_decline": "Eu não aceito",
@@ -662,67 +909,113 @@
   "com_ui_delete": "Excluir",
   "com_ui_delete_action": "Excluir Ação",
   "com_ui_delete_action_confirm": "Tem certeza de que deseja excluir esta ação?",
+  "com_ui_delete_agent": "Excluir agente",
   "com_ui_delete_agent_confirm": "Tem certeza de que deseja excluir este agente?",
+  "com_ui_delete_assistant": "Excluir assistente",
   "com_ui_delete_assistant_confirm": "Tem certeza de que deseja excluir este Assistente? Isso não pode ser desfeito.",
   "com_ui_delete_confirm": "Isso excluirá",
   "com_ui_delete_confirm_prompt_version_var": "Isso excluirá a versão selecionada para \"{{0}}\". Se não houver outras versões, o prompt será excluído.",
+  "com_ui_delete_confirm_strong": "Isso excluirá <strong>{{title}}</strong>",
   "com_ui_delete_conversation": "Excluir chat?",
+  "com_ui_delete_conversation_tooltip": "Excluir conversa",
+  "com_ui_delete_mcp_server": "Excluir servidor MCP?",
+  "com_ui_delete_mcp_server_name": "Excluir servidor MCP {{0}}",
   "com_ui_delete_memory": "Remover Memória",
+  "com_ui_delete_not_allowed": "A operação de exclusão não é permitida",
+  "com_ui_delete_preset": "Excluir predefinição?",
   "com_ui_delete_prompt": "Excluir Prompt?",
   "com_ui_delete_shared_link": "Excluir link compartilhado?",
+  "com_ui_delete_shared_link_heading": "Excluir link compartilhado",
   "com_ui_delete_success": "Removido com sucesso",
   "com_ui_delete_tool": "Excluir Ferramenta",
   "com_ui_delete_tool_confirm": "Tem certeza de que deseja excluir esta ferramenta?",
+  "com_ui_delete_tool_save_reminder": "Ferramenta removida. Salve o agente para aplicar as alterações.",
   "com_ui_deleted": "Removido",
+  "com_ui_deleting": "Excluindo...",
   "com_ui_deleting_file": "Removendo arquivo...",
+  "com_ui_deploy": "Implantar",
   "com_ui_descending": "Desc",
   "com_ui_description": "Descrição",
   "com_ui_description_placeholder": "Opcional: Insira uma descrição para exibir para o prompt",
+  "com_ui_deselect_all": "Desmarcar tudo",
   "com_ui_detailed": "Detalhado",
+  "com_ui_details": "Detalhes",
   "com_ui_disabling": "Desativando...",
+  "com_ui_done": "Feito",
   "com_ui_download": "Download",
   "com_ui_download_artifact": "Download artefato",
   "com_ui_download_backup": "Baixar códigos de backup",
   "com_ui_download_backup_tooltip": "Antes de continuar, baixe seus códigos de backup. Você precisará deles para recuperar o acesso se perder seu dispositivo autenticador",
   "com_ui_download_error": "Erro ao baixar o arquivo. O arquivo pode ter sido excluído.",
+  "com_ui_download_error_logs": "Baixar registros de erros",
   "com_ui_drag_drop": "Arraste arquivos aqui para anexá-los",
   "com_ui_dropdown_variables": "Variáveis de dropdown:",
   "com_ui_duplicate": "Duplicado",
+  "com_ui_duplicate_agent": "Agente duplicado",
   "com_ui_duplication_error": "Ocorreu um erro ao duplicar a conversa",
   "com_ui_duplication_processing": "Duplicando conversa...",
   "com_ui_duplication_success": "Conversa duplicada com sucesso",
   "com_ui_edit": "Editar",
+  "com_ui_edit_editing_image": "Editando imagem",
   "com_ui_edit_mcp_server": "Editar Servidor MCP",
+  "com_ui_edit_mcp_server_dialog_description": "Identificador exclusivo do servidor: {{serverName}}",
   "com_ui_edit_memory": "Editar Memória",
+  "com_ui_edit_preset_title": "Editar predefinição - {{title}}",
+  "com_ui_edit_prompt_page": "Editar página de prompt",
+  "com_ui_editable_message": "Mensagem editável",
+  "com_ui_editor_instructions": "Arraste a imagem para reposicionar • Use o controle deslizante de zoom ou botões para ajustar o tamanho",
   "com_ui_empty_category": "-",
   "com_ui_endpoint": "Endpoint",
   "com_ui_endpoint_menu": "Menu endpoint LLM",
   "com_ui_enter": "Entrar",
   "com_ui_enter_api_key": "Insira a chave da API",
+  "com_ui_enter_description": "Insira a descrição (opcional)",
   "com_ui_enter_key": "Inserir chave",
+  "com_ui_enter_name": "Digite o nome",
   "com_ui_enter_openapi_schema": "Insira seu esquema OpenAPI aqui",
   "com_ui_enter_value": "Inserir valor",
   "com_ui_error": "Erro",
   "com_ui_error_connection": "Erro ao conectar ao servidor, tente atualizar a página.",
+  "com_ui_error_message_prefix": "Mensagem de erro:",
   "com_ui_error_save_admin_settings": "Houve um erro ao salvar suas configurações de admin.",
+  "com_ui_error_try_following_prefix": "Por favor, tente um dos seguintes",
+  "com_ui_error_unexpected": "Ops! Algo inesperado aconteceu",
   "com_ui_error_updating_preferences": "Erro ao atualizar preferências",
+  "com_ui_everyone_permission_level": "Nível de permissão de todos",
   "com_ui_examples": "Exemplos",
+  "com_ui_expand": "Expandir",
   "com_ui_expand_chat": "Expandir Chat",
+  "com_ui_expand_thoughts": "Expandir pensamentos",
   "com_ui_export_convo_modal": "Exportar Modal de Conversação",
+  "com_ui_failed": "Falhou",
   "com_ui_feedback_more": "Mais...",
   "com_ui_feedback_more_information": "Fornecer feedback adicional",
   "com_ui_feedback_negative": "Precisa de melhorias",
   "com_ui_feedback_placeholder": "Por favor, forneça qualquer feedback adicional aqui",
   "com_ui_feedback_positive": "Amei isso",
   "com_ui_feedback_tag_accurate_reliable": "Preciso e confiável",
+  "com_ui_feedback_tag_attention_to_detail": "Atenção aos detalhes",
+  "com_ui_feedback_tag_bad_style": "Estilo ou tom ruim",
+  "com_ui_feedback_tag_clear_well_written": "Claro e bem escrito",
   "com_ui_feedback_tag_creative_solution": "Solução Criativa",
+  "com_ui_feedback_tag_inaccurate": "Resposta imprecisa ou incorreta",
+  "com_ui_feedback_tag_missing_image": "Esperava uma imagem",
   "com_ui_feedback_tag_not_helpful": "Faltou informação útil",
+  "com_ui_feedback_tag_not_matched": "Não correspondeu à minha solicitação",
+  "com_ui_feedback_tag_other": "Outro problema",
   "com_ui_feedback_tag_unjustified_refusal": "Recusado com razão",
+  "com_ui_field_max_length": "{{field}} deve ter menos que {{length}} caracteres",
   "com_ui_field_required": "Este campo é obrigatório",
+  "com_ui_file": "Arquivo",
+  "com_ui_file_input_avatar_label": "Entrada de arquivo para avatar",
   "com_ui_file_size": "Tamanho do Arquivo",
+  "com_ui_file_token_limit": "Limite de token de arquivo",
+  "com_ui_file_token_limit_desc": "Defina o limite máximo de tokens para processamento de arquivos para controlar custos e uso de recursos",
   "com_ui_files": "Arquivos",
+  "com_ui_filter_mcp_servers": "Filtrar servidores MCP por nome",
   "com_ui_filter_prompts": "Filtrar prompts",
   "com_ui_filter_prompts_name": "Filtrar prompts por nome",
+  "com_ui_final_touch": "Toque final",
   "com_ui_finance": "Financiar",
   "com_ui_fork": "Bifurcar",
   "com_ui_fork_all_target": "Incluir todos para/de aqui",
@@ -730,15 +1023,20 @@
   "com_ui_fork_change_default": "Opção de bifurcação padrão",
   "com_ui_fork_default": "Usar opção de bifurcação padrão",
   "com_ui_fork_error": "Houve um erro ao bifurcar a conversa",
+  "com_ui_fork_error_rate_limit": "Muitas solicitações de fork. Por favor, tente novamente mais tarde",
   "com_ui_fork_from_message": "Selecione uma opção de bifurcação",
   "com_ui_fork_info_1": "Use esta configuração para bifurcar mensagens com o comportamento desejado.",
   "com_ui_fork_info_2": "\"Bifurcação\" refere-se à criação de uma nova conversa que começa/termina a partir de mensagens específicas na conversa atual, criando uma cópia de acordo com as opções selecionadas.",
   "com_ui_fork_info_3": "A \"mensagem alvo\" refere-se à mensagem da qual este popup foi aberto, ou, se você marcar \"{{0}}\", a última mensagem na conversa.",
   "com_ui_fork_info_branches": "Esta opção bifurca as mensagens visíveis, junto com ramificações relacionadas; em outras palavras, o caminho direto para a mensagem alvo, incluindo ramificações ao longo do caminho.",
+  "com_ui_fork_info_button_label": "Ver informações sobre bifurcação de conversas",
   "com_ui_fork_info_remember": "Marque isto para lembrar as opções que você seleciona para uso futuro, tornando mais rápido bifurcar conversas conforme preferido.",
   "com_ui_fork_info_start": "Se marcado, a bifurcação começará desta mensagem até a última mensagem na conversa, de acordo com o comportamento selecionado acima.",
   "com_ui_fork_info_target": "Esta opção bifurca todas as mensagens até a mensagem alvo, incluindo seus vizinhos; em outras palavras, todos os ramos de mensagens, estejam ou não visíveis ou ao longo do mesmo caminho, estão incluídos.",
   "com_ui_fork_info_visible": "Esta opção bifurca apenas as mensagens visíveis; em outras palavras, o caminho direto para a mensagem alvo, sem quaisquer ramificações.",
+  "com_ui_fork_more_details_about": "Ver informações e detalhes adicionais sobre a opção de fork \"{{0}}\"",
+  "com_ui_fork_more_info_options": "Veja a explicação detalhada de todas as opções de fork e seus comportamentos",
+  "com_ui_fork_open_menu": "Abrir menu de fork",
   "com_ui_fork_processing": "Bifurcando conversa...",
   "com_ui_fork_remember": "Lembrar",
   "com_ui_fork_remember_checked": "Sua seleção será lembrada após o uso. Altere isso a qualquer momento nas configurações.",
@@ -748,15 +1046,23 @@
   "com_ui_fork_visible": "Apenas mensagens visíveis",
   "com_ui_generate_qrcode": "Gerar QR Code",
   "com_ui_generating": "Gerando...",
+  "com_ui_generating_image": "Gerando imagem...",
   "com_ui_generation_settings": "Configurações de Geração",
+  "com_ui_getting_started": "Primeiros passos",
   "com_ui_go_back": "Volte",
   "com_ui_go_to_conversation": "Ir para a conversa",
   "com_ui_good_afternoon": "Boa tarde",
   "com_ui_good_evening": "Boa noite",
   "com_ui_good_morning": "Bom dia",
+  "com_ui_group": "Grupo",
+  "com_ui_handoff_instructions": "Instruções de transferência",
   "com_ui_happy_birthday": "É meu 1º aniversário!",
+  "com_ui_header_format": "Formato de cabeçalho",
+  "com_ui_hide": "Ocultar",
+  "com_ui_hide_code": "Ocultar código",
   "com_ui_hide_image_details": "Esconder Detalhes de Imagem",
   "com_ui_hide_qr": "Ocultar QR Code",
+  "com_ui_high": "Alto",
   "com_ui_host": "Host",
   "com_ui_icon": "Ícone",
   "com_ui_idea": "Ideias",
@@ -764,158 +1070,439 @@
   "com_ui_image_details": "Detalhes da Imagem",
   "com_ui_image_edited": "Imagem editada",
   "com_ui_image_gen": "Geração de Imagem",
+  "com_ui_image_gen_failed": "Falha na geração da imagem",
   "com_ui_import": "Importar",
   "com_ui_import_conversation_error": "Houve um erro ao importar suas conversas",
   "com_ui_import_conversation_file_type_error": "Tipo de importação não suportado",
   "com_ui_import_conversation_info": "Importar conversas de um arquivo JSON",
   "com_ui_import_conversation_success": "Conversas importadas com sucesso",
+  "com_ui_import_conversation_upload_error": "Erro ao carregar o arquivo. Por favor, tente novamente.",
+  "com_ui_importing": "Importando",
   "com_ui_include_shadcnui": "Incluir instruções de componentes shadcn/ui",
+  "com_ui_initializing": "Inicializando...",
   "com_ui_input": "Entrada",
   "com_ui_instructions": "Instruções",
   "com_ui_key": "Chave",
+  "com_ui_key_required": "A chave de API é obrigatória",
+  "com_ui_labels": "Rótulos",
+  "com_ui_last_used": "Usado pela última vez",
+  "com_ui_late_night": "Boa madrugada",
+  "com_ui_latest": "mais recente",
   "com_ui_latest_footer": "Toda IA para Todos.",
   "com_ui_latest_version": "Ultima versão",
+  "com_ui_leave_blank_to_keep": "Deixe em branco para manter o existente",
+  "com_ui_light_theme_enabled": "Tema claro ativado",
+  "com_ui_link_copied": "Link copiado",
+  "com_ui_link_refreshed": "Link atualizado",
+  "com_ui_live": "ao vivo",
   "com_ui_loading": "Carregando",
   "com_ui_locked": "Bloqueado",
   "com_ui_logo": "{{0}} Logo",
+  "com_ui_low": "Baixo",
+  "com_ui_make_production": "Tornar produção",
   "com_ui_manage": "Gerenciar",
+  "com_ui_marketplace": "Marketplace",
+  "com_ui_marketplace_allow_use": "Permitir uso do Marketplace",
+  "com_ui_max": "Máx.",
+  "com_ui_max_favorites_reached": "Máximo de itens fixados atingido ({{0}}). Desafixe um item para adicionar mais.",
+  "com_ui_max_file_size": "PNG, JPG ou JPEG (máx. {{0}})",
   "com_ui_max_tags": "O número máximo permitido é {{0}}, usando os valores mais recentes.",
   "com_ui_mcp_authenticated_success": "Servidor MCP '{{0}}' autenticado com sucesso",
+  "com_ui_mcp_click_to_defer": "Clique para adiar - a ferramenta poderá ser descoberta por meio de pesquisa, mas não será carregada até que seja necessária",
+  "com_ui_mcp_click_to_programmatic": "Habilitar chamada programática – a ferramenta só pode ser invocada por meio de execução de código",
+  "com_ui_mcp_configure_server": "Configurar {{0}}",
+  "com_ui_mcp_configure_server_description": "Configurar variáveis personalizadas para {{0}}",
+  "com_ui_mcp_defer": "Adiar",
+  "com_ui_mcp_defer_all": "Adiar todas as ferramentas",
+  "com_ui_mcp_defer_loading": "Adiar carregamento",
+  "com_ui_mcp_dialog_title": "Configurar variáveis para {{serverName}}. Status do servidor: {{status}}",
+  "com_ui_mcp_domain_not_allowed": "O domínio do servidor MCP não está na lista de domínios permitidos. Entre em contato com seu administrador.",
   "com_ui_mcp_enter_var": "Insira um valor para {{0}}",
+  "com_ui_mcp_init_failed": "Falha ao inicializar o servidor MCP",
   "com_ui_mcp_initialize": "Inicializar",
   "com_ui_mcp_initialized_success": "Servidor MCP '{{0}}' inicializou com sucesso",
+  "com_ui_mcp_invalid_url": "Insira um URL válido",
+  "com_ui_mcp_no_description": "Nenhuma descrição disponível",
+  "com_ui_mcp_oauth_cancelled": "Login OAuth cancelado para {{0}}",
+  "com_ui_mcp_oauth_timeout": "O login do OAuth expirou para {{0}}",
+  "com_ui_mcp_programmatic": "Programático",
+  "com_ui_mcp_programmatic_all": "Marcar tudo como programático",
+  "com_ui_mcp_server": "Servidor MCP",
+  "com_ui_mcp_server_connection_failed": "A tentativa de conexão com o servidor MCP fornecido falhou. Certifique-se de que a URL, o tipo de servidor e qualquer configuração de autenticação estejam corretos e tente novamente. Certifique-se também de que a URL esteja acessível.",
+  "com_ui_mcp_server_created": "Servidor MCP criado com sucesso",
+  "com_ui_mcp_server_delete_confirm": "Tem certeza de que deseja excluir este servidor MCP?",
+  "com_ui_mcp_server_deleted": "Servidor MCP excluído com sucesso",
+  "com_ui_mcp_server_role_editor": "Editor de servidor MCP",
+  "com_ui_mcp_server_role_editor_desc": "Pode visualizar, usar e editar servidores MCP",
+  "com_ui_mcp_server_role_owner": "Proprietário do servidor MCP",
+  "com_ui_mcp_server_role_owner_desc": "Controle total sobre servidores MCP",
+  "com_ui_mcp_server_role_viewer": "Visualizador do servidor MCP",
+  "com_ui_mcp_server_role_viewer_desc": "Pode visualizar e usar servidores MCP",
+  "com_ui_mcp_server_updated": "Servidor MCP atualizado com sucesso",
+  "com_ui_mcp_server_url_placeholder": "https://mcp.example.com",
   "com_ui_mcp_servers": "Servidores MCP",
+  "com_ui_mcp_servers_allow_create": "Permitir que os usuários criem servidores MCP",
+  "com_ui_mcp_servers_allow_share": "Permitir que os usuários compartilhem servidores MCP",
+  "com_ui_mcp_servers_allow_share_public": "Permitir que os usuários compartilhem servidores MCP publicamente",
+  "com_ui_mcp_servers_allow_use": "Permitir que os usuários usem servidores MCP",
+  "com_ui_mcp_title_invalid": "O título só pode conter letras, números e espaços",
+  "com_ui_mcp_tool_options": "Opções de ferramentas",
+  "com_ui_mcp_transport": "Transporte",
+  "com_ui_mcp_type_sse": "SSE",
+  "com_ui_mcp_type_streamable_http": "HTTPS com streaming",
+  "com_ui_mcp_undefer": "Não adiar",
+  "com_ui_mcp_undefer_all": "Cancelar adiamento de todas as ferramentas",
+  "com_ui_mcp_unprogrammatic_all": "Desmarcar tudo como programático",
   "com_ui_mcp_update_var": "Atualizar {{0}}",
   "com_ui_mcp_url": "URL do Servidor MCP",
   "com_ui_medium": "Médio",
   "com_ui_memories": "Memórias",
   "com_ui_memories_allow_create": "Permitir criação de Memórias",
+  "com_ui_memories_allow_opt_out": "Permitir que os usuários desativem as Memórias",
+  "com_ui_memories_allow_read": "Permitir leitura de memórias",
   "com_ui_memories_allow_update": "Permite a atualização de Memórias",
   "com_ui_memories_allow_use": "Permite a utilização de Memórias",
   "com_ui_memories_filter": "Filtrar memórias...",
   "com_ui_memory": "Memória",
+  "com_ui_memory_already_exceeded": "Armazenamento de memória já cheio; excedido em {{tokens}} tokens. Exclua memórias existentes antes de adicionar novas.",
   "com_ui_memory_created": "Memória criada com sucesso",
   "com_ui_memory_deleted": "Memória removida",
   "com_ui_memory_deleted_items": "Memórias removidas",
+  "com_ui_memory_error": "Erro de memória",
+  "com_ui_memory_key_exists": "Já existe uma memória com esta chave. Por favor, use uma chave diferente.",
+  "com_ui_memory_key_hint": "Use apenas letras minúsculas e sublinhados",
+  "com_ui_memory_key_validation": "A chave de memória deve conter apenas letras minúsculas e sublinhados.",
   "com_ui_memory_storage_full": "Armazenamento de Memória Cheio",
   "com_ui_memory_updated": "Memória salva atualizada",
   "com_ui_memory_updated_items": "Memórias Atualizadas",
   "com_ui_memory_would_exceed": "Impossível salvar - excederia o limite por {{tokens} tokens. Remova memórias existentes para liberar espaço.",
   "com_ui_mention": "Mencione um endpoint, assistente ou predefinição para alternar rapidamente para ele",
+  "com_ui_mermaid": "Mermaid",
+  "com_ui_mermaid_failed": "Falha ao renderizar o diagrama:",
+  "com_ui_mermaid_source": "Código fonte:",
+  "com_ui_message_input": "Entrada de mensagem",
+  "com_ui_microphone_unavailable": "O microfone não está disponível",
   "com_ui_min_tags": "Não é possível remover mais valores, um mínimo de {{0}} é necessário.",
+  "com_ui_minimal": "Mínimo",
   "com_ui_misc": "Diversos",
   "com_ui_model": "Modelo",
   "com_ui_model_parameters": "Parâmetros do Modelo",
+  "com_ui_model_parameters_reset": "Os parâmetros do modelo foram redefinidos.",
+  "com_ui_model_selected": "{{0}} selecionado",
+  "com_ui_model_spec": "Especificações do modelo",
   "com_ui_more_info": "Mais informações",
   "com_ui_my_prompts": "Meus Prompts",
   "com_ui_name": "Nome",
+  "com_ui_name_sort": "Classificar por nome",
+  "com_ui_navigate_results": "Navegue pelos resultados",
   "com_ui_new": "Novo",
   "com_ui_new_chat": "Novo chat",
+  "com_ui_new_conversation_title": "Novo título da conversa",
   "com_ui_next": "Próximo",
+  "com_ui_next_result": "Próximo resultado",
   "com_ui_no": "Não",
+  "com_ui_no_api_keys": "Ainda não há chaves de API. Crie uma para começar.",
+  "com_ui_no_auth": "Nenhum (detecção automática)",
   "com_ui_no_bookmarks": "Parece que você ainda não tem favoritos. Clique em um chat e adicione um novo",
+  "com_ui_no_bookmarks_match": "Nenhum favorito corresponde à sua pesquisa",
+  "com_ui_no_bookmarks_title": "Ainda não há favoritos",
+  "com_ui_no_categories": "Nenhuma categoria disponível",
   "com_ui_no_category": "Sem categoria",
+  "com_ui_no_changes": "Nenhuma alteração foi feita",
+  "com_ui_no_individual_access": "Nenhum usuário ou grupo individual tem acesso a este agente",
+  "com_ui_no_labels": "Sem rótulos",
+  "com_ui_no_mcp_servers": "Ainda não há servidores MCP",
+  "com_ui_no_mcp_servers_match": "Nenhum servidor MCP corresponde ao seu filtro",
+  "com_ui_no_memories": "Sem memórias. Crie-as manualmente ou peça à IA para lembrar de algo",
+  "com_ui_no_memories_match": "Nenhuma memória corresponde à sua pesquisa",
+  "com_ui_no_memories_title": "Ainda não há memórias",
+  "com_ui_no_personalization_available": "Nenhuma opção de personalização está disponível no momento",
+  "com_ui_no_prompts_title": "Ainda não há prompts",
+  "com_ui_no_read_access": "Você não tem permissão para ver memórias",
+  "com_ui_no_results_found": "Nenhum resultado encontrado",
   "com_ui_no_terms_content": "Nenhum conteúdo de termos e condições para exibir",
   "com_ui_none": "Nenhum",
   "com_ui_not_used": "Não usado",
   "com_ui_nothing_found": "Nada encontrado",
   "com_ui_oauth": "OAuth",
+  "com_ui_oauth_connected_to": "Conectado a",
+  "com_ui_oauth_error_callback_failed": "Falha no retorno de chamada de autenticação. Por favor, tente novamente.",
+  "com_ui_oauth_error_generic": "Falha na autenticação. Por favor, tente novamente.",
+  "com_ui_oauth_error_invalid_state": "Parâmetro de estado inválido. Por favor, tente novamente.",
+  "com_ui_oauth_error_missing_code": "O código de autorização está faltando. Por favor, tente novamente.",
+  "com_ui_oauth_error_missing_state": "O parâmetro de estado está ausente. Por favor, tente novamente.",
+  "com_ui_oauth_error_title": "Falha na autenticação",
+  "com_ui_oauth_success_description": "Sua autenticação foi bem-sucedida. Esta janela será fechada em",
+  "com_ui_oauth_success_title": "Autenticação bem-sucedida",
   "com_ui_of": "de",
   "com_ui_off": "Desligado",
+  "com_ui_offline": "Off-line",
+  "com_ui_omitted": "Omitido",
   "com_ui_on": "Ligado",
+  "com_ui_open_archived_chat_new_tab_title": "{{title}} (abre em uma nova guia)",
+  "com_ui_open_source_chat_new_tab": "Abrir chat de origem em nova guia",
+  "com_ui_open_source_chat_new_tab_title": "Abrir chat de origem em nova guia - {{title}}",
+  "com_ui_open_var": "Abrir {{0}}",
   "com_ui_openai": "OpenAI",
+  "com_ui_optional": "(opcional)",
+  "com_ui_options": "opções",
+  "com_ui_output": "Saída",
   "com_ui_page": "Página",
+  "com_ui_pagination": "Paginação",
+  "com_ui_parameters": "Parâmetros",
+  "com_ui_people": "pessoas",
+  "com_ui_people_picker": "Seletor de pessoas",
+  "com_ui_people_picker_allow_view_groups": "Permitir visualização de grupos",
+  "com_ui_people_picker_allow_view_roles": "Permitir visualização de funções",
+  "com_ui_people_picker_allow_view_users": "Permitir visualização de usuários",
+  "com_ui_permissions_failed_load": "Falha ao carregar permissões. Por favor, tente novamente.",
+  "com_ui_permissions_failed_update": "Falha ao atualizar as permissões. Por favor, tente novamente.",
+  "com_ui_permissions_updated_success": "Permissões atualizadas com sucesso",
+  "com_ui_pin": "Fixar",
+  "com_ui_preferences_updated": "Preferências atualizadas com sucesso",
   "com_ui_prev": "Anterior",
+  "com_ui_prev_result": "Resultado anterior",
   "com_ui_preview": "Pré-visualizar",
+  "com_ui_preview_unavailable": "A visualização não está disponível para este tipo de arquivo",
   "com_ui_privacy_policy": "Política de Privacidade",
   "com_ui_privacy_policy_url": "URL da Política de Privacidade",
+  "com_ui_production": "Produção",
   "com_ui_prompt": "Prompt",
+  "com_ui_prompt_category_selector_aria": "Seletor de categoria do prompt",
+  "com_ui_prompt_delete_confirm": "Tem certeza de que deseja excluir o prompt '{{0}}'?",
+  "com_ui_prompt_delete_error": "Ocorreu um erro ao excluir o prompt",
+  "com_ui_prompt_deleted_group": "Grupo de prompts \"{{0}}\" excluído",
+  "com_ui_prompt_details": "Detalhes do prompt {{name}}",
+  "com_ui_prompt_group_button": "Prompt {{name}}, categoria {{category}}",
+  "com_ui_prompt_group_button_no_category": "Prompt {{name}}",
+  "com_ui_prompt_groups": "Lista de grupos de prompts",
+  "com_ui_prompt_input": "Entrada de prompt",
+  "com_ui_prompt_input_field": "Campo de entrada de texto de prompt",
   "com_ui_prompt_name": "Nome do Prompt",
   "com_ui_prompt_name_required": "Nome do Prompt é obrigatório",
   "com_ui_prompt_preview_not_shared": "O autor não permitiu colaboração para este prompt.",
   "com_ui_prompt_text": "Texto",
   "com_ui_prompt_text_required": "Texto é obrigatório",
   "com_ui_prompt_update_error": "Houve um erro ao atualizar o prompt",
+  "com_ui_prompt_variables_list": "Lista de variáveis de prompt",
   "com_ui_prompts": "Prompts",
   "com_ui_prompts_allow_create": "Permitir criação de Prompts",
+  "com_ui_prompts_allow_share": "Permitir compartilhamento de prompts",
+  "com_ui_prompts_allow_share_public": "Permitir o compartilhamento de prompts publicamente",
   "com_ui_prompts_allow_use": "Permitir uso de Prompts",
   "com_ui_provider": "Provedor",
+  "com_ui_quality": "Qualidade",
   "com_ui_read_aloud": "Ler em voz alta",
+  "com_ui_redirect_uri": "URI de redirecionamento",
+  "com_ui_redirect_uri_instructions": "Copie este URI de redirecionamento e configure-o nas configurações do seu provedor OAuth.",
+  "com_ui_redirecting_to_provider": "Redirecionando para {{0}}, aguarde...",
+  "com_ui_reference_saved_memories": "Referência de memórias salvas",
+  "com_ui_reference_saved_memories_description": "Permita que o assistente faça referência e use suas memórias salvas ao responder",
+  "com_ui_refresh": "Atualizar",
   "com_ui_refresh_link": "Atualizar link",
+  "com_ui_refresh_page": "Atualizar página",
   "com_ui_regenerate": "Regenerar",
   "com_ui_regenerate_backup": "Regerar código de backup",
   "com_ui_regenerating": "Regerando...",
   "com_ui_region": "Região",
+  "com_ui_reinitialize": "Reinicializar",
+  "com_ui_relevance": "Relevância",
+  "com_ui_remote_access": "Acesso remoto",
+  "com_ui_remote_agent_role_editor": "Editor",
+  "com_ui_remote_agent_role_editor_desc": "Pode visualizar e modificar o agente via API",
+  "com_ui_remote_agent_role_owner": "Proprietário da API",
+  "com_ui_remote_agent_role_owner_desc": "Acesso total à API e permissão para conceder acesso remoto a outras pessoas",
+  "com_ui_remote_agent_role_viewer": "Visualizador da API",
+  "com_ui_remote_agent_role_viewer_desc": "Pode consultar o agente via API",
+  "com_ui_remote_agents": "Agentes Remotos (API)",
+  "com_ui_remote_agents_allow_create": "Permitir que os usuários criem agentes via API",
+  "com_ui_remote_agents_allow_share": "Permitir que usuários concedam acesso à API dos agentes a outras pessoas",
+  "com_ui_remote_agents_allow_share_public": "Permitir que usuários concedam acesso à API dos agentes a todos os usuários",
+  "com_ui_remote_agents_allow_use": "Permitir que os usuários criem chaves de API e consultem agentes remotamente",
+  "com_ui_remove_agent_from_chain": "Remover {{0}} da cadeia",
+  "com_ui_remove_user": "Remover {{0}}",
   "com_ui_rename": "Renomear",
+  "com_ui_rename_conversation": "Renomear conversa",
+  "com_ui_rename_failed": "Falha ao renomear a conversa",
   "com_ui_requires_auth": "Requer autenticação",
+  "com_ui_reset": "Redefinir",
+  "com_ui_reset_adjustments": "Redefinir ajustes",
   "com_ui_reset_var": "Redefinir {{0}}",
+  "com_ui_reset_zoom": "Redefinir zoom",
+  "com_ui_resource": "recurso",
+  "com_ui_response": "Resposta",
   "com_ui_result": "Resultado",
+  "com_ui_result_found": "Resultado {{count}} encontrado",
+  "com_ui_results_found": "Resultados {{count}} encontrados",
+  "com_ui_retrieved_files": "Arquivos pesquisados",
+  "com_ui_retry": "Tentar novamente",
   "com_ui_revoke": "Revogar",
   "com_ui_revoke_info": "Revogar todas as credenciais fornecidas pelo usuário",
   "com_ui_revoke_key_confirm": "Tem certeza de que deseja revogar esta chave?",
   "com_ui_revoke_key_endpoint": "Revogar chave para {{0}}",
+  "com_ui_revoke_key_error": "Falha ao revogar a chave de API. Por favor, tente novamente.",
+  "com_ui_revoke_key_success": "Chave de API revogada com sucesso",
   "com_ui_revoke_keys": "Revogar chaves",
   "com_ui_revoke_keys_confirm": "Tem certeza de que deseja revogar todas as chaves?",
+  "com_ui_role": "Papel",
+  "com_ui_role_editor": "Editor",
+  "com_ui_role_editor_desc": "Pode visualizar e modificar o agente",
+  "com_ui_role_manager": "Gerente",
+  "com_ui_role_manager_desc": "Pode visualizar, modificar e excluir o agente",
+  "com_ui_role_owner": "Proprietário",
+  "com_ui_role_owner_desc": "Tem controle total sobre o agente, incluindo compartilhamento",
   "com_ui_role_select": "Papel",
+  "com_ui_role_viewer": "Visualizador",
+  "com_ui_role_viewer_desc": "Pode visualizar e usar o agente, mas não pode modificá-lo",
   "com_ui_roleplay": "RPG",
+  "com_ui_rotate": "Girar",
+  "com_ui_rotate_90": "Girar 90 graus",
   "com_ui_run_code": "Executar código",
   "com_ui_run_code_error": "Ocorreu um erro ao executar o código",
+  "com_ui_running": "Em execução...",
   "com_ui_save": "Salvar",
+  "com_ui_save_badge_changes": "Salvar alterações dos emblemas?",
+  "com_ui_save_changes": "Salvar alterações",
+  "com_ui_save_key_error": "Falha ao salvar a chave de API. Por favor, tente novamente.",
+  "com_ui_save_key_success": "Chave de API salva com sucesso",
   "com_ui_save_submit": "Salvar & Enviar",
   "com_ui_saved": "Salvo!",
+  "com_ui_saving": "Salvando...",
   "com_ui_schema": "Esquema",
   "com_ui_scope": "Escopo",
   "com_ui_search": "Pesquisar",
+  "com_ui_search_above_to_add": "Pesquise acima para adicionar usuários ou grupos",
+  "com_ui_search_above_to_add_all": "Pesquise acima para adicionar usuários, grupos ou funções",
+  "com_ui_search_above_to_add_people": "Pesquise acima para adicionar pessoas",
+  "com_ui_search_agent_category": "Pesquisar categorias...",
+  "com_ui_search_default_placeholder": "Pesquise por nome ou email (mín. 2 caracteres)",
+  "com_ui_search_people_placeholder": "Pesquise pessoas ou grupos por nome ou email",
+  "com_ui_search_result_count": "Resultado {{count}} encontrado",
+  "com_ui_search_results_count": "Resultados {{count}} encontrados",
+  "com_ui_searching_files": "Pesquisando seus arquivos",
+  "com_ui_seconds": "segundos",
   "com_ui_secret_key": "Chave secreta",
   "com_ui_select": "Selecionar",
+  "com_ui_select_agent": "Selecione Agente",
+  "com_ui_select_all": "Selecionar tudo",
   "com_ui_select_file": "Selecionar um arquivo",
   "com_ui_select_model": "Selecionar um modelo",
+  "com_ui_select_options": "Selecione opções...",
+  "com_ui_select_or_create_prompt": "Selecione ou crie um prompt",
   "com_ui_select_provider": "Selecionar um provedor",
   "com_ui_select_provider_first": "Selecione um provedor primeiro",
   "com_ui_select_region": "Selecione uma região",
+  "com_ui_select_row": "Selecione a linha",
   "com_ui_select_search_model": "Pesquisar modelo por nome",
   "com_ui_select_search_provider": "Pesquisar provedor por nome",
   "com_ui_select_search_region": "Pesquisar região por nome",
+  "com_ui_set": "Definir",
   "com_ui_share": "Compartilhar",
   "com_ui_share_create_message": "Seu nome e quaisquer mensagens que você adicionar após o compartilhamento permanecerão privadas.",
   "com_ui_share_delete_error": "Houve um erro ao excluir o link compartilhado",
   "com_ui_share_error": "Houve um erro ao compartilhar o link do chat",
+  "com_ui_share_everyone": "Compartilhar com todos",
+  "com_ui_share_everyone_description_var": "Este {{resource}} estará disponível para todos. Certifique-se de que o {{resource}} realmente deve ser compartilhado com todos. Tenha cuidado com seus dados.",
   "com_ui_share_link_to_chat": "Compartilhar link para o chat",
+  "com_ui_share_qr_code_description": "Código QR para compartilhar o link desta conversa",
   "com_ui_share_update_message": "Seu nome, instruções personalizadas e quaisquer mensagens que você adicionar após o compartilhamento permanecerão privadas.",
   "com_ui_share_var": "Compartilhar {{0}}",
   "com_ui_shared_link_delete_success": "Link compartilhado excluído com sucesso",
   "com_ui_shared_link_not_found": "Link compartilhado não encontrado",
   "com_ui_shared_prompts": "Prompts Compartilhados",
   "com_ui_shop": "Shopping",
+  "com_ui_show": "Mostrar",
   "com_ui_show_all": "Mostrar Todos",
+  "com_ui_show_code": "Mostrar código",
+  "com_ui_show_image_details": "Mostrar detalhes da imagem",
+  "com_ui_show_less": "Mostrar menos",
+  "com_ui_show_more": "Mostrar mais",
   "com_ui_show_qr": "Mostrar QR Code",
   "com_ui_sign_in_to_domain": "Entre em {{0}}",
   "com_ui_simple": "Simples",
   "com_ui_size": "Tamanho",
+  "com_ui_size_sort": "Classificar por tamanho",
+  "com_ui_special": "especial",
+  "com_ui_special_var_current_date": "Data Atual",
+  "com_ui_special_var_current_datetime": "Data e hora atuais",
+  "com_ui_special_var_current_user": "Usuário atual",
+  "com_ui_special_var_desc_current_date": "Data de hoje e dia da semana",
+  "com_ui_special_var_desc_current_datetime": "Data e hora local no seu fuso horário",
+  "com_ui_special_var_desc_current_user": "Nome de exibição da sua conta",
+  "com_ui_special_var_desc_iso_datetime": "Data e hora UTC no formato ISO 8601",
+  "com_ui_special_var_iso_datetime": "Data e hora UTC ISO",
+  "com_ui_special_variable_added": "Variável especial {{0}} adicionada.",
   "com_ui_special_variables": "Variáveis especiais:",
+  "com_ui_speech_not_supported": "Seu navegador não suporta reconhecimento de fala",
+  "com_ui_speech_not_supported_use_external": "Seu navegador não suporta reconhecimento de fala. Tente mudar para STT externo em Configurações > Fala.",
   "com_ui_speech_while_submitting": "Não é possível enviar a fala enquanto uma resposta está sendo gerada",
+  "com_ui_sr_global_prompt": "Grupo de prompt global",
+  "com_ui_stack_trace": "Rastreamento de pilha",
+  "com_ui_status_prefix": "Status:",
   "com_ui_stop": "Parar",
   "com_ui_storage": "Armazenamento",
+  "com_ui_storage_filter_sort": "Filtrar e classificar por armazenamento",
   "com_ui_submit": "Enviar",
+  "com_ui_summarized": "Resumido",
+  "com_ui_summarizing": "Resumindo...",
+  "com_ui_support_contact": "Contato de suporte",
+  "com_ui_support_contact_email": "Email",
+  "com_ui_support_contact_email_invalid": "Por favor insira um endereço de email válido",
+  "com_ui_support_contact_email_placeholder": "suporte@exemplo.com",
+  "com_ui_support_contact_name": "Nome",
+  "com_ui_support_contact_name_min_length": "O nome deve ter pelo menos {{minLength}} caracteres",
+  "com_ui_support_contact_name_placeholder": "Nome do contato de suporte",
   "com_ui_teach_or_explain": "Aprendizado",
+  "com_ui_temporary": "Chat temporário",
   "com_ui_terms_and_conditions": "Termos e Condições",
   "com_ui_terms_of_service": "Termos de Serviço",
+  "com_ui_text_variables": "Variáveis de texto",
   "com_ui_thinking": "Pensando...",
   "com_ui_thoughts": "Pensamentos",
+  "com_ui_toggle_theme": "Alternar tema",
+  "com_ui_token": "token",
   "com_ui_token_exchange_method": "Método de troca de tokens",
   "com_ui_token_url": "URL do token",
+  "com_ui_tokens": "tokens",
+  "com_ui_tool_collection_prefix": "Uma coleção de ferramentas de",
+  "com_ui_tool_failed": "falhou",
+  "com_ui_tool_list_collapse": "Recolher lista de ferramentas de {{serverName}}",
+  "com_ui_tool_list_expand": "Expandir lista de ferramentas de {{serverName}}",
+  "com_ui_tool_name_code": "Código",
+  "com_ui_tool_name_code_analysis": "Análise de código",
+  "com_ui_tool_name_file_search": "Pesquisa de arquivos",
+  "com_ui_tool_name_image_edit": "Edição de imagem",
+  "com_ui_tool_name_image_gen": "Geração de imagem",
+  "com_ui_tool_name_web_search": "Pesquisa na Web",
   "com_ui_tools": "Ferramentas",
+  "com_ui_tools_and_actions": "Ferramentas e ações",
+  "com_ui_transferred_to": "Transferido para",
   "com_ui_travel": "Viagem",
+  "com_ui_trust_app": "Eu confio neste aplicativo",
+  "com_ui_try_adjusting_search": "Tente ajustar seus termos de pesquisa",
+  "com_ui_ui_resource_error": "Erro de recurso de UI ({{0}})",
+  "com_ui_ui_resource_not_found": "Recurso de UI não encontrado (índice: {{0}})",
   "com_ui_unarchive": "Desarquivar",
+  "com_ui_unarchive_conversation": "Desarquivar conversa",
   "com_ui_unarchive_error": "Falha ao desarquivar conversa",
+  "com_ui_unavailable": "Indisponível",
   "com_ui_unknown": "Desconhecido",
+  "com_ui_unpin": "Desafixar",
+  "com_ui_unset": "Não definido",
+  "com_ui_untitled": "Sem título",
   "com_ui_update": "Atualizar",
+  "com_ui_update_mcp_server": "Atualizar servidor MCP",
+  "com_ui_updating": "Atualizando...",
   "com_ui_upload": "Carregar",
+  "com_ui_upload_agent_avatar": "Avatar do agente atualizado com sucesso",
+  "com_ui_upload_agent_avatar_label": "Carregar imagem de avatar do agente",
+  "com_ui_upload_avatar_label": "Carregar imagem de avatar",
   "com_ui_upload_delay": "O upload de \"{{0}}\" está demorando mais do que o esperado. Por favor, aguarde enquanto o arquivo termina de ser indexado para recuperação.",
   "com_ui_upload_error": "Houve um erro ao carregar seu arquivo",
   "com_ui_upload_file_context": "Contexto de upload de arquivo",
   "com_ui_upload_file_search": "Upload para pesquisa de arquivos",
   "com_ui_upload_files": "Carregar arquivos",
+  "com_ui_upload_icon": "Carregar imagem do ícone",
   "com_ui_upload_image": "Carregar uma imagem",
   "com_ui_upload_image_input": "Upload de imagem",
   "com_ui_upload_invalid": "Arquivo inválido para upload. Deve ser uma imagem não excedendo o limite",
@@ -924,18 +1511,30 @@
   "com_ui_upload_provider": "Anexar Arquivos",
   "com_ui_upload_success": "Arquivo carregado com sucesso",
   "com_ui_upload_type": "Selecione o tipo de upload",
+  "com_ui_usage": "Uso",
   "com_ui_use_2fa_code": "Use o código 2FA em vez disso",
   "com_ui_use_backup_code": "Use o código de backup",
+  "com_ui_use_memory": "Usar memória",
   "com_ui_use_micrphone": "Usar microfone",
+  "com_ui_use_prompt": "Usar prompt",
   "com_ui_used": "Usado",
+  "com_ui_used_n_tools": "{{0}} ferramentas usadas",
+  "com_ui_user": "Usuário",
+  "com_ui_user_group_permissions": "Permissões de usuário e grupo",
+  "com_ui_user_provides_key": "Cada usuário fornece sua própria chave",
+  "com_ui_value": "Valor",
+  "com_ui_variable_with_options": "Variável {{name}} com {{count}} opções",
   "com_ui_variables": "Variáveis",
   "com_ui_verify": "Verificar",
   "com_ui_version_var": "Versão {{0}}",
   "com_ui_versions": "Versões",
+  "com_ui_via_server": "em {{0}}",
+  "com_ui_view_memory": "Ver memória",
   "com_ui_web_search": "Busca na web",
   "com_ui_web_search_cohere_key": "Insira a chave de API Cohere",
   "com_ui_web_search_firecrawl_url": "URL da API Firecrawl (opcional)",
   "com_ui_web_search_jina_key": "Insira a chave de API Jina",
+  "com_ui_web_search_jina_url": "URL da API Jina (opcional)",
   "com_ui_web_search_processing": "Resultados de processamento",
   "com_ui_web_search_provider": "Provedor de Buscas",
   "com_ui_web_search_provider_searxng": "SearXNG",
@@ -947,16 +1546,28 @@
   "com_ui_web_search_reranker_cohere_key": "Obtenha sua chave de API Cohere",
   "com_ui_web_search_reranker_jina": "Jina AI",
   "com_ui_web_search_reranker_jina_key": "Obtenha sua chave de API Jina",
+  "com_ui_web_search_reranker_jina_url_help": "Saiba mais sobre a API Jina Rerank",
   "com_ui_web_search_scraper": "Scraper",
   "com_ui_web_search_scraper_firecrawl": "Firecrawl API",
   "com_ui_web_search_scraper_firecrawl_key": "Obtenha sua chave de API Firecrawl",
+  "com_ui_web_search_scraper_serper": "API Serper Scrape",
+  "com_ui_web_search_scraper_serper_key": "Obtenha sua chave de API Serper",
   "com_ui_web_search_searxng_api_key": "Insira sua Chave de API SearXNG (opcional)",
+  "com_ui_web_search_searxng_instance_url": "URL da instância SearXNG",
+  "com_ui_web_search_source": "{{count}} fonte",
+  "com_ui_web_search_sources": "{{count}} fontes",
+  "com_ui_web_searched": "Pesquisa na web concluída",
   "com_ui_web_searching": "Procurando na web",
   "com_ui_web_searching_again": "Procurando na web novamente",
   "com_ui_weekend_morning": "Boa semana",
   "com_ui_write": "Escrevendo",
   "com_ui_x_selected": "{{0}} selecionado",
+  "com_ui_xhigh": "Muito alto",
   "com_ui_yes": "Sim",
+  "com_ui_your_api_key": "Sua chave de API",
   "com_ui_zoom": "Zoom",
+  "com_ui_zoom_in": "Ampliar",
+  "com_ui_zoom_level": "Nível de zoom",
+  "com_ui_zoom_out": "Diminuir zoom",
   "com_user_message": "Você"
 }
diff --git a/client/src/locales/ru/translation.json b/client/src/locales/ru/translation.json
index 45e45e68a2a..5913a1988f2 100644
--- a/client/src/locales/ru/translation.json
+++ b/client/src/locales/ru/translation.json
@@ -1157,7 +1157,7 @@
   "com_ui_save": "Сохранить",
   "com_ui_save_badge_changes": "Сохранить изменения значков?",
   "com_ui_save_changes": "Сохранить изменения",
-  "com_ui_save_key_error": "Ошибк",
+  "com_ui_save_key_error": "Не удалось сохранить API-ключ. Повторите попытку.",
   "com_ui_save_key_success": "API-ключ сохранен успешно",
   "com_ui_save_submit": "Сохранить и отправить",
   "com_ui_saved": "Сохранено!",
@@ -1174,7 +1174,7 @@
   "com_ui_seconds": "секунды",
   "com_ui_secret_key": "Секретный ключ",
   "com_ui_select": "Выбрать",
-  "com_ui_select_agent": "Выб",
+  "com_ui_select_agent": "Выберите агента",
   "com_ui_select_all": "Выбрать все",
   "com_ui_select_file": "Выберите файл",
   "com_ui_select_model": "Выберите модель",
diff --git a/client/src/locales/tr/translation.json b/client/src/locales/tr/translation.json
index 89e33586127..15dc1b394fc 100644
--- a/client/src/locales/tr/translation.json
+++ b/client/src/locales/tr/translation.json
@@ -3,25 +3,110 @@
   "chat_direction_right_to_left": "Sağdan Sola",
   "com_a11y_ai_composing": "Yapay zeka hala yanıt oluşturuyor.",
   "com_a11y_end": "Yapay zeka yanıtını tamamladı.",
+  "com_a11y_selected": "seçildi",
   "com_a11y_start": "Yapay zeka yanıtlamaya başladı.",
+  "com_a11y_summarize_completed": "Bağlam özetlendi.",
+  "com_a11y_summarize_failed": "Özetleme başarısız oldu, mevcut bağlamla devam ediliyor.",
+  "com_a11y_summarize_started": "Bağlam özetleniyor.",
+  "com_agents_agent_card_label": "{{name}} ajanı. {{description}}",
+  "com_agents_all": "Tüm Ajanlar",
   "com_agents_all_category": "Hepsi",
+  "com_agents_all_description": "Tüm kategorilerdeki paylaşılan ajanlara göz atın",
+  "com_agents_avatar_upload_error": "Ajan avatarı yüklenemedi",
+  "com_agents_category_aftersales": "Satış Sonrası",
+  "com_agents_category_aftersales_description": "Satış sonrası destek, bakım ve müşteri hizmetlerinde uzmanlaşmış ajanlar",
+  "com_agents_category_empty": "{{category}} kategorisinde ajan bulunamadı",
+  "com_agents_category_finance": "Finans",
+  "com_agents_category_finance_description": "Finansal analiz, bütçeleme ve muhasebede uzmanlaşmış ajanlar",
+  "com_agents_category_general": "Genel",
+  "com_agents_category_general_description": "Yaygın görevler ve sorgular için genel amaçlı ajanlar",
+  "com_agents_category_hr": "İnsan Kaynakları",
+  "com_agents_category_hr_description": "İK süreçleri, politikaları ve çalışan desteğinde uzmanlaşmış ajanlar",
+  "com_agents_category_it": "BT",
+  "com_agents_category_it_description": "BT desteği, teknik sorun giderme ve sistem yönetimi ajanları",
+  "com_agents_category_rd": "Araştırma ve Geliştirme",
+  "com_agents_category_rd_description": "Ar-Ge süreçleri, inovasyon ve teknik araştırmalara odaklanan ajanlar",
+  "com_agents_category_sales": "Satış",
+  "com_agents_category_sales_description": "Satış süreçleri ve müşteri ilişkilerine odaklanan ajanlar",
+  "com_agents_category_tab_label": "{{category}} kategorisi, {{position}} / {{total}}",
+  "com_agents_category_tabs_label": "Ajan Kategorileri",
+  "com_agents_chat_with": "{{name}} ile sohbet et",
+  "com_agents_clear_search": "Aramayı temizle",
+  "com_agents_contact": "İletişim",
+  "com_agents_copy_link": "Bağlantıyı Kopyala",
   "com_agents_create_error": "Ajanınız oluşturulurken bir hata oluştu.",
+  "com_agents_created_by": "tarafından",
+  "com_agents_description_card": "Açıklama: {{description}}",
   "com_agents_description_placeholder": "İsteğe bağlı: Ajanınızı burada tanımlayın",
+  "com_agents_empty_state_heading": "Ajan bulunamadı",
   "com_agents_enable_file_search": "Dosya Aramayı Etkinleştir",
+  "com_agents_error_bad_request_message": "İstek işlenemedi.",
+  "com_agents_error_bad_request_suggestion": "Lütfen girdinizi kontrol edip tekrar deneyin.",
+  "com_agents_error_category_title": "Kategori Hatası",
+  "com_agents_error_generic": "İçerik yüklenirken bir sorunla karşılaştık.",
+  "com_agents_error_invalid_request": "Geçersiz İstek",
+  "com_agents_error_loading": "Ajanlar yüklenirken hata oluştu",
+  "com_agents_error_network_message": "Sunucuya bağlanılamıyor.",
+  "com_agents_error_network_suggestion": "İnternet bağlantınızı kontrol edip tekrar deneyin.",
+  "com_agents_error_network_title": "Bağlantı Sorunu",
+  "com_agents_error_not_found_message": "İstenilen içerik bulunamadı.",
+  "com_agents_error_not_found_suggestion": "Diğer seçeneklere göz atmayı deneyin veya pazaryerine geri dönün.",
+  "com_agents_error_not_found_title": "Bulunamadı",
+  "com_agents_error_retry": "Tekrar Dene",
+  "com_agents_error_search_title": "Arama Hatası",
+  "com_agents_error_searching": "Ajanları ararken hata oluştu",
+  "com_agents_error_server_message": "Sunucu geçici olarak kullanılamıyor.",
+  "com_agents_error_server_suggestion": "Lütfen birkaç dakika sonra tekrar deneyin.",
+  "com_agents_error_server_title": "Sunucu Hatası",
+  "com_agents_error_suggestion_generic": "Lütfen sayfayı yenilemeyi veya daha sonra tekrar denemeyi unutmayın.",
+  "com_agents_error_timeout_message": "İsteğin tamamlanması çok uzun sürdü.",
+  "com_agents_error_timeout_suggestion": "Lütfen internet bağlantınızı kontrol edip tekrar deneyin.",
+  "com_agents_error_timeout_title": "Bağlantı Zaman Aşımı",
+  "com_agents_error_title": "Bir şeyler ters gitti",
+  "com_agents_file_context_description": "\"Bağlam\" olarak yüklenen dosyalar, Ajanın talimatlarını desteklemek üzere metin olarak ayrıştırılır. OCR mevcutsa veya yüklenen dosya türü için yapılandırılmışsa, metni çıkarmak için kullanılır. Bir dosyanın tam metin içeriğine ihtiyaç duyduğunuz belgeler, metin içeren resimler veya PDF'ler için idealdir.",
+  "com_agents_file_context_disabled": "Dosya Bağlamı için dosya yüklemeden önce ajan oluşturulmalıdır.",
+  "com_agents_file_context_label": "Dosya Bağlamı",
   "com_agents_file_search_disabled": "Dosya Arama için dosya yüklemeden önce ajan oluşturulmalıdır.",
   "com_agents_file_search_info": "Etkinleştirildiğinde, ajan aşağıda listelenen dosya adlarından haberdar olacak ve bu dosyalardan ilgili içeriği alabilecektir.",
+  "com_agents_grid_announcement": "{{category}} kategorisinde {{count}} ajan gösteriliyor",
   "com_agents_instructions_placeholder": "Ajanın kullandığı sistem talimatları",
+  "com_agents_link_copied": "Bağlantı kopyalandı",
+  "com_agents_link_copy_failed": "Bağlantı kopyalanamadı",
+  "com_agents_load_more_label": "{{category}} kategorisinden daha fazla ajan yükle",
+  "com_agents_loading": "Yükleniyor...",
+  "com_agents_marketplace": "Ajan Pazaryeri",
+  "com_agents_marketplace_subtitle": "İş akışlarınızı ve üretkenliğinizi artırmak için güçlü yapay zeka ajanlarını keşfedin ve kullanın",
+  "com_agents_mcp_description_placeholder": "Birkaç kelimeyle ne yaptığını açıklayın",
+  "com_agents_mcp_icon_size": "Minimum boyut 128 x 128 piksel",
+  "com_agents_mcp_name_placeholder": "Özel Araç",
+  "com_agents_mcp_trust_subtext": "Özel bağlayıcılar LibreChat tarafından doğrulanmamıştır",
+  "com_agents_missing_name": "Lütfen bir ajan oluşturmadan önce bir ad girin.",
   "com_agents_missing_provider_model": "Lütfen bir ajan oluşturmadan önce bir sağlayıcı ve model seçin.",
   "com_agents_name_placeholder": "İsteğe bağlı: Ajanın adı",
   "com_agents_no_access": "Bu ajanı düzenleme erişiminiz yok.",
+  "com_agents_no_agent_id_error": "Ajan kimliği bulunamadı. Lütfen önce ajanın oluşturulduğundan emin olun.",
+  "com_agents_no_more_results": "Sonuçların sonuna ulaştınız",
   "com_agents_not_available": "Ajan Mevcut Değil",
+  "com_agents_recommended": "Önerilen ajanlarımız",
+  "com_agents_results_for": "'{{query}}' için sonuçlar",
+  "com_agents_search_aria": "Ajanları ara",
+  "com_agents_search_empty_heading": "Arama sonucu yok",
+  "com_agents_search_info": "Etkinleştirildiğinde, ajanınızın güncel bilgi için web'de arama yapmasına olanak tanır. Geçerli bir API anahtarı gerektirir.",
+  "com_agents_search_instructions": "Ajanları ada veya açıklamaya göre aramak için yazın",
   "com_agents_search_name": "Ajanları ada göre ara",
+  "com_agents_search_no_results": "\"{{query}}\" için ajan bulunamadı",
+  "com_agents_search_placeholder": "Ajanları ara...",
+  "com_agents_see_more": "Daha fazla gör",
+  "com_agents_start_chat": "Sohbeti Başlat",
+  "com_agents_top_picks": "En İyiler",
   "com_agents_update_error": "Ajanınız güncellenirken bir hata oluştu.",
   "com_assistants_actions": "Eylemler",
   "com_assistants_actions_disabled": "Eylem eklemeden önce bir asistan oluşturmanız gerekiyor.",
   "com_assistants_actions_info": "Asistanın API'leri kullanarak bilgi getirmesine veya eylem gerçekleştirmesine izin ver",
   "com_assistants_add_actions": "Eylem Ekle",
+  "com_assistants_add_mcp_server_tools": "MCP Sunucu Araçlarını Ekle",
   "com_assistants_add_tools": "Araçları Ekle",
+  "com_assistants_allow_sites_you_trust": "Yalnızca güvendiğiniz sitelere izin verin.",
   "com_assistants_append_date": "Şu anki tarih ve saati ekleyin",
   "com_assistants_append_date_tooltip": "Etkinleştirildiğinde, şu anki müşteri tarihi ve saati, Asistanın sistem talimatlarına eklenir.",
   "com_assistants_available_actions": "Mevcut Eylemler",
@@ -51,11 +136,13 @@
   "com_assistants_non_retrieval_model": "Dosya arama bu modelde etkin değil. Lütfen başka bir model seçin.",
   "com_assistants_retrieval": "Geri Getirme",
   "com_assistants_running_action": "Eylem çalışıyor",
+  "com_assistants_running_var": "{{0}} çalışıyor",
   "com_assistants_search_name": "Asistan adında ara",
   "com_assistants_update_actions_error": "Eylem oluşturma veya güncelleme sırasında bir hata oluştu.",
   "com_assistants_update_actions_success": "Eylem başarıyla oluşturuldu veya güncellendi",
   "com_assistants_update_error": "Asistanınızı güncelleme sırasında bir hata oluştu.",
   "com_assistants_update_success": "Başarıyla güncellendi",
+  "com_assistants_update_success_name": "{{name}} başarıyla güncellendi",
   "com_auth_already_have_account": "Zaten bir hesabınız var mı?",
   "com_auth_apple_login": "Apple ile Giriş Yap",
   "com_auth_back_to_login": "Girişe geri dön",
@@ -80,28 +167,30 @@
   "com_auth_email_verification_redirecting": "{{0}} saniye içinde yönlendiriliyor...",
   "com_auth_email_verification_resend_prompt": "E-postayı almadınız mı?",
   "com_auth_email_verification_success": "E-posta başarıyla doğrulandı",
+  "com_auth_email_verifying_ellipsis": "Doğrulanıyor...",
   "com_auth_error_create": "Hesabınızı kaydetmeye çalışırken bir hata oluştu. Lütfen tekrar deneyin.",
   "com_auth_error_invalid_reset_token": "Bu şifre sıfırlama jetonu artık geçerli değil.",
   "com_auth_error_login": "Sağlanan bilgilerle giriş yapılamıyor. Lütfen kimlik bilgilerinizi kontrol edin ve tekrar deneyin.",
   "com_auth_error_login_ban": "Hesabınız hizmetimize yönelik ihlaller nedeniyle geçici olarak yasaklanmıştır.",
   "com_auth_error_login_rl": "Kısa sürede çok fazla giriş denemesi yapıldı. Lütfen daha sonra tekrar deneyin.",
   "com_auth_error_login_server": "Dahili sunucu hatası oluştu. Lütfen birkaç dakika bekleyin ve tekrar deneyin.",
-  "com_auth_error_login_unverified": "Hesabınız doğrulanmamış. Lütfen doğrulama bağlantısı için e-postanızı kontrol edin.",
+  "com_auth_error_login_unverified": "Hesabınız doğrulanmamış. Lütfen doğrulama yapmak için e-posta kutunuzu kontrol edin.",
+  "com_auth_error_oauth_failed": "Kimlik doğrulama başarısız oldu. Lütfen giriş yönteminizi kontrol edin ve tekrar deneyin.",
   "com_auth_facebook_login": "Facebook ile devam et",
-  "com_auth_full_name": "Tam adı",
+  "com_auth_full_name": "Tam isim",
   "com_auth_github_login": "Github ile devam et",
   "com_auth_google_login": "Google ile devam et",
   "com_auth_here": "BURAYA",
   "com_auth_login": "Giriş yap",
   "com_auth_login_with_new_password": "Şimdi yeni şifreniz ile giriş yapabilirsiniz.",
   "com_auth_name_max_length": "Ad en fazla 80 karakter olmalıdır",
-  "com_auth_name_min_length": "Ad en az 3 karakter olmalıdır",
-  "com_auth_name_required": "Ad gereklidir",
+  "com_auth_name_min_length": "Adınız en az 3 karakterden oluşmalıdır",
+  "com_auth_name_required": "Adınızı girmeniz gereklidir",
   "com_auth_no_account": "Hesabınız yok mu?",
   "com_auth_password": "Şifre",
   "com_auth_password_confirm": "Şifreyi onayla",
   "com_auth_password_forgot": "Şifremi unuttum?",
-  "com_auth_password_max_length": "Şifre en fazla 128 karakter olmalıdır",
+  "com_auth_password_max_length": "Şifre 128 karakterden az olmalıdır",
   "com_auth_password_min_length": "Şifre en az 8 karakter olmalıdır",
   "com_auth_password_not_match": "Şifreler uyuşmuyor",
   "com_auth_password_required": "Şifre gereklidir",
@@ -111,29 +200,40 @@
   "com_auth_reset_password_if_email_exists": "Bu e-postaya sahip bir hesap varsa, e-posta ile şifre sıfırlama talimatları gönderilmiştir. Lütfen spam klasörünüzü kontrol edin.",
   "com_auth_reset_password_link_sent": "E-posta gönderildi",
   "com_auth_reset_password_success": "Şifre başarıyla sıfırlandı",
+  "com_auth_saml_login": "SAML ile devam et",
   "com_auth_sign_in": "Giriş yap",
   "com_auth_sign_up": "Kaydol",
-  "com_auth_submit_registration": "Kayıt formunu gönder",
+  "com_auth_submit_registration": "Kaydı tamamla",
   "com_auth_to_reset_your_password": "şifrenizi sıfırlamak için.",
   "com_auth_to_try_again": "yeniden denemek için.",
+  "com_auth_two_factor": "Tercih ettiğiniz tek kullanımlık şifre uygulamasından bir kod kontrol edin",
   "com_auth_username": "Kullanıcı adı (isteğe bağlı)",
-  "com_auth_username_max_length": "Kullanıcı adı en fazla 20 karakter olmalıdır",
+  "com_auth_username_max_length": "Kullanıcı adı 20 karakterden az olmalıdır",
   "com_auth_username_min_length": "Kullanıcı adı en az 2 karakter olmalıdır",
+  "com_auth_verify_your_identity": "Kimliğinizi Doğrulayın",
   "com_auth_welcome_back": "Tekrar hoş geldiniz",
+  "com_citation_more_details": "{{label}} hakkında daha fazla ayrıntı",
+  "com_citation_source": "Kaynak",
   "com_click_to_download": "(indirmek için tıklayın)",
   "com_download_expired": "(indirme süresi doldu)",
   "com_endpoint": "Uç Nokta",
   "com_endpoint_agent": "Ajan",
   "com_endpoint_agent_placeholder": "Lütfen bir Ajan seçin",
   "com_endpoint_ai": "Yapay Zeka",
-  "com_endpoint_anthropic_maxoutputtokens": "Yanıttaki maksimum token sayısı. Daha kısa yanıtlar için düşük bir değer, daha uzun yanıtlar için yüksek bir değer belirtin.",
+  "com_endpoint_anthropic_effort": "Claude'un uyguladığı hesaplama çabasını kontrol eder. Düşük çaba token tasarrufu sağlar ve gecikmeyi azaltır; daha yüksek çaba daha kapsamlı yanıtlar üretir. 'Max' en derin mantık yürütmeyi etkinleştirir (Sadece Opus 4.6).",
+  "com_endpoint_anthropic_maxoutputtokens": "Yanıttaki maksimum token sayısı. Daha kısa yanıtlar için düşük bir değer, daha uzun yanıtlar için yüksek bir değer belirtin. Not: modeller bu maksimuma ulaşmadan durabilir.",
   "com_endpoint_anthropic_prompt_cache": "İstem önbelleğe alma, API çağrıları arasında büyük bağlam veya talimatların yeniden kullanılmasına izin vererek maliyetleri ve gecikmeyi azaltır",
   "com_endpoint_anthropic_temp": "0 ile 1 arasında değişir. Analitik / çoktan seçmeli sorular için 0'a yakın, yaratıcı ve üretken görevler için 1'e yakın bir sıcaklık kullanın. Bu parametre ile Olasılık Kütüphanesini değiştirmeyi öneririz (ikisini birden değiştirmemek).",
+  "com_endpoint_anthropic_thinking": "Desteklenen Claude modelleri için iç akıl yürütmeyi etkinleştirir. Daha yeni modeller için (Opus 4.6+), Effort parametresi tarafından kontrol edilen adaptif düşünmeyi kullanır. Eski modeller için, \"Thinking Budget\" ayarlanmış ve \"Max Output Tokens\"dan daha düşük olmalıdır.",
+  "com_endpoint_anthropic_thinking_budget": "Claude'un iç akıl yürütme süreci için kullanmasına izin verilen maksimum token sayısını belirler. Daha büyük bütçeler, karmaşık problemler için daha kapsamlı analizi etkinleştirerek yanıt kalitesini artırabilir, ancak Claude ayrılan tüm bütçeyi kullanmayabilir, özellikle 32K üzeri aralıklarda. Bu ayar \"Max Output Tokens\"dan daha düşük olmalıdır.",
+  "com_endpoint_anthropic_thinking_display_desc": "Claude'un düşünce dönütünü kontrol eder. Özetlenmiş düşüncelerin 'Oto' ",
   "com_endpoint_anthropic_topk": "Top-k, modelin çıktı için token seçimini nasıl yaptığını değiştirir. 1 olan bir top-k, modelin kelime haznesindeki en olası tokenin seçildiği (açgözlü kod çözme olarak da adlandırılır) anlamına gelirken, 3 olan bir top-k, bir sonraki tokenin en olası üç token arasından (sıcaklık kullanılarak) seçileceği anlamına gelir.",
   "com_endpoint_anthropic_topp": "Modelin çıktı için token seçim şeklini değiştirir. Tokenlar, en olasılıktan (bkz. topK parametresi) en az olasıya kadar seçilir ve olasılıkları toplamı, top-p değerine eşit olana kadar devam eder.",
+  "com_endpoint_anthropic_use_web_search": "Anthropic'in yerleşik arama yeteneklerini kullanarak web arama işlevini etkinleştirin. Bu, modelin güncel bilgiler için web'de arama yapmasına ve daha doğru, güncel yanıtlar sağlamasına olanak tanır.",
   "com_endpoint_assistant": "Asistan",
   "com_endpoint_assistant_model": "Asistan Modeli",
   "com_endpoint_assistant_placeholder": "Lütfen sağ tarafta bir Asistan seçin",
+  "com_endpoint_bedrock_reasoning_effort": "Desteklenen Bedrock modelleri için akıl yürütme seviyesini kontrol eder (ör. Kimi K2.5, GLM). Daha yüksek seviyeler, artan gecikme ve token pahasına daha kapsamlı mantık yürütme üretir.",
   "com_endpoint_config_click_here": "Buraya Tıklayın",
   "com_endpoint_config_google_api_info": "Gemini için Yapay Zeka Dil API Anahtarınızı almak için,",
   "com_endpoint_config_google_api_key": "Google API Anahtarı",
@@ -154,7 +254,7 @@
   "com_endpoint_config_key_name": "Anahtar",
   "com_endpoint_config_key_never_expires": "Anahtarınız asla sona ermeyecek",
   "com_endpoint_config_placeholder": "Sohbet etmek için Anahtarınızı Başlık menüsünde ayarlayın.",
-  "com_endpoint_config_value": "Değer girin",
+  "com_endpoint_config_value": "için değer girin",
   "com_endpoint_context": "Bağlam",
   "com_endpoint_context_info": "Bağlam için kullanılabilecek maksimum token sayısı. Bu, her istek için kaç token gönderileceğini kontrol etmek içindir. Belirtilmezse, bilinen modellerin bağlam boyutuna göre sistem varsayılanları kullanılacaktır. Daha yüksek değerler belirlemek hatalara ve/veya daha yüksek token maliyetine neden olabilir.",
   "com_endpoint_context_tokens": "Maksimum Bağlam Tokenleri",
@@ -162,15 +262,22 @@
   "com_endpoint_default": "varsayılan",
   "com_endpoint_default_blank": "varsayılan: boş",
   "com_endpoint_default_with_num": "varsayılan: {{0}}",
+  "com_endpoint_disable_streaming": "Akış yanıtlarını devre dışı bırakın ve tüm yanıtı tek seferde alın. Akış için organizasyon doğrulaması gerektiren o3 gibi modeller için faydalıdır",
+  "com_endpoint_disable_streaming_label": "Akışı Devre Dışı Bırak",
+  "com_endpoint_effort": "Çaba",
   "com_endpoint_examples": "Hazır Ayarlar",
   "com_endpoint_export": "Dışa Aktar",
   "com_endpoint_export_share": "Dışa Aktar / Paylaş",
   "com_endpoint_frequency_penalty": "Sıklık Cezası",
   "com_endpoint_google_custom_name_placeholder": "Google için özel bir ad ayarlayın",
-  "com_endpoint_google_maxoutputtokens": "Yanıttaki maksimum token sayısı. Daha kısa yanıtlar için düşük bir değer, daha uzun yanıtlar için yüksek bir değer belirtin.",
+  "com_endpoint_google_maxoutputtokens": "Yanıttaki maksimum token sayısı. Daha kısa yanıtlar için düşük bir değer, daha uzun yanıtlar için yüksek bir değer belirtin. Not: modeller bu maksimuma ulaşmadan durabilir.",
   "com_endpoint_google_temp": "Yüksek değerler = daha rastgele, düşük değerler = daha odaklı ve belirleyici. Bu parametre ile Olasılık Kütüphanesini değiştirmeyi öneririz (ikisini birden değiştirmemek).",
+  "com_endpoint_google_thinking": "Akıl yürütmeyi etkinleştirir veya devre dışı bırakır. Gemini 2.5 ve 3 serisi tarafından desteklenir. Not: Gemini 3 Pro düşünmeyi tamamen devre dışı bırakamaz.",
+  "com_endpoint_google_thinking_budget": "Modelin kullandığı düşünme tokenlerinin sayısını yönlendirir. Gerçek miktar isteme bağlı olarak bu değeri aşabilir veya altında kalabilir.\n\nBu ayar yalnızca Gemini 2.5 ve daha eski modeller için geçerlidir. Gemini 3 ve sonrası için bunun yerine Düşünme Seviyesi ayarını kullanın.\n\nGemini 2.5 Pro 128-32.768 tokeni destekler. Gemini 2.5 Flash 0-24.576 tokeni destekler. Gemini 2.5 Flash Lite 512-24.576 tokeni destekler.\n\nModelin ne zaman ve ne kadar düşüneceğine otomatik karar vermesi için boş bırakın veya \"-1\" olarak ayarlayın. Varsayılan olarak Gemini 2.5 Flash Lite düşünmez.",
+  "com_endpoint_google_thinking_level": "Gemini 3 ve sonraki modeller için akıl yürütme derinliğini kontrol eder. Gemini 2.5 ve daha eski modeller üzerinde etkisi yoktur — onlar için Düşünme Bütçesini kullanın.\n\nModel varsayılanını kullanmak için Otomatikte bırakın.",
   "com_endpoint_google_topk": "Top-k, modelin çıktı için token seçimini nasıl yaptığını değiştirir. 1 olan bir top-k, modelin kelime haznesindeki en olası tokenin seçildiği (açgözlü kod çözme olarak da adlandırılır) anlamına gelirken, 3 olan bir top-k, bir sonraki tokenin en olası üç token arasından (sıcaklık kullanılarak) seçileceği anlamına gelir.",
   "com_endpoint_google_topp": "Olasılık Kütüphanesi, modelin çıktı için token seçme şeklini değiştirir. Tokenler, en olasılıktan (bkz. topK parametresi) en az olasıya kadar seçilir ve olasılıkları toplamı, top-p değerine eşit olana kadar devam eder.",
+  "com_endpoint_google_use_search_grounding": "Gerçek zamanlı web arama sonuçlarıyla yanıtları geliştirmek için Google'ın arama temellendirme (grounding) özelliğini kullanın. Bu, modellerin güncel bilgilere erişmesini ve daha doğru, güncel yanıtlar sağlamasını sağlar.",
   "com_endpoint_instructions_assistants": "Talimatları Geçersiz Kıl",
   "com_endpoint_instructions_assistants_placeholder": "Asistanın talimatlarını geçersiz kılar. Bu, davranışı tek tek çalışma bazında değiştirmek için yararlıdır.",
   "com_endpoint_max_output_tokens": "Maksimum Çıktı Tokenleri",
@@ -186,23 +293,29 @@
   "com_endpoint_openai_max_tokens": "İsteğe bağlı `max_tokens` alanı, sohbet tamamlamalarında üretilebilecek maksimum token sayısını temsil eder. Giriş tokenlarının ve üretilen tokenların toplam uzunluğu, modellerin bağlam uzunluğu ile sınırlıdır. Bu sayının maksimum bağlam tokenlarını aşması durumunda hatalarla karşılaşabilirsiniz.",
   "com_endpoint_openai_pres": " -2.0 ile 2.0 arasında bir değer. Pozitif değerler, metinde daha önceki varlıklarına dayalı olarak yeni tokenları cezalandırır, bu da modelin yeni konular hakkında konuşma olasılığını artırır.",
   "com_endpoint_openai_prompt_prefix_placeholder": "Sistem Mesajına dahil edilecek özel talimatlar ayarlayın. Varsayılan: yok",
-  "com_endpoint_openai_reasoning_effort": "Sadece o1 modelleri: akıl yürütme modelleri için akıl yürütme çabasını kısıtlar. Akıl yürütme çabasını azaltmak, daha hızlı yanıtlara ve yanıtta akıl yürütmeye daha az token kullanılmasına neden olabilir.",
+  "com_endpoint_openai_reasoning_effort": "Sadece akıl yürütme modelleri: akıl yürütme çabasını kısıtlar. Akıl yürütme çabasını azaltmak, daha hızlı yanıtlara ve yanıtta akıl yürütmeye daha az token kullanılmasına neden olabilir. 'Minimal' kodlama ve talimat takibi için özellikle uygun olan en hızlı ilk token süresi için çok az akıl yürütme tokeni üretir.",
+  "com_endpoint_openai_reasoning_summary": "Sadece Yanıtlar API'si: Model tarafından gerçekleştirilen akıl yürütmenin bir özeti. Bu, modelin akıl yürütme sürecini hata ayıklamak ve anlamak için yararlı olabilir. none, auto, concise veya detailed olarak ayarlayın.",
   "com_endpoint_openai_resend": "Daha önce eklenmiş tüm görüntüleri yeniden gönderin. Not: Bu, token maliyetinizi önemli ölçüde artırabilir ve birden çok görüntü eklenmişse hatalarla karşılaşabilirsiniz.",
   "com_endpoint_openai_resend_files": "Daha önce eklenmiş tüm dosyaları yeniden gönderin. Not: Bu, token maliyetinizi artıracaktır ve birden çok eklenmiş dosya ile hatalarla karşılaşabilirsiniz.",
   "com_endpoint_openai_stop": "API'nin ek tokenlar üretmeyi durduracağı en fazla 4 sıra.",
   "com_endpoint_openai_temp": "Yüksek değerler = daha rastgele, düşük değerler = daha odaklı ve belirleyici. Bu parametre ile Olasılık Kütüphanesi (top-p) değiştirmeyi öneririz (ikisini birden değiştirmemek).",
   "com_endpoint_openai_topp": "Sıcaklıkla örneklemenin bir alternatifi olan, çekirdek örnekleme olarak adlandırılır, model top_p olasılık kütlesine sahip tokenların sonuçlarını dikkate alır. Yani 0.1, sadece top 10% olasılık kütlesine sahip tokenların dikkate alındığı anlamına gelir. Sıcaklık (temperature) ile değil bu parametre ile değiştirmenizi öneririz.",
+  "com_endpoint_openai_use_responses_api": "OpenAI'dan genişletilmiş özellikleri içeren Sohbet Tamamlamaları yerine Yanıtlar API'sini kullanın. o1-pro, o3-pro için ve akıl yürütme özetlerini etkinleştirmek için gereklidir.",
+  "com_endpoint_openai_use_web_search": "OpenAI'nin yerleşik arama yeteneklerini kullanarak web arama işlevini etkinleştirin. Bu, modelin güncel bilgiler için web'de arama yapmasına ve daha doğru, güncel yanıtlar sağlamasına olanak tanır.",
+  "com_endpoint_openai_verbosity": "Modelin yanıtının ayrıntı düzeyini kısıtlar. Daha düşük değerler daha kısa yanıtlara yol açarken, daha yüksek değerler daha ayrıntılı yanıtlarla sonuçlanır. Şu anda desteklenen değerler low (düşük), medium (orta) ve high (yüksek) düzeydedir.",
   "com_endpoint_output": "Çıktı",
   "com_endpoint_plug_image_detail": "Görüntü Detayı",
   "com_endpoint_plug_resend_files": "Dosyaları Yeniden Gönderin",
   "com_endpoint_presence_penalty": "Varlık Cezası",
   "com_endpoint_preset": "hazır ayar",
+  "com_endpoint_preset_custom_name_placeholder": "buraya bir şey girmeliydiniz. boş bırakıldı",
   "com_endpoint_preset_default": "şu anda varsayılan hazır ayar.",
   "com_endpoint_preset_default_item": "Varsayılan:",
   "com_endpoint_preset_default_none": "Aktif varsayılan hazır ayar yok.",
   "com_endpoint_preset_default_removed": "Artık varsayılan hazır ayar değil.",
   "com_endpoint_preset_delete_confirm": "Bu hazır ayarı silmek istediğinizden emin misiniz?",
   "com_endpoint_preset_delete_error": "Hazır ayarınızı silerken bir hata oluştu. Lütfen tekrar deneyin.",
+  "com_endpoint_preset_delete_success": "Hazır ayar başarıyla silindi",
   "com_endpoint_preset_import": "Hazır Ayar İthal Edildi!",
   "com_endpoint_preset_import_error": "Hazır ayarınızı karşıya yüklerken bir hata oluştu. Lütfen tekrar deneyin.",
   "com_endpoint_preset_name": "Hazır Ayar Adı",
@@ -218,52 +331,115 @@
   "com_endpoint_prompt_prefix_assistants_placeholder": "Asistanın ana talimatlarının üzerine ek talimatlar veya bağlam ekleyin. Boşsa yok sayılır.",
   "com_endpoint_prompt_prefix_placeholder": "Özel talimatlar veya bağlam ayarlayın. Boşsa yok sayılır.",
   "com_endpoint_reasoning_effort": "Akıl Yürütme Çabası",
+  "com_endpoint_reasoning_summary": "Akıl Yürütme Özeti",
   "com_endpoint_save_as_preset": "Hazır Olarak Kaydet",
   "com_endpoint_search": "Uç noktayı ada göre ara",
-  "com_endpoint_set_custom_name": "Özelleştirmenizi adlandırın, böylece bu ayarlanabilir",
+  "com_endpoint_search_endpoint_models": "{{0}} modelleri aranıyor...",
+  "com_endpoint_search_models": "Modeller aranıyor...",
+  "com_endpoint_search_var": "{{0}} aranıyor...",
+  "com_endpoint_set_custom_name": "Bu ayarı bulabilmeniz için özel bir ad ayarlayın",
   "com_endpoint_stop": "Durdurma Sıraları",
   "com_endpoint_stop_placeholder": "Değerleri ayırmak için `Enter` tuşuna basın",
   "com_endpoint_temperature": "Sıcaklık",
+  "com_endpoint_thinking": "Düşünme",
+  "com_endpoint_thinking_budget": "Düşünme Bütçesi",
+  "com_endpoint_thinking_level": "Düşünme Seviyesi",
   "com_endpoint_top_k": "Top K",
   "com_endpoint_top_p": "Top P",
   "com_endpoint_use_active_assistant": "Etkin Asistanı Kullan",
+  "com_endpoint_use_responses_api": "Yanıtlar API'sini Kullan",
+  "com_endpoint_use_search_grounding": "Google Arama ile Temellendirme (Grounding)",
+  "com_endpoint_verbosity": "Ayrıntı Düzeyi",
+  "com_error_endpoint_models_not_loaded": "{{0}} için modeller yüklenemedi. Lütfen sayfayı yenileyin ve tekrar deneyin.",
   "com_error_expired_user_key": "Belirtilen {{0}} anahtarı {{1}} tarihinde süresi dolmuş. Lütfen bir anahtar sağlayın ve tekrar deneyin.",
   "com_error_files_dupe": "Yinelenen dosya tespit edildi.",
   "com_error_files_empty": "Boş dosyalara izin verilmez.",
   "com_error_files_process": "Dosya işlenirken bir hata oluştu.",
   "com_error_files_upload": "Dosya yüklenirken bir hata oluştu.",
   "com_error_files_upload_canceled": "Dosya yükleme isteği iptal edildi. Not: dosya yüklemesi hala işleniyor olabilir ve manuel olarak silinmesi gerekecektir.",
+  "com_error_files_upload_too_large": "Dosya çok büyük. Lütfen {{0}} MB'tan daha küçük bir dosya yükleyin",
   "com_error_files_validation": "Dosya doğrulanırken bir hata oluştu.",
-  "com_error_input_length": "Son mesajın token sayısı çok uzun, token limitini aşıyor ({{0}}). Lütfen mesajınızı kısaltın, konuşma parametrelerinden maksimum bağlam boyutunu ayarlayın veya devam etmek için konuşmayı çatallayın.",
-  "com_error_invalid_user_key": "Sağlanan anahtar geçersiz. Lütfen bir anahtar sağlayın ve tekrar deneyin.",
+  "com_error_google_tool_conflict": "Yerleşik Google araçlarının kullanımı harici araçlarla desteklenmez. Lütfen yerleşik araçları veya harici araçları devre dışı bırakın.",
+  "com_error_heic_conversion": "HEIC resmini JPEG'e dönüştürme başarısız oldu. Lütfen resmi manuel olarak dönüştürmeyi veya farklı bir format kullanmayı deneyin.",
+  "com_error_illegal_model_request": "\"{{0}}\" modeli {{1}} için mevcut değil. Lütfen farklı bir model seçin.",
+  "com_error_input_length": "Son mesajın token sayısı çok uzun, token limitini aşıyor veya token limiti parametreleriniz yanlış yapılandırılmış ve bağlam penceresini olumsuz etkiliyor. Daha fazla bilgi: {{0}}. Lütfen mesajınızı kısaltın, konuşma parametelerinden maksimum bağlam boyutunu ayarlayın veya devam etmek için konuşmayı çatallayın.",
+  "com_error_invalid_agent_provider": "\"{{0}}\" sağlayıcısı Ajanlarla kullanılamaz. Lütfen ajanınızın ayarlarına gidin ve şu anda mevcut olan bir sağlayıcı seçin.",
+  "com_error_invalid_base_url": "Sağladığınız temel URL kısıtlanmış bir adresi hedefliyor. Lütfen geçerli bir harici URL kullanın ve tekrar deneyin.",
+  "com_error_invalid_user_key": "Sağlanan anahtar geçersiz. Lütfen geçerli bir anahtar sağlayın ve tekrar deneyin.",
+  "com_error_missing_model": "{{0}} için model seçilmedi. Lütfen bir model seçin ve tekrar deneyin.",
+  "com_error_models_not_loaded": "Modeller yapılandırması yüklenemedi. Lütfen sayfayı yenileyin ve tekrar deneyin.",
   "com_error_moderation": "Gönderdiğiniz içerik, topluluk kurallarımıza uymadığı için moderasyon sistemimiz tarafından işaretlenmiş görünüyor. Bu belirli konu ile devam edemiyoruz. Başka sorularınız veya incelemek istediğiniz başka konular varsa, mesajınızı düzenleyin veya yeni bir konuşma başlatın.",
   "com_error_no_base_url": "Temel URL bulunamadı. Lütfen bir tane sağlayın ve tekrar deneyin.",
   "com_error_no_user_key": "Anahtar bulunamadı. Lütfen bir anahtar sağlayın ve tekrar deneyin.",
+  "com_error_refusal": "Yanıt güvenlik filtreleri tarafından reddedildi. Mesajınızı yeniden yazın ve tekrar deneyin. Claude Sonnet 4.5 veya Opus 4.1 kullanırken bunu sık sık yaşıyorsanız, farklı kullanım kısıtlamalarına sahip olan Sonnet 4'ü deneyebilirsiniz.",
+  "com_error_stream_expired": "Yanıt akışı sona erdi veya zaten tamamlandı. Lütfen tekrar deneyin.",
+  "com_file_pages": "Sayfalar: {{pages}}",
+  "com_file_source": "Dosya",
+  "com_file_unknown": "Bilinmeyen Dosya",
+  "com_files_download_failed": "{{0}} dosya başarısız oldu",
+  "com_files_download_percent_complete": "%{{0}} tamamlandı",
+  "com_files_download_progress": "{{1}} dosyadan {{0}} tanesi",
+  "com_files_downloading": "Dosyalar İndiriliyor",
   "com_files_filter": "Dosyaları filtrele...",
+  "com_files_filter_by": "Dosyaları şuna göre filtrele...",
   "com_files_no_results": "Sonuç bulunamadı.",
-  "com_files_number_selected": "{{0}} dosya/dosyadan {{1}} seçildi",
+  "com_files_number_selected": "{{1}} dosya/öğeden {{0}} seçildi",
+  "com_files_preparing_download": "İndirme hazırlanıyor...",
+  "com_files_result_found": "{{count}} sonuç bulundu",
+  "com_files_results_found": "{{count}} sonuç bulundu",
+  "com_files_sharepoint_picker_title": "Dosyaları Seç",
+  "com_files_table": "Dosyalar Tablosu",
+  "com_files_upload_local_machine": "Yerel Bilgisayardan",
+  "com_files_upload_sharepoint": "SharePoint'ten",
   "com_generated_files": "Oluşturulan dosyalar:",
   "com_hide_examples": "Örnekleri Gizle",
+  "com_info_heic_converting": "HEIC resmi JPEG'e dönüştürülüyor...",
+  "com_nav_2fa": "İki Faktörlü Kimlik Doğrulama (2FA)",
   "com_nav_account_settings": "Hesap Ayarları",
-  "com_nav_always_make_prod": "Her zaman yeni sürümleri üretime al",
-  "com_nav_archive_created_at": "Oluşturulma Tarihi",
+  "com_nav_always_make_prod": "Her zaman yeni istem sürümlerini üretime al",
+  "com_nav_archive_created_at": "Arşivlenme Tarihi",
   "com_nav_archive_name": "Ad",
   "com_nav_archived_chats": "Arşivlenmiş sohbetler",
   "com_nav_at_command": "@-Komutu",
   "com_nav_at_command_description": "Uç noktaları, modelleri, ön ayarları vb. değiştirmek için \"@\" komutunu aç/kapat",
   "com_nav_audio_play_error": "Ses oynatma hatası: {{0}}",
   "com_nav_audio_process_error": "Ses işleme hatası: {{0}}",
+  "com_nav_auto_expand_tools": "Araç detaylarını otomatik genişlet",
   "com_nav_auto_scroll": "Sohbet açıldığında otomatik olarak son mesaja kaydır",
-  "com_nav_auto_send_prompts": "İstemleri Otomatik Gönder",
-  "com_nav_auto_send_text": "Metni otomatik gönder (3 sn sonra)",
+  "com_nav_auto_send_prompts": "Seçildiğinde istemleri gönder",
+  "com_nav_auto_send_prompts_desc": "Seçildiğinde istemi otomatik olarak sohbete gönder",
+  "com_nav_auto_send_text": "Metni otomatik gönder",
   "com_nav_auto_transcribe_audio": "Sesi otomatik olarak yazıya dök",
-  "com_nav_automatic_playback": "Son Mesajı Otomatik Çal (yalnızca dış)",
-  "com_nav_balance": "Denge",
+  "com_nav_automatic_playback": "Son Mesajı Otomatik Çal",
+  "com_nav_balance": "Bakiye",
+  "com_nav_balance_auto_refill_disabled": "Otomatik Dolum devre dışı.",
+  "com_nav_balance_auto_refill_error": "Otomatik dolum ayarları yüklenirken hata oluştu.",
+  "com_nav_balance_auto_refill_settings": "Otomatik Dolum Ayarları",
+  "com_nav_balance_day": "gün",
+  "com_nav_balance_days": "gün",
+  "com_nav_balance_every": "Her",
+  "com_nav_balance_hour": "saat",
+  "com_nav_balance_hours": "saat",
+  "com_nav_balance_interval": "Aralık:",
+  "com_nav_balance_last_refill": "Son Dolum:",
+  "com_nav_balance_minute": "dakika",
+  "com_nav_balance_minutes": "dakika",
+  "com_nav_balance_month": "ay",
+  "com_nav_balance_months": "ay",
+  "com_nav_balance_next_refill": "Sonraki Dolum:",
+  "com_nav_balance_next_refill_info": "Sonraki dolum otomatik olarak ancak şu iki şart da sağlandığında gerçekleşecektir: Son dolumdan bu yana belirlenen süre aralığı geçmiş olacak ve bir istem göndermek bakiyenizin sıfırın altına düşmesine neden olacak.",
+  "com_nav_balance_refill_amount": "Dolum Miktarı:",
+  "com_nav_balance_second": "saniye",
+  "com_nav_balance_seconds": "saniye",
+  "com_nav_balance_week": "hafta",
+  "com_nav_balance_weeks": "hafta",
   "com_nav_browser": "Tarayıcı",
+  "com_nav_center_chat_input": "Karşılama Ekranında Sohbet Girdisini Ortala",
   "com_nav_change_picture": "Resmi değiştir",
   "com_nav_chat_commands": "Sohbet Komutları",
   "com_nav_chat_commands_info": "Bu komutlar, mesajınızın başına belirli karakterler yazarak etkinleştirilir. Her komut, belirlenen öneki ile tetiklenir. Bu karakterleri sıklıkla mesaj başlatmak için kullanıyorsanız bunları devre dışı bırakabilirsiniz.",
   "com_nav_chat_direction": "Sohbet yönü",
+  "com_nav_chat_direction_selected": "Sohbet yönü: {{direction}}",
   "com_nav_clear_all_chats": "Tüm sohbetleri temizle",
   "com_nav_clear_cache_confirm_message": "Önbelleği temizlemek istediğinizden emin misiniz?",
   "com_nav_clear_conversation": "Sohbetleri temizle",
@@ -271,14 +447,16 @@
   "com_nav_close_sidebar": "Yan paneli kapat",
   "com_nav_commands": "Komutlar",
   "com_nav_confirm_clear": "Temizlemeyi Onayla",
+  "com_nav_control_panel": "Kontrol Paneli",
   "com_nav_conversation_mode": "Konuşma Modu",
   "com_nav_convo_menu_options": "Konuşma Menü Seçenekleri",
   "com_nav_db_sensitivity": "Desibel hassasiyeti",
+  "com_nav_default_temporary_chat": "Varsayılan Olarak Geçici Sohbet",
   "com_nav_delete_account": "Hesabı sil",
   "com_nav_delete_account_button": "Hesabımı kalıcı olarak sil",
   "com_nav_delete_account_confirm": "Hesabı silmek istediğinizden emin misiniz?",
   "com_nav_delete_account_email_placeholder": "Lütfen hesap e-postanızı girin",
-  "com_nav_delete_cache_storage": "Önbellek depolamayı sil",
+  "com_nav_delete_cache_storage": "TTS önbellek depolamasını sil",
   "com_nav_delete_data_info": "Tüm verileriniz silinecektir.",
   "com_nav_delete_warning": "UYARI: Bu işlem hesabınızı kalıcı olarak silecektir.",
   "com_nav_enable_cache_tts": "TTS önbelleğini etkinleştir",
@@ -291,58 +469,94 @@
   "com_nav_export_filename": "Dosya adı",
   "com_nav_export_filename_placeholder": "Dosya adını belirle",
   "com_nav_export_include_endpoint_options": "Uç nokta seçeneklerini dahil et",
-  "com_nav_export_recursive": "Yinelenen",
-  "com_nav_export_recursive_or_sequential": "Yinelenen mi, ardışık mı?",
+  "com_nav_export_recursive": "Özyinelemeli (Recursive)",
+  "com_nav_export_recursive_or_sequential": "Özyinelemeli mi yoksa sıralı mı?",
   "com_nav_export_type": "Tür",
   "com_nav_external": "Harici",
-  "com_nav_font_size": "Yazı Boyutu",
+  "com_nav_font_size": "Mesaj Yazı Boyutu",
   "com_nav_font_size_base": "Orta",
   "com_nav_font_size_lg": "Büyük",
   "com_nav_font_size_sm": "Küçük",
   "com_nav_font_size_xl": "Çok Büyük",
   "com_nav_font_size_xs": "Çok Küçük",
-  "com_nav_help_faq": "Yardım & SS",
+  "com_nav_help_faq": "Yardım & SSS",
+  "com_nav_info_balance": "Bakiye, kullanmanız için ne kadar token krediniz kaldığını gösterir. Token kredileri parasal değere çevrilir (ör. 1000 kredi = $0.001 USD)",
   "com_nav_info_code_artifacts": "Sohbet yanında deneysel kod yapıtlarının görüntülenmesini etkinleştirir",
+  "com_nav_info_code_artifacts_agent": "Bu ajan için kod yapıtlarının kullanımını etkinleştirir. \"Özel İstem Modu\" etkinleştirilmediği sürece, yapıtlara özel ek talimatlar varsayılan olarak eklenir.",
   "com_nav_info_custom_prompt_mode": "Etkinleştirildiğinde, varsayılan yapıtlar sistem istemi dahil edilmeyecektir. Bu modda tüm yapıt oluşturma talimatları manuel olarak sağlanmalıdır.",
+  "com_nav_info_default_temporary_chat": "Etkinleştirildiğinde, yeni sohbetler varsayılan olarak geçici sohbet modu aktifken başlayacaktır. Geçici sohbetler geçmişinize kaydedilmez.",
   "com_nav_info_enter_to_send": "Etkinleştirildiğinde, `ENTER` tuşuna basmak mesajınızı gönderecektir. Devre dışı bırakıldığında, Enter tuşuna basmak yeni bir satır ekleyecek ve mesajınızı göndermek için `CTRL + ENTER` / `⌘ + ENTER` tuşlarına basmanız gerekecektir.",
   "com_nav_info_fork_change_default": "`Sadece görünür mesajlar` yalnızca seçili mesaja giden doğrudan yolu içerir. `İlgili dalları dahil et` yol boyunca dalları ekler. `Buradan/buraya tümünü dahil et` tüm bağlantılı mesajları ve dalları içerir.",
-  "com_nav_info_fork_split_target_setting": "Etkinleştirildiğinde, çatallama, seçilen davranışa göre hedef mesajdan konuşmadaki en son mesaja kadar başlayacaktır.",
+  "com_nav_info_fork_split_target_setting": "Etkinleştirildiğinde, çatallama seçilen davranışa göre hedef mesajdan konuşmadaki en son mesaja kadar başlayacaktır.",
   "com_nav_info_include_shadcnui": "Etkinleştirildiğinde, shadcn/ui bileşenlerini kullanma talimatları dahil edilecektir. shadcn/ui, Radix UI ve Tailwind CSS kullanılarak oluşturulmuş yeniden kullanılabilir bileşenler koleksiyonudur. Not: bunlar uzun talimatlardır, yalnızca LLM'ye doğru içe aktarmaları ve bileşenleri bildirmek sizin için önemliyse etkinleştirmelisiniz. Bu bileşenler hakkında daha fazla bilgi için: https://ui.shadcn.com/",
   "com_nav_info_latex_parsing": "Etkinleştirildiğinde, mesajlardaki LaTeX kodu matematiksel denklemler olarak işlenecektir. LaTeX işlemeye ihtiyacınız yoksa performansı artırmak için bunu devre dışı bırakabilirsiniz.",
+  "com_nav_info_save_badges_state": "Etkinleştirildiğinde, sohbet rozetlerinin durumu kaydedilir. Bu, yeni bir sohbet başlattığınızda rozetlerin bir önceki sohbetle aynı durumda kalacağı anlamına gelir. Bu seçeneği devre dışı bırakırsanız, yeni bir sohbet oluşturduğunuzda rozetler varsayılan hallerine sıfırlanır.",
   "com_nav_info_save_draft": "Etkinleştirildiğinde, sohbet formuna girdiğiniz metin ve ekler otomatik olarak yerel olarak taslak olarak kaydedilecektir. Bu taslaklar, sayfayı yeniden yüklediğinizde veya farklı bir konuşmaya geçtiğinizde bile mevcut olacaktır. Taslaklar cihazınızda yerel olarak depolanır ve mesaj gönderildikten sonra silinir.",
   "com_nav_info_show_thinking": "Etkinleştirildiğinde, sohbet düşünme açılır menülerini varsayılan olarak açık gösterecek, yapay zekanın akıl yürütmesini gerçek zamanlı olarak görmenize olanak tanıyacaktır. Devre dışı bırakıldığında, daha temiz ve düzenli bir arayüz için düşünme açılır menüleri varsayılan olarak kapalı kalacaktır",
   "com_nav_info_user_name_display": "Etkinleştirildiğinde, gönderenin kullanıcı adı gönderdiğiniz her mesajın üzerinde gösterilecektir. Devre dışı bırakıldığında, mesajlarınızın üzerinde sadece \"Siz\" göreceksiniz.",
+  "com_nav_keep_screen_awake": "Yanıt oluşturulurken ekranı uyanık tut",
   "com_nav_lang_arabic": "العربية",
-  "com_nav_lang_auto": "Auto detect",
+  "com_nav_lang_armenian": "Հայերեն",
+  "com_nav_lang_auto": "Otomatik Algıla",
+  "com_nav_lang_bosnian": "Босански",
   "com_nav_lang_brazilian_portuguese": "Português Brasileiro",
+  "com_nav_lang_catalan": "Català",
   "com_nav_lang_chinese": "中文",
+  "com_nav_lang_czech": "Čeština",
+  "com_nav_lang_danish": "Dansk",
   "com_nav_lang_dutch": "Nederlands",
   "com_nav_lang_english": "English",
   "com_nav_lang_estonian": "Eesti keel",
   "com_nav_lang_finnish": "Suomi",
-  "com_nav_lang_french": "Français ",
+  "com_nav_lang_french": "Français",
   "com_nav_lang_georgian": "ქართული",
   "com_nav_lang_german": "Deutsch",
   "com_nav_lang_hebrew": "עברית",
+  "com_nav_lang_hungarian": "Magyar",
+  "com_nav_lang_icelandic": "Íslenska",
   "com_nav_lang_indonesia": "Indonesia",
   "com_nav_lang_italian": "Italiano",
   "com_nav_lang_japanese": "日本語",
   "com_nav_lang_korean": "한국어",
+  "com_nav_lang_latvian": "Latviski",
+  "com_nav_lang_lithuanian": "Lietuvių",
+  "com_nav_lang_norwegian_bokmal": "Norsk Bokmål",
+  "com_nav_lang_norwegian_nynorsk": "Norsk Nynorsk",
+  "com_nav_lang_persian": "فارسی",
   "com_nav_lang_polish": "Polski",
   "com_nav_lang_portuguese": "Português",
   "com_nav_lang_russian": "Русский",
+  "com_nav_lang_slovak": "Slovenčina",
+  "com_nav_lang_slovenian": "Slovenščina",
   "com_nav_lang_spanish": "Español",
   "com_nav_lang_swedish": "Svenska",
   "com_nav_lang_thai": "ไทย",
+  "com_nav_lang_tibetan": "བོད་སྐད་",
   "com_nav_lang_traditional_chinese": "繁體中文",
   "com_nav_lang_turkish": "Türkçe",
+  "com_nav_lang_ukrainian": "Українська",
+  "com_nav_lang_uyghur": "Uyƣur tili",
   "com_nav_lang_vietnamese": "Tiếng Việt",
   "com_nav_language": "Dil",
   "com_nav_latex_parsing": "Mesajlarda LaTeX işleme (performansı etkileyebilir)",
   "com_nav_log_out": "Çıkış yap",
   "com_nav_long_audio_warning": "Daha uzun metinlerin işlenmesi daha uzun sürecektir.",
   "com_nav_maximize_chat_space": "Sohbet alanını maksimize et",
-  "com_nav_modular_chat": "Konuşmalar arasında uç noktaları değiştir",
+  "com_nav_mcp_access_revoked": "MCP sunucusu erişimi başarıyla iptal edildi.",
+  "com_nav_mcp_configure_server": "{{0}} Yapılandır",
+  "com_nav_mcp_connect": "Bağlan",
+  "com_nav_mcp_connect_server": "{{0}} Bağlan",
+  "com_nav_mcp_reconnect": "Yeniden Bağlan",
+  "com_nav_mcp_status_connected": "Bağlı",
+  "com_nav_mcp_status_connecting": "{{0}} - Bağlanıyor",
+  "com_nav_mcp_status_disconnected": "Bağlantı Kesildi",
+  "com_nav_mcp_status_error": "Hata",
+  "com_nav_mcp_status_initializing": "Başlatılıyor",
+  "com_nav_mcp_status_needs_auth": "Kimlik Doğrulaması Gerekiyor",
+  "com_nav_mcp_status_unknown": "Bilinmiyor",
+  "com_nav_mcp_vars_update_error": "MCP özel kullanıcı değişkenleri güncellenirken hata oluştu",
+  "com_nav_mcp_vars_updated": "MCP özel kullanıcı değişkenleri başarıyla güncellendi.",
+  "com_nav_modular_chat": "Konuşmalar arasında uç noktaları değiştirmeyi etkinleştir",
   "com_nav_my_files": "Dosyalarım",
   "com_nav_not_supported": "Desteklenmiyor",
   "com_nav_open_sidebar": "Yan paneli aç",
@@ -351,14 +565,19 @@
   "com_nav_plus_command": "+-Komutu",
   "com_nav_plus_command_description": "Çoklu yanıt ayarı eklemek için \"+\" komutunu aç/kapat",
   "com_nav_profile_picture": "Profil Resmi",
+  "com_nav_save_badges_state": "Rozet durumunu kaydet",
   "com_nav_save_drafts": "Taslakları yerel olarak kaydet",
   "com_nav_scroll_button": "Sona kaydır düğmesi",
   "com_nav_search_placeholder": "Mesajları ara",
-  "com_nav_send_message": "Mesajı gönder",
+  "com_nav_send_message": "Mesaj gönder",
   "com_nav_setting_account": "Hesap",
+  "com_nav_setting_balance": "Bakiye",
   "com_nav_setting_chat": "Sohbet",
   "com_nav_setting_data": "Veri kontrolleri",
+  "com_nav_setting_delay": "Gecikme (sn)",
   "com_nav_setting_general": "Genel",
+  "com_nav_setting_mcp": "MCP Ayarları",
+  "com_nav_setting_personalization": "Kişiselleştirme",
   "com_nav_setting_speech": "Konuşma",
   "com_nav_settings": "Ayarlar",
   "com_nav_shared_links": "Paylaşılan bağlantılar",
@@ -375,6 +594,7 @@
   "com_nav_tool_dialog": "Asistan Araçları",
   "com_nav_tool_dialog_agents": "Ajan Araçları",
   "com_nav_tool_dialog_description": "Araç seçimlerinin kalıcı olması için asistan kaydedilmelidir.",
+  "com_nav_tool_dialog_mcp_server_tools": "MCP Sunucu Araçları",
   "com_nav_tool_remove": "Kaldır",
   "com_nav_tool_search": "Araçları Ara",
   "com_nav_user": "KULLANICI",
@@ -383,54 +603,183 @@
   "com_nav_voice_select": "Ses Seçimi",
   "com_show_examples": "Örnekleri Göster",
   "com_sidepanel_agent_builder": "Ajan Oluşturucu",
-  "com_sidepanel_assistant_builder": "Asistan Yapıcı",
+  "com_sidepanel_assistant_builder": "Asistan Oluşturucu",
   "com_sidepanel_attach_files": "Dosyaları Ekle",
   "com_sidepanel_conversation_tags": "Yer İmleri",
   "com_sidepanel_hide_panel": "Paneli Gizle",
   "com_sidepanel_manage_files": "Dosyaları Yönet",
   "com_sidepanel_parameters": "Parametreler",
+  "com_sources_agent_file": "Kaynak Belge",
+  "com_sources_agent_files": "Ajan Dosyaları",
+  "com_sources_download_aria_label": "İndir: {{filename}}{{status}}",
+  "com_sources_download_failed": "İndirme başarısız oldu",
+  "com_sources_download_local_unavailable": "İndirilemiyor: Dosya kaydedilmedi",
+  "com_sources_downloading_status": " (indiriliyor...)",
+  "com_sources_error_fallback": "Kaynaklar yüklenemedi",
+  "com_sources_image_alt": "Arama sonucu resmi",
+  "com_sources_more_files": "+{{count}} dosya",
+  "com_sources_more_sources": "+{{count}} kaynak",
+  "com_sources_pages": "Sayfalar",
+  "com_sources_region_label": "Arama sonuçları ve kaynaklar",
+  "com_sources_reload_page": "Sayfayı yeniden yükle",
+  "com_sources_tab_all": "Tümü",
+  "com_sources_tab_files": "Dosyalar",
+  "com_sources_tab_images": "Resimler",
+  "com_sources_tab_news": "Haberler",
+  "com_sources_title": "Kaynaklar",
+  "com_ui_2fa_account_security": "İki faktörlü kimlik doğrulama, hesabınıza ekstra bir güvenlik katmanı ekler",
+  "com_ui_2fa_disable": "2FA'yı Devre Dışı Bırak",
+  "com_ui_2fa_disable_error": "İki faktörlü kimlik doğrulamayı devre dışı bırakırken bir hata oluştu",
+  "com_ui_2fa_disabled": "2FA devre dışı bırakıldı",
+  "com_ui_2fa_enable": "2FA'yı Etkinleştir",
+  "com_ui_2fa_enabled": "2FA etkinleştirildi",
+  "com_ui_2fa_generate_error": "İki faktörlü kimlik doğrulama ayarları oluşturulurken bir hata oluştu",
+  "com_ui_2fa_invalid": "Geçersiz iki faktörlü kimlik doğrulama kodu",
+  "com_ui_2fa_setup": "2FA Kurulumu",
+  "com_ui_2fa_verification_required": "Devam etmek için 2FA kodunuzu girin",
+  "com_ui_2fa_verified": "İki Faktörlü Kimlik Doğrulama başarıyla doğrulandı",
   "com_ui_accept": "Kabul ediyorum",
+  "com_ui_action_button": "Eylem Düğmesi",
+  "com_ui_active": "Aktif",
   "com_ui_add": "Ekle",
-  "com_ui_add_model_preset": "Ek bir yanıt için bir model veya ön ayar ekleyin",
+  "com_ui_add_first_bookmark": "Bir tane eklemek için bir sohbete tıklayın",
+  "com_ui_add_first_mcp_server": "Başlamak için ilk MCP sunucunuzu oluşturun",
+  "com_ui_add_first_prompt": "Başlamak için ilk isteminizi oluşturun",
+  "com_ui_add_labels": "Etiket Ekle",
+  "com_ui_add_mcp": "MCP Ekle",
+  "com_ui_add_mcp_server": "MCP Sunucusu Ekle",
+  "com_ui_add_model_preset": "Ek bir yanıt için bir model veya hazır ayar ekleyin",
   "com_ui_add_multi_conversation": "Çoklu konuşma ekle",
+  "com_ui_add_special_variables": "Özel Değişkenler Ekle",
+  "com_ui_add_web_search_api_keys": "Web Arama API Anahtarlarını Ekle",
+  "com_ui_adding_details": "Detaylar ekleniyor",
+  "com_ui_additional_details": "Ek Detaylar",
   "com_ui_admin": "Yönetici",
   "com_ui_admin_access_warning": "Bu özelliğe Yönetici erişimini devre dışı bırakmak, yenileme gerektiren beklenmedik kullanıcı arayüzü sorunlarına neden olabilir. Kaydedilirse, geri almanın tek yolu tüm rolleri etkileyen librechat.yaml yapılandırmasındaki arayüz ayarı aracılığıyladır.",
   "com_ui_admin_settings": "Yönetici Ayarları",
+  "com_ui_admin_settings_section": "Yönetici Ayarları - {{section}}",
   "com_ui_advanced": "Gelişmiş",
+  "com_ui_advanced_settings": "Gelişmiş Ayarlar",
   "com_ui_agent": "Ajan",
+  "com_ui_agent_api_keys": "Ajan API Anahtarları",
+  "com_ui_agent_api_keys_description": "API üzerinden ajanlara uzaktan erişmek için API anahtarları oluşturun",
+  "com_ui_agent_category_aftersales": "Satış Sonrası",
+  "com_ui_agent_category_finance": "Finans",
+  "com_ui_agent_category_general": "Genel",
+  "com_ui_agent_category_hr": "İK",
+  "com_ui_agent_category_it": "BT",
+  "com_ui_agent_category_rd": "Ar-Ge",
+  "com_ui_agent_category_sales": "Satış",
+  "com_ui_agent_category_selector_aria": "Ajan kategori seçici",
+  "com_ui_agent_chain": "Ajan Zinciri (Ajan Karışımı)",
+  "com_ui_agent_chain_info": "Ajanlardan oluşan diziler oluşturmanıza olanak tanır. Her ajan zincirdeki önceki ajanların çıktılarına erişebilir. Ajanların yardımcı bilgi olarak önceki çıktıları kullandığı \"Mixture-of-Agents\" (Ajan Karışımı) mimarisine dayanmaktadır.",
+  "com_ui_agent_chain_max": "Maksimum ajan sınırına ulaştınız: {{0}}.",
   "com_ui_agent_delete_error": "Ajan silinirken bir hata oluştu",
   "com_ui_agent_deleted": "Ajan başarıyla silindi",
   "com_ui_agent_duplicate_error": "Ajan çoğaltılırken bir hata oluştu",
   "com_ui_agent_duplicated": "Ajan başarıyla çoğaltıldı",
+  "com_ui_agent_handoff_add": "Devretme ajanı ekle",
+  "com_ui_agent_handoff_description": "Devretme açıklaması",
+  "com_ui_agent_handoff_description_placeholder": "örn., İstatistiksel analiz için veri analistine aktar",
+  "com_ui_agent_handoff_info": "Spesifik uzmanlık gerektiğinde bu ajanın konuşmaları devredebileceği ajanları yapılandırın.",
+  "com_ui_agent_handoff_info_2": "Her bir devir işlemi, uzman ajanlara bağlam ile birlikte sorunsuz yönlendirme sağlayan bir transfer aracı oluşturur.",
+  "com_ui_agent_handoff_max": "Maksimum {{0}} devretme ajanı sınırına ulaşıldı.",
+  "com_ui_agent_handoff_prompt": "İletilen içerik (Passthrough)",
+  "com_ui_agent_handoff_prompt_key": "İçerik parametre adı (varsayılan: 'instructions')",
+  "com_ui_agent_handoff_prompt_key_placeholder": "Geçirilecek içeriği etiketle (varsayılan: 'instructions')",
+  "com_ui_agent_handoff_prompt_placeholder": "Bu ajana devralan ajana hangi içeriği oluşturup ileteceğini söyleyin. Bu özelliği etkinleştirmek için buraya bir şey eklemelisiniz.",
+  "com_ui_agent_handoffs": "Ajan Devretmeleri",
+  "com_ui_agent_name_is_required": "Ajan adı gereklidir",
+  "com_ui_agent_recursion_limit": "Maksimum Ajan Adımı",
+  "com_ui_agent_recursion_limit_info": "Ajanın nihai bir yanıt vermeden önce bir çalıştırmada atabileceği adım sayısını sınırlar. Varsayılan değer 25 adımdır. Bir adım, AI API isteği veya araç kullanım turudur. Örneğin, temel bir araç etkileşimi 3 adım sürer: başlangıç isteği, araç kullanımı ve takip isteği.",
+  "com_ui_agent_url_copied": "Ajan URL'si panoya kopyalandı",
+  "com_ui_agent_var": "{{0}} ajanı",
+  "com_ui_agent_version": "Sürüm",
+  "com_ui_agent_version_active": "Aktif Sürüm",
+  "com_ui_agent_version_empty": "Kullanılabilir sürüm yok",
+  "com_ui_agent_version_error": "Sürümler alınırken hata oluştu",
+  "com_ui_agent_version_history": "Sürüm Geçmişi",
+  "com_ui_agent_version_no_agent": "Ajan seçilmedi. Sürüm geçmişini görmek için lütfen bir ajan seçin.",
+  "com_ui_agent_version_no_date": "Tarih mevcut değil",
+  "com_ui_agent_version_restore": "Geri Yükle",
+  "com_ui_agent_version_restore_confirm": "Bu sürümü geri yüklemek istediğinizden emin misiniz?",
+  "com_ui_agent_version_restore_error": "Sürüm geri yüklenemedi",
+  "com_ui_agent_version_restore_success": "Sürüm başarıyla geri yüklendi",
+  "com_ui_agent_version_title": "Sürüm {{versionNumber}}",
+  "com_ui_agent_version_unknown_date": "Bilinmeyen tarih",
   "com_ui_agents": "Ajanlar",
   "com_ui_agents_allow_create": "Ajan oluşturmaya izin ver",
+  "com_ui_agents_allow_share": "Ajan paylaşımına izin ver",
+  "com_ui_agents_allow_share_public": "Ajanları herkese açık paylaşmaya izin ver",
   "com_ui_agents_allow_use": "Ajan kullanımına izin ver",
   "com_ui_all": "hepsi",
   "com_ui_all_proper": "Tümü",
+  "com_ui_analyzing": "Analiz ediliyor",
+  "com_ui_analyzing_finished": "Analiz tamamlandı",
+  "com_ui_api_key": "API Anahtarı",
+  "com_ui_api_key_copied": "API anahtarı panoya kopyalandı",
+  "com_ui_api_key_create_error": "API anahtarı oluşturulamadı",
+  "com_ui_api_key_created": "API anahtarı başarıyla oluşturuldu",
+  "com_ui_api_key_delete_error": "API anahtarı silinemedi",
+  "com_ui_api_key_deleted": "API anahtarı başarıyla silindi",
+  "com_ui_api_key_name": "Anahtar Adı",
+  "com_ui_api_key_name_placeholder": "Benim API Anahtarım",
+  "com_ui_api_key_name_required": "API anahtarı adı gereklidir",
+  "com_ui_api_key_warning": "API anahtarınızı şimdi kopyaladığınızdan emin olun. Bir daha göremeyeceksiniz!",
+  "com_ui_api_keys_load_error": "API anahtarları yüklenemedi",
   "com_ui_archive": "Arşivle",
-  "com_ui_archive_error": "Konuşmayı arşivleyemedi",
+  "com_ui_archive_delete_error": "Arşivlenmiş konuşma silinemedi",
+  "com_ui_archive_error": "Konuşma arşivlenemedi",
   "com_ui_artifact_click": "Açmak için tıklayın",
   "com_ui_artifacts": "Yapıtlar",
+  "com_ui_artifacts_options": "Yapıt Seçenekleri",
   "com_ui_artifacts_toggle": "Yapıtlar Arayüzünü Aç/Kapat",
+  "com_ui_artifacts_toggle_agent": "Yapıtları Etkinleştir",
   "com_ui_ascending": "Artan",
   "com_ui_assistant": "Asistan",
   "com_ui_assistant_delete_error": "Asistan silme sırasında bir hata oluştu",
   "com_ui_assistant_deleted": "Asistan başarıyla silindi",
   "com_ui_assistants": "Asistanlar",
-  "com_ui_assistants_output": "Asistan Çıkışı",
+  "com_ui_assistants_output": "Asistan Çıktıları",
+  "com_ui_at_least_one_owner_required": "En az bir sahip (owner) gereklidir",
   "com_ui_attach_error": "Dosya eklenemiyor. Bir konuşma oluşturun veya seçin ya da sayfayı yenilemeyi deneyin.",
+  "com_ui_attach_error_disabled": "Bu uç nokta için dosya yüklemeleri devre dışı",
+  "com_ui_attach_error_limit": "Dosya sınırına ulaşıldı:",
   "com_ui_attach_error_openai": "Asistan dosyalarını diğer uç noktalara ekleyemezsiniz",
   "com_ui_attach_error_size": "Uç nokta için dosya boyutu sınırı aşıldı:",
+  "com_ui_attach_error_total_size": "Uç nokta için toplam dosya boyutu sınırı aşıldı:",
   "com_ui_attach_error_type": "Uç nokta için desteklenmeyen dosya türü:",
+  "com_ui_attach_remove": "Dosyayı kaldır",
   "com_ui_attach_warn_endpoint": "Asistan olmayan dosyalar uyumlu bir araç olmadan göz ardı edilebilir",
   "com_ui_attachment": "Ek",
+  "com_ui_auth_type": "Kimlik Doğrulama Türü",
+  "com_ui_auth_url": "Yetkilendirme URL'si",
+  "com_ui_authenticate": "Kimlik Doğrula",
   "com_ui_authentication": "Kimlik Doğrulama",
+  "com_ui_authentication_type": "Kimlik Doğrulama Türü",
+  "com_ui_auto": "Otomatik",
+  "com_ui_available_options": "Mevcut seçenekler",
   "com_ui_avatar": "Avatar",
+  "com_ui_azure": "Azure",
+  "com_ui_azure_ad": "Entra ID",
+  "com_ui_back": "Geri",
+  "com_ui_back_to_builder": "Oluşturucuya geri dön",
   "com_ui_back_to_prompts": "İstemlere Dön",
+  "com_ui_backup_code_number": "Kod #{{number}}",
+  "com_ui_backup_codes": "Yedek Kodlar",
+  "com_ui_backup_codes_regenerate_error": "Yedek kodlar yeniden oluşturulurken bir hata oluştu",
+  "com_ui_backup_codes_regenerated": "Yedek kodlar başarıyla yeniden oluşturuldu",
+  "com_ui_backup_codes_security_info": "Güvenlik nedenleriyle yedek kodlar oluşturulduğunda yalnızca bir kez görüntülenir. Lütfen bunları güvenli bir yere kaydedin.",
+  "com_ui_backup_codes_status": "Yedek Kod Durumu",
+  "com_ui_basic": "Temel",
+  "com_ui_basic_auth_header": "Temel yetkilendirme başlığı (Basic Auth)",
+  "com_ui_bearer": "Bearer",
+  "com_ui_beta": "Beta",
   "com_ui_bookmark_delete_confirm": "Bu yer imini silmek istediğinizden emin misiniz?",
   "com_ui_bookmarks": "Yer İmleri",
   "com_ui_bookmarks_add": "Yer İmi Ekle",
   "com_ui_bookmarks_add_to_conversation": "Mevcut sohbete ekle",
+  "com_ui_bookmarks_count_selected": "Yer İmleri, {{count}} seçildi",
   "com_ui_bookmarks_create_error": "Yer imi oluşturulurken bir hata oluştu",
   "com_ui_bookmarks_create_exists": "Bu yer imi zaten mevcut",
   "com_ui_bookmarks_create_success": "Yer imi başarıyla oluşturuldu",
@@ -441,36 +790,97 @@
   "com_ui_bookmarks_edit": "Yer İmini Düzenle",
   "com_ui_bookmarks_filter": "Yer imlerini filtrele...",
   "com_ui_bookmarks_new": "Yeni Yer İmi",
+  "com_ui_bookmarks_tag_exists": "Bu başlığa sahip bir yer imi zaten mevcut",
   "com_ui_bookmarks_title": "Başlık",
   "com_ui_bookmarks_update_error": "Yer imi güncellenirken bir hata oluştu",
   "com_ui_bookmarks_update_success": "Yer imi başarıyla güncellendi",
+  "com_ui_branch_created": "Dal başarıyla oluşturuldu",
+  "com_ui_branch_error": "Dal oluşturulamadı",
+  "com_ui_branch_message": "Bu yanıttan dal oluştur",
+  "com_ui_by_author": "{{0}} tarafından",
+  "com_ui_callback_url": "Geri Dönüş (Callback) URL'si",
   "com_ui_cancel": "İptal",
+  "com_ui_cancelled": "İptal edildi",
+  "com_ui_category": "Kategori",
+  "com_ui_change_version": "Sürümü Değiştir",
   "com_ui_chat": "Sohbet",
   "com_ui_chat_history": "Sohbet Geçmişi",
+  "com_ui_chats": "Sohbetler",
+  "com_ui_check_internet": "İnternet bağlantınızı kontrol edin",
   "com_ui_clear": "Temizle",
   "com_ui_clear_all": "Tümünü temizle",
+  "com_ui_clear_browser_cache": "Tarayıcı önbelleğinizi temizleyin",
+  "com_ui_clear_presets": "Hazır Ayarları Temizle",
+  "com_ui_clear_search": "Aramayı temizle",
+  "com_ui_click_to_close": "Kapatmak için tıklayın",
+  "com_ui_click_to_edit": "Düzenlemek için tıklayın",
+  "com_ui_click_to_view_var": "{{0}} görüntülemek için tıklayın",
+  "com_ui_client_id": "İstemci Kimliği (Client ID)",
+  "com_ui_client_secret": "İstemci Sırrı (Client Secret)",
   "com_ui_close": "Kapat",
   "com_ui_close_menu": "Menüyü Kapat",
+  "com_ui_close_settings": "Ayarları Kapat",
+  "com_ui_close_var": "{{0}} Kapat",
+  "com_ui_close_window": "Pencereyi Kapat",
   "com_ui_code": "Kod",
+  "com_ui_collapse": "Daralt",
   "com_ui_collapse_chat": "Sohbeti Daralt",
-  "com_ui_command_placeholder": "İsteğe bağlı: İstem için bir komut girin veya ad kullanılacak",
-  "com_ui_command_usage_placeholder": "Bir İstemi komut veya ada göre seçin",
+  "com_ui_collapse_summary": "Özeti Daralt",
+  "com_ui_collapse_thoughts": "Düşünceleri Daralt",
+  "com_ui_command_placeholder": "İsteğe bağlı: İstem için bir komut girin veya adı kullanılacaktır",
+  "com_ui_command_usage_placeholder": "Komut veya isimle bir İstem seçin",
+  "com_ui_complete": "Tamamlandı!",
+  "com_ui_complete_setup": "Kurulumu Tamamla",
+  "com_ui_concise": "Kısa ve Öz",
+  "com_ui_configure": "Yapılandır",
+  "com_ui_configure_mcp_variables_for": "{{0}} İçin Değişkenleri Yapılandır",
+  "com_ui_confirm": "Onayla",
   "com_ui_confirm_action": "Eylemi Onayla",
   "com_ui_confirm_admin_use_change": "Bu ayarı değiştirmek, siz dahil yöneticilerin erişimini engelleyecektir. Devam etmek istediğinizden emin misiniz?",
   "com_ui_confirm_change": "Değişikliği Onayla",
+  "com_ui_connecting": "Bağlanıyor",
+  "com_ui_contact_admin_if_issue_persists": "Sorun devam ederse Yönetici ile iletişime geçin",
   "com_ui_context": "Bağlam",
+  "com_ui_context_filter_sort": "Bağlama Göre Filtrele ve Sırala",
   "com_ui_continue": "Devam et",
-  "com_ui_convo_delete_success": "Konuşma başarıyla silindi.",
+  "com_ui_continue_oauth": "OAuth ile Devam Et",
+  "com_ui_control_bar": "Kontrol çubuğu",
+  "com_ui_conversation": "konuşma",
+  "com_ui_conversation_label": "{{title}} konuşması",
+  "com_ui_conversation_not_found": "Konuşma bulunamadı",
+  "com_ui_conversation_summarized": "Konuşma özetlendi",
+  "com_ui_conversations": "konuşmalar",
+  "com_ui_convo_archived": "Konuşma arşivlendi",
+  "com_ui_convo_delete_error": "Konuşma silinemedi",
+  "com_ui_convo_delete_success": "Konuşma başarıyla silindi",
   "com_ui_copied": "Kopyalandı!",
   "com_ui_copied_to_clipboard": "Panoya kopyalandı",
+  "com_ui_copy": "Kopyala",
   "com_ui_copy_code": "Kodu kopyala",
+  "com_ui_copy_failed": "Panoya kopyalama başarısız oldu",
   "com_ui_copy_link": "Bağlantıyı kopyala",
+  "com_ui_copy_stack_trace": "Yığın izlemeyi (stack trace) kopyala",
+  "com_ui_copy_summary": "Özeti panoya kopyala",
+  "com_ui_copy_thoughts_to_clipboard": "Düşünceleri panoya kopyala",
   "com_ui_copy_to_clipboard": "Panoya kopyala",
+  "com_ui_copy_url_to_clipboard": "URL'yi panoya kopyala",
   "com_ui_create": "Oluştur",
+  "com_ui_create_api_key": "API Anahtarı Oluştur",
+  "com_ui_create_assistant": "Asistan Oluştur",
   "com_ui_create_link": "Bağlantı oluştur",
+  "com_ui_create_mcp_server": "MCP sunucusu oluştur",
+  "com_ui_create_new_agent": "Yeni Ajan Oluştur",
   "com_ui_create_prompt": "İstem Oluştur",
-  "com_ui_currently_production": "Şu anda üretimde",
+  "com_ui_create_prompt_page": "Yeni İstem Yapılandırma Sayfası",
+  "com_ui_created": "Oluşturuldu",
+  "com_ui_creating": "Oluşturuluyor...",
+  "com_ui_creating_image": "Resim oluşturuluyor. Biraz sürebilir",
+  "com_ui_current": "Geçerli",
+  "com_ui_currently_production": "Şu anda üretimde (production)",
+  "com_ui_custom": "Özel",
+  "com_ui_custom_header_name": "Özel Başlık (Header) Adı",
   "com_ui_custom_prompt_mode": "Özel İstem Modu",
+  "com_ui_dark_theme_enabled": "Karanlık tema etkin",
   "com_ui_date": "Tarih",
   "com_ui_date_april": "Nisan",
   "com_ui_date_august": "Ağustos",
@@ -486,195 +896,640 @@
   "com_ui_date_previous_30_days": "Önceki 30 gün",
   "com_ui_date_previous_7_days": "Önceki 7 gün",
   "com_ui_date_september": "Eylül",
+  "com_ui_date_sort": "Tarihe Göre Sırala",
   "com_ui_date_today": "Bugün",
   "com_ui_date_yesterday": "Dün",
   "com_ui_decline": "Kabul etmiyorum",
+  "com_ui_default_post_request": "Varsayılan (POST isteği)",
   "com_ui_delete": "Sil",
   "com_ui_delete_action": "Eylemi Sil",
   "com_ui_delete_action_confirm": "Bu eylemi silmek istediğinizden emin misiniz?",
+  "com_ui_delete_agent": "Ajanı Sil",
   "com_ui_delete_agent_confirm": "Bu ajanı silmek istediğinizden emin misiniz?",
+  "com_ui_delete_assistant": "Asistanı Sil",
   "com_ui_delete_assistant_confirm": "Bu Asistanı gerçekten silmek istediğinizden emin misiniz? Bu işlem geri alınamaz.",
-  "com_ui_delete_confirm": "Bu silinecek",
-  "com_ui_delete_confirm_prompt_version_var": "Bu, \"{{0}}\" için seçilen sürümü silecektir. Başka sürüm yoksa, istem silinecektir.",
-  "com_ui_delete_conversation": "Sohbeti sil?",
+  "com_ui_delete_confirm": "Bu işlem şunu silecek:",
+  "com_ui_delete_confirm_prompt_version_var": "Bu, \"{{0}}\" için seçilen sürümü silecektir. Başka sürüm yoksa istem tamamen silinir.",
+  "com_ui_delete_confirm_strong": "Bu <strong>{{title}}</strong> öğesini silecek",
+  "com_ui_delete_conversation": "Sohbet silinsin mi?",
+  "com_ui_delete_conversation_tooltip": "Konuşmayı sil",
+  "com_ui_delete_mcp_server": "MCP Sunucusu Silinsin mi?",
+  "com_ui_delete_mcp_server_name": "{{0}} MCP sunucusunu sil",
+  "com_ui_delete_not_allowed": "Silme işlemine izin verilmiyor",
+  "com_ui_delete_preset": "Hazır Ayar Silinsin mi?",
   "com_ui_delete_prompt": "İstem Silinsin mi?",
   "com_ui_delete_shared_link": "Paylaşılan bağlantı silinsin mi?",
+  "com_ui_delete_shared_link_heading": "Paylaşılan Bağlantıyı Sil",
+  "com_ui_delete_success": "Başarıyla silindi",
   "com_ui_delete_tool": "Aracı Sil",
   "com_ui_delete_tool_confirm": "Bu aracı silmek istediğinizden emin misiniz?",
+  "com_ui_delete_tool_save_reminder": "Araç kaldırıldı. Değişiklikleri uygulamak için ajanı kaydedin.",
+  "com_ui_deleted": "Silindi",
+  "com_ui_deleting": "Siliniyor...",
+  "com_ui_deleting_file": "Dosya siliniyor...",
+  "com_ui_deploy": "Dağıt (Deploy)",
   "com_ui_descending": "Azalan",
   "com_ui_description": "Açıklama",
   "com_ui_description_placeholder": "İsteğe bağlı: İstem için görüntülenecek bir açıklama girin",
+  "com_ui_deselect_all": "Tüm Seçimleri Kaldır",
+  "com_ui_detailed": "Detaylı",
+  "com_ui_details": "Detaylar",
+  "com_ui_disabling": "Devre dışı bırakılıyor...",
+  "com_ui_done": "Bitti",
   "com_ui_download": "İndir",
   "com_ui_download_artifact": "Yapıtı İndir",
+  "com_ui_download_backup": "Yedek Kodları İndir",
+  "com_ui_download_backup_tooltip": "Devam etmeden önce yedek kodlarınızı indirin. Kimlik doğrulayıcı cihazınızı kaybederseniz erişimi yeniden sağlamak için bunlara ihtiyacınız olacak.",
   "com_ui_download_error": "Dosya indirme hatası. Dosya silinmiş olabilir.",
-  "com_ui_drag_drop": "Sürükle ve bırak",
+  "com_ui_download_error_logs": "Hata günlüklerini indir",
+  "com_ui_drag_drop": "Konuşmaya eklemek için herhangi bir dosyayı buraya sürükleyip bırakın",
   "com_ui_dropdown_variables": "Açılır menü değişkenleri:",
   "com_ui_duplicate": "Çoğalt",
+  "com_ui_duplicate_agent": "Ajanı Çoğalt",
   "com_ui_duplication_error": "Konuşma çoğaltılırken bir hata oluştu",
   "com_ui_duplication_processing": "Konuşma çoğaltılıyor...",
   "com_ui_duplication_success": "Konuşma başarıyla çoğaltıldı",
   "com_ui_edit": "Düzenle",
+  "com_ui_edit_editing_image": "Resim düzenleniyor",
+  "com_ui_edit_mcp_server": "MCP Sunucusunu Düzenle",
+  "com_ui_edit_mcp_server_dialog_description": "Benzersiz Sunucu Tanımlayıcısı: {{serverName}}",
+  "com_ui_edit_preset_title": "Hazır Ayarı Düzenle - {{title}}",
+  "com_ui_edit_prompt_page": "İstem Düzenleme Sayfası",
+  "com_ui_editable_message": "Düzenlenebilir Mesaj",
+  "com_ui_editor_instructions": "Resmi yeniden konumlandırmak için sürükleyin • Boyutu ayarlamak için yakınlaştırma kaydırıcısını veya düğmelerini kullanın",
+  "com_ui_empty_category": "-",
   "com_ui_endpoint": "Uç Nokta",
   "com_ui_endpoint_menu": "LLM Uç Nokta Menüsü",
   "com_ui_enter": "Gir",
   "com_ui_enter_api_key": "API Anahtarı Girin",
+  "com_ui_enter_description": "Açıklama girin (isteğe bağlı)",
+  "com_ui_enter_key": "Anahtar girin",
+  "com_ui_enter_name": "Ad girin",
   "com_ui_enter_openapi_schema": "OpenAPI şemanızı buraya girin",
+  "com_ui_enter_value": "Değer girin",
   "com_ui_error": "Hata",
-  "com_ui_error_connection": "Sunucuya bağlanırken hata oluştu, sayfayı yenilemeyi deneyin.",
+  "com_ui_error_connection": "Sunucuya bağlanılırken hata oluştu, sayfayı yenilemeyi deneyin.",
+  "com_ui_error_message_prefix": "Hata Mesajı:",
   "com_ui_error_save_admin_settings": "Yönetici ayarlarınız kaydedilirken bir hata oluştu.",
+  "com_ui_error_try_following_prefix": "Lütfen şunlardan birini deneyin",
+  "com_ui_error_unexpected": "Oops! Beklenmeyen Bir Şey Oldu",
+  "com_ui_error_updating_preferences": "Tercihler güncellenirken hata oluştu",
+  "com_ui_everyone_permission_level": "Herkesin izin seviyesi",
   "com_ui_examples": "Örnekler",
+  "com_ui_expand": "Genişlet",
+  "com_ui_expand_chat": "Sohbeti Genişlet",
+  "com_ui_expand_thoughts": "Düşünceleri Genişlet",
   "com_ui_export_convo_modal": "Konuşma Dışa Aktarma Modalı",
+  "com_ui_failed": "Başarısız",
+  "com_ui_feedback_more": "Daha fazla...",
+  "com_ui_feedback_more_information": "Ek geri bildirim sağlayın",
+  "com_ui_feedback_negative": "Geliştirilmesi gerekiyor",
+  "com_ui_feedback_placeholder": "Lütfen buraya ek geri bildirim sağlayın",
+  "com_ui_feedback_positive": "Bunu sevdim",
+  "com_ui_feedback_tag_accurate_reliable": "Doğru ve Güvenilir",
+  "com_ui_feedback_tag_attention_to_detail": "Detaylara Dikkat Edilmiş",
+  "com_ui_feedback_tag_bad_style": "Kötü stil veya ton",
+  "com_ui_feedback_tag_clear_well_written": "Açık ve İyi Yazılmış",
+  "com_ui_feedback_tag_creative_solution": "Yaratıcı Çözüm",
+  "com_ui_feedback_tag_inaccurate": "Hatalı veya yanlış cevap",
+  "com_ui_feedback_tag_missing_image": "Bir resim bekleniyordu",
+  "com_ui_feedback_tag_not_helpful": "Faydalı bilgi eksikti",
+  "com_ui_feedback_tag_not_matched": "İsteğimle eşleşmedi",
+  "com_ui_feedback_tag_other": "Diğer sorun",
+  "com_ui_feedback_tag_unjustified_refusal": "Sebepsiz yere reddedildi",
+  "com_ui_field_max_length": "{{field}} {{length}} karakterden az olmalıdır",
   "com_ui_field_required": "Bu alan gereklidir",
+  "com_ui_file": "Dosya",
+  "com_ui_file_input_avatar_label": "Avatar için dosya girişi",
+  "com_ui_file_size": "Dosya Boyutu",
+  "com_ui_file_token_limit": "Dosya Token Sınırı",
+  "com_ui_file_token_limit_desc": "Maliyetleri ve kaynak kullanımını kontrol etmek için dosya işleme için maksimum token sınırını ayarlayın",
+  "com_ui_files": "Dosyalar",
+  "com_ui_filter_mcp_servers": "MCP sunucularını ada göre filtrele",
   "com_ui_filter_prompts": "İstemleri Filtrele",
   "com_ui_filter_prompts_name": "İstemleri ada göre filtrele",
-  "com_ui_fork": "Çatallaş",
-  "com_ui_fork_all_target": "Buradan tüm dahil et",
+  "com_ui_final_touch": "Son dokunuş",
+  "com_ui_finance": "Finans",
+  "com_ui_fork": "Çatalla (Fork)",
+  "com_ui_fork_all_target": "Buradan/buraya tümünü dahil et",
   "com_ui_fork_branches": "İlgili dalları dahil et",
   "com_ui_fork_change_default": "Varsayılan çatallama seçeneği",
   "com_ui_fork_default": "Varsayılan çatallama seçeneğini kullan",
   "com_ui_fork_error": "Konuşma çatallanmasında bir hata oluştu",
+  "com_ui_fork_error_rate_limit": "Çok fazla çatallama isteği. Lütfen daha sonra tekrar deneyin",
   "com_ui_fork_from_message": "Bir çatallama seçeneği seç",
   "com_ui_fork_info_1": "Mesajların istenilen davranışla çatallanması için bu ayarı kullanın.",
-  "com_ui_fork_info_2": "\"Çatallaşma\", mevcut konuşmadaki belirli mesajlardan veya mesajlardan başlayan/sonlanan yeni bir konuşma oluşturmayı ifade eder, seçilen seçeneklere göre bir kopya oluşturur.",
-  "com_ui_fork_info_3": "\"Hedef mesaj\" bu açılır pencerenin açıldığı mesajı veya \"{{0}}\" işaretlenirse, konuşmadaki son mesajı ifade eder.",
+  "com_ui_fork_info_2": "\"Çatallaşma\", mevcut konuşmadaki belirli mesajlardan başlayan/sonlanan yeni bir konuşma oluşturmayı ifade eder ve seçilen seçeneklere göre bir kopya oluşturur.",
+  "com_ui_fork_info_3": "\"Hedef mesaj\", bu açılır pencerenin açıldığı mesajı veya \"{{0}}\" işaretlenirse, konuşmadaki son mesajı ifade eder.",
   "com_ui_fork_info_branches": "Bu seçenek, görünen mesajları ilgili dallarla birlikte çatallandırır; diğer bir deyişle, hedef mesaja giden doğrudan yolu ve yol üzerindeki dalları içerir.",
-  "com_ui_fork_info_remember": "Çatallama işlemlerinde hızlıca tercih ettiğiniz seçenekleri hatırlayın, böylece gelecekte çatallama işlemlerini daha hızlı yapabilirsiniz.",
-  "com_ui_fork_info_start": "İşaretlenirse, yukarıda seçilen davranışa göre bu mesajdan konuşmadaki son mesaja kadar çatallandırılacaktır.",
+  "com_ui_fork_info_button_label": "Konuşmaları çatallama hakkında bilgi görüntüle",
+  "com_ui_fork_info_remember": "Gelecekteki kullanımlarda tercih ettiğiniz seçenekleri hatırlamak için bunu işaretleyin, böylece çatallama işlemleri daha hızlı yapılabilir.",
+  "com_ui_fork_info_start": "İşaretlenirse, yukarıda seçilen davranışa göre çatallama işlemi bu mesajdan başlayıp konuşmadaki en son mesaja kadar sürecektir.",
   "com_ui_fork_info_target": "Bu seçenek, hedef mesaja kadar olan tüm mesajları ve komşularını çatallandırır; diğer bir deyişle, tüm mesaj dalları, görünür olup olmadıklarına veya aynı yoldan olup olmadıklarına bakılmaksızın dahildir.",
-  "com_ui_fork_info_visible": "Bu seçenek sadece görünen mesajları çatallandırır; diğer bir deyişle, hedef mesaja giden doğrudan yolu, herhangi bir dal olmadan.",
+  "com_ui_fork_info_visible": "Bu seçenek sadece görünen mesajları çatallandırır; diğer bir deyişle, herhangi bir dal olmadan hedef mesaja giden doğrudan yolu alır.",
+  "com_ui_fork_more_details_about": "\"{{0}}\" çatallama seçeneği hakkında daha fazla bilgi ve ayrıntı görüntüle",
+  "com_ui_fork_more_info_options": "Tüm çatallama seçeneklerinin ve davranışlarının detaylı açıklamasını görüntüle",
+  "com_ui_fork_open_menu": "Çatallama Menüsünü Aç",
   "com_ui_fork_processing": "Konuşma çatallanıyor...",
   "com_ui_fork_remember": "Hatırla",
   "com_ui_fork_remember_checked": "Seçiminiz kullanımdan sonra hatırlanacaktır. Ayarlardan herhangi bir zamanda bunu değiştirebilirsiniz.",
   "com_ui_fork_split_target": "Çatallamaya burada başla",
   "com_ui_fork_split_target_setting": "Varsayılan olarak hedef mesajdan çatallamaya başla",
-  "com_ui_fork_success": "Başarıyla çatallanmış konuşma",
-  "com_ui_fork_visible": "Sadece görünen mesajlar",
+  "com_ui_fork_success": "Konuşma başarıyla çatallandı",
+  "com_ui_fork_visible": "Sadece görünür mesajlar",
+  "com_ui_generate_qrcode": "QR Kodu Oluştur",
+  "com_ui_generating": "Oluşturuluyor...",
+  "com_ui_generating_image": "Resim oluşturuluyor...",
+  "com_ui_generation_settings": "Oluşturma Ayarları",
+  "com_ui_getting_started": "Başlarken",
   "com_ui_go_back": "Geri git",
-  "com_ui_go_to_conversation": "Konuşmaya Git",
+  "com_ui_go_to_conversation": "Konuşmaya git",
+  "com_ui_good_afternoon": "Tünaydın",
+  "com_ui_good_evening": "İyi akşamlar",
+  "com_ui_good_morning": "Günaydın",
+  "com_ui_group": "Grup",
+  "com_ui_handoff_instructions": "Devretme talimatları",
   "com_ui_happy_birthday": "1. doğum günüm kutlu olsun!",
+  "com_ui_header_format": "Başlık (Header) Formatı",
+  "com_ui_hide": "Gizle",
+  "com_ui_hide_code": "Kodu Gizle",
+  "com_ui_hide_image_details": "Resim Detaylarını Gizle",
   "com_ui_hide_qr": "QR Kodunu Gizle",
-  "com_ui_host": "Host",
-  "com_ui_image_gen": "Görüntü Oluştur",
+  "com_ui_high": "Yüksek",
+  "com_ui_host": "Host (Sunucu)",
+  "com_ui_icon": "Simge",
+  "com_ui_idea": "Fikirler",
+  "com_ui_image_created": "Resim oluşturuldu",
+  "com_ui_image_details": "Resim Detayları",
+  "com_ui_image_edited": "Resim düzenlendi",
+  "com_ui_image_gen": "Resim Oluşturma",
+  "com_ui_image_gen_failed": "Resim oluşturma başarısız oldu",
+  "com_ui_import": "İçe Aktar",
   "com_ui_import_conversation_error": "Konuşmalarınızı içe aktarma sırasında bir hata oluştu",
   "com_ui_import_conversation_file_type_error": "Desteklenmeyen içe aktarma türü",
   "com_ui_import_conversation_info": "JSON dosyasından konuşmaları içe aktar",
   "com_ui_import_conversation_success": "Konuşmalar başarıyla içe aktarıldı",
+  "com_ui_import_conversation_upload_error": "Dosya yüklenirken hata oluştu. Lütfen tekrar deneyin.",
+  "com_ui_importing": "İçe Aktarılıyor",
   "com_ui_include_shadcnui": "shadcn/ui bileşen talimatlarını dahil et",
+  "com_ui_initializing": "Başlatılıyor...",
   "com_ui_input": "Girdi",
   "com_ui_instructions": "Talimatlar",
+  "com_ui_key": "Anahtar",
+  "com_ui_key_required": "API anahtarı gereklidir",
+  "com_ui_labels": "Etiketler",
+  "com_ui_last_used": "Son kullanım",
+  "com_ui_late_night": "İyi geceler",
+  "com_ui_latest": "en son",
   "com_ui_latest_footer": "Herkes için Her Yapay Zeka.",
   "com_ui_latest_version": "En son sürüm",
+  "com_ui_leave_blank_to_keep": "Mevcut olanı korumak için boş bırakın",
+  "com_ui_light_theme_enabled": "Aydınlık tema etkin",
+  "com_ui_link_copied": "Bağlantı kopyalandı",
+  "com_ui_link_refreshed": "Bağlantı yenilendi",
+  "com_ui_live": "canlı",
+  "com_ui_loading": "Yükleniyor...",
   "com_ui_locked": "Kilitli",
   "com_ui_logo": "{{0}} Logosu",
+  "com_ui_low": "Düşük",
+  "com_ui_make_production": "Üretim (Production) Yap",
   "com_ui_manage": "Yönet",
+  "com_ui_marketplace": "Pazaryeri",
+  "com_ui_marketplace_allow_use": "Pazaryeri kullanımına izin ver",
+  "com_ui_max": "Maksimum",
+  "com_ui_max_favorites_reached": "Maksimum sabitlenmiş öğe sınırına ulaşıldı ({{0}}). Daha fazla eklemek için bir öğenin sabitlemesini kaldırın.",
+  "com_ui_max_file_size": "PNG, JPG veya JPEG (maks {{0}})",
   "com_ui_max_tags": "İzin verilen maksimum sayı {{0}}, en son değerler kullanılıyor.",
+  "com_ui_mcp_authenticated_success": "'{{0}}' MCP sunucusu başarıyla doğrulandı",
+  "com_ui_mcp_click_to_defer": "Ertelemek için tıklayın - araç arama yoluyla bulunabilir ancak gerekene kadar yüklenmez",
+  "com_ui_mcp_click_to_programmatic": "Programatik çağırmayı etkinleştir - araç yalnızca kod yürütme yoluyla çağrılabilir",
+  "com_ui_mcp_configure_server": "{{0}} Yapılandır",
+  "com_ui_mcp_configure_server_description": "{{0}} için özel değişkenleri yapılandır",
+  "com_ui_mcp_defer": "Ertele",
+  "com_ui_mcp_defer_all": "Tüm araçları ertele",
+  "com_ui_mcp_defer_loading": "Yüklemeyi ertele",
+  "com_ui_mcp_dialog_title": "{{serverName}} için Değişkenleri Yapılandır. Sunucu Durumu: {{status}}",
+  "com_ui_mcp_domain_not_allowed": "MCP sunucusu alan adı (domain) izin verilenler listesinde değil. Lütfen yöneticinizle iletişime geçin.",
+  "com_ui_mcp_enter_var": "{{0}} için değer girin",
+  "com_ui_mcp_init_failed": "MCP sunucusu başlatılamadı",
+  "com_ui_mcp_initialize": "Başlat",
+  "com_ui_mcp_initialized_success": "'{{0}}' MCP sunucusu başarıyla başlatıldı",
+  "com_ui_mcp_invalid_url": "Lütfen geçerli bir URL girin",
+  "com_ui_mcp_no_description": "Açıklama mevcut değil",
+  "com_ui_mcp_oauth_cancelled": "{{0}} için OAuth girişi iptal edildi",
+  "com_ui_mcp_oauth_timeout": "{{0}} için OAuth girişi zaman aşımına uğradı",
+  "com_ui_mcp_programmatic": "Programatik",
+  "com_ui_mcp_programmatic_all": "Tümünü programatik olarak işaretle",
+  "com_ui_mcp_server": "MCP Sunucusu",
+  "com_ui_mcp_server_connection_failed": "Sağlanan MCP sunucusuna bağlantı denemesi başarısız oldu. Lütfen URL'nin, sunucu türünün ve herhangi bir kimlik doğrulama yapılandırmasının doğru olduğundan emin olup tekrar deneyin. Ayrıca URL'ye ulaşılabildiğinden emin olun.",
+  "com_ui_mcp_server_created": "MCP sunucusu başarıyla oluşturuldu",
+  "com_ui_mcp_server_delete_confirm": "Bu MCP sunucusunu silmek istediğinizden emin misiniz?",
+  "com_ui_mcp_server_deleted": "MCP sunucusu başarıyla silindi",
+  "com_ui_mcp_server_role_editor": "MCP Sunucusu Düzenleyici",
+  "com_ui_mcp_server_role_editor_desc": "MCP sunucularını görüntüleyebilir, kullanabilir ve düzenleyebilir",
+  "com_ui_mcp_server_role_owner": "MCP Sunucusu Sahibi",
+  "com_ui_mcp_server_role_owner_desc": "MCP sunucuları üzerinde tam kontrol",
+  "com_ui_mcp_server_role_viewer": "MCP Sunucusu İzleyici",
+  "com_ui_mcp_server_role_viewer_desc": "MCP sunucularını görüntüleyebilir ve kullanabilir",
+  "com_ui_mcp_server_updated": "MCP sunucusu başarıyla güncellendi",
+  "com_ui_mcp_server_url_placeholder": "https://mcp.example.com",
+  "com_ui_mcp_servers": "MCP Sunucuları",
+  "com_ui_mcp_servers_allow_create": "Kullanıcıların MCP sunucuları oluşturmasına izin ver",
+  "com_ui_mcp_servers_allow_share": "Kullanıcıların MCP sunucularını paylaşmasına izin ver",
+  "com_ui_mcp_servers_allow_share_public": "Kullanıcıların MCP sunucularını herkese açık paylaşmasına izin ver",
+  "com_ui_mcp_servers_allow_use": "Kullanıcıların MCP sunucularını kullanmasına izin ver",
+  "com_ui_mcp_title_invalid": "Başlık yalnızca harf, rakam ve boşluk içerebilir",
+  "com_ui_mcp_tool_options": "Araç Seçenekleri",
+  "com_ui_mcp_transport": "Taşıma (Transport)",
+  "com_ui_mcp_type_sse": "SSE",
+  "com_ui_mcp_type_streamable_http": "Streamable HTTPS",
+  "com_ui_mcp_undefer": "Ertelemeyi Geri Al",
+  "com_ui_mcp_undefer_all": "Tüm araçların ertelenmesini geri al",
+  "com_ui_mcp_unprogrammatic_all": "Tümünün programatik işaretini kaldır",
+  "com_ui_mcp_update_var": "{{0}} Güncelle",
+  "com_ui_mcp_url": "MCP Sunucu URL'si",
+  "com_ui_medium": "Orta",
+  "com_ui_memory_key_hint": "Yalnızca küçük harfler ve alt çizgi kullanın",
   "com_ui_mention": "Bir uç nokta, asistan veya hazır ayar anın, hızlıca ona geçmek için",
+  "com_ui_mermaid": "mermaid",
+  "com_ui_mermaid_failed": "Diyagram çizilemedi:",
+  "com_ui_mermaid_source": "Kaynak kod:",
+  "com_ui_message_input": "Mesaj girdisi",
+  "com_ui_microphone_unavailable": "Mikrofon kullanılamıyor",
   "com_ui_min_tags": "Daha fazla değer kaldırılamaz, en az {{0}} gereklidir.",
+  "com_ui_minimal": "Minimal",
+  "com_ui_misc": "Çeşitli (Misc.)",
   "com_ui_model": "Model",
   "com_ui_model_parameters": "Model Parametreleri",
+  "com_ui_model_parameters_reset": "Model Parametreleri sıfırlandı.",
+  "com_ui_model_selected": "{{0}} seçildi",
   "com_ui_more_info": "Daha fazla bilgi",
   "com_ui_my_prompts": "İstemlerim",
   "com_ui_name": "Ad",
+  "com_ui_name_sort": "Ada Göre Sırala",
+  "com_ui_navigate_results": "Sonuçlarda gezin",
+  "com_ui_new": "Yeni",
   "com_ui_new_chat": "Yeni sohbet",
+  "com_ui_new_conversation_title": "Yeni Konuşma Başlığı",
   "com_ui_next": "Sonraki",
+  "com_ui_next_result": "Sonraki sonuç",
   "com_ui_no": "Hayır",
+  "com_ui_no_api_keys": "Henüz API anahtarı yok. Başlamak için bir tane oluşturun.",
+  "com_ui_no_auth": "Yok (Otomatik algıla)",
   "com_ui_no_bookmarks": "henüz yer iminiz yok gibi görünüyor. Bir sohbete tıklayın ve yeni bir tane ekleyin",
+  "com_ui_no_bookmarks_match": "Aramanızla eşleşen yer imi yok",
+  "com_ui_no_bookmarks_title": "Henüz yer imi yok",
+  "com_ui_no_categories": "Mevcut kategori yok",
   "com_ui_no_category": "Kategori yok",
+  "com_ui_no_changes": "Herhangi bir değişiklik yapılmadı",
+  "com_ui_no_individual_access": "Bu ajana erişimi olan hiçbir bireysel kullanıcı veya grup yok",
+  "com_ui_no_labels": "Etiket Yok",
+  "com_ui_no_mcp_servers": "Henüz MCP sunucusu yok",
+  "com_ui_no_mcp_servers_match": "Filtrenizle eşleşen MCP sunucusu yok",
+  "com_ui_no_personalization_available": "Şu anda hiçbir kişiselleştirme seçeneği mevcut değil",
+  "com_ui_no_prompts_title": "Henüz istem yok",
+  "com_ui_no_results_found": "Sonuç bulunamadı",
   "com_ui_no_terms_content": "Şartlar ve koşullar için içerik bulunmuyor",
+  "com_ui_none": "Hiçbiri",
+  "com_ui_not_used": "Kullanılmadı",
   "com_ui_nothing_found": "Hiçbir şey bulunamadı",
-  "com_ui_of": "-den",
+  "com_ui_oauth": "OAuth",
+  "com_ui_oauth_connected_to": "Şuraya bağlı:",
+  "com_ui_oauth_error_callback_failed": "Kimlik doğrulama geri dönüşü (callback) başarısız oldu. Lütfen tekrar deneyin.",
+  "com_ui_oauth_error_generic": "Kimlik doğrulama başarısız oldu. Lütfen tekrar deneyin.",
+  "com_ui_oauth_error_invalid_state": "Geçersiz durum (state) parametresi. Lütfen tekrar deneyin.",
+  "com_ui_oauth_error_missing_code": "Yetkilendirme kodu (authorization code) eksik. Lütfen tekrar deneyin.",
+  "com_ui_oauth_error_missing_state": "Durum (state) parametresi eksik. Lütfen tekrar deneyin.",
+  "com_ui_oauth_error_title": "Kimlik Doğrulama Başarısız",
+  "com_ui_oauth_success_description": "Kimlik doğrulamanız başarılı oldu. Bu pencere kapanacaktır:",
+  "com_ui_oauth_success_title": "Kimlik Doğrulama Başarılı",
+  "com_ui_of": " / ",
   "com_ui_off": "Kapalı",
+  "com_ui_offline": "Çevrimdışı",
   "com_ui_on": "Açık",
+  "com_ui_open_archived_chat_new_tab_title": "{{title}} (yeni sekmede açılır)",
+  "com_ui_open_source_chat_new_tab": "Kaynak Sohbeti Yeni Sekmede Aç",
+  "com_ui_open_source_chat_new_tab_title": "Kaynak Sohbeti Yeni Sekmede Aç - {{title}}",
+  "com_ui_open_var": "{{0}} Aç",
+  "com_ui_openai": "OpenAI",
+  "com_ui_optional": "(isteğe bağlı)",
+  "com_ui_options": "seçenekler",
+  "com_ui_output": "Çıktı",
   "com_ui_page": "Sayfa",
+  "com_ui_pagination": "Sayfalandırma",
+  "com_ui_parameters": "Parametreler",
+  "com_ui_people": "kişiler",
+  "com_ui_people_picker": "Kişi Seçici",
+  "com_ui_people_picker_allow_view_groups": "Grupları görüntülemeye izin ver",
+  "com_ui_people_picker_allow_view_roles": "Rolleri görüntülemeye izin ver",
+  "com_ui_people_picker_allow_view_users": "Kullanıcıları görüntülemeye izin ver",
+  "com_ui_permissions_failed_load": "İzinler yüklenemedi. Lütfen tekrar deneyin.",
+  "com_ui_permissions_failed_update": "İzinler güncellenemedi. Lütfen tekrar deneyin.",
+  "com_ui_permissions_updated_success": "İzinler başarıyla güncellendi",
+  "com_ui_pin": "Sabitle",
+  "com_ui_preferences_updated": "Tercihler başarıyla güncellendi",
   "com_ui_prev": "Önceki",
+  "com_ui_prev_result": "Önceki sonuç",
   "com_ui_preview": "Önizleme",
+  "com_ui_preview_unavailable": "Bu dosya türü için önizleme kullanılamıyor",
   "com_ui_privacy_policy": "Gizlilik Politikası",
   "com_ui_privacy_policy_url": "Gizlilik Politikası URL'si",
+  "com_ui_production": "Üretim (Production)",
   "com_ui_prompt": "İstem",
+  "com_ui_prompt_category_selector_aria": "İstem kategori seçici",
+  "com_ui_prompt_delete_confirm": "'{{0}}' istemini silmek istediğinizden emin misiniz?",
+  "com_ui_prompt_deleted_group": "\"{{0}}\" istem grubu silindi",
+  "com_ui_prompt_details": "{{name}} istemi detayları",
+  "com_ui_prompt_group_button": "{{name}} istemi, {{category}} kategorisi",
+  "com_ui_prompt_group_button_no_category": "{{name}} istemi",
+  "com_ui_prompt_groups": "İstem Grupları Listesi",
+  "com_ui_prompt_input": "İstem girdisi",
+  "com_ui_prompt_input_field": "İstem metin giriş alanı",
   "com_ui_prompt_name": "İstem Adı",
-  "com_ui_prompt_name_required": "İstem Adı gerekli",
+  "com_ui_prompt_name_required": "İstem Adı gereklidir",
   "com_ui_prompt_preview_not_shared": "Yazar bu istem için işbirliğine izin vermemiş.",
   "com_ui_prompt_text": "Metin",
-  "com_ui_prompt_text_required": "Metin gerekli",
+  "com_ui_prompt_text_required": "Metin gereklidir",
   "com_ui_prompt_update_error": "İstem güncellenirken bir hata oluştu",
+  "com_ui_prompt_variables_list": "İstem değişkenleri listesi",
   "com_ui_prompts": "İstemler",
   "com_ui_prompts_allow_create": "İstem oluşturmaya izin ver",
+  "com_ui_prompts_allow_share": "İstem paylaşımına izin ver",
+  "com_ui_prompts_allow_share_public": "İstemleri herkese açık paylaşmaya izin ver",
   "com_ui_prompts_allow_use": "İstem kullanımına izin ver",
   "com_ui_provider": "Sağlayıcı",
+  "com_ui_quality": "Kalite",
   "com_ui_read_aloud": "Sesli oku",
+  "com_ui_redirect_uri": "Yönlendirme (Redirect) URI'si",
+  "com_ui_redirect_uri_instructions": "Bu yönlendirme URI'sini kopyalayın ve OAuth sağlayıcı ayarlarınızda yapılandırın.",
+  "com_ui_redirecting_to_provider": "{{0}}'a yönlendiriliyor, lütfen bekleyin...",
+  "com_ui_refresh": "Yenile",
   "com_ui_refresh_link": "Bağlantıyı yenile",
+  "com_ui_refresh_page": "Sayfayı yenile",
   "com_ui_regenerate": "Yeniden Oluştur",
+  "com_ui_regenerate_backup": "Yedek Kodları Yeniden Oluştur",
+  "com_ui_regenerating": "Yeniden Oluşturuluyor...",
   "com_ui_region": "Bölge",
+  "com_ui_reinitialize": "Yeniden Başlat",
+  "com_ui_relevance": "İlgi",
+  "com_ui_remote_access": "Uzaktan Erişim",
+  "com_ui_remote_agent_role_editor": "Düzenleyici",
+  "com_ui_remote_agent_role_editor_desc": "Ajanı API üzerinden görüntüleyebilir ve değiştirebilir",
+  "com_ui_remote_agent_role_owner": "API Sahibi",
+  "com_ui_remote_agent_role_owner_desc": "Tam API erişimi ve başkalarına uzaktan erişim verebilir",
+  "com_ui_remote_agent_role_viewer": "API İzleyici",
+  "com_ui_remote_agent_role_viewer_desc": "Ajanı API üzerinden sorgulayabilir",
+  "com_ui_remote_agents": "Uzaktan Ajanlar (API)",
+  "com_ui_remote_agents_allow_create": "Kullanıcıların API üzerinden ajan oluşturmasına izin ver",
+  "com_ui_remote_agents_allow_share": "Kullanıcıların ajanlara API erişimi vermesine izin ver",
+  "com_ui_remote_agents_allow_share_public": "Kullanıcıların tüm kullanıcılara ajanlar için API erişimi vermesine izin ver",
+  "com_ui_remote_agents_allow_use": "Kullanıcıların API anahtarları oluşturmasına ve ajanları uzaktan sorgulamasına izin ver",
+  "com_ui_remove_agent_from_chain": "{{0}} ajanını zincirden çıkar",
+  "com_ui_remove_user": "{{0}} kaldır",
   "com_ui_rename": "Yeniden adlandır",
-  "com_ui_reset_var": "{{0}} sıfırla",
+  "com_ui_rename_conversation": "Konuşmayı Yeniden Adlandır",
+  "com_ui_rename_failed": "Konuşma yeniden adlandırılamadı",
+  "com_ui_requires_auth": "Kimlik Doğrulaması Gerektirir",
+  "com_ui_reset": "Sıfırla",
+  "com_ui_reset_adjustments": "Ayarlamaları sıfırla",
+  "com_ui_reset_var": "{{0}} Sıfırla",
+  "com_ui_reset_zoom": "Yakınlaştırmayı Sıfırla",
+  "com_ui_resource": "kaynak",
+  "com_ui_response": "Yanıt",
   "com_ui_result": "Sonuç",
-  "com_ui_revoke": "Geri Al",
+  "com_ui_result_found": "{{count}} sonuç bulundu",
+  "com_ui_results_found": "{{count}} sonuç bulundu",
+  "com_ui_retrieved_files": "Dosyalarınızda arandı",
+  "com_ui_retry": "Tekrar dene",
+  "com_ui_revoke": "İptal Et / Geri Al",
   "com_ui_revoke_info": "Kullanıcı tarafından sağlanan tüm kimlik bilgilerini geri al",
   "com_ui_revoke_key_confirm": "Bu anahtarı iptal etmek istediğinizden emin misiniz?",
   "com_ui_revoke_key_endpoint": "{{0}} için Anahtarı İptal Et",
+  "com_ui_revoke_key_error": "API anahtarı iptal edilemedi. Lütfen tekrar deneyin.",
+  "com_ui_revoke_key_success": "API anahtarı başarıyla iptal edildi",
   "com_ui_revoke_keys": "Anahtarları İptal Et",
   "com_ui_revoke_keys_confirm": "Tüm anahtarları iptal etmek istediğinizden emin misiniz?",
+  "com_ui_role": "Rol",
+  "com_ui_role_editor": "Düzenleyici",
+  "com_ui_role_editor_desc": "Ajanı görüntüleyebilir ve değiştirebilir",
+  "com_ui_role_manager": "Yönetici",
+  "com_ui_role_manager_desc": "Ajanı görüntüleyebilir, değiştirebilir ve silebilir",
+  "com_ui_role_owner": "Sahip",
+  "com_ui_role_owner_desc": "Ajanı paylaşmak da dahil olmak üzere üzerinde tam kontrole sahiptir",
   "com_ui_role_select": "Rol",
+  "com_ui_role_viewer": "İzleyici",
+  "com_ui_role_viewer_desc": "Ajanı görüntüleyebilir ve kullanabilir ancak değiştiremez",
+  "com_ui_roleplay": "Rol Yapma (Roleplay)",
+  "com_ui_rotate": "Döndür",
+  "com_ui_rotate_90": "90 derece döndür",
   "com_ui_run_code": "Kodu Çalıştır",
   "com_ui_run_code_error": "Kod çalıştırılırken bir hata oluştu",
+  "com_ui_running": "Çalışıyor...",
   "com_ui_save": "Kaydet",
+  "com_ui_save_badge_changes": "Rozet değişiklikleri kaydedilsin mi?",
+  "com_ui_save_changes": "Değişiklikleri Kaydet",
+  "com_ui_save_key_error": "API anahtarı kaydedilemedi. Lütfen tekrar deneyin.",
+  "com_ui_save_key_success": "API anahtarı başarıyla kaydedildi",
   "com_ui_save_submit": "Kaydet ve Gönder",
   "com_ui_saved": "Kaydedildi!",
+  "com_ui_saving": "Kaydediliyor...",
   "com_ui_schema": "Şema",
+  "com_ui_scope": "Kapsam (Scope)",
   "com_ui_search": "Ara",
+  "com_ui_search_above_to_add": "Kullanıcı veya grup eklemek için yukarıda arayın",
+  "com_ui_search_above_to_add_all": "Kullanıcı, grup veya rol eklemek için yukarıda arayın",
+  "com_ui_search_above_to_add_people": "Kişi eklemek için yukarıda arayın",
+  "com_ui_search_agent_category": "Kategorilerde ara...",
+  "com_ui_search_default_placeholder": "Ada veya e-postaya göre ara (min 2 karakter)",
+  "com_ui_search_people_placeholder": "Kişileri veya grupları ada veya e-postaya göre arayın",
+  "com_ui_search_result_count": "{{count}} sonuç bulundu",
+  "com_ui_search_results_count": "{{count}} sonuç bulundu",
+  "com_ui_searching_files": "Dosyalarınız aranıyor",
+  "com_ui_seconds": "saniye",
+  "com_ui_secret_key": "Gizli Anahtar (Secret Key)",
   "com_ui_select": "Seç",
+  "com_ui_select_agent": "Ajan Seç",
+  "com_ui_select_all": "Tümünü Seç",
   "com_ui_select_file": "Bir dosya seç",
   "com_ui_select_model": "Bir model seçin",
+  "com_ui_select_options": "Seçenekleri belirleyin...",
+  "com_ui_select_or_create_prompt": "Bir İstem Seçin veya Oluşturun",
   "com_ui_select_provider": "Bir sağlayıcı seç",
   "com_ui_select_provider_first": "Önce bir sağlayıcı seçin",
   "com_ui_select_region": "Bir bölge seç",
+  "com_ui_select_row": "Satırı seç",
   "com_ui_select_search_model": "Adına göre model ara",
   "com_ui_select_search_provider": "Sağlayıcıyı ada göre ara",
   "com_ui_select_search_region": "Bölgeyi ada göre ara",
+  "com_ui_set": "Ayarla",
   "com_ui_share": "Paylaş",
   "com_ui_share_create_message": "Adınız ve paylaşım sonrasında eklediğiniz mesajlar gizli kalır.",
   "com_ui_share_delete_error": "Paylaşılan bağlantı silinirken bir hata oluştu",
   "com_ui_share_error": "Sohbet bağlantısını paylaşırken bir hata oluştu",
+  "com_ui_share_everyone": "Herkesle paylaş",
+  "com_ui_share_everyone_description_var": "Bu {{resource}} herkese açık olacaktır. Lütfen bu {{resource}} kaynağının gerçekten herkesle paylaşılması gerektiğinden emin olun. Verilerinize dikkat edin.",
   "com_ui_share_link_to_chat": "Sohbete bağlantı paylaş",
+  "com_ui_share_qr_code_description": "Bu konuşma bağlantısını paylaşmak için QR kodu",
   "com_ui_share_update_message": "Adınız, özel talimatlarınız ve paylaşım sonrasında eklediğiniz mesajlar gizli kalır.",
   "com_ui_share_var": "{{0}} paylaş",
   "com_ui_shared_link_delete_success": "Paylaşılan bağlantı başarıyla silindi",
   "com_ui_shared_link_not_found": "Paylaşılan bağlantı bulunamadı",
   "com_ui_shared_prompts": "Paylaşılan İstemler",
+  "com_ui_shop": "Alışveriş",
+  "com_ui_show": "Göster",
   "com_ui_show_all": "Tümünü Göster",
+  "com_ui_show_code": "Kodu Göster",
+  "com_ui_show_image_details": "Resim Detaylarını Göster",
+  "com_ui_show_less": "Daha az göster",
+  "com_ui_show_more": "Daha fazla göster",
   "com_ui_show_qr": "QR Kodunu Göster",
+  "com_ui_sign_in_to_domain": "{{0}} alan adına giriş yap",
   "com_ui_simple": "Basit",
   "com_ui_size": "Boyut",
-  "com_ui_special_variables": "Özel değişkenler:",
+  "com_ui_size_sort": "Boyuta Göre Sırala",
+  "com_ui_special": "özel",
+  "com_ui_special_var_current_date": "Geçerli Tarih",
+  "com_ui_special_var_current_datetime": "Geçerli Tarih ve Saat",
+  "com_ui_special_var_current_user": "Mevcut Kullanıcı",
+  "com_ui_special_var_desc_current_date": "Bugünün tarihi ve haftanın günü",
+  "com_ui_special_var_desc_current_datetime": "Saat diliminizdeki yerel tarih ve saat",
+  "com_ui_special_var_desc_current_user": "Hesap görünen adınız",
+  "com_ui_special_var_desc_iso_datetime": "ISO 8601 formatında UTC tarih ve saat",
+  "com_ui_special_var_iso_datetime": "UTC ISO Tarih/Saat",
+  "com_ui_special_variable_added": "{{0}} özel değişkeni eklendi.",
+  "com_ui_special_variables": "Özel değişkenler",
+  "com_ui_speech_not_supported": "Tarayıcınız konuşma tanımayı desteklemiyor",
+  "com_ui_speech_not_supported_use_external": "Tarayıcınız konuşma tanımayı desteklemiyor. Ayarlar > Konuşma bölümünden Harici STT'ye geçmeyi deneyin.",
   "com_ui_speech_while_submitting": "Bir yanıt oluşturulurken konuşma gönderilemez",
+  "com_ui_sr_global_prompt": "Genel istem grubu",
+  "com_ui_stack_trace": "Yığın İzleme (Stack Trace)",
+  "com_ui_status_prefix": "Durum:",
   "com_ui_stop": "Durdur",
   "com_ui_storage": "Depolama",
+  "com_ui_storage_filter_sort": "Depolamaya Göre Filtrele ve Sırala",
   "com_ui_submit": "Gönder",
-  "com_ui_terms_and_conditions": "Şartlar ve koşullar",
+  "com_ui_summarizing": "Özetleniyor...",
+  "com_ui_support_contact": "Destek İletişim",
+  "com_ui_support_contact_email": "E-posta",
+  "com_ui_support_contact_email_invalid": "Lütfen geçerli bir e-posta adresi girin",
+  "com_ui_support_contact_email_placeholder": "destek@ornek.com",
+  "com_ui_support_contact_name": "Ad",
+  "com_ui_support_contact_name_min_length": "Ad en az {{minLength}} karakter olmalıdır",
+  "com_ui_support_contact_name_placeholder": "Destek iletişim adı",
+  "com_ui_teach_or_explain": "Öğrenme",
+  "com_ui_temporary": "Geçici Sohbet",
+  "com_ui_terms_and_conditions": "Şartlar ve Koşullar",
   "com_ui_terms_of_service": "Hizmet Şartları",
+  "com_ui_text_variables": "Metin değişkenleri",
   "com_ui_thinking": "Düşünüyor...",
   "com_ui_thoughts": "Düşünceler",
+  "com_ui_toggle_theme": "Temayı Değiştir",
+  "com_ui_token": "token",
+  "com_ui_token_exchange_method": "Token Değişim Yöntemi",
+  "com_ui_token_url": "Token URL'si",
+  "com_ui_tokens": "tokenler",
+  "com_ui_tool_collection_prefix": "Şuradan araç koleksiyonu:",
+  "com_ui_tool_failed": "başarısız oldu",
+  "com_ui_tool_list_collapse": "{{serverName}} araç listesini daralt",
+  "com_ui_tool_list_expand": "{{serverName}} araç listesini genişlet",
+  "com_ui_tool_name_code": "Kod",
+  "com_ui_tool_name_code_analysis": "Kod Analizi",
+  "com_ui_tool_name_file_search": "Dosya Arama",
+  "com_ui_tool_name_image_edit": "Resim Düzenleme",
+  "com_ui_tool_name_image_gen": "Resim Oluşturma",
+  "com_ui_tool_name_web_search": "Web Arama",
   "com_ui_tools": "Araçlar",
+  "com_ui_tools_and_actions": "Araçlar ve Eylemler",
+  "com_ui_transferred_to": "Şuraya aktarıldı:",
+  "com_ui_travel": "Seyahat",
+  "com_ui_trust_app": "Bu uygulamaya güveniyorum",
+  "com_ui_try_adjusting_search": "Arama terimlerinizi ayarlamayı deneyin",
+  "com_ui_ui_resource_error": "Arayüz Kaynak Hatası ({{0}})",
+  "com_ui_ui_resource_not_found": "Arayüz Kaynağı bulunamadı (indeks: {{0}})",
   "com_ui_unarchive": "Arşivden çıkar",
+  "com_ui_unarchive_conversation": "Konuşmayı arşivden çıkar",
   "com_ui_unarchive_error": "Konuşmayı arşivden çıkarma başarısız oldu",
+  "com_ui_unavailable": "Kullanılamıyor",
   "com_ui_unknown": "Bilinmeyen",
+  "com_ui_unpin": "Sabitlemeyi Kaldır",
+  "com_ui_unset": "Kaldır/Temizle",
+  "com_ui_untitled": "İsimsiz",
   "com_ui_update": "Güncelle",
+  "com_ui_update_mcp_server": "MCP sunucusunu güncelle",
+  "com_ui_updating": "Güncelleniyor...",
   "com_ui_upload": "Yükle",
+  "com_ui_upload_agent_avatar": "Ajan avatarı başarıyla güncellendi",
+  "com_ui_upload_agent_avatar_label": "Ajan avatar resmi yükle",
+  "com_ui_upload_avatar_label": "Avatar resmi yükle",
   "com_ui_upload_delay": "\"{{0}}\" yüklenmesi beklenenden daha uzun sürüyor. Lütfen dosyanın alma işlemini tamamlamasını bekleyin.",
   "com_ui_upload_error": "Dosyanızı yüklerken bir hata oluştu",
+  "com_ui_upload_file_context": "Dosya Bağlamı Yükle",
   "com_ui_upload_file_search": "Dosya Arama için Yükle",
   "com_ui_upload_files": "Dosyaları yükle",
+  "com_ui_upload_icon": "Simge resmi yükle",
   "com_ui_upload_image": "Bir resim yükle",
   "com_ui_upload_image_input": "Resim Yükle",
-  "com_ui_upload_invalid": "Geçersiz dosya yükleme. 2 MB'ı geçmeyen bir resim olması gerekir",
+  "com_ui_upload_invalid": "Geçersiz dosya yükleme. Sınırı aşmayan bir resim olmalıdır.",
   "com_ui_upload_invalid_var": "Yükleme için geçersiz dosya. {{0}} MB'ı aşmayan bir resim olmalı",
+  "com_ui_upload_ocr_text": "Metin olarak Yükle",
+  "com_ui_upload_provider": "Sağlayıcıya Yükle",
   "com_ui_upload_success": "Dosya başarıyla yüklendi",
   "com_ui_upload_type": "Yükleme Türünü Seç",
+  "com_ui_usage": "Kullanım",
+  "com_ui_use_2fa_code": "Bunun Yerine 2FA Kodu Kullan",
+  "com_ui_use_backup_code": "Bunun Yerine Yedek Kod Kullan",
   "com_ui_use_micrphone": "Mikrofon kullan",
+  "com_ui_use_prompt": "İstem Kullan",
+  "com_ui_used": "Kullanıldı",
+  "com_ui_used_n_tools": "{{0}} araç kullanıldı",
+  "com_ui_user": "Kullanıcı",
+  "com_ui_user_group_permissions": "Kullanıcı ve Grup İzinleri",
+  "com_ui_user_provides_key": "Her kullanıcı kendi anahtarını sağlar",
+  "com_ui_value": "Değer",
+  "com_ui_variable_with_options": "{{count}} seçenekli {{name}} değişkeni",
   "com_ui_variables": "Değişkenler",
+  "com_ui_verify": "Doğrula",
   "com_ui_version_var": "Sürüm {{0}}",
   "com_ui_versions": "Sürümler",
+  "com_ui_via_server": "{{0}} içinde",
+  "com_ui_web_search": "Web Arama",
+  "com_ui_web_search_cohere_key": "Cohere API Anahtarını Girin",
+  "com_ui_web_search_firecrawl_url": "Firecrawl API URL'si (isteğe bağlı)",
+  "com_ui_web_search_jina_key": "Jina API Anahtarını Girin",
+  "com_ui_web_search_jina_url": "Jina API URL'si (isteğe bağlı)",
+  "com_ui_web_search_processing": "Sonuçlar işleniyor",
+  "com_ui_web_search_provider": "Arama Sağlayıcısı",
+  "com_ui_web_search_provider_searxng": "SearXNG",
+  "com_ui_web_search_provider_serper": "Serper API",
+  "com_ui_web_search_provider_serper_key": "Serper API anahtarınızı alın",
+  "com_ui_web_search_reading": "Sonuçlar okunuyor",
+  "com_ui_web_search_reranker": "Yeniden Sıralayıcı (Reranker)",
+  "com_ui_web_search_reranker_cohere": "Cohere",
+  "com_ui_web_search_reranker_cohere_key": "Cohere API anahtarınızı alın",
+  "com_ui_web_search_reranker_jina": "Jina AI",
+  "com_ui_web_search_reranker_jina_key": "Jina API anahtarınızı alın",
+  "com_ui_web_search_reranker_jina_url_help": "Jina Rerank API hakkında bilgi edinin",
+  "com_ui_web_search_scraper": "Kazıyıcı (Scraper)",
+  "com_ui_web_search_scraper_firecrawl": "Firecrawl API",
+  "com_ui_web_search_scraper_firecrawl_key": "Firecrawl API anahtarınızı alın",
+  "com_ui_web_search_scraper_serper": "Serper Scrape API",
+  "com_ui_web_search_scraper_serper_key": "Serper API anahtarınızı alın",
+  "com_ui_web_search_searxng_api_key": "SearXNG API Anahtarını Girin (isteğe bağlı)",
+  "com_ui_web_search_searxng_instance_url": "SearXNG Sunucu (Instance) URL'si",
+  "com_ui_web_search_source": "{{count}} kaynak",
+  "com_ui_web_search_sources": "{{count}} kaynak",
+  "com_ui_web_searched": "Web'de arandı",
+  "com_ui_web_searching": "Web'de aranıyor",
+  "com_ui_web_searching_again": "Web'de tekrar aranıyor",
+  "com_ui_weekend_morning": "İyi hafta sonları",
+  "com_ui_write": "Yazma",
+  "com_ui_x_selected": "{{0}} seçildi",
+  "com_ui_xhigh": "Ekstra Yüksek",
   "com_ui_yes": "Evet",
+  "com_ui_your_api_key": "API Anahtarınız",
   "com_ui_zoom": "Yakınlaştır",
-  "com_user_message": "Sen"
+  "com_ui_zoom_in": "Yakınlaş",
+  "com_ui_zoom_level": "Yakınlaştırma seviyesi",
+  "com_ui_zoom_out": "Uzaklaş",
+  "com_user_message": "Siz"
 }
diff --git a/client/src/locales/zh-Hans/translation.json b/client/src/locales/zh-Hans/translation.json
index 3f601b3730a..1a17126e301 100644
--- a/client/src/locales/zh-Hans/translation.json
+++ b/client/src/locales/zh-Hans/translation.json
@@ -7,6 +7,7 @@
   "com_a11y_selected": "已选中",
   "com_a11y_start": "AI 已开始回复。",
   "com_a11y_summarize_completed": "上下文已总结。",
+  "com_a11y_summarize_failed": "摘要生成失败，将继续使用现有上下文。",
   "com_a11y_summarize_started": "正在总结上下文。",
   "com_agents_agent_card_label": "智能体 {{name}}：{{description}}",
   "com_agents_all": "全部智能体",
@@ -34,7 +35,7 @@
   "com_agents_clear_search": "清除搜索",
   "com_agents_contact": "联系",
   "com_agents_copy_link": "复制链接",
-  "com_agents_create_error": "更新智能体时出现错误。",
+  "com_agents_create_error": "创建智能体时出现错误。",
   "com_agents_created_by": "来自",
   "com_agents_description_card": "描述：{{description}}",
   "com_agents_description_placeholder": "可选：在此描述您的智能体",
@@ -89,6 +90,8 @@
   "com_agents_not_available": "智能体不可用",
   "com_agents_recommended": "我们推荐的智能体",
   "com_agents_results_for": "'{{query}}' 的结果",
+  "com_agents_run_code_files": "以下文件仅供代码环境使用：",
+  "com_agents_run_code_info": "启用后，允许您的智能体安全地运行生成的代码，包括文件处理。",
   "com_agents_search_aria": "搜索智能体",
   "com_agents_search_empty_heading": "无搜索结果",
   "com_agents_search_info": "启用后，允许您的智能体搜索网络以获取最新信息。需要有效的 API 密钥。",
@@ -142,7 +145,7 @@
   "com_assistants_update_actions_success": "已成功创建或更新操作",
   "com_assistants_update_error": "更新助手时出现错误。",
   "com_assistants_update_success": "更新成功",
-  "com_assistants_update_success_name": "成功上传{{name}}",
+  "com_assistants_update_success_name": "成功更新{{name}}",
   "com_auth_already_have_account": "已有账户？",
   "com_auth_apple_login": "使用 Apple 账户登录",
   "com_auth_back_to_login": "返回登录",
@@ -225,12 +228,19 @@
   "com_endpoint_anthropic_temp": "值介于 0 到 1 之间。对于分析性/选择性任务，值应更接近 0；对于创造性和生成性任务，值应更接近 1。我们建议更改该参数或 Top P，但不要同时更改这两个参数。",
   "com_endpoint_anthropic_thinking": "为支持的 Claude 模型启用内部推理。对于较新的模型（Opus 4.6 及以上版本），使用由“思考程度 (Effort)”参数控制的自适应思考。对于旧版模型，则需要设置“思考预算 (Thinking Budget)”，且该数值必须低于“最大输出 Token 数 (Max Output Tokens)”",
   "com_endpoint_anthropic_thinking_budget": "决定 Claude 内部推理过程允许使用的最大词元数。尽管 Claude 可能不会使用分配的全部预算，尤其是在超过 32K 的范围内，但较大的预算可以对复杂问题进行更深入的分析，从而提高响应质量。此设置必须小于 \"最大输出词元数\"。",
+  "com_endpoint_anthropic_thinking_display": "思维可见性",
+  "com_endpoint_anthropic_thinking_display_desc": "控制是否返回 Claude 的推理过程。'Auto'（自动）模式下，对于默认隐藏推理过程的模型（如 Opus 4.7 及更高版本），将启用并返回摘要化的思考过程；'Summarized'（摘要）模式始终显示推理过程；'Omitted'（省略）模式始终隐藏推理过程，以实现略微更低的延迟。",
   "com_endpoint_anthropic_topk": "top-k 会改变模型选择输出词元的方式。top-k 为 1 意味着所选词是模型词汇中概率最大的（也称为贪心解码），而 top-k 为 3 意味着下一个词是从 3 个概率最大的词中选出的（使用随机性）。",
   "com_endpoint_anthropic_topp": "top-p（核采样）会改变模型选择输出词元的方式。从概率最大的 K（参见 topK 参数）向最小的 K 选择，直到它们的概率之和等于 top-p 值。",
   "com_endpoint_anthropic_use_web_search": "使用 Anthropic 内置的搜索能力启用网络搜索功能。这使得模型能够搜索网络上的最新信息，提供更准确、更及时的响应。",
   "com_endpoint_assistant": "助手",
   "com_endpoint_assistant_model": "助手模型",
   "com_endpoint_assistant_placeholder": "请从右侧面板中选择助手",
+  "com_endpoint_bedrock_reasoning_effort": "控制受支持的 Bedrock 模型（例如 Kimi K2.5、GLM）的推理级别。较高的级别能够生成更为详尽的推理结果，但代价是会增加延迟和 词元（Token） 消耗。",
+  "com_endpoint_config_bedrock_access_key_id": "AWS 访问密钥 ID",
+  "com_endpoint_config_bedrock_bearer_token": "AWS Bedrock API 密钥",
+  "com_endpoint_config_bedrock_secret_access_key": "AWS 秘密访问密钥",
+  "com_endpoint_config_bedrock_session_token": "AWS 会话令牌",
   "com_endpoint_config_click_here": "点击此处",
   "com_endpoint_config_google_api_info": "获取您的生成式语言 API 密钥（Gemini），",
   "com_endpoint_config_google_api_key": "Google API Key",
@@ -251,6 +261,7 @@
   "com_endpoint_config_key_name": "密钥",
   "com_endpoint_config_key_never_expires": "您的密钥将永远有效",
   "com_endpoint_config_placeholder": "在顶部菜单设置 API 密钥。",
+  "com_endpoint_config_required_fields": "以下字段为必填项：",
   "com_endpoint_config_value": "输入值：",
   "com_endpoint_context": "上下文",
   "com_endpoint_context_info": "可用于上下文的最大词元数。用于控制每个请求发送的词元数量。如果未指定，将根据已知模型的上下文大小使用系统默认值。设置较高的值可能会导致错误和/或更高的词元成本。",
@@ -261,6 +272,7 @@
   "com_endpoint_default_with_num": "默认值：{{0}}",
   "com_endpoint_disable_streaming": "禁用流式响应并一次性接收完整的响应。对于像 o3 这样需要进行组织验证才能进行流式响应的模型非常有用。",
   "com_endpoint_disable_streaming_label": "禁用流式响应",
+  "com_endpoint_effort": "投入",
   "com_endpoint_examples": " 预设",
   "com_endpoint_export": "导出",
   "com_endpoint_export_share": "导出/共享",
@@ -270,6 +282,7 @@
   "com_endpoint_google_temp": "值越高表示输出越随机，值越低表示输出越确定。建议不要同时改变此值和 Top-p。",
   "com_endpoint_google_thinking": "启用或禁用推理。此设置仅支持 Gemini 2.5及3系列。注意：Gemini 3 Pro不能完全禁用推理。",
   "com_endpoint_google_thinking_budget": "用于引导模型使用的思考 Token 数量。实际消耗量可能会根据提示词（Prompt）的不同而高于或低于此设定值。\n\n此设置仅适用于 Gemini 2.5 及更早版本的模型。对于 Gemini 3 及更高版本，请改用“思考级别 (Thinking Level)”设置。\n\nGemini 2.5 Pro 支持 128 - 32,768 个 Token；Gemini 2.5 Flash 支持 0 - 24,576 个 Token；Gemini 2.5 Flash Lite 支持 512 - 24,576 个 Token。\n\n留空或设置为“-1”可让模型自动决定何时思考以及思考多少。默认情况下，Gemini 2.5 Flash Lite 不启用思考功能。",
+  "com_endpoint_google_thinking_level": "控制谷歌Gemini 3 及后续模型的推理深度。对谷歌Gemini 2.5 及更早期的模型无效——对于谷歌这些更早期模型，请使用 Thinking Budget。\n\n保持设置为“自动”（Auto）以使用模型的默认设置。",
   "com_endpoint_google_topk": "top-k 会改变模型选择输出词元的方式。top-k 为 1 意味着所选词是模型词汇中概率最大的（也称为贪心解码），而 top-k 为 3 意味着下一个词是从 3 个概率最大的词中选出的（使用随机性）。",
   "com_endpoint_google_topp": "top-p（核采样）会改变模型选择输出词的方式。从概率最大的 K（参见 topK 参数）向最小的 K 选择，直到它们的概率之和等于 top-p 值。",
   "com_endpoint_google_use_search_grounding": "使用 Google 的基础搜索特性，通过实时网络搜索结果优化响应。这使得模型能够访问当前信息，提供更准确、更及时的答案。",
@@ -310,6 +323,7 @@
   "com_endpoint_preset_default_removed": "不再是默认预设。",
   "com_endpoint_preset_delete_confirm": "您确定要删除此预设吗？",
   "com_endpoint_preset_delete_error": "删除预设时发生错误，请重试。",
+  "com_endpoint_preset_delete_success": "预设删除成功",
   "com_endpoint_preset_import": "成功导入预设！",
   "com_endpoint_preset_import_error": "导入预设时发生错误，请重试。",
   "com_endpoint_preset_name": "预设名",
@@ -358,15 +372,18 @@
   "com_error_illegal_model_request": "模型 “{{0}}” 不可用于 {{1}}，请选择其他模型。",
   "com_error_input_length": "最新消息的令牌数过长，超出了令牌限制，或者您的令牌限制参数配置错误，对上下文窗口产生不利影响。更多信息：{{0}}。请缩短您的消息、调整对话参数中的最大上下文大小，或分叉对话以继续。",
   "com_error_invalid_agent_provider": "提供商 ”{{0}}“ 不适用于智能体。请转到智能体设置并选择当前可用的提供商。",
+  "com_error_invalid_base_url": "您提供的基准网址 URL 指向的是一个受限地址。请使用有效的外部 URL 并重试。",
   "com_error_invalid_user_key": "提供的密钥无效，请提供有效的密钥后重试。",
   "com_error_missing_model": "未选择 {{0}} 模型，请选择一个模型并重试。",
   "com_error_models_not_loaded": "无法加载模型配置，请刷新页面并重试。",
   "com_error_moderation": "很抱歉，您提交的内容被我们的审核系统标记为不符合社区指引。我们无法就此特定主题继续交流。如果您有任何其他问题或想探讨的话题，请编辑您的消息或开启新的对话。",
   "com_error_no_base_url": "未找到基础 URL，请提供一个后重试。",
   "com_error_no_user_key": "未找到密钥，请提供密钥后重试。",
+  "com_error_refusal": "响应被安全过滤器拒绝。请重写您的消息并重试。如果您在使用 Claude Sonnet 4.5 或 Opus 4.1 时频繁遇到此问题，可以尝试使用 Sonnet 4，该版本的限制规则有所不同。",
+  "com_error_stream_expired": "响应流已过期或已完成。请重试。",
   "com_file_pages": "页面：{{pages}}",
   "com_file_source": "文件",
-  "com_file_unknown": "位置文件",
+  "com_file_unknown": "未知文件",
   "com_files_download_failed": "{{0}} 个文件失败",
   "com_files_download_percent_complete": "已完成 {{0}}%",
   "com_files_download_progress": "第 {{0}} 个文件，共 {{1}} 个",
@@ -376,16 +393,28 @@
   "com_files_no_results": "无结果。",
   "com_files_number_selected": "已选择 {{0}} 个文件（共 {{1}} 个文件）",
   "com_files_preparing_download": "准备下载...",
+  "com_files_result_found": "找到 {{count}} 个结果",
   "com_files_results_found": "找到{{count}}个结果",
   "com_files_sharepoint_picker_title": "选择文件",
-  "com_files_table": "这里需要放点东西，当前是空的",
+  "com_files_table": "文件表",
   "com_files_upload_local_machine": "来自本地计算机",
   "com_files_upload_sharepoint": "来自 SharePoint",
   "com_generated_files": "生成的文件",
   "com_hide_examples": "隐藏示例",
   "com_info_heic_converting": "正在将 HEIC 图片转换为 JPEG ...",
   "com_nav_2fa": "双重身份验证（2FA）",
+  "com_nav_about_branch": "分支",
+  "com_nav_about_build_date": "已构建",
+  "com_nav_about_commit": "提交",
+  "com_nav_about_diagnostics_copied": "已复制到剪贴板",
+  "com_nav_about_diagnostics_copy": "复制诊断信息",
+  "com_nav_about_diagnostics_description": "在提交支持问题时，请复制此代码块，以便维护人员准确识别您当前运行的具体构建版本。",
+  "com_nav_about_diagnostics_heading": "诊断信息",
+  "com_nav_about_version": "版本",
+  "com_nav_about_version_heading": "构建信息",
   "com_nav_account_settings": "账户设置",
+  "com_nav_advanced_prompts": "高级提示词编辑器",
+  "com_nav_advanced_prompts_desc": "启用提示词版本控制与生产控制",
   "com_nav_always_make_prod": "始终使用新版本",
   "com_nav_archive_created_at": "归档时间",
   "com_nav_archive_name": "名称",
@@ -394,8 +423,10 @@
   "com_nav_at_command_description": "切换至命令 “@” 以更改端点、模型、预设等",
   "com_nav_audio_play_error": "播放音频时发生错误：{{0}}",
   "com_nav_audio_process_error": "处理音频时发生错误：{{0}}",
+  "com_nav_auto_expand_tools": "自动展开工具详情",
   "com_nav_auto_scroll": "打开对话时自动滚动到最新消息",
-  "com_nav_auto_send_prompts": "自动发送提示词",
+  "com_nav_auto_send_prompts": "在选中时发送提示词",
+  "com_nav_auto_send_prompts_desc": "选择后自动将提示词提交到聊天",
   "com_nav_auto_send_text": "自动发送文本",
   "com_nav_auto_transcribe_audio": "自动转录音频",
   "com_nav_automatic_playback": "自动播放最新消息",
@@ -427,6 +458,7 @@
   "com_nav_chat_commands": "对话命令",
   "com_nav_chat_commands_info": "这些命令通过在您的消息开头输入特定字符来激活。每个命令都由其指定的前缀触发。如果您经常在消息开头使用这些字符，可以选择禁用这些命令。",
   "com_nav_chat_direction": "对话方向",
+  "com_nav_chat_direction_selected": "聊天方向： {{direction}}",
   "com_nav_clear_all_chats": "清除所有对话",
   "com_nav_clear_cache_confirm_message": "您确定要清除缓存吗？",
   "com_nav_clear_conversation": "清除对话",
@@ -434,9 +466,11 @@
   "com_nav_close_sidebar": "关闭侧边栏",
   "com_nav_commands": "命令",
   "com_nav_confirm_clear": "确认清除",
+  "com_nav_control_panel": "控制面板",
   "com_nav_conversation_mode": "对话模式",
   "com_nav_convo_menu_options": "对话菜单选项",
   "com_nav_db_sensitivity": "分贝灵敏度",
+  "com_nav_default_temporary_chat": "默认临时聊天",
   "com_nav_delete_account": "删除账户",
   "com_nav_delete_account_button": "永久删除我的账户",
   "com_nav_delete_account_confirm": "删除账户 - 您确定吗？",
@@ -469,6 +503,7 @@
   "com_nav_info_code_artifacts": "启用在对话旁显示实验性代码工件",
   "com_nav_info_code_artifacts_agent": "使该智能体能够使用代码工件。默认情况下，除非启用“自定义提示词模式”，否则会添加与 Artifacts 使用相关的额外说明。",
   "com_nav_info_custom_prompt_mode": "启用后，默认的 Artifacts 系统提示词将不会包含在内。在此模式下，必须手动提供所有生成工件的指令。",
+  "com_nav_info_default_temporary_chat": "启用后，新聊天将默认以激活的临时聊天模式开始。临时对话不会保存到您的历史记录中。",
   "com_nav_info_enter_to_send": "启用后，按下 `ENTER` 将发送您的消息。禁用后，按下 `ENTER` 将添加新行，您需要按下 `CTRL + ENTER` / `⌘ + ENTER` 来发送消息。",
   "com_nav_info_fork_change_default": "`仅可见消息` 仅包含到所选消息的直接路径，`包含相关分支` 添加路径上的分支，`包含所有目标` 包括所有连接的消息和分支。",
   "com_nav_info_fork_split_target_setting": "启用后，将根据选择的行为，从目标消息开始到对话中的最新消息进行分叉。",
@@ -497,16 +532,19 @@
   "com_nav_lang_german": "Deutsch",
   "com_nav_lang_hebrew": "עברית",
   "com_nav_lang_hungarian": "Magyar",
+  "com_nav_lang_icelandic": "冰岛语",
   "com_nav_lang_indonesia": "Indonesia",
   "com_nav_lang_italian": "Italiano",
   "com_nav_lang_japanese": "日本語",
   "com_nav_lang_korean": "한국어",
   "com_nav_lang_latvian": "Latviski",
+  "com_nav_lang_lithuanian": "立陶宛语",
   "com_nav_lang_norwegian_bokmal": "Norsk Bokmål",
   "com_nav_lang_persian": "فارسی",
   "com_nav_lang_polish": "Polski",
   "com_nav_lang_portuguese": "Português",
   "com_nav_lang_russian": "Русский",
+  "com_nav_lang_slovak": "斯洛伐克语",
   "com_nav_lang_slovenian": "Slovenščina",
   "com_nav_lang_spanish": "Español",
   "com_nav_lang_swedish": "Svenska",
@@ -522,17 +560,22 @@
   "com_nav_log_out": "注销",
   "com_nav_long_audio_warning": "较长的文本将需要更长时间来处理。",
   "com_nav_maximize_chat_space": "最大化对话窗口",
+  "com_nav_mcp_access_revoked": "MCP 服务器访问权限已成功撤销。",
   "com_nav_mcp_configure_server": "配置 {{0}}",
   "com_nav_mcp_connect": "连接",
+  "com_nav_mcp_connect_server": "连接 {{0}}",
   "com_nav_mcp_reconnect": "重新连接",
   "com_nav_mcp_status_connected": "yi'lian'jie",
   "com_nav_mcp_status_connecting": "{{0}} - 连接中",
   "com_nav_mcp_status_error": "错误",
+  "com_nav_mcp_status_initializing": "MCP正在初始化",
+  "com_nav_mcp_status_needs_auth": "需授权",
   "com_nav_mcp_status_unknown": "未知",
   "com_nav_mcp_vars_update_error": "更新 MCP 自定义用户变量时发生错误",
   "com_nav_mcp_vars_updated": "MCP 自定义用户变量更新成功。",
   "com_nav_modular_chat": "启用在对话中切换端点",
   "com_nav_my_files": "我的文件",
+  "com_nav_new_chat_switch_to_history": "在新聊天中切换至聊天记录",
   "com_nav_not_supported": "未支持",
   "com_nav_open_sidebar": "打开侧边栏",
   "com_nav_playback_rate": "音频播放速度",
@@ -545,6 +588,7 @@
   "com_nav_scroll_button": "滚动到末尾按钮",
   "com_nav_search_placeholder": "搜索消息",
   "com_nav_send_message": "发送消息",
+  "com_nav_setting_about": "关于",
   "com_nav_setting_account": "账户",
   "com_nav_setting_balance": "余额",
   "com_nav_setting_chat": "对话",
@@ -611,20 +655,28 @@
   "com_ui_2fa_generate_error": "生成双重身份验证设置时发生错误。",
   "com_ui_2fa_invalid": "无效的双重身份验证代码",
   "com_ui_2fa_setup": "设置双重身份验证",
+  "com_ui_2fa_verification_required": "请输入您的双重验证码以继续",
   "com_ui_2fa_verified": "成功验证双重身份验证",
   "com_ui_accept": "我接受",
   "com_ui_action_button": "操作按钮",
   "com_ui_active": "活动",
   "com_ui_add": "添加",
+  "com_ui_add_first_bookmark": "点击聊天以添加",
+  "com_ui_add_first_mcp_server": "创建您的首个 MCP 服务器以开始使用",
+  "com_ui_add_first_prompt": "创建您的第一个提示词以开始使用",
+  "com_ui_add_labels": "添加标签",
   "com_ui_add_mcp": "添加 MCP",
   "com_ui_add_mcp_server": "添加 MCP 服务器",
   "com_ui_add_model_preset": "添加一个模型或预设以获得额外的响应",
   "com_ui_add_multi_conversation": "添加多个对话",
+  "com_ui_add_skills": "添加技能",
   "com_ui_add_special_variables": "添加特殊变量",
   "com_ui_adding_details": "添加细节",
+  "com_ui_additional_details": "更多详情",
   "com_ui_admin": "管理",
   "com_ui_admin_access_warning": "禁用管理员对此特性的访问可能会导致界面出现异常，需要刷新页面。如果保存此设置，唯一的恢复方式是通过 librechat.yaml 配置文件中的界面设置进行修改，这将影响所有角色。",
   "com_ui_admin_settings": "管理员设置",
+  "com_ui_admin_settings_section": "管理员设置 - {{section}}",
   "com_ui_advanced": "进阶",
   "com_ui_advanced_settings": "进阶设置",
   "com_ui_agent": "智能体",
@@ -659,6 +711,12 @@
   "com_ui_agent_name_is_required": "智能体名称为必填项",
   "com_ui_agent_recursion_limit": "最大智能体步骤数",
   "com_ui_agent_recursion_limit_info": "限制智能体在给出最终响应之前可执行的步骤数。默认为 25 个步骤。步骤可以是一次 AI API 请求或一次工具使用。例如，一个基本的工具交互需要 3 个步骤：初始请求、工具使用和后续请求。",
+  "com_ui_agent_subagents": "子智能体",
+  "com_ui_agent_subagents_add": "添加子智能体",
+  "com_ui_agent_subagents_agents": "其他子智能体",
+  "com_ui_agent_subagents_allow_self": "允许自我生成",
+  "com_ui_agent_subagents_empty": "无子智能体可用：启用自我生成或添加至少一个智能体。",
+  "com_ui_agent_subagents_enable": "启用子智能体",
   "com_ui_agent_url_copied": "智能体 URL 已复制到剪贴板",
   "com_ui_agent_var": "{{0}} 智能体",
   "com_ui_agent_version": "版本",
@@ -1252,7 +1310,7 @@
   "com_ui_special_var_current_datetime": "当前日期时间",
   "com_ui_special_var_current_user": "当前用户",
   "com_ui_special_var_iso_datetime": "UTC ISO 日期时间",
-  "com_ui_special_variables": "特殊变量：",
+  "com_ui_special_variables": "特殊变量",
   "com_ui_speech_while_submitting": "正在生成响应时无法提交语音",
   "com_ui_stop": "停止",
   "com_ui_storage": "存储",
diff --git a/client/src/main.jsx b/client/src/main.jsx
index d7dd8e0f6e3..f0f196e720a 100644
--- a/client/src/main.jsx
+++ b/client/src/main.jsx
@@ -1,18 +1,38 @@
 import './polyfills/regeneratorRuntime';
 import { createRoot } from 'react-dom/client';
-import './locales/i18n';
+import { initializeI18n } from './locales/i18n';
 import App from './App';
+import '@librechat/client/style.css';
 import './style.css';
 import './mobile.css';
 import { ApiErrorBoundaryProvider } from './hooks/ApiErrorBoundaryContext';
 import 'katex/dist/katex.min.css';
 import 'katex/dist/contrib/copy-tex.js';
 
+window.addEventListener('vite:preloadError', (event) => {
+  if (window.__lcRecoverStaleAssets?.()) {
+    event.preventDefault();
+  }
+});
+
 const container = document.getElementById('root');
 const root = createRoot(container);
 
-root.render(
-  <ApiErrorBoundaryProvider>
-    <App />
-  </ApiErrorBoundaryProvider>,
-);
+async function bootstrap() {
+  await initializeI18n();
+
+  root.render(
+    <ApiErrorBoundaryProvider>
+      <App />
+    </ApiErrorBoundaryProvider>,
+  );
+}
+
+bootstrap().catch((error) => {
+  console.error('[i18n] Failed to initialize before render', error);
+  root.render(
+    <ApiErrorBoundaryProvider>
+      <App />
+    </ApiErrorBoundaryProvider>,
+  );
+});
diff --git a/client/src/routes/ChatRoute.tsx b/client/src/routes/ChatRoute.tsx
index e7118fe45df..5f55df51dd2 100644
--- a/client/src/routes/ChatRoute.tsx
+++ b/client/src/routes/ChatRoute.tsx
@@ -1,4 +1,5 @@
-import { useEffect } from 'react';
+import { useEffect, useMemo } from 'react';
+import { useQueryClient } from '@tanstack/react-query';
 import { useRecoilCallback, useRecoilValue } from 'recoil';
 import { Spinner, useToastContext } from '@librechat/client';
 import { useParams, useSearchParams } from 'react-router-dom';
@@ -13,7 +14,14 @@ import {
   isNotFoundError,
   isTemporaryConversation,
   logger,
+  clearMessagesCache,
 } from '~/utils';
+import {
+  useGetConvoIdQuery,
+  useGetStartupConfig,
+  useGetEndpointsQuery,
+  useProjectQuery,
+} from '~/data-provider';
 import {
   useAssistantListMap,
   useIdChangeEffect,
@@ -21,7 +29,6 @@ import {
   useNewConvo,
   useLocalize,
 } from '~/hooks';
-import { useGetConvoIdQuery, useGetStartupConfig, useGetEndpointsQuery } from '~/data-provider';
 import { ToolCallsMapProvider } from '~/Providers';
 import ChatView from '~/components/Chat/ChatView';
 import { NotificationSeverity } from '~/common';
@@ -29,9 +36,13 @@ import useAuthRedirect from './useAuthRedirect';
 import temporaryStore from '~/store/temporary';
 import store from '~/store';
 
+const isValidChatProjectId = (projectId: string | null): projectId is string =>
+  projectId != null && /^[a-f\d]{24}$/i.test(projectId);
+
 export default function ChatRoute() {
   const { data: startupConfig } = useGetStartupConfig();
   const { isAuthenticated, user, roles } = useAuthRedirect();
+  const queryClient = useQueryClient();
 
   const defaultTemporaryChat = useRecoilValue(temporaryStore.defaultTemporaryChat);
   const setIsTemporary = useRecoilCallback(
@@ -44,13 +55,64 @@ export default function ChatRoute() {
   useAppStartup({ startupConfig, user });
 
   const index = 0;
-  const [searchParams] = useSearchParams();
+  const [searchParams, setSearchParams] = useSearchParams();
   const { conversationId = '' } = useParams();
+  const projectIdParam = searchParams.get('projectId');
+  const chatProjectId = isValidChatProjectId(projectIdParam) ? projectIdParam : null;
   useIdChangeEffect(conversationId);
   const { hasSetConversation, conversation } = store.useCreateConversationAtom(index);
   const { newConversation } = useNewConvo();
   const { showToast } = useToastContext();
   const localize = useLocalize();
+  const projectQuery = useProjectQuery(chatProjectId, {
+    enabled: isAuthenticated && Boolean(chatProjectId),
+    retry: false,
+    staleTime: 30000,
+    cacheTime: 300000,
+  });
+  /**
+   * The scoped project is *confirmed gone* — a not-found/not-owned (404) response,
+   * or a success that resolved to a different/empty project. Transient failures
+   * (500, network, auth refresh race) are deliberately excluded: this query runs with
+   * `retry: false`, so treating any error as "gone" would unscope a valid project on
+   * a single blip.
+   */
+  const projectNotFound = projectQuery.isError && isNotFoundError(projectQuery.error);
+  /**
+   * Trust the scope when the project resolves to itself, and keep showing it through
+   * transient errors via React Query's retained data — but never for a project that
+   * is confirmed gone (otherwise the deleted project's chip lingers).
+   */
+  const verifiedChatProjectId =
+    !projectNotFound && projectQuery.data?._id === chatProjectId ? chatProjectId : null;
+  const projectTemplate = useMemo(
+    () => (verifiedChatProjectId ? { chatProjectId: verifiedChatProjectId } : {}),
+    [verifiedChatProjectId],
+  );
+
+  /**
+   * The scoped project is gone even though the URL still carries `?projectId`. Drop
+   * the param so the new-chat landing reverts to an unscoped chat — otherwise the
+   * stale chip lingers and sends target a dead project.
+   */
+  const projectScopeMissing =
+    Boolean(chatProjectId) &&
+    conversationId === Constants.NEW_CONVO &&
+    (projectNotFound || (projectQuery.isSuccess && projectQuery.data?._id !== chatProjectId));
+
+  useEffect(() => {
+    if (!projectScopeMissing) {
+      return;
+    }
+    setSearchParams(
+      (params) => {
+        const next = new URLSearchParams(params);
+        next.delete('projectId');
+        return next;
+      },
+      { replace: true },
+    );
+  }, [projectScopeMissing, setSearchParams]);
 
   const modelsQuery = useGetModelsQuery({
     enabled: isAuthenticated,
@@ -81,24 +143,36 @@ export default function ChatRoute() {
   useEffect(() => {
     // Wait for roles to load so hasAgentAccess has a definitive value in useNewConvo
     const rolesLoaded = roles?.USER != null;
+    const isNewConvo = conversationId === Constants.NEW_CONVO;
+    const isDraftNewConvo = conversation?.conversationId === Constants.NEW_CONVO;
+    const draftProjectMismatch = verifiedChatProjectId
+      ? conversation?.chatProjectId !== verifiedChatProjectId
+      : conversation?.chatProjectId != null;
+    const newConvoNeedsInit =
+      isNewConvo && (!conversation || (isDraftNewConvo && draftProjectMismatch));
     const shouldSetConvo =
-      (startupConfig && rolesLoaded && !hasSetConversation.current && !modelsQuery.data?.initial) ??
+      (startupConfig &&
+        rolesLoaded &&
+        (!hasSetConversation.current || newConvoNeedsInit) &&
+        !modelsQuery.data?.initial) ??
       false;
     /* Early exit if startupConfig is not loaded and conversation is already set and only initial models have loaded */
     if (!shouldSetConvo) {
       return;
     }
 
-    const isNewConvo = conversationId === Constants.NEW_CONVO;
+    if (isNewConvo && chatProjectId && projectQuery.isLoading) {
+      return;
+    }
 
     const getNewConvoPreset = () => {
-      const result = getDefaultModelSpec(startupConfig);
-      const spec = result?.default ?? result?.last;
+      const result = getDefaultModelSpec(startupConfig, endpointsQuery.data);
+      const spec = result?.default ?? result?.last ?? result?.softDefault;
       const specPreset = spec ? getModelSpecPreset(spec) : undefined;
 
       const queryParams: Record<string, string> = {};
       searchParams.forEach((value, key) => {
-        if (key !== 'prompt' && key !== 'q' && key !== 'submit') {
+        if (key !== 'prompt' && key !== 'q' && key !== 'submit' && key !== 'projectId') {
           queryParams[key] = value;
         }
       });
@@ -114,9 +188,10 @@ export default function ChatRoute() {
       const preset = getNewConvoPreset();
 
       logger.log('conversation', 'ChatRoute, new convo effect', conversation);
+      clearMessagesCache(queryClient, conversation?.conversationId);
       newConversation({
         modelsData: modelsQuery.data,
-        template: conversation ? conversation : undefined,
+        template: projectTemplate,
         ...(preset ? { preset } : {}),
       });
 
@@ -137,8 +212,8 @@ export default function ChatRoute() {
       initialConvoQuery.isError &&
       isNotFoundError(initialConvoQuery.error)
     ) {
-      const result = getDefaultModelSpec(startupConfig);
-      const spec = result?.default ?? result?.last;
+      const result = getDefaultModelSpec(startupConfig, endpointsQuery.data);
+      const spec = result?.default ?? result?.last ?? result?.softDefault;
       showToast({
         message: localize('com_ui_conversation_not_found'),
         severity: NotificationSeverity.WARNING,
@@ -161,9 +236,10 @@ export default function ChatRoute() {
       const preset = getNewConvoPreset();
 
       logger.log('conversation', 'ChatRoute new convo, assistants effect', conversation);
+      clearMessagesCache(queryClient, conversation?.conversationId);
       newConversation({
         modelsData: modelsQuery.data,
-        template: conversation ? conversation : undefined,
+        template: projectTemplate,
         ...(preset ? { preset } : {}),
       });
       hasSetConversation.current = true;
@@ -189,6 +265,13 @@ export default function ChatRoute() {
     endpointsQuery.data,
     modelsQuery.data,
     assistantListMap,
+    chatProjectId,
+    projectQuery.data?._id,
+    projectQuery.isLoading,
+    projectTemplate,
+    queryClient,
+    conversation?.chatProjectId,
+    conversation?.conversationId,
   ]);
 
   if (endpointsQuery.isLoading || modelsQuery.isLoading) {
@@ -218,7 +301,7 @@ export default function ChatRoute() {
 
   return (
     <ToolCallsMapProvider conversationId={conversation.conversationId ?? ''}>
-      <ChatView index={index} />
+      <ChatView index={index} project={verifiedChatProjectId ? projectQuery.data : undefined} />
     </ToolCallsMapProvider>
   );
 }
diff --git a/client/src/routes/index.tsx b/client/src/routes/index.tsx
index 36376225469..ebcab40c147 100644
--- a/client/src/routes/index.tsx
+++ b/client/src/routes/index.tsx
@@ -41,6 +41,16 @@ const loadSkillsView = () =>
     Component: m.default,
   }));
 
+const loadProjectsView = () =>
+  import('~/components/Projects').then((m) => ({
+    Component: m.ProjectsView,
+  }));
+
+const loadProjectWorkspace = () =>
+  import('~/components/Projects').then((m) => ({
+    Component: m.ProjectWorkspace,
+  }));
+
 const baseEl = document.querySelector('base');
 const baseHref = baseEl?.getAttribute('href') || '/';
 
@@ -152,6 +162,14 @@ export const router = createBrowserRouter(
               path: 'skills/:skillId/edit',
               lazy: loadSkillsView,
             },
+            {
+              path: 'projects',
+              lazy: loadProjectsView,
+            },
+            {
+              path: 'projects/:projectId',
+              lazy: loadProjectWorkspace,
+            },
             {
               path: 'agents',
               element: (
diff --git a/client/src/store/families.ts b/client/src/store/families.ts
index 5d19331f594..54a2294fb57 100644
--- a/client/src/store/families.ts
+++ b/client/src/store/families.ts
@@ -93,6 +93,9 @@ const conversationByIndex = atomFamily<TConversation | null, string | number>({
 
         if (shouldUpdateParams) {
           const newParams = createChatSearchParams(newValue);
+          if (newValue.chatProjectId) {
+            newParams.set('projectId', newValue.chatProjectId);
+          }
           const searchParams = createSearchParams(newParams);
           const url = `${window.location.pathname}?${searchParams.toString()}`;
           window.history.pushState({}, '', url);
diff --git a/client/src/store/index.ts b/client/src/store/index.ts
index 0584e9d8054..7d7d9cfe614 100644
--- a/client/src/store/index.ts
+++ b/client/src/store/index.ts
@@ -1,21 +1,22 @@
 import * as artifacts from './artifacts';
-import families from './families';
-import endpoints from './endpoints';
-import user from './user';
-import text from './text';
-import toast from './toast';
 import submission from './submission';
+import isTemporary from './temporary';
+import endpoints from './endpoints';
+import families from './families';
+import settings from './settings';
+import prompts from './prompts';
 import search from './search';
 import preset from './preset';
-import prompts from './prompts';
 import lang from './language';
-import settings from './settings';
+import toast from './toast';
+import user from './user';
+import text from './text';
 import misc from './misc';
-import isTemporary from './temporary';
 export * from './agents';
 export * from './mcp';
 export * from './favorites';
 export * from './subagents';
+export * from './usage';
 
 export default {
   ...artifacts,
diff --git a/client/src/store/language.ts b/client/src/store/language.ts
index 50e98fb127b..f49ee997642 100644
--- a/client/src/store/language.ts
+++ b/client/src/store/language.ts
@@ -1,11 +1,36 @@
+import { atom } from 'recoil';
 import Cookies from 'js-cookie';
 import { atomWithLocalStorage } from './utils';
 
+const readStoredLang = () => {
+  if (typeof localStorage === 'undefined') {
+    return undefined;
+  }
+
+  const storedLang = localStorage.getItem('lang');
+  if (!storedLang) {
+    return undefined;
+  }
+
+  try {
+    const parsedLang = JSON.parse(storedLang);
+    return typeof parsedLang === 'string' ? parsedLang : storedLang;
+  } catch {
+    return storedLang;
+  }
+};
+
 const defaultLang = () => {
-  const userLang = navigator.language || navigator.languages[0];
-  return Cookies.get('lang') || localStorage.getItem('lang') || userLang;
+  const userLang =
+    (typeof navigator !== 'undefined' ? navigator.language || navigator.languages?.[0] : null) ??
+    'en';
+  return Cookies.get('lang') || readStoredLang() || userLang;
 };
 
 const lang = atomWithLocalStorage('lang', defaultLang());
+const languageLoading = atom<boolean>({
+  key: 'languageLoading',
+  default: false,
+});
 
-export default { lang };
+export default { lang, languageLoading };
diff --git a/client/src/store/usage.ts b/client/src/store/usage.ts
new file mode 100644
index 00000000000..a4bd064a587
--- /dev/null
+++ b/client/src/store/usage.ts
@@ -0,0 +1,183 @@
+import { atomFamily } from 'jotai/utils';
+import { atom, getDefaultStore } from 'jotai';
+import type { TMessage, TContextUsageEvent } from 'librechat-data-provider';
+import type { BranchTotals, BranchUsage } from '~/utils/tokens';
+import { EMPTY_BRANCH, EMPTY_USAGE } from '~/utils/tokens';
+
+/** Latest backend context snapshot, anchored to the run's user message for staleness checks */
+export interface ContextSnapshot extends TContextUsageEvent {
+  anchorMessageId: string | null;
+  /** Output tokens finalized after this pre-call snapshot (the last call's response) */
+  completedOutputTokens?: number;
+}
+
+/**
+ * In-flight usage for the streaming response only — a single-response pending
+ * holder. `foldUsage` accumulates the current response's `on_token_usage`
+ * events here; `finalizeUsage` flushes it into the per-message index and resets
+ * it. Branch/total figures are otherwise derived by summing the index, so this
+ * is the only live add (counted exactly once at finalize).
+ */
+export interface UsageTotals {
+  input: number;
+  output: number;
+  cacheWrite: number;
+  cacheRead: number;
+  eventCount: number;
+  /** Summed authoritative per-event cost from the backend (premium tiers,
+   *  cache rates). Populated only when `interface.contextCost` is enabled. */
+  costUSD: number;
+  /** Whether cost coverage is complete — every folded event carried a cost
+   *  (ANDed, vacuously true when empty); gates the cost row. */
+  costKnown: boolean;
+}
+
+export const EMPTY_USAGE_TOTALS: UsageTotals = {
+  input: 0,
+  output: 0,
+  cacheWrite: 0,
+  cacheRead: 0,
+  eventCount: 0,
+  costUSD: 0,
+  costKnown: true,
+};
+
+/**
+ * Split into small per-conversation atoms so high-frequency writes (live
+ * stream estimates) re-render only the subscribers that draw them.
+ */
+export const branchTotalsFamily = atomFamily((_conversationId: string) =>
+  atom<BranchTotals>(EMPTY_BRANCH),
+);
+
+export const contextSnapshotFamily = atomFamily((_conversationId: string) =>
+  atom<ContextSnapshot | null>(null),
+);
+
+/**
+ * Finalized snapshots keyed by their (branch-unique) response message id.
+ * `contextSnapshotFamily` only holds the latest run; this retains each
+ * generation's breakdown so switching to a branch generated earlier this
+ * session keeps its granular rows instead of dropping to coarse totals.
+ * Bounded by the conversation's generation count; cleared on convo switch.
+ */
+export const snapshotsByAnchorFamily = atomFamily((_conversationId: string) =>
+  atom<Map<string, ContextSnapshot>>(new Map()),
+);
+
+/** In-flight usage of the streaming response; flushed into the index at finalize. */
+export const pendingUsageFamily = atomFamily((_conversationId: string) =>
+  atom<UsageTotals>(EMPTY_USAGE_TOTALS),
+);
+
+/** Provider usage/cost summed across all branches of the conversation. */
+export const totalUsageFamily = atomFamily((_conversationId: string) =>
+  atom<BranchUsage>(EMPTY_USAGE),
+);
+
+/** Throttled in-flight output token estimate for the current model call */
+export const liveTokensFamily = atomFamily((_conversationId: string) => atom<number>(0));
+
+/** Last known provider-vs-estimate calibration ratio for the conversation */
+export const calibrationFamily = atomFamily((_conversationId: string) => atom<number>(1));
+
+/**
+ * Per-conversation set of usage-event identities already folded into the
+ * totals. Lets the live path and resume backfill fold each model call exactly
+ * once, so reconnect mid-stream preserves earlier prompts' usage instead of
+ * resetting the session totals.
+ */
+const foldedUsageKeys = new Map<string, Set<string>>();
+
+/** Records an event identity; returns false if it was already folded. */
+export function markUsageFolded(conversationId: string, key: string): boolean {
+  let seen = foldedUsageKeys.get(conversationId);
+  if (seen == null) {
+    seen = new Set<string>();
+    foldedUsageKeys.set(conversationId, seen);
+  }
+  if (seen.has(key)) {
+    return false;
+  }
+  seen.add(key);
+  return true;
+}
+
+/** Moves folded-key tracking from a temporary convo id to the persisted one. */
+export function migrateUsageFolded(fromId: string, toId: string): void {
+  const seen = foldedUsageKeys.get(fromId);
+  if (seen == null) {
+    return;
+  }
+  const target = foldedUsageKeys.get(toId) ?? new Set<string>();
+  for (const key of seen) {
+    target.add(key);
+  }
+  foldedUsageKeys.set(toId, target);
+  foldedUsageKeys.delete(fromId);
+}
+
+/**
+ * Forgets a conversation's folded usage-event identities so a subsequent resume
+ * can re-fold them. Used when a terminal close discards the in-flight pending
+ * usage: `backfillUsage` would otherwise treat the persisted events as already
+ * folded and never rebuild pending after a navigate-away-then-resume.
+ */
+export function clearUsageFolded(conversationId: string): void {
+  foldedUsageKeys.delete(conversationId);
+}
+
+/** Jotai atomFamily entries are never GC'd — call on conversation switch/cleanup */
+export function removeUsageAtoms(conversationId: string): void {
+  branchTotalsFamily.remove(conversationId);
+  contextSnapshotFamily.remove(conversationId);
+  snapshotsByAnchorFamily.remove(conversationId);
+  pendingUsageFamily.remove(conversationId);
+  totalUsageFamily.remove(conversationId);
+  liveTokensFamily.remove(conversationId);
+  calibrationFamily.remove(conversationId);
+  foldedUsageKeys.delete(conversationId);
+}
+
+/**
+ * Rehydrates per-branch context breakdowns from persisted `metadata.contextUsage`
+ * into the snapshot-history map so the granular gauge survives a reload / opening
+ * an existing conversation. Merges, never clobbers — a live finalized snapshot
+ * for the same response id wins. Re-anchors each blob to its (branch-unique)
+ * response message id and reads the response's `tokenCount` as completed output.
+ */
+export function hydrateSnapshots(conversationId: string, messages?: TMessage[] | null): void {
+  if (messages == null || messages.length === 0) {
+    return;
+  }
+  const store = getDefaultStore();
+  const historyAtom = snapshotsByAnchorFamily(conversationId);
+  const current = store.get(historyAtom);
+  let next: Map<string, ContextSnapshot> | null = null;
+  for (const message of messages) {
+    const id = message?.messageId;
+    if (!id || current.has(id)) {
+      continue;
+    }
+    const blob = message.metadata?.contextUsage;
+    if (blob == null || typeof blob !== 'object') {
+      continue;
+    }
+    const event = blob as TContextUsageEvent;
+    /** Use ONLY the persisted post-snapshot delta (the final call's output). Do
+     *  NOT fall back to the full response `tokenCount`: the snapshot already
+     *  counts earlier steps' output for multi-call turns, so adding the whole
+     *  tokenCount would double-count after reload. Absent (rare: no usage event)
+     *  contributes 0, matching the snapshot's pre-final-call base. */
+    const snapshot: ContextSnapshot = {
+      ...event,
+      anchorMessageId: id,
+      completedOutputTokens: event.completedOutputTokens,
+    };
+    next ??= new Map(current);
+    next.set(id, snapshot);
+  }
+  if (next != null) {
+    store.set(historyAtom, next);
+  }
+}
diff --git a/client/src/style.css b/client/src/style.css
index 902860ef525..35dee56a1d3 100644
--- a/client/src/style.css
+++ b/client/src/style.css
@@ -1496,6 +1496,27 @@ button {
   background-color: transparent;
 }
 
+.markdown-table-wrapper {
+  -webkit-overflow-scrolling: touch;
+  overflow-x: auto;
+  overscroll-behavior-x: contain;
+  padding-bottom: 0.25rem;
+  scrollbar-color: var(--border-medium) transparent;
+  scrollbar-width: thin;
+}
+
+.markdown-table-wrapper::-webkit-scrollbar {
+  height: 0.5rem;
+}
+
+.markdown-table-wrapper::-webkit-scrollbar-thumb {
+  background-color: var(--border-medium);
+}
+
+.markdown-table-wrapper::-webkit-scrollbar-thumb:hover {
+  background-color: var(--border-heavy);
+}
+
 /* Show scrollbar only on hover */
 .scrollbar-hover {
   scrollbar-width: thin;
diff --git a/client/src/utils/__tests__/applyModelSpecEphemeralAgent.test.ts b/client/src/utils/__tests__/applyModelSpecEphemeralAgent.test.ts
index 941293b76e8..c45e6f6139a 100644
--- a/client/src/utils/__tests__/applyModelSpecEphemeralAgent.test.ts
+++ b/client/src/utils/__tests__/applyModelSpecEphemeralAgent.test.ts
@@ -119,6 +119,16 @@ describe('applyModelSpecEphemeralAgent', () => {
       const agent = updateEphemeralAgent.mock.calls[0][1] as TEphemeralAgent;
       expect(agent.artifacts).toBe('custom-renderer');
     });
+
+    it('should not copy model spec subagents into client ephemeral agent state', () => {
+      const subagents = { enabled: true, allowSelf: true, agent_ids: ['agent_private'] };
+      const modelSpec = createModelSpec({ subagents });
+
+      applyModelSpecEphemeralAgent({ convoId: null, modelSpec, updateEphemeralAgent });
+
+      const agent = updateEphemeralAgent.mock.calls[0][1] as TEphemeralAgent;
+      expect('subagents' in agent).toBe(false);
+    });
   });
 
   // ─── Existing Conversations: Per-Conversation Persistence ──────────
diff --git a/client/src/utils/__tests__/collection.test.ts b/client/src/utils/__tests__/collection.test.ts
index 04da2e22bcf..53bace714b2 100644
--- a/client/src/utils/__tests__/collection.test.ts
+++ b/client/src/utils/__tests__/collection.test.ts
@@ -323,7 +323,7 @@ describe('deleteData', () => {
   it('removes the matching item from its page', () => {
     const data = makeInfiniteData([{ items: [makeItem('a', 'Alpha'), makeItem('b', 'Beta')] }]);
 
-    const result = deleteData<Page, Item>(data, 'items', (page) =>
+    const result = deleteData<Page, InfiniteData<Page>>(data, 'items', (page) =>
       page.items.findIndex((i) => i.id === 'a'),
     );
 
@@ -334,7 +334,7 @@ describe('deleteData', () => {
   it('leaves data unchanged when item is not found', () => {
     const data = makeInfiniteData([{ items: [makeItem('a', 'Alpha')] }]);
 
-    const result = deleteData<Page, Item>(data, 'items', (page) =>
+    const result = deleteData<Page, InfiniteData<Page>>(data, 'items', (page) =>
       page.items.findIndex((i) => i.id === 'z'),
     );
 
diff --git a/client/src/utils/__tests__/configHtml.test.ts b/client/src/utils/__tests__/configHtml.test.ts
index 66ee2969e1b..70dd2427854 100644
--- a/client/src/utils/__tests__/configHtml.test.ts
+++ b/client/src/utils/__tests__/configHtml.test.ts
@@ -2,6 +2,8 @@ import {
   CONFIG_HTML_BLOCK_TAGS,
   CONFIG_HTML_CLASS_ATTR,
   CONFIG_HTML_INLINE_TAGS,
+  CONFIG_HTML_MEDIA_ATTR,
+  CONFIG_HTML_MEDIA_TAGS,
   createConfigHtmlSanitizer,
   sanitizeConfigHtml,
 } from '../configHtml';
@@ -43,4 +45,18 @@ describe('configHtml', () => {
       '<a href="/docs" target="_blank" rel="noopener noreferrer">Docs</a> <a target="_blank" rel="noopener noreferrer">Remote</a>',
     );
   });
+
+  it('keeps inline images with safe sources under media tags', () => {
+    const sanitize = createConfigHtmlSanitizer({
+      allowedTags: CONFIG_HTML_MEDIA_TAGS,
+      allowedAttr: CONFIG_HTML_MEDIA_ATTR,
+    });
+    const sanitized = sanitize(
+      '<span>Powered by <img src="/assets/brand.svg" alt="Brand" onerror="alert(1)"> AI</span><img src="javascript:alert(1)">',
+    );
+
+    expect(sanitized).toBe(
+      '<span>Powered by <img src="/assets/brand.svg" alt="Brand"> AI</span><img>',
+    );
+  });
 });
diff --git a/client/src/utils/__tests__/getDefaultModelSpec.test.ts b/client/src/utils/__tests__/getDefaultModelSpec.test.ts
new file mode 100644
index 00000000000..37c9af163c3
--- /dev/null
+++ b/client/src/utils/__tests__/getDefaultModelSpec.test.ts
@@ -0,0 +1,428 @@
+import { Constants, EModelEndpoint, LocalStorageKeys } from 'librechat-data-provider';
+import type { TModelSpec, TStartupConfig, TEndpointsConfig } from 'librechat-data-provider';
+import { getDefaultModelSpec } from '../endpoints';
+
+const createModelSpec = (name: string, overrides: Partial<TModelSpec> = {}): TModelSpec =>
+  ({
+    name,
+    label: name,
+    preset: {
+      endpoint: EModelEndpoint.openAI,
+      model: name,
+    },
+    ...overrides,
+  }) as TModelSpec;
+
+const createStartupConfig = (
+  list: TModelSpec[],
+  {
+    prioritize = true,
+    modelSelect = true,
+    addedEndpoints,
+  }: { prioritize?: boolean; modelSelect?: boolean; addedEndpoints?: string[] } = {},
+): TStartupConfig =>
+  ({
+    interface: {
+      modelSelect,
+    },
+    modelSpecs: {
+      prioritize,
+      list,
+      ...(addedEndpoints ? { addedEndpoints } : {}),
+    },
+  }) as TStartupConfig;
+
+const fullEndpointsConfig: TEndpointsConfig = {
+  [EModelEndpoint.openAI]: { order: 0 },
+  [EModelEndpoint.agents]: { order: 1 },
+};
+
+const agentsOnlyEndpointsConfig: TEndpointsConfig = {
+  [EModelEndpoint.agents]: { order: 0 },
+};
+
+const writeLastModel = (endpoint: string, model: string) => {
+  const stored = JSON.parse(localStorage.getItem(LocalStorageKeys.LAST_MODEL) ?? '{}') as Record<
+    string,
+    string
+  >;
+  stored[endpoint] = model;
+  localStorage.setItem(LocalStorageKeys.LAST_MODEL, JSON.stringify(stored));
+};
+
+/** Mirrors what the conversation effect persists after a spec preset is applied */
+const persistAppliedSpec = (spec: TModelSpec, conversationId: string = Constants.NEW_CONVO) => {
+  localStorage.setItem(LocalStorageKeys.LAST_SPEC, spec.name);
+  writeLastModel(spec.preset.endpoint as string, spec.preset.model as string);
+  localStorage.setItem(
+    `${LocalStorageKeys.LAST_CONVO_SETUP}_0`,
+    JSON.stringify({
+      conversationId,
+      endpoint: spec.preset.endpoint,
+      model: spec.preset.model,
+      spec: spec.name,
+    }),
+  );
+};
+
+/** Mirrors what the conversation effect persists after the user selects an agent */
+const persistAgentSelection = (agentId: string) => {
+  localStorage.setItem(`${LocalStorageKeys.AGENT_ID_PREFIX}0`, agentId);
+  localStorage.setItem(
+    `${LocalStorageKeys.LAST_CONVO_SETUP}_0`,
+    JSON.stringify({
+      endpoint: EModelEndpoint.agents,
+      agent_id: agentId,
+      model: null,
+      spec: null,
+    }),
+  );
+};
+
+/** Mirrors what the conversation effect persists after an ephemeral endpoint → model pick */
+const persistEphemeralSelection = (endpoint: string, model: string) => {
+  writeLastModel(endpoint, model);
+  localStorage.setItem(
+    `${LocalStorageKeys.LAST_CONVO_SETUP}_0`,
+    JSON.stringify({ endpoint, model, spec: null }),
+  );
+};
+
+describe('getDefaultModelSpec', () => {
+  beforeEach(() => {
+    localStorage.clear();
+  });
+
+  it('uses the soft default for a fresh user with no prior selection', () => {
+    const regularSpec = createModelSpec('regular-spec');
+    const softSpec = createModelSpec('soft-spec', { softDefault: true });
+
+    const result = getDefaultModelSpec(createStartupConfig([regularSpec, softSpec]));
+
+    expect(result).toEqual({ softDefault: softSpec });
+  });
+
+  it('keeps the last selected spec before applying the soft default', () => {
+    const lastSpec = createModelSpec('last-spec');
+    const softSpec = createModelSpec('soft-spec', { softDefault: true });
+    localStorage.setItem(LocalStorageKeys.LAST_SPEC, lastSpec.name);
+
+    const result = getDefaultModelSpec(createStartupConfig([softSpec, lastSpec]));
+
+    expect(result).toEqual({ last: lastSpec });
+  });
+
+  it('does not apply the soft default when a prior model selection exists', () => {
+    const softSpec = createModelSpec('soft-spec', { softDefault: true });
+    localStorage.setItem(
+      LocalStorageKeys.LAST_MODEL,
+      JSON.stringify({ [EModelEndpoint.openAI]: 'gpt-4o' }),
+    );
+
+    const result = getDefaultModelSpec(createStartupConfig([softSpec]), fullEndpointsConfig);
+
+    expect(result).toBeUndefined();
+  });
+
+  it('does not apply the soft default when a prior agent selection exists', () => {
+    const softSpec = createModelSpec('soft-spec', { softDefault: true });
+    localStorage.setItem(`${LocalStorageKeys.AGENT_ID_PREFIX}0`, 'agent_123');
+
+    const result = getDefaultModelSpec(createStartupConfig([softSpec]), fullEndpointsConfig);
+
+    expect(result).toBeUndefined();
+  });
+
+  it('keeps hard admin defaults ahead of user history and soft defaults', () => {
+    const hardSpec = createModelSpec('hard-spec', { default: true });
+    const softSpec = createModelSpec('soft-spec', { softDefault: true });
+    localStorage.setItem(LocalStorageKeys.LAST_SPEC, softSpec.name);
+
+    const result = getDefaultModelSpec(createStartupConfig([softSpec, hardSpec]));
+
+    expect(result).toEqual({ default: hardSpec });
+  });
+
+  it('preserves the legacy first-spec fallback when no soft default is configured', () => {
+    const firstSpec = createModelSpec('first-spec');
+    const secondSpec = createModelSpec('second-spec');
+
+    const result = getDefaultModelSpec(createStartupConfig([firstSpec, secondSpec]));
+
+    expect(result).toEqual({ default: firstSpec });
+  });
+
+  describe('soft default auto-application residue', () => {
+    const softSpec = createModelSpec('soft-spec', { softDefault: true });
+    const otherSpec = createModelSpec('other-spec');
+
+    it('stays soft after its own application is persisted (prioritized config)', () => {
+      persistAppliedSpec(softSpec);
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([otherSpec, softSpec]),
+        fullEndpointsConfig,
+      );
+
+      expect(result).toEqual({ softDefault: softSpec });
+    });
+
+    it('stays soft after its own application is persisted (modelSelect config)', () => {
+      persistAppliedSpec(softSpec);
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([otherSpec, softSpec], { prioritize: false }),
+        fullEndpointsConfig,
+      );
+
+      expect(result).toEqual({ softDefault: softSpec });
+    });
+
+    it('yields to an agent selected after the soft default was applied', () => {
+      persistAppliedSpec(softSpec);
+      persistAgentSelection('agent_abc');
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([otherSpec, softSpec], { prioritize: false }),
+        fullEndpointsConfig,
+      );
+
+      expect(result).toBeUndefined();
+    });
+
+    it('yields to an agent selection even with the prioritized config', () => {
+      persistAppliedSpec(softSpec);
+      persistAgentSelection('agent_abc');
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([otherSpec, softSpec]),
+        fullEndpointsConfig,
+      );
+
+      expect(result).toBeUndefined();
+    });
+
+    it('yields to an ephemeral endpoint → model pick after the soft default was applied', () => {
+      persistAppliedSpec(softSpec);
+      persistEphemeralSelection(EModelEndpoint.openAI, 'gpt-4o');
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([otherSpec, softSpec], { prioritize: false }),
+        fullEndpointsConfig,
+      );
+
+      expect(result).toBeUndefined();
+    });
+
+    it('yields to a different spec selected after the soft default was applied', () => {
+      persistAppliedSpec(softSpec);
+      persistAppliedSpec(otherSpec);
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([otherSpec, softSpec], { prioritize: false }),
+        fullEndpointsConfig,
+      );
+
+      expect(result).toEqual({ last: otherSpec });
+    });
+
+    it('treats a matching stored agent as residue when the soft default points to an agent', () => {
+      const softAgentSpec = createModelSpec('soft-agent-spec', {
+        softDefault: true,
+        preset: { endpoint: EModelEndpoint.agents, agent_id: 'agent_soft' },
+      } as Partial<TModelSpec>);
+      localStorage.setItem(`${LocalStorageKeys.AGENT_ID_PREFIX}0`, 'agent_soft');
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([softAgentSpec], { prioritize: false }),
+        fullEndpointsConfig,
+      );
+
+      expect(result).toEqual({ softDefault: softAgentSpec });
+    });
+
+    it('treats a stored model matching the soft default preset as residue', () => {
+      localStorage.setItem(
+        LocalStorageKeys.LAST_MODEL,
+        JSON.stringify({ [softSpec.preset.endpoint as string]: softSpec.preset.model }),
+      );
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([otherSpec, softSpec], { prioritize: false }),
+        fullEndpointsConfig,
+      );
+
+      expect(result).toEqual({ softDefault: softSpec });
+    });
+
+    it('stays soft after the first conversation is sent', () => {
+      persistAppliedSpec(softSpec, 'a8b1c2d3-e4f5-4a6b-8c7d-9e0f1a2b3c4d');
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([otherSpec, softSpec], { prioritize: false }),
+        fullEndpointsConfig,
+      );
+
+      expect(result).toEqual({ softDefault: softSpec });
+    });
+
+    it('does not re-arm from viewing an old soft conversation after an ephemeral pick', () => {
+      persistEphemeralSelection(EModelEndpoint.anthropic, 'claude-sonnet-4-6');
+      persistAppliedSpec(softSpec, 'a8b1c2d3-e4f5-4a6b-8c7d-9e0f1a2b3c4d');
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([otherSpec, softSpec], { prioritize: false }),
+        fullEndpointsConfig,
+      );
+
+      expect(result).toBeUndefined();
+    });
+
+    it('does not re-arm from viewing an old soft conversation after an agent pick', () => {
+      localStorage.setItem(`${LocalStorageKeys.AGENT_ID_PREFIX}0`, 'agent_abc');
+      persistAppliedSpec(softSpec, 'a8b1c2d3-e4f5-4a6b-8c7d-9e0f1a2b3c4d');
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([otherSpec, softSpec], { prioritize: false }),
+        fullEndpointsConfig,
+      );
+
+      expect(result).toBeUndefined();
+    });
+
+    it('yields when a different agent is stored than the soft default agent spec', () => {
+      const softAgentSpec = createModelSpec('soft-agent-spec', {
+        softDefault: true,
+        preset: { endpoint: EModelEndpoint.agents, agent_id: 'agent_soft' },
+      } as Partial<TModelSpec>);
+      localStorage.setItem(`${LocalStorageKeys.AGENT_ID_PREFIX}0`, 'agent_other');
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([softAgentSpec], { prioritize: false }),
+        fullEndpointsConfig,
+      );
+
+      expect(result).toBeUndefined();
+    });
+  });
+
+  describe('explicit soft default selection', () => {
+    const softSpec = createModelSpec('soft-spec', { softDefault: true });
+    const otherSpec = createModelSpec('other-spec');
+
+    it('keeps the soft default selected over older model history (prioritized config)', () => {
+      persistEphemeralSelection(EModelEndpoint.openAI, 'gpt-4o');
+      persistAppliedSpec(softSpec);
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([otherSpec, softSpec]),
+        fullEndpointsConfig,
+      );
+
+      expect(result).toEqual({ softDefault: softSpec });
+    });
+
+    it('keeps the soft default selected over older model history (modelSelect config)', () => {
+      persistEphemeralSelection(EModelEndpoint.openAI, 'gpt-4o');
+      persistAppliedSpec(softSpec);
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([otherSpec, softSpec], { prioritize: false }),
+        fullEndpointsConfig,
+      );
+
+      expect(result).toEqual({ softDefault: softSpec });
+    });
+  });
+
+  describe('no ephemeral endpoint → model options (edge case)', () => {
+    const softSpec = createModelSpec('soft-spec', { softDefault: true });
+    const otherSpec = createModelSpec('other-spec');
+
+    it('applies the soft default despite a stored agent when modelSelect is disabled', () => {
+      persistAgentSelection('agent_abc');
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([otherSpec, softSpec], { modelSelect: false }),
+        fullEndpointsConfig,
+      );
+
+      expect(result).toEqual({ softDefault: softSpec });
+    });
+
+    it('applies the soft default despite a stored agent when addedEndpoints only includes agents', () => {
+      persistAgentSelection('agent_abc');
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([otherSpec, softSpec], {
+          prioritize: false,
+          addedEndpoints: [EModelEndpoint.agents],
+        }),
+        fullEndpointsConfig,
+      );
+
+      expect(result).toEqual({ softDefault: softSpec });
+    });
+
+    it('applies the soft default despite a stored agent when agents is the only endpoint', () => {
+      persistAgentSelection('agent_abc');
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([otherSpec, softSpec], { prioritize: false }),
+        agentsOnlyEndpointsConfig,
+      );
+
+      expect(result).toEqual({ softDefault: softSpec });
+    });
+
+    it('still defers to the last selected spec', () => {
+      persistAppliedSpec(otherSpec);
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([otherSpec, softSpec], { prioritize: false }),
+        agentsOnlyEndpointsConfig,
+      );
+
+      expect(result).toEqual({ last: otherSpec });
+    });
+
+    it('keeps the selection gate when addedEndpoints includes ephemeral endpoints', () => {
+      persistAgentSelection('agent_abc');
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([otherSpec, softSpec], {
+          prioritize: false,
+          addedEndpoints: [EModelEndpoint.agents, EModelEndpoint.openAI],
+        }),
+        fullEndpointsConfig,
+      );
+
+      expect(result).toBeUndefined();
+    });
+
+    it('keeps the selection gate while the endpoints config has not loaded', () => {
+      persistAgentSelection('agent_abc');
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([otherSpec, softSpec], { prioritize: false }),
+        undefined,
+      );
+
+      expect(result).toBeUndefined();
+    });
+
+    it('detects an agents-only allow-list before the endpoints config loads', () => {
+      persistAgentSelection('agent_abc');
+
+      const result = getDefaultModelSpec(
+        createStartupConfig([otherSpec, softSpec], {
+          prioritize: false,
+          addedEndpoints: [EModelEndpoint.agents],
+        }),
+        undefined,
+      );
+
+      expect(result).toEqual({ softDefault: softSpec });
+    });
+  });
+});
diff --git a/client/src/utils/__tests__/messages.test.ts b/client/src/utils/__tests__/messages.test.ts
index 4af9f694395..b919441348a 100644
--- a/client/src/utils/__tests__/messages.test.ts
+++ b/client/src/utils/__tests__/messages.test.ts
@@ -1,6 +1,11 @@
 import type { TMessage } from 'librechat-data-provider';
 import type { LocalizeFunction } from '~/common';
-import { getMessageAriaLabel, getHeaderPrefixForScreenReader } from '../messages';
+import {
+  isValidTimestamp,
+  getMessageAriaLabel,
+  getMessageTimestamp,
+  getHeaderPrefixForScreenReader,
+} from '../messages';
 
 const translations: Record<string, string> = {
   com_endpoint_message: 'Message',
@@ -80,3 +85,70 @@ describe('getHeaderPrefixForScreenReader', () => {
     expect(getHeaderPrefixForScreenReader(msg, localize)).toBe('Response: ');
   });
 });
+
+describe('isValidTimestamp', () => {
+  it('returns false for missing values', () => {
+    expect(isValidTimestamp(undefined)).toBe(false);
+    expect(isValidTimestamp(null)).toBe(false);
+    expect(isValidTimestamp('')).toBe(false);
+  });
+
+  it('returns false for unparseable strings', () => {
+    expect(isValidTimestamp('not-a-date')).toBe(false);
+  });
+
+  it('returns true for ISO date strings', () => {
+    expect(isValidTimestamp('2026-06-12T15:42:00.000Z')).toBe(true);
+  });
+});
+
+describe('getMessageTimestamp', () => {
+  const NOW = new Date('2026-06-12T15:42:00.000Z').getTime();
+
+  beforeEach(() => {
+    jest.useFakeTimers().setSystemTime(NOW);
+  });
+
+  afterEach(() => {
+    jest.useRealTimers();
+  });
+
+  it('returns null for missing or invalid values', () => {
+    expect(getMessageTimestamp(undefined, 'en-US')).toBeNull();
+    expect(getMessageTimestamp(null, 'en-US')).toBeNull();
+    expect(getMessageTimestamp('not-a-date', 'en-US')).toBeNull();
+  });
+
+  it('formats relative and absolute time for a recent message', () => {
+    const twoHoursAgo = new Date(NOW - 2 * 60 * 60 * 1000).toISOString();
+    const result = getMessageTimestamp(twoHoursAgo, 'en-US');
+    expect(result).not.toBeNull();
+    expect(result?.relative).toBe('2 hours ago');
+    expect(result?.iso).toBe(twoHoursAgo);
+    expect(result?.absolute).toContain('2026');
+  });
+
+  it('flags messages under 24h as recent (prefer relative)', () => {
+    const justUnderADay = new Date(NOW - 23 * 60 * 60 * 1000).toISOString();
+    expect(getMessageTimestamp(justUnderADay, 'en-US')?.isRecent).toBe(true);
+  });
+
+  it('flags older messages as not recent (prefer absolute date)', () => {
+    const overADay = new Date(NOW - 25 * 60 * 60 * 1000).toISOString();
+    const monthAgo = new Date(NOW - 38 * 24 * 60 * 60 * 1000).toISOString();
+    expect(getMessageTimestamp(overADay, 'en-US')?.isRecent).toBe(false);
+    expect(getMessageTimestamp(monthAgo, 'en-US')?.isRecent).toBe(false);
+  });
+
+  it('uses "now" for the current instant', () => {
+    const result = getMessageTimestamp(new Date(NOW).toISOString(), 'en-US');
+    expect(result?.relative).toBe('now');
+    expect(result?.isRecent).toBe(true);
+  });
+
+  it('falls back to the default locale for a malformed locale tag', () => {
+    const iso = new Date(NOW - 60 * 1000).toISOString();
+    expect(() => getMessageTimestamp(iso, 'not a locale!!')).not.toThrow();
+    expect(getMessageTimestamp(iso, 'not a locale!!')).not.toBeNull();
+  });
+});
diff --git a/client/src/utils/__tests__/validateFiles.spec.ts b/client/src/utils/__tests__/validateFiles.spec.ts
index 6d690bf62a9..b7f13d64741 100644
--- a/client/src/utils/__tests__/validateFiles.spec.ts
+++ b/client/src/utils/__tests__/validateFiles.spec.ts
@@ -98,6 +98,22 @@ describe('validateFiles', () => {
     expect(setError).toHaveBeenCalledWith('Unsupported file type: application/x-unknown');
   });
 
+  it('normalizes Windows ZIP MIME type before validation', () => {
+    const fileList = [makeFile('archive.zip', 'application/x-zip-compressed', 1024)];
+    const result = validateFiles({ files, fileList, setError, endpointFileConfig, fileConfig });
+    expect(result).toBe(true);
+    expect(fileList[0].type).toBe('application/zip');
+    expect(setError).not.toHaveBeenCalled();
+  });
+
+  it('infers ZIP MIME type when the browser does not provide one', () => {
+    const fileList = [makeFile('archive.zip', '', 1024)];
+    const result = validateFiles({ files, fileList, setError, endpointFileConfig, fileConfig });
+    expect(result).toBe(true);
+    expect(fileList[0].type).toBe('application/zip');
+    expect(setError).not.toHaveBeenCalled();
+  });
+
   it('rejects when file size equals fileSizeLimit (>= comparison)', () => {
     const limit = 5 * megabyte;
     endpointFileConfig = makeEndpointConfig({ fileSizeLimit: limit });
diff --git a/client/src/utils/configHtml.ts b/client/src/utils/configHtml.ts
index 171b8ce6296..8c0cbddcd7d 100644
--- a/client/src/utils/configHtml.ts
+++ b/client/src/utils/configHtml.ts
@@ -3,8 +3,10 @@ import DOMPurify from 'dompurify';
 export const CONFIG_HTML_INLINE_TAGS = ['a', 'strong', 'b', 'em', 'i', 'br', 'code'] as const;
 export const CONFIG_HTML_TEXT_TAGS = [...CONFIG_HTML_INLINE_TAGS, 'span'] as const;
 export const CONFIG_HTML_BLOCK_TAGS = [...CONFIG_HTML_TEXT_TAGS, 'p'] as const;
+export const CONFIG_HTML_MEDIA_TAGS = [...CONFIG_HTML_TEXT_TAGS, 'img'] as const;
 export const CONFIG_HTML_LINK_ATTR = ['href', 'target', 'rel'] as const;
 export const CONFIG_HTML_CLASS_ATTR = [...CONFIG_HTML_LINK_ATTR, 'class'] as const;
+export const CONFIG_HTML_MEDIA_ATTR = [...CONFIG_HTML_CLASS_ATTR, 'src', 'alt'] as const;
 
 const CONFIG_HTML_SAFE_URI =
   /^(?:(?:https?|mailto|tel):|(?!(?:\s*[a-z][a-z0-9+.-]*:|\s*\/\/))[\s\S])/i;
diff --git a/client/src/utils/conversationTags.spec.ts b/client/src/utils/conversationTags.spec.ts
index 10eb336682f..9bacd504b53 100644
--- a/client/src/utils/conversationTags.spec.ts
+++ b/client/src/utils/conversationTags.spec.ts
@@ -7,6 +7,7 @@ describe('ConversationTag Utilities', () => {
   beforeEach(() => {
     conversations = [
       {
+        _id: 'tag-id-saved',
         tag: 'saved',
         count: 1,
         position: 0,
@@ -16,6 +17,7 @@ describe('ConversationTag Utilities', () => {
         user: 'user1',
       },
       {
+        _id: 'tag-id-1',
         tag: 'tag1',
         count: 1,
         position: 1,
@@ -25,6 +27,7 @@ describe('ConversationTag Utilities', () => {
         user: 'user1',
       },
       {
+        _id: 'tag-id-2',
         tag: 'tag2',
         count: 20,
         position: 2,
@@ -34,6 +37,7 @@ describe('ConversationTag Utilities', () => {
         user: 'user1',
       },
       {
+        _id: 'tag-id-3',
         tag: 'tag3',
         count: 30,
         position: 3,
@@ -43,6 +47,7 @@ describe('ConversationTag Utilities', () => {
         user: 'user1',
       },
       {
+        _id: 'tag-id-4',
         tag: 'tag4',
         count: 40,
         position: 4,
@@ -52,6 +57,7 @@ describe('ConversationTag Utilities', () => {
         user: 'user1',
       },
       {
+        _id: 'tag-id-5',
         tag: 'tag5',
         count: 50,
         position: 5,
@@ -175,6 +181,7 @@ describe('ConversationTag Utilities', () => {
       conversations,
       { tag: 'newtag', description: 'newDescription' },
       {
+        _id: 'tag-id-newtag',
         tag: 'newtag',
         description: 'newDescription',
         position: 1,
@@ -208,6 +215,7 @@ describe('ConversationTag Utilities', () => {
       [],
       { tag: 'newtag', description: 'newDescription' },
       {
+        _id: 'tag-id-saved',
         tag: 'saved',
         description: 'newDescription',
         position: 0,
diff --git a/client/src/utils/convos.ts b/client/src/utils/convos.ts
index 5b0f6b7a552..2fe26f7e388 100644
--- a/client/src/utils/convos.ts
+++ b/client/src/utils/convos.ts
@@ -78,6 +78,7 @@ const dateGroupsSet = new Set([
 
 export const groupConversationsByDate = (
   conversations: Array<TConversation | null>,
+  dateField: 'updatedAt' | 'createdAt' = 'updatedAt',
 ): GroupedConversations => {
   if (!Array.isArray(conversations)) {
     return [];
@@ -93,8 +94,9 @@ export const groupConversationsByDate = (
     seenConversationIds.add(conversation.conversationId);
 
     let date: Date;
-    if (conversation.updatedAt) {
-      date = parseISO(conversation.updatedAt);
+    const dateValue = conversation[dateField] ?? conversation.updatedAt ?? conversation.createdAt;
+    if (dateValue) {
+      date = parseISO(dateValue);
     } else {
       date = now;
     }
@@ -131,7 +133,8 @@ export const groupConversationsByDate = (
   sortedGroups.forEach((conversations) => {
     conversations.sort(
       (a: TConversation, b: TConversation) =>
-        new Date(b.updatedAt).getTime() - new Date(a.updatedAt).getTime(),
+        new Date(b[dateField] ?? b.updatedAt ?? 0).getTime() -
+        new Date(a[dateField] ?? a.updatedAt ?? 0).getTime(),
     );
   });
   return Array.from(sortedGroups, ([key, value]) => [key, value]);
@@ -142,6 +145,40 @@ export type ConversationCursorData = {
   nextCursor?: string | null;
 };
 
+function getConversationQueryProjectId(queryKey: readonly unknown[]): string | undefined {
+  const params = queryKey[1];
+  if (!params || typeof params !== 'object') {
+    return undefined;
+  }
+  return (params as { projectId?: string }).projectId;
+}
+
+function conversationMatchesProjectQuery(
+  queryKey: readonly unknown[],
+  conversation: Pick<TConversation, 'chatProjectId'>,
+): boolean {
+  const projectId = getConversationQueryProjectId(queryKey);
+  if (!projectId) {
+    return true;
+  }
+  if (projectId === 'unassigned') {
+    return !conversation.chatProjectId;
+  }
+  return conversation.chatProjectId === projectId;
+}
+
+/**
+ * Reads the project id from the current URL's `?projectId` param — the source of
+ * truth for a new chat's project scope (the conversation atom can lag behind it).
+ */
+export function getRouteChatProjectId(): string | null {
+  if (typeof window === 'undefined') {
+    return null;
+  }
+  const projectId = new URLSearchParams(window.location.search).get('projectId');
+  return projectId != null && /^[a-f\d]{24}$/i.test(projectId) ? projectId : null;
+}
+
 // === InfiniteData helpers for cursor-based convo queries ===
 
 export function findConversationInInfinite(
@@ -208,6 +245,9 @@ export function addConversationToAllConversationsQueries(
     .findAll([QueryKeys.allConversations], { exact: false });
 
   for (const query of queries) {
+    if (!conversationMatchesProjectQuery(query.queryKey, newConversation)) {
+      continue;
+    }
     queryClient.setQueryData<InfiniteData<ConversationCursorData>>(query.queryKey, (old) => {
       if (
         !old ||
@@ -322,6 +362,9 @@ export function addConvoToAllQueries(queryClient: QueryClient, newConvo: TConver
     .findAll([QueryKeys.allConversations], { exact: false });
 
   for (const query of queries) {
+    if (!conversationMatchesProjectQuery(query.queryKey, newConvo)) {
+      continue;
+    }
     queryClient.setQueryData<InfiniteData<ConversationCursorData>>(query.queryKey, (oldData) => {
       if (!oldData) {
         return oldData;
@@ -381,6 +424,9 @@ export function upsertConvoInAllQueries(
 
       const now = new Date().toISOString();
       if (pageIdx === -1) {
+        if (!conversationMatchesProjectQuery(query.queryKey, nextConvo)) {
+          return oldData;
+        }
         const firstPage = oldData.pages[0] ?? { conversations: [], nextCursor: null };
         return {
           ...oldData,
@@ -404,6 +450,10 @@ export function upsertConvoInAllQueries(
         updatedAt: nextConvo.updatedAt ?? (moveToTop ? now : found.updatedAt),
       };
 
+      if (!conversationMatchesProjectQuery(query.queryKey, updated)) {
+        return removeConvoFromInfinitePages(oldData, updated.conversationId ?? '');
+      }
+
       if (!moveToTop || (pageIdx === 0 && convoIdx === 0)) {
         return {
           ...oldData,
@@ -480,6 +530,10 @@ export function updateConvoInAllQueries(
         ? { ...updater(found), updatedAt: new Date().toISOString() }
         : updater(found);
 
+      if (!conversationMatchesProjectQuery(query.queryKey, updated)) {
+        return removeConvoFromInfinitePages(oldData, conversationId);
+      }
+
       // If not moving to top, or already at top of page 0, update in place
       if (!moveToTop || (pageIdx === 0 && convoIdx === 0)) {
         return {
diff --git a/client/src/utils/endpoints.ts b/client/src/utils/endpoints.ts
index fcc389a13f3..95b55ce1169 100644
--- a/client/src/utils/endpoints.ts
+++ b/client/src/utils/endpoints.ts
@@ -137,6 +137,148 @@ interface InitiatedTemplateResult {
   newEndpointType: EModelEndpoint | undefined;
 }
 
+type StoredModelSelection = Pick<
+  t.TConversation,
+  'endpoint' | 'model' | 'spec' | 'agent_id' | 'assistant_id' | 'conversationId'
+>;
+
+function hasSelectionValue(value?: string | null): boolean {
+  return typeof value === 'string' && value.trim() !== '';
+}
+
+function parseStoredModelSelection(
+  value: string | null,
+): Partial<StoredModelSelection> | undefined {
+  if (!value) {
+    return;
+  }
+
+  try {
+    return JSON.parse(value) as Partial<StoredModelSelection>;
+  } catch {
+    return;
+  }
+}
+
+function hasStoredPrefixValue(prefix: string, ignoreValue?: string | null): boolean {
+  for (let i = 0; i < localStorage.length; i++) {
+    const key = localStorage.key(i);
+    if (!key?.startsWith(prefix)) {
+      continue;
+    }
+
+    const value = localStorage.getItem(key);
+    if (hasSelectionValue(value) && value !== ignoreValue) {
+      return true;
+    }
+  }
+
+  return false;
+}
+
+function hasStoredModelValue(softPreset?: t.TModelSpecPreset): boolean {
+  const storedModelValue = localStorage.getItem(LocalStorageKeys.LAST_MODEL);
+  if (!storedModelValue) {
+    return false;
+  }
+
+  try {
+    const storedModels = JSON.parse(storedModelValue) as Record<string, string | null | undefined>;
+    return Object.entries(storedModels).some(
+      ([endpoint, model]) =>
+        hasSelectionValue(model) &&
+        !(endpoint === softPreset?.endpoint && model === softPreset?.model),
+    );
+  } catch {
+    return false;
+  }
+}
+
+export function hasModelSelection(selection?: Partial<StoredModelSelection> | null): boolean {
+  if (!selection) {
+    return false;
+  }
+
+  return (
+    hasSelectionValue(selection.spec) ||
+    hasSelectionValue(selection.agent_id) ||
+    hasSelectionValue(selection.assistant_id) ||
+    hasSelectionValue(selection.model) ||
+    hasSelectionValue(selection.endpoint)
+  );
+}
+
+/**
+ * Whether localStorage holds a model selection the user actually made.
+ * State matching what applying `softDefaultSpec` writes is residue of the
+ * soft default itself, not evidence of a user choice, and is ignored.
+ */
+function hasStoredModelSelection(softDefaultSpec?: t.TModelSpec): boolean {
+  const softPreset = softDefaultSpec?.preset;
+  const lastSpecName = localStorage.getItem(LocalStorageKeys.LAST_SPEC);
+  if (hasSelectionValue(lastSpecName) && lastSpecName !== softDefaultSpec?.name) {
+    return true;
+  }
+
+  if (hasStoredModelValue(softPreset)) {
+    return true;
+  }
+
+  if (
+    hasStoredPrefixValue(LocalStorageKeys.AGENT_ID_PREFIX, softPreset?.agent_id) ||
+    hasStoredPrefixValue(LocalStorageKeys.ASST_ID_PREFIX, softPreset?.assistant_id)
+  ) {
+    return true;
+  }
+
+  const lastConversationSetup = parseStoredModelSelection(
+    localStorage.getItem(LocalStorageKeys.LAST_CONVO_SETUP + '_0'),
+  );
+  if (softDefaultSpec && lastConversationSetup?.spec === softDefaultSpec.name) {
+    return false;
+  }
+
+  return hasModelSelection(lastConversationSetup);
+}
+
+/**
+ * Whether the selector offers any ephemeral endpoint → model options.
+ * False when the endpoints menu is hidden (`modelSelect` disabled) or only
+ * agents/assistants picks remain; an empty endpoints config means not loaded.
+ */
+function hasEphemeralModelOptions({
+  endpointsConfig,
+  addedEndpoints,
+  modelSelect,
+}: {
+  endpointsConfig?: t.TEndpointsConfig;
+  addedEndpoints?: Array<EModelEndpoint | string>;
+  modelSelect?: boolean;
+}): boolean {
+  if (!modelSelect) {
+    return false;
+  }
+  const included = new Set(addedEndpoints ?? []);
+  const includesEphemeral =
+    included.size === 0 ||
+    [...included].some(
+      (endpoint) => !isAgentsEndpoint(endpoint) && !isAssistantsEndpoint(endpoint),
+    );
+  if (!includesEphemeral) {
+    return false;
+  }
+  if (endpointsConfig == null || Object.keys(endpointsConfig).length === 0) {
+    return true;
+  }
+  return Object.entries(endpointsConfig).some(
+    ([endpoint, config]) =>
+      config != null &&
+      !isAgentsEndpoint(endpoint) &&
+      !isAssistantsEndpoint(endpoint) &&
+      (included.size === 0 || included.has(endpoint)),
+  );
+}
+
 /** Get the conditional logic for switching conversations */
 export function getConvoSwitchLogic(params: ConversationInitParams): InitiatedTemplateResult {
   const { conversation, newEndpoint, endpointsConfig, modularChat = false } = params;
@@ -271,35 +413,81 @@ export function applyModelSpecEphemeralAgent({
 
 /**
  * Gets default model spec from config and user preferences.
- * Priority: admin default → last selected → first spec (when prioritize=true or modelSelect disabled).
- * Otherwise: admin default or last conversation spec.
+ * Priority: hard admin default → prior user selection → soft default.
+ * The soft default yields only to selections the user actually made — its
+ * stored state counts as the live selection only when set on a new chat, so
+ * merely viewing an old soft-spec conversation never re-arms it — and it acts
+ * as the fallback default when no ephemeral endpoint → model options exist.
+ * Legacy first-spec prioritization remains only when no soft default is configured.
  */
-export function getDefaultModelSpec(startupConfig?: t.TStartupConfig):
+export function getDefaultModelSpec(
+  startupConfig?: t.TStartupConfig,
+  endpointsConfig?: t.TEndpointsConfig,
+):
   | {
       default?: t.TModelSpec;
       last?: t.TModelSpec;
+      softDefault?: t.TModelSpec;
     }
   | undefined {
   const { modelSpecs, interface: interfaceConfig } = startupConfig ?? {};
-  const { list, prioritize } = modelSpecs ?? {};
+  const { list, prioritize, addedEndpoints } = modelSpecs ?? {};
   if (!list) {
     return;
   }
   const defaultSpec = list?.find((spec) => spec.default);
+  const softDefaultSpec = list?.find((spec) => spec.softDefault);
+  const lastConversationSetup = parseStoredModelSelection(
+    localStorage.getItem(LocalStorageKeys.LAST_CONVO_SETUP + '_0'),
+  );
+  const resolveSoftDefault = (): { softDefault: t.TModelSpec } | undefined => {
+    if (!softDefaultSpec) {
+      return;
+    }
+    if (
+      lastConversationSetup?.spec === softDefaultSpec.name &&
+      lastConversationSetup?.conversationId === Constants.NEW_CONVO
+    ) {
+      return { softDefault: softDefaultSpec };
+    }
+    const ephemeralOptions = hasEphemeralModelOptions({
+      endpointsConfig,
+      addedEndpoints,
+      modelSelect: interfaceConfig?.modelSelect,
+    });
+    if (!ephemeralOptions) {
+      return { softDefault: softDefaultSpec };
+    }
+    return hasStoredModelSelection(softDefaultSpec) ? undefined : { softDefault: softDefaultSpec };
+  };
   if (prioritize === true || !interfaceConfig?.modelSelect) {
     const lastSelectedSpecName = localStorage.getItem(LocalStorageKeys.LAST_SPEC);
     const lastSelectedSpec = list?.find((spec) => spec.name === lastSelectedSpecName);
-    return { default: defaultSpec || lastSelectedSpec || list?.[0] };
+    if (defaultSpec) {
+      return { default: defaultSpec };
+    }
+    if (lastSelectedSpec && lastSelectedSpec.name === softDefaultSpec?.name) {
+      return resolveSoftDefault();
+    }
+    if (lastSelectedSpec) {
+      return { last: lastSelectedSpec };
+    }
+    if (softDefaultSpec) {
+      return resolveSoftDefault();
+    }
+    return { default: list?.[0] };
   } else if (defaultSpec) {
     return { default: defaultSpec };
   }
-  const lastConversationSetup = JSON.parse(
-    localStorage.getItem(LocalStorageKeys.LAST_CONVO_SETUP + '_0') ?? '{}',
-  );
-  if (!lastConversationSetup.spec) {
-    return;
+  const lastConversationSpecName = lastConversationSetup?.spec;
+  if (!hasSelectionValue(lastConversationSpecName)) {
+    return resolveSoftDefault();
+  }
+  const lastSpec = list?.find((spec) => spec.name === lastConversationSpecName);
+  if (lastSpec && lastSpec.name === softDefaultSpec?.name) {
+    return resolveSoftDefault();
   }
-  return { last: list?.find((spec) => spec.name === lastConversationSetup.spec) };
+  return { last: lastSpec };
 }
 
 export function getModelSpecPreset(modelSpec?: t.TModelSpec) {
diff --git a/client/src/utils/heicConverter.spec.ts b/client/src/utils/heicConverter.spec.ts
new file mode 100644
index 00000000000..59b30b2306c
--- /dev/null
+++ b/client/src/utils/heicConverter.spec.ts
@@ -0,0 +1,47 @@
+describe('heicConverter', () => {
+  beforeEach(() => {
+    jest.resetModules();
+  });
+
+  it('does not load heic-to for non-HEIC files', async () => {
+    jest.doMock(
+      'heic-to',
+      () => {
+        throw new Error('heic-to should not be loaded');
+      },
+      { virtual: true },
+    );
+
+    const { processFileForUpload } = await import('./heicConverter');
+    const file = new File(['plain text'], 'notes.txt', { type: 'text/plain' });
+
+    await expect(processFileForUpload(file)).resolves.toBe(file);
+  });
+
+  it('detects and converts HEIC files after lazily loading heic-to', async () => {
+    const isHeic = jest.fn(async () => true);
+    const heicTo = jest.fn(async () => new Blob(['jpeg'], { type: 'image/jpeg' }));
+    jest.doMock('heic-to', () => ({ heicTo, isHeic }), { virtual: true });
+
+    const { processFileForUpload } = await import('./heicConverter');
+    const file = new File(['heic data'], 'photo.heic', {
+      type: 'image/heic',
+      lastModified: 123,
+    });
+    const onProgress = jest.fn();
+
+    const converted = await processFileForUpload(file, 0.85, onProgress);
+
+    expect(isHeic).toHaveBeenCalledWith(file);
+    expect(heicTo).toHaveBeenCalledWith({
+      blob: file,
+      type: 'image/jpeg',
+      quality: 0.85,
+    });
+    expect(converted).not.toBe(file);
+    expect(converted.name).toBe('photo.jpg');
+    expect(converted.type).toBe('image/jpeg');
+    expect(converted.lastModified).toBe(123);
+    expect(onProgress.mock.calls.map(([progress]) => progress)).toEqual([0.3, 0.8, 1]);
+  });
+});
diff --git a/client/src/utils/heicConverter.ts b/client/src/utils/heicConverter.ts
index a14e09a0508..46dc7d929a1 100644
--- a/client/src/utils/heicConverter.ts
+++ b/client/src/utils/heicConverter.ts
@@ -1,4 +1,19 @@
-import { heicTo, isHeic } from 'heic-to';
+const HEIC_MIME_TYPES = new Set(['image/heic', 'image/heif']);
+const HEIC_EXTENSION_REGEX = /\.(heic|heif)$/i;
+type HeicToModule = typeof import('heic-to');
+
+let heicConverterPromise: Promise<HeicToModule> | null = null;
+
+const loadHeicConverter = async (): Promise<HeicToModule> => {
+  heicConverterPromise ??= import('heic-to').catch((error) => {
+    heicConverterPromise = null;
+    throw error;
+  });
+  return heicConverterPromise;
+};
+
+const hasHEICMetadata = (file: File): boolean =>
+  HEIC_MIME_TYPES.has(file.type.toLowerCase()) || HEIC_EXTENSION_REGEX.test(file.name);
 
 /**
  * Check if a file is in HEIC format
@@ -6,7 +21,12 @@ import { heicTo, isHeic } from 'heic-to';
  * @returns Promise<boolean> - True if the file is HEIC
  */
 export const isHEICFile = async (file: File): Promise<boolean> => {
+  if (!hasHEICMetadata(file)) {
+    return false;
+  }
+
   try {
+    const { isHeic } = await loadHeicConverter();
     return await isHeic(file);
   } catch (error) {
     console.warn('Error checking if file is HEIC:', error);
@@ -31,6 +51,7 @@ export const convertHEICToJPEG = async (
     // Report conversion start
     onProgress?.(0.3);
 
+    const { heicTo } = await loadHeicConverter();
     const convertedBlob = await heicTo({
       blob: file,
       type: 'image/jpeg',
diff --git a/client/src/utils/imageResize.ts b/client/src/utils/imageResize.ts
index 3be6e8d8c07..af13d97ff4d 100644
--- a/client/src/utils/imageResize.ts
+++ b/client/src/utils/imageResize.ts
@@ -45,7 +45,9 @@ export function supportsClientResize(): boolean {
     const canvas = document.createElement('canvas');
     const ctx = canvas.getContext('2d');
 
-    return !!(ctx && ctx.drawImage && canvas.toBlob);
+    return (
+      ctx != null && typeof ctx.drawImage === 'function' && typeof canvas.toBlob === 'function'
+    );
   } catch {
     return false;
   }
diff --git a/client/src/utils/index.ts b/client/src/utils/index.ts
index 14d76e7b732..ea322b047fb 100644
--- a/client/src/utils/index.ts
+++ b/client/src/utils/index.ts
@@ -10,6 +10,7 @@ export * from './email';
 export * from './share';
 export * from './files';
 export * from './latex';
+export * from './tilde';
 export * from './forms';
 export * from './roles';
 export * from './errors';
@@ -21,6 +22,7 @@ export * from './presets';
 export * from './prompts';
 export * from './textarea';
 export * from './messages';
+export * from './tokens';
 export * from './redirect';
 export * from './languages';
 export * from './conversation';
diff --git a/client/src/utils/messages.ts b/client/src/utils/messages.ts
index d906c33ddc4..0c756e7c375 100644
--- a/client/src/utils/messages.ts
+++ b/client/src/utils/messages.ts
@@ -17,9 +17,15 @@ import type { QueryClient } from '@tanstack/react-query';
 import type { LocalizeFunction } from '~/common';
 
 export const TEXT_KEY_DIVIDER = '|||';
+export const STREAM_START_FAILED_METADATA_KEY = 'streamStartFailed';
 
 type SiblingIndexLookup = (parentMessageId: string | null | undefined) => number;
 
+export type BranchSiblingIndex = {
+  parentMessageId: string | null | undefined;
+  siblingIdx: number;
+};
+
 export const selectActiveBranchTail = (
   messages: TMessage[] | null | undefined,
   rootSiblingKey: string | null | undefined,
@@ -82,6 +88,55 @@ export const getMessageBranchSiblingParentIds = (
   return Array.from(parentIds);
 };
 
+export const getBranchSiblingIndexesForTarget = (
+  messages: TMessage[] | null | undefined,
+  targetMessageId: string | null | undefined,
+  rootSiblingKey: string | null | undefined,
+): BranchSiblingIndex[] => {
+  if (!targetMessageId) {
+    return [];
+  }
+
+  const messagesTree = buildTree({ messages: messages ?? null });
+  if (!messagesTree?.length) {
+    return [];
+  }
+
+  const branchIndexes: BranchSiblingIndex[] = [];
+  const findTargetPath = (
+    siblings: TMessage[] | undefined,
+    parentMessageId: string | null | undefined,
+  ): boolean => {
+    if (!siblings?.length) {
+      return false;
+    }
+
+    for (let index = 0; index < siblings.length; index++) {
+      const message = siblings[index];
+      if (!message) {
+        continue;
+      }
+
+      const isTarget = message.messageId === targetMessageId;
+      const childHasTarget = findTargetPath(message.children, message.messageId);
+      if (isTarget || childHasTarget) {
+        if (siblings.length > 1) {
+          branchIndexes.unshift({
+            parentMessageId,
+            siblingIdx: siblings.length - index - 1,
+          });
+        }
+        return true;
+      }
+    }
+
+    return false;
+  };
+
+  findTargetPath(messagesTree, rootSiblingKey);
+  return branchIndexes;
+};
+
 export const getLatestText = (message?: TMessage | null, includeIndex?: boolean): string => {
   if (!message) {
     return '';
@@ -136,6 +191,16 @@ export const getAllContentText = (message?: TMessage | null): string => {
   return '';
 };
 
+export const hasStreamStartFailed = (message?: Pick<TMessage, 'metadata'> | null): boolean =>
+  message?.metadata?.[STREAM_START_FAILED_METADATA_KEY] === true;
+
+export const markStreamStartFailedMetadata = (
+  metadata?: TMessage['metadata'],
+): TMessage['metadata'] => ({
+  ...(metadata ?? {}),
+  [STREAM_START_FAILED_METADATA_KEY]: true,
+});
+
 const getLatestContentForKey = (message: TMessage): string => {
   const formatText = (str: string, index: number): string => {
     if (str.length === 0) {
@@ -279,6 +344,94 @@ export const getHeaderPrefixForScreenReader = (
     : `${localize('com_ui_response')}${suffix}: `;
 };
 
+export type MessageTimestamp = {
+  /** Localized relative time, e.g. "2 hours ago". */
+  relative: string;
+  /** Localized absolute date and time, e.g. "Jun 12, 2026, 3:42 PM". */
+  absolute: string;
+  /** ISO 8601 string for the `<time>` element's `dateTime` attribute. */
+  iso: string;
+  /**
+   * True when the message is recent enough that the relative form ("10 minutes ago")
+   * reads better than the absolute date. Past this window the absolute date is clearer.
+   */
+  isRecent: boolean;
+};
+
+/** Below this age the relative form is preferred over the absolute date. */
+const RECENT_THRESHOLD_MS = 24 * 60 * 60 * 1000;
+
+/** Returns true when `value` parses to a valid date. */
+export const isValidTimestamp = (value?: string | null): value is string => {
+  if (!value) {
+    return false;
+  }
+  return !Number.isNaN(new Date(value).getTime());
+};
+
+const RELATIVE_TIME_DIVISIONS: { amount: number; unit: Intl.RelativeTimeFormatUnit }[] = [
+  { amount: 60, unit: 'second' },
+  { amount: 60, unit: 'minute' },
+  { amount: 24, unit: 'hour' },
+  { amount: 7, unit: 'day' },
+  { amount: 4.34524, unit: 'week' },
+  { amount: 12, unit: 'month' },
+  { amount: Number.POSITIVE_INFINITY, unit: 'year' },
+];
+
+/** Returns the locale only when it is a syntactically valid BCP-47 tag, else undefined. */
+const resolveLocale = (locale?: string): string | undefined => {
+  if (!locale) {
+    return undefined;
+  }
+  try {
+    Intl.DateTimeFormat.supportedLocalesOf(locale);
+    return locale;
+  } catch {
+    return undefined;
+  }
+};
+
+const formatRelativeTime = (from: Date, to: Date, locale?: string): string => {
+  const formatter = new Intl.RelativeTimeFormat(locale, { numeric: 'auto' });
+  let duration = (from.getTime() - to.getTime()) / 1000;
+  for (const division of RELATIVE_TIME_DIVISIONS) {
+    if (Math.abs(duration) < division.amount) {
+      return formatter.format(Math.round(duration), division.unit);
+    }
+    duration /= division.amount;
+  }
+  return formatter.format(Math.round(duration), 'year');
+};
+
+/**
+ * Formats a message timestamp into locale-aware relative and absolute strings.
+ * Returns null when the value is missing or unparseable, so callers can skip
+ * rendering the timestamp entirely.
+ */
+export const getMessageTimestamp = (
+  value?: string | null,
+  locale?: string,
+): MessageTimestamp | null => {
+  if (!isValidTimestamp(value)) {
+    return null;
+  }
+
+  const date = new Date(value);
+  const now = new Date(Date.now());
+  const safeLocale = resolveLocale(locale);
+
+  return {
+    iso: date.toISOString(),
+    relative: formatRelativeTime(date, now, safeLocale),
+    absolute: new Intl.DateTimeFormat(safeLocale, {
+      dateStyle: 'medium',
+      timeStyle: 'short',
+    }).format(date),
+    isRecent: Math.abs(now.getTime() - date.getTime()) < RECENT_THRESHOLD_MS,
+  };
+};
+
 /**
  * Creates initial content parts for dual message display with agent-based grouping.
  * Sets up primary and added agent content parts with agentId for column rendering.
diff --git a/client/src/utils/resources.ts b/client/src/utils/resources.ts
index a8bdfcb3414..09623247a29 100644
--- a/client/src/utils/resources.ts
+++ b/client/src/utils/resources.ts
@@ -71,6 +71,16 @@ export const RESOURCE_CONFIGS: Record<ResourceType, ResourceConfig> = {
       `Manage permissions for ${name && name !== '' ? name : 'skill'}`,
     getCopyUrlMessage: () => 'Skill URL copied',
   },
+  [ResourceType.SHARED_LINK]: {
+    resourceType: ResourceType.SHARED_LINK,
+    defaultViewerRoleId: AccessRoleIds.SHARED_LINK_VIEWER,
+    defaultEditorRoleId: AccessRoleIds.SHARED_LINK_VIEWER,
+    defaultOwnerRoleId: AccessRoleIds.SHARED_LINK_OWNER,
+    getResourceName: (name?: string) => name || 'shared link',
+    getShareMessage: (name?: string) => name || 'shared link',
+    getManageMessage: (name?: string) => `Manage access for ${name || 'shared link'}`,
+    getCopyUrlMessage: () => 'Share link copied',
+  },
 };
 
 export const getResourceConfig = (resourceType: ResourceType): ResourceConfig | undefined => {
diff --git a/client/src/utils/roles.ts b/client/src/utils/roles.ts
index 3720e91939e..3dba1fe5ff6 100644
--- a/client/src/utils/roles.ts
+++ b/client/src/utils/roles.ts
@@ -73,6 +73,15 @@ export const ROLE_LOCALIZATIONS = {
     name: 'com_ui_role_owner' as const,
     description: 'com_ui_skill_role_owner_desc' as const,
   } as const,
+  // Shared link roles
+  sharedLink_viewer: {
+    name: 'com_ui_role_viewer' as const,
+    description: 'com_ui_role_viewer_desc' as const,
+  } as const,
+  sharedLink_owner: {
+    name: 'com_ui_role_owner' as const,
+    description: 'com_ui_role_owner_desc' as const,
+  } as const,
 };
 
 /**
diff --git a/client/src/utils/tilde.spec.ts b/client/src/utils/tilde.spec.ts
new file mode 100644
index 00000000000..fbda8d82581
--- /dev/null
+++ b/client/src/utils/tilde.spec.ts
@@ -0,0 +1,143 @@
+import type { Node } from 'unist';
+import { normalizeApproxTildes, remarkApproxTilde } from './tilde';
+
+const T = '∼'; // U+223C TILDE OPERATOR
+
+describe('normalizeApproxTildes', () => {
+  test('returns the same string when no tilde is present', () => {
+    const content = 'a plain string without any tilde';
+    expect(normalizeApproxTildes(content)).toBe(content);
+  });
+
+  test('neutralizes a paired approximation that would become subscript', () => {
+    expect(normalizeApproxTildes('down. ~50% of IPOs ... to ~10%).')).toBe(
+      `down. ${T}50% of IPOs ... to ${T}10%).`,
+    );
+  });
+
+  test('neutralizes a single approximation tilde', () => {
+    expect(normalizeApproxTildes('about ~50 people')).toBe(`about ${T}50 people`);
+  });
+
+  test('neutralizes approximation before currency and after an open bracket', () => {
+    expect(normalizeApproxTildes('range (~$5 to ~10%)')).toBe(`range (${T}$5 to ${T}10%)`);
+  });
+
+  test('neutralizes a spaced negative approximation', () => {
+    expect(normalizeApproxTildes('is ~ -3% from')).toBe(`is ${T} -3% from`);
+  });
+
+  test('neutralizes quoted approximations', () => {
+    expect(normalizeApproxTildes('about "~50%" and "~10%"')).toBe(`about "${T}50%" and "${T}10%"`);
+  });
+
+  test('preserves word-attached subscripts', () => {
+    expect(normalizeApproxTildes('H~2~O and x~1~')).toBe('H~2~O and x~1~');
+  });
+
+  test('preserves a space-delimited closed-number subscript', () => {
+    expect(normalizeApproxTildes('the term a ~2~ here')).toBe('the term a ~2~ here');
+  });
+
+  test('does not match a tilde attached to a preceding number', () => {
+    expect(normalizeApproxTildes('range 5~10 items')).toBe('range 5~10 items');
+  });
+});
+
+interface TextNode extends Node {
+  type: 'text';
+  value: string;
+}
+interface CodeNode extends Node {
+  type: 'inlineCode' | 'code';
+  value: string;
+}
+interface MathNode extends Node {
+  type: 'inlineMath' | 'math';
+  value: string;
+}
+interface LinkNode extends Node {
+  type: 'link';
+  url: string;
+  children: Node[];
+}
+
+describe('remarkApproxTilde', () => {
+  /**
+   * supersub only splits `text` nodes, so the plugin's contract is to rewrite
+   * approximation tildes in text nodes while leaving every other node type — code,
+   * math, and link destinations — byte-for-byte untouched. A hand-built tree proves
+   * that contract without depending on the parser.
+   */
+  test('rewrites text nodes but leaves code, math, and link URLs untouched', () => {
+    const text: TextNode = { type: 'text', value: 'about ~50% and ~10% here' };
+    const inlineCode: CodeNode = { type: 'inlineCode', value: '~50%' };
+    const fenced: CodeNode = { type: 'code', value: '~50% in code\n~/path' };
+    const inlineMath: MathNode = { type: 'inlineMath', value: 'x ~ 10' };
+    const displayMath: MathNode = { type: 'math', value: '~10' };
+    const linkText: TextNode = { type: 'text', value: '~50% off' };
+    const link: LinkNode = {
+      type: 'link',
+      url: 'https://example.com/~50/file',
+      children: [linkText],
+    };
+    const tree: Node = {
+      type: 'root',
+      children: [text, inlineCode, fenced, inlineMath, displayMath, link],
+    } as Node;
+
+    remarkApproxTilde()(tree);
+
+    expect(text.value).toBe(`about ${T}50% and ${T}10% here`);
+    expect(inlineCode.value).toBe('~50%');
+    expect(fenced.value).toBe('~50% in code\n~/path');
+    expect(inlineMath.value).toBe('x ~ 10');
+    expect(displayMath.value).toBe('~10');
+    expect(link.url).toBe('https://example.com/~50/file');
+    expect(linkText.value).toBe(`${T}50% off`);
+  });
+
+  test('preserves an autolink label that displays the URL', () => {
+    const label: TextNode = { type: 'text', value: 'https://example.com/~50/file' };
+    const link: LinkNode = {
+      type: 'link',
+      url: 'https://example.com/~50/file',
+      children: [label],
+    };
+    remarkApproxTilde()({ type: 'root', children: [link] } as Node);
+    expect(label.value).toBe('https://example.com/~50/file');
+  });
+
+  test('preserves a www autolink label whose href has an implied scheme', () => {
+    const label: TextNode = { type: 'text', value: 'www.example.com/~50/x' };
+    const link: LinkNode = {
+      type: 'link',
+      url: 'http://www.example.com/~50/x',
+      children: [label],
+    };
+    remarkApproxTilde()({ type: 'root', children: [link] } as Node);
+    expect(label.value).toBe('www.example.com/~50/x');
+  });
+
+  test('still converts a regular link label that is prose', () => {
+    const label: TextNode = { type: 'text', value: '~50% to ~10% off' };
+    const link: LinkNode = { type: 'link', url: 'https://example.com', children: [label] };
+    remarkApproxTilde()({ type: 'root', children: [link] } as Node);
+    expect(label.value).toBe(`${T}50% to ${T}10% off`);
+  });
+
+  test('removes both tildes of an approximation pair so no `~` remains to subscript', () => {
+    const node: TextNode = { type: 'text', value: 'first ~50% then ~10% drop' };
+    const tree: Node = { type: 'root', children: [node] } as Node;
+    remarkApproxTilde()(tree);
+    expect(node.value).not.toContain('~');
+    expect(node.value).toBe(`first ${T}50% then ${T}10% drop`);
+  });
+
+  test('leaves a genuine subscript text node intact for supersub to handle', () => {
+    const node: TextNode = { type: 'text', value: 'water H~2~O molecule' };
+    const tree: Node = { type: 'root', children: [node] } as Node;
+    remarkApproxTilde()(tree);
+    expect(node.value).toBe('water H~2~O molecule');
+  });
+});
diff --git a/client/src/utils/tilde.ts b/client/src/utils/tilde.ts
new file mode 100644
index 00000000000..e2b4384ae50
--- /dev/null
+++ b/client/src/utils/tilde.ts
@@ -0,0 +1,77 @@
+import type { Node } from 'unist';
+
+interface TextNode extends Node {
+  type: 'text';
+  value: string;
+}
+interface LinkNode extends Node {
+  type: 'link';
+  url: string;
+}
+interface ParentNode extends Node {
+  children?: Node[];
+}
+
+/**
+ * A GFM autolink renders the URL itself as its label, so the label text node equals the
+ * destination (with an implied scheme for `www.`/email links). Rewriting it would change the
+ * URL the user sees while leaving the href intact, so these are left untouched.
+ */
+function isAutolinkLabel(value: string, parent?: Node): boolean {
+  if (!parent || parent.type !== 'link') {
+    return false;
+  }
+  const url = (parent as LinkNode).url;
+  return (
+    url === value ||
+    url === `http://${value}` ||
+    url === `https://${value}` ||
+    url === `mailto:${value}`
+  );
+}
+
+// "Approximately" tilde: a `~` prefixing a number that is not attached to a preceding word —
+// e.g. `~50%`, `~ -3%`, `~$5`, `"~50%"`, `(~10%)`. Running on parsed text nodes (never code,
+// links, math, or URL destinations) means only real prose is touched, so the boundary can be
+// permissive: anything except a word character or another tilde. Word-attached and
+// closed-number subscripts (`H~2~O`, `a ~2~ b`) are excluded so genuine subscripts survive.
+// Markdown decodes `\~` to `~` before this runs, so escaped tildes are covered too.
+const APPROX_TILDE_REGEX = /(?<![\w~])~(?=[ \t]?[-−+]?\$?\d)(?![ \t]?[-−+]?\$?[\d.,]*~)/g;
+// U+223C TILDE OPERATOR — renders as a tilde but is not split by remark-supersub.
+const TILDE_OPERATOR = '∼';
+
+/**
+ * Replaces "approximately" tildes (e.g. `~50%`) in a single text value with the Unicode
+ * tilde operator so `remark-supersub` does not pair them into spurious `<sub>` ranges.
+ * A backslash escape cannot help — markdown decodes `\~` back to `~` before supersub runs —
+ * so the glyph itself must change.
+ */
+export function normalizeApproxTildes(value: string): string {
+  if (value.indexOf('~') === -1) return value;
+  return value.replace(APPROX_TILDE_REGEX, TILDE_OPERATOR);
+}
+
+function normalizeTextNodes(node: Node, parent?: Node): void {
+  if (node.type === 'text') {
+    const textNode = node as TextNode;
+    if (typeof textNode.value === 'string' && !isAutolinkLabel(textNode.value, parent)) {
+      textNode.value = normalizeApproxTildes(textNode.value);
+    }
+    return;
+  }
+  const children = (node as ParentNode).children;
+  if (!children) return;
+  for (const child of children) {
+    normalizeTextNodes(child, node);
+  }
+}
+
+/**
+ * remark plugin that neutralizes "approximately" tildes in text nodes before
+ * `remark-supersub` runs. Walking the parsed tree means code, links, math, and URL
+ * destinations are structurally excluded — none of them are `text` nodes. Autolink labels
+ * (which display the URL itself) are skipped so the visible URL is preserved verbatim.
+ */
+export function remarkApproxTilde() {
+  return (tree: Node) => normalizeTextNodes(tree);
+}
diff --git a/client/src/utils/tokens.spec.ts b/client/src/utils/tokens.spec.ts
new file mode 100644
index 00000000000..725fdab224d
--- /dev/null
+++ b/client/src/utils/tokens.spec.ts
@@ -0,0 +1,679 @@
+import { Constants, Providers } from 'librechat-data-provider';
+import type { TMessage, TResponseUsage } from 'librechat-data-provider';
+import {
+  buildIndex,
+  upsertEntries,
+  migrateIndex,
+  clearIndex,
+  hasIndex,
+  sumBranch,
+  mergeUsage,
+  setEntryUsage,
+  sumTotalUsage,
+  findBranchSnapshotAnchor,
+  estimateTokens,
+  normalizeUsageUnits,
+  formatCost,
+  groupToolTokens,
+  countTrailingOutputChars,
+  EMPTY_BRANCH,
+  EMPTY_USAGE,
+  EMPTY_TOOL_GROUPS,
+} from './tokens';
+
+const CONVO = 'convo-1';
+
+function msg(
+  messageId: string,
+  parentMessageId: string | null,
+  isCreatedByUser: boolean,
+  tokenCount?: number,
+): TMessage {
+  return {
+    messageId,
+    parentMessageId,
+    isCreatedByUser,
+    tokenCount,
+    conversationId: CONVO,
+    text: '',
+  } as TMessage;
+}
+
+/** Response message carrying a persisted `metadata.usage` rollup (the backend
+ *  persists already-normalized display units). */
+function responseMsg(
+  messageId: string,
+  parentMessageId: string | null,
+  tokenCount: number,
+  usage: TResponseUsage,
+): TMessage {
+  return {
+    messageId,
+    parentMessageId,
+    isCreatedByUser: false,
+    tokenCount,
+    conversationId: CONVO,
+    text: '',
+    metadata: { usage },
+  } as TMessage;
+}
+
+const USAGE_A: TResponseUsage = { input: 100, output: 50, cacheWrite: 0, cacheRead: 0, cost: 0.01 };
+const USAGE_B: TResponseUsage = { input: 200, output: 80, cacheWrite: 0, cacheRead: 0, cost: 0.02 };
+
+describe('token index', () => {
+  afterEach(() => {
+    clearIndex(CONVO);
+    clearIndex('convo-2');
+    clearIndex(Constants.NEW_CONVO);
+  });
+
+  it('sums only the active branch via the parent chain', () => {
+    buildIndex(CONVO, [
+      msg('u1', Constants.NO_PARENT, true, 10),
+      msg('a1', 'u1', false, 20),
+      msg('u2', 'a1', true, 30),
+      msg('a2', 'u2', false, 40),
+      /** Sibling branch that must not be counted */
+      msg('a2-alt', 'u2', false, 999),
+    ]);
+
+    const totals = sumBranch(CONVO, 'a2');
+    expect(totals.input).toBe(40);
+    expect(totals.output).toBe(60);
+    expect(totals.total).toBe(4);
+    expect(totals.counted).toBe(4);
+
+    const altTotals = sumBranch(CONVO, 'a2-alt');
+    expect(altTotals.output).toBe(1019);
+  });
+
+  it('caps the branch at a summary marker instead of re-summing compacted history', () => {
+    const summarized = {
+      messageId: 'a2',
+      parentMessageId: 'u2',
+      isCreatedByUser: false,
+      tokenCount: 40,
+      conversationId: CONVO,
+      text: '',
+      /** a2's turn compacted the history; pre-invoke context was 500 tokens. */
+      metadata: { summaryUsedTokens: 500 },
+    } as TMessage;
+    buildIndex(CONVO, [
+      msg('u1', Constants.NO_PARENT, true, 100),
+      msg('a1', 'u1', false, 9000) /** huge pre-summary history, now discarded */,
+      msg('u2', 'a1', true, 200),
+      summarized,
+      msg('u3', 'a2', true, 15),
+      msg('a3', 'u3', false, 25),
+    ]);
+
+    const totals = sumBranch(CONVO, 'a3');
+    /** Walk stops at a2: only its output + the post-summary turn are summed. */
+    expect(totals.summaryBaseline).toBe(500);
+    expect(totals.input).toBe(15);
+    expect(totals.output).toBe(65); // a3 (25) + a2 (40)
+    /** Estimate used = post-summary + compacted baseline = 580, not the 9380
+     *  raw history sum that pinned the gauge at 100%. */
+    expect(totals.input + totals.output + totals.summaryBaseline).toBe(580);
+  });
+
+  it('keeps provider usage/cost across the full branch even past a summary marker', () => {
+    const summarized = {
+      messageId: 'a2',
+      parentMessageId: 'u2',
+      isCreatedByUser: false,
+      tokenCount: 40,
+      conversationId: CONVO,
+      text: '',
+      metadata: { usage: USAGE_B, summaryUsedTokens: 500 },
+    } as TMessage;
+    buildIndex(CONVO, [
+      msg('u1', Constants.NO_PARENT, true, 10),
+      responseMsg('a1', 'u1', 9000, USAGE_A) /** pre-summary spend */,
+      msg('u2', 'a1', true, 200),
+      summarized,
+      msg('u3', 'a2', true, 15),
+      responseMsg('a3', 'u3', 25, USAGE_A) /** post-summary spend */,
+    ]);
+
+    const totals = sumBranch(CONVO, 'a3');
+    /** Context is capped at the marker... */
+    expect(totals.summaryBaseline).toBe(500);
+    /** ...but cost/usage is cumulative spend and spans the WHOLE branch
+     *  (a1 + a2 + a3 = 0.01 + 0.02 + 0.01), not truncated at the summary boundary. */
+    expect(totals.usage.cost).toBeCloseTo(0.04);
+    expect(totals.usage.input).toBe(400); // 100 + 200 + 100
+  });
+
+  it('flags whether the anchor message is on the branch', () => {
+    buildIndex(CONVO, [
+      msg('u1', Constants.NO_PARENT, true, 10),
+      msg('a1', 'u1', false, 20),
+      msg('a1-alt', 'u1', false, 25),
+    ]);
+
+    expect(sumBranch(CONVO, 'a1', 'a1').containsAnchor).toBe(true);
+    expect(sumBranch(CONVO, 'a1-alt', 'a1').containsAnchor).toBe(false);
+  });
+
+  it('stops matching the anchor once the context is capped at a summary marker', () => {
+    const summarized = {
+      messageId: 'a2',
+      parentMessageId: 'u2',
+      isCreatedByUser: false,
+      tokenCount: 40,
+      conversationId: CONVO,
+      text: '',
+      metadata: { summaryUsedTokens: 500 },
+    } as TMessage;
+    buildIndex(CONVO, [
+      msg('u1', Constants.NO_PARENT, true, 100),
+      msg('a1', 'u1', false, 20),
+      msg('u2', 'a1', true, 200),
+      summarized,
+      msg('u3', 'a2', true, 15),
+      msg('a3', 'u3', false, 25),
+    ]);
+    /** a1 is older than the summary marker (a2): a snapshot anchored there is
+     *  pre-summary, so it must NOT count as on-branch — else useTokenUsage revives
+     *  that stale breakdown over the summary-baseline estimate. */
+    expect(sumBranch(CONVO, 'a3', 'a1').containsAnchor).toBe(false);
+    /** The summarized response's own (post-summary) snapshot still matches... */
+    expect(sumBranch(CONVO, 'a3', 'a2').containsAnchor).toBe(true);
+    /** ...as does a snapshot from a newer turn. */
+    expect(sumBranch(CONVO, 'a3', 'a3').containsAnchor).toBe(true);
+  });
+
+  it('tracks uncounted messages and tolerates missing parents', () => {
+    buildIndex(CONVO, [msg('u2', 'missing-parent', true, undefined), msg('a2', 'u2', false, 15)]);
+
+    const totals = sumBranch(CONVO, 'a2');
+    expect(totals.total).toBe(2);
+    expect(totals.counted).toBe(1);
+    expect(totals.output).toBe(15);
+  });
+
+  it('returns EMPTY_BRANCH without an index or tail', () => {
+    expect(sumBranch('unknown', 'x')).toBe(EMPTY_BRANCH);
+    buildIndex(CONVO, []);
+    expect(sumBranch(CONVO, null)).toBe(EMPTY_BRANCH);
+  });
+
+  it('upserts incrementally and overwrites by messageId', () => {
+    buildIndex(CONVO, [msg('u1', Constants.NO_PARENT, true, 10)]);
+    upsertEntries(CONVO, [msg('a1', 'u1', false, 20), null, undefined]);
+    expect(sumBranch(CONVO, 'a1').output).toBe(20);
+
+    upsertEntries(CONVO, [msg('a1', 'u1', false, 35)]);
+    expect(sumBranch(CONVO, 'a1').output).toBe(35);
+  });
+
+  it('migrates the index to a new conversation id', () => {
+    buildIndex(Constants.NEW_CONVO, [msg('u1', Constants.NO_PARENT, true, 10)]);
+    migrateIndex(Constants.NEW_CONVO, 'convo-2');
+
+    expect(hasIndex(Constants.NEW_CONVO)).toBe(false);
+    expect(sumBranch('convo-2', 'u1').input).toBe(10);
+  });
+});
+
+describe('findBranchSnapshotAnchor', () => {
+  afterEach(() => clearIndex(CONVO));
+
+  it('returns the deepest stored anchor on the viewed branch', () => {
+    buildIndex(CONVO, [
+      msg('u1', Constants.NO_PARENT, true, 10),
+      msg('a1', 'u1', false, 20),
+      msg('u2', 'a1', true, 30),
+      msg('a2', 'u2', false, 40),
+      msg('a2-alt', 'u2', false, 50),
+    ]);
+    /** Both a1 and a2 stored; walking from a2 must return the nearer one (a2). */
+    const anchors = new Map([
+      ['a1', 1],
+      ['a2', 1],
+    ]);
+    expect(findBranchSnapshotAnchor(CONVO, 'a2', anchors)).toBe('a2');
+    /** From the sibling branch tail, the only on-branch anchor is a1. */
+    expect(findBranchSnapshotAnchor(CONVO, 'a2-alt', anchors)).toBe('a1');
+  });
+
+  it('returns null when no stored anchor sits on the branch', () => {
+    buildIndex(CONVO, [msg('u1', Constants.NO_PARENT, true, 10), msg('a1', 'u1', false, 20)]);
+    expect(findBranchSnapshotAnchor(CONVO, 'a1', new Map([['other', 1]]))).toBeNull();
+    expect(findBranchSnapshotAnchor(CONVO, 'a1', new Map())).toBeNull();
+    expect(findBranchSnapshotAnchor('unknown', 'a1', new Map([['a1', 1]]))).toBeNull();
+  });
+
+  it('does not cross a summary marker to recover a stale pre-summary snapshot', () => {
+    const summarized = {
+      messageId: 'a2',
+      parentMessageId: 'u2',
+      isCreatedByUser: false,
+      tokenCount: 40,
+      conversationId: CONVO,
+      text: '',
+      metadata: { summaryUsedTokens: 500 },
+    } as TMessage;
+    buildIndex(CONVO, [
+      msg('u1', Constants.NO_PARENT, true, 10),
+      msg('a1', 'u1', false, 20) /** has a snapshot, but pre-summary */,
+      msg('u2', 'a1', true, 30),
+      summarized /** compacted here, no snapshot of its own */,
+      msg('u3', 'a2', true, 15),
+      msg('a3', 'u3', false, 25),
+    ]);
+    /** a1 is the only stored anchor, but it sits before the summary — the walk
+     *  must stop at a2 and return null so the summary-baseline estimate is used. */
+    expect(findBranchSnapshotAnchor(CONVO, 'a3', new Map([['a1', 1]]))).toBeNull();
+    /** When the summarized response itself has a snapshot, return it. */
+    expect(findBranchSnapshotAnchor(CONVO, 'a3', new Map([['a2', 1]]))).toBe('a2');
+  });
+});
+
+describe('estimateTokens', () => {
+  it('estimates chars/4 scaled by calibration ratio', () => {
+    expect(estimateTokens(400)).toBe(100);
+    expect(estimateTokens(400, 1.1)).toBe(110);
+    expect(estimateTokens(0)).toBe(0);
+    expect(estimateTokens(100, 0)).toBe(25);
+  });
+});
+
+describe('normalizeUsageUnits', () => {
+  it('subtracts cache from input for Anthropic (input_tokens is cache-inclusive)', () => {
+    /** The agents SDK folds cache into Anthropic input_tokens, so cache is a
+     *  subset of input and must be subtracted: 900 − 100 read = 800. */
+    expect(
+      normalizeUsageUnits({
+        input_tokens: 900,
+        output_tokens: 100,
+        provider: Providers.ANTHROPIC,
+        input_token_details: { cache_read: 100 },
+      }),
+    ).toEqual({ input: 800, output: 100, cacheWrite: 0, cacheRead: 100 });
+  });
+
+  it('keeps cache additive for Bedrock (Converse input_tokens excludes cache)', () => {
+    expect(
+      normalizeUsageUnits({
+        input_tokens: 900,
+        output_tokens: 100,
+        provider: Providers.BEDROCK,
+        input_token_details: { cache_read: 100 },
+      }),
+    ).toEqual({ input: 900, output: 100, cacheWrite: 0, cacheRead: 100 });
+  });
+
+  it('keeps subset semantics for OpenAI regardless of magnitude', () => {
+    expect(
+      normalizeUsageUnits({
+        input_tokens: 900,
+        output_tokens: 100,
+        provider: Providers.OPENAI,
+        input_token_details: { cache_read: 100 },
+      }),
+    ).toEqual({ input: 800, output: 100, cacheWrite: 0, cacheRead: 100 });
+  });
+
+  it('falls back to a magnitude heuristic when provider is unknown', () => {
+    /** cacheSum (12000) > input (1000) ⇒ additive */
+    expect(
+      normalizeUsageUnits({
+        input_tokens: 1000,
+        output_tokens: 500,
+        input_token_details: { cache_creation: 2000, cache_read: 10000 },
+      }),
+    ).toEqual({ input: 1000, output: 500, cacheWrite: 2000, cacheRead: 10000 });
+  });
+
+  it('repairs under-reported completion tokens (Vertex thinking)', () => {
+    /** total - input = 500 recovers the dropped thinking tokens */
+    expect(
+      normalizeUsageUnits({
+        input_tokens: 1000,
+        output_tokens: 200,
+        total_tokens: 1500,
+        provider: Providers.VERTEXAI,
+      }).output,
+    ).toBe(500);
+  });
+
+  it('does not mistake additive cache for missing completion tokens (Bedrock)', () => {
+    /** Bedrock keeps cache separate, so total = input + output + cache (1700).
+     *  Without the cache adjustment the repair would falsely inflate completion. */
+    expect(
+      normalizeUsageUnits({
+        input_tokens: 1000,
+        output_tokens: 200,
+        total_tokens: 1700,
+        provider: Providers.BEDROCK,
+        input_token_details: { cache_creation: 300, cache_read: 200 },
+      }).output,
+    ).toBe(200);
+  });
+
+  it('does not inflate completion for cache-inclusive Anthropic totals', () => {
+    /** Anthropic total already includes cache (input 1000 covers the 500 cache),
+     *  so total 1200 leaves output at 200 — no false repair. */
+    expect(
+      normalizeUsageUnits({
+        input_tokens: 1000,
+        output_tokens: 200,
+        total_tokens: 1200,
+        provider: Providers.ANTHROPIC,
+        input_token_details: { cache_creation: 300, cache_read: 200 },
+      }).output,
+    ).toBe(200);
+  });
+});
+
+describe('formatCost', () => {
+  it('formats across magnitude bands (USD default, unchanged)', () => {
+    expect(formatCost(0)).toBe('$0.00');
+    expect(formatCost(0.004)).toBe('<$0.01');
+    expect(formatCost(0.0523)).toBe('$0.0523');
+    expect(formatCost(1.234)).toBe('$1.23');
+  });
+
+  it('applies the static USD→local rate', () => {
+    expect(formatCost(2, { code: 'USD', rate: 0.5 })).toBe('$1.00');
+    expect(formatCost(10, { code: 'USD', rate: 0.1 })).toBe('$1.00');
+  });
+
+  it('formats in the configured currency', () => {
+    const eur = formatCost(5, { code: 'EUR', rate: 1 });
+    expect(eur).toContain('€');
+    expect(eur).toContain('5');
+  });
+
+  it('respects zero-decimal currencies', () => {
+    const jpy = formatCost(5, { code: 'JPY', rate: 1 });
+    expect(jpy).toContain('¥');
+    expect(jpy).not.toContain('.');
+  });
+
+  it('falls back to USD on a malformed currency code', () => {
+    expect(formatCost(5, { code: 'invalid', rate: 1 })).toBe('$5.00');
+  });
+
+  it('drops the rate too when the currency code is unsupported', () => {
+    /** A typo in `code` must not leave a converted amount under the $ symbol. */
+    expect(formatCost(10, { code: 'EURO', rate: 0.92 })).toBe('$10.00');
+  });
+
+  it('rejects well-formed but non-ISO codes that Intl would accept', () => {
+    /** `EUU`/`RMB` are 3 letters so Intl does not throw; the ISO-4217 set must
+     *  still reject them and fall back to USD (no converted amount, no rate). */
+    expect(formatCost(10, { code: 'EUU', rate: 0.92 })).toBe('$10.00');
+    expect(formatCost(10, { code: 'RMB', rate: 0.5 })).toBe('$10.00');
+  });
+
+  it('uses the currency minor unit for three-decimal currencies', () => {
+    /** KWD has 3 fractional digits, so the tiny threshold is 0.001, not 0.01. */
+    const small = formatCost(0.005, { code: 'KWD', rate: 1 });
+    expect(small).toContain('0.005');
+    expect(small).not.toContain('<');
+    expect(formatCost(0.0005, { code: 'KWD', rate: 1 })).toContain('0.001');
+  });
+
+  it('falls back to rate 1 when rate is not a finite positive number', () => {
+    /** Partial admin override (code set before rate) must never render NaN. */
+    const eur = formatCost(10, { code: 'EUR', rate: undefined as unknown as number });
+    expect(eur).toContain('€');
+    expect(eur).toContain('10');
+    expect(eur).not.toContain('NaN');
+    expect(formatCost(10, { code: 'USD', rate: Number.NaN })).toBe('$10.00');
+  });
+});
+
+describe('groupToolTokens', () => {
+  it('classifies tools into system, mcp, skills, and subagent groups', () => {
+    const groups = groupToolTokens(
+      {
+        execute_code: 500,
+        web_search: 300,
+        skill: 200,
+        subagent: 150,
+        'search_mcp_Google-Workspace': 400,
+        fetch_mcp_Github: 250,
+      },
+      ['fetch_mcp_Github', 'web_search'],
+    );
+
+    expect(groups).toEqual({
+      system: 500,
+      mcp: 400,
+      skills: 200,
+      subagents: 150,
+      systemDeferred: 300,
+      mcpDeferred: 250,
+    });
+  });
+
+  it('returns empty groups without counts and skips zero entries', () => {
+    expect(groupToolTokens(undefined)).toBe(EMPTY_TOOL_GROUPS);
+    expect(groupToolTokens({ execute_code: 0 })).toEqual(EMPTY_TOOL_GROUPS);
+  });
+});
+
+describe('countTrailingOutputChars', () => {
+  const text = (value: string) => ({ type: 'text', text: value });
+  const think = (value: string) => ({ type: 'think', think: value });
+  const tool = () => ({ type: 'tool_call', tool_call: { id: 'tc' } });
+
+  it('counts the trailing run of text and think parts', () => {
+    expect(countTrailingOutputChars([text('aaaa'), tool(), think('bb'), text('ccc')])).toBe(5);
+  });
+
+  it('returns 0 when the latest part is a tool call (no in-flight output)', () => {
+    /** Once a tool call is emitted, its preceding text is folded into the next
+     *  snapshot's messageTokens — counting it here would double-count. */
+    expect(countTrailingOutputChars([text('aaaa'), tool(), text('ccc'), tool()])).toBe(0);
+  });
+
+  it('stops at the previous tool boundary', () => {
+    expect(countTrailingOutputChars([text('aaaa'), tool(), text('ccc')])).toBe(3);
+  });
+
+  it('handles empty and non-output content', () => {
+    expect(countTrailingOutputChars(undefined)).toBe(0);
+    expect(countTrailingOutputChars([])).toBe(0);
+    expect(countTrailingOutputChars([tool()])).toBe(0);
+  });
+});
+
+describe('per-message usage index (branch + total)', () => {
+  afterEach(() => {
+    clearIndex(CONVO);
+  });
+
+  it('reads metadata.usage onto entries and sums it along the branch', () => {
+    buildIndex(CONVO, [
+      msg('u1', Constants.NO_PARENT, true, 10),
+      responseMsg('a1', 'u1', 50, USAGE_A),
+      msg('u2', 'a1', true, 30),
+      responseMsg('a2', 'u2', 80, USAGE_B),
+    ]);
+
+    const { usage } = sumBranch(CONVO, 'a2');
+    expect(usage).toEqual({
+      input: 300,
+      output: 130,
+      cacheWrite: 0,
+      cacheRead: 0,
+      cost: 0.03,
+      costKnown: true,
+    });
+  });
+
+  it('reads persisted display units (incl. cache) directly', () => {
+    /** The backend already normalized per-event; the client reads as-is */
+    buildIndex(CONVO, [
+      msg('u1', Constants.NO_PARENT, true, 10),
+      responseMsg('a1', 'u1', 100, {
+        input: 600,
+        output: 100,
+        cacheWrite: 0,
+        cacheRead: 400,
+        cost: 0.03,
+      }),
+    ]);
+
+    const { usage } = sumBranch(CONVO, 'a1');
+    expect(usage).toEqual({
+      input: 600,
+      output: 100,
+      cacheWrite: 0,
+      cacheRead: 400,
+      cost: 0.03,
+      costKnown: true,
+    });
+  });
+
+  it('marks cost unknown when persisted usage omits cost (contextCost off)', () => {
+    buildIndex(CONVO, [
+      msg('u1', Constants.NO_PARENT, true, 10),
+      responseMsg('a1', 'u1', 50, { input: 100, output: 50, cacheWrite: 0, cacheRead: 0 }),
+    ]);
+    const { usage } = sumBranch(CONVO, 'a1');
+    expect(usage.costKnown).toBe(false);
+    expect(usage.cost).toBe(0);
+    expect(usage.input).toBe(100);
+  });
+
+  it('messages without metadata.usage contribute zero (backward compat)', () => {
+    buildIndex(CONVO, [msg('u1', Constants.NO_PARENT, true, 10), msg('a1', 'u1', false, 50)]);
+    expect(sumBranch(CONVO, 'a1').usage).toEqual(EMPTY_USAGE);
+    expect(sumTotalUsage(CONVO)).toEqual(EMPTY_USAGE);
+  });
+
+  it('preserves a prior entry usage when a rebuilt message lacks metadata.usage', () => {
+    /** Live finalize flushes usage into the index before persisted metadata
+     *  reaches the cache; a mid-session rebuild from a cache message without
+     *  metadata.usage must not wipe it (regenerate keeps the sibling's cost). */
+    buildIndex(CONVO, [msg('u1', Constants.NO_PARENT, true, 10), msg('a1', 'u1', false, 50)]);
+    setEntryUsage(CONVO, 'a1', {
+      input: 100,
+      output: 50,
+      cacheWrite: 0,
+      cacheRead: 0,
+      cost: 0.01,
+      costKnown: true,
+    });
+    /** Rebuild from the same cache (still no metadata.usage on a1) */
+    buildIndex(CONVO, [msg('u1', Constants.NO_PARENT, true, 10), msg('a1', 'u1', false, 50)]);
+    expect(sumBranch(CONVO, 'a1').usage.cost).toBeCloseTo(0.01);
+    expect(sumBranch(CONVO, 'a1').usage.input).toBe(100);
+  });
+
+  it('restores branch cost from sticky history after regenerate drops then re-adds a sibling', () => {
+    /** a1 generated live; its cache message never carries metadata.usage */
+    buildIndex(CONVO, [msg('u1', Constants.NO_PARENT, true, 10), msg('a1', 'u1', false, 50)]);
+    setEntryUsage(CONVO, 'a1', {
+      input: 100,
+      output: 50,
+      cacheWrite: 0,
+      cacheRead: 0,
+      cost: 0.01,
+      costKnown: true,
+    });
+
+    /** Regenerate streaming shows only the active branch — a1 is dropped */
+    buildIndex(CONVO, [msg('u1', Constants.NO_PARENT, true, 10), msg('a1-alt', 'u1', false, 60)]);
+    expect(sumBranch(CONVO, 'a1').usage).toEqual(EMPTY_USAGE);
+
+    /** Post-regenerate full rebuild re-adds a1 (still no metadata.usage) */
+    buildIndex(CONVO, [
+      msg('u1', Constants.NO_PARENT, true, 10),
+      msg('a1', 'u1', false, 50),
+      msg('a1-alt', 'u1', false, 60),
+    ]);
+
+    /** Switching back to branch A must still show its cost (the reported bug) */
+    expect(sumBranch(CONVO, 'a1').usage.cost).toBeCloseTo(0.01);
+    expect(sumBranch(CONVO, 'a1').usage.input).toBe(100);
+  });
+
+  it('scopes branch usage to the active thread while total spans all branches', () => {
+    /** Regenerate: a1 and a1-alt are sibling responses under the same user msg */
+    buildIndex(CONVO, [
+      msg('u1', Constants.NO_PARENT, true, 10),
+      responseMsg('a1', 'u1', 50, USAGE_A),
+      responseMsg('a1-alt', 'u1', 80, USAGE_B),
+    ]);
+
+    /** Viewing branch B (the regenerated response) */
+    expect(sumBranch(CONVO, 'a1-alt').usage.cost).toBeCloseTo(0.02);
+    /** Viewing branch A (the original) */
+    expect(sumBranch(CONVO, 'a1').usage.cost).toBeCloseTo(0.01);
+    /** Total spans both abandoned + active branches */
+    const total = sumTotalUsage(CONVO);
+    expect(total.cost).toBeCloseTo(0.03);
+    expect(total.input).toBe(300);
+    expect(total.output).toBe(130);
+  });
+
+  it('is idempotent across rebuilds', () => {
+    const messages = [
+      msg('u1', Constants.NO_PARENT, true, 10),
+      responseMsg('a1', 'u1', 50, USAGE_A),
+      responseMsg('a1-alt', 'u1', 80, USAGE_B),
+    ];
+    buildIndex(CONVO, messages);
+    const first = sumTotalUsage(CONVO);
+    buildIndex(CONVO, messages);
+    const second = sumTotalUsage(CONVO);
+    expect(second).toEqual(first);
+  });
+
+  it('flushes a live response usage via setEntryUsage (no metadata yet)', () => {
+    buildIndex(CONVO, [msg('u1', Constants.NO_PARENT, true, 10), msg('a1', 'u1', false, 50)]);
+    /** Live response entry has no metadata.usage until persisted; finalize flushes it */
+    expect(sumBranch(CONVO, 'a1').usage).toEqual(EMPTY_USAGE);
+    setEntryUsage(CONVO, 'a1', {
+      input: 100,
+      output: 50,
+      cacheWrite: 0,
+      cacheRead: 0,
+      cost: 0.01,
+      costKnown: true,
+    });
+    expect(sumBranch(CONVO, 'a1').usage.cost).toBeCloseTo(0.01);
+    expect(sumBranch(CONVO, 'a1').usage.input).toBe(100);
+  });
+
+  it('mergeUsage sums records and ANDs costKnown (incomplete coverage wins)', () => {
+    const a = { input: 1, output: 2, cacheWrite: 3, cacheRead: 4, cost: 0.5, costKnown: false };
+    const b = { input: 10, output: 20, cacheWrite: 30, cacheRead: 40, cost: 1.5, costKnown: true };
+    expect(mergeUsage(a, b)).toEqual({
+      input: 11,
+      output: 22,
+      cacheWrite: 33,
+      cacheRead: 44,
+      cost: 2,
+      costKnown: false,
+    });
+  });
+
+  it('marks branch cost incomplete when any usage-bearing entry lacks cost', () => {
+    /** A turn saved before cost display was on (no cost) alongside one with cost
+     *  → the summed cost under-reports, so coverage is incomplete. */
+    buildIndex(CONVO, [
+      msg('u1', Constants.NO_PARENT, true, 10),
+      responseMsg('a1', 'u1', 50, { input: 100, output: 50, cacheWrite: 0, cacheRead: 0 }),
+      responseMsg('a2', 'a1', 60, USAGE_B),
+    ]);
+    const { usage } = sumBranch(CONVO, 'a2');
+    expect(usage.costKnown).toBe(false);
+    /** Cost still sums what it can, but coverage is flagged incomplete */
+    expect(usage.cost).toBeCloseTo(0.02);
+    expect(sumTotalUsage(CONVO).costKnown).toBe(false);
+  });
+
+  it('EMPTY_BRANCH carries an empty usage record', () => {
+    expect(sumBranch('missing-convo', 'x')).toBe(EMPTY_BRANCH);
+    expect(EMPTY_BRANCH.usage).toEqual(EMPTY_USAGE);
+  });
+});
diff --git a/client/src/utils/tokens.ts b/client/src/utils/tokens.ts
new file mode 100644
index 00000000000..adbf65a0971
--- /dev/null
+++ b/client/src/utils/tokens.ts
@@ -0,0 +1,610 @@
+import { Tools, Constants, inputTokensIncludesCache } from 'librechat-data-provider';
+import type { TMessage, TResponseUsage, TTokenUsageEvent } from 'librechat-data-provider';
+
+/** Provider-reported usage of one response, in display units (post-normalize). */
+export interface BranchUsage {
+  input: number;
+  output: number;
+  cacheWrite: number;
+  cacheRead: number;
+  /** Authoritative USD cost; 0 when `interface.contextCost` was off at save */
+  cost: number;
+  /** Whether cost coverage is COMPLETE — every usage-bearing response summed
+   *  here carried a cost. Gates the cost row so a partial sum (some turns saved
+   *  before cost display was on) never renders an under-reported total. Starts
+   *  true (vacuous) and is ANDed; pair with `hasUsage` to require ≥1 entry. */
+  costKnown: boolean;
+}
+
+export const EMPTY_USAGE: BranchUsage = {
+  input: 0,
+  output: 0,
+  cacheWrite: 0,
+  cacheRead: 0,
+  cost: 0,
+  costKnown: true,
+};
+
+export interface TokenEntry {
+  tokenCount: number;
+  isCreatedByUser: boolean;
+  parentMessageId: string | null;
+  /** Per-response provider usage from `metadata.usage` (response messages only) */
+  usage?: BranchUsage;
+  /** Pre-invoke compacted context size (`metadata.summaryUsedTokens`) for a
+   *  response whose turn summarized. Caps the estimate so it stops re-summing
+   *  the now-discarded pre-summary history. */
+  summaryUsedTokens?: number;
+}
+
+export interface BranchTotals {
+  /** Sum of user-message token counts on the active branch */
+  input: number;
+  /** Sum of assistant-message token counts on the active branch */
+  output: number;
+  /** Messages on the branch with a known tokenCount */
+  counted: number;
+  /** Total messages on the branch */
+  total: number;
+  tailId: string | null;
+  /** Whether the latest run's anchor message is on this branch */
+  containsAnchor: boolean;
+  /** Provider usage/cost summed along the active branch */
+  usage: BranchUsage;
+  /** Compacted-context baseline from the deepest summarized response on the
+   *  branch (0 if none). The branch walk stops there, so `input`/`output` cover
+   *  only the post-summary messages; the estimate adds this to avoid counting
+   *  the discarded pre-summary history. */
+  summaryBaseline: number;
+}
+
+export const EMPTY_BRANCH: BranchTotals = {
+  input: 0,
+  output: 0,
+  counted: 0,
+  total: 0,
+  tailId: null,
+  containsAnchor: false,
+  usage: EMPTY_USAGE,
+  summaryBaseline: 0,
+};
+
+/** Module-level token index: conversationId → messageId → entry. Not render state. */
+const registry = new Map<string, Map<string, TokenEntry>>();
+
+/**
+ * Sticky per-response usage: conversationId → messageId → usage. Written only by
+ * the live finalize/stop flush (`setEntryUsage`) and never rebuilt from the
+ * messages cache, so a response's usage survives mid-session index rebuilds even
+ * when its cache message lacks `metadata.usage` AND it was transiently dropped
+ * from the cache (e.g. a sibling branch during a regenerate). `buildIndex`
+ * restores from here so branch cost persists across branch switches — the cost
+ * analog of `snapshotsByAnchorFamily` for the breakdown. Cleared on convo switch.
+ */
+const usageHistory = new Map<string, Map<string, BranchUsage>>();
+
+function stickyUsage(conversationId: string, messageId: string): BranchUsage | undefined {
+  return usageHistory.get(conversationId)?.get(messageId);
+}
+
+/** Reads the persisted per-response usage rollup off a message's metadata.
+ *  The backend already normalized per-event into display units, so this reads
+ *  them directly. Absent for user messages and pre-feature responses (they
+ *  contribute 0 to branch/total). */
+function readPersistedUsage(message: Partial<TMessage>): BranchUsage | undefined {
+  const usage = message.metadata?.usage;
+  if (usage == null || typeof usage !== 'object') {
+    return undefined;
+  }
+  const persisted = usage as TResponseUsage;
+  return {
+    input: persisted.input ?? 0,
+    output: persisted.output ?? 0,
+    cacheWrite: persisted.cacheWrite ?? 0,
+    cacheRead: persisted.cacheRead ?? 0,
+    cost: persisted.cost ?? 0,
+    /** Cost is omitted when saved with `contextCost` off — don't render $0.00 */
+    costKnown: typeof persisted.cost === 'number',
+  };
+}
+
+/** Pure sum of two usage records — for combining branch/total with pending. */
+export function mergeUsage(a: BranchUsage, b: BranchUsage): BranchUsage {
+  return {
+    input: a.input + b.input,
+    output: a.output + b.output,
+    cacheWrite: a.cacheWrite + b.cacheWrite,
+    cacheRead: a.cacheRead + b.cacheRead,
+    cost: a.cost + b.cost,
+    /** Coverage stays complete only if BOTH sides are complete */
+    costKnown: a.costKnown && b.costKnown,
+  };
+}
+
+/** Accumulates one entry's usage into a running total (in place). */
+function addUsage(target: BranchUsage, usage?: BranchUsage): void {
+  if (usage == null) {
+    return;
+  }
+  target.input += usage.input;
+  target.output += usage.output;
+  target.cacheWrite += usage.cacheWrite;
+  target.cacheRead += usage.cacheRead;
+  target.cost += usage.cost;
+  /** A usage-bearing entry without a cost breaks complete coverage */
+  if (!usage.costKnown) {
+    target.costKnown = false;
+  }
+}
+
+function toEntry(message: Partial<TMessage>): TokenEntry {
+  const summaryUsedTokens = message.metadata?.summaryUsedTokens;
+  return {
+    tokenCount: typeof message.tokenCount === 'number' ? message.tokenCount : 0,
+    isCreatedByUser: message.isCreatedByUser === true,
+    parentMessageId: message.parentMessageId ?? null,
+    usage: readPersistedUsage(message),
+    summaryUsedTokens:
+      typeof summaryUsedTokens === 'number' && summaryUsedTokens > 0
+        ? summaryUsedTokens
+        : undefined,
+  };
+}
+
+/** Full O(n) rebuild — only on discrete cache replacements (load, refetch, edits).
+ *  Restores a response's `usage` from the sticky history when the rebuilt message
+ *  carries none: per-message usage is immutable and the live finalize flushes it
+ *  into the index (`setEntryUsage`) before the persisted `metadata.usage` reaches
+ *  the cache, so a mid-session rebuild (e.g. during regenerate) must not wipe an
+ *  earlier branch's flushed usage — which would drop its branch cost on switch. */
+export function buildIndex(conversationId: string, messages?: TMessage[] | null): void {
+  const index = new Map<string, TokenEntry>();
+  if (messages != null) {
+    for (const message of messages) {
+      if (message?.messageId) {
+        const entry = toEntry(message);
+        if (entry.usage == null) {
+          entry.usage = stickyUsage(conversationId, message.messageId);
+        }
+        index.set(message.messageId, entry);
+      }
+    }
+  }
+  registry.set(conversationId, index);
+}
+
+/** Incremental upsert — final SSE events touch at most two entries */
+export function upsertEntries(
+  conversationId: string,
+  messages: (Partial<TMessage> | null | undefined)[],
+): void {
+  let index = registry.get(conversationId);
+  if (!index) {
+    index = new Map<string, TokenEntry>();
+    registry.set(conversationId, index);
+  }
+  for (const message of messages) {
+    if (message?.messageId) {
+      const entry = toEntry(message);
+      if (entry.usage == null) {
+        entry.usage = stickyUsage(conversationId, message.messageId);
+      }
+      index.set(message.messageId, entry);
+    }
+  }
+}
+
+/** Re-keys the index when `new` resolves to a real conversation id */
+export function migrateIndex(fromId: string, toId: string): void {
+  if (fromId === toId) {
+    return;
+  }
+  const index = registry.get(fromId);
+  if (index) {
+    registry.delete(fromId);
+    registry.set(toId, index);
+  }
+  const usage = usageHistory.get(fromId);
+  if (usage) {
+    usageHistory.delete(fromId);
+    usageHistory.set(toId, usage);
+  }
+}
+
+export function clearIndex(conversationId: string): void {
+  registry.delete(conversationId);
+  usageHistory.delete(conversationId);
+}
+
+export function hasIndex(conversationId: string): boolean {
+  return registry.has(conversationId);
+}
+
+/** O(depth) walk from the branch tail up the parent chain */
+export function sumBranch(
+  conversationId: string,
+  tailId: string | null | undefined,
+  anchorId?: string | null,
+): BranchTotals {
+  const index = registry.get(conversationId);
+  if (!index || !tailId) {
+    return EMPTY_BRANCH;
+  }
+
+  const totals = { input: 0, output: 0, counted: 0, total: 0, containsAnchor: false };
+  const usage: BranchUsage = { ...EMPTY_USAGE };
+  let summaryBaseline = 0;
+  /** Once a summary marker is crossed, older turns are out of the CONTEXT WINDOW
+   *  (subsumed by the baseline) — but their provider spend still happened, so the
+   *  usage/cost walk continues to the root while context counting stops. */
+  let contextCapped = false;
+  let currentId: string | null = tailId;
+  let guard = index.size;
+
+  while (currentId && currentId !== Constants.NO_PARENT && guard-- > 0) {
+    const entry: TokenEntry | undefined = index.get(currentId);
+    if (!entry) {
+      break;
+    }
+    totals.total += 1;
+    /** Only match the anchor while still inside the active context window. An
+     *  anchor OLDER than the deepest summary marker belongs to a pre-summary
+     *  snapshot; treating it as on-branch would let `useTokenUsage` revive that
+     *  stale breakdown (discarded history) over the summary-baseline estimate
+     *  that `findBranchSnapshotAnchor` correctly refuses to recover. */
+    if (!contextCapped && anchorId != null && currentId === anchorId) {
+      totals.containsAnchor = true;
+    }
+    if (!contextCapped && entry.tokenCount > 0) {
+      totals.counted += 1;
+      if (entry.isCreatedByUser) {
+        totals.input += entry.tokenCount;
+      } else {
+        totals.output += entry.tokenCount;
+      }
+    }
+    /** Cost/usage is cumulative spend — never truncated at the summary boundary. */
+    addUsage(usage, entry.usage);
+    /** This response's turn compacted the history: its own output is counted
+     *  above; record the pre-invoke compacted baseline and stop counting context
+     *  tokens for older (summarized-away) turns, but keep walking for cost. */
+    if (!contextCapped && entry.summaryUsedTokens != null) {
+      summaryBaseline = entry.summaryUsedTokens;
+      contextCapped = true;
+    }
+    currentId = entry.parentMessageId;
+  }
+
+  return { ...totals, tailId, usage, summaryBaseline };
+}
+
+/**
+ * Sums provider usage/cost across EVERY message in the conversation (all
+ * branches, including regenerated/abandoned responses) — the conversation
+ * total, shown alongside the branch figure when they differ.
+ */
+export function sumTotalUsage(conversationId: string): BranchUsage {
+  const usage: BranchUsage = { ...EMPTY_USAGE };
+  const index = registry.get(conversationId);
+  if (!index) {
+    return usage;
+  }
+  for (const entry of index.values()) {
+    addUsage(usage, entry.usage);
+  }
+  return usage;
+}
+
+/**
+ * Attaches a response's usage to its index entry AND the sticky usage history.
+ * Used by the live finalize/stop flush. The history copy lets `buildIndex`
+ * restore the usage after a rebuild (the persisted `metadata.usage` reaches
+ * `buildIndex` on reload; the sticky copy covers the in-session window before
+ * that, including a sibling transiently dropped from the cache on regenerate).
+ */
+export function setEntryUsage(conversationId: string, messageId: string, usage: BranchUsage): void {
+  /** Remember it durably first so a later rebuild — or a transient cache drop
+   *  during regenerate — can restore it even when the entry isn't present yet. */
+  let history = usageHistory.get(conversationId);
+  if (!history) {
+    history = new Map<string, BranchUsage>();
+    usageHistory.set(conversationId, history);
+  }
+  history.set(messageId, usage);
+  const entry = registry.get(conversationId)?.get(messageId);
+  if (entry) {
+    entry.usage = usage;
+  }
+}
+
+/**
+ * Walks the branch tail up the parent chain and returns the first message id
+ * present in `anchors` — i.e. the deepest (most recent) stored snapshot anchor
+ * on the viewed branch. Used to recover a branch's granular breakdown after a
+ * later generation on a sibling branch overwrote the live snapshot.
+ */
+export function findBranchSnapshotAnchor(
+  conversationId: string,
+  tailId: string | null | undefined,
+  anchors: ReadonlyMap<string, unknown>,
+): string | null {
+  const index = registry.get(conversationId);
+  if (!index || !tailId || anchors.size === 0) {
+    return null;
+  }
+
+  let currentId: string | null = tailId;
+  let guard = index.size;
+
+  while (currentId && currentId !== Constants.NO_PARENT && guard-- > 0) {
+    if (anchors.has(currentId)) {
+      return currentId;
+    }
+    const entry: TokenEntry | undefined = index.get(currentId);
+    if (!entry) {
+      break;
+    }
+    /** Stop at a summarized response that has no snapshot of its own: crossing it
+     *  would recover an older PRE-summary snapshot (discarded history), which the
+     *  summary-baseline estimate is meant to replace. */
+    if (entry.summaryUsedTokens != null) {
+      return null;
+    }
+    currentId = entry.parentMessageId;
+  }
+
+  return null;
+}
+
+export interface ToolTokenGroups {
+  system: number;
+  mcp: number;
+  skills: number;
+  subagents: number;
+  systemDeferred: number;
+  mcpDeferred: number;
+}
+
+export const EMPTY_TOOL_GROUPS: ToolTokenGroups = {
+  system: 0,
+  mcp: 0,
+  skills: 0,
+  subagents: 0,
+  systemDeferred: 0,
+  mcpDeferred: 0,
+};
+
+/**
+ * Classifies per-tool schema tokens into display groups: built-in system
+ * tools, MCP tools, skills, and subagents — with deferred (on-demand) tools
+ * split out for the system/MCP groups.
+ */
+export function groupToolTokens(
+  toolTokenCounts?: Record<string, number>,
+  deferredToolNames?: string[],
+): ToolTokenGroups {
+  if (toolTokenCounts == null) {
+    return EMPTY_TOOL_GROUPS;
+  }
+  const deferred = new Set(deferredToolNames ?? []);
+  const groups = { ...EMPTY_TOOL_GROUPS };
+  for (const [name, tokens] of Object.entries(toolTokenCounts)) {
+    if (tokens <= 0) {
+      continue;
+    }
+    if (name === Tools.skill) {
+      groups.skills += tokens;
+    } else if (name === Constants.SUBAGENT) {
+      groups.subagents += tokens;
+    } else if (name.includes(Constants.mcp_delimiter)) {
+      if (deferred.has(name)) {
+        groups.mcpDeferred += tokens;
+      } else {
+        groups.mcp += tokens;
+      }
+    } else if (deferred.has(name)) {
+      groups.systemDeferred += tokens;
+    } else {
+      groups.system += tokens;
+    }
+  }
+  return groups;
+}
+
+function getOutputChars(part: unknown): number | null {
+  if (part == null || typeof part !== 'object') {
+    return null;
+  }
+  const { text, think } = part as { text?: unknown; think?: unknown };
+  if (typeof text === 'string') {
+    return text.length;
+  }
+  if (typeof think === 'string') {
+    return think.length;
+  }
+  return null;
+}
+
+/**
+ * Chars of the contiguous text/think parts at the very END of aggregated
+ * content — the output the model is actively producing on the current call,
+ * which the latest pre-invoke context snapshot does not yet account for.
+ *
+ * Crucially this does NOT skip a trailing tool-call part: once the model has
+ * emitted a tool call, that call's text is already folded into the next
+ * snapshot's `messageTokens`, so counting it would double-count against the
+ * snapshot. A tool call at the end therefore yields 0 (nothing new in flight).
+ */
+export function countTrailingOutputChars(content?: unknown[] | null): number {
+  if (!Array.isArray(content) || content.length === 0) {
+    return 0;
+  }
+  let chars = 0;
+  for (let i = content.length - 1; i >= 0; i--) {
+    const partChars = getOutputChars(content[i]);
+    if (partChars == null) {
+      break;
+    }
+    chars += partChars;
+  }
+  return chars;
+}
+
+/** Rough live estimate for streaming text, calibrated by the last known provider ratio */
+export function estimateTokens(charCount: number, calibrationRatio = 1): number {
+  if (charCount <= 0) {
+    return 0;
+  }
+  const ratio = calibrationRatio > 0 ? calibrationRatio : 1;
+  return Math.round((charCount / 4) * ratio);
+}
+
+/** Billable token quantities of one or more model calls, normalized for pricing */
+export interface CostUnits {
+  input: number;
+  output: number;
+  cacheWrite: number;
+  cacheRead: number;
+}
+
+/**
+ * Normalizes one call's usage into billable units, mirroring the backend's
+ * authoritative `splitUsage`/`resolveCompletionTokens`
+ * (packages/api/src/agents/usage.ts):
+ *   - cache classification is by provider, not magnitude — Anthropic/Bedrock
+ *     keep cache additive (input is uncached-only); subset providers fold
+ *     cache into `input_tokens`. Falls back to a magnitude heuristic only when
+ *     the provider is unknown.
+ *   - completion is repaired for providers (e.g. Vertex) that under-report
+ *     `output_tokens` but carry the gap in `total_tokens`.
+ * Applied per event so units stay correct when summed across calls.
+ */
+export function normalizeUsageUnits(usage: TTokenUsageEvent): CostUnits {
+  const rawInput = usage.input_tokens ?? 0;
+  const rawOutput = usage.output_tokens ?? 0;
+  const total = usage.total_tokens ?? 0;
+  const cacheWrite = usage.input_token_details?.cache_creation ?? 0;
+  const cacheRead = usage.input_token_details?.cache_read ?? 0;
+
+  const includesCache =
+    usage.provider != null
+      ? inputTokensIncludesCache(usage.provider)
+      : cacheWrite + cacheRead <= rawInput;
+
+  const cacheAdjustment = includesCache ? 0 : cacheRead + cacheWrite;
+  const output =
+    total > rawInput + rawOutput + cacheAdjustment ? total - rawInput - cacheAdjustment : rawOutput;
+
+  return {
+    input: includesCache ? Math.max(0, rawInput - cacheRead - cacheWrite) : rawInput,
+    output,
+    cacheWrite,
+    cacheRead,
+  };
+}
+
+export function formatTokens(count: number): string {
+  const formatted = new Intl.NumberFormat(undefined, {
+    notation: 'compact',
+    maximumFractionDigits: 1,
+  }).format(count);
+  return formatted.replace(/\.0(?=[A-Za-z]|$)/, '');
+}
+
+/** Display currency for the context cost. `rate` is a static USD→local
+ *  multiplier (no live FX); `code` is an ISO-4217 currency for Intl formatting. */
+export interface CurrencyConfig {
+  code: string;
+  rate: number;
+}
+
+const DEFAULT_CURRENCY: CurrencyConfig = { code: 'USD', rate: 1 };
+const currencyFormatters = new Map<string, Intl.NumberFormat>();
+const currencyDigits = new Map<string, number>();
+let supportedCurrencies: Set<string> | null | undefined;
+
+/** True only for codes recognized as ISO-4217. `Intl.NumberFormat` accepts any
+ *  well-formed three-letter code (e.g. `EUU`, `RMB`) without throwing, so the
+ *  ISO-4217 set is the real guard against typo'd / non-ISO codes. */
+function isSupportedCurrency(code: unknown): code is string {
+  if (typeof code !== 'string' || code.length === 0) {
+    return false;
+  }
+  const upper = code.toUpperCase();
+  if (supportedCurrencies === undefined) {
+    const supportedValuesOf = (
+      Intl as typeof Intl & { supportedValuesOf?: (key: string) => string[] }
+    ).supportedValuesOf;
+    supportedCurrencies =
+      typeof supportedValuesOf === 'function' ? new Set(supportedValuesOf('currency')) : null;
+  }
+  if (supportedCurrencies != null) {
+    return supportedCurrencies.has(upper);
+  }
+  /** Older runtime without `supportedValuesOf`: accept any code Intl can build. */
+  try {
+    new Intl.NumberFormat(undefined, { style: 'currency', currency: upper });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/** Default fraction digits for a validated currency: USD→2, JPY→0, KWD→3. */
+function maxFractionDigits(code: string): number {
+  const cached = currencyDigits.get(code);
+  if (cached !== undefined) {
+    return cached;
+  }
+  const digits =
+    new Intl.NumberFormat(undefined, { style: 'currency', currency: code }).resolvedOptions()
+      .maximumFractionDigits ?? 2;
+  currencyDigits.set(code, digits);
+  return digits;
+}
+
+function currencyFormatter(code: string, minDigits: number, maxDigits: number): Intl.NumberFormat {
+  const key = `${code}:${minDigits}:${maxDigits}`;
+  let formatter = currencyFormatters.get(key);
+  if (formatter == null) {
+    formatter = new Intl.NumberFormat(undefined, {
+      style: 'currency',
+      currency: code,
+      minimumFractionDigits: minDigits,
+      maximumFractionDigits: maxDigits,
+    });
+    currencyFormatters.set(key, formatter);
+  }
+  return formatter;
+}
+
+export function formatCost(usd: number, currency: CurrencyConfig = DEFAULT_CURRENCY): string {
+  /** Resolve to a safe (code, rate): an unsupported code falls back to USD AND
+   *  rate 1 — never present a converted amount under the wrong symbol. A
+   *  non-finite/negative rate (e.g. a partial admin override that set `code`
+   *  before `rate`) falls back to 1 so a cost never renders as `NaN`. */
+  let code = DEFAULT_CURRENCY.code;
+  let rate = 1;
+  if (isSupportedCurrency(currency?.code)) {
+    code = currency.code.toUpperCase();
+    rate = Number.isFinite(currency?.rate) && (currency.rate as number) > 0 ? currency.rate : 1;
+  }
+  const base = maxFractionDigits(code);
+
+  const amount = usd * rate;
+  /** The currency's own minor unit — USD/EUR→0.01, JPY→1, KWD→0.001. */
+  const smallest = Math.pow(10, -base);
+
+  if (amount <= 0) {
+    return currencyFormatter(code, base, base).format(0);
+  }
+  if (amount < smallest) {
+    return `<${currencyFormatter(code, base, base).format(smallest)}`;
+  }
+  if (amount < 1 && base > 0) {
+    /** Extra precision for sub-unit costs; trailing zeros trim to the currency's
+     *  own scale (min = base). */
+    return currencyFormatter(code, base, base + 2).format(amount);
+  }
+  return currencyFormatter(code, base, base).format(amount);
+}
diff --git a/client/sw/heal.js b/client/sw/heal.js
new file mode 100644
index 00000000000..40c79368a39
--- /dev/null
+++ b/client/sw/heal.js
@@ -0,0 +1,60 @@
+/* Runs inside the generated service worker via workbox `importScripts`.
+ * When a new build's worker activates, pages served from a previous build
+ * can no longer load their hashed chunks (the old precache is purged) and
+ * carry no recovery code of their own — the worker is the only code path
+ * stale clients fetch fresh. Ping every window client; reload the ones
+ * that cannot answer. */
+const PING_TYPE = 'LC_SW_PING';
+const PONG_TYPE = 'LC_SW_PONG';
+const PONG_TIMEOUT_MS = 1500;
+
+const pendingPongs = new Map();
+
+self.addEventListener('message', (event) => {
+  if (!event.data || event.data.type !== PONG_TYPE || !event.source) {
+    return;
+  }
+  const resolvePong = pendingPongs.get(event.source.id);
+  if (resolvePong) {
+    pendingPongs.delete(event.source.id);
+    resolvePong(true);
+  }
+});
+
+function pingClient(client) {
+  return new Promise((resolve) => {
+    pendingPongs.set(client.id, resolve);
+    setTimeout(() => {
+      if (pendingPongs.delete(client.id)) {
+        resolve(false);
+      }
+    }, PONG_TIMEOUT_MS);
+    client.postMessage({ type: PING_TYPE });
+  });
+}
+
+async function reloadUnresponsiveClients() {
+  await self.clients.claim();
+  const windowClients = await self.clients.matchAll({
+    type: 'window',
+    includeUncontrolled: true,
+  });
+  const topLevelClients = windowClients.filter((client) => client.frameType !== 'nested');
+  await Promise.all(
+    topLevelClients.map(async (client) => {
+      const responsive = await pingClient(client);
+      if (responsive) {
+        return;
+      }
+      try {
+        await client.navigate(client.url);
+      } catch {
+        /* client closed or no longer controllable */
+      }
+    }),
+  );
+}
+
+self.addEventListener('activate', (event) => {
+  event.waitUntil(reloadUnresponsiveClients());
+});
diff --git a/client/tsconfig.json b/client/tsconfig.json
index fcf799dd1d5..582ce560c18 100644
--- a/client/tsconfig.json
+++ b/client/tsconfig.json
@@ -28,10 +28,8 @@
   "include": [
     "src/**/*",
     "test/**/*",
-    "../e2e/**/*",
     "test/setupTests.js",
     "env.d.ts",
-    "../config/translations/**/*.ts",
     "../packages/client/src/hooks/useDelayedRender.tsx",
     "../packages/client/src/components/InfoHoverCard.tsx"
   ]
diff --git a/client/vite.config.ts b/client/vite.config.ts
index 11c2cc1b02b..bf6fb53ff3e 100644
--- a/client/vite.config.ts
+++ b/client/vite.config.ts
@@ -1,4 +1,5 @@
 import react from '@vitejs/plugin-react';
+import fs from 'fs';
 import path from 'path';
 import { defineConfig } from 'vite';
 import { createRequire } from 'module';
@@ -34,6 +35,13 @@ const backendURL = process.env.HOST
   ? `http://${process.env.HOST}:${backendPort}`
   : `http://localhost:${backendPort}`;
 const buildSourceMap = process.env.NODE_ENV === 'development';
+const QUERY_DEVTOOLS_CHUNK_MODULES = [
+  '@tanstack/react-query-devtools',
+  '@tanstack/match-sorter-utils',
+  'node_modules/superjson',
+  'node_modules/copy-anything',
+  'node_modules/is-what',
+];
 
 export default defineConfig(({ command }) => ({
   base: '',
@@ -66,6 +74,17 @@ export default defineConfig(({ command }) => ({
       },
     },
     nodePolyfills(),
+    {
+      name: 'emit-sw-heal',
+      apply: 'build',
+      generateBundle() {
+        this.emitFile({
+          type: 'asset',
+          fileName: 'sw-heal.js',
+          source: fs.readFileSync(path.resolve(__dirname, 'sw/heal.js'), 'utf8'),
+        });
+      },
+    },
     VitePWA({
       injectRegister: 'auto', // 'auto' | 'manual' | 'disabled'
       registerType: 'autoUpdate', // 'prompt' | 'autoUpdate'
@@ -83,10 +102,38 @@ export default defineConfig(({ command }) => ({
           'assets/maskable-icon.png',
           'manifest.webmanifest',
         ],
-        globIgnores: ['images/**/*', '**/*.map', 'index.html', 'assets/rum.*.js'],
+        globIgnores: [
+          'images/**/*',
+          '**/*.map',
+          'index.html',
+          'sw-heal.js',
+          'assets/rum.*.js',
+          'assets/locale-*.js',
+          'assets/query-devtools*.js',
+        ],
         maximumFileSizeToCacheInBytes: 4 * 1024 * 1024,
         /** LibreChat mutates index.html per request for subpath and language support. */
         navigateFallback: null,
+        /** Reloads window clients that cannot answer a ping after activation —
+         * pages stuck on a previous build's purged precache (stale index.html)
+         * have no working code of their own to recover with. */
+        importScripts: ['sw-heal.js'],
+        runtimeCaching: [
+          {
+            urlPattern: ({ url }) => /\/assets\/locale-[^/]+\.js$/.test(url.pathname),
+            handler: 'StaleWhileRevalidate',
+            options: {
+              cacheName: 'locale-chunks',
+              cacheableResponse: {
+                statuses: [0, 200],
+              },
+              expiration: {
+                maxEntries: 80,
+                maxAgeSeconds: 30 * 24 * 60 * 60,
+              },
+            },
+          },
+        ],
       },
       includeAssets: [],
       manifest: {
@@ -289,6 +336,13 @@ export default defineConfig(({ command }) => ({
                   if (normalizedId.includes('node_modules/hast-util-raw')) {
                     return 'markdown_large';
                   }
+                  if (
+                    QUERY_DEVTOOLS_CHUNK_MODULES.some((moduleName) =>
+                      normalizedId.includes(moduleName),
+                    )
+                  ) {
+                    return 'query-devtools';
+                  }
                   if (normalizedId.includes('@tanstack')) {
                     return 'tanstack-vendor';
                   }
@@ -306,9 +360,12 @@ export default defineConfig(({ command }) => ({
                 if (normalizedId.includes('/src/polyfills/')) {
                   return 'polyfills';
                 }
-                // Create a separate chunk for all locale files under src/locales.
-                if (normalizedId.includes('/src/locales/')) {
-                  return 'locales';
+                // Keep lazy-loaded locale files in one chunk per locale.
+                const localeMatch = normalizedId.match(
+                  /\/src\/locales\/([^/]+)\/translation\.json$/,
+                );
+                if (localeMatch) {
+                  return localeMatch[1] === 'en' ? null : `locale-${localeMatch[1]}`;
                 }
                 // Let Rolldown decide automatically for any other files.
                 return null;
diff --git a/config/__tests__/migrate-shared-link-permissions.spec.js b/config/__tests__/migrate-shared-link-permissions.spec.js
new file mode 100644
index 00000000000..246d5e7e975
--- /dev/null
+++ b/config/__tests__/migrate-shared-link-permissions.spec.js
@@ -0,0 +1,218 @@
+jest.mock('../connect', () => jest.fn().mockResolvedValue(true));
+jest.mock('@librechat/api', () => ({
+  ensureRequiredCollectionsExist: jest.fn().mockResolvedValue(undefined),
+  matchModelName: jest.fn(),
+  findMatchingPattern: jest.fn(),
+}));
+jest.mock('@librechat/data-schemas', () => ({
+  ...jest.requireActual('@librechat/data-schemas'),
+  logger: { error: jest.fn(), info: jest.fn(), warn: jest.fn(), debug: jest.fn() },
+}));
+jest.mock('~/cache/getLogStores', () => jest.fn());
+
+const mongoose = require('mongoose');
+const { MongoMemoryServer } = require('mongodb-memory-server');
+const { createMethods, SYSTEM_TENANT_ID, tenantStorage } = require('@librechat/data-schemas');
+
+describe('migrate-shared-link-permissions', () => {
+  let mongoServer;
+  let SharedLink, AclEntry;
+  let migrateSharedLinkPermissions;
+  const testUserId = new mongoose.Types.ObjectId();
+
+  beforeAll(async () => {
+    mongoServer = await MongoMemoryServer.create();
+    await mongoose.connect(mongoServer.getUri());
+
+    const migration = require('../migrate-shared-link-permissions');
+    migrateSharedLinkPermissions = migration.migrateSharedLinkPermissions;
+
+    SharedLink = mongoose.models.SharedLink;
+    AclEntry = mongoose.models.AclEntry;
+
+    await createMethods(mongoose).seedDefaultRoles();
+  });
+
+  afterAll(async () => {
+    await mongoose.disconnect();
+    await mongoServer.stop();
+  });
+
+  beforeEach(async () => {
+    await AclEntry.deleteMany({});
+    await SharedLink.deleteMany({});
+    jest.restoreAllMocks();
+  });
+
+  async function createLegacyLink(isPublic = true, user = testUserId, overrides = {}) {
+    const link = await SharedLink.create({
+      shareId: `share-${Date.now()}-${Math.random()}`,
+      conversationId: 'convo1',
+      messages: [],
+      ...(user != null ? { user } : {}),
+      ...overrides,
+    });
+    await mongoose.connection.db
+      .collection('sharedlinks')
+      .updateOne({ _id: link._id }, { $set: { isPublic } });
+    return link;
+  }
+
+  test('removes isPublic from all links on success', async () => {
+    const link1 = await createLegacyLink(true);
+    const link2 = await createLegacyLink(true);
+
+    const result = await migrateSharedLinkPermissions({ dryRun: false, batchSize: 100 });
+
+    expect(result.errors).toBe(0);
+    expect(result.failedLinkCount).toBe(0);
+
+    const raw1 = await mongoose.connection.db.collection('sharedlinks').findOne({ _id: link1._id });
+    const raw2 = await mongoose.connection.db.collection('sharedlinks').findOne({ _id: link2._id });
+    expect(raw1).not.toHaveProperty('isPublic');
+    expect(raw2).not.toHaveProperty('isPublic');
+  });
+
+  test('preserves isPublic on links with partial write errors', async () => {
+    const link1 = await createLegacyLink(true);
+    const link2 = await createLegacyLink(true);
+    const link3 = await createLegacyLink(true);
+
+    const originalBulkWrite = AclEntry.bulkWrite.bind(AclEntry);
+    jest.spyOn(AclEntry, 'bulkWrite').mockImplementationOnce(async (ops, options) => {
+      const failedIndices = [];
+      const successOps = [];
+
+      for (let i = 0; i < ops.length; i++) {
+        if (ops[i].updateOne.filter.resourceId.equals(link2._id)) {
+          failedIndices.push(i);
+        } else {
+          successOps.push(ops[i]);
+        }
+      }
+
+      if (successOps.length > 0) {
+        await originalBulkWrite(successOps, options);
+      }
+
+      const error = new Error('Partial bulk write failure');
+      error.writeErrors = failedIndices.map((idx) => ({
+        index: idx,
+        errmsg: 'Simulated write error',
+      }));
+      throw error;
+    });
+
+    const result = await migrateSharedLinkPermissions({ dryRun: false, batchSize: 100 });
+
+    expect(result.failedLinkCount).toBe(1);
+    expect(result.errors).toBeGreaterThan(0);
+
+    const raw1 = await mongoose.connection.db.collection('sharedlinks').findOne({ _id: link1._id });
+    const raw2 = await mongoose.connection.db.collection('sharedlinks').findOne({ _id: link2._id });
+    const raw3 = await mongoose.connection.db.collection('sharedlinks').findOne({ _id: link3._id });
+
+    expect(raw2).toHaveProperty('isPublic', true);
+    expect(raw1).not.toHaveProperty('isPublic');
+    expect(raw3).not.toHaveProperty('isPublic');
+  });
+
+  test('preserves isPublic on all batch links when bulk write fails entirely', async () => {
+    const link1 = await createLegacyLink(true);
+    const link2 = await createLegacyLink(true);
+
+    jest.spyOn(AclEntry, 'bulkWrite').mockRejectedValueOnce(new Error('Connection lost'));
+
+    const result = await migrateSharedLinkPermissions({ dryRun: false, batchSize: 100 });
+
+    expect(result.failedLinkCount).toBe(2);
+
+    const raw1 = await mongoose.connection.db.collection('sharedlinks').findOne({ _id: link1._id });
+    const raw2 = await mongoose.connection.db.collection('sharedlinks').findOne({ _id: link2._id });
+
+    expect(raw1).toHaveProperty('isPublic', true);
+    expect(raw2).toHaveProperty('isPublic', true);
+  });
+
+  test('does not grant PUBLIC VIEWER to isPublic false links when forced', async () => {
+    const link = await createLegacyLink(false);
+
+    const result = await migrateSharedLinkPermissions({ dryRun: false, force: true });
+
+    expect(result.aborted).toBeUndefined();
+    expect(result.publicViewerSkipped).toBe(1);
+
+    const publicEntry = await AclEntry.findOne({
+      resourceId: link._id,
+      principalType: 'public',
+    }).lean();
+    expect(publicEntry).toBeNull();
+
+    const ownerEntry = await AclEntry.findOne({
+      resourceId: link._id,
+      principalType: 'user',
+    }).lean();
+    expect(ownerEntry).toBeDefined();
+  });
+
+  test('reports private legacy links during dry run without aborting', async () => {
+    await createLegacyLink(false);
+
+    const result = await migrateSharedLinkPermissions({ dryRun: true });
+
+    expect(result.aborted).toBeUndefined();
+    expect(result.dryRun).toBe(true);
+    expect(result.summary.withIsPublicFalse).toBe(1);
+  });
+
+  test('grants PUBLIC VIEWER to ownerless public legacy links', async () => {
+    const link = await createLegacyLink(true, null);
+
+    const result = await migrateSharedLinkPermissions({ dryRun: false });
+
+    expect(result.missingUserWarnings).toBe(1);
+
+    const publicEntry = await AclEntry.findOne({
+      resourceId: link._id,
+      principalType: 'public',
+    }).lean();
+    expect(publicEntry).toBeDefined();
+    expect(publicEntry).not.toHaveProperty('grantedBy');
+
+    const ownerEntry = await AclEntry.findOne({
+      resourceId: link._id,
+      principalType: 'user',
+    }).lean();
+    expect(ownerEntry).toBeNull();
+  });
+
+  test('copies shared link expiration to migrated ACL entries', async () => {
+    const expiredAt = new Date(Date.now() + 60 * 60 * 1000);
+    const link = await createLegacyLink(true, testUserId, { expiredAt });
+
+    await migrateSharedLinkPermissions({ dryRun: false });
+
+    const entries = await AclEntry.find({ resourceId: link._id }).lean();
+    expect(entries).toHaveLength(2);
+    for (const entry of entries) {
+      expect(entry.expiredAt?.toISOString()).toBe(expiredAt.toISOString());
+    }
+  });
+
+  test('runs the migration body inside a system tenant context', async () => {
+    await createLegacyLink(true);
+    const contextsObserved = [];
+    const originalCountDocuments = SharedLink.countDocuments.bind(SharedLink);
+    SharedLink.countDocuments = jest.fn((...args) => {
+      contextsObserved.push(tenantStorage.getStore()?.tenantId);
+      return originalCountDocuments(...args);
+    });
+
+    try {
+      await migrateSharedLinkPermissions({ dryRun: true });
+      expect(contextsObserved).toContain(SYSTEM_TENANT_ID);
+    } finally {
+      SharedLink.countDocuments = originalCountDocuments;
+    }
+  });
+});
diff --git a/config/jest.config.js b/config/jest.config.js
new file mode 100644
index 00000000000..f3bccbb890f
--- /dev/null
+++ b/config/jest.config.js
@@ -0,0 +1,18 @@
+const path = require('path');
+const apiConfig = require('../api/jest.config');
+
+const apiDir = path.resolve(__dirname, '..', 'api');
+
+const resolvedMapper = Object.fromEntries(
+  Object.entries(apiConfig.moduleNameMapper).map(([key, value]) => [
+    key,
+    value.replace('<rootDir>', apiDir),
+  ]),
+);
+
+module.exports = {
+  ...apiConfig,
+  roots: ['<rootDir>'],
+  setupFiles: apiConfig.setupFiles.map((f) => path.resolve(apiDir, f)),
+  moduleNameMapper: resolvedMapper,
+};
diff --git a/config/migrate-shared-link-permissions.js b/config/migrate-shared-link-permissions.js
new file mode 100644
index 00000000000..f106cd46046
--- /dev/null
+++ b/config/migrate-shared-link-permissions.js
@@ -0,0 +1,357 @@
+const path = require('path');
+const { logger, runAsSystem } = require('@librechat/data-schemas');
+const { ensureRequiredCollectionsExist } = require('@librechat/api');
+
+require('module-alias')({ base: path.resolve(__dirname, '..', 'api') });
+const connect = require('./connect');
+
+const { findRoleByIdentifier } = require('~/models');
+const { SharedLink, AclEntry } = require('~/db/models');
+
+/**
+ * String literals matching `librechat-data-provider` enums so this script
+ * runs standalone without requiring a built data-provider package.
+ */
+const RESOURCE_TYPE_SHARED_LINK = 'sharedLink';
+const ROLE_ID_OWNER = 'sharedLink_owner';
+const ROLE_ID_VIEWER = 'sharedLink_viewer';
+const PRINCIPAL_USER = 'user';
+const PRINCIPAL_PUBLIC = 'public';
+
+async function migrateSharedLinkPermissions({
+  dryRun = true,
+  batchSize = 100,
+  force = false,
+} = {}) {
+  await connect();
+
+  return runAsSystem(async () => {
+    logger.info('Starting SharedLink Permissions Migration', { dryRun, batchSize, force });
+
+    const mongoose = require('mongoose');
+    /** @type {import('mongoose').mongo.Db | undefined} */
+    const db = mongoose.connection.db;
+    if (db) {
+      await ensureRequiredCollectionsExist(db);
+    }
+
+    const ownerRole = await findRoleByIdentifier(ROLE_ID_OWNER);
+    const viewerRole = await findRoleByIdentifier(ROLE_ID_VIEWER);
+
+    if (!ownerRole || !viewerRole) {
+      throw new Error(
+        'Required sharedLink roles not found (sharedLink_owner, sharedLink_viewer). Run role seeding first.',
+      );
+    }
+
+    logger.info('Roles resolved', {
+      owner: { id: ownerRole._id, permBits: ownerRole.permBits },
+      viewer: { id: viewerRole._id, permBits: viewerRole.permBits },
+    });
+
+    // --- Safety check: abort if isPublic: false documents exist (unless --force) ---
+    // Raw driver bypasses mongoose strictQuery: true, which silently strips query
+    // keys absent from the schema. isPublic was removed from the schema by this
+    // migration, so Mongoose queries like { isPublic: false } become {} (match all).
+    const rawCollection = mongoose.connection.db.collection('sharedlinks');
+    const isPublicFalseCount = await rawCollection.countDocuments({ isPublic: false });
+    if (!dryRun && isPublicFalseCount > 0 && !force) {
+      const sample = await rawCollection
+        .find({ isPublic: false })
+        .project({ _id: 1, shareId: 1, user: 1 })
+        .limit(20)
+        .toArray();
+
+      const sampleIds = sample.map((doc) => doc._id.toString());
+      logger.error(
+        `Found ${isPublicFalseCount} SharedLink documents with isPublic: false. ` +
+          'These may have been intentionally marked non-public. ' +
+          'Use --force to proceed anyway (they will NOT receive a PUBLIC VIEWER grant).',
+        { sampleIds },
+      );
+      return {
+        aborted: true,
+        reason: 'isPublic: false documents found',
+        isPublicFalseCount,
+        sampleIds,
+      };
+    }
+
+    // --- Count totals for progress reporting ---
+    const totalLinks = await SharedLink.countDocuments({});
+    logger.info(`Found ${totalLinks} SharedLink documents total`);
+
+    if (totalLinks === 0) {
+      logger.info('No SharedLink documents to migrate');
+      return { migrated: 0, errors: 0, skipped: 0, dryRun };
+    }
+
+    // --- Dry run: scan and categorize ---
+    if (dryRun) {
+      const withUser = await SharedLink.countDocuments({ user: { $exists: true, $ne: null } });
+      const withoutUser = await SharedLink.countDocuments({
+        $or: [{ user: { $exists: false } }, { user: null }],
+      });
+      const withIsPublicTrue = await rawCollection.countDocuments({ isPublic: true });
+      const withIsPublicFalse = isPublicFalseCount;
+      const withIsPublicField = await rawCollection.countDocuments({ isPublic: { $exists: true } });
+
+      const alreadyMigratedOwner = await AclEntry.countDocuments({
+        resourceType: RESOURCE_TYPE_SHARED_LINK,
+        principalType: PRINCIPAL_USER,
+      });
+      const alreadyMigratedPublic = await AclEntry.countDocuments({
+        resourceType: RESOURCE_TYPE_SHARED_LINK,
+        principalType: PRINCIPAL_PUBLIC,
+      });
+
+      return {
+        migrated: 0,
+        errors: 0,
+        dryRun: true,
+        summary: {
+          totalLinks,
+          withUser,
+          withoutUser,
+          withIsPublicTrue,
+          withIsPublicFalse,
+          withIsPublicField,
+          alreadyMigratedOwner,
+          alreadyMigratedPublic,
+        },
+      };
+    }
+
+    // --- Live migration: cursor-based batch processing ---
+    const failedLinkIds = new Set();
+
+    const results = {
+      migrated: 0,
+      errors: 0,
+      skipped: 0,
+      ownerGrants: 0,
+      ownerSkipped: 0,
+      publicViewerGrants: 0,
+      publicViewerSkipped: 0,
+      missingUserWarnings: 0,
+    };
+
+    const cursor = SharedLink.find({})
+      .select('_id user isPublic tenantId expiredAt')
+      .lean()
+      .cursor();
+
+    let batch = [];
+    let batchIndex = 0;
+
+    /**
+     * Process a single batch of SharedLink documents.
+     * Collects upsert operations into a single bulkWrite for efficiency.
+     * Tracks which op indices map to which link IDs so write failures
+     * can be attributed to specific links.
+     */
+    async function processBatch(links) {
+      const bulkOps = [];
+      const opIndexToLinkId = [];
+
+      for (const link of links) {
+        const linkId = link._id;
+        const userId = link.user;
+        const tenantId = link.tenantId;
+        const expiredAt = link.expiredAt;
+        const now = new Date();
+
+        if (userId) {
+          opIndexToLinkId.push(linkId);
+          bulkOps.push({
+            updateOne: {
+              filter: {
+                resourceType: RESOURCE_TYPE_SHARED_LINK,
+                resourceId: linkId,
+                principalType: PRINCIPAL_USER,
+                principalId: new mongoose.Types.ObjectId(userId),
+              },
+              update: {
+                $set: {
+                  permBits: ownerRole.permBits,
+                  roleId: ownerRole._id,
+                  grantedBy: new mongoose.Types.ObjectId(userId),
+                  grantedAt: now,
+                  ...(expiredAt && { expiredAt }),
+                },
+                $setOnInsert: {
+                  principalModel: 'User',
+                  ...(tenantId && { tenantId }),
+                },
+              },
+              upsert: true,
+            },
+          });
+        } else {
+          results.missingUserWarnings++;
+          logger.warn('SharedLink has no user field, skipping OWNER grant', {
+            linkId: linkId.toString(),
+          });
+        }
+
+        const hasIsPublic = link.isPublic !== undefined;
+        if (hasIsPublic && link.isPublic === false) {
+          results.publicViewerSkipped++;
+        } else if (hasIsPublic) {
+          const publicUpdateSet = {
+            permBits: viewerRole.permBits,
+            roleId: viewerRole._id,
+            grantedAt: now,
+            ...(expiredAt && { expiredAt }),
+          };
+          if (userId) {
+            publicUpdateSet.grantedBy = new mongoose.Types.ObjectId(userId);
+          }
+
+          opIndexToLinkId.push(linkId);
+          bulkOps.push({
+            updateOne: {
+              filter: {
+                resourceType: RESOURCE_TYPE_SHARED_LINK,
+                resourceId: linkId,
+                principalType: PRINCIPAL_PUBLIC,
+              },
+              update: {
+                $set: publicUpdateSet,
+                $setOnInsert: {
+                  ...(tenantId && { tenantId }),
+                },
+              },
+              upsert: true,
+            },
+          });
+        }
+
+        results.migrated++;
+      }
+
+      if (bulkOps.length > 0) {
+        try {
+          const bulkResult = await AclEntry.bulkWrite(bulkOps, { ordered: false });
+          results.ownerGrants += bulkResult.upsertedCount;
+        } catch (error) {
+          if (error.writeErrors) {
+            results.errors += error.writeErrors.length;
+            for (const writeError of error.writeErrors) {
+              const failedId = opIndexToLinkId[writeError.index];
+              if (failedId) {
+                failedLinkIds.add(failedId);
+              }
+              logger.error('Failed to migrate SharedLink in bulk', {
+                error: writeError.errmsg,
+                linkId: failedId?.toString(),
+              });
+            }
+          } else {
+            results.errors += links.length;
+            for (const link of links) {
+              failedLinkIds.add(link._id);
+            }
+            logger.error('Bulk write failed entirely', { error: error.message });
+          }
+        }
+      }
+    }
+
+    for await (const doc of cursor) {
+      batch.push(doc);
+
+      if (batch.length >= batchSize) {
+        batchIndex++;
+        const totalBatches = Math.ceil(totalLinks / batchSize);
+
+        if (batchIndex % 5 === 0 || batchIndex === 1) {
+          logger.info(`Processing batch ${batchIndex}/${totalBatches}`, {
+            migrated: results.migrated,
+            errors: results.errors,
+          });
+        }
+
+        await processBatch(batch);
+        batch = [];
+        await new Promise((resolve) => setTimeout(resolve, 100));
+      }
+    }
+
+    // Process remaining documents
+    if (batch.length > 0) {
+      batchIndex++;
+      const totalBatches = Math.ceil(totalLinks / batchSize);
+      logger.info(`Processing final batch ${batchIndex}/${totalBatches}`, {
+        remaining: batch.length,
+      });
+      await processBatch(batch);
+    }
+
+    // --- $unset isPublic only from successfully migrated documents ---
+    const unsetFilter = { isPublic: { $exists: true } };
+    if (failedLinkIds.size > 0) {
+      unsetFilter._id = { $nin: [...failedLinkIds] };
+      logger.warn(
+        `Skipping isPublic removal for ${failedLinkIds.size} links with failed ACL grants`,
+        { failedLinkIds: [...failedLinkIds].map((id) => id.toString()) },
+      );
+    }
+
+    logger.info('Removing isPublic field from successfully migrated SharedLink documents...');
+    const unsetResult = await rawCollection.updateMany(unsetFilter, { $unset: { isPublic: 1 } });
+    logger.info(`Removed isPublic field from ${unsetResult.modifiedCount} documents`);
+
+    results.isPublicFieldsRemoved = unsetResult.modifiedCount;
+    results.failedLinkCount = failedLinkIds.size;
+
+    logger.info('SharedLink migration completed', results);
+    return results;
+  });
+}
+
+if (require.main === module) {
+  const dryRun = process.argv.includes('--dry-run');
+  const force = process.argv.includes('--force');
+  const batchSize =
+    parseInt(process.argv.find((arg) => arg.startsWith('--batch-size='))?.split('=')[1]) || 100;
+
+  migrateSharedLinkPermissions({ dryRun, batchSize, force })
+    .then((result) => {
+      if (result.aborted) {
+        console.log('\n=== MIGRATION ABORTED ===');
+        console.log(`Reason: ${result.reason}`);
+        console.log(`Documents with isPublic: false: ${result.isPublicFalseCount}`);
+        console.log(`Sample IDs: ${result.sampleIds.join(', ')}`);
+        console.log('\nUse --force to proceed anyway');
+        process.exit(1);
+      }
+
+      if (dryRun) {
+        console.log('\n=== DRY RUN RESULTS ===');
+        console.log(`Total SharedLink documents: ${result.summary.totalLinks}`);
+        console.log(`- With user field: ${result.summary.withUser}`);
+        console.log(`- Without user field: ${result.summary.withoutUser}`);
+        console.log(`- With isPublic: true: ${result.summary.withIsPublicTrue}`);
+        console.log(`- With isPublic: false: ${result.summary.withIsPublicFalse}`);
+        console.log(`- With isPublic field present: ${result.summary.withIsPublicField}`);
+        console.log(
+          `\nAlready migrated (OWNER AclEntries): ${result.summary.alreadyMigratedOwner}`,
+        );
+        console.log(
+          `Already migrated (PUBLIC AclEntries): ${result.summary.alreadyMigratedPublic}`,
+        );
+        console.log('\nTo run the actual migration, remove the --dry-run flag');
+      } else {
+        console.log('\n=== MIGRATION RESULTS ===');
+        console.log(JSON.stringify(result, null, 2));
+      }
+      process.exit(0);
+    })
+    .catch((error) => {
+      console.error('SharedLink migration failed:', error);
+      process.exit(1);
+    });
+}
+
+module.exports = { migrateSharedLinkPermissions };
diff --git a/deploy-compose.yml b/deploy-compose.yml
index 5d7bcebcd0d..e581aed80fe 100644
--- a/deploy-compose.yml
+++ b/deploy-compose.yml
@@ -23,6 +23,13 @@ services:
       - MEILI_HOST=http://meilisearch:7700
       - RAG_PORT=${RAG_PORT:-8000}
       - RAG_API_URL=http://rag_api:${RAG_PORT:-8000}
+      - PROXY=${PROXY:-}
+      - HTTP_PROXY=${HTTP_PROXY:-}
+      - HTTPS_PROXY=${HTTPS_PROXY:-}
+      - NO_PROXY=${NO_PROXY:-localhost,127.0.0.1,::1},${no_proxy:-},mongodb,chat-mongodb,meilisearch,chat-meilisearch,rag_api,vectordb,host.docker.internal
+      - http_proxy=${http_proxy:-}
+      - https_proxy=${https_proxy:-}
+      - no_proxy=${no_proxy:-localhost,127.0.0.1,::1},${NO_PROXY:-},mongodb,chat-mongodb,meilisearch,chat-meilisearch,rag_api,vectordb,host.docker.internal
     volumes:
       - type: bind
         source: ./librechat.yaml
@@ -30,6 +37,7 @@ services:
       - ./images:/app/client/public/images
       - ./uploads:/app/uploads
       - ./logs:/app/api/logs
+      - ./skill:/app/skill
 
   client:
     image: nginx:1.27.0-alpine
diff --git a/docker-compose.yml b/docker-compose.yml
index 6c95c309b46..dd3880a767f 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -20,6 +20,13 @@ services:
       - MEILI_HOST=http://meilisearch:7700
       - RAG_PORT=${RAG_PORT:-8000}
       - RAG_API_URL=http://rag_api:${RAG_PORT:-8000}
+      - PROXY=${PROXY:-}
+      - HTTP_PROXY=${HTTP_PROXY:-}
+      - HTTPS_PROXY=${HTTPS_PROXY:-}
+      - NO_PROXY=${NO_PROXY:-localhost,127.0.0.1,::1},${no_proxy:-},mongodb,chat-mongodb,meilisearch,chat-meilisearch,rag_api,vectordb,host.docker.internal
+      - http_proxy=${http_proxy:-}
+      - https_proxy=${https_proxy:-}
+      - no_proxy=${no_proxy:-localhost,127.0.0.1,::1},${NO_PROXY:-},mongodb,chat-mongodb,meilisearch,chat-meilisearch,rag_api,vectordb,host.docker.internal
     volumes:
       - type: bind
         source: ./.env
@@ -27,6 +34,7 @@ services:
       - ./images:/app/client/public/images
       - ./uploads:/app/uploads
       - ./logs:/app/logs
+      - ./skill:/app/skill
   mongodb:
     container_name: chat-mongodb
     image: mongo:8.0.20
diff --git a/e2e/README.md b/e2e/README.md
index 822297103f6..86ec9124475 100644
--- a/e2e/README.md
+++ b/e2e/README.md
@@ -1,6 +1,6 @@
 # LibreChat e2e
 
-The mock e2e profile is the safest default for generated tests. It starts LibreChat with `e2e/config/librechat.e2e.yaml`, points custom endpoints at the local mock LLM server, creates an authenticated e2e user, and avoids real provider credentials.
+The mock e2e profile is the safest default for generated tests. It starts LibreChat with `e2e/config/librechat.e2e.yaml`, injects an in-process fake LLM (via `LIBRECHAT_TEST_RUN_HOOK`), creates an authenticated e2e user, and avoids real provider credentials.
 
 ## Recording Tests
 
@@ -10,9 +10,9 @@ Use Playwright codegen when you want to turn an exploratory browser session into
 npm run e2e:record
 ```
 
-That command builds the app, starts the mock LLM and LibreChat test server when needed, writes `e2e/storageState.json`, and opens Playwright codegen at `/c/new`. The npm script uses `http://localhost:3333` so it does not collide with a normal dev server on `3080`. Raw recordings are written to `e2e/recordings/` and ignored by git.
+That command builds the app, starts the LibreChat test server (with an in-process fake LLM) when needed, writes `e2e/storageState.json`, and opens Playwright codegen at `/c/new`. The npm script uses `http://localhost:3333` so it does not collide with a normal dev server on `3080`. Raw recordings are written to `e2e/recordings/` and ignored by git.
 
-For a real local LibreChat config instead of the mock LLM profile:
+For a real local LibreChat config instead of the mock profile:
 
 ```sh
 npm run e2e:record:local
diff --git a/e2e/config/librechat.e2e.yaml b/e2e/config/librechat.e2e.yaml
index e7e9e622716..daa5154bb4e 100644
--- a/e2e/config/librechat.e2e.yaml
+++ b/e2e/config/librechat.e2e.yaml
@@ -1,8 +1,38 @@
-# Credential-free e2e config template. e2e/playwright.config.mock.ts writes
-# an ignored runtime copy and rewrites the mock LLM port from MOCK_LLM_PORT.
+# Credential-free e2e config template. e2e/playwright.config.mock.ts copies this
+# to an ignored runtime path; the in-process fake model (e2e/setup/fake-model.js)
+# overrides each run, so the placeholder baseURL below is never contacted.
 version: 1.3.11
 cache: true
 
+interface:
+  # Exercises the cost row in the context usage gauge (off by default).
+  # Mock models price at the default rate, so synthetic usage yields a value.
+  contextCost: true
+
+mcpSettings:
+  # Deliberately excludes 127.0.0.1, so the URL-based `e2e-http` server below is blocked
+  # at boot (stored as inspectionFailed). mcp-allowlist-override.spec.ts adds that origin
+  # via an admin-panel config override and asserts the server reinitializes — proving the
+  # admin override is honored by inspection/connection. stdio servers skip this check.
+  allowedDomains:
+    - https://allowed.example.com
+
+mcpServers:
+  e2e-memory:
+    type: stdio
+    command: node
+    args:
+      - e2e/setup/fake-mcp-server.js
+    title: E2E Memory
+    description: Local MCP fixture used by mock end-to-end tests.
+    timeout: 30000
+  e2e-http:
+    type: streamable-http
+    url: http://127.0.0.1:8765/mcp
+    title: E2E HTTP
+    description: Local HTTP MCP fixture for allowlist-override e2e tests.
+    timeout: 30000
+
 endpoints:
   custom:
     - name: 'Mock Provider A'
@@ -14,6 +44,8 @@ endpoints:
         fetch: false
       titleConvo: false
       modelDisplayLabel: 'Mock Provider A'
+      customParams:
+        defaultParamsEndpoint: anthropic
 
     - name: 'Mock Provider B'
       apiKey: 'e2e-mock-key-b'
@@ -24,3 +56,95 @@ endpoints:
         fetch: false
       titleConvo: false
       modelDisplayLabel: 'Mock Provider B'
+
+    # No model spec mirrors this endpoint's label, so it stays unambiguous in the
+    # selector and gives e2e tests a real ephemeral endpoint → model option.
+    - name: 'Mock Provider C'
+      apiKey: 'e2e-mock-key-c'
+      baseURL: 'http://127.0.0.1:8889/v1'
+      models:
+        default:
+          - 'mock-model-c'
+        fetch: false
+      titleConvo: false
+      modelDisplayLabel: 'Mock Provider C'
+
+    # Second non-spec endpoint so e2e tests can switch between two real
+    # ephemeral endpoints (e.g. MCP selection persistence across switches).
+    - name: 'Mock Provider D'
+      apiKey: 'e2e-mock-key-d'
+      baseURL: 'http://127.0.0.1:8889/v1'
+      models:
+        default:
+          - 'mock-model-d'
+        fetch: false
+      titleConvo: false
+      modelDisplayLabel: 'Mock Provider D'
+
+modelSpecs:
+  prioritize: true
+  # Enforcement would reject sends from the non-spec paths addedEndpoints
+  # exposes below (buildEndpointOption requires a spec when enforce is true).
+  enforce: false
+  # Surfaces the endpoints menu (modelSelect defaults on when addedEndpoints is
+  # set) limited to entries that don't collide with the spec labels above.
+  addedEndpoints:
+    - 'Mock Provider C'
+    - 'Mock Provider D'
+    - 'agents'
+  list:
+    - name: 'e2e-mock-provider-a'
+      label: 'Mock Provider A'
+      preset:
+        endpoint: 'Mock Provider A'
+        model: 'mock-model-a'
+
+    - name: 'e2e-mock-provider-b'
+      label: 'Mock Provider B'
+      preset:
+        endpoint: 'Mock Provider B'
+        model: 'mock-model-b'
+
+    - name: 'e2e-icon-spec'
+      label: 'E2E Icon Spec'
+      iconURL: '/assets/openai.svg'
+      preset:
+        endpoint: 'Mock Provider A'
+        model: 'mock-model-a'
+
+    - name: 'e2e-skill-scope'
+      label: 'E2E Skill Scope'
+      preset:
+        endpoint: 'Mock Provider A'
+        model: 'mock-model-a'
+      skills:
+        - 'e2e-model-spec-allowed'
+        - 'e2e-model-spec-missing'
+        - 'e2e-model-spec-inaccessible'
+
+    - name: 'e2e-soft-default'
+      label: 'E2E Soft Default'
+      softDefault: true
+      preset:
+        endpoint: 'Mock Provider A'
+        model: 'mock-model-a'
+
+    - name: 'e2e-branded'
+      label: 'E2E Branded'
+      description: '<strong>Branded</strong> answers <img src="/assets/openai.svg" alt="brand icon">'
+      showOnLanding: true
+      preset:
+        endpoint: 'Mock Provider A'
+        model: 'mock-model-a'
+
+    - name: 'e2e-starters'
+      label: 'E2E Starters'
+      conversation_starters:
+        - 'E2E_REPLY:starter'
+        - 'Plan my week'
+        - 'Third starter prompt'
+        - 'Fourth starter prompt'
+        - 'Fifth starter beyond the cap'
+      preset:
+        endpoint: 'Mock Provider A'
+        model: 'mock-model-a'
diff --git a/e2e/config/librechat.real.yaml b/e2e/config/librechat.real.yaml
new file mode 100644
index 00000000000..7c8c3b4bd52
--- /dev/null
+++ b/e2e/config/librechat.real.yaml
@@ -0,0 +1,10 @@
+# Real-provider local e2e template. Used only by e2e/playwright.config.real.ts,
+# which requires ANTHROPIC_API_KEY in the invoking environment — the key is
+# passed through process env at runtime and never written to disk. Not wired
+# into CI; the mock workflow only runs playwright.config.mock.ts.
+version: 1.3.11
+cache: true
+
+interface:
+  # Exercise the cost row against real provider usage.
+  contextCost: true
diff --git a/e2e/fixtures/deployment-skills/e2e-deployment-skill/SKILL.md b/e2e/fixtures/deployment-skills/e2e-deployment-skill/SKILL.md
new file mode 100644
index 00000000000..a0d1d260ece
--- /dev/null
+++ b/e2e/fixtures/deployment-skills/e2e-deployment-skill/SKILL.md
@@ -0,0 +1,10 @@
+---
+name: e2e-deployment-skill
+description: Use this deployment skill to verify shared skills load during Playwright startup.
+always-apply: true
+user-invocable: true
+---
+
+# E2E Deployment Skill
+
+E2E deployment skill loaded through Playwright from the configured deployment skills directory.
diff --git a/e2e/fixtures/deployment-skills/e2e-deployment-skill/guide.txt b/e2e/fixtures/deployment-skills/e2e-deployment-skill/guide.txt
new file mode 100644
index 00000000000..17ca54fd454
--- /dev/null
+++ b/e2e/fixtures/deployment-skills/e2e-deployment-skill/guide.txt
@@ -0,0 +1 @@
+deployment skill file fixture
diff --git a/e2e/jestSetup.js b/e2e/jestSetup.js
index f379d0929bf..d34a9644713 100644
--- a/e2e/jestSetup.js
+++ b/e2e/jestSetup.js
@@ -1,3 +1,3 @@
-// v0.8.6
+// v0.8.7-rc1
 // See .env.test.example for an example of the '.env.test' file.
 require('dotenv').config({ path: './e2e/.env.test' });
diff --git a/e2e/playwright.config.mock.ts b/e2e/playwright.config.mock.ts
index a78d51817c7..74aac8dbd03 100644
--- a/e2e/playwright.config.mock.ts
+++ b/e2e/playwright.config.mock.ts
@@ -5,15 +5,16 @@ import { getLocalE2EEnv, getE2EBaseURL } from './setup/env';
 
 const rootPath = path.resolve(__dirname, '..');
 const serverPath = path.resolve(rootPath, 'e2e/setup/start-server.js');
-const mockLlmPath = path.resolve(rootPath, 'e2e/setup/mock-llm-server.js');
+const mcpHttpServerPath = path.resolve(rootPath, 'e2e/setup/fake-mcp-http-server.js');
+/** Must match the `e2e-http` server URL in e2e/config/librechat.e2e.yaml. */
+const MCP_HTTP_PORT = process.env.E2E_MCP_HTTP_PORT || '8765';
+const fakeModelHookPath = path.resolve(rootPath, 'e2e/setup/fake-model.js');
 const configTemplatePath = path.resolve(rootPath, 'e2e/config/librechat.e2e.yaml');
 const configPath = path.resolve(rootPath, 'e2e/.generated/librechat.e2e.yaml');
 const reportPath = path.resolve(rootPath, 'e2e/playwright-report');
+const deploymentSkillsPath = path.resolve(rootPath, 'e2e/fixtures/deployment-skills');
 
 const baseURL = getE2EBaseURL();
-const mockLlmPort = getMockLlmPort();
-const defaultMockLlmBaseURL = 'http://127.0.0.1:8889/v1';
-const mockLlmBaseURL = `http://127.0.0.1:${mockLlmPort}/v1`;
 const chromiumChannel = process.env.E2E_CHROMIUM_CHANNEL || undefined;
 
 const vanillaOverrides = {
@@ -30,7 +31,9 @@ const vanillaOverrides = {
 const baseEnv = {
   ...getLocalE2EEnv(),
   CONFIG_PATH: configPath,
-  MOCK_LLM_PORT: mockLlmPort,
+  DEPLOYMENT_SKILLS_DIR: deploymentSkillsPath,
+  /** Loaded in-process by `@librechat/api`'s `createRun` to swap in a fake model. */
+  LIBRECHAT_TEST_RUN_HOOK: fakeModelHookPath,
   ...vanillaOverrides,
 };
 
@@ -41,23 +44,19 @@ const preservedCredentialEnvKeys = new Set([
   'E2E_USER_B_PASSWORD',
 ]);
 
-function getMockLlmPort() {
-  const port = process.env.MOCK_LLM_PORT ?? '8889';
-  if (!/^\d+$/.test(port)) {
-    throw new Error('MOCK_LLM_PORT must be a numeric port');
-  }
-  return port;
-}
-
+/**
+ * The custom endpoints in the template point at an unreachable baseURL; the fake
+ * model injected via `LIBRECHAT_TEST_RUN_HOOK` overrides the run before any
+ * request is made, so no real (or mock HTTP) provider is contacted.
+ */
 function writeRuntimeMockConfig() {
   const template = fs.readFileSync(configTemplatePath, 'utf8');
-
-  if (!template.includes(defaultMockLlmBaseURL)) {
-    throw new Error(`Expected mock config template to include ${defaultMockLlmBaseURL}`);
-  }
-
+  const config =
+    process.env.E2E_MODEL_SPECS_ENFORCE === 'true'
+      ? template.replace('\n  enforce: false\n', '\n  enforce: true\n')
+      : template;
   fs.mkdirSync(path.dirname(configPath), { recursive: true });
-  fs.writeFileSync(configPath, template.replaceAll(defaultMockLlmBaseURL, mockLlmBaseURL));
+  fs.writeFileSync(configPath, config);
 }
 
 function neutralizeCredentialEnv(env: NodeJS.ProcessEnv, keep: Set<string>) {
@@ -129,20 +128,22 @@ export default defineConfig({
   ],
   webServer: [
     {
-      command: `node ${mockLlmPath}`,
+      command: `node ${serverPath}`,
       cwd: rootPath,
-      url: `http://127.0.0.1:${mockLlmPort}/health`,
+      url: baseURL,
       stdout: 'pipe',
-      timeout: 30_000,
+      ignoreHTTPSErrors: true,
+      timeout: 120_000,
       reuseExistingServer: false,
     },
     {
-      command: `node ${serverPath}`,
+      // URL-based MCP fixture for the allowlist-override spec (its health route is GET /).
+      command: `node ${mcpHttpServerPath}`,
       cwd: rootPath,
-      url: baseURL,
+      env: { ...process.env, E2E_MCP_HTTP_PORT: MCP_HTTP_PORT },
+      url: `http://127.0.0.1:${MCP_HTTP_PORT}/`,
       stdout: 'pipe',
-      ignoreHTTPSErrors: true,
-      timeout: 120_000,
+      timeout: 60_000,
       reuseExistingServer: false,
     },
   ],
diff --git a/e2e/playwright.config.real.ts b/e2e/playwright.config.real.ts
new file mode 100644
index 00000000000..d854155a04b
--- /dev/null
+++ b/e2e/playwright.config.real.ts
@@ -0,0 +1,139 @@
+import { defineConfig, devices } from '@playwright/test';
+import fs from 'fs';
+import path from 'path';
+import { getLocalE2EEnv, getE2EBaseURL } from './setup/env';
+
+/**
+ * LOCAL-ONLY real-provider config: boots the same self-contained harness as
+ * the mock config (in-memory Mongo, seeded user, generated secrets) but runs
+ * real Anthropic calls — no fake-model hook. The API key is consumed from the
+ * invoking environment only; every other credential-like variable is blanked
+ * before the server boots, and nothing secret is written to disk.
+ *
+ * Run with:
+ * ANTHROPIC_API_KEY=... E2E_BASE_URL=http://localhost:3334 \
+ *   npm run e2e:prepare && npx playwright test --config=e2e/playwright.config.real.ts
+ */
+if (!process.env.ANTHROPIC_API_KEY) {
+  throw new Error(
+    '[e2e:real] ANTHROPIC_API_KEY is required in the environment for the real-provider config.',
+  );
+}
+
+const rootPath = path.resolve(__dirname, '..');
+const serverPath = path.resolve(rootPath, 'e2e/setup/start-server.js');
+const configTemplatePath = path.resolve(rootPath, 'e2e/config/librechat.real.yaml');
+const configPath = path.resolve(rootPath, 'e2e/.generated/librechat.real.yaml');
+const reportPath = path.resolve(rootPath, 'e2e/playwright-report');
+
+const baseURL = getE2EBaseURL();
+const chromiumChannel = process.env.E2E_CHROMIUM_CHANNEL || undefined;
+
+const realModel = process.env.E2E_REAL_ANTHROPIC_MODEL ?? 'claude-haiku-4-5';
+
+const baseEnv = {
+  ...getLocalE2EEnv(),
+  CONFIG_PATH: configPath,
+  TENANT_ISOLATION_STRICT: 'false',
+  OPENAI_API_KEY: 'user_provided',
+  ANTHROPIC_API_KEY: process.env.ANTHROPIC_API_KEY,
+  /** Single deterministic model so the selector flow never drifts */
+  ANTHROPIC_MODELS: realModel,
+  OPENID_CLIENT_ID: '',
+  OPENID_ISSUER: '',
+  OPENID_AUTO_REDIRECT: 'false',
+  ALLOW_SOCIAL_LOGIN: 'false',
+  ALLOW_SOCIAL_REGISTRATION: 'false',
+  STREAM_KEEP_COMPLETED_JOBS: 'true',
+};
+
+const SECRET_KEY_PATTERN = /(API_KEY|SECRET|TOKEN|PASSWORD|CREDENTIALS|CLIENT_ID|_KEY)$/i;
+const preservedCredentialEnvKeys = new Set([
+  ...Object.keys(baseEnv),
+  'E2E_USER_PASSWORD',
+  'E2E_USER_B_PASSWORD',
+]);
+
+function writeRuntimeRealConfig() {
+  const template = fs.readFileSync(configTemplatePath, 'utf8');
+  fs.mkdirSync(path.dirname(configPath), { recursive: true });
+  fs.writeFileSync(configPath, template);
+}
+
+function neutralizeCredentialEnv(env: NodeJS.ProcessEnv, keep: Set<string>) {
+  for (const key of Object.keys(env)) {
+    if (!keep.has(key) && SECRET_KEY_PATTERN.test(key)) {
+      env[key] = '';
+    }
+  }
+}
+
+/** Blank any credential-like vars from a local `.env` so they never reach the test server. */
+function neutralizeDotenvSecrets(envFile: string, keep: Set<string>) {
+  if (!fs.existsSync(envFile)) {
+    return;
+  }
+  const lines = fs.readFileSync(envFile, 'utf8').split('\n');
+  for (const line of lines) {
+    const match = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=/);
+    if (!match) {
+      continue;
+    }
+    const key = match[1];
+    if (keep.has(key)) {
+      continue;
+    }
+    if (SECRET_KEY_PATTERN.test(key)) {
+      process.env[key] = '';
+    }
+  }
+}
+
+writeRuntimeRealConfig();
+neutralizeCredentialEnv(process.env, preservedCredentialEnvKeys);
+Object.assign(process.env, baseEnv);
+neutralizeDotenvSecrets(path.resolve(rootPath, '.env'), preservedCredentialEnvKeys);
+
+export default defineConfig({
+  globalSetup: require.resolve('./setup/global-setup'),
+  globalTeardown: require.resolve('./setup/global-teardown.mock'),
+  testDir: 'specs/real/',
+  outputDir: 'specs/.test-results',
+  fullyParallel: false,
+  forbidOnly: true,
+  retries: 0,
+  workers: 1,
+  reporter: [['html', { outputFolder: reportPath, open: 'never' }], ['list']],
+  use: {
+    baseURL,
+    video: 'off',
+    trace: 'off',
+    ignoreHTTPSErrors: true,
+    headless: true,
+    storageState: path.resolve(process.cwd(), 'e2e/storageState.json'),
+    screenshot: 'only-on-failure',
+  },
+  expect: {
+    timeout: 15000,
+  },
+  projects: [
+    {
+      name: chromiumChannel ?? 'chromium',
+      use: {
+        ...devices['Desktop Chrome'],
+        ...(chromiumChannel ? { channel: chromiumChannel } : {}),
+      },
+    },
+  ],
+  webServer: [
+    {
+      command: `node ${serverPath}`,
+      cwd: rootPath,
+      url: baseURL,
+      stdout: 'pipe',
+      ignoreHTTPSErrors: true,
+      timeout: 120_000,
+      reuseExistingServer: false,
+    },
+  ],
+});
diff --git a/e2e/setup/fake-mcp-http-server.js b/e2e/setup/fake-mcp-http-server.js
new file mode 100644
index 00000000000..503e82d9e2e
--- /dev/null
+++ b/e2e/setup/fake-mcp-http-server.js
@@ -0,0 +1,78 @@
+#!/usr/bin/env node
+
+/**
+ * Streamable-HTTP MCP fixture for the allowlist-override e2e spec.
+ *
+ * Unlike the stdio `fake-mcp-server.js`, this one is reachable over a URL so it
+ * exercises the `mcpSettings.allowedDomains` check (stdio transports skip it). The
+ * e2e config deliberately omits this server's origin from `allowedDomains`, so it
+ * boots as `inspectionFailed`; `mcp-allowlist-override.spec.ts` then adds the origin
+ * via an admin-panel config override and asserts the server reinitializes.
+ *
+ * Mirrors the stateful streamable-HTTP pattern in
+ * packages/api/src/mcp/__tests__/helpers/oauthTestServer.ts (without OAuth).
+ */
+
+const http = require('http');
+const { randomUUID } = require('crypto');
+const { McpServer } = require('@modelcontextprotocol/sdk/server/mcp.js');
+const {
+  StreamableHTTPServerTransport,
+} = require('@modelcontextprotocol/sdk/server/streamableHttp.js');
+
+const PORT = parseInt(process.env.E2E_MCP_HTTP_PORT || '8765', 10);
+const HOST = '127.0.0.1';
+
+function createMcpServer() {
+  const server = new McpServer({ name: 'e2e-http', version: '1.0.0' });
+  server.registerTool(
+    'http_ping',
+    {
+      description: 'Returns a deterministic value for LibreChat allowlist-override e2e tests.',
+      inputSchema: {},
+    },
+    async () => ({
+      content: [{ type: 'text', text: 'E2E HTTP MCP pong' }],
+    }),
+  );
+  return server;
+}
+
+/** @type {Map<string, InstanceType<typeof StreamableHTTPServerTransport>>} */
+const sessions = new Map();
+
+const httpServer = http.createServer(async (req, res) => {
+  const url = new URL(req.url, `http://${req.headers.host}`);
+
+  // Health endpoint so Playwright's `webServer` can detect readiness.
+  if (url.pathname === '/' && req.method === 'GET') {
+    res.writeHead(200, { 'Content-Type': 'text/plain' });
+    res.end('ok');
+    return;
+  }
+
+  if (url.pathname !== '/mcp') {
+    res.writeHead(404);
+    res.end();
+    return;
+  }
+
+  const sid = req.headers['mcp-session-id'];
+  let transport = typeof sid === 'string' ? sessions.get(sid) : undefined;
+  if (!transport) {
+    transport = new StreamableHTTPServerTransport({ sessionIdGenerator: () => randomUUID() });
+    const mcp = createMcpServer();
+    await mcp.connect(transport);
+  }
+
+  await transport.handleRequest(req, res);
+
+  if (transport.sessionId && !sessions.has(transport.sessionId)) {
+    sessions.set(transport.sessionId, transport);
+    transport.onclose = () => sessions.delete(transport.sessionId);
+  }
+});
+
+httpServer.listen(PORT, HOST, () => {
+  console.log(`[e2e] fake HTTP MCP server listening on http://${HOST}:${PORT}/mcp`);
+});
diff --git a/e2e/setup/fake-mcp-server.js b/e2e/setup/fake-mcp-server.js
new file mode 100644
index 00000000000..87419df88a4
--- /dev/null
+++ b/e2e/setup/fake-mcp-server.js
@@ -0,0 +1,53 @@
+#!/usr/bin/env node
+
+const { McpServer } = require('@modelcontextprotocol/sdk/server/mcp.js');
+const { StdioServerTransport } = require('@modelcontextprotocol/sdk/server/stdio.js');
+const z = require('zod/v4');
+
+const server = new McpServer({
+  name: 'e2e-memory',
+  version: '1.0.0',
+});
+
+server.registerTool(
+  'remember_fact',
+  {
+    description: 'Stores a deterministic fact for LibreChat mock end-to-end tests.',
+    inputSchema: {
+      fact: z.string().optional(),
+    },
+  },
+  async ({ fact = 'LibreChat MCP e2e fact' }) => ({
+    content: [
+      {
+        type: 'text',
+        text: `E2E MCP memory noted: ${fact}`,
+      },
+    ],
+  }),
+);
+
+server.registerTool(
+  'recall_fact',
+  {
+    description: 'Returns a deterministic fact for LibreChat mock end-to-end tests.',
+    inputSchema: {},
+  },
+  async () => ({
+    content: [
+      {
+        type: 'text',
+        text: 'E2E MCP memory recalled: LibreChat can persist MCP tools on agents.',
+      },
+    ],
+  }),
+);
+
+async function main() {
+  await server.connect(new StdioServerTransport());
+}
+
+main().catch((error) => {
+  console.error('[fake-mcp-server] failed to start', error);
+  process.exit(1);
+});
diff --git a/e2e/setup/fake-model.js b/e2e/setup/fake-model.js
new file mode 100644
index 00000000000..77f1d98a34b
--- /dev/null
+++ b/e2e/setup/fake-model.js
@@ -0,0 +1,538 @@
+/**
+ * In-process fake LLM for credential-free e2e tests. Loaded by `@librechat/api`'s
+ * `createRun` via the `LIBRECHAT_TEST_RUN_HOOK` env var (set by the mock
+ * Playwright config and the `--profile=mock` recorder), it swaps the run's model
+ * for the agents package's own `FakeChatModel` through
+ * `run.Graph.overrideTestModel(...)`.
+ *
+ * This exercises the real `Run.create` -> graph -> tool-node pipeline end to end
+ * without a live provider or a standalone HTTP mock server: responses are decided
+ * from the conversation and the agents' advertised tools.
+ */
+const { FakeChatModel } = require('@librechat/agents');
+const { ChatGenerationChunk } = require('@langchain/core/outputs');
+const { AIMessageChunk } = require('@langchain/core/messages');
+
+const MOCK_REPLY = process.env.MOCK_LLM_REPLY || 'E2E mock reply: pong';
+const CHUNK_DELAY_MS = Number(process.env.MOCK_LLM_CHUNK_DELAY_MS) || 10;
+
+const CREATE_SKILL_MARKER = 'E2E_CREATE_SKILL:';
+const EDIT_SKILL_MARKER = 'E2E_EDIT_SKILL:';
+const ASSERT_MODEL_SPEC_SKILLS_MARKER = 'E2E_ASSERT_MODEL_SPEC_SKILLS';
+const ASSERT_PROVIDER_FILE_MARKER = 'E2E_ASSERT_PROVIDER_FILE:';
+const REPLY_MARKER = 'E2E_REPLY:';
+const COUNTED_REPLY_MARKER = 'E2E_COUNTED_REPLY:';
+const SLOW_REPLY_MARKER = 'E2E_SLOW_REPLY:';
+const SLOW_COUNTED_REPLY_MARKER = 'E2E_SLOW_COUNTED_REPLY:';
+const RESUME_ICON_REPLY_MARKER = 'E2E_RESUME_ICON_REPLY:';
+const FORCED_ERROR_MARKER = 'E2E_FORCED_ERROR:';
+const MARKDOWN_REPLY_MARKER = 'E2E_MARKDOWN_REPLY';
+const CREATE_FILE_AUTHORING_FINAL_TEXT = 'E2E file authoring complete';
+const EDIT_FILE_AUTHORING_FINAL_TEXT = 'E2E file edit complete';
+const MODEL_SPEC_SKILL_ASSERTION_FINAL_TEXT = 'E2E model spec skill assertion passed';
+const PROVIDER_FILE_ASSERTION_FINAL_TEXT = 'E2E provider file assertion passed';
+const SLOW_CHUNK_DELAY_MS = Number(process.env.MOCK_LLM_SLOW_CHUNK_DELAY_MS) || 35;
+const SLOW_REPLY_CHUNKS = 160;
+const RESUME_ICON_CHUNK_DELAY_MS = Number(process.env.MOCK_LLM_RESUME_ICON_CHUNK_DELAY_MS) || 60;
+const RESUME_ICON_REPLY_CHUNKS = 240;
+const CREATE_FILE_TOOL_NAME = 'create_file';
+const EDIT_FILE_TOOL_NAME = 'edit_file';
+const BASH_TOOL_NAME = 'bash_tool';
+const SKILL_TOOL_NAME = 'skill';
+const CREATE_SKILL_TOOL_CALL_ID = 'call_e2e_create_skill';
+const EDIT_SKILL_TOOL_CALL_ID = 'call_e2e_edit_skill';
+const MODEL_SPEC_ACCESSIBLE_SKILL = 'e2e-model-spec-allowed';
+const MODEL_SPEC_MISSING_SKILL = 'e2e-model-spec-missing';
+const MODEL_SPEC_INACCESSIBLE_SKILL = 'e2e-model-spec-inaccessible';
+const ALWAYS_APPLY_BODY_MARKER = 'E2E_ALWAYS_APPLY_BODY_MARKER';
+const SKILL_DESCRIPTION =
+  'Use this skill to verify LibreChat skill file authoring in mock end-to-end tests.';
+const EDITED_SKILL_DESCRIPTION =
+  'Use this edited skill to verify LibreChat skill file authoring in mock end-to-end tests.';
+const countedReplies = new Map();
+const slowCountedReplies = new Map();
+
+function messageType(message) {
+  if (typeof message.getType === 'function') {
+    return message.getType();
+  }
+  if (typeof message._getType === 'function') {
+    return message._getType();
+  }
+  return message.role || message.type || '';
+}
+
+function getContentText(content) {
+  if (typeof content === 'string') {
+    return content;
+  }
+  if (!Array.isArray(content)) {
+    return '';
+  }
+  return content
+    .map((part) => {
+      if (typeof part === 'string') {
+        return part;
+      }
+      if (part && typeof part === 'object' && typeof part.text === 'string') {
+        return part.text;
+      }
+      return '';
+    })
+    .join('\n');
+}
+
+function getLatestUserText(messages) {
+  const message = getLatestUserMessage(messages);
+  return message ? getContentText(message.content) : '';
+}
+
+function getLatestUserMessage(messages) {
+  if (!Array.isArray(messages)) {
+    return null;
+  }
+  for (let index = messages.length - 1; index >= 0; index--) {
+    const message = messages[index];
+    if (!message) {
+      continue;
+    }
+    const type = messageType(message);
+    if (type === 'human' || type === 'user') {
+      return message;
+    }
+  }
+  return null;
+}
+
+function getRequestedSkillName(text, marker) {
+  const markerIndex = text.indexOf(marker);
+  if (markerIndex === -1) {
+    return '';
+  }
+  const afterMarker = text.slice(markerIndex + marker.length);
+  return afterMarker.match(/[a-z0-9][a-z0-9-]*/)?.[0] ?? '';
+}
+
+function getMarkerValue(text, marker) {
+  const markerIndex = text.indexOf(marker);
+  if (markerIndex === -1) {
+    return '';
+  }
+  return (
+    text
+      .slice(markerIndex + marker.length)
+      .trim()
+      .split(/\s+/, 1)[0] ?? ''
+  );
+}
+
+function collectToolNames(agents) {
+  const names = new Set();
+  const add = (name) => {
+    if (typeof name === 'string' && name) {
+      names.add(name);
+    }
+  };
+  for (const agent of agents ?? []) {
+    if (!agent) {
+      continue;
+    }
+    for (const tool of agent.tools ?? []) {
+      add(tool?.name);
+    }
+    for (const def of agent.toolDefinitions ?? []) {
+      add(def?.name);
+    }
+    if (agent.toolRegistry && typeof agent.toolRegistry.keys === 'function') {
+      for (const name of agent.toolRegistry.keys()) {
+        add(name);
+      }
+    }
+  }
+  return names;
+}
+
+function collectAdditionalInstructions(agents) {
+  return (agents ?? [])
+    .map((agent) =>
+      typeof agent?.additional_instructions === 'string' ? agent.additional_instructions : '',
+    )
+    .filter(Boolean)
+    .join('\n');
+}
+
+function collectSkillPrimeMessages(messages) {
+  return (messages ?? [])
+    .filter((message) => message?.additional_kwargs?.source === 'skill')
+    .map((message) => ({
+      name: message.additional_kwargs.skillName,
+      trigger: message.additional_kwargs.trigger,
+      content: getContentText(message.content),
+    }));
+}
+
+function collectProviderFileNames(value, names = new Set()) {
+  if (value == null) {
+    return names;
+  }
+
+  if (Array.isArray(value)) {
+    for (const item of value) {
+      collectProviderFileNames(item, names);
+    }
+    return names;
+  }
+
+  if (typeof value !== 'object') {
+    return names;
+  }
+
+  if (value.type === 'input_file' && typeof value.filename === 'string') {
+    names.add(value.filename);
+  }
+
+  if (value.type === 'file' && typeof value.file?.filename === 'string') {
+    names.add(value.file.filename);
+  }
+
+  if (value.type === 'document' && typeof value.context === 'string') {
+    const match = value.context.match(/File:\s*"([^"]+)"/);
+    if (match?.[1]) {
+      names.add(match[1]);
+    }
+  }
+
+  for (const child of Object.values(value)) {
+    collectProviderFileNames(child, names);
+  }
+
+  return names;
+}
+
+function providerFileAssertionResponses({ messages, text }) {
+  const filename = getMarkerValue(text, ASSERT_PROVIDER_FILE_MARKER);
+  if (!filename) {
+    return null;
+  }
+
+  const latestUserMessage = getLatestUserMessage(messages);
+  const providerFileNames = collectProviderFileNames(latestUserMessage?.content);
+  if (providerFileNames.has(filename)) {
+    return {
+      responses: [`${PROVIDER_FILE_ASSERTION_FINAL_TEXT}: ${filename}`],
+    };
+  }
+
+  return {
+    responses: [
+      `E2E provider file assertion failed: expected ${filename}; saw ${
+        Array.from(providerFileNames).join(', ') || 'no provider files'
+      }`,
+    ],
+  };
+}
+
+function replyResponses(text) {
+  if (text.includes(MARKDOWN_REPLY_MARKER)) {
+    return {
+      responses: [
+        [
+          '## E2E markdown heading',
+          '',
+          '**E2E bold text**',
+          '',
+          '- E2E list item',
+          '',
+          '```javascript',
+          'const e2eSyntaxHighlight = "ok";',
+          '```',
+        ].join('\n'),
+      ],
+    };
+  }
+
+  const errorName = getMarkerValue(text, FORCED_ERROR_MARKER);
+  if (errorName) {
+    return {
+      responses: [`E2E forced error prelude ${errorName}`],
+      thrownError: `E2E forced stream error ${errorName}`,
+    };
+  }
+
+  const replyName = getMarkerValue(text, REPLY_MARKER);
+  if (replyName) {
+    return {
+      responses: [`E2E reply ${replyName}`],
+    };
+  }
+
+  const countedName = getMarkerValue(text, COUNTED_REPLY_MARKER);
+  if (countedName) {
+    const count = (countedReplies.get(countedName) ?? 0) + 1;
+    countedReplies.set(countedName, count);
+    return {
+      responses: [`E2E counted reply ${countedName} #${count}`],
+    };
+  }
+
+  const slowName = getMarkerValue(text, SLOW_REPLY_MARKER);
+  if (slowName) {
+    const chunks = Array.from(
+      { length: SLOW_REPLY_CHUNKS },
+      (_, index) => `chunk-${String(index).padStart(3, '0')}`,
+    ).join(' ');
+    return {
+      responses: [`E2E slow reply ${slowName} ${chunks}`],
+      sleep: SLOW_CHUNK_DELAY_MS,
+    };
+  }
+
+  const slowCountedName = getMarkerValue(text, SLOW_COUNTED_REPLY_MARKER);
+  if (slowCountedName) {
+    const count = (slowCountedReplies.get(slowCountedName) ?? 0) + 1;
+    slowCountedReplies.set(slowCountedName, count);
+    const chunks = Array.from(
+      { length: SLOW_REPLY_CHUNKS },
+      (_, index) => `chunk-${String(index).padStart(3, '0')}`,
+    ).join(' ');
+    return {
+      responses: [`E2E slow counted reply ${slowCountedName} #${count} ${chunks}`],
+      sleep: SLOW_CHUNK_DELAY_MS,
+    };
+  }
+
+  const resumeIconName = getMarkerValue(text, RESUME_ICON_REPLY_MARKER);
+  if (resumeIconName) {
+    const chunks = Array.from(
+      { length: RESUME_ICON_REPLY_CHUNKS },
+      (_, index) => `chunk-${String(index).padStart(3, '0')}`,
+    ).join(' ');
+    return {
+      responses: [`E2E resume icon reply ${resumeIconName} ${chunks}`],
+      sleep: RESUME_ICON_CHUNK_DELAY_MS,
+    };
+  }
+
+  return null;
+}
+
+/**
+ * Attaches synthetic usage_metadata on a final empty chunk (the OpenAI
+ * streaming pattern) so token-usage SSE events flow end to end in mock runs.
+ */
+class UsageEmittingFakeChatModel extends FakeChatModel {
+  async *_streamResponseChunks(messages, options, runManager) {
+    let outputChars = 0;
+    for await (const chunk of super._streamResponseChunks(messages, options, runManager)) {
+      outputChars += typeof chunk.text === 'string' ? chunk.text.length : 0;
+      yield chunk;
+    }
+    const inputChars = (messages ?? []).reduce(
+      (sum, message) => sum + getContentText(message?.content).length,
+      0,
+    );
+    const input_tokens = Math.max(1, Math.ceil(inputChars / 4));
+    const output_tokens = Math.max(1, Math.ceil(outputChars / 4));
+    yield new ChatGenerationChunk({
+      text: '',
+      message: new AIMessageChunk({
+        content: '',
+        usage_metadata: { input_tokens, output_tokens, total_tokens: input_tokens + output_tokens },
+      }),
+    });
+  }
+}
+
+function overrideModel({ graph, responses, sleep, toolCalls, thrownError }) {
+  if (!thrownError) {
+    graph.overrideModel = new UsageEmittingFakeChatModel({
+      responses,
+      sleep: sleep ?? CHUNK_DELAY_MS,
+      emitCustomEvent: true,
+      toolCalls,
+    });
+    return;
+  }
+
+  class ThrowingFakeChatModel extends FakeChatModel {
+    async *_streamResponseChunks(messages, options, runManager) {
+      yield* super._streamResponseChunks(
+        messages,
+        { ...options, thrownErrorString: thrownError },
+        runManager,
+      );
+    }
+  }
+
+  graph.overrideModel = new ThrowingFakeChatModel({
+    responses,
+    sleep: sleep ?? CHUNK_DELAY_MS,
+    emitCustomEvent: true,
+    toolCalls,
+  });
+}
+
+function modelSpecSkillAssertionResponses({ agents, messages, toolNames }) {
+  const failures = [];
+  const additionalInstructions = collectAdditionalInstructions(agents);
+  const skillPrimeMessages = collectSkillPrimeMessages(messages);
+  const alwaysApplyPrime = skillPrimeMessages.find(
+    (message) => message.name === MODEL_SPEC_ACCESSIBLE_SKILL && message.trigger === 'always-apply',
+  );
+
+  if (!toolNames.has(SKILL_TOOL_NAME)) {
+    failures.push(`${SKILL_TOOL_NAME} tool was not advertised`);
+  }
+  if (!additionalInstructions.includes(MODEL_SPEC_ACCESSIBLE_SKILL)) {
+    failures.push(`${MODEL_SPEC_ACCESSIBLE_SKILL} was not present in the model-visible catalog`);
+  }
+  if (additionalInstructions.includes(MODEL_SPEC_MISSING_SKILL)) {
+    failures.push(`${MODEL_SPEC_MISSING_SKILL} leaked into the model-visible catalog`);
+  }
+  if (additionalInstructions.includes(MODEL_SPEC_INACCESSIBLE_SKILL)) {
+    failures.push(`${MODEL_SPEC_INACCESSIBLE_SKILL} leaked into the model-visible catalog`);
+  }
+  if (!alwaysApplyPrime) {
+    failures.push(`${MODEL_SPEC_ACCESSIBLE_SKILL} was not always-apply primed`);
+  } else if (!alwaysApplyPrime.content.includes(ALWAYS_APPLY_BODY_MARKER)) {
+    failures.push(`${MODEL_SPEC_ACCESSIBLE_SKILL} always-apply body was missing its marker`);
+  }
+  if (skillPrimeMessages.some((message) => message.name === MODEL_SPEC_MISSING_SKILL)) {
+    failures.push(`${MODEL_SPEC_MISSING_SKILL} was unexpectedly primed`);
+  }
+  if (skillPrimeMessages.some((message) => message.name === MODEL_SPEC_INACCESSIBLE_SKILL)) {
+    failures.push(`${MODEL_SPEC_INACCESSIBLE_SKILL} was unexpectedly primed`);
+  }
+
+  if (failures.length > 0) {
+    return {
+      responses: [`E2E model spec skill assertion failed: ${failures.join('; ')}`],
+    };
+  }
+  return {
+    responses: [`${MODEL_SPEC_SKILL_ASSERTION_FINAL_TEXT}: ${MODEL_SPEC_ACCESSIBLE_SKILL}`],
+  };
+}
+
+function buildSkillBody(skillName) {
+  return `---
+name: ${skillName}
+description: ${SKILL_DESCRIPTION}
+---
+
+# ${skillName}
+
+Created by the Playwright mock e2e suite to verify host file authoring without code execution.`;
+}
+
+function buildCreateSkillArgs(skillName) {
+  return {
+    file_path: `skills/${skillName}/SKILL.md`,
+    content: buildSkillBody(skillName),
+    overwrite: false,
+  };
+}
+
+function buildEditSkillArgs(skillName) {
+  return {
+    file_path: `skills/${skillName}/SKILL.md`,
+    old_text: `description: ${SKILL_DESCRIPTION}`,
+    new_text: `description: ${EDITED_SKILL_DESCRIPTION}`,
+  };
+}
+
+/**
+ * Pick the fake-model script for a skill file-authoring turn. The graph runs two
+ * model turns: turn 1 streams the (empty) preamble and emits the tool call, the
+ * tool node writes the SKILL.md, then turn 2 streams the final text. The guards
+ * assert the feature advertised the host file-authoring tool and did NOT enable
+ * code execution.
+ */
+function fileAuthoringResponses(operation, toolNames) {
+  if (!toolNames.has(operation.toolName)) {
+    return {
+      responses: [`E2E file authoring unavailable: ${operation.toolName} was not advertised.`],
+    };
+  }
+  if (toolNames.has(BASH_TOOL_NAME)) {
+    return {
+      responses: [`E2E file authoring unavailable: ${BASH_TOOL_NAME} was unexpectedly advertised.`],
+    };
+  }
+  return {
+    responses: ['', `${operation.finalText}: ${operation.skillName}`],
+    toolCalls: [
+      {
+        id: operation.toolCallId,
+        name: operation.toolName,
+        args: operation.args,
+        type: 'tool_call',
+      },
+    ],
+  };
+}
+
+function resolveResponses({ agents, messages, text, toolNames }) {
+  const reply = replyResponses(text);
+  if (reply) {
+    return reply;
+  }
+
+  const providerFileAssertion = providerFileAssertionResponses({ messages, text });
+  if (providerFileAssertion) {
+    return providerFileAssertion;
+  }
+
+  if (text.includes(ASSERT_MODEL_SPEC_SKILLS_MARKER)) {
+    return modelSpecSkillAssertionResponses({ agents, messages, toolNames });
+  }
+
+  const createSkillName = getRequestedSkillName(text, CREATE_SKILL_MARKER);
+  if (createSkillName) {
+    return fileAuthoringResponses(
+      {
+        skillName: createSkillName,
+        toolName: CREATE_FILE_TOOL_NAME,
+        toolCallId: CREATE_SKILL_TOOL_CALL_ID,
+        finalText: CREATE_FILE_AUTHORING_FINAL_TEXT,
+        args: buildCreateSkillArgs(createSkillName),
+      },
+      toolNames,
+    );
+  }
+
+  const editSkillName = getRequestedSkillName(text, EDIT_SKILL_MARKER);
+  if (editSkillName) {
+    return fileAuthoringResponses(
+      {
+        skillName: editSkillName,
+        toolName: EDIT_FILE_TOOL_NAME,
+        toolCallId: EDIT_SKILL_TOOL_CALL_ID,
+        finalText: EDIT_FILE_AUTHORING_FINAL_TEXT,
+        args: buildEditSkillArgs(editSkillName),
+      },
+      toolNames,
+    );
+  }
+
+  return { responses: [MOCK_REPLY] };
+}
+
+/** @type {import('@librechat/api').TestRunHook} */
+module.exports = function fakeModelHook(run, context) {
+  const graph = run?.Graph;
+  if (!graph || typeof graph.overrideTestModel !== 'function') {
+    console.warn('[e2e] fake-model hook: run.Graph.overrideTestModel unavailable');
+    return;
+  }
+
+  const text = getLatestUserText(context?.messages);
+  const toolNames = collectToolNames(context?.agents);
+  const { responses, sleep, toolCalls, thrownError } = resolveResponses({
+    agents: context?.agents,
+    messages: context?.messages,
+    text,
+    toolNames,
+  });
+  overrideModel({ graph, responses, sleep, toolCalls, thrownError });
+};
diff --git a/e2e/setup/mock-llm-server.js b/e2e/setup/mock-llm-server.js
deleted file mode 100644
index 1aa9ad78a69..00000000000
--- a/e2e/setup/mock-llm-server.js
+++ /dev/null
@@ -1,128 +0,0 @@
-/**
- * OpenAI-compatible mock server for credential-free e2e tests. Answers
- * `${baseURL}/chat/completions` with deterministic content. Run standalone
- * (Playwright `webServer`) or import `startMockLlm()` for programmatic control.
- */
-const http = require('http');
-
-const DEFAULT_PORT = 8889;
-const MOCK_REPLY = process.env.MOCK_LLM_REPLY || 'E2E mock reply: pong';
-const MODEL_FALLBACK = 'mock-model';
-const STREAM_CHUNK_DELAY_MS = Number(process.env.MOCK_LLM_CHUNK_DELAY_MS) || 60;
-
-const delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-
-function readJsonBody(req) {
-  return new Promise((resolve) => {
-    let raw = '';
-    req.on('data', (chunk) => {
-      raw += chunk;
-    });
-    req.on('end', () => {
-      try {
-        resolve(raw ? JSON.parse(raw) : {});
-      } catch {
-        resolve({});
-      }
-    });
-  });
-}
-
-function toChunks(text) {
-  return text.match(/\S+\s*/g) || [text];
-}
-
-async function streamCompletion(res, model) {
-  res.writeHead(200, {
-    'Content-Type': 'text/event-stream',
-    'Cache-Control': 'no-cache',
-    Connection: 'keep-alive',
-  });
-  if (typeof res.flushHeaders === 'function') {
-    res.flushHeaders();
-  }
-
-  const id = 'chatcmpl-e2e-mock';
-  const created = 1700000000;
-  const base = { id, object: 'chat.completion.chunk', created, model };
-
-  const send = (delta, finishReason = null) => {
-    const payload = {
-      ...base,
-      choices: [{ index: 0, delta, finish_reason: finishReason }],
-    };
-    res.write(`data: ${JSON.stringify(payload)}\n\n`);
-  };
-
-  send({ role: 'assistant', content: '' });
-  for (const chunk of toChunks(MOCK_REPLY)) {
-    await delay(STREAM_CHUNK_DELAY_MS);
-    send({ content: chunk });
-  }
-  send({}, 'stop');
-  res.write('data: [DONE]\n\n');
-  res.end();
-}
-
-function jsonCompletion(res, model) {
-  const payload = {
-    id: 'chatcmpl-e2e-mock',
-    object: 'chat.completion',
-    created: 1700000000,
-    model,
-    choices: [
-      {
-        index: 0,
-        message: { role: 'assistant', content: MOCK_REPLY },
-        finish_reason: 'stop',
-      },
-    ],
-    usage: { prompt_tokens: 1, completion_tokens: 1, total_tokens: 2 },
-  };
-  res.writeHead(200, { 'Content-Type': 'application/json' });
-  res.end(JSON.stringify(payload));
-}
-
-async function handleRequest(req, res) {
-  if (req.method === 'GET' && (req.url === '/health' || req.url === '/')) {
-    res.writeHead(200, { 'Content-Type': 'application/json' });
-    res.end(JSON.stringify({ status: 'ok' }));
-    return;
-  }
-
-  if (req.method === 'POST' && req.url && req.url.endsWith('/chat/completions')) {
-    const body = await readJsonBody(req);
-    const model = body.model || MODEL_FALLBACK;
-    if (body.stream) {
-      await streamCompletion(res, model);
-    } else {
-      jsonCompletion(res, model);
-    }
-    return;
-  }
-
-  res.writeHead(404, { 'Content-Type': 'application/json' });
-  res.end(JSON.stringify({ error: 'not found' }));
-}
-
-function startMockLlm(port = Number(process.env.MOCK_LLM_PORT) || DEFAULT_PORT) {
-  const server = http.createServer((req, res) => {
-    handleRequest(req, res).catch(() => {
-      res.writeHead(500, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify({ error: 'mock server error' }));
-    });
-  });
-
-  return new Promise((resolve) => {
-    server.listen(port, '127.0.0.1', () => {
-      console.log(`[e2e] Mock LLM server listening on http://127.0.0.1:${port}`);
-      resolve(server);
-    });
-  });
-}
-
-if (require.main === module) {
-  startMockLlm();
-}
-
-module.exports = { startMockLlm, MOCK_REPLY };
diff --git a/e2e/setup/record.js b/e2e/setup/record.js
index 6bbb1d0c987..70052a2b788 100644
--- a/e2e/setup/record.js
+++ b/e2e/setup/record.js
@@ -8,9 +8,7 @@ const baseURL = process.env.E2E_BASE_URL || 'http://localhost:3080';
 const storageStatePath = path.resolve(rootPath, 'e2e/storageState.json');
 const configTemplatePath = path.resolve(rootPath, 'e2e/config/librechat.e2e.yaml');
 const configPath = path.resolve(rootPath, 'e2e/.generated/librechat.e2e.yaml');
-const defaultMockLlmBaseURL = 'http://127.0.0.1:8889/v1';
-const mockLlmPort = getMockLlmPort();
-const mockLlmBaseURL = `http://127.0.0.1:${mockLlmPort}/v1`;
+const fakeModelHookPath = path.resolve(rootPath, 'e2e/setup/fake-model.js');
 const defaultUser = {
   email: 'testuser@example.com',
   name: 'Test User',
@@ -49,7 +47,8 @@ const rateLimitOverrides = {
 
 const mockOverrides = {
   CONFIG_PATH: configPath,
-  MOCK_LLM_PORT: mockLlmPort,
+  /** Loaded in-process by `@librechat/api`'s `createRun` to swap in a fake model. */
+  LIBRECHAT_TEST_RUN_HOOK: fakeModelHookPath,
   OPENAI_API_KEY: 'user_provided',
   TENANT_ISOLATION_STRICT: 'false',
   OPENID_CLIENT_ID: '',
@@ -75,14 +74,6 @@ const preservedCredentialEnvKeys = new Set([
 ]);
 const npxBin = process.platform === 'win32' ? 'npx.cmd' : 'npx';
 
-function getMockLlmPort() {
-  const port = process.env.MOCK_LLM_PORT || '8889';
-  if (!/^\d+$/.test(port)) {
-    throw new Error('MOCK_LLM_PORT must be a numeric port');
-  }
-  return port;
-}
-
 function appURL(pathname = '') {
   const normalizedBaseURL = baseURL.endsWith('/') ? baseURL : `${baseURL}/`;
   return new URL(pathname.replace(/^\/+/, ''), normalizedBaseURL).toString();
@@ -181,13 +172,8 @@ function formatDate(date) {
 
 function writeRuntimeMockConfig() {
   const template = fs.readFileSync(configTemplatePath, 'utf8');
-
-  if (!template.includes(defaultMockLlmBaseURL)) {
-    throw new Error(`Expected mock config template to include ${defaultMockLlmBaseURL}`);
-  }
-
   fs.mkdirSync(path.dirname(configPath), { recursive: true });
-  fs.writeFileSync(configPath, template.replaceAll(defaultMockLlmBaseURL, mockLlmBaseURL));
+  fs.writeFileSync(configPath, template);
 }
 
 function parseArgs(argv) {
@@ -406,21 +392,6 @@ async function main() {
   try {
     if (options.profile === 'mock') {
       writeRuntimeMockConfig();
-
-      const mockURL = `http://127.0.0.1:${mockLlmPort}/health`;
-      if (!(await waitForURL(mockURL, 1000))) {
-        children.push(
-          spawnProcess(
-            'mock-llm',
-            'node',
-            [path.resolve(rootPath, 'e2e/setup/mock-llm-server.js')],
-            env,
-          ),
-        );
-        if (!(await waitForURL(mockURL, 30000))) {
-          throw new Error(`Mock LLM server did not become ready at ${mockURL}`);
-        }
-      }
     }
 
     if (await waitForURL(baseURL, 1000)) {
diff --git a/e2e/specs/mock/agents.helpers.ts b/e2e/specs/mock/agents.helpers.ts
new file mode 100644
index 00000000000..bf5566f6af8
--- /dev/null
+++ b/e2e/specs/mock/agents.helpers.ts
@@ -0,0 +1,130 @@
+import { expect } from '@playwright/test';
+import type { Page } from '@playwright/test';
+import { MOCK_ENDPOINTS, NEW_CHAT_PATH, fetchJson, getAccessToken, requestJson } from './helpers';
+
+export const AGENT_EDIT_PERMISSION = 2;
+
+export type AgentSummary = {
+  _id: string;
+  id: string;
+  name?: string;
+  description?: string;
+  provider: string;
+  model: string;
+  category?: string;
+};
+
+export type ModelParameters = {
+  maxContextTokens?: number;
+  maxOutputTokens?: number;
+  temperature?: number;
+  topP?: number;
+  topK?: number;
+  thinkingBudget?: number;
+  fileTokenLimit?: number;
+  resendFiles?: boolean;
+  promptCache?: boolean;
+  thinking?: boolean;
+  web_search?: boolean;
+};
+
+export type AgentDetail = AgentSummary & {
+  instructions?: string;
+  model_parameters?: ModelParameters;
+  tools?: string[];
+  mcpServerNames?: string[];
+};
+
+export const uniqueAgentName = (prefix: string) =>
+  `${prefix} ${Date.now()}-${Math.floor(Math.random() * 1e4)}`;
+
+export async function findAgent(
+  page: Page,
+  agentName: string,
+  token: string,
+): Promise<AgentSummary | null> {
+  const body = await fetchJson<{ data?: AgentSummary[] }>(
+    page,
+    `/api/agents?search=${encodeURIComponent(agentName)}&limit=10&requiredPermission=${AGENT_EDIT_PERMISSION}`,
+    token,
+  );
+  return body.data?.find((agent) => agent.name === agentName) ?? null;
+}
+
+export async function waitForPersistedAgent(
+  page: Page,
+  agentName: string,
+  description: string,
+): Promise<AgentDetail> {
+  const token = await getAccessToken(page);
+  let latestAgent: AgentDetail | null = null;
+
+  for (let attempt = 0; attempt < 20; attempt++) {
+    const agent = await findAgent(page, agentName, token);
+    if (agent) {
+      latestAgent = await fetchJson<AgentDetail>(
+        page,
+        `/api/agents/${encodeURIComponent(agent.id)}/expanded`,
+        token,
+      );
+      if (latestAgent.description === description) {
+        return latestAgent;
+      }
+    }
+    await new Promise((resolve) => setTimeout(resolve, 500));
+  }
+
+  expect(latestAgent, `Expected agent "${agentName}" to be persisted`).not.toBeNull();
+  expect(latestAgent?.description).toBe(description);
+  return latestAgent!;
+}
+
+export async function openAgentBuilder(page: Page) {
+  await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+
+  const form = page.getByRole('form', { name: 'Agent configuration form' });
+  const builderVisible = await form
+    .waitFor({ state: 'visible', timeout: 1000 })
+    .then(() => true)
+    .catch(() => false);
+  if (!builderVisible) {
+    const agentBuilderButton = page.getByRole('button', { name: 'Agent Builder' });
+    await expect(agentBuilderButton).toBeVisible();
+    if ((await agentBuilderButton.getAttribute('aria-pressed')) !== 'true') {
+      await agentBuilderButton.click();
+    }
+  }
+  await expect(form).toBeVisible();
+  return form;
+}
+
+export async function selectMockModel(page: Page, clickBackToBuilder = false) {
+  const form = page.getByRole('form', { name: 'Agent configuration form' });
+
+  await form.locator('label[for="provider"] + button').click();
+  await expect(form.getByText('Model Parameters', { exact: true })).toBeVisible();
+
+  await form.getByRole('combobox', { name: 'Provider' }).click();
+  await page.getByRole('option', { name: MOCK_ENDPOINTS[0].label }).click();
+
+  await form.getByRole('combobox', { name: 'Model' }).click();
+  await page.getByRole('option', { name: MOCK_ENDPOINTS[0].model, exact: true }).click();
+
+  if (clickBackToBuilder) {
+    await form.getByRole('button', { name: 'Back to builder' }).click();
+    await expect(page.getByRole('form', { name: 'Agent configuration form' })).toBeVisible();
+  }
+}
+
+export async function cleanupAgent(page: Page, agentId?: string) {
+  if (!agentId) {
+    return;
+  }
+
+  const token = await getAccessToken(page);
+  await requestJson<{ message?: string }>(page, {
+    path: `/api/agents/${encodeURIComponent(agentId)}`,
+    token,
+    method: 'DELETE',
+  });
+}
diff --git a/e2e/specs/mock/agents.spec.ts b/e2e/specs/mock/agents.spec.ts
new file mode 100644
index 00000000000..b066234aafa
--- /dev/null
+++ b/e2e/specs/mock/agents.spec.ts
@@ -0,0 +1,195 @@
+import { expect, test } from '@playwright/test';
+import type { Locator, Page } from '@playwright/test';
+import type { AgentDetail } from './agents.helpers';
+import {
+  cleanupAgent,
+  openAgentBuilder,
+  selectMockModel,
+  uniqueAgentName,
+  waitForPersistedAgent,
+} from './agents.helpers';
+import { MOCK_ENDPOINTS, mockReply, sendMessage } from './helpers';
+
+const DESCRIPTION = 'Use this agent to verify LibreChat agent creation in mock end-to-end tests.';
+const INSTRUCTIONS =
+  'Reply through the mock e2e model and keep this agent available for UI persistence checks.';
+const MODEL_PARAMETERS = {
+  maxContextTokens: 32000,
+  maxOutputTokens: 4096,
+  temperature: 0.25,
+  topP: 0.8,
+  topK: 12,
+  resendFiles: false,
+  promptCache: true,
+  thinking: true,
+  thinkingBudget: 2000,
+  web_search: true,
+  fileTokenLimit: 12000,
+};
+const PERSISTED_MODEL_PARAMETERS = {
+  maxContextTokens: MODEL_PARAMETERS.maxContextTokens,
+  maxOutputTokens: MODEL_PARAMETERS.maxOutputTokens,
+  temperature: MODEL_PARAMETERS.temperature,
+  topP: MODEL_PARAMETERS.topP,
+  topK: MODEL_PARAMETERS.topK,
+  resendFiles: MODEL_PARAMETERS.resendFiles,
+  web_search: MODEL_PARAMETERS.web_search,
+  fileTokenLimit: MODEL_PARAMETERS.fileTokenLimit,
+};
+
+async function setSwitch(form: Locator, name: string, checked: boolean) {
+  const control = form.getByRole('switch', { name, exact: true });
+  await expect(control).toBeVisible();
+  if ((await control.getAttribute('aria-checked')) !== String(checked)) {
+    await control.click();
+  }
+  await expect(control).toHaveAttribute('aria-checked', String(checked));
+}
+
+async function fillAnthropicStyleModelParameters(page: Page) {
+  const form = page.getByRole('form', { name: 'Agent configuration form' });
+
+  await expect(form.getByLabel('Max Context Tokens')).toBeVisible();
+  await expect(form.getByLabel('Max Output Tokens')).toBeVisible();
+  await expect(form.getByText('Temperature', { exact: true })).toBeVisible();
+  await expect(form.getByText('Top P', { exact: true })).toBeVisible();
+  await expect(form.getByText('Top K', { exact: true })).toBeVisible();
+  await expect(form.getByText('Effort', { exact: true })).toBeVisible();
+  await expect(form.getByText('Thought Visibility', { exact: true })).toBeVisible();
+
+  await form
+    .locator('#maxContextTokens-dynamic-input')
+    .fill(`${MODEL_PARAMETERS.maxContextTokens}`);
+  await form.locator('#maxOutputTokens-dynamic-input').fill(`${MODEL_PARAMETERS.maxOutputTokens}`);
+  await form
+    .locator('#temperature-dynamic-setting-input-number')
+    .fill(`${MODEL_PARAMETERS.temperature}`);
+  await form.locator('#topP-dynamic-setting-input-number').fill(`${MODEL_PARAMETERS.topP}`);
+  await form.locator('#topK-dynamic-setting-input-number').fill(`${MODEL_PARAMETERS.topK}`);
+  await form.locator('#thinkingBudget-dynamic-input').fill(`${MODEL_PARAMETERS.thinkingBudget}`);
+  await form.locator('#fileTokenLimit-dynamic-input').fill(`${MODEL_PARAMETERS.fileTokenLimit}`);
+
+  await setSwitch(form, 'Resend Files', MODEL_PARAMETERS.resendFiles);
+  await setSwitch(form, 'Use Prompt Caching', MODEL_PARAMETERS.promptCache);
+  await setSwitch(form, 'Thinking', MODEL_PARAMETERS.thinking);
+  await setSwitch(form, 'Web Search', MODEL_PARAMETERS.web_search);
+
+  // DynamicInput/DynamicSlider values use a 450ms debounced form update.
+  await page.waitForTimeout(600);
+}
+
+async function expectAnthropicStyleModelParameters(page: Page) {
+  const form = page.getByRole('form', { name: 'Agent configuration form' });
+
+  await expect(form.locator('#maxContextTokens-dynamic-input')).toHaveValue(
+    `${MODEL_PARAMETERS.maxContextTokens}`,
+  );
+  await expect(form.locator('#maxOutputTokens-dynamic-input')).toHaveValue(
+    `${MODEL_PARAMETERS.maxOutputTokens}`,
+  );
+  await expect(form.locator('#temperature-dynamic-setting-input-number')).toHaveValue(
+    `${MODEL_PARAMETERS.temperature}`,
+  );
+  await expect(form.locator('#topP-dynamic-setting-input-number')).toHaveValue(
+    MODEL_PARAMETERS.topP.toFixed(2),
+  );
+  await expect(form.locator('#topK-dynamic-setting-input-number')).toHaveValue(
+    `${MODEL_PARAMETERS.topK}`,
+  );
+  await expect(form.locator('#thinkingBudget-dynamic-input')).toHaveValue(
+    `${MODEL_PARAMETERS.thinkingBudget}`,
+  );
+  await expect(form.locator('#fileTokenLimit-dynamic-input')).toHaveValue(
+    `${MODEL_PARAMETERS.fileTokenLimit}`,
+  );
+
+  await expect(form.getByRole('switch', { name: 'Resend Files', exact: true })).toHaveAttribute(
+    'aria-checked',
+    String(MODEL_PARAMETERS.resendFiles),
+  );
+  await expect(
+    form.getByRole('switch', { name: 'Use Prompt Caching', exact: true }),
+  ).toHaveAttribute('aria-checked', String(MODEL_PARAMETERS.promptCache));
+  await expect(form.getByRole('switch', { name: 'Thinking', exact: true })).toHaveAttribute(
+    'aria-checked',
+    String(MODEL_PARAMETERS.thinking),
+  );
+  await expect(form.getByRole('switch', { name: 'Web Search', exact: true })).toHaveAttribute(
+    'aria-checked',
+    String(MODEL_PARAMETERS.web_search),
+  );
+}
+
+test.describe('agent builder', () => {
+  test('creates an agent, persists its configuration, and can chat with it', async ({ page }) => {
+    test.setTimeout(120000);
+
+    const agentName = uniqueAgentName('E2E Agent');
+    let createdAgentId: string | undefined;
+
+    try {
+      let form = await openAgentBuilder(page);
+
+      await form.getByLabel('Agent name').fill(agentName);
+      await form.getByLabel('Agent description').fill(DESCRIPTION);
+      await form.getByLabel('Agent instructions').fill(INSTRUCTIONS);
+
+      await selectMockModel(page);
+      await fillAnthropicStyleModelParameters(page);
+      await page
+        .getByRole('form', { name: 'Agent configuration form' })
+        .getByRole('button', {
+          name: 'Back to builder',
+        })
+        .click();
+      form = page.getByRole('form', { name: 'Agent configuration form' });
+
+      const [createResponse] = await Promise.all([
+        page.waitForResponse(
+          (response) =>
+            response.request().method() === 'POST' &&
+            new URL(response.url()).pathname === '/api/agents' &&
+            response.status() === 201,
+          { timeout: 30000 },
+        ),
+        form.getByRole('button', { name: 'Create' }).click(),
+      ]);
+      const createdAgent = (await createResponse.json()) as AgentDetail;
+      createdAgentId = createdAgent.id;
+
+      await expect(page.getByText(`Successfully created ${agentName}`)).toBeVisible();
+
+      const persistedAgent = await waitForPersistedAgent(page, agentName, DESCRIPTION);
+      expect(persistedAgent).toMatchObject({
+        id: createdAgentId,
+        name: agentName,
+        description: DESCRIPTION,
+        instructions: INSTRUCTIONS,
+        provider: MOCK_ENDPOINTS[0].label,
+        model: MOCK_ENDPOINTS[0].model,
+        category: 'general',
+      });
+      expect(persistedAgent.model_parameters).toMatchObject(PERSISTED_MODEL_PARAMETERS);
+
+      form = await openAgentBuilder(page);
+      await form.getByRole('combobox', { name: 'Agent', exact: true }).click();
+      await page.getByRole('option', { name: agentName }).click();
+
+      await expect(form.getByLabel('Agent name')).toHaveValue(agentName);
+      await expect(form.getByLabel('Agent description')).toHaveValue(DESCRIPTION);
+      await expect(form.getByLabel('Agent instructions')).toHaveValue(INSTRUCTIONS);
+
+      await form.locator('label[for="provider"] + button').click();
+      await expectAnthropicStyleModelParameters(page);
+      await form.getByRole('button', { name: 'Back to builder' }).click();
+
+      await form.getByRole('button', { name: 'Select Agent' }).click();
+
+      const response = await sendMessage(page, `hello from ${agentName}`);
+      expect(response.ok()).toBeTruthy();
+      await expect(mockReply(page)).toBeVisible({ timeout: 30000 });
+    } finally {
+      await cleanupAgent(page, createdAgentId);
+    }
+  });
+});
diff --git a/e2e/specs/mock/app-load.spec.ts b/e2e/specs/mock/app-load.spec.ts
index aadb3ec4dbc..9c5d6865013 100644
--- a/e2e/specs/mock/app-load.spec.ts
+++ b/e2e/specs/mock/app-load.spec.ts
@@ -1,10 +1,12 @@
 import { expect, test } from '@playwright/test';
+import { getPrimaryE2EUser } from '../../setup/users.mock';
 import { NEW_CHAT_PATH } from './helpers';
 
 test.describe('app loads cleanly', () => {
   test('authenticated user lands on a rendered chat view without runtime errors', async ({
     page,
   }) => {
+    const user = getPrimaryE2EUser();
     const pageErrors: string[] = [];
     page.on('pageerror', (error) => pageErrors.push(error.message));
 
@@ -12,6 +14,7 @@ test.describe('app loads cleanly', () => {
 
     await expect(page).toHaveURL(/\/c\/new$/);
     await expect(page.getByRole('main')).toBeVisible();
+    await expect(page.getByRole('main')).toContainText(user.name);
     await expect(page.getByRole('textbox', { name: 'Message input' })).toBeVisible();
     await expect(page.getByRole('button', { name: 'Select a model' }).first()).toBeVisible();
     await expect(page.getByTestId('nav-user')).toBeVisible();
diff --git a/e2e/specs/mock/auth.spec.ts b/e2e/specs/mock/auth.spec.ts
index d965d4270f8..7443a64fe91 100644
--- a/e2e/specs/mock/auth.spec.ts
+++ b/e2e/specs/mock/auth.spec.ts
@@ -5,6 +5,26 @@ import { getSecondaryE2EUser } from '../../setup/users.mock';
 import cleanupUser from '../../setup/cleanupUser';
 import { NEW_CHAT_PATH } from './helpers';
 
+type AuthRecoveryTestEvent = {
+  type: string;
+  detail: unknown;
+};
+
+type AuthRecoveryTestWindow = Window & {
+  __authRecoveryTestEvents: AuthRecoveryTestEvent[];
+};
+
+type RefreshTokenBody = {
+  token?: string;
+};
+
+function createJwt(expiresAtMs: number) {
+  const payload = Buffer.from(JSON.stringify({ exp: Math.floor(expiresAtMs / 1000) })).toString(
+    'base64url',
+  );
+  return `header.${payload}.signature`;
+}
+
 async function getIsolatedStorageState(request: APIRequestContext, user: User) {
   await cleanupUser(user);
 
@@ -79,4 +99,83 @@ test.describe('auth session', () => {
       await cleanupUser(user);
     }
   });
+
+  test('recovers from an expired bearer during app bootstrap without redirect looping', async ({
+    page,
+  }) => {
+    test.setTimeout(30000);
+
+    const expiredToken = createJwt(Date.now() - 60_000);
+    const expiredBearerPaths: string[] = [];
+    let refreshCalls = 0;
+
+    await page.addInitScript(() => {
+      const testWindow = window as AuthRecoveryTestWindow;
+      testWindow.__authRecoveryTestEvents = [];
+      window.addEventListener('authRecovery', (event) => {
+        testWindow.__authRecoveryTestEvents.push({
+          type: 'authRecovery',
+          detail: (event as CustomEvent).detail,
+        });
+      });
+      window.addEventListener('authRedirectStarted', (event) => {
+        testWindow.__authRecoveryTestEvents.push({
+          type: 'authRedirectStarted',
+          detail: (event as CustomEvent).detail,
+        });
+      });
+    });
+
+    await page.route('**/api/**', async (route) => {
+      const request = route.request();
+      const pathname = new URL(request.url()).pathname;
+
+      if (pathname === '/api/auth/refresh') {
+        refreshCalls += 1;
+        const response = await route.fetch();
+        if (refreshCalls === 1) {
+          const body = (await response.json()) as RefreshTokenBody;
+          await route.fulfill({
+            response,
+            json: {
+              ...body,
+              token: expiredToken,
+            },
+          });
+          return;
+        }
+
+        await route.fulfill({ response });
+        return;
+      }
+
+      if (request.headers().authorization === `Bearer ${expiredToken}`) {
+        expiredBearerPaths.push(pathname);
+        await route.fulfill({
+          status: 401,
+          contentType: 'application/json',
+          json: { message: 'jwt expired' },
+        });
+        return;
+      }
+
+      await route.continue();
+    });
+
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+
+    await expect(page).not.toHaveURL(/\/login/);
+    await expect(page.getByRole('textbox', { name: 'Message input' })).toBeVisible();
+    await expect.poll(() => refreshCalls).toBe(2);
+    expect(expiredBearerPaths.length).toBeGreaterThan(0);
+
+    const events = await page.evaluate(
+      () => (window as AuthRecoveryTestWindow).__authRecoveryTestEvents,
+    );
+
+    expect(events.filter((event) => event.type === 'authRedirectStarted')).toHaveLength(0);
+    expect(
+      events.filter((event) => event.type === 'authRecovery').map((event) => event.detail),
+    ).toEqual([{ state: 'started' }, { state: 'finished' }]);
+  });
 });
diff --git a/e2e/specs/mock/chat.spec.ts b/e2e/specs/mock/chat.spec.ts
index 60a45d5310e..da72bdf161b 100644
--- a/e2e/specs/mock/chat.spec.ts
+++ b/e2e/specs/mock/chat.spec.ts
@@ -1,12 +1,85 @@
 import { expect, test } from '@playwright/test';
+import type { Page } from '@playwright/test';
 import {
+  isAgentsStream,
   MOCK_ENDPOINTS,
   NEW_CHAT_PATH,
+  messagesView,
   mockReply,
+  replyText,
+  replyPrompt,
   selectMockEndpoint,
   sendMessage,
 } from './helpers';
 
+type UploadFixture = {
+  name: string;
+  mimeType: string;
+  buffer: Buffer;
+};
+
+const pdfFixture: UploadFixture = {
+  name: 'provider-context.pdf',
+  mimeType: 'application/pdf',
+  buffer: Buffer.from(
+    `%PDF-1.4
+1 0 obj
+<< /Type /Catalog /Pages 2 0 R >>
+endobj
+2 0 obj
+<< /Type /Pages /Count 0 >>
+endobj
+trailer
+<< /Root 1 0 R >>
+%%EOF
+`,
+  ),
+};
+
+const textFixture: UploadFixture = {
+  name: 'provider-context.txt',
+  mimeType: 'text/plain',
+  buffer: Buffer.from('This text attachment should be available to the mock model.\n'),
+};
+
+const imageFixture: UploadFixture = {
+  name: 'provider-context.png',
+  mimeType: 'image/png',
+  buffer: Buffer.from(
+    'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+/p9sAAAAASUVORK5CYII=',
+    'base64',
+  ),
+};
+
+const composer = (page: Page) => page.locator('form');
+
+async function openProviderFileChooser(page: Page) {
+  await page.getByRole('button', { name: 'Attach File Options' }).click();
+  await expect(page.getByText('Upload to Provider')).toBeVisible();
+
+  const fileChooserPromise = page.waitForEvent('filechooser');
+  await page.getByText('Upload to Provider').click();
+  const fileChooser = await fileChooserPromise;
+  expect(await fileChooser.element().getAttribute('type')).toBe('file');
+  return fileChooser;
+}
+
+async function uploadProviderFile(page: Page, fixture: UploadFixture) {
+  const fileChooser = await openProviderFileChooser(page);
+  const uploadResponsePromise = page.waitForResponse(
+    (response) =>
+      response.url().includes('/api/files') &&
+      response.request().method() === 'POST' &&
+      response.status() === 200,
+    { timeout: 30000 },
+  );
+  await fileChooser.setFiles(fixture);
+  const uploadResponse = await uploadResponsePromise;
+  expect(uploadResponse.ok()).toBeTruthy();
+  await page.waitForTimeout(350);
+  return uploadResponse;
+}
+
 test.describe('core chat loop', () => {
   test('streams a response, saves the conversation, and persists across reload', async ({
     page,
@@ -21,6 +94,11 @@ test.describe('core chat loop', () => {
     expect(response.ok()).toBeTruthy();
 
     await expect(page.getByText(userMessage)).toBeVisible();
+    const userMessageTurn = messagesView(page)
+      .locator('.message-render')
+      .filter({ hasText: userMessage });
+    await expect(userMessageTurn.locator('.user-turn')).toBeVisible();
+    await expect(userMessageTurn.locator('.agent-turn')).toHaveCount(0);
     await expect(mockReply(page)).toBeVisible();
 
     await expect(page).toHaveURL(/\/c\/[0-9a-fA-F-]{36}$/);
@@ -34,4 +112,285 @@ test.describe('core chat loop', () => {
     await expect(mockReply(page)).toBeVisible();
     await expect(page.getByTestId('convo-item').first()).toBeVisible();
   });
+
+  test('keeps send disabled until the composer has message text', async ({ page }) => {
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+
+    const input = page.getByRole('textbox', { name: 'Message input' });
+    const sendButton = page.getByTestId('send-button');
+
+    await expect(sendButton).toBeDisabled();
+    await input.fill('ready to send');
+    await expect(sendButton).toBeEnabled();
+    await input.fill('   ');
+    await expect(sendButton).toBeDisabled();
+  });
+
+  test('renders assistant markdown and syntax-highlighted code blocks', async ({ page }) => {
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+
+    const response = await sendMessage(page, 'E2E_MARKDOWN_REPLY');
+    expect(response.ok()).toBeTruthy();
+
+    const assistantMessage = messagesView(page)
+      .locator('.message-render')
+      .filter({ hasText: 'E2E markdown heading' })
+      .last();
+    await expect(assistantMessage.locator('.agent-turn')).toBeVisible();
+    await expect(
+      assistantMessage.getByRole('heading', { name: 'E2E markdown heading' }),
+    ).toBeVisible();
+    await expect(
+      assistantMessage.locator('strong').filter({ hasText: 'E2E bold text' }),
+    ).toBeVisible();
+    await expect(
+      assistantMessage.getByRole('listitem').filter({ hasText: 'E2E list item' }),
+    ).toBeVisible();
+
+    const codeBlock = assistantMessage.locator('code').filter({ hasText: 'e2eSyntaxHighlight' });
+    await expect(codeBlock).toBeVisible();
+    await expect(codeBlock).toHaveClass(/hljs/);
+    await expect(codeBlock).toHaveClass(/language-javascript/);
+  });
+
+  test('can switch back to the previous branch after regenerating an earlier response', async ({
+    page,
+  }) => {
+    test.setTimeout(90000);
+    const firstMessage = 'branch root from e2e';
+    const followUpMessage = 'follow-up on original branch from e2e';
+
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+
+    let response = await sendMessage(page, firstMessage);
+    expect(response.ok()).toBeTruthy();
+    await expect(mockReply(page)).toBeVisible();
+
+    response = await sendMessage(page, followUpMessage);
+    expect(response.ok()).toBeTruthy();
+    await expect(page.getByText(followUpMessage)).toBeVisible();
+
+    const firstAssistantMessage = messagesView(page).locator('.message-render').nth(1);
+    await firstAssistantMessage.hover();
+    const regenerateButton = firstAssistantMessage.locator('button[title="Regenerate"]').last();
+    await expect(regenerateButton).toBeVisible();
+
+    const [regenerateResponse] = await Promise.all([
+      page.waitForResponse(isAgentsStream, { timeout: 30000 }),
+      regenerateButton.click(),
+    ]);
+    expect(regenerateResponse.ok()).toBeTruthy();
+
+    await expect(page.getByText('2 / 2')).toBeVisible();
+    await page.getByRole('button', { name: 'Previous sibling message' }).click();
+    await expect(page.getByText('1 / 2')).toBeVisible();
+    await expect(page.getByText(followUpMessage)).toBeVisible();
+  });
+
+  test('keeps the viewed branch when regenerating its latest response with an earlier branch present', async ({
+    page,
+  }) => {
+    test.setTimeout(120000);
+    const firstMessage = 'first turn from e2e';
+    const secondMessage = 'second turn from e2e';
+
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+
+    let response = await sendMessage(page, firstMessage);
+    expect(response.ok()).toBeTruthy();
+    await expect(mockReply(page).first()).toBeVisible();
+    response = await sendMessage(page, secondMessage);
+    expect(response.ok()).toBeTruthy();
+    await expect(page.getByText(secondMessage)).toBeVisible();
+
+    // Regenerate the INITIAL response → a second root-level branch the second
+    // turn does not belong to.
+    const firstAssistant = messagesView(page).locator('.message-render').nth(1);
+    await firstAssistant.hover();
+    const regenInitial = firstAssistant.locator('button[title="Regenerate"]').last();
+    await expect(regenInitial).toBeVisible();
+    [response] = await Promise.all([
+      page.waitForResponse(isAgentsStream, { timeout: 30000 }),
+      regenInitial.click(),
+    ]);
+    expect(response.ok()).toBeTruthy();
+    await expect(page.getByText('2 / 2')).toBeVisible();
+    await expect(page.getByText(secondMessage)).toHaveCount(0);
+
+    // Back to the ORIGINAL branch (both turns present).
+    await page.getByRole('button', { name: 'Previous sibling message' }).click();
+    await expect(page.getByText('1 / 2')).toBeVisible();
+    await expect(page.getByText(secondMessage)).toBeVisible();
+
+    // Regenerate the LATEST response on the original branch. The bug snapped the
+    // root fork back to the newest (regenerated-initial) branch, dropping the
+    // original thread; the view must stay put.
+    const latestAssistant = messagesView(page).locator('.message-render').last();
+    await latestAssistant.hover();
+    const regenLatest = latestAssistant.locator('button[title="Regenerate"]').last();
+    await expect(regenLatest).toBeVisible();
+    [response] = await Promise.all([
+      page.waitForResponse(isAgentsStream, { timeout: 30000 }),
+      regenLatest.click(),
+    ]);
+    expect(response.ok()).toBeTruthy();
+
+    // Still on the original branch: the second turn survives and the root fork
+    // still reads 1 / 2 (rather than snapping to the regenerated-initial branch).
+    await expect(page.getByText(secondMessage)).toBeVisible();
+    await expect(page.getByText('1 / 2')).toBeVisible();
+  });
+
+  test('preserves a long original branch when regenerating early then later on it', async ({
+    page,
+  }) => {
+    test.setTimeout(150000);
+    // Labeled prompts give each turn a unique reply, so we can both settle on
+    // it (turn complete) and assert which branch is visible.
+    const turns = [
+      { prompt: replyPrompt('lb-one'), reply: replyText('lb-one') },
+      { prompt: replyPrompt('lb-two'), reply: replyText('lb-two') },
+      { prompt: replyPrompt('lb-three'), reply: replyText('lb-three') },
+    ];
+
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+
+    // Build a three-turn thread (the "long running thread"), waiting for each
+    // turn's unique reply to render before sending the next.
+    for (const turn of turns) {
+      const response = await sendMessage(page, turn.prompt);
+      expect(response.ok()).toBeTruthy();
+      await expect(messagesView(page).getByText(turn.reply)).toBeVisible({ timeout: 30000 });
+    }
+
+    // Regenerate from an EARLIER part of the branch (the first response). This
+    // forks a fresh root branch that does not contain the later turns.
+    const earlyAssistant = messagesView(page).locator('.message-render').nth(1);
+    await earlyAssistant.hover();
+    const regenEarly = earlyAssistant.locator('button[title="Regenerate"]').last();
+    await expect(regenEarly).toBeVisible();
+    let [response] = await Promise.all([
+      page.waitForResponse(isAgentsStream, { timeout: 30000 }),
+      regenEarly.click(),
+    ]);
+    expect(response.ok()).toBeTruthy();
+    await expect(page.getByText('2 / 2')).toBeVisible();
+    // The fresh branch does not contain the later turns' replies.
+    await expect(messagesView(page).getByText(turns[1].reply)).toHaveCount(0);
+    await expect(messagesView(page).getByText(turns[2].reply)).toHaveCount(0);
+
+    // Go back to the ORIGINAL branch — all three turns are present again.
+    await page.getByRole('button', { name: 'Previous sibling message' }).click();
+    await expect(page.getByText('1 / 2')).toBeVisible();
+    await expect(messagesView(page).getByText(turns[1].reply)).toBeVisible();
+    await expect(messagesView(page).getByText(turns[2].reply)).toBeVisible();
+
+    // Regenerate from LATER in the original branch (its latest response). The
+    // bug snapped the early fork back to the regenerated branch, collapsing the
+    // long original thread; it must stay intact.
+    const lateAssistant = messagesView(page).locator('.message-render').last();
+    await lateAssistant.hover();
+    const regenLate = lateAssistant.locator('button[title="Regenerate"]').last();
+    await expect(regenLate).toBeVisible();
+    [response] = await Promise.all([
+      page.waitForResponse(isAgentsStream, { timeout: 30000 }),
+      regenLate.click(),
+    ]);
+    expect(response.ok()).toBeTruthy();
+
+    // The whole original branch survives and its first fork still reads 1 / 2.
+    await expect(messagesView(page).getByText(turns[1].reply)).toBeVisible();
+    await expect(page.getByText('1 / 2')).toBeVisible();
+  });
+
+  test('keeps upload-to-provider CSV attached to the sent message and model input', async ({
+    page,
+  }) => {
+    test.setTimeout(90000);
+
+    const csvFixture: UploadFixture = {
+      name: 'provider-upload.csv',
+      mimeType: 'text/csv',
+      buffer: Buffer.from('name,value\nalpha,1\n'),
+    };
+    const filename = csvFixture.name;
+    const assertionText = `E2E_ASSERT_PROVIDER_FILE:${filename}`;
+    const fileChip = messagesView(page).getByRole('button', { name: filename });
+
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+
+    await uploadProviderFile(page, csvFixture);
+
+    await expect(page.getByRole('button', { name: filename })).toBeVisible();
+
+    const input = page.getByRole('textbox', { name: 'Message input' });
+    await input.click();
+    await input.fill(assertionText);
+    await expect(page.getByTestId('send-button')).toBeEnabled();
+
+    const [response] = await Promise.all([
+      page.waitForResponse(isAgentsStream, { timeout: 30000 }),
+      page.getByTestId('send-button').click(),
+    ]);
+    expect(response.ok()).toBeTruthy();
+
+    await expect(
+      messagesView(page).getByText(`E2E provider file assertion passed: ${filename}`),
+    ).toBeVisible();
+    await expect(fileChip).toBeVisible();
+
+    await expect(page).toHaveURL(/\/c\/[0-9a-fA-F-]{36}$/);
+    const conversationUrl = page.url();
+    await page.reload({ timeout: 10000 });
+    await expect(page).toHaveURL(conversationUrl);
+    await expect(fileChip).toBeVisible();
+  });
+
+  test('supports attaching, removing, and sending provider files from the composer', async ({
+    page,
+  }) => {
+    test.setTimeout(90000);
+
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+
+    await uploadProviderFile(page, pdfFixture);
+    const pdfChip = composer(page).getByRole('button', { name: pdfFixture.name });
+    await expect(pdfChip).toBeVisible();
+
+    await composer(page).getByRole('button', { name: 'Remove file' }).click();
+    await expect(pdfChip).toHaveCount(0);
+
+    await uploadProviderFile(page, imageFixture);
+    await expect(
+      composer(page).getByRole('button', { name: 'View Preview image in full size' }),
+    ).toBeVisible();
+
+    await uploadProviderFile(page, textFixture);
+    const textChip = composer(page).getByRole('button', { name: textFixture.name });
+    await expect(textChip).toBeVisible();
+
+    const assertionText = `E2E_ASSERT_PROVIDER_FILE:${textFixture.name}`;
+    const input = page.getByRole('textbox', { name: 'Message input' });
+    await input.click();
+    await input.fill(assertionText);
+    await expect(page.getByTestId('send-button')).toBeEnabled();
+
+    const [response] = await Promise.all([
+      page.waitForResponse(isAgentsStream, { timeout: 30000 }),
+      page.getByTestId('send-button').click(),
+    ]);
+    expect(response.ok()).toBeTruthy();
+
+    await expect(
+      messagesView(page).getByText(`E2E provider file assertion passed: ${textFixture.name}`),
+    ).toBeVisible();
+    await expect(messagesView(page).getByRole('button', { name: textFixture.name })).toBeVisible();
+  });
 });
diff --git a/e2e/specs/mock/conversation-management.spec.ts b/e2e/specs/mock/conversation-management.spec.ts
new file mode 100644
index 00000000000..c289aa16997
--- /dev/null
+++ b/e2e/specs/mock/conversation-management.spec.ts
@@ -0,0 +1,120 @@
+import { expect, test } from '@playwright/test';
+import type { Locator, Page } from '@playwright/test';
+import {
+  MOCK_ENDPOINTS,
+  NEW_CHAT_PATH,
+  messagesView,
+  replyPrompt,
+  replyText,
+  selectMockEndpoint,
+  sendMessage,
+} from './helpers';
+
+const firstConversation = (page: Page) => page.getByTestId('convo-item').first();
+
+function uniqueLabel(prefix: string) {
+  return `${prefix}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+}
+
+async function openMockChat(page: Page) {
+  await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+  await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+}
+
+async function sendAndExpectReply(page: Page, label: string) {
+  const prompt = replyPrompt(label);
+  const reply = replyText(label);
+  const response = await sendMessage(page, prompt);
+  expect(response.ok()).toBeTruthy();
+  await expect(messagesView(page).getByText(prompt)).toBeVisible();
+  await expect(messagesView(page).getByText(reply)).toBeVisible();
+  return { prompt, reply };
+}
+
+async function openConversationMenu(conversation: Locator) {
+  await conversation.hover();
+  await conversation.getByRole('button', { name: 'Conversation Menu Options' }).click();
+}
+
+async function renameConversation(page: Page, conversation: Locator, title: string) {
+  await openConversationMenu(conversation);
+  await page.getByRole('menuitem', { name: 'Rename' }).click();
+  const titleInput = conversation.getByRole('textbox', { name: 'New Conversation Title' });
+  await expect(titleInput).toBeVisible();
+  await titleInput.fill(title);
+  await conversation.getByRole('button', { name: 'Save' }).click();
+  await expect(conversation).toContainText(title);
+}
+
+test.describe('conversation management', () => {
+  test('loads a past sidebar conversation with its message history', async ({ page }) => {
+    const firstLabel = uniqueLabel('sidebar-history-first');
+    const secondLabel = uniqueLabel('sidebar-history-second');
+
+    await openMockChat(page);
+    const firstTurn = await sendAndExpectReply(page, firstLabel);
+    const secondTurn = await sendAndExpectReply(page, secondLabel);
+    const conversationUrl = page.url();
+
+    await expect(page).toHaveURL(/\/c\/[0-9a-fA-F-]{36}$/);
+    await expect(firstConversation(page)).toBeVisible();
+
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await expect(page).toHaveURL(/\/c\/new$/);
+    await expect(messagesView(page).getByText(firstTurn.prompt)).toHaveCount(0);
+    await expect(messagesView(page).getByText(secondTurn.prompt)).toHaveCount(0);
+
+    await firstConversation(page).click();
+    await expect(page).toHaveURL(conversationUrl);
+    await expect(messagesView(page).getByText(firstTurn.prompt)).toBeVisible();
+    await expect(messagesView(page).getByText(firstTurn.reply)).toBeVisible();
+    await expect(messagesView(page).getByText(secondTurn.prompt)).toBeVisible();
+    await expect(messagesView(page).getByText(secondTurn.reply)).toBeVisible();
+  });
+
+  test('renames a conversation from the sidebar', async ({ page }) => {
+    const label = uniqueLabel('sidebar-rename');
+    const renamedTitle = `Renamed ${label}`;
+
+    await openMockChat(page);
+    await sendAndExpectReply(page, label);
+
+    await renameConversation(page, firstConversation(page), renamedTitle);
+    await page.reload({ timeout: 10000 });
+    await expect(page.getByTestId('convo-item').filter({ hasText: renamedTitle })).toBeVisible();
+  });
+
+  test('deletes a conversation from the sidebar and blocks direct URL access', async ({ page }) => {
+    const label = uniqueLabel('sidebar-delete');
+    const renamedTitle = `Delete ${label}`;
+
+    await openMockChat(page);
+    const turn = await sendAndExpectReply(page, label);
+    const conversationUrl = page.url();
+
+    const conversation = firstConversation(page);
+    await renameConversation(page, conversation, renamedTitle);
+    await openConversationMenu(conversation);
+    await page.getByRole('menuitem', { name: 'Delete' }).click();
+
+    const dialog = page.getByRole('dialog', { name: 'Delete chat?' });
+    await expect(dialog).toBeVisible();
+    const [deleteResponse] = await Promise.all([
+      page.waitForResponse(
+        (response) =>
+          response.request().method() === 'DELETE' && response.url().includes('/api/convos'),
+        { timeout: 30000 },
+      ),
+      dialog.getByRole('button', { name: 'Delete' }).click(),
+    ]);
+    expect(deleteResponse.ok()).toBeTruthy();
+
+    await expect(page).toHaveURL(/\/c\/new$/);
+    await expect(page.getByTestId('convo-item').filter({ hasText: renamedTitle })).toHaveCount(0);
+
+    await page.goto(conversationUrl, { timeout: 10000 });
+    await expect(page.getByRole('textbox', { name: 'Message input' })).toBeVisible();
+    await expect(messagesView(page).getByText(turn.prompt)).toHaveCount(0);
+    await expect(messagesView(page).getByText(turn.reply)).toHaveCount(0);
+  });
+});
diff --git a/e2e/specs/mock/deployment-skills.spec.ts b/e2e/specs/mock/deployment-skills.spec.ts
new file mode 100644
index 00000000000..c5c98e29268
--- /dev/null
+++ b/e2e/specs/mock/deployment-skills.spec.ts
@@ -0,0 +1,218 @@
+import { expect, test } from '@playwright/test';
+import type { Page } from '@playwright/test';
+import { NEW_CHAT_PATH } from './helpers';
+
+const DEPLOYMENT_SKILL_NAME = 'e2e-deployment-skill';
+const DEPLOYMENT_SKILL_DESCRIPTION =
+  'Use this deployment skill to verify shared skills load during Playwright startup.';
+
+type RefreshTokenBody = {
+  token?: string;
+};
+
+type SkillSummary = {
+  _id: string;
+  name: string;
+  description: string;
+  source?: string;
+  sourceMetadata?: Record<string, unknown>;
+  fileCount?: number;
+  alwaysApply?: boolean;
+  isPublic?: boolean;
+};
+
+type SkillDetail = SkillSummary & {
+  body: string;
+  frontmatter?: Record<string, unknown>;
+};
+
+type SkillFile = {
+  _id: string;
+  skillId: string;
+  relativePath: string;
+  file_id: string;
+  filename: string;
+  filepath: string;
+  source: string;
+  mimeType: string;
+  bytes: number;
+  category: string;
+  isExecutable: boolean;
+  author: string;
+  createdAt: string;
+  updatedAt: string;
+  content?: string;
+};
+
+type SkillFileContent = Pick<
+  SkillFile,
+  'relativePath' | 'filename' | 'mimeType' | 'bytes' | 'content'
+> & {
+  isBinary?: boolean;
+};
+
+type ApiResult<T> = {
+  ok: boolean;
+  status: number;
+  text: string;
+  json: T | null;
+};
+
+async function getAccessToken(page: Page): Promise<string> {
+  const result = await page.evaluate(async () => {
+    const response = await fetch('/api/auth/refresh', {
+      method: 'POST',
+      credentials: 'include',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({}),
+    });
+    const text = await response.text();
+    let json: unknown = null;
+    try {
+      json = text ? JSON.parse(text) : null;
+    } catch {
+      json = null;
+    }
+    return { ok: response.ok, status: response.status, text, json };
+  });
+
+  if (!result.ok) {
+    throw new Error(
+      `Expected /api/auth/refresh to return 2xx, got ${result.status}: ${result.text}`,
+    );
+  }
+
+  const body = result.json as RefreshTokenBody | null;
+  if (!body?.token) {
+    throw new Error(`Expected /api/auth/refresh to return a token, got: ${result.text}`);
+  }
+
+  return body.token;
+}
+
+async function apiJson<T>(
+  page: Page,
+  path: string,
+  token: string,
+  init: { method?: string; body?: unknown } = {},
+): Promise<ApiResult<T>> {
+  return page.evaluate(
+    async ({ accessToken, body, method, urlPath }) => {
+      const headers: Record<string, string> = { Authorization: `Bearer ${accessToken}` };
+      if (body !== undefined) {
+        headers['Content-Type'] = 'application/json';
+      }
+      const response = await fetch(urlPath, {
+        method,
+        credentials: 'include',
+        headers,
+        body: body === undefined ? undefined : JSON.stringify(body),
+      });
+      const text = await response.text();
+      let json: unknown = null;
+      try {
+        json = text ? JSON.parse(text) : null;
+      } catch {
+        json = null;
+      }
+      return { ok: response.ok, status: response.status, text, json };
+    },
+    {
+      accessToken: token,
+      body: init.body,
+      method: init.method,
+      urlPath: path,
+    },
+  ) as Promise<ApiResult<T>>;
+}
+
+async function fetchJson<T>(page: Page, path: string, token: string): Promise<T> {
+  const result = await apiJson<T>(page, path, token);
+  if (!result.ok) {
+    throw new Error(`Expected ${path} to return 2xx, got ${result.status}: ${result.text}`);
+  }
+  return result.json as T;
+}
+
+test.describe('deployment skills', () => {
+  test('loads configured deployment skills for every authenticated user as read-only', async ({
+    page,
+  }) => {
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    const token = await getAccessToken(page);
+
+    const list = await fetchJson<{ skills?: SkillSummary[] }>(
+      page,
+      `/api/skills?search=${encodeURIComponent(DEPLOYMENT_SKILL_NAME)}&limit=10`,
+      token,
+    );
+    const skill = list.skills?.find((item) => item.name === DEPLOYMENT_SKILL_NAME);
+    expect(skill).toMatchObject({
+      name: DEPLOYMENT_SKILL_NAME,
+      description: DEPLOYMENT_SKILL_DESCRIPTION,
+      source: 'deployment',
+      sourceMetadata: { deployment: true },
+      fileCount: 1,
+      alwaysApply: true,
+      isPublic: true,
+    });
+
+    const detail = await fetchJson<SkillDetail>(
+      page,
+      `/api/skills/${encodeURIComponent(skill!._id)}`,
+      token,
+    );
+    expect(detail.body).toContain('E2E deployment skill loaded through Playwright');
+    expect(detail.frontmatter).toMatchObject({
+      name: DEPLOYMENT_SKILL_NAME,
+      description: DEPLOYMENT_SKILL_DESCRIPTION,
+      'always-apply': true,
+    });
+
+    const files = await fetchJson<{ files?: SkillFile[] }>(
+      page,
+      `/api/skills/${encodeURIComponent(skill!._id)}/files`,
+      token,
+    );
+    expect(files.files).toHaveLength(1);
+    expect(files.files?.[0]).toMatchObject({
+      skillId: skill!._id,
+      relativePath: 'guide.txt',
+      filename: 'guide.txt',
+      source: 'deployment',
+      mimeType: 'text/plain',
+      bytes: 'deployment skill file fixture\n'.length,
+      category: 'other',
+      isExecutable: false,
+    });
+    expect(files.files?.[0]).not.toHaveProperty('content');
+
+    const downloaded = await fetchJson<SkillFileContent>(
+      page,
+      `/api/skills/${encodeURIComponent(skill!._id)}/files/guide.txt`,
+      token,
+    );
+    expect(downloaded).toMatchObject({
+      relativePath: 'guide.txt',
+      filename: 'guide.txt',
+      mimeType: 'text/plain',
+      bytes: 'deployment skill file fixture\n'.length,
+      isBinary: false,
+      content: 'deployment skill file fixture\n',
+    });
+
+    const patch = await apiJson<{ message?: string }>(
+      page,
+      `/api/skills/${encodeURIComponent(skill!._id)}`,
+      token,
+      {
+        method: 'PATCH',
+        body: {
+          description: 'Deployment skills should stay read-only.',
+        },
+      },
+    );
+    expect(patch.status).toBe(403);
+    expect(patch.json).toMatchObject({ message: 'Deployment skills are read-only' });
+  });
+});
diff --git a/e2e/specs/mock/enforced-model-specs.spec.ts b/e2e/specs/mock/enforced-model-specs.spec.ts
new file mode 100644
index 00000000000..d8f9ad1abbe
--- /dev/null
+++ b/e2e/specs/mock/enforced-model-specs.spec.ts
@@ -0,0 +1,170 @@
+import { randomUUID } from 'crypto';
+import { expect, test } from '@playwright/test';
+import type { Page } from '@playwright/test';
+import {
+  MOCK_ENDPOINTS,
+  NEW_CHAT_PATH,
+  getAccessToken,
+  messagesView,
+  replyPrompt,
+  replyText,
+  requestJson,
+  selectModelSpec,
+  sendMessage,
+} from './helpers';
+
+const NO_PARENT = '00000000-0000-0000-0000-000000000000';
+const ENFORCED_SPEC_NAME = 'e2e-mock-provider-a';
+const ENFORCED_SPEC_LABEL = 'Mock Provider A';
+
+type AgentStartResponse = {
+  conversationId: string;
+  streamId: string;
+  status: string;
+};
+
+async function createProject(page: Page, name: string): Promise<string> {
+  await page.goto('/projects', { timeout: 10000 });
+  await page.getByRole('button', { name: 'New project' }).first().click();
+
+  const dialog = page.getByRole('dialog');
+  await dialog.getByRole('textbox', { name: 'Project name' }).fill(name);
+  await dialog.getByRole('button', { name: 'Create project' }).click();
+
+  await expect(page.getByRole('heading', { name })).toBeVisible();
+  const projectId = new URL(page.url()).pathname.split('/projects/')[1];
+  expect(projectId).toBeTruthy();
+  return projectId;
+}
+
+const uniqueName = (prefix: string) => `${prefix} ${Date.now()}-${Math.floor(Math.random() * 1e4)}`;
+
+async function waitForStreamReply(page: Page, token: string, streamId: string, expected: string) {
+  await page.evaluate(
+    async ({ accessToken, expectedText, currentStreamId }) => {
+      const controller = new AbortController();
+      const timeout = window.setTimeout(() => controller.abort(), 60000);
+      let buffered = '';
+
+      try {
+        const response = await fetch(
+          `/api/agents/chat/stream/${encodeURIComponent(currentStreamId)}?resume=true`,
+          {
+            method: 'GET',
+            credentials: 'include',
+            headers: { Authorization: `Bearer ${accessToken}` },
+            signal: controller.signal,
+          },
+        );
+
+        if (!response.ok || !response.body) {
+          throw new Error(`Expected stream to return 2xx, got ${response.status}`);
+        }
+
+        const reader = response.body.getReader();
+        const decoder = new TextDecoder();
+
+        while (true) {
+          const { done, value } = await reader.read();
+          if (done) {
+            break;
+          }
+
+          buffered += decoder.decode(value, { stream: true });
+          if (buffered.includes(expectedText)) {
+            await reader.cancel();
+            return;
+          }
+
+          if (buffered.includes('event: error')) {
+            await reader.cancel();
+            throw new Error(`Stream emitted an error before ${expectedText}:\n${buffered}`);
+          }
+        }
+      } finally {
+        window.clearTimeout(timeout);
+      }
+
+      throw new Error(`Timed out waiting for ${expectedText}. Latest stream:\n${buffered}`);
+    },
+    { accessToken: token, currentStreamId: streamId, expectedText: expected },
+  );
+}
+
+test.describe('enforced model specs', () => {
+  test.skip(
+    process.env.E2E_MODEL_SPECS_ENFORCE !== 'true',
+    'requires E2E_MODEL_SPECS_ENFORCE=true',
+  );
+
+  test('rebuilds a valid enforced spec from the backend preset when the request is stale', async ({
+    page,
+  }) => {
+    test.setTimeout(120000);
+    const label = uniqueName('reported-spec').replace(/\s+/g, '-');
+
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    const token = await getAccessToken(page);
+    const userMessageId = randomUUID();
+    const start = await requestJson<AgentStartResponse>(page, {
+      path: `/api/agents/chat/${encodeURIComponent(MOCK_ENDPOINTS[0].label)}`,
+      token,
+      method: 'POST',
+      body: {
+        text: replyPrompt(label),
+        sender: 'User',
+        clientTimestamp: new Date().toLocaleString('sv').replace(' ', 'T'),
+        isCreatedByUser: true,
+        parentMessageId: NO_PARENT,
+        conversationId: 'new',
+        messageId: userMessageId,
+        responseMessageId: `${userMessageId}_`,
+        endpoint: MOCK_ENDPOINTS[0].label,
+        endpointType: 'custom',
+        model: { stale: 'cached-client-value' },
+        agent_id: 'agent_from_cached_client_state',
+        spec: ENFORCED_SPEC_NAME,
+        isTemporary: false,
+        isRegenerate: false,
+        error: false,
+      },
+    });
+
+    expect(start.status).toBe('started');
+    expect(start.conversationId).toBeTruthy();
+
+    await waitForStreamReply(page, token, start.streamId, replyText(label));
+  });
+
+  test('keeps a project-scoped chat attached when sending with an enforced spec', async ({
+    page,
+  }) => {
+    test.setTimeout(120000);
+    const name = uniqueName('E2E Enforced Project');
+    const projectId = await createProject(page, name);
+    const label = uniqueName('project-spec').replace(/\s+/g, '-');
+
+    await page.goto(`/c/new?projectId=${projectId}`, { timeout: 10000 });
+    await expect(page.getByRole('button', { name: 'Remove from project' })).toBeVisible();
+    await expect(page.getByRole('textbox', { name: 'Message input' })).toHaveAttribute(
+      'placeholder',
+      new RegExp(name),
+    );
+
+    await selectModelSpec(page, ENFORCED_SPEC_LABEL);
+    await expect(page.getByRole('button', { name: 'Remove from project' })).toBeVisible();
+
+    const response = await sendMessage(page, replyPrompt(label));
+    expect(response.ok()).toBeTruthy();
+    await expect(messagesView(page).getByText(replyText(label))).toBeVisible({ timeout: 30000 });
+    await expect(page).toHaveURL(/\/c\/(?!new)/, { timeout: 15000 });
+
+    const projectRow = page.getByRole('button', { name }).first();
+    if ((await projectRow.getAttribute('aria-expanded')) !== 'true') {
+      await projectRow.click();
+    }
+    await expect(
+      page.getByTestId(`project-chats-${projectId}`).getByTestId('convo-item').first(),
+    ).toBeVisible();
+  });
+});
diff --git a/e2e/specs/mock/helpers.ts b/e2e/specs/mock/helpers.ts
index f60837bba3c..d24a021c0ac 100644
--- a/e2e/specs/mock/helpers.ts
+++ b/e2e/specs/mock/helpers.ts
@@ -10,28 +10,76 @@ export const MOCK_ENDPOINTS = [
   { label: 'Mock Provider B', model: 'mock-model-b' },
 ] as const;
 
-export type MockEndpoint = (typeof MOCK_ENDPOINTS)[number];
+export type MockEndpoint = { label: string; model: string };
 
 export const NEW_CHAT_PATH = '/c/new';
 
+type RefreshTokenBody = {
+  token?: string;
+};
+
 export function isAgentsStream(response: Response) {
-  return response.url().includes('/api/agents') && response.status() === 200;
+  return isAgentGenerationStart(response);
+}
+
+export function isAgentGenerationStart(response: Response) {
+  const { pathname } = new URL(response.url());
+  const isAgentsChat = pathname === '/api/agents/chat' || pathname.startsWith('/api/agents/chat/');
+  return (
+    response.request().method() === 'POST' &&
+    isAgentsChat &&
+    !pathname.endsWith('/abort') &&
+    response.status() === 200
+  );
 }
 
 const modelSelectorTrigger = (page: Page) =>
   page.getByRole('button', { name: 'Select a model' }).first();
 
+export const escapeRegExp = (value: string) => value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+
 /** Open the model selector, choose an endpoint, then its model (committed on the model click). */
 export async function selectMockEndpoint(page: Page, endpoint: MockEndpoint) {
-  await modelSelectorTrigger(page).click();
+  const trigger = modelSelectorTrigger(page);
+  await trigger.click();
   await page.getByRole('option', { name: endpoint.label }).click();
-  await page.getByRole('option', { name: endpoint.model, exact: true }).click();
-  await expect(modelSelectorTrigger(page)).not.toHaveText('Select a model');
+  const modelOption = page.getByRole('option', { name: endpoint.model, exact: true });
+  if (await modelOption.isVisible({ timeout: 1000 }).catch(() => false)) {
+    await modelOption.click();
+  }
+  await expect(trigger).not.toHaveText('Select a model');
+}
+
+/** Open the model selector and choose a configured model spec by label. */
+export async function selectModelSpec(page: Page, label: string) {
+  const trigger = modelSelectorTrigger(page);
+  await expect(trigger).toBeVisible();
+  if ((await trigger.textContent())?.includes(label)) {
+    return;
+  }
+  await trigger.click();
+  await page.getByRole('option', { name: new RegExp(`(^|\\s)${escapeRegExp(label)}\\b`) }).click();
+  await expect(trigger).toContainText(label);
+}
+
+/** Enable the ephemeral Skills capability from the composer tool menu. */
+export async function enableSkills(page: Page) {
+  await page.getByRole('button', { name: 'Tools Options' }).click();
+  await page.getByTestId('tools-menu-skills').click();
+  await page.keyboard.press('Escape');
+  await expect(page.getByRole('button', { name: 'Skills' })).toBeVisible();
 }
 
+/** The conversation messages container. */
+export const messagesView = (page: Page) => page.getByTestId('messages-view');
+
+/** Build the mock-model reply trigger and its expected rendered text for a label. */
+export const replyPrompt = (label: string) => `E2E_REPLY:${label}`;
+export const replyText = (label: string) => `E2E reply ${label}`;
+
 /** The mock reply as rendered in the conversation, scoped to the messages view. */
 export function mockReply(page: Page) {
-  return page.getByTestId('messages-view').getByText(new RegExp(MOCK_REPLY_TEXT, 'i'));
+  return messagesView(page).getByText(new RegExp(MOCK_REPLY_TEXT, 'i'));
 }
 
 /** Type a message, send it, and wait for the streamed `/api/agents` response. */
@@ -45,3 +93,88 @@ export async function sendMessage(page: Page, text: string): Promise<Response> {
   ]);
   return response;
 }
+
+export async function getAccessToken(page: Page): Promise<string> {
+  const result = await page.evaluate(async () => {
+    const response = await fetch('/api/auth/refresh', {
+      method: 'POST',
+      credentials: 'include',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({}),
+    });
+    const text = await response.text();
+    let json: unknown = null;
+    try {
+      json = text ? JSON.parse(text) : null;
+    } catch {
+      json = null;
+    }
+    return { ok: response.ok, status: response.status, text, json };
+  });
+
+  if (!result.ok) {
+    throw new Error(
+      `Expected /api/auth/refresh to return 2xx, got ${result.status}: ${result.text}`,
+    );
+  }
+
+  const body = result.json as RefreshTokenBody | null;
+  if (!body?.token) {
+    throw new Error(`Expected /api/auth/refresh to return a token, got: ${result.text}`);
+  }
+
+  return body.token;
+}
+
+export async function requestJson<T>(
+  page: Page,
+  params: {
+    path: string;
+    token: string;
+    method?: string;
+    body?: unknown;
+  },
+): Promise<T> {
+  const result = await page.evaluate(
+    async ({ accessToken, body, method, urlPath }) => {
+      const headers: Record<string, string> = {
+        Authorization: `Bearer ${accessToken}`,
+      };
+      const init: RequestInit = {
+        method,
+        credentials: 'include',
+        headers,
+      };
+      if (body !== undefined) {
+        headers['Content-Type'] = 'application/json';
+        init.body = JSON.stringify(body);
+      }
+      const response = await fetch(urlPath, init);
+      const text = await response.text();
+      let json: unknown = null;
+      try {
+        json = text ? JSON.parse(text) : null;
+      } catch {
+        json = null;
+      }
+      return { ok: response.ok, status: response.status, text, json };
+    },
+    {
+      accessToken: params.token,
+      body: params.body,
+      method: params.method ?? 'GET',
+      urlPath: params.path,
+    },
+  );
+
+  if (!result.ok) {
+    throw new Error(
+      `Expected ${params.method ?? 'GET'} ${params.path} to return 2xx, got ${result.status}: ${result.text}`,
+    );
+  }
+  return result.json as T;
+}
+
+export async function fetchJson<T>(page: Page, path: string, token: string): Promise<T> {
+  return requestJson<T>(page, { path, token });
+}
diff --git a/e2e/specs/mock/mcp-allowlist-override.spec.ts b/e2e/specs/mock/mcp-allowlist-override.spec.ts
new file mode 100644
index 00000000000..281c1aebd0c
--- /dev/null
+++ b/e2e/specs/mock/mcp-allowlist-override.spec.ts
@@ -0,0 +1,77 @@
+import { expect, test } from '@playwright/test';
+import type { APIRequestContext } from '@playwright/test';
+import { getPrimaryE2EUser } from '../../setup/users.mock';
+
+/**
+ * Proves the #13809 fix end to end: an admin-panel `mcpSettings.allowedDomains`
+ * override is honored by MCP inspection/connection without a restart.
+ *
+ * `e2e-http` (a URL-based MCP fixture) boots `inspectionFailed` because its origin
+ * is absent from the YAML allowlist. Adding that origin via an admin config override
+ * must let the server reinitialize. Before the fix, reinspection used the frozen
+ * YAML allowlist and the server stayed unreachable.
+ *
+ * Pure-API e2e against the real backend + DB: the JWT comes from the Authorization
+ * header (`ExtractJwt.fromAuthHeaderAsBearerToken`), so we log in for a token rather
+ * than relying on the browser storage state.
+ */
+
+const SERVER_NAME = 'e2e-http';
+/** Must match the `e2e-http` URL origin in e2e/config/librechat.e2e.yaml. */
+const FIXTURE_ORIGIN = `http://127.0.0.1:${process.env.E2E_MCP_HTTP_PORT || '8765'}`;
+
+async function reinitialize(
+  request: APIRequestContext,
+  headers: Record<string, string>,
+): Promise<{ status: number; success: boolean }> {
+  const res = await request.post(`/api/mcp/${SERVER_NAME}/reinitialize`, { headers });
+  if (!res.ok()) {
+    return { status: res.status(), success: false };
+  }
+  const body = (await res.json()) as { success?: boolean };
+  return { status: res.status(), success: body.success === true };
+}
+
+test.describe('MCP admin-panel allowlist override', () => {
+  test('honors an admin mcpSettings.allowedDomains override so a blocked server reinitializes', async ({
+    request,
+  }) => {
+    test.setTimeout(120000);
+
+    // The seeded primary user is the first-registered user → ADMIN, so it can write
+    // config overrides. Log in for a Bearer token + the user id.
+    const { email, password } = getPrimaryE2EUser();
+    const loginRes = await request.post('/api/auth/login', { data: { email, password } });
+    expect(loginRes.ok()).toBeTruthy();
+    const { token, user } = (await loginRes.json()) as {
+      token: string;
+      user: { id?: string; _id?: string };
+    };
+    const userId = user.id ?? user._id;
+    expect(token).toBeTruthy();
+    expect(userId).toBeTruthy();
+
+    const headers = { Authorization: `Bearer ${token}` };
+
+    // Baseline: the fixture's origin is not in the YAML allowlist, so reinit fails.
+    const before = await reinitialize(request, headers);
+    expect(before.status).toBe(200);
+    expect(before.success).toBe(false);
+
+    // Admin-panel override: allow the fixture's origin for this user.
+    const put = await request.put(`/api/admin/config/user/${userId}`, {
+      headers,
+      data: { overrides: { mcpSettings: { allowedDomains: [FIXTURE_ORIGIN] } } },
+    });
+    expect(put.ok()).toBeTruthy();
+
+    // The override is honored on reinit: the server now connects. invalidateConfigCaches
+    // runs asynchronously after the PUT, so poll until the merged allowlist lands.
+    await expect
+      .poll(async () => (await reinitialize(request, headers)).success, {
+        timeout: 30000,
+        intervals: [1000, 2000, 3000],
+      })
+      .toBe(true);
+  });
+});
diff --git a/e2e/specs/mock/mcp-ephemeral.spec.ts b/e2e/specs/mock/mcp-ephemeral.spec.ts
new file mode 100644
index 00000000000..93104f4a43e
--- /dev/null
+++ b/e2e/specs/mock/mcp-ephemeral.spec.ts
@@ -0,0 +1,84 @@
+import { expect, test } from '@playwright/test';
+import type { Page, Response } from '@playwright/test';
+import {
+  NEW_CHAT_PATH,
+  isAgentsStream,
+  mockReply,
+  selectMockEndpoint,
+  sendMessage,
+} from './helpers';
+
+/** Non-spec endpoints from e2e/config/librechat.e2e.yaml — switching between
+ *  them exercises the no-spec `applyModelSpecEffects` path that previously
+ *  wiped the ephemeral agent (MCP selection) for the active conversation. */
+const PROVIDER_C = { label: 'Mock Provider C', model: 'mock-model-c' };
+const PROVIDER_D = { label: 'Mock Provider D', model: 'mock-model-d' };
+
+const MCP_SERVER_NAME = 'e2e-memory';
+const MCP_SERVER_TITLE = 'E2E Memory';
+
+const uniqueText = (prefix: string) => `${prefix} ${Date.now()}-${Math.floor(Math.random() * 1e4)}`;
+
+const mcpBadge = (page: Page) => page.getByRole('button', { name: new RegExp(MCP_SERVER_TITLE) });
+
+/** Select the MCP server from the composer's ephemeral MCP dropdown. */
+async function selectEphemeralMCP(page: Page) {
+  await page.getByRole('button', { name: 'MCP Servers', exact: true }).click();
+  const serverItem = page.getByRole('menuitemcheckbox', { name: new RegExp(MCP_SERVER_TITLE) });
+  await expect(serverItem).toBeVisible();
+  await serverItem.click();
+  await expect(serverItem).toHaveAttribute('aria-checked', 'true');
+  await page.keyboard.press('Escape');
+  await expect(mcpBadge(page)).toBeVisible();
+}
+
+/** The `ephemeralAgent.mcp` array sent with a chat request. */
+function requestMCP(response: Response): string[] | undefined {
+  const body = response.request().postDataJSON() as { ephemeralAgent?: { mcp?: string[] } };
+  return body.ephemeralAgent?.mcp;
+}
+
+test.describe('ephemeral MCP selection persistence', () => {
+  test('keeps the MCP selection when switching models on a new chat', async ({ page }) => {
+    test.setTimeout(120000);
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+
+    await selectMockEndpoint(page, PROVIDER_C);
+    await selectEphemeralMCP(page);
+
+    await selectMockEndpoint(page, PROVIDER_D);
+    await expect(mcpBadge(page)).toBeVisible();
+
+    const response = await sendMessage(page, uniqueText('mcp new chat switch'));
+    expect(response.ok()).toBeTruthy();
+    expect(requestMCP(response)).toContain(MCP_SERVER_NAME);
+
+    await expect(mockReply(page)).toBeVisible({ timeout: 20000 });
+  });
+
+  test('keeps the MCP selection when regenerating after a model switch', async ({ page }) => {
+    test.setTimeout(120000);
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+
+    await selectMockEndpoint(page, PROVIDER_C);
+    await selectEphemeralMCP(page);
+
+    const first = await sendMessage(page, uniqueText('mcp regenerate switch'));
+    expect(first.ok()).toBeTruthy();
+    expect(requestMCP(first)).toContain(MCP_SERVER_NAME);
+    await expect(mockReply(page)).toBeVisible({ timeout: 20000 });
+    await expect(page).toHaveURL(/\/c\/(?!new)/, { timeout: 15000 });
+
+    await selectMockEndpoint(page, PROVIDER_D);
+    await expect(mcpBadge(page)).toBeVisible();
+
+    const [regenerated] = await Promise.all([
+      page.waitForResponse(isAgentsStream, { timeout: 30000 }),
+      page.getByRole('button', { name: 'Regenerate', exact: true }).click(),
+    ]);
+    expect(regenerated.ok()).toBeTruthy();
+    expect(requestMCP(regenerated)).toContain(MCP_SERVER_NAME);
+
+    await expect(mockReply(page).first()).toBeVisible({ timeout: 20000 });
+  });
+});
diff --git a/e2e/specs/mock/mcp.spec.ts b/e2e/specs/mock/mcp.spec.ts
new file mode 100644
index 00000000000..0a2b4fd466f
--- /dev/null
+++ b/e2e/specs/mock/mcp.spec.ts
@@ -0,0 +1,150 @@
+import { expect, test } from '@playwright/test';
+import type { Locator, Page } from '@playwright/test';
+import type { AgentDetail } from './agents.helpers';
+import {
+  cleanupAgent,
+  openAgentBuilder,
+  selectMockModel,
+  uniqueAgentName,
+  waitForPersistedAgent,
+} from './agents.helpers';
+import { MOCK_ENDPOINTS, fetchJson, getAccessToken, mockReply, sendMessage } from './helpers';
+
+const MCP_SERVER_NAME = 'e2e-memory';
+const MCP_SERVER_TITLE = 'E2E Memory';
+const MCP_TOOL_NAME = 'remember_fact';
+const MCP_SERVER_TOOL_ID = `sys__server__sys_mcp_${MCP_SERVER_NAME}`;
+const MCP_TOOL_ID = `${MCP_TOOL_NAME}_mcp_${MCP_SERVER_NAME}`;
+const DESCRIPTION = 'Use this agent to verify LibreChat MCP tool selection in mock e2e tests.';
+const INSTRUCTIONS =
+  'Keep the selected MCP server tools available while replying through the mock e2e model.';
+
+type MCPToolsResponse = {
+  servers?: Record<
+    string,
+    {
+      tools?: Array<{
+        name: string;
+        pluginKey: string;
+        description?: string;
+      }>;
+    }
+  >;
+};
+
+async function waitForMCPTools(page: Page) {
+  const token = await getAccessToken(page);
+  let latestTools: MCPToolsResponse | null = null;
+
+  for (let attempt = 0; attempt < 20; attempt++) {
+    latestTools = await fetchJson<MCPToolsResponse>(page, '/api/mcp/tools', token);
+    const serverTools = latestTools.servers?.[MCP_SERVER_NAME]?.tools ?? [];
+    if (serverTools.some((tool) => tool.pluginKey === MCP_TOOL_ID)) {
+      return serverTools;
+    }
+    await new Promise((resolve) => setTimeout(resolve, 500));
+  }
+
+  expect(
+    latestTools?.servers?.[MCP_SERVER_NAME]?.tools,
+    `Expected ${MCP_SERVER_NAME} to expose ${MCP_TOOL_ID}`,
+  ).toEqual(expect.arrayContaining([expect.objectContaining({ pluginKey: MCP_TOOL_ID })]));
+  return latestTools!.servers![MCP_SERVER_NAME].tools!;
+}
+
+async function addMCPServerTools(page: Page, form: Locator) {
+  await expect(form.getByText('MCP Servers', { exact: true })).toBeVisible();
+  await form.getByRole('button', { name: 'Add MCP Server Tools' }).click();
+
+  const dialogTitle = page.getByText('MCP Server Tools', { exact: true });
+  await expect(dialogTitle).toBeVisible();
+  await expect(page.getByText(MCP_SERVER_TITLE, { exact: true })).toBeVisible();
+
+  await page.getByRole('button', { name: `Add ${MCP_SERVER_TITLE}` }).click();
+  await expect(page.getByRole('button', { name: `Remove ${MCP_SERVER_TITLE}` })).toBeVisible({
+    timeout: 30000,
+  });
+
+  await page.getByRole('button', { name: 'Close dialog' }).click();
+  await expect(dialogTitle).toBeHidden();
+
+  await expect(form.getByText(MCP_SERVER_NAME, { exact: true })).toBeVisible();
+  await form.getByText(MCP_SERVER_NAME, { exact: true }).click();
+  await expect(form.getByLabel(MCP_TOOL_NAME)).toBeVisible();
+}
+
+async function expectSelectedMCPServerTools(form: Locator) {
+  await expect(form.getByText(MCP_SERVER_NAME, { exact: true })).toBeVisible();
+  await form.getByText(MCP_SERVER_NAME, { exact: true }).click();
+  await expect(form.getByLabel(MCP_TOOL_NAME)).toBeVisible();
+}
+
+test.describe('agent builder MCP tools', () => {
+  test('creates an agent with MCP server tools and persists the selection', async ({ page }) => {
+    test.setTimeout(120000);
+
+    const agentName = uniqueAgentName('E2E MCP Agent');
+    let createdAgentId: string | undefined;
+
+    try {
+      const form = await openAgentBuilder(page);
+      await waitForMCPTools(page);
+
+      await form.getByLabel('Agent name').fill(agentName);
+      await form.getByLabel('Agent description').fill(DESCRIPTION);
+      await form.getByLabel('Agent instructions').fill(INSTRUCTIONS);
+      await selectMockModel(page, true);
+
+      await addMCPServerTools(page, form);
+
+      const [createResponse] = await Promise.all([
+        page.waitForResponse(
+          (response) =>
+            response.request().method() === 'POST' &&
+            new URL(response.url()).pathname === '/api/agents' &&
+            response.status() === 201,
+          { timeout: 30000 },
+        ),
+        form.getByRole('button', { name: 'Create' }).click(),
+      ]);
+      const createdAgent = (await createResponse.json()) as AgentDetail;
+      createdAgentId = createdAgent.id;
+
+      await expect(
+        page.getByText(`Successfully created ${agentName}`, { exact: true }),
+      ).toBeVisible();
+
+      const persistedAgent = await waitForPersistedAgent(page, agentName, DESCRIPTION);
+      expect(persistedAgent).toMatchObject({
+        id: createdAgentId,
+        name: agentName,
+        description: DESCRIPTION,
+        instructions: INSTRUCTIONS,
+        provider: MOCK_ENDPOINTS[0].label,
+        model: MOCK_ENDPOINTS[0].model,
+        category: 'general',
+      });
+      expect(persistedAgent.tools).toEqual(
+        expect.arrayContaining([MCP_SERVER_TOOL_ID, MCP_TOOL_ID]),
+      );
+      expect(persistedAgent.mcpServerNames).toEqual(expect.arrayContaining([MCP_SERVER_NAME]));
+
+      const reopenedForm = await openAgentBuilder(page);
+      await reopenedForm.getByRole('combobox', { name: 'Agent', exact: true }).click();
+      await page.getByRole('option', { name: agentName }).click();
+
+      await expect(reopenedForm.getByLabel('Agent name')).toHaveValue(agentName);
+      await expect(reopenedForm.getByLabel('Agent description')).toHaveValue(DESCRIPTION);
+      await expect(reopenedForm.getByLabel('Agent instructions')).toHaveValue(INSTRUCTIONS);
+      await expectSelectedMCPServerTools(reopenedForm);
+
+      await reopenedForm.getByRole('button', { name: 'Select Agent' }).click();
+
+      const response = await sendMessage(page, `hello from ${agentName}`);
+      expect(response.ok()).toBeTruthy();
+      await expect(mockReply(page)).toBeVisible({ timeout: 30000 });
+    } finally {
+      await cleanupAgent(page, createdAgentId);
+    }
+  });
+});
diff --git a/e2e/specs/mock/message-tree.spec.ts b/e2e/specs/mock/message-tree.spec.ts
new file mode 100644
index 00000000000..f66c41dafae
--- /dev/null
+++ b/e2e/specs/mock/message-tree.spec.ts
@@ -0,0 +1,1248 @@
+import { expect, test } from '@playwright/test';
+import type { Page, Response, Route } from '@playwright/test';
+import {
+  isAgentGenerationStart,
+  MOCK_ENDPOINTS,
+  NEW_CHAT_PATH,
+  fetchJson,
+  getAccessToken,
+  selectMockEndpoint,
+  sendMessage,
+} from './helpers';
+
+const NO_PARENT = '00000000-0000-0000-0000-000000000000';
+
+type TextContentPart = {
+  type?: string;
+  text?: string | { value?: string };
+  error?: string;
+};
+
+type E2EMessage = {
+  messageId: string;
+  parentMessageId?: string | null;
+  conversationId?: string | null;
+  text?: string;
+  content?: TextContentPart[];
+  isCreatedByUser?: boolean;
+  error?: boolean;
+  unfinished?: boolean;
+};
+
+type ForkResponse = {
+  conversation: {
+    conversationId?: string;
+  };
+  messages: E2EMessage[];
+};
+
+type JsonResponse = {
+  ok: boolean;
+  status: number;
+  text: string;
+  json: unknown;
+};
+
+const uniqueLabel = (name: string) => `${name}-${Date.now()}-${Math.floor(Math.random() * 1e6)}`;
+
+const replyPrompt = (label: string) => `E2E_REPLY:${label}`;
+const replyText = (label: string) => `E2E reply ${label}`;
+const countedPrompt = (label: string) => `E2E_COUNTED_REPLY:${label}`;
+const countedReplyText = (label: string, count: number) => `E2E counted reply ${label} #${count}`;
+const slowPrompt = (label: string) => `E2E_SLOW_REPLY:${label}`;
+const slowReplyPrefix = (label: string) => `E2E slow reply ${label}`;
+const slowCountedPrompt = (label: string) => `E2E_SLOW_COUNTED_REPLY:${label}`;
+const slowCountedReplyText = (label: string, count: number) =>
+  `E2E slow counted reply ${label} #${count}`;
+
+const messagesView = (page: Page) => page.getByTestId('messages-view');
+const messageRender = (page: Page, text: string) =>
+  page.locator('.message-render').filter({ hasText: text }).last();
+const conversationPath = (conversationId: string) => `/c/${encodeURIComponent(conversationId)}`;
+
+function contentText(part: TextContentPart): string {
+  if (typeof part.text === 'string') {
+    return part.text;
+  }
+  if (part.text?.value) {
+    return part.text.value;
+  }
+  return part.error ?? '';
+}
+
+function messageText(message: E2EMessage): string {
+  if (message.text) {
+    return message.text;
+  }
+  return message.content?.map(contentText).filter(Boolean).join('\n') ?? '';
+}
+
+function sseMessage(payload: unknown): string {
+  return `event: message\ndata: ${JSON.stringify(payload)}\n\n`;
+}
+
+function findMessage(messages: E2EMessage[], text: string, isCreatedByUser?: boolean): E2EMessage {
+  const message = messages.find((candidate) => {
+    const roleMatches =
+      isCreatedByUser === undefined || candidate.isCreatedByUser === isCreatedByUser;
+    return roleMatches && messageText(candidate).includes(text);
+  });
+  if (!message) {
+    throw new Error(
+      `Expected message containing "${text}". Saw:\n${messages.map(messageText).join('\n---\n')}`,
+    );
+  }
+  return message;
+}
+
+function expectParent(
+  messages: E2EMessage[],
+  childText: string,
+  parentText: string,
+  childIsUser?: boolean,
+) {
+  const child = findMessage(messages, childText, childIsUser);
+  const parent = findMessage(messages, parentText);
+  expect(child.parentMessageId, `${childText} should be a child of ${parentText}`).toBe(
+    parent.messageId,
+  );
+}
+
+function expectNoFoldedMessages(messages: E2EMessage[]) {
+  const ids = new Set(messages.map((message) => message.messageId));
+  const folded = messages.filter((message) => {
+    const parentId = message.parentMessageId;
+    return parentId != null && parentId !== '' && parentId !== NO_PARENT && !ids.has(parentId);
+  });
+  expect(
+    folded.map((message) => ({
+      text: messageText(message),
+      messageId: message.messageId,
+      parentMessageId: message.parentMessageId,
+    })),
+    'messages must not render as parent-less folded children',
+  ).toEqual([]);
+
+  const roots = messages.filter((message) => {
+    const parentId = message.parentMessageId;
+    return parentId == null || parentId === '' || parentId === NO_PARENT;
+  });
+  expect(
+    roots.map((message) => ({
+      text: messageText(message),
+      isCreatedByUser: message.isCreatedByUser,
+    })),
+    'only user messages should be roots',
+  ).toEqual(roots.map(() => expect.objectContaining({ isCreatedByUser: true })));
+}
+
+async function expectVisibleMessages(page: Page, texts: string[]) {
+  for (const text of texts) {
+    await expect(messagesView(page).getByText(text)).toBeVisible({ timeout: 30000 });
+  }
+}
+
+async function reloadAndExpectMessages(page: Page, texts: string[]) {
+  await page.reload({ timeout: 10000 });
+  await expectVisibleMessages(page, texts);
+}
+
+async function revisitConversationAndExpectMessages(
+  page: Page,
+  conversationId: string,
+  texts: string[],
+) {
+  await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+  await page.goto(conversationPath(conversationId), { timeout: 10000 });
+  await expectVisibleMessages(page, texts);
+}
+
+async function mockActiveOAuthResumeStream({
+  page,
+  authUrl,
+  conversationId,
+  parentMessageId,
+  pendingPrompt,
+  pendingUserMessageId,
+  postAuthRunId,
+  postAuthText,
+}: {
+  page: Page;
+  authUrl: string;
+  conversationId: string;
+  parentMessageId: string;
+  pendingPrompt: string;
+  pendingUserMessageId: string;
+  postAuthRunId?: string;
+  postAuthText?: string;
+}) {
+  const pendingResponseMessageId = `${pendingUserMessageId}_`;
+  const toolCallId = `${pendingUserMessageId}:Google-Workspace`;
+  const stepId = 'step_oauth_login_Google-Workspace';
+  const messageStepId = 'step_post_auth_message';
+  const resumeState = {
+    runSteps: [],
+    aggregatedContent: [],
+    responseMessageId: pendingResponseMessageId,
+    conversationId,
+    userMessage: {
+      messageId: pendingUserMessageId,
+      parentMessageId,
+      conversationId,
+      text: pendingPrompt,
+    },
+    replayEvents: [
+      {
+        event: 'on_run_step',
+        data: {
+          runId: 'USE_PRELIM_RESPONSE_MESSAGE_ID',
+          id: stepId,
+          type: 'tool_calls',
+          index: 0,
+          stepDetails: {
+            type: 'tool_calls',
+            tool_calls: [
+              {
+                id: toolCallId,
+                name: 'oauth_mcp_Google-Workspace',
+                type: 'tool_call_chunk',
+              },
+            ],
+          },
+        },
+      },
+      {
+        event: 'on_run_step_delta',
+        data: {
+          id: stepId,
+          delta: {
+            type: 'tool_calls',
+            tool_calls: [
+              {
+                id: toolCallId,
+                name: 'oauth_mcp_Google-Workspace',
+                type: 'tool_call_chunk',
+                args: '',
+              },
+            ],
+            auth: authUrl,
+            expires_at: Date.now() + 120000,
+          },
+        },
+      },
+    ],
+  };
+  const streamPayloads: unknown[] = [
+    {
+      sync: true,
+      resumeState,
+      pendingEvents: [],
+    },
+  ];
+
+  if (postAuthText) {
+    streamPayloads.push(
+      {
+        event: 'on_run_step',
+        data: {
+          runId: postAuthRunId ?? 'USE_PRELIM_RESPONSE_MESSAGE_ID',
+          id: messageStepId,
+          type: 'message_creation',
+          index: 0,
+          stepDetails: {
+            type: 'message_creation',
+            message_creation: {
+              message_id: `${pendingResponseMessageId}-post-auth`,
+            },
+          },
+          usage: null,
+        },
+      },
+      {
+        event: 'on_message_delta',
+        data: {
+          id: messageStepId,
+          delta: {
+            content: [
+              {
+                type: 'text',
+                text: postAuthText,
+              },
+            ],
+          },
+        },
+      },
+    );
+  }
+
+  await page.route(`**/api/agents/chat/status/${conversationId}`, (route) =>
+    route.fulfill({
+      status: 200,
+      contentType: 'application/json',
+      body: JSON.stringify({
+        active: true,
+        streamId: conversationId,
+        status: 'running',
+        aggregatedContent: [],
+        createdAt: Date.now(),
+        resumeState,
+      }),
+    }),
+  );
+
+  await page.route(`**/api/agents/chat/stream/${conversationId}**`, (route) =>
+    route.fulfill({
+      status: 200,
+      contentType: 'text/event-stream',
+      body: streamPayloads.map(sseMessage).join(''),
+    }),
+  );
+}
+
+async function mockPreCreatedOAuthStream({
+  page,
+  authUrl,
+  conversationId,
+  parentMessageId,
+  prompt,
+  serverUserMessageId,
+  responseMessageId,
+  postAuthText,
+}: {
+  page: Page;
+  authUrl: string;
+  conversationId: string;
+  parentMessageId: string;
+  prompt: string;
+  serverUserMessageId: string;
+  responseMessageId: string;
+  postAuthText: string;
+}) {
+  const toolCallId = `${serverUserMessageId}:Google-Workspace`;
+  const oauthStepId = 'step_oauth_login_Google-Workspace';
+  const reasoningStepId = 'step_post_auth_reasoning';
+  const messageStepId = 'step_post_auth_message';
+  const payloads = [
+    {
+      event: 'on_run_step',
+      data: {
+        runId: 'USE_PRELIM_RESPONSE_MESSAGE_ID',
+        id: oauthStepId,
+        type: 'tool_calls',
+        index: 0,
+        stepDetails: {
+          type: 'tool_calls',
+          tool_calls: [
+            {
+              id: toolCallId,
+              name: 'oauth_mcp_Google-Workspace',
+              type: 'tool_call_chunk',
+            },
+          ],
+        },
+      },
+    },
+    {
+      event: 'on_run_step_delta',
+      data: {
+        id: oauthStepId,
+        delta: {
+          type: 'tool_calls',
+          tool_calls: [
+            {
+              id: toolCallId,
+              name: 'oauth_mcp_Google-Workspace',
+              type: 'tool_call_chunk',
+              args: '',
+            },
+          ],
+          auth: authUrl,
+          expires_at: Date.now() + 120000,
+        },
+      },
+    },
+    {
+      event: 'on_run_step_completed',
+      data: {
+        result: {
+          id: oauthStepId,
+          index: 0,
+          tool_call: {
+            id: toolCallId,
+            name: 'oauth_mcp_Google-Workspace',
+            args: '',
+            output: 'OAuth authentication completed',
+            type: 'tool_call',
+          },
+        },
+      },
+    },
+    {
+      created: true,
+      message: {
+        messageId: serverUserMessageId,
+        parentMessageId,
+        conversationId,
+        sender: 'User',
+        text: prompt,
+        isCreatedByUser: true,
+      },
+      streamId: conversationId,
+    },
+    {
+      event: 'on_run_step',
+      data: {
+        runId: responseMessageId,
+        id: reasoningStepId,
+        type: 'message_creation',
+        index: 0,
+        stepDetails: {
+          type: 'message_creation',
+          message_creation: {
+            message_id: `${responseMessageId}-reasoning`,
+          },
+        },
+        usage: null,
+      },
+    },
+    {
+      event: 'on_reasoning_delta',
+      data: {
+        id: reasoningStepId,
+        delta: {
+          content: [
+            {
+              type: 'think',
+              think: 'The user completed OAuth.',
+            },
+          ],
+        },
+      },
+    },
+    {
+      event: 'on_run_step',
+      data: {
+        runId: responseMessageId,
+        id: messageStepId,
+        type: 'message_creation',
+        index: 1,
+        stepDetails: {
+          type: 'message_creation',
+          message_creation: {
+            message_id: `${responseMessageId}-message`,
+          },
+        },
+        usage: null,
+      },
+    },
+    {
+      event: 'on_message_delta',
+      data: {
+        id: messageStepId,
+        delta: {
+          content: [
+            {
+              type: 'text',
+              text: postAuthText,
+              index: 1,
+            },
+          ],
+        },
+      },
+    },
+  ];
+
+  await page.route(`**/api/agents/chat/stream/${conversationId}**`, (route) =>
+    route.fulfill({
+      status: 200,
+      contentType: 'text/event-stream',
+      body: payloads.map(sseMessage).join(''),
+    }),
+  );
+}
+
+async function openMockChat(page: Page) {
+  await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+  await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+}
+
+function isAgentGenerationResponse(response: Response, expectedStatus: number) {
+  const { pathname } = new URL(response.url());
+  const isAgentsChat = pathname === '/api/agents/chat' || pathname.startsWith('/api/agents/chat/');
+  return (
+    response.request().method() === 'POST' &&
+    isAgentsChat &&
+    !pathname.endsWith('/abort') &&
+    response.status() === expectedStatus
+  );
+}
+
+async function waitForGenerationStart(page: Page, action: () => Promise<void>): Promise<Response> {
+  const [response] = await Promise.all([
+    page.waitForResponse(isAgentGenerationStart, { timeout: 30000 }),
+    action(),
+  ]);
+  expect(response.ok()).toBeTruthy();
+  return response;
+}
+
+async function sendAndExpectReply(page: Page, prompt: string, expectedReply: string) {
+  const response = await sendMessage(page, prompt);
+  expect(response.ok()).toBeTruthy();
+  await expect(messagesView(page).getByText(expectedReply)).toBeVisible({ timeout: 30000 });
+}
+
+async function submitMessageExpectingGenerationFailure(
+  page: Page,
+  prompt: string,
+  expectedStatus: number,
+) {
+  const input = page.getByRole('textbox', { name: 'Message input' });
+  await expect(input).toBeEnabled({ timeout: 30000 });
+  await input.click();
+  await input.fill(prompt);
+  const [response] = await Promise.all([
+    page.waitForResponse((res) => isAgentGenerationResponse(res, expectedStatus), {
+      timeout: 30000,
+    }),
+    input.press('Enter'),
+  ]);
+  return response;
+}
+
+async function conversationIdFromPage(page: Page): Promise<string> {
+  await expect(page).toHaveURL(/\/c\/(?!new)[0-9a-fA-F-]{36}$/);
+  const id = new URL(page.url()).pathname.split('/').pop();
+  if (!id) {
+    throw new Error(`Could not parse conversation id from ${page.url()}`);
+  }
+  return id;
+}
+
+async function fetchMessages(
+  page: Page,
+  conversationId: string,
+  accessToken?: string,
+): Promise<E2EMessage[]> {
+  const token = accessToken ?? (await getAccessToken(page));
+  return fetchJson<E2EMessage[]>(
+    page,
+    `/api/messages/${encodeURIComponent(conversationId)}`,
+    token,
+  );
+}
+
+async function postJsonWithStatus(page: Page, path: string, token: string, body: unknown) {
+  return page.evaluate(
+    async ({ accessToken, requestBody, urlPath }): Promise<JsonResponse> => {
+      const response = await fetch(urlPath, {
+        method: 'POST',
+        credentials: 'include',
+        headers: {
+          Authorization: `Bearer ${accessToken}`,
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify(requestBody),
+      });
+      const text = await response.text();
+      let json: unknown = null;
+      try {
+        json = text ? JSON.parse(text) : null;
+      } catch {
+        json = null;
+      }
+      return { ok: response.ok, status: response.status, text, json };
+    },
+    { accessToken: token, requestBody: body, urlPath: path },
+  );
+}
+
+async function waitForMessages(
+  page: Page,
+  conversationId: string,
+  predicate: (messages: E2EMessage[]) => boolean,
+  description: string,
+): Promise<E2EMessage[]> {
+  let latest: E2EMessage[] = [];
+  const token = await getAccessToken(page);
+  for (let attempt = 0; attempt < 80; attempt++) {
+    latest = await fetchMessages(page, conversationId, token);
+    if (predicate(latest)) {
+      return latest;
+    }
+    await new Promise((resolve) => setTimeout(resolve, 250));
+  }
+
+  throw new Error(
+    `Timed out waiting for ${description}. Latest messages:\n${latest
+      .map(
+        (message) => `${message.messageId} <- ${message.parentMessageId}: ${messageText(message)}`,
+      )
+      .join('\n')}`,
+  );
+}
+
+async function clickMessageTitleButton(page: Page, messageTextValue: string, title: string) {
+  const render = messageRender(page, messageTextValue);
+  await render.scrollIntoViewIfNeeded();
+  await render.hover();
+  await render.locator(`button[title="${title}"]`).last().click();
+}
+
+async function clickSibling(page: Page, messageTextValue: string, direction: 'Previous' | 'Next') {
+  const render = messageRender(page, messageTextValue);
+  await render.scrollIntoViewIfNeeded();
+  await render.hover();
+  await render.getByRole('button', { name: `${direction} sibling message` }).click();
+}
+
+async function expectCanCycleSiblingTexts(page: Page, previousText: string, nextText: string) {
+  const previous = messagesView(page).getByText(previousText);
+  const next = messagesView(page).getByText(nextText);
+  if (await previous.isVisible()) {
+    await clickSibling(page, previousText, 'Next');
+    await expect(next).toBeVisible();
+    await clickSibling(page, nextText, 'Previous');
+    await expect(previous).toBeVisible();
+    return;
+  }
+
+  if (await next.isVisible()) {
+    await clickSibling(page, nextText, 'Previous');
+    await expect(previous).toBeVisible();
+    await clickSibling(page, previousText, 'Next');
+    await expect(next).toBeVisible();
+    return;
+  }
+
+  throw new Error(`Expected either sibling "${previousText}" or "${nextText}" to be visible`);
+}
+
+async function clickForkVisibleMessages(
+  page: Page,
+  messageTextValue: string,
+): Promise<ForkResponse> {
+  const render = messageRender(page, messageTextValue);
+  await render.scrollIntoViewIfNeeded();
+  await render.hover();
+  await render.getByRole('button', { name: 'Open Fork Menu' }).click();
+
+  const [response] = await Promise.all([
+    page.waitForResponse(
+      (res) =>
+        res.request().method() === 'POST' &&
+        res.url().includes('/api/convos/fork') &&
+        res.status() === 200,
+      { timeout: 30000 },
+    ),
+    page.getByRole('button', { name: 'Visible messages only', exact: true }).click(),
+  ]);
+
+  return (await response.json()) as ForkResponse;
+}
+
+test.describe('message tree stream operations', () => {
+  test.setTimeout(180000);
+
+  test('streams follow-ups and keeps an aborted response as the next parent', async ({ page }) => {
+    const label = uniqueLabel('abort');
+    const firstPrompt = replyPrompt(`${label}-first`);
+    const firstReply = replyText(`${label}-first`);
+    const secondPrompt = replyPrompt(`${label}-second`);
+    const secondReply = replyText(`${label}-second`);
+    const abortPrompt = slowPrompt(`${label}-stop`);
+    const abortReply = slowReplyPrefix(`${label}-stop`);
+    const afterAbortPrompt = replyPrompt(`${label}-after-stop`);
+    const afterAbortReply = replyText(`${label}-after-stop`);
+
+    await openMockChat(page);
+    await sendAndExpectReply(page, firstPrompt, firstReply);
+    const conversationId = await conversationIdFromPage(page);
+    await sendAndExpectReply(page, secondPrompt, secondReply);
+
+    const slowStart = await sendMessage(page, abortPrompt);
+    expect(slowStart.ok()).toBeTruthy();
+    await expect(messagesView(page).getByText(abortReply)).toBeVisible({ timeout: 30000 });
+
+    const [abortResponse] = await Promise.all([
+      page.waitForResponse(
+        (response) =>
+          response.request().method() === 'POST' &&
+          response.url().includes('/api/agents/chat/abort'),
+        { timeout: 30000 },
+      ),
+      page.getByRole('button', { name: 'Stop generating' }).click(),
+    ]);
+    expect(abortResponse.ok()).toBeTruthy();
+    await expect(page.getByRole('button', { name: 'Stop generating' })).toBeHidden({
+      timeout: 30000,
+    });
+
+    let messages = await waitForMessages(
+      page,
+      conversationId,
+      (items) => items.some((message) => messageText(message).includes(abortReply)),
+      'aborted response to persist',
+    );
+    expectNoFoldedMessages(messages);
+    expectParent(messages, secondPrompt, firstReply, true);
+    expectParent(messages, abortReply, abortPrompt, false);
+
+    await sendAndExpectReply(page, afterAbortPrompt, afterAbortReply);
+    messages = await waitForMessages(
+      page,
+      conversationId,
+      (items) => items.some((message) => messageText(message).includes(afterAbortReply)),
+      'follow-up after abort',
+    );
+    expectNoFoldedMessages(messages);
+    expectParent(messages, afterAbortPrompt, abortReply, true);
+    expectParent(messages, afterAbortReply, afterAbortPrompt, false);
+
+    await reloadAndExpectMessages(page, [firstReply, secondReply, abortReply, afterAbortReply]);
+    await revisitConversationAndExpectMessages(page, conversationId, [
+      firstReply,
+      secondReply,
+      abortReply,
+      afterAbortReply,
+    ]);
+  });
+
+  test('regenerates assistant siblings, cycles branches, follows up, and forks the visible branch', async ({
+    page,
+  }) => {
+    const label = uniqueLabel('regen');
+    const prompt = countedPrompt(label);
+    const firstReply = countedReplyText(label, 1);
+    const regeneratedReply = countedReplyText(label, 2);
+    const followPrompt = replyPrompt(`${label}-follow`);
+    const followReply = replyText(`${label}-follow`);
+
+    await openMockChat(page);
+    await sendAndExpectReply(page, prompt, firstReply);
+    const originalConversationId = await conversationIdFromPage(page);
+
+    await waitForGenerationStart(page, () =>
+      clickMessageTitleButton(page, firstReply, 'Regenerate'),
+    );
+    await expect(messagesView(page).getByText(regeneratedReply)).toBeVisible({ timeout: 30000 });
+
+    await clickSibling(page, regeneratedReply, 'Previous');
+    await expect(messagesView(page).getByText(firstReply)).toBeVisible();
+    await expect(messagesView(page).getByText(regeneratedReply)).toBeHidden();
+    await clickSibling(page, firstReply, 'Next');
+    await expect(messagesView(page).getByText(regeneratedReply)).toBeVisible();
+
+    await sendAndExpectReply(page, followPrompt, followReply);
+    let messages = await waitForMessages(
+      page,
+      originalConversationId,
+      (items) => items.some((message) => messageText(message).includes(followReply)),
+      'follow-up after regenerate',
+    );
+    expectNoFoldedMessages(messages);
+    expectParent(messages, firstReply, prompt, false);
+    expectParent(messages, regeneratedReply, prompt, false);
+    expectParent(messages, followPrompt, regeneratedReply, true);
+    expectParent(messages, followReply, followPrompt, false);
+
+    const userMessage = findMessage(messages, prompt, true);
+    const assistantSiblings = messages.filter(
+      (message) => message.parentMessageId === userMessage.messageId && !message.isCreatedByUser,
+    );
+    expect(assistantSiblings.map(messageText).sort()).toEqual(
+      [firstReply, regeneratedReply].sort(),
+    );
+
+    await reloadAndExpectMessages(page, [regeneratedReply, followReply]);
+    await revisitConversationAndExpectMessages(page, originalConversationId, [
+      regeneratedReply,
+      followReply,
+    ]);
+    await clickSibling(page, regeneratedReply, 'Previous');
+    await expect(messagesView(page).getByText(firstReply)).toBeVisible();
+    const fork = await clickForkVisibleMessages(page, firstReply);
+    const forkedConversationId = fork.conversation.conversationId;
+    if (!forkedConversationId) {
+      throw new Error('Expected fork response to include a conversation id');
+    }
+    await expect(page).toHaveURL(new RegExp(`/c/${forkedConversationId}$`));
+
+    messages = fork.messages;
+    expectNoFoldedMessages(messages);
+    expect(messages.some((message) => messageText(message).includes(firstReply))).toBe(true);
+    expect(messages.some((message) => messageText(message).includes(regeneratedReply))).toBe(false);
+    expect(messages.some((message) => messageText(message).includes(followReply))).toBe(false);
+  });
+
+  test('shows the regenerating response immediately when regenerating a non-latest sibling', async ({
+    page,
+  }) => {
+    // A parent with multiple siblings, switched to an older one, then
+    // regenerated: the optimistic slice drops the target but keeps the other
+    // siblings, so the child count is unchanged and MultiMessage's
+    // length-change reset never fires. Without an explicit focus the view stays
+    // on the kept (newer) sibling and the streaming response is hidden until the
+    // server restores the dropped sibling at finalize. A slow reply keeps the
+    // stream open long enough to assert the during-stream state.
+    const label = uniqueLabel('regen-nonlatest');
+    const prompt = slowCountedPrompt(label);
+    const reply1 = slowCountedReplyText(label, 1);
+    const reply2 = slowCountedReplyText(label, 2);
+    const reply3 = slowCountedReplyText(label, 3);
+    const stopButton = page.getByRole('button', { name: 'Stop generating' });
+
+    await openMockChat(page);
+    await sendMessage(page, prompt);
+    await expect(messagesView(page).getByText(reply1)).toBeVisible({ timeout: 30000 });
+    await expect(stopButton).toBeHidden({ timeout: 30000 });
+
+    // First regenerate adds a sibling; the parent now has two responses.
+    await waitForGenerationStart(page, () => clickMessageTitleButton(page, reply1, 'Regenerate'));
+    await expect(messagesView(page).getByText(reply2)).toBeVisible({ timeout: 30000 });
+    await expect(stopButton).toBeHidden({ timeout: 30000 });
+
+    // View the older sibling, then regenerate it (the non-latest one).
+    await clickSibling(page, reply2, 'Previous');
+    await expect(messagesView(page).getByText(reply1)).toBeVisible();
+    await expect(messagesView(page).getByText(reply2)).toBeHidden();
+
+    await waitForGenerationStart(page, () => clickMessageTitleButton(page, reply1, 'Regenerate'));
+    // Still streaming (slow reply): the regenerating response must be visible
+    // now — not the kept sibling — and well before finalize.
+    await expect(stopButton).toBeVisible({ timeout: 30000 });
+    await expect(messagesView(page).getByText(reply3)).toBeVisible({ timeout: 4000 });
+    await expect(messagesView(page).getByText(reply2)).toBeHidden();
+
+    // It stays put after finalize too.
+    await expect(stopButton).toBeHidden({ timeout: 30000 });
+    await expect(messagesView(page).getByText(reply3)).toBeVisible();
+  });
+
+  test('does not flash the kept sibling before the created event when regenerating a non-latest sibling', async ({
+    page,
+  }) => {
+    // Same hazard at the optimistic (pre-`created`) render: useChatFunctions
+    // appends the placeholder and renders it before the request resolves. Gate
+    // the regenerate request so only that optimistic frame is on screen — with
+    // no `created` event to fall back on — and assert the kept sibling is
+    // already gone (the regenerating placeholder took its place). This isolates
+    // the optimistic focus; the createdHandler focus cannot mask a regression
+    // because `created` never arrives during the assertion.
+    const label = uniqueLabel('regen-precreated');
+    const prompt = countedPrompt(label);
+    const reply1 = countedReplyText(label, 1);
+    const reply2 = countedReplyText(label, 2);
+    const reply3 = countedReplyText(label, 3);
+
+    await openMockChat(page);
+    await sendAndExpectReply(page, prompt, reply1);
+
+    await waitForGenerationStart(page, () => clickMessageTitleButton(page, reply1, 'Regenerate'));
+    await expect(messagesView(page).getByText(reply2)).toBeVisible({ timeout: 30000 });
+
+    await clickSibling(page, reply2, 'Previous');
+    await expect(messagesView(page).getByText(reply1)).toBeVisible();
+    await expect(messagesView(page).getByText(reply2)).toBeHidden();
+
+    // Hold the SSE stream so the `created` event cannot arrive: the optimistic
+    // render is all there is. The chat POST returns a stream id; the stream
+    // itself is a separate GET (/api/agents/chat/stream/<id>) — gate that one,
+    // not the POST, which must complete to hand back the id.
+    let release = () => {};
+    const gate = new Promise<void>((resolve) => {
+      release = resolve;
+    });
+    await page.route(/\/api\/agents\/chat\/stream\//, async (route: Route) => {
+      await gate;
+      return route.continue();
+    });
+
+    try {
+      await clickMessageTitleButton(page, reply1, 'Regenerate');
+      // The stream is gated, so the regenerating response has no text yet.
+      await expect(messagesView(page).getByText(reply3)).toBeHidden();
+      // Pre-`created` window: the kept sibling must not be the one on screen —
+      // the regenerating placeholder has already taken its place.
+      await expect(messagesView(page).getByText(reply2)).toBeHidden({ timeout: 5000 });
+      await expect(messagesView(page).getByText(reply1)).toBeHidden();
+    } finally {
+      release();
+    }
+
+    await expect(messagesView(page).getByText(reply3)).toBeVisible({ timeout: 30000 });
+  });
+
+  test('resumes pending OAuth on the selected older branch after reload', async ({ page }) => {
+    const label = uniqueLabel('oauth-branch');
+    const rootPrompt = countedPrompt(`${label}-root`);
+    const firstReply = countedReplyText(`${label}-root`, 1);
+    const regeneratedReply = countedReplyText(`${label}-root`, 2);
+    const followPrompt = replyPrompt(`${label}-follow`);
+    const followReply = replyText(`${label}-follow`);
+    const pendingPrompt = replyPrompt(`${label}-oauth`);
+
+    await openMockChat(page);
+    await sendAndExpectReply(page, rootPrompt, firstReply);
+    const conversationId = await conversationIdFromPage(page);
+    await sendAndExpectReply(page, followPrompt, followReply);
+
+    await waitForGenerationStart(page, () =>
+      clickMessageTitleButton(page, firstReply, 'Regenerate'),
+    );
+    await expect(messagesView(page).getByText(regeneratedReply)).toBeVisible({ timeout: 30000 });
+
+    await clickSibling(page, regeneratedReply, 'Previous');
+    await expectVisibleMessages(page, [firstReply, followPrompt, followReply]);
+    await expect(messagesView(page).getByText(regeneratedReply)).toBeHidden();
+
+    const messages = await waitForMessages(
+      page,
+      conversationId,
+      (items) =>
+        items.some((message) => messageText(message).includes(followReply)) &&
+        items.some((message) => messageText(message).includes(regeneratedReply)),
+      'two-branch conversation',
+    );
+    const branchOneTail = findMessage(messages, followReply, false);
+
+    await mockActiveOAuthResumeStream({
+      page,
+      conversationId,
+      parentMessageId: branchOneTail.messageId,
+      pendingPrompt,
+      pendingUserMessageId: `${label}-pending-user`,
+      authUrl: `https://auth.example.test/${label}`,
+    });
+
+    await page.reload({ timeout: 10000 });
+    await expectVisibleMessages(page, [firstReply, followPrompt, followReply, pendingPrompt]);
+    await expect(messagesView(page).getByText(regeneratedReply)).toBeHidden();
+  });
+
+  test('keeps existing messages visible when resumed OAuth streams post-auth content', async ({
+    page,
+  }) => {
+    const label = uniqueLabel('oauth-post-auth');
+    const rootPrompt = replyPrompt(`${label}-root`);
+    const rootReply = replyText(`${label}-root`);
+    const pendingPrompt = replyPrompt(`${label}-pending`);
+    const postAuthText = `E2E post-auth OAuth reply ${label}`;
+
+    await openMockChat(page);
+    await sendAndExpectReply(page, rootPrompt, rootReply);
+    const conversationId = await conversationIdFromPage(page);
+
+    const messages = await waitForMessages(
+      page,
+      conversationId,
+      (items) => items.some((message) => messageText(message).includes(rootReply)),
+      'root reply before OAuth resume',
+    );
+    const branchTail = findMessage(messages, rootReply, false);
+
+    await mockActiveOAuthResumeStream({
+      page,
+      conversationId,
+      parentMessageId: branchTail.messageId,
+      pendingPrompt,
+      pendingUserMessageId: `${label}-pending-user`,
+      authUrl: `https://auth.example.test/${label}`,
+      postAuthRunId: `${label}-stable-response`,
+      postAuthText,
+    });
+
+    await page.reload({ timeout: 10000 });
+    await expectVisibleMessages(page, [rootPrompt, rootReply, pendingPrompt, postAuthText]);
+  });
+
+  test('keeps existing messages visible when OAuth completes before created', async ({ page }) => {
+    const label = uniqueLabel('oauth-pre-created');
+    const rootPrompt = replyPrompt(`${label}-root`);
+    const rootReply = replyText(`${label}-root`);
+    const followPrompt = replyPrompt(`${label}-follow`);
+    const postAuthText = `E2E pre-created OAuth reply ${label}`;
+
+    await openMockChat(page);
+    await sendAndExpectReply(page, rootPrompt, rootReply);
+    const conversationId = await conversationIdFromPage(page);
+
+    const messages = await waitForMessages(
+      page,
+      conversationId,
+      (items) => items.some((message) => messageText(message).includes(rootReply)),
+      'root reply before pre-created OAuth stream',
+    );
+    const branchTail = findMessage(messages, rootReply, false);
+
+    await mockPreCreatedOAuthStream({
+      page,
+      conversationId,
+      parentMessageId: branchTail.messageId,
+      prompt: followPrompt,
+      serverUserMessageId: `${label}-server-user`,
+      responseMessageId: `${label}-response`,
+      authUrl: `https://auth.example.test/${label}`,
+      postAuthText,
+    });
+
+    const response = await sendMessage(page, followPrompt);
+    expect(response.ok()).toBeTruthy();
+    await expectVisibleMessages(page, [rootPrompt, rootReply, followPrompt, postAuthText]);
+  });
+
+  test('long threads retain regenerated and save-and-submit branches after revisit', async ({
+    page,
+  }) => {
+    const label = uniqueLabel('save-submit');
+    const rootPrompt = replyPrompt(`${label}-root`);
+    const rootReply = replyText(`${label}-root`);
+    const firstPrompt = replyPrompt(`${label}-first`);
+    const firstReply = replyText(`${label}-first`);
+    const middlePrompt = replyPrompt(`${label}-middle`);
+    const middleReply = replyText(`${label}-middle`);
+    const fourthPrompt = replyPrompt(`${label}-fourth`);
+    const fourthReply = replyText(`${label}-fourth`);
+    const tailPrompt = countedPrompt(`${label}-tail`);
+    const tailReply = countedReplyText(`${label}-tail`, 1);
+    const regeneratedTailReply = countedReplyText(`${label}-tail`, 2);
+    const editedMiddlePrompt = replyPrompt(`${label}-middle-edited`);
+    const editedMiddleReply = replyText(`${label}-middle-edited`);
+    const afterEditPrompt = replyPrompt(`${label}-after-edit`);
+    const afterEditReply = replyText(`${label}-after-edit`);
+
+    await openMockChat(page);
+    await sendAndExpectReply(page, rootPrompt, rootReply);
+    const conversationId = await conversationIdFromPage(page);
+    await sendAndExpectReply(page, firstPrompt, firstReply);
+    await sendAndExpectReply(page, middlePrompt, middleReply);
+    await sendAndExpectReply(page, fourthPrompt, fourthReply);
+    await sendAndExpectReply(page, tailPrompt, tailReply);
+
+    await waitForGenerationStart(page, () =>
+      clickMessageTitleButton(page, tailReply, 'Regenerate'),
+    );
+    await expect(messagesView(page).getByText(regeneratedTailReply)).toBeVisible({
+      timeout: 30000,
+    });
+
+    await clickMessageTitleButton(page, middlePrompt, 'Edit');
+    const editor = page.getByTestId('message-text-editor');
+    await expect(editor).toBeVisible();
+    await editor.fill(editedMiddlePrompt);
+    await waitForGenerationStart(page, () =>
+      page.getByRole('button', { name: 'Save & Submit' }).click(),
+    );
+    await expect(messagesView(page).getByText(editedMiddleReply)).toBeVisible({ timeout: 30000 });
+
+    let messages = await waitForMessages(
+      page,
+      conversationId,
+      (items) => items.some((message) => messageText(message).includes(editedMiddleReply)),
+      'save-and-submit edited branch',
+    );
+    expectNoFoldedMessages(messages);
+    expectParent(messages, firstPrompt, rootReply, true);
+    expectParent(messages, firstReply, firstPrompt, false);
+    expectParent(messages, middlePrompt, firstReply, true);
+    expectParent(messages, middleReply, middlePrompt, false);
+    expectParent(messages, fourthPrompt, middleReply, true);
+    expectParent(messages, fourthReply, fourthPrompt, false);
+    expectParent(messages, tailPrompt, fourthReply, true);
+    expectParent(messages, tailReply, tailPrompt, false);
+    expectParent(messages, regeneratedTailReply, tailPrompt, false);
+    expectParent(messages, editedMiddlePrompt, firstReply, true);
+    expectParent(messages, editedMiddleReply, editedMiddlePrompt, false);
+
+    await clickSibling(page, editedMiddlePrompt, 'Previous');
+    await expectVisibleMessages(page, [middlePrompt, fourthReply]);
+    await expectCanCycleSiblingTexts(page, tailReply, regeneratedTailReply);
+    await clickSibling(page, middlePrompt, 'Next');
+    await expectVisibleMessages(page, [editedMiddlePrompt, editedMiddleReply]);
+
+    await sendAndExpectReply(page, afterEditPrompt, afterEditReply);
+    messages = await waitForMessages(
+      page,
+      conversationId,
+      (items) => items.some((message) => messageText(message).includes(afterEditReply)),
+      'follow-up after save-and-submit branch',
+    );
+    expectNoFoldedMessages(messages);
+    expectParent(messages, afterEditPrompt, editedMiddleReply, true);
+    expectParent(messages, afterEditReply, afterEditPrompt, false);
+    expect(messages.some((message) => messageText(message).includes(tailReply))).toBe(true);
+    expect(messages.some((message) => messageText(message).includes(regeneratedTailReply))).toBe(
+      true,
+    );
+
+    await reloadAndExpectMessages(page, [rootReply, firstReply, editedMiddleReply, afterEditReply]);
+    await revisitConversationAndExpectMessages(page, conversationId, [
+      rootReply,
+      firstReply,
+      editedMiddleReply,
+      afterEditReply,
+    ]);
+    await clickSibling(page, editedMiddlePrompt, 'Previous');
+    await expectVisibleMessages(page, [middlePrompt, fourthReply]);
+    await expectCanCycleSiblingTexts(page, tailReply, regeneratedTailReply);
+    await clickSibling(page, middlePrompt, 'Next');
+    await expectVisibleMessages(page, [editedMiddlePrompt, editedMiddleReply, afterEditReply]);
+  });
+
+  test('error responses remain valid parents for follow-ups', async ({ page }) => {
+    const label = uniqueLabel('error');
+    const basePrompt = replyPrompt(`${label}-base`);
+    const baseReply = replyText(`${label}-base`);
+    const errorPrompt = `E2E_FORCED_ERROR:${label}`;
+    const errorText = `E2E forced stream error ${label}`;
+    const afterErrorPrompt = replyPrompt(`${label}-after-error`);
+    const afterErrorReply = replyText(`${label}-after-error`);
+
+    await openMockChat(page);
+    await sendAndExpectReply(page, basePrompt, baseReply);
+    const conversationId = await conversationIdFromPage(page);
+
+    await sendAndExpectReply(page, errorPrompt, errorText);
+    await expect(messagesView(page).getByText(errorText)).toBeVisible({ timeout: 30000 });
+
+    await sendAndExpectReply(page, afterErrorPrompt, afterErrorReply);
+    const messages = await waitForMessages(
+      page,
+      conversationId,
+      (items) => items.some((message) => messageText(message).includes(afterErrorReply)),
+      'follow-up after error',
+    );
+    expectNoFoldedMessages(messages);
+    expectParent(messages, errorPrompt, baseReply, true);
+    expectParent(messages, errorText, errorPrompt, false);
+    expectParent(messages, afterErrorPrompt, errorText, true);
+    expectParent(messages, afterErrorReply, afterErrorPrompt, false);
+
+    await reloadAndExpectMessages(page, [baseReply, errorText, afterErrorReply]);
+    await revisitConversationAndExpectMessages(page, conversationId, [
+      baseReply,
+      errorText,
+      afterErrorReply,
+    ]);
+  });
+
+  test('rejects normal follow-ups whose parent is a preliminary assistant placeholder', async ({
+    page,
+  }) => {
+    const label = uniqueLabel('placeholder-parent');
+    const basePrompt = replyPrompt(`${label}-base`);
+    const baseReply = replyText(`${label}-base`);
+    const followPrompt = replyPrompt(`${label}-follow`);
+
+    await openMockChat(page);
+    await sendAndExpectReply(page, basePrompt, baseReply);
+    const conversationId = await conversationIdFromPage(page);
+    const token = await getAccessToken(page);
+
+    const beforeMessages = await fetchMessages(page, conversationId, token);
+    const stableParent = findMessage(beforeMessages, baseReply, false);
+    const response = await postJsonWithStatus(
+      page,
+      `/api/agents/chat/${encodeURIComponent(MOCK_ENDPOINTS[0].label)}`,
+      token,
+      {
+        text: followPrompt,
+        sender: 'User',
+        clientTimestamp: new Date().toLocaleString('sv').replace(' ', 'T'),
+        isCreatedByUser: true,
+        parentMessageId: `${stableParent.messageId}_`,
+        conversationId,
+        messageId: `${label}-user-message`,
+        endpoint: MOCK_ENDPOINTS[0].label,
+        endpointType: 'custom',
+        model: MOCK_ENDPOINTS[0].model,
+        spec: 'e2e-mock-provider-a',
+        isTemporary: false,
+        isRegenerate: false,
+        error: false,
+      },
+    );
+
+    expect(response.status).toBe(409);
+    expect(response.json).toEqual(
+      expect.objectContaining({
+        error: expect.stringContaining('selected parent response is still being saved'),
+      }),
+    );
+
+    const afterMessages = await fetchMessages(page, conversationId, token);
+    expect(afterMessages.map((message) => message.messageId).sort()).toEqual(
+      beforeMessages.map((message) => message.messageId).sort(),
+    );
+    expect(afterMessages.some((message) => messageText(message).includes(followPrompt))).toBe(
+      false,
+    );
+    expectNoFoldedMessages(afterMessages);
+  });
+
+  test('generation-start failures recover without folding the next follow-up', async ({ page }) => {
+    const label = uniqueLabel('start-error');
+    const basePrompt = replyPrompt(`${label}-base`);
+    const baseReply = replyText(`${label}-base`);
+    const failedPrompt = replyPrompt(`${label}-failed-start`);
+    const failedText = `E2E generation start failure ${label}`;
+    const afterFailurePrompt = replyPrompt(`${label}-after-start-failure`);
+    const afterFailureReply = replyText(`${label}-after-start-failure`);
+
+    await openMockChat(page);
+    await sendAndExpectReply(page, basePrompt, baseReply);
+    const conversationId = await conversationIdFromPage(page);
+
+    const failGenerationStart = async (route: Route) => {
+      const request = route.request();
+      const { pathname } = new URL(request.url());
+      const isAgentsChat =
+        pathname === '/api/agents/chat' || pathname.startsWith('/api/agents/chat/');
+      if (
+        request.method() !== 'POST' ||
+        !isAgentsChat ||
+        pathname.endsWith('/abort') ||
+        !request.postData()?.includes(failedPrompt)
+      ) {
+        await route.continue();
+        return;
+      }
+
+      await route.fulfill({
+        status: 500,
+        contentType: 'application/json',
+        body: JSON.stringify({ message: failedText }),
+      });
+    };
+    await page.route('**/api/agents/chat**', failGenerationStart);
+
+    const failure = await submitMessageExpectingGenerationFailure(page, failedPrompt, 500);
+    expect(failure.ok()).toBe(false);
+    await expect(messagesView(page).getByText(failedText)).toBeVisible({ timeout: 30000 });
+    await expect(page.getByRole('textbox', { name: 'Message input' })).toBeEnabled({
+      timeout: 30000,
+    });
+    await page.unroute('**/api/agents/chat**', failGenerationStart);
+
+    await sendAndExpectReply(page, afterFailurePrompt, afterFailureReply);
+    const messages = await waitForMessages(
+      page,
+      conversationId,
+      (items) => items.some((message) => messageText(message).includes(afterFailureReply)),
+      'follow-up after generation-start failure',
+    );
+    expectNoFoldedMessages(messages);
+    expectParent(messages, afterFailurePrompt, baseReply, true);
+    expectParent(messages, afterFailureReply, afterFailurePrompt, false);
+    expect(messages.some((message) => messageText(message).includes(failedPrompt))).toBe(false);
+    expect(messages.some((message) => messageText(message).includes(failedText))).toBe(false);
+
+    await reloadAndExpectMessages(page, [baseReply, afterFailureReply]);
+    await expect(messagesView(page).getByText(failedText)).toBeHidden();
+    await revisitConversationAndExpectMessages(page, conversationId, [
+      baseReply,
+      afterFailureReply,
+    ]);
+    await expect(messagesView(page).getByText(failedText)).toBeHidden();
+  });
+});
diff --git a/e2e/specs/mock/model-spec-branding.spec.ts b/e2e/specs/mock/model-spec-branding.spec.ts
new file mode 100644
index 00000000000..493572cfd5e
--- /dev/null
+++ b/e2e/specs/mock/model-spec-branding.spec.ts
@@ -0,0 +1,47 @@
+import { expect, test } from '@playwright/test';
+import { getPrimaryE2EUser } from '../../setup/users.mock';
+import { NEW_CHAT_PATH, selectModelSpec } from './helpers';
+
+/** Spec with `showOnLanding: true` and an HTML `description` in e2e/config/librechat.e2e.yaml. */
+const BRANDED_SPEC = {
+  label: 'E2E Branded',
+  descriptionText: 'Branded answers',
+  descriptionIcon: '/assets/openai.svg',
+};
+
+/** The `softDefault: true` spec does not set `showOnLanding`, so it is unbranded. */
+const UNBRANDED_SPEC_LABEL = 'E2E Soft Default';
+
+test.describe('model spec branding on landing', () => {
+  test('branded spec replaces the greeting with its label and rendered description', async ({
+    page,
+  }) => {
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectModelSpec(page, BRANDED_SPEC.label);
+
+    const main = page.getByRole('main');
+    await expect(main).toContainText(BRANDED_SPEC.label);
+    await expect(main).toContainText(BRANDED_SPEC.descriptionText);
+    await expect(main.locator(`img[src$="${BRANDED_SPEC.descriptionIcon}"]`)).toBeVisible();
+
+    const user = getPrimaryE2EUser();
+    await expect(main).not.toContainText(user.name);
+  });
+
+  test('unbranded spec keeps the personalized greeting', async ({ page }) => {
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectModelSpec(page, UNBRANDED_SPEC_LABEL);
+
+    const user = getPrimaryE2EUser();
+    await expect(page.getByRole('main')).toContainText(user.name);
+  });
+
+  test('branded spec renders its description in the model selector', async ({ page }) => {
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+
+    await page.getByRole('button', { name: 'Select a model' }).first().click();
+    const option = page.getByRole('option', { name: new RegExp(BRANDED_SPEC.label) });
+    await expect(option).toContainText(BRANDED_SPEC.descriptionText);
+    await expect(option.locator(`img[src$="${BRANDED_SPEC.descriptionIcon}"]`)).toBeVisible();
+  });
+});
diff --git a/e2e/specs/mock/model-spec-icons.spec.ts b/e2e/specs/mock/model-spec-icons.spec.ts
new file mode 100644
index 00000000000..64b861bbfd8
--- /dev/null
+++ b/e2e/specs/mock/model-spec-icons.spec.ts
@@ -0,0 +1,82 @@
+import { expect, test } from '@playwright/test';
+import type { Locator, Page } from '@playwright/test';
+import { NEW_CHAT_PATH, selectModelSpec, sendMessage } from './helpers';
+
+const ICON_SPEC_LABEL = 'E2E Icon Spec';
+const ICON_SPEC_URL = '/assets/openai.svg';
+
+const uniqueLabel = (name: string) => `${name}-${Date.now()}-${Math.floor(Math.random() * 1e6)}`;
+const iconPrompt = (label: string) => `E2E_RESUME_ICON_REPLY:${label}`;
+const iconReplyPrefix = (label: string) => `E2E resume icon reply ${label}`;
+
+const assistantMessage = (page: Page, text: string) =>
+  page.locator('.message-render').filter({ hasText: text }).last();
+
+const modelSpecIcon = (message: Locator) => message.locator(`img[src$="${ICON_SPEC_URL}"]`);
+
+async function openIconSpecChat(page: Page) {
+  await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+  await selectModelSpec(page, ICON_SPEC_LABEL);
+}
+
+async function sendIconSpecStream(page: Page, label: string) {
+  const response = await sendMessage(page, iconPrompt(label));
+  expect(response.ok()).toBeTruthy();
+  await expect(page).toHaveURL(/\/c\/[0-9a-fA-F-]{36}(?:\?.*)?$/);
+
+  const reply = iconReplyPrefix(label);
+  const message = assistantMessage(page, reply);
+  await expect(message.getByText(reply)).toBeVisible({ timeout: 30000 });
+  await expect(modelSpecIcon(message)).toBeVisible();
+
+  return { conversationUrl: page.url(), reply };
+}
+
+test.describe('model spec message icons', () => {
+  test('preserves iconURL when resuming an active stream after navigation', async ({ page }) => {
+    test.setTimeout(90000);
+    const label = uniqueLabel('resume-icon');
+
+    await openIconSpecChat(page);
+    const { conversationUrl, reply } = await sendIconSpecStream(page, label);
+
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await page.goto(conversationUrl, { timeout: 10000 });
+
+    const resumedMessage = assistantMessage(page, reply);
+    await expect(resumedMessage.getByText(reply)).toBeVisible({ timeout: 30000 });
+    await expect(modelSpecIcon(resumedMessage)).toBeVisible();
+    await expect(page.getByRole('button', { name: 'Stop generating' })).toBeVisible();
+  });
+
+  test('preserves iconURL when aborting an active model spec stream', async ({ page }) => {
+    test.setTimeout(90000);
+    const label = uniqueLabel('abort-icon');
+
+    await openIconSpecChat(page);
+    const { reply } = await sendIconSpecStream(page, label);
+
+    const [abortResponse] = await Promise.all([
+      page.waitForResponse(
+        (response) =>
+          response.request().method() === 'POST' &&
+          response.url().includes('/api/agents/chat/abort'),
+        { timeout: 30000 },
+      ),
+      page.getByRole('button', { name: 'Stop generating' }).click(),
+    ]);
+    expect(abortResponse.ok()).toBeTruthy();
+    await expect(page.getByRole('button', { name: 'Stop generating' })).toBeHidden({
+      timeout: 30000,
+    });
+
+    const abortedMessage = assistantMessage(page, reply);
+    await expect(abortedMessage.getByText(reply)).toBeVisible();
+    await expect(modelSpecIcon(abortedMessage)).toBeVisible();
+
+    await page.reload({ timeout: 10000 });
+    const reloadedMessage = assistantMessage(page, reply);
+    await expect(reloadedMessage.getByText(reply)).toBeVisible({ timeout: 30000 });
+    await expect(modelSpecIcon(reloadedMessage)).toBeVisible();
+  });
+});
diff --git a/e2e/specs/mock/model-spec-skills.spec.ts b/e2e/specs/mock/model-spec-skills.spec.ts
new file mode 100644
index 00000000000..b0c9394959a
--- /dev/null
+++ b/e2e/specs/mock/model-spec-skills.spec.ts
@@ -0,0 +1,175 @@
+import { expect, test } from '@playwright/test';
+import { MongoClient, ObjectId } from 'mongodb';
+import type { Page } from '@playwright/test';
+import { applyRuntimeEnv } from '../../setup/runtimeEnv';
+import {
+  NEW_CHAT_PATH,
+  fetchJson,
+  getAccessToken,
+  requestJson,
+  selectModelSpec,
+  sendMessage,
+} from './helpers';
+
+const MODEL_SPEC_LABEL = 'E2E Skill Scope';
+const ASSERTION_MARKER = 'E2E_ASSERT_MODEL_SPEC_SKILLS';
+const ASSERTION_FINAL_TEXT = 'E2E model spec skill assertion passed';
+const ACCESSIBLE_SKILL_NAME = 'e2e-model-spec-allowed';
+const INACCESSIBLE_SKILL_NAME = 'e2e-model-spec-inaccessible';
+const ALWAYS_APPLY_BODY_MARKER = 'E2E_ALWAYS_APPLY_BODY_MARKER';
+const INACCESSIBLE_AUTHOR_ID = new ObjectId('64f000000000000000000001');
+const SKILL_DESCRIPTION =
+  'Use this skill to verify model-spec skill scoping and always-apply priming in mock e2e tests.';
+
+type SkillSummary = {
+  _id: string;
+  name: string;
+  description: string;
+  version: number;
+  alwaysApply?: boolean;
+};
+
+type SkillDetail = SkillSummary & {
+  body: string;
+};
+
+function buildSkillBody(name: string) {
+  return `---
+name: ${name}
+description: ${SKILL_DESCRIPTION}
+alwaysApply: true
+---
+
+# ${name}
+
+${ALWAYS_APPLY_BODY_MARKER}
+
+This body should be injected as an always-apply skill prime.`;
+}
+
+async function findSkill(
+  page: Page,
+  skillName: string,
+  token: string,
+): Promise<SkillSummary | null> {
+  const body = await fetchJson<{ skills?: SkillSummary[] }>(
+    page,
+    `/api/skills?search=${encodeURIComponent(skillName)}&limit=10`,
+    token,
+  );
+  return body.skills?.find((skill) => skill.name === skillName) ?? null;
+}
+
+async function seedAccessibleSkill(page: Page, token: string): Promise<SkillDetail> {
+  const body = buildSkillBody(ACCESSIBLE_SKILL_NAME);
+  const payload = {
+    name: ACCESSIBLE_SKILL_NAME,
+    description: SKILL_DESCRIPTION,
+    body,
+  };
+  const existing = await findSkill(page, ACCESSIBLE_SKILL_NAME, token);
+  if (!existing) {
+    return requestJson<SkillDetail>(page, {
+      path: '/api/skills',
+      token,
+      method: 'POST',
+      body: payload,
+    });
+  }
+
+  const detail = await fetchJson<SkillDetail>(
+    page,
+    `/api/skills/${encodeURIComponent(existing._id)}`,
+    token,
+  );
+  return requestJson<SkillDetail>(page, {
+    path: `/api/skills/${encodeURIComponent(existing._id)}`,
+    token,
+    method: 'PATCH',
+    body: {
+      ...payload,
+      expectedVersion: detail.version,
+    },
+  });
+}
+
+async function seedInaccessibleSkill() {
+  applyRuntimeEnv();
+  if (!process.env.MONGO_URI) {
+    throw new Error('MONGO_URI must be available for model-spec skill mock e2e tests');
+  }
+
+  const client = new MongoClient(process.env.MONGO_URI);
+  await client.connect();
+  try {
+    const db = client.db();
+    const skills = db.collection('skills');
+    const aclEntries = db.collection('aclentries');
+    const now = new Date();
+    await skills.updateOne(
+      {
+        name: INACCESSIBLE_SKILL_NAME,
+        author: INACCESSIBLE_AUTHOR_ID,
+        tenantId: null,
+      },
+      {
+        $set: {
+          description: SKILL_DESCRIPTION,
+          body: buildSkillBody(INACCESSIBLE_SKILL_NAME),
+          authorName: 'Inaccessible E2E User',
+          updatedAt: now,
+        },
+        $setOnInsert: {
+          displayTitle: INACCESSIBLE_SKILL_NAME,
+          frontmatter: {},
+          disableModelInvocation: false,
+          userInvocable: true,
+          allowedTools: [],
+          alwaysApply: true,
+          source: 'inline',
+          fileCount: 0,
+          version: 1,
+          createdAt: now,
+        },
+      },
+      { upsert: true },
+    );
+    const skill = await skills.findOne({
+      name: INACCESSIBLE_SKILL_NAME,
+      author: INACCESSIBLE_AUTHOR_ID,
+      tenantId: null,
+    });
+    if (skill?._id) {
+      await aclEntries.deleteMany({ resourceType: 'skill', resourceId: skill._id });
+    }
+  } finally {
+    await client.close();
+  }
+}
+
+test.describe('model spec skills', () => {
+  test('loads accessible configured skills and skips missing or inaccessible names', async ({
+    page,
+  }) => {
+    test.setTimeout(120000);
+
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    const token = await getAccessToken(page);
+    const skill = await seedAccessibleSkill(page, token);
+    expect(skill.alwaysApply).toBe(true);
+    await seedInaccessibleSkill();
+
+    await selectModelSpec(page, MODEL_SPEC_LABEL);
+    const response = await sendMessage(
+      page,
+      `${ASSERTION_MARKER}\nVerify model-spec skill scope and always-apply frontmatter.`,
+    );
+    expect(response.ok()).toBeTruthy();
+
+    await expect(
+      page
+        .getByTestId('messages-view')
+        .getByText(`${ASSERTION_FINAL_TEXT}: ${ACCESSIBLE_SKILL_NAME}`),
+    ).toBeVisible({ timeout: 30000 });
+  });
+});
diff --git a/e2e/specs/mock/model-spec-starters.spec.ts b/e2e/specs/mock/model-spec-starters.spec.ts
new file mode 100644
index 00000000000..a723f965311
--- /dev/null
+++ b/e2e/specs/mock/model-spec-starters.spec.ts
@@ -0,0 +1,49 @@
+import { expect, test } from '@playwright/test';
+import { messagesView, NEW_CHAT_PATH, replyPrompt, replyText, selectModelSpec } from './helpers';
+
+/** Spec with five `conversation_starters` in e2e/config/librechat.e2e.yaml; only four may render. */
+const STARTER_SPEC_LABEL = 'E2E Starters';
+const STARTER_PROMPTS = [
+  replyPrompt('starter'),
+  'Plan my week',
+  'Third starter prompt',
+  'Fourth starter prompt',
+];
+const STARTER_BEYOND_CAP = 'Fifth starter beyond the cap';
+
+/** A spec without `conversation_starters`. */
+const PLAIN_SPEC_LABEL = 'E2E Soft Default';
+
+test.describe('model spec conversation starters', () => {
+  test('starter prompts render on the landing for a spec that defines them', async ({ page }) => {
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectModelSpec(page, STARTER_SPEC_LABEL);
+
+    for (const text of STARTER_PROMPTS) {
+      await expect(page.getByRole('button', { name: text })).toBeVisible();
+    }
+    await expect(page.getByRole('button', { name: STARTER_BEYOND_CAP })).toBeHidden();
+  });
+
+  test('a spec without starters shows none', async ({ page }) => {
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectModelSpec(page, PLAIN_SPEC_LABEL);
+
+    for (const text of STARTER_PROMPTS) {
+      await expect(page.getByRole('button', { name: text })).toBeHidden();
+    }
+  });
+
+  test('clicking a starter submits it as the first message', async ({ page }) => {
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectModelSpec(page, STARTER_SPEC_LABEL);
+
+    const prompt = replyPrompt('starter');
+    await page.getByRole('button', { name: prompt }).click();
+
+    await expect(messagesView(page).getByText(prompt)).toBeVisible({ timeout: 30000 });
+    await expect(messagesView(page).getByText(replyText('starter'))).toBeVisible({
+      timeout: 30000,
+    });
+  });
+});
diff --git a/e2e/specs/mock/permissions.spec.ts b/e2e/specs/mock/permissions.spec.ts
new file mode 100644
index 00000000000..ae02995c327
--- /dev/null
+++ b/e2e/specs/mock/permissions.spec.ts
@@ -0,0 +1,407 @@
+import { expect, request as playwrightRequest, test } from '@playwright/test';
+import { MongoClient, ObjectId } from 'mongodb';
+import type { APIRequestContext } from '@playwright/test';
+import type { Collection, Db } from 'mongodb';
+import cleanupUser from '../../setup/cleanupUser';
+import { applyRuntimeEnv } from '../../setup/runtimeEnv';
+
+type TestUser = {
+  email: string;
+  name: string;
+  password: string;
+};
+
+type UserDoc = {
+  _id: ObjectId;
+  email: string;
+  name: string;
+  tenantId?: string;
+};
+
+type GroupDoc = {
+  _id: ObjectId;
+  name: string;
+  email?: string;
+  tenantId?: string;
+};
+
+type AccessRoleDoc = {
+  _id: ObjectId;
+  accessRoleId: string;
+  resourceType: string;
+  permBits: number;
+  tenantId?: string;
+};
+
+type PrincipalResponse = {
+  type: string;
+  id: string;
+  email?: string;
+  name?: string;
+  accessRoleId: string;
+};
+
+type PermissionsResponse = {
+  principals: PrincipalResponse[];
+};
+
+type AuthenticatedRequest = {
+  api: APIRequestContext;
+  token: string;
+  role: string;
+};
+
+const CURRENT_TENANT_ID = 'e2e-acl-current';
+const OTHER_TENANT_ID = 'e2e-acl-other';
+const RESOURCE_TYPE_AGENT = 'agent';
+const PRINCIPAL_TYPE_USER = 'user';
+const PRINCIPAL_TYPE_GROUP = 'group';
+const PRINCIPAL_MODEL_USER = 'User';
+const PRINCIPAL_MODEL_GROUP = 'Group';
+const ACCESS_ROLE_AGENT_OWNER = 'agent_owner';
+const ACCESS_ROLE_AGENT_VIEWER = 'agent_viewer';
+const PERM_BITS_VIEWER = 1;
+const PERM_BITS_OWNER = 15;
+
+const randomSuffix = () => `${Date.now()}-${Math.floor(Math.random() * 10000)}`;
+
+async function connectToE2EDb() {
+  applyRuntimeEnv();
+  if (!process.env.MONGO_URI) {
+    throw new Error('MONGO_URI must be available for permissions mock e2e tests');
+  }
+
+  const client = new MongoClient(process.env.MONGO_URI);
+  await client.connect();
+  return { client, db: client.db() };
+}
+
+async function createAuthenticatedRequest(
+  baseURL: string,
+  user: TestUser,
+  tenantId: string,
+): Promise<AuthenticatedRequest> {
+  await cleanupUser(user);
+
+  const api = await playwrightRequest.newContext({
+    baseURL,
+    storageState: { cookies: [], origins: [] },
+    extraHTTPHeaders: {
+      'X-Tenant-Id': tenantId,
+    },
+  });
+
+  const registerResponse = await api.post('/api/auth/register', {
+    data: {
+      email: user.email,
+      name: user.name,
+      password: user.password,
+      confirm_password: user.password,
+    },
+  });
+  expect(registerResponse.ok()).toBeTruthy();
+
+  const loginResponse = await api.post('/api/auth/login', {
+    data: {
+      email: user.email,
+      password: user.password,
+    },
+  });
+  expect(loginResponse.ok()).toBeTruthy();
+  const loginPayload = (await loginResponse.json()) as { token?: string; user?: { role?: string } };
+  if (!loginPayload.token || !loginPayload.user?.role) {
+    throw new Error('Expected login response to include a bearer token and user role');
+  }
+
+  return {
+    api,
+    token: loginPayload.token,
+    role: loginPayload.user.role,
+  };
+}
+
+async function seedTenantRole(db: Db, tenantId: string, roleName: string) {
+  await db.collection('roles').updateOne(
+    { name: roleName, tenantId },
+    {
+      $set: {
+        name: roleName,
+        tenantId,
+        permissions: {
+          AGENTS: {
+            USE: true,
+            CREATE: true,
+            SHARE: true,
+            SHARE_PUBLIC: true,
+          },
+        },
+      },
+      $setOnInsert: {
+        createdAt: new Date(),
+      },
+      $currentDate: {
+        updatedAt: true,
+      },
+    },
+    { upsert: true },
+  );
+}
+
+async function seedAccessRole(
+  accessRoles: Collection<AccessRoleDoc>,
+  tenantId: string,
+  accessRoleId: string,
+  permBits: number,
+): Promise<AccessRoleDoc> {
+  await accessRoles.updateOne(
+    { accessRoleId, tenantId },
+    {
+      $set: {
+        accessRoleId,
+        tenantId,
+        resourceType: RESOURCE_TYPE_AGENT,
+        permBits,
+        name: accessRoleId,
+      },
+      $setOnInsert: {
+        createdAt: new Date(),
+      },
+      $currentDate: {
+        updatedAt: true,
+      },
+    },
+    { upsert: true },
+  );
+
+  const role = await accessRoles.findOne({ accessRoleId, tenantId });
+  if (!role) {
+    throw new Error(`Expected seeded access role ${accessRoleId}`);
+  }
+  return role;
+}
+
+test.describe('permission principal details', () => {
+  test.setTimeout(120000);
+
+  test('keeps permission details and local principal writes in the authenticated context', async ({
+    baseURL,
+  }) => {
+    if (typeof baseURL !== 'string') {
+      throw new Error('baseURL must be configured for permissions mock e2e tests');
+    }
+
+    const suffix = randomSuffix();
+    const ownerUser: TestUser = {
+      email: `acl-owner-${suffix}@example.com`,
+      name: `ACL Owner ${suffix}`,
+      password: 'securepassword123',
+    };
+
+    const { api, role, token } = await createAuthenticatedRequest(
+      baseURL,
+      ownerUser,
+      CURRENT_TENANT_ID,
+    );
+    const { client, db } = await connectToE2EDb();
+    const users = db.collection<UserDoc>('users');
+    const groups = db.collection<GroupDoc>('groups');
+    const aclEntries = db.collection('aclentries');
+    const accessRoles = db.collection<AccessRoleDoc>('accessroles');
+    const resourceId = new ObjectId();
+    const createdIds: ObjectId[] = [];
+
+    try {
+      await seedTenantRole(db, CURRENT_TENANT_ID, role);
+      const ownerRole = await seedAccessRole(
+        accessRoles,
+        CURRENT_TENANT_ID,
+        ACCESS_ROLE_AGENT_OWNER,
+        PERM_BITS_OWNER,
+      );
+      const viewerRole = await seedAccessRole(
+        accessRoles,
+        CURRENT_TENANT_ID,
+        ACCESS_ROLE_AGENT_VIEWER,
+        PERM_BITS_VIEWER,
+      );
+
+      const currentOwner = await users.findOne({
+        email: ownerUser.email,
+        tenantId: CURRENT_TENANT_ID,
+      });
+      if (!currentOwner) {
+        throw new Error('Expected authenticated e2e user to be stored with a tenant id');
+      }
+
+      const outsideUserId = new ObjectId();
+      const outsideGroupId = new ObjectId();
+      const outsideWriteUserId = new ObjectId();
+      const currentGroupId = new ObjectId();
+      createdIds.push(outsideUserId, outsideGroupId, outsideWriteUserId, currentGroupId);
+
+      await users.insertMany([
+        {
+          _id: outsideUserId,
+          email: `outside-read-${suffix}@example.com`,
+          name: `Outside Read User ${suffix}`,
+          tenantId: OTHER_TENANT_ID,
+        },
+        {
+          _id: outsideWriteUserId,
+          email: `outside-write-${suffix}@example.com`,
+          name: `Outside Write User ${suffix}`,
+          tenantId: OTHER_TENANT_ID,
+        },
+      ]);
+      await groups.insertMany([
+        {
+          _id: outsideGroupId,
+          email: `outside-group-${suffix}@example.com`,
+          name: `Outside Group ${suffix}`,
+          tenantId: OTHER_TENANT_ID,
+        },
+        {
+          _id: currentGroupId,
+          email: `current-group-${suffix}@example.com`,
+          name: `Current Group ${suffix}`,
+          tenantId: CURRENT_TENANT_ID,
+        },
+      ]);
+
+      await aclEntries.insertMany([
+        {
+          principalType: PRINCIPAL_TYPE_USER,
+          principalId: currentOwner._id,
+          principalModel: PRINCIPAL_MODEL_USER,
+          resourceType: RESOURCE_TYPE_AGENT,
+          resourceId,
+          permBits: ownerRole.permBits,
+          roleId: ownerRole._id,
+          grantedBy: currentOwner._id,
+          tenantId: CURRENT_TENANT_ID,
+          createdAt: new Date(),
+          updatedAt: new Date(),
+        },
+        {
+          principalType: PRINCIPAL_TYPE_USER,
+          principalId: outsideUserId,
+          principalModel: PRINCIPAL_MODEL_USER,
+          resourceType: RESOURCE_TYPE_AGENT,
+          resourceId,
+          permBits: viewerRole.permBits,
+          roleId: viewerRole._id,
+          grantedBy: currentOwner._id,
+          tenantId: CURRENT_TENANT_ID,
+          createdAt: new Date(),
+          updatedAt: new Date(),
+        },
+        {
+          principalType: PRINCIPAL_TYPE_GROUP,
+          principalId: outsideGroupId,
+          principalModel: PRINCIPAL_MODEL_GROUP,
+          resourceType: RESOURCE_TYPE_AGENT,
+          resourceId,
+          permBits: viewerRole.permBits,
+          roleId: viewerRole._id,
+          grantedBy: currentOwner._id,
+          tenantId: CURRENT_TENANT_ID,
+          createdAt: new Date(),
+          updatedAt: new Date(),
+        },
+      ]);
+
+      const authHeaders = { Authorization: `Bearer ${token}` };
+
+      const getResponse = await api.get(`/api/permissions/${RESOURCE_TYPE_AGENT}/${resourceId}`, {
+        headers: authHeaders,
+      });
+      expect(getResponse.ok()).toBeTruthy();
+      const getPayload = (await getResponse.json()) as PermissionsResponse;
+      const serializedGetPayload = JSON.stringify(getPayload);
+
+      expect(getPayload.principals).toEqual([
+        expect.objectContaining({
+          type: PRINCIPAL_TYPE_USER,
+          id: currentOwner._id.toString(),
+          email: ownerUser.email,
+          accessRoleId: ACCESS_ROLE_AGENT_OWNER,
+        }),
+      ]);
+      expect(serializedGetPayload).not.toContain(`outside-read-${suffix}@example.com`);
+      expect(serializedGetPayload).not.toContain(`outside-group-${suffix}@example.com`);
+      expect(serializedGetPayload).not.toContain(outsideUserId.toString());
+      expect(serializedGetPayload).not.toContain(outsideGroupId.toString());
+
+      const putResponse = await api.put(`/api/permissions/${RESOURCE_TYPE_AGENT}/${resourceId}`, {
+        headers: authHeaders,
+        data: {
+          updated: [
+            {
+              type: PRINCIPAL_TYPE_GROUP,
+              id: currentGroupId.toString(),
+              name: `Current Group ${suffix}`,
+              source: 'local',
+              accessRoleId: ACCESS_ROLE_AGENT_VIEWER,
+            },
+            {
+              type: PRINCIPAL_TYPE_USER,
+              id: outsideWriteUserId.toString(),
+              name: `Outside Write User ${suffix}`,
+              email: `outside-write-${suffix}@example.com`,
+              source: 'local',
+              accessRoleId: ACCESS_ROLE_AGENT_VIEWER,
+            },
+          ],
+          removed: [],
+        },
+      });
+      expect(putResponse.ok()).toBeTruthy();
+      const putPayload = (await putResponse.json()) as { results: PermissionsResponse };
+      const serializedPutPayload = JSON.stringify(putPayload);
+
+      expect(putPayload.results.principals).toEqual([
+        expect.objectContaining({
+          type: PRINCIPAL_TYPE_GROUP,
+          id: currentGroupId.toString(),
+          accessRoleId: ACCESS_ROLE_AGENT_VIEWER,
+        }),
+      ]);
+      expect(serializedPutPayload).not.toContain(outsideWriteUserId.toString());
+      expect(serializedPutPayload).not.toContain(`outside-write-${suffix}@example.com`);
+      await expect
+        .poll(() =>
+          aclEntries.countDocuments({
+            resourceType: RESOURCE_TYPE_AGENT,
+            resourceId,
+            principalId: currentGroupId,
+            tenantId: CURRENT_TENANT_ID,
+          }),
+        )
+        .toBe(1);
+      await expect
+        .poll(() =>
+          aclEntries.countDocuments({
+            resourceType: RESOURCE_TYPE_AGENT,
+            resourceId,
+            principalId: outsideWriteUserId,
+            tenantId: CURRENT_TENANT_ID,
+          }),
+        )
+        .toBe(0);
+    } finally {
+      await Promise.all([
+        aclEntries.deleteMany({ resourceId }),
+        users.deleteMany({ _id: { $in: createdIds } }),
+        groups.deleteMany({ _id: { $in: createdIds } }),
+        db.collection('roles').deleteOne({ name: role, tenantId: CURRENT_TENANT_ID }),
+        accessRoles.deleteMany({
+          accessRoleId: { $in: [ACCESS_ROLE_AGENT_OWNER, ACCESS_ROLE_AGENT_VIEWER] },
+          tenantId: CURRENT_TENANT_ID,
+        }),
+      ]);
+      await client.close();
+      await api.dispose();
+      await cleanupUser(ownerUser);
+    }
+  });
+});
diff --git a/e2e/specs/mock/projects.spec.ts b/e2e/specs/mock/projects.spec.ts
new file mode 100644
index 00000000000..a336a94d3e3
--- /dev/null
+++ b/e2e/specs/mock/projects.spec.ts
@@ -0,0 +1,149 @@
+import { expect, test } from '@playwright/test';
+import type { Page } from '@playwright/test';
+import { MOCK_ENDPOINTS, mockReply, selectMockEndpoint, sendMessage } from './helpers';
+
+/**
+ * Creates a project from the all-projects page and returns its id.
+ * Project creation navigates to the project workspace (`/projects/:id`).
+ */
+async function createProject(page: Page, name: string): Promise<string> {
+  await page.goto('/projects', { timeout: 10000 });
+  await page.getByRole('button', { name: 'New project' }).first().click();
+
+  const dialog = page.getByRole('dialog');
+  await dialog.getByRole('textbox', { name: 'Project name' }).fill(name);
+  await dialog.getByRole('button', { name: 'Create project' }).click();
+
+  await expect(page.getByRole('heading', { name })).toBeVisible();
+  const projectId = new URL(page.url()).pathname.split('/projects/')[1];
+  expect(projectId).toBeTruthy();
+  return projectId;
+}
+
+const uniqueName = (prefix: string) => `${prefix} ${Date.now()}-${Math.floor(Math.random() * 1e4)}`;
+
+test.describe('chat projects', () => {
+  test('creates a project and lists it on the all-projects page', async ({ page }) => {
+    test.setTimeout(60000);
+    const name = uniqueName('E2E Project');
+
+    await createProject(page, name);
+
+    await page.goto('/projects', { timeout: 10000 });
+    await expect(page.getByRole('button', { name }).first()).toBeVisible();
+  });
+
+  test('starts a project-scoped chat and persists it under the project', async ({ page }) => {
+    test.setTimeout(120000);
+    const name = uniqueName('E2E Project');
+    const projectId = await createProject(page, name);
+
+    // The workspace exposes a composer entry to start a chat in the project.
+    await expect(page.getByRole('button', { name: `New chat in ${name}` }).first()).toBeVisible();
+
+    // Open the project-scoped new-chat landing directly.
+    await page.goto(`/c/new?projectId=${projectId}`, { timeout: 10000 });
+
+    // The interactive project chip is present, and the composer is scoped.
+    await expect(page.getByRole('button', { name: 'Remove from project' })).toBeVisible();
+    const input = page.getByRole('textbox', { name: 'Message input' });
+    await expect(input).toHaveAttribute('placeholder', new RegExp(name));
+
+    // Switch to a mock endpoint so the message streams without a real API key;
+    // the project scope must be retained across the model switch.
+    await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+    await expect(page.getByRole('button', { name: 'Remove from project' })).toBeVisible();
+
+    // Send the message; it streams a reply and the new chat opens at /c/:id.
+    const response = await sendMessage(page, 'hello from a project');
+    expect(response.ok()).toBeTruthy();
+    await expect(mockReply(page)).toBeVisible({ timeout: 20000 });
+    await expect(page).toHaveURL(/\/c\/(?!new)/, { timeout: 15000 });
+
+    // Expand the project in the sidebar and confirm the chat is filed under it.
+    const projectRow = page.getByRole('button', { name }).first();
+    if ((await projectRow.getAttribute('aria-expanded')) !== 'true') {
+      await projectRow.click();
+    }
+    await expect(
+      page.getByTestId(`project-chats-${projectId}`).getByTestId('convo-item').first(),
+    ).toBeVisible();
+
+    const conversationUrl = page.url();
+    await page.reload({ timeout: 10000 });
+    await expect(page).toHaveURL(conversationUrl);
+
+    const reloadedProjectRow = page.getByRole('button', { name }).first();
+    if ((await reloadedProjectRow.getAttribute('aria-expanded')) !== 'true') {
+      await reloadedProjectRow.click();
+    }
+    await expect(
+      page.getByTestId(`project-chats-${projectId}`).getByTestId('convo-item').first(),
+    ).toBeVisible();
+  });
+
+  test('removes the project scope via the chip ×', async ({ page }) => {
+    test.setTimeout(60000);
+    const name = uniqueName('E2E Project');
+    const projectId = await createProject(page, name);
+
+    await page.goto(`/c/new?projectId=${projectId}`, { timeout: 10000 });
+    await expect(page.getByRole('button', { name: 'Remove from project' })).toBeVisible();
+
+    await page.getByRole('button', { name: 'Remove from project' }).click();
+
+    // Chip disappears and the URL drops the project scope.
+    await expect(page.getByRole('button', { name: 'Remove from project' })).toBeHidden();
+    await expect(page).toHaveURL((url) => !url.searchParams.has('projectId'));
+  });
+
+  test('drops the project scope when the scoped project is deleted', async ({ page }) => {
+    test.setTimeout(90000);
+    const name = uniqueName('E2E Project');
+    const projectId = await createProject(page, name);
+
+    await page.goto(`/c/new?projectId=${projectId}`, { timeout: 10000 });
+    await expect(page.getByRole('button', { name: 'Remove from project' })).toBeVisible();
+
+    // Delete the scoped project from the sidebar while it is selected on the landing.
+    const row = page.getByRole('button', { name, exact: true }).first();
+    await expect(row).toBeVisible();
+    const item = row.locator('..');
+    await item.hover();
+    await item.getByRole('button', { name: 'More options' }).click();
+    await page.getByRole('menuitem', { name: 'Delete' }).click();
+    await page.getByRole('dialog').getByRole('button', { name: 'Delete' }).click();
+
+    // The stale chip is gone, the URL drops the now-dead project scope, and the
+    // composer reverts to an unscoped chat (placeholder no longer names the project).
+    await expect(page.getByRole('button', { name: 'Remove from project' })).toBeHidden();
+    await expect(page).toHaveURL((url) => !url.searchParams.has('projectId'));
+    await expect(page.getByRole('textbox', { name: 'Message input' })).not.toHaveAttribute(
+      'placeholder',
+      new RegExp(name),
+    );
+  });
+
+  test('switches the project via the chip combobox', async ({ page }) => {
+    test.setTimeout(90000);
+    const nameA = uniqueName('E2E Project A');
+    const nameB = uniqueName('E2E Project B');
+    await createProject(page, nameA);
+    const projectIdA = new URL(page.url()).pathname.split('/projects/')[1];
+    await createProject(page, nameB);
+    const projectIdB = new URL(page.url()).pathname.split('/projects/')[1];
+
+    await page.goto(`/c/new?projectId=${projectIdA}`, { timeout: 10000 });
+    await expect(page.getByRole('button', { name: 'Remove from project' })).toBeVisible();
+
+    // Open the combobox and pick the other project.
+    await page.locator('#project-landing-select').click();
+    await page.getByRole('option', { name: nameB }).click();
+
+    await expect(page).toHaveURL(new RegExp(`projectId=${projectIdB}`));
+    await expect(page.getByRole('textbox', { name: 'Message input' })).toHaveAttribute(
+      'placeholder',
+      new RegExp(nameB),
+    );
+  });
+});
diff --git a/e2e/specs/mock/prompts.spec.ts b/e2e/specs/mock/prompts.spec.ts
new file mode 100644
index 00000000000..b0e39604c28
--- /dev/null
+++ b/e2e/specs/mock/prompts.spec.ts
@@ -0,0 +1,203 @@
+import { expect, test } from '@playwright/test';
+import type { Page } from '@playwright/test';
+import {
+  isAgentsStream,
+  MOCK_ENDPOINTS,
+  NEW_CHAT_PATH,
+  escapeRegExp,
+  fetchJson,
+  getAccessToken,
+  replyPrompt,
+  replyText,
+  requestJson,
+  selectMockEndpoint,
+} from './helpers';
+
+const DESCRIPTION = 'Use this prompt to verify LibreChat prompt creation in mock e2e tests.';
+const COMMAND = 'e2e-prompt';
+
+type Prompt = {
+  _id?: string;
+  groupId: string;
+  prompt: string;
+  type: 'text' | 'chat';
+};
+
+type PromptGroup = {
+  _id?: string;
+  name: string;
+  oneliner?: string;
+  command?: string;
+  productionPrompt?: Pick<Prompt, 'prompt'> | null;
+};
+
+type PromptGroupListResponse = {
+  promptGroups?: PromptGroup[];
+};
+
+const uniquePromptName = () => `E2E Prompt ${Date.now()}-${Math.floor(Math.random() * 1e4)}`;
+
+async function findPromptGroup(
+  page: Page,
+  promptName: string,
+  token: string,
+): Promise<PromptGroup | null> {
+  const body = await fetchJson<PromptGroupListResponse>(
+    page,
+    `/api/prompts/groups?name=${encodeURIComponent(promptName)}&limit=10`,
+    token,
+  );
+  return body.promptGroups?.find((group) => group.name === promptName) ?? null;
+}
+
+async function waitForPersistedPrompt(
+  page: Page,
+  promptName: string,
+  expectedPrompt: string,
+): Promise<{ group: PromptGroup; prompts: Prompt[] }> {
+  const token = await getAccessToken(page);
+  let latestGroup: PromptGroup | null = null;
+  let latestPrompts: Prompt[] = [];
+
+  for (let attempt = 0; attempt < 20; attempt++) {
+    const group = await findPromptGroup(page, promptName, token);
+    if (group?._id) {
+      latestGroup = await fetchJson<PromptGroup>(
+        page,
+        `/api/prompts/groups/${encodeURIComponent(group._id)}`,
+        token,
+      );
+      latestPrompts = await fetchJson<Prompt[]>(
+        page,
+        `/api/prompts?groupId=${encodeURIComponent(group._id)}`,
+        token,
+      );
+
+      const hasExpectedPrompt = latestPrompts.some((prompt) => prompt.prompt === expectedPrompt);
+      if (
+        latestGroup.oneliner === DESCRIPTION &&
+        latestGroup.command === COMMAND &&
+        latestGroup.productionPrompt?.prompt === expectedPrompt &&
+        hasExpectedPrompt
+      ) {
+        return { group: latestGroup, prompts: latestPrompts };
+      }
+    }
+    await new Promise((resolve) => setTimeout(resolve, 500));
+  }
+
+  expect(latestGroup, `Expected prompt group "${promptName}" to be persisted`).not.toBeNull();
+  expect(latestGroup?.oneliner).toBe(DESCRIPTION);
+  expect(latestGroup?.command).toBe(COMMAND);
+  expect(latestGroup?.productionPrompt?.prompt).toBe(expectedPrompt);
+  expect(latestPrompts.some((prompt) => prompt.prompt === expectedPrompt)).toBe(true);
+  return { group: latestGroup!, prompts: latestPrompts };
+}
+
+async function cleanupPromptGroup(page: Page, groupId?: string) {
+  if (!groupId) {
+    return;
+  }
+
+  const token = await getAccessToken(page);
+  await requestJson<{ message?: string }>(page, {
+    path: `/api/prompts/groups/${encodeURIComponent(groupId)}`,
+    token,
+    method: 'DELETE',
+  });
+}
+
+async function openPromptsPanel(page: Page) {
+  const promptsButton = page.getByRole('button', { name: 'Prompts', exact: true });
+  await expect(promptsButton).toBeVisible();
+  if ((await promptsButton.getAttribute('aria-pressed')) !== 'true') {
+    await promptsButton.click();
+  }
+  await expect(page.getByRole('search')).toBeVisible();
+}
+
+async function ensureAutoSendPrompts(page: Page) {
+  const autoSend = page.getByRole('button', { name: 'Send prompts on select' });
+  await expect(autoSend).toBeVisible();
+  if ((await autoSend.getAttribute('aria-pressed')) !== 'true') {
+    await autoSend.click();
+  }
+  await expect(autoSend).toHaveAttribute('aria-pressed', 'true');
+}
+
+test.describe('prompt manager', () => {
+  test('creates a prompt and can send it from chat', async ({ page }) => {
+    test.setTimeout(120000);
+
+    const promptName = uniquePromptName();
+    const label = promptName.toLowerCase().replace(/[^a-z0-9]+/g, '-');
+    const promptText = replyPrompt(label);
+    let createdGroupId: string | undefined;
+
+    try {
+      await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+      await openPromptsPanel(page);
+
+      await page.getByRole('link', { name: 'Create Prompt' }).click();
+      await expect(page).toHaveURL(/\/prompts\/new$/);
+
+      await page.getByRole('textbox', { name: 'Prompt Name' }).fill(promptName);
+      await page.getByRole('textbox', { name: 'Prompt text input field' }).fill(promptText);
+      await page
+        .getByRole('textbox', { name: 'Optional: Enter a description to display for the prompt' })
+        .fill(DESCRIPTION);
+      await page
+        .getByRole('textbox', {
+          name: 'Optional: Enter a command for the prompt or name will be used',
+        })
+        .fill(COMMAND);
+
+      const [createResponse] = await Promise.all([
+        page.waitForResponse(
+          (response) =>
+            response.request().method() === 'POST' &&
+            new URL(response.url()).pathname === '/api/prompts' &&
+            response.status() >= 200 &&
+            response.status() < 300,
+          { timeout: 30000 },
+        ),
+        page.getByRole('button', { name: 'Create Prompt' }).click(),
+      ]);
+      const createdPrompt = (await createResponse.json()) as {
+        group?: PromptGroup;
+        prompt?: Prompt;
+      };
+      createdGroupId = createdPrompt.group?._id ?? createdPrompt.prompt?.groupId;
+
+      const { group } = await waitForPersistedPrompt(page, promptName, promptText);
+      createdGroupId = group._id ?? createdGroupId;
+      expect(createdGroupId).toBeTruthy();
+      await expect(page).toHaveURL(new RegExp(`/prompts/${createdGroupId}$`));
+      await expect(page.getByRole('button', { name: `Edit: ${promptName}` })).toBeVisible();
+
+      await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+      await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+      await openPromptsPanel(page);
+      await ensureAutoSendPrompts(page);
+
+      await page.getByLabel('Filter prompts by name').fill(promptName);
+      const promptCard = page.getByRole('button', {
+        name: new RegExp(`^${escapeRegExp(promptName)} prompt`),
+      });
+      await expect(promptCard).toBeVisible({ timeout: 10000 });
+
+      const [response] = await Promise.all([
+        page.waitForResponse(isAgentsStream, { timeout: 30000 }),
+        promptCard.click(),
+      ]);
+      expect(response.ok()).toBeTruthy();
+
+      await expect(page.getByTestId('messages-view').getByText(promptText)).toBeVisible();
+      await expect(page.getByTestId('messages-view').getByText(replyText(label))).toBeVisible({
+        timeout: 30000,
+      });
+    } finally {
+      await cleanupPromptGroup(page, createdGroupId);
+    }
+  });
+});
diff --git a/e2e/specs/mock/shared-links.spec.ts b/e2e/specs/mock/shared-links.spec.ts
new file mode 100644
index 00000000000..145dc8377e9
--- /dev/null
+++ b/e2e/specs/mock/shared-links.spec.ts
@@ -0,0 +1,187 @@
+import { expect, test } from '@playwright/test';
+import { MongoClient } from 'mongodb';
+import type { Collection, ObjectId } from 'mongodb';
+import { applyRuntimeEnv } from '../../setup/runtimeEnv';
+import {
+  MOCK_ENDPOINTS,
+  MOCK_REPLY_TEXT,
+  NEW_CHAT_PATH,
+  mockReply,
+  selectMockEndpoint,
+  sendMessage,
+} from './helpers';
+
+type SharedLinkDoc = {
+  _id?: ObjectId;
+  conversationId: string;
+  title?: string;
+  user?: string;
+  messages?: ObjectId[];
+  shareId: string;
+  isPublic?: boolean;
+  createdAt: Date;
+  updatedAt: Date;
+};
+
+type StoredSharedLinkDoc = SharedLinkDoc & {
+  _id: ObjectId;
+  messages: ObjectId[];
+};
+
+type AclEntryDoc = {
+  _id: ObjectId;
+  principalType: string;
+  resourceType: string;
+  resourceId: ObjectId;
+};
+
+const randomSuffix = () => `${Date.now()}-${Math.floor(Math.random() * 10000)}`;
+
+async function connectToE2EDb() {
+  applyRuntimeEnv();
+  if (!process.env.MONGO_URI) {
+    throw new Error('MONGO_URI must be available for shared-links mock e2e tests');
+  }
+
+  const client = new MongoClient(process.env.MONGO_URI);
+  await client.connect();
+  return { client, db: client.db() };
+}
+
+async function waitForSharedLink(
+  sharedLinks: Collection<SharedLinkDoc>,
+  shareId: string,
+): Promise<StoredSharedLinkDoc> {
+  const deadline = Date.now() + 15000;
+
+  while (Date.now() < deadline) {
+    const share = await sharedLinks.findOne({ shareId });
+    if (share?._id && Array.isArray(share.messages) && share.messages.length > 0) {
+      return share as StoredSharedLinkDoc;
+    }
+
+    await new Promise((resolve) => setTimeout(resolve, 250));
+  }
+
+  throw new Error(`Timed out waiting for persisted shared link ${shareId}`);
+}
+
+test.describe('shared links', () => {
+  test.setTimeout(120000);
+
+  test('creates a shared link and preserves legacy public links through runtime migration', async ({
+    page,
+    baseURL,
+  }) => {
+    if (typeof baseURL !== 'string') {
+      throw new Error('baseURL must be configured for shared-link mock e2e tests');
+    }
+
+    const suffix = randomSuffix();
+    const userMessage = `Shared link e2e ${suffix}`;
+
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+
+    const response = await sendMessage(page, userMessage);
+    expect(response.ok()).toBeTruthy();
+    await expect(page.getByText(userMessage)).toBeVisible();
+    await expect(mockReply(page)).toBeVisible();
+
+    await expect(page).toHaveURL(/\/c\/(?!new)[0-9a-fA-F-]{36}$/);
+    const conversationUrl = new URL(page.url());
+    const conversationId = conversationUrl.pathname.split('/').pop();
+    if (!conversationId) {
+      throw new Error(`Could not parse conversation id from ${conversationUrl.href}`);
+    }
+
+    await page.getByRole('button', { name: 'Export options' }).click();
+    await page.getByTestId('share-conversation-menu-item').click();
+    await expect(page.getByRole('dialog', { name: 'Share link to chat' })).toBeVisible();
+
+    const [shareResponse] = await Promise.all([
+      page.waitForResponse(
+        (res) =>
+          res.request().method() === 'POST' &&
+          res.url().includes(`/api/share/${conversationId}`) &&
+          res.status() === 200,
+        { timeout: 30000 },
+      ),
+      page.getByRole('button', { name: 'Create link' }).click(),
+    ]);
+    expect(shareResponse.ok()).toBeTruthy();
+    const sharePayload = (await shareResponse.json()) as { shareId?: string };
+    if (!sharePayload.shareId) {
+      throw new Error('Expected create-share response to include a shareId');
+    }
+
+    await expect(page.getByTestId('shared-link-url')).toContainText('/share/');
+    await expect(page.getByRole('button', { name: 'Manage Access' })).toBeVisible();
+    const sharedLinkUrl = (await page.getByTestId('shared-link-url').textContent())?.trim();
+    if (!sharedLinkUrl) {
+      throw new Error('Expected shared-link URL to be rendered after creating a link');
+    }
+
+    await page.goto(new URL(sharedLinkUrl, baseURL).pathname, { timeout: 10000 });
+    await expect(page).toHaveURL(/\/share\/.+/);
+    await expect(page.getByTestId('messages-view').getByText(userMessage)).toBeVisible();
+    await expect(mockReply(page)).toBeVisible();
+
+    const { client, db } = await connectToE2EDb();
+    const aclEntries = db.collection<AclEntryDoc>('aclentries');
+    const sharedLinks = db.collection<SharedLinkDoc>('sharedlinks');
+    const legacyShareId = `legacy-${suffix}`;
+    let legacyResourceId: ObjectId | undefined;
+
+    try {
+      const createdShare = await waitForSharedLink(sharedLinks, sharePayload.shareId);
+      const legacyShare = {
+        shareId: legacyShareId,
+        conversationId: createdShare.conversationId,
+        title: createdShare.title ?? `Legacy shared link ${suffix}`,
+        ...(createdShare.user ? { user: createdShare.user } : {}),
+        messages: createdShare.messages,
+        isPublic: true,
+        createdAt: new Date(),
+        updatedAt: new Date(),
+      };
+      const insertResult = await sharedLinks.insertOne(legacyShare);
+      const resourceId = insertResult.insertedId;
+      legacyResourceId = resourceId;
+
+      await page.goto(`/share/${legacyShareId}`, { timeout: 10000 });
+      await expect(page.getByTestId('messages-view').getByText(userMessage)).toBeVisible();
+      await expect(mockReply(page)).toBeVisible();
+
+      await expect
+        .poll(
+          async () =>
+            aclEntries.countDocuments({
+              resourceType: 'sharedLink',
+              resourceId,
+              principalType: 'public',
+            }),
+          { timeout: 15000 },
+        )
+        .toBe(1);
+
+      await expect
+        .poll(
+          async () => {
+            const migrated = await sharedLinks.findOne({ _id: resourceId });
+            return migrated != null && !Object.prototype.hasOwnProperty.call(migrated, 'isPublic');
+          },
+          { timeout: 15000 },
+        )
+        .toBe(true);
+    } finally {
+      if (legacyResourceId) {
+        await Promise.all([
+          aclEntries.deleteMany({ resourceId: legacyResourceId }),
+          sharedLinks.deleteOne({ _id: legacyResourceId }),
+        ]);
+      }
+      await client.close();
+    }
+  });
+});
diff --git a/e2e/specs/mock/sidebar.spec.ts b/e2e/specs/mock/sidebar.spec.ts
new file mode 100644
index 00000000000..e622145d4b8
--- /dev/null
+++ b/e2e/specs/mock/sidebar.spec.ts
@@ -0,0 +1,82 @@
+import { expect, test } from '@playwright/test';
+import type { Page } from '@playwright/test';
+
+/** Size of the virtualized chat list grid vs. its measured container. */
+const sizes = (page: Page) =>
+  page.evaluate(() => {
+    const grid = document.querySelector<HTMLElement>('aside .ReactVirtualized__Grid');
+    const wrap = grid?.parentElement ?? null;
+    const gridRect = grid?.getBoundingClientRect();
+    const wrapRect = wrap?.getBoundingClientRect();
+    return {
+      grid: gridRect ? gridRect.width : -1,
+      wrap: wrapRect ? wrapRect.width : -1,
+      gridH: gridRect ? gridRect.height : -1,
+      wrapH: wrapRect ? wrapRect.height : -1,
+    };
+  });
+
+/**
+ * Polls until the grid matches its container AND the size has stopped changing
+ * between samples — the sidebar expand/collapse animation runs for 300ms, and a
+ * tracking-only check can match mid-animation on slow CI machines.
+ */
+const settledSizes = async (page: Page) => {
+  let prev = await sizes(page);
+  for (let attempt = 0; attempt < 40; attempt++) {
+    await page.waitForTimeout(350);
+    const next = await sizes(page);
+    const tracked =
+      next.wrap > 0 &&
+      next.wrapH > 0 &&
+      Math.abs(next.grid - next.wrap) <= 1 &&
+      Math.abs(next.gridH - next.wrapH) <= 1;
+    const stable = Math.abs(next.grid - prev.grid) <= 1 && Math.abs(next.gridH - prev.gridH) <= 1;
+    if (tracked && stable) {
+      return next;
+    }
+    prev = next;
+  }
+  throw new Error(`Sidebar chat list never settled: ${JSON.stringify(prev)}`);
+};
+
+test.describe('sidebar chat list', () => {
+  test('chat list width tracks the sidebar through resize and collapse cycles', async ({
+    page,
+  }) => {
+    test.setTimeout(60000);
+    await page.goto('/c/new', { timeout: 10000 });
+    await expect(page.locator('aside .ReactVirtualized__Grid').first()).toBeVisible({
+      timeout: 20000,
+    });
+
+    const initial = await settledSizes(page);
+
+    const separator = page.locator('[role="separator"][aria-label="Resize sidebar"]');
+    const sepBox = await separator.boundingBox();
+    expect(sepBox).not.toBeNull();
+    const startX = (sepBox?.x ?? 0) + (sepBox?.width ?? 0) / 2;
+    const y = (sepBox?.y ?? 0) + (sepBox?.height ?? 0) / 2;
+
+    await page.mouse.move(startX, y);
+    await page.mouse.down();
+    for (let i = 1; i <= 5; i++) {
+      await page.mouse.move(startX + i * 20, y);
+      await page.waitForTimeout(50);
+    }
+    await page.mouse.up();
+
+    const widened = await settledSizes(page);
+    expect(widened.grid).toBeGreaterThan(initial.grid);
+
+    await page.locator('aside').getByTestId('close-sidebar-button').click();
+    await page.locator('aside').getByTestId('open-sidebar-button').click();
+
+    const reopened = await settledSizes(page);
+    expect(reopened.grid).toBeGreaterThan(initial.grid);
+
+    await page.setViewportSize({ width: 1280, height: 540 });
+    const shrunken = await settledSizes(page);
+    expect(shrunken.gridH).toBeLessThan(reopened.gridH);
+  });
+});
diff --git a/e2e/specs/mock/skill-file-authoring.spec.ts b/e2e/specs/mock/skill-file-authoring.spec.ts
new file mode 100644
index 00000000000..529a2991bf2
--- /dev/null
+++ b/e2e/specs/mock/skill-file-authoring.spec.ts
@@ -0,0 +1,128 @@
+import { expect, test } from '@playwright/test';
+import type { Page } from '@playwright/test';
+import {
+  MOCK_ENDPOINTS,
+  NEW_CHAT_PATH,
+  enableSkills,
+  fetchJson,
+  getAccessToken,
+  selectMockEndpoint,
+  sendMessage,
+} from './helpers';
+
+const FINAL_TEXT = 'E2E file authoring complete';
+const EDIT_FINAL_TEXT = 'E2E file edit complete';
+const DESCRIPTION =
+  'Use this skill to verify LibreChat skill file authoring in mock end-to-end tests.';
+const EDITED_DESCRIPTION =
+  'Use this edited skill to verify LibreChat skill file authoring in mock end-to-end tests.';
+
+type SkillSummary = {
+  _id: string;
+  name: string;
+  description: string;
+};
+
+type SkillDetail = SkillSummary & {
+  body: string;
+};
+
+const uniqueSkillName = () => `e2e-file-authoring-${Date.now()}-${Math.floor(Math.random() * 1e4)}`;
+
+async function findSkill(
+  page: Page,
+  skillName: string,
+  token: string,
+): Promise<SkillSummary | null> {
+  const body = await fetchJson<{ skills?: SkillSummary[] }>(
+    page,
+    `/api/skills?search=${encodeURIComponent(skillName)}&limit=10`,
+    token,
+  );
+  return body.skills?.find((skill) => skill.name === skillName) ?? null;
+}
+
+async function waitForPersistedSkill(
+  page: Page,
+  skillName: string,
+  expectedDescription = DESCRIPTION,
+): Promise<SkillDetail> {
+  const token = await getAccessToken(page);
+  let latestSkill: SkillDetail | null = null;
+  for (let attempt = 0; attempt < 20; attempt++) {
+    const skill = await findSkill(page, skillName, token);
+    if (skill) {
+      latestSkill = await fetchJson<SkillDetail>(
+        page,
+        `/api/skills/${encodeURIComponent(skill._id)}`,
+        token,
+      );
+      if (latestSkill.description === expectedDescription) {
+        return latestSkill;
+      }
+    }
+    await new Promise((resolve) => setTimeout(resolve, 500));
+  }
+
+  expect(latestSkill, `Expected skill "${skillName}" to be persisted`).not.toBeNull();
+  expect(latestSkill?.description).toBe(expectedDescription);
+  return latestSkill!;
+}
+
+test.describe('skill file authoring tools', () => {
+  test('creates and edits a skill without enabling code execution', async ({ page }) => {
+    test.setTimeout(120000);
+    const skillName = uniqueSkillName();
+    const prompt = [
+      `${FINAL_TEXT} request`,
+      `E2E_CREATE_SKILL:${skillName}`,
+      'Create the skill file using host file authoring only.',
+    ].join('\n');
+    const editPrompt = [
+      `${EDIT_FINAL_TEXT} request`,
+      `E2E_EDIT_SKILL:${skillName}`,
+      'Edit the skill file using host file authoring only.',
+    ].join('\n');
+
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+    await enableSkills(page);
+
+    const response = await sendMessage(page, prompt);
+    expect(response.ok()).toBeTruthy();
+
+    await expect(page).toHaveURL(/\/c\/(?!new)/, { timeout: 15000 });
+    const conversationPath = new URL(page.url()).pathname;
+    await expect(
+      page.getByTestId('messages-view').getByText(`${FINAL_TEXT}: ${skillName}`),
+    ).toBeVisible({ timeout: 30000 });
+
+    const skill = await waitForPersistedSkill(page, skillName);
+    expect(skill.description).toBe(DESCRIPTION);
+    expect(skill.body).toContain(`name: ${skillName}`);
+    expect(skill.body).toContain(DESCRIPTION);
+
+    const editResponse = await sendMessage(page, editPrompt);
+    expect(editResponse.ok()).toBeTruthy();
+
+    await expect(
+      page.getByTestId('messages-view').getByText(`${EDIT_FINAL_TEXT}: ${skillName}`),
+    ).toBeVisible({ timeout: 30000 });
+
+    const editedSkill = await waitForPersistedSkill(page, skillName, EDITED_DESCRIPTION);
+    expect(editedSkill.body).toContain(EDITED_DESCRIPTION);
+
+    await page.reload({ timeout: 10000 });
+    await expect(page).toHaveURL((url) => url.pathname === conversationPath);
+    await expect(
+      page.getByTestId('messages-view').getByText(`${FINAL_TEXT}: ${skillName}`),
+    ).toBeVisible({ timeout: 30000 });
+    await expect(
+      page.getByTestId('messages-view').getByText(`${EDIT_FINAL_TEXT}: ${skillName}`),
+    ).toBeVisible({ timeout: 30000 });
+
+    await page.goto(`/skills/${editedSkill._id}`, { timeout: 10000 });
+    await expect(page.getByRole('heading', { level: 1, name: skillName })).toBeVisible();
+    await expect(page.getByText(EDITED_DESCRIPTION)).toBeVisible();
+  });
+});
diff --git a/e2e/specs/mock/soft-default.spec.ts b/e2e/specs/mock/soft-default.spec.ts
new file mode 100644
index 00000000000..41dc031a671
--- /dev/null
+++ b/e2e/specs/mock/soft-default.spec.ts
@@ -0,0 +1,149 @@
+import { expect, test } from '@playwright/test';
+import type { Page } from '@playwright/test';
+import { NEW_CHAT_PATH, getAccessToken, mockReply, requestJson, sendMessage } from './helpers';
+
+/** Label of the `softDefault: true` spec in e2e/config/librechat.e2e.yaml. */
+const SOFT_DEFAULT_LABEL = 'E2E Soft Default';
+
+/** Ephemeral endpoint from e2e/config/librechat.e2e.yaml with no mirroring spec. */
+const EPHEMERAL_ENDPOINT = { label: 'Mock Provider C', model: 'mock-model-c' };
+
+const uniqueName = (prefix: string) => `${prefix} ${Date.now()}-${Math.floor(Math.random() * 1e4)}`;
+
+const modelTrigger = (page: Page) => page.getByRole('button', { name: 'Select a model' }).first();
+
+/** Reset selection state so the test starts as a fresh instance (auth stays in cookies). */
+async function startFresh(page: Page) {
+  await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+  await page.evaluate(() => localStorage.clear());
+  await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+}
+
+type AgentResponse = {
+  id: string;
+  name?: string | null;
+};
+
+async function createAgent(page: Page, name: string): Promise<AgentResponse> {
+  const token = await getAccessToken(page);
+  return requestJson<AgentResponse>(page, {
+    path: '/api/agents',
+    token,
+    method: 'POST',
+    body: {
+      name,
+      provider: 'Mock Provider A',
+      model: 'mock-model-a',
+      model_parameters: {},
+    },
+  });
+}
+
+async function selectAgent(page: Page, agentName: string) {
+  await modelTrigger(page).click();
+  await page.getByRole('option', { name: 'My Agents' }).click();
+  await page.getByRole('option', { name: agentName }).click();
+  await expect(modelTrigger(page)).toContainText(agentName);
+}
+
+async function selectEphemeralModel(page: Page) {
+  await modelTrigger(page).click();
+  await page.getByRole('option', { name: EPHEMERAL_ENDPOINT.label }).click();
+  await page.getByRole('option', { name: EPHEMERAL_ENDPOINT.model, exact: true }).click();
+  await expect(modelTrigger(page)).toContainText(EPHEMERAL_ENDPOINT.model);
+}
+
+async function sendAndAwaitReply(page: Page, text: string) {
+  const response = await sendMessage(page, text);
+  expect(response.ok()).toBeTruthy();
+  await expect(mockReply(page)).toBeVisible({ timeout: 20000 });
+  await expect(page).toHaveURL(/\/c\/(?!new)/, { timeout: 15000 });
+}
+
+async function newChat(page: Page) {
+  await page.getByTestId('new-chat-button').click();
+  await expect(page).toHaveURL(/\/c\/new/, { timeout: 15000 });
+}
+
+test.describe('soft default model spec', () => {
+  test('applies the soft default on a fresh instance and stays applied across reloads', async ({
+    page,
+  }) => {
+    await startFresh(page);
+
+    await expect(modelTrigger(page)).toContainText(SOFT_DEFAULT_LABEL, { timeout: 15000 });
+
+    // Its own auto-application must not convert it into a sticky "last" selection
+    // that would behave differently on the next load.
+    await page.reload({ timeout: 10000 });
+    await expect(modelTrigger(page)).toContainText(SOFT_DEFAULT_LABEL, { timeout: 15000 });
+  });
+
+  test('a previously selected agent outranks the soft default', async ({ page }) => {
+    test.setTimeout(120000);
+    await startFresh(page);
+    await expect(modelTrigger(page)).toContainText(SOFT_DEFAULT_LABEL, { timeout: 15000 });
+
+    const agentName = uniqueName('E2E Soft Agent');
+    await createAgent(page, agentName);
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+
+    await selectAgent(page, agentName);
+
+    await page.reload({ timeout: 10000 });
+    await expect(modelTrigger(page)).toContainText(agentName, { timeout: 15000 });
+
+    await page.getByTestId('new-chat-button').click();
+    await expect(page).toHaveURL(/\/c\/new/, { timeout: 15000 });
+    await expect(modelTrigger(page)).toContainText(agentName, { timeout: 15000 });
+  });
+
+  test('a previous ephemeral endpoint and model selection outranks the soft default', async ({
+    page,
+  }) => {
+    test.setTimeout(120000);
+    await startFresh(page);
+    await expect(modelTrigger(page)).toContainText(SOFT_DEFAULT_LABEL, { timeout: 15000 });
+
+    await selectEphemeralModel(page);
+
+    await page.reload({ timeout: 10000 });
+    await expect(modelTrigger(page)).toContainText(EPHEMERAL_ENDPOINT.model, { timeout: 15000 });
+    await expect(modelTrigger(page)).not.toContainText(SOFT_DEFAULT_LABEL);
+
+    await page.getByTestId('new-chat-button').click();
+    await expect(page).toHaveURL(/\/c\/new/, { timeout: 15000 });
+    await expect(modelTrigger(page)).toContainText(EPHEMERAL_ENDPOINT.model, { timeout: 15000 });
+  });
+
+  test('stays soft on New Chat after the first conversation is sent', async ({ page }) => {
+    test.setTimeout(120000);
+    await startFresh(page);
+    await expect(modelTrigger(page)).toContainText(SOFT_DEFAULT_LABEL, { timeout: 15000 });
+
+    await sendAndAwaitReply(page, 'first soft conversation');
+
+    await newChat(page);
+    await expect(modelTrigger(page)).toContainText(SOFT_DEFAULT_LABEL, { timeout: 15000 });
+  });
+
+  test('viewing an old soft conversation does not re-arm it over a prior selection', async ({
+    page,
+  }) => {
+    test.setTimeout(120000);
+    await startFresh(page);
+    await expect(modelTrigger(page)).toContainText(SOFT_DEFAULT_LABEL, { timeout: 15000 });
+
+    await sendAndAwaitReply(page, 'soft history conversation');
+    const softConvoUrl = page.url();
+
+    await newChat(page);
+    await selectEphemeralModel(page);
+
+    await page.goto(softConvoUrl, { timeout: 10000 });
+    await expect(modelTrigger(page)).toContainText(SOFT_DEFAULT_LABEL, { timeout: 15000 });
+
+    await newChat(page);
+    await expect(modelTrigger(page)).not.toContainText(SOFT_DEFAULT_LABEL, { timeout: 15000 });
+  });
+});
diff --git a/e2e/specs/mock/two-factor.spec.ts b/e2e/specs/mock/two-factor.spec.ts
new file mode 100644
index 00000000000..d1f3245179d
--- /dev/null
+++ b/e2e/specs/mock/two-factor.spec.ts
@@ -0,0 +1,42 @@
+import { expect, test } from '@playwright/test';
+import { NEW_CHAT_PATH } from './helpers';
+
+/**
+ * Regression test for the framer-motion / Vite incompatibility that crashed the
+ * client with "e is not a function" when opening the Enable 2FA dialog
+ * (issue #13511). The dialog body is a framer-motion `<motion.div>`; on the
+ * broken build it throws while rendering, so the dialog never appears.
+ *
+ * This only reproduces in a production build (the mock harness builds the client
+ * via `e2e:prepare`), matching the original report.
+ */
+test.describe('account settings · two-factor dialog', () => {
+  test('opening the Enable 2FA dialog renders without a framer-motion crash', async ({ page }) => {
+    test.setTimeout(60000);
+
+    const framerErrors: string[] = [];
+    page.on('pageerror', (error) => {
+      if (/is not a function/i.test(error.message)) {
+        framerErrors.push(error.message);
+      }
+    });
+
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+
+    await page.getByTestId('nav-user').click();
+    await page.getByRole('menuitem', { name: 'Settings' }).click();
+    await page.getByRole('tab', { name: 'Account' }).click();
+
+    // Opening the dialog mounts the framer-motion-animated body — the crash site.
+    await page.getByRole('button', { name: 'Enable 2FA' }).click();
+
+    // With the broken framer-motion build this content never renders.
+    await expect(page.locator('#two-factor-authentication-dialog')).toBeVisible({ timeout: 15000 });
+    await expect(page.getByRole('button', { name: 'Generate QR Code' })).toBeVisible();
+
+    expect(
+      framerErrors,
+      `framer-motion threw while rendering the 2FA dialog: ${framerErrors.join(' | ')}`,
+    ).toEqual([]);
+  });
+});
diff --git a/e2e/specs/mock/usage.spec.ts b/e2e/specs/mock/usage.spec.ts
new file mode 100644
index 00000000000..1d854870941
--- /dev/null
+++ b/e2e/specs/mock/usage.spec.ts
@@ -0,0 +1,230 @@
+import { expect, test } from '@playwright/test';
+import type { Page } from '@playwright/test';
+import {
+  mockReply,
+  sendMessage,
+  messagesView,
+  MOCK_ENDPOINTS,
+  NEW_CHAT_PATH,
+  isAgentsStream,
+  selectMockEndpoint,
+} from './helpers';
+
+const gauge = (page: Page) => page.getByTestId('token-usage');
+const gaugeMeter = (page: Page) => gauge(page).getByRole('meter');
+
+async function expectGaugeAboveZero(page: Page) {
+  await expect(gauge(page)).toBeVisible({ timeout: 20000 });
+  await expect(gaugeMeter(page)).toHaveAttribute('aria-valuenow', /[1-9]/, { timeout: 20000 });
+}
+
+/** Opens the gauge breakdown popover (click, not hover) and returns its region. */
+async function openBreakdown(page: Page) {
+  await expectGaugeAboveZero(page);
+  await gauge(page).click();
+  const popover = page.getByRole('region', { name: 'Context usage' });
+  await expect(popover).toBeVisible({ timeout: 10000 });
+  return popover;
+}
+
+/** Granularity lives only in the live `on_context_usage` snapshot; its rows
+ *  render under the `context-breakdown` testid, the coarse message-history
+ *  fallback under `context-estimate`. They are mutually exclusive. */
+async function expectGranular(page: Page) {
+  const popover = await openBreakdown(page);
+  await expect(popover.getByTestId('context-breakdown')).toBeVisible({ timeout: 10000 });
+  await expect(popover.getByTestId('context-estimate')).toHaveCount(0);
+  await expect(popover.getByText('Messages', { exact: true })).toBeVisible();
+  await expect(popover.getByText('Free space', { exact: true })).toBeVisible();
+}
+
+async function sendAndAwaitReply(page: Page, text: string) {
+  const response = await sendMessage(page, text);
+  expect(response.ok()).toBeTruthy();
+  await expect(mockReply(page)).toBeVisible({ timeout: 20000 });
+  await expect(page).toHaveURL(/\/c\/(?!new)/, { timeout: 15000 });
+}
+
+test.describe('context usage gauge', () => {
+  test('tracks usage from live SSE events and survives reload', async ({ page }) => {
+    test.setTimeout(120000);
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+
+    // REQUIRED so the message streams without a real key.
+    await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+
+    const response = await sendMessage(page, 'hello');
+    expect(response.ok()).toBeTruthy();
+    await expect(mockReply(page)).toBeVisible({ timeout: 20000 });
+    await expect(page).toHaveURL(/\/c\/(?!new)/, { timeout: 15000 });
+
+    /** Live path: the agents pipeline's context snapshot + usage events fill the gauge */
+    await expectGaugeAboveZero(page);
+
+    /** Breakdown popover: context section always; the usage section is
+     *  scoped by testid since the pre-snapshot fallback renders its own
+     *  Input/Output rows when the lib predates on_context_usage */
+    await gauge(page).click();
+    const popover = page.getByRole('region', { name: 'Context usage' });
+    await expect(popover).toBeVisible({ timeout: 10000 });
+    await expect(popover.getByText('Context window')).toBeVisible();
+    const usageSection = popover.getByTestId('token-usage-totals');
+    await expect(usageSection).toBeVisible({ timeout: 10000 });
+    await expect(usageSection.getByText('Input', { exact: true })).toBeVisible();
+    await expect(usageSection.getByText('Output', { exact: true })).toBeVisible();
+
+    /** Cost row: interface.contextCost is enabled in the harness yaml, the
+     *  token-config endpoint prices mock models at the default rate, and the
+     *  fake model emits usage — so a $ value must render. A single (unbranched)
+     *  conversation shows only the branch cost, no all-branches total line. */
+    const costSection = popover.getByTestId('token-usage-cost');
+    await expect(costSection).toBeVisible();
+    await expect(costSection.getByText(/\$\d|<\$0\.01/)).toBeVisible();
+    await expect(costSection.getByText('All branches')).toHaveCount(0);
+    await page.keyboard.press('Escape');
+
+    /** Persistence (Parts A + B): after reload the breakdown rehydrates from
+     *  the response message's metadata.contextUsage + metadata.usage — the
+     *  granular rows AND the branch cost survive without generating a turn. */
+    await page.reload({ timeout: 15000 });
+    await expect(mockReply(page)).toBeVisible({ timeout: 20000 });
+    await expectGaugeAboveZero(page);
+    const reloaded = await openBreakdown(page);
+    await expect(reloaded.getByTestId('context-breakdown')).toBeVisible({ timeout: 10000 });
+    const reloadedCost = reloaded.getByTestId('token-usage-cost');
+    await expect(reloadedCost).toBeVisible();
+    await expect(reloadedCost.getByText(/\$\d|<\$0\.01/)).toBeVisible();
+  });
+
+  test('renders the granular breakdown from the live context snapshot', async ({ page }) => {
+    test.setTimeout(120000);
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+
+    await sendAndAwaitReply(page, 'hello');
+
+    /** The agents pipeline emits on_context_usage on each model call, so the
+     *  breakdown — not the estimate fallback — drives the popover. */
+    await expectGranular(page);
+  });
+
+  test('shows branch cost with an all-branches total after regenerating', async ({ page }) => {
+    test.setTimeout(150000);
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+
+    await sendAndAwaitReply(page, 'hello');
+
+    /** Single branch: branch cost == total, so no all-branches line renders. */
+    let popover = await openBreakdown(page);
+    await expect(popover.getByTestId('token-usage-cost')).toBeVisible();
+    await expect(popover.getByText('All branches')).toHaveCount(0);
+    await page.keyboard.press('Escape');
+
+    /** Regenerate to create a sibling branch (B). */
+    const assistantMessage = messagesView(page).locator('.message-render').nth(1);
+    await assistantMessage.hover();
+    const regenerateButton = assistantMessage.locator('button[title="Regenerate"]').last();
+    await expect(regenerateButton).toBeVisible();
+    const [regen] = await Promise.all([
+      page.waitForResponse(isAgentsStream, { timeout: 30000 }),
+      regenerateButton.click(),
+    ]);
+    expect(regen.ok()).toBeTruthy();
+    await expect(page.getByText('2 / 2')).toBeVisible({ timeout: 20000 });
+
+    /** Branch cost is shown live for the regenerated branch. */
+    popover = await openBreakdown(page);
+    await expect(popover.getByTestId('token-usage-cost')).toBeVisible();
+    await page.keyboard.press('Escape');
+
+    /** After reload both branches rehydrate from persisted metadata.usage, so
+     *  the cost is branch-scoped and a muted all-branches total appears (it
+     *  exceeds the single viewed branch). */
+    await page.reload({ timeout: 15000 });
+    await expect(mockReply(page)).toBeVisible({ timeout: 20000 });
+    const reloaded = await openBreakdown(page);
+    const costSection = reloaded.getByTestId('token-usage-cost');
+    await expect(costSection).toBeVisible();
+    await expect(costSection.getByText('Cost (this branch)')).toBeVisible();
+    await expect(costSection.getByText('All branches')).toBeVisible();
+  });
+
+  test('preserves the granular breakdown after switching branches', async ({ page }) => {
+    test.setTimeout(150000);
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+
+    await sendAndAwaitReply(page, 'hello');
+
+    /** Branch A: the just-generated branch shows its live snapshot. */
+    await expectGranular(page);
+    await page.keyboard.press('Escape');
+
+    /** Regenerate to create a sibling branch (B), which overwrites the single
+     *  live snapshot and anchors it to B's response (proven selectors mirror
+     *  chat.spec.ts's branch test). */
+    const assistantMessage = messagesView(page).locator('.message-render').nth(1);
+    await assistantMessage.hover();
+    const regenerateButton = assistantMessage.locator('button[title="Regenerate"]').last();
+    await expect(regenerateButton).toBeVisible();
+    const [regen] = await Promise.all([
+      page.waitForResponse(isAgentsStream, { timeout: 30000 }),
+      regenerateButton.click(),
+    ]);
+    expect(regen.ok()).toBeTruthy();
+    await expect(page.getByText('2 / 2')).toBeVisible({ timeout: 20000 });
+
+    /** Switch back to branch A. Its live snapshot was overwritten by B, so the
+     *  rows can only survive via the per-anchor snapshot history map. */
+    await page.getByRole('button', { name: 'Previous sibling message' }).click();
+    await expect(page.getByText('1 / 2')).toBeVisible({ timeout: 10000 });
+
+    await expectGranular(page);
+
+    /** Branch cost must also survive the switch (live, no reload): branch A's
+     *  flushed usage is restored from the sticky usage history even though its
+     *  cache message lacks metadata.usage and B's regenerate dropped it. */
+    const popover = page.getByRole('region', { name: 'Context usage' });
+    const costSection = popover.getByTestId('token-usage-cost');
+    await expect(costSection).toBeVisible();
+    /** Branch A also has siblings, so both a branch-cost row and an all-branches
+     *  total render — assert at least one cost value is present. */
+    await expect(costSection.getByText(/\$\d|<\$0\.01/).first()).toBeVisible();
+  });
+
+  test('hides on a new chat, then reveals snapshot on hover and breakdown on click', async ({
+    page,
+  }) => {
+    test.setTimeout(120000);
+    await page.goto(NEW_CHAT_PATH, { timeout: 10000 });
+    await selectMockEndpoint(page, MOCK_ENDPOINTS[0]);
+
+    /** A fresh, message-less chat shows no gauge (it is not mounted). */
+    await expect(gauge(page)).toHaveCount(0);
+
+    await sendAndAwaitReply(page, 'hello');
+    await expectGaugeAboveZero(page);
+
+    /** Hover surfaces the compact snapshot tooltip — not the full breakdown. */
+    await gauge(page).hover();
+    const tooltip = page.getByRole('tooltip');
+    await expect(tooltip).toBeVisible({ timeout: 10000 });
+    await expect(tooltip).toContainText('Context');
+    await expect(page.getByRole('region', { name: 'Context usage' })).toHaveCount(0);
+
+    /** Click opens the breakdown popover; Escape (focus-away) closes it. */
+    await gauge(page).click();
+    const popover = page.getByRole('region', { name: 'Context usage' });
+    await expect(popover).toBeVisible({ timeout: 10000 });
+    await expect(popover.getByText('Context window')).toBeVisible();
+    await page.keyboard.press('Escape');
+    await expect(popover).toBeHidden({ timeout: 10000 });
+
+    /** Reopen, then dismiss by clicking outside (blur). */
+    await gauge(page).click();
+    await expect(popover).toBeVisible({ timeout: 10000 });
+    await messagesView(page).click({ position: { x: 5, y: 5 } });
+    await expect(popover).toBeHidden({ timeout: 10000 });
+  });
+});
diff --git a/e2e/specs/real/usage.spec.ts b/e2e/specs/real/usage.spec.ts
new file mode 100644
index 00000000000..f7cedbe1aee
--- /dev/null
+++ b/e2e/specs/real/usage.spec.ts
@@ -0,0 +1,122 @@
+import { expect, test } from '@playwright/test';
+import type { Page, TestInfo } from '@playwright/test';
+import { sendMessage, selectMockEndpoint } from '../mock/helpers';
+
+/**
+ * LOCAL-ONLY real-provider verification: drives multiple turns against real
+ * Anthropic and asserts the context gauge tracks genuine provider usage.
+ * Runs only via e2e/playwright.config.real.ts (requires ANTHROPIC_API_KEY).
+ */
+
+const REAL_MODEL = process.env.E2E_REAL_ANTHROPIC_MODEL ?? 'claude-haiku-4-5';
+
+const gauge = (page: Page) => page.getByTestId('token-usage');
+const gaugeMeter = (page: Page) => gauge(page).getByRole('meter');
+const popover = (page: Page) => page.getByRole('region', { name: 'Context usage' });
+
+async function gaugeValue(page: Page): Promise<number> {
+  const raw = await gaugeMeter(page).getAttribute('aria-valuenow');
+  const value = Number(raw);
+  expect(Number.isFinite(value)).toBe(true);
+  return value;
+}
+
+/** Parses formatTokens output ("950", "1.2K", "2M") back to a number. */
+function parseTokens(text: string): number {
+  const match = text.trim().match(/^([\d.]+)([KM])?/i);
+  if (!match) {
+    return NaN;
+  }
+  const suffix = match[2]?.toUpperCase();
+  let scale = 1;
+  if (suffix === 'M') {
+    scale = 1e6;
+  } else if (suffix === 'K') {
+    scale = 1e3;
+  }
+  return parseFloat(match[1]) * scale;
+}
+
+async function readUsageTotals(page: Page): Promise<{ input: number; output: number }> {
+  await gauge(page).hover();
+  const section = popover(page).getByTestId('token-usage-totals');
+  await expect(section).toBeVisible({ timeout: 15000 });
+  const rows = section.locator('div');
+  const input = parseTokens(
+    (await rows.filter({ hasText: 'Input' }).first().locator('span').last().innerText()) ?? '',
+  );
+  const output = parseTokens(
+    (await rows.filter({ hasText: 'Output' }).first().locator('span').last().innerText()) ?? '',
+  );
+  await page.keyboard.press('Escape');
+  return { input, output };
+}
+
+async function sendTurn(page: Page, text: string) {
+  const response = await sendMessage(page, text);
+  expect(response.ok()).toBeTruthy();
+  /** Settle: streaming over once the stop button yields back to send */
+  await expect(page.getByRole('button', { name: 'Stop generating' })).toBeHidden({
+    timeout: 90000,
+  });
+  await expect(page.getByTestId('send-button')).toBeVisible({ timeout: 30000 });
+}
+
+test.describe('context usage gauge with a real provider', () => {
+  test('grows across turns and reflects real usage', async ({ page }, testInfo: TestInfo) => {
+    test.setTimeout(300000);
+    await page.goto('/c/new', { timeout: 15000 });
+
+    await selectMockEndpoint(page, { label: 'Anthropic', model: REAL_MODEL } as never);
+
+    /** Turn 1 */
+    await sendTurn(page, 'Reply with exactly one word: alpha');
+    await expect(gauge(page)).toBeVisible({ timeout: 20000 });
+    const v1 = await gaugeValue(page);
+    expect(v1).toBeGreaterThan(0);
+    const totals1 = await readUsageTotals(page);
+    expect(totals1.input).toBeGreaterThan(0);
+    expect(totals1.output).toBeGreaterThan(0);
+    await gauge(page).hover();
+    await expect(popover(page).getByText('Messages')).toBeVisible();
+    await expect(popover(page).getByText('Free space')).toBeVisible();
+    await expect(popover(page).getByText('Session cost')).toBeVisible();
+    await expect(popover(page).getByText(/\$\d|<\$0\.01/)).toBeVisible();
+    await page.screenshot({ path: testInfo.outputPath('turn1-popover.png') });
+    await page.keyboard.press('Escape');
+    await expect(page).toHaveURL(/\/c\/(?!new)/, { timeout: 15000 });
+
+    /** Turn 2: context must include turn 1 — gauge and totals grow */
+    await sendTurn(page, 'Reply with exactly one word: beta');
+    const v2 = await gaugeValue(page);
+    expect(v2).toBeGreaterThan(v1);
+    const totals2 = await readUsageTotals(page);
+    expect(totals2.input).toBeGreaterThan(totals1.input);
+    expect(totals2.output).toBeGreaterThan(totals1.output);
+
+    /** Turn 3 */
+    await sendTurn(page, 'Reply with exactly one word: gamma');
+    const v3 = await gaugeValue(page);
+    expect(v3).toBeGreaterThan(v2);
+    await gauge(page).hover();
+    await expect(popover(page)).toBeVisible({ timeout: 15000 });
+    await page.screenshot({ path: testInfo.outputPath('turn3-popover.png') });
+    await page.keyboard.press('Escape');
+
+    /** Reload: gauge rebuilds from persisted per-message token counts once
+     *  the messages query resolves — retry until the meter leaves zero */
+    await page.reload({ timeout: 20000 });
+    await expect(gauge(page)).toBeVisible({ timeout: 20000 });
+    await expect(gaugeMeter(page)).toHaveAttribute('aria-valuenow', /[1-9]/, { timeout: 20000 });
+    const vReload = await gaugeValue(page);
+    expect(vReload).toBeGreaterThan(0);
+    await gauge(page).hover();
+    await expect(popover(page)).toBeVisible({ timeout: 15000 });
+    await page.screenshot({ path: testInfo.outputPath('reload-popover.png') });
+
+    testInfo.annotations.push({
+      type: 'observed',
+      description: `v1=${v1} v2=${v2} v3=${v3} reload=${vReload} input1=${totals1.input} input2=${totals2.input}`,
+    });
+  });
+});
diff --git a/eslint.config.mjs b/eslint.config.mjs
index adf52b44a61..800e71f69db 100644
--- a/eslint.config.mjs
+++ b/eslint.config.mjs
@@ -120,7 +120,7 @@ export default [
       'jsx-a11y/img-redundant-alt': 'off',
       'jsx-a11y/no-noninteractive-tabindex': 'off',
       // common rules
-      'no-nested-ternary': 'warn',
+      'no-nested-ternary': 'error',
       'no-constant-binary-expression': 'warn',
       'no-unused-vars': [
         'warn',
@@ -219,7 +219,10 @@ export default [
     })),
   {
     files: ['**/*.ts', '**/*.tsx'],
-    ignores: ['packages/**/*', 'client/vite.config.ts'],
+    // e2e specs are not part of `client/tsconfig.json`'s program, so typed
+    // linting them errors with "file not found in project"; they still get
+    // the non-type-checked recommended rules from the block above.
+    ignores: ['packages/**/*', 'client/vite.config.ts', 'e2e/**/*'],
     plugins: {
       '@typescript-eslint': typescriptEslintEslintPlugin,
       jest: fixupPluginRules(jest),
diff --git a/helm/librechat/Chart.yaml b/helm/librechat/Chart.yaml
index 694bfa41aad..0096383710c 100755
--- a/helm/librechat/Chart.yaml
+++ b/helm/librechat/Chart.yaml
@@ -15,7 +15,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 2.0.5
+version: 2.0.6
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
@@ -23,7 +23,7 @@ version: 2.0.5
 # It is recommended to use it with quotes.
 
 # renovate: image=registry.librechat.ai/danny-avila/librechat
-appVersion: "v0.8.6"
+appVersion: "v0.8.7-rc1"
 
 home: https://www.librechat.ai
 
diff --git a/librechat.example.yaml b/librechat.example.yaml
index da7d773641d..968723925d1 100644
--- a/librechat.example.yaml
+++ b/librechat.example.yaml
@@ -2,7 +2,7 @@
 # https://www.librechat.ai/docs/configuration/librechat_yaml
 
 # Configuration version (required)
-version: 1.3.12
+version: 1.3.13
 
 # Cache settings: Set to true to enable caching
 cache: true
@@ -61,6 +61,37 @@ cache: true
 #   # Recommended for download paths: attach a CloudFront response headers policy
 #   # with X-Content-Type-Options: nosniff and CSP default-src 'none'.
 
+# Skill sync configuration (optional)
+# GitHub tokens are referenced from environment variables. Put the token in
+# `.env`, then reference it here with `token: '${GITHUB_SKILLS_TOKEN}'`. Use a
+# GitHub fine-grained personal access token scoped to the selected repository
+# with read-only Contents and Metadata permissions.
+# skillSync:
+#   github:
+#     enabled: false
+#     intervalMinutes: 60
+#     runOnStartup: true
+#     sources:
+#       - id: librechat-skills
+#         owner: your-org
+#         repo: your-skills-repo
+#         ref: main
+#         paths:
+#           - skills
+#         # Number of directory levels below each configured path to scan for
+#         # `SKILL.md`. Use 2 for repos shaped like `skills/<category>/<skill>`.
+#         skillDiscoveryDepth: 2
+#         token: '${GITHUB_SKILLS_TOKEN}'
+#         # Optional. Owns the mirrored skills under the given tenant so they are
+#         # created and shared within that tenant. Required for visibility when
+#         # tenant isolation is enabled. Omit for single-tenant deployments.
+#         # Treat as immutable per source id: changing (or adding/removing) the
+#         # tenantId later leaves previously mirrored skills in the old tenant,
+#         # where this source's sync can no longer see or clean them up. To move a
+#         # source between tenants, delete its mirrored skills in the old tenant
+#         # first, or use a new source id for the new tenant.
+#         # tenantId: your-tenant-id
+
 # Custom interface configuration
 interface:
   customWelcome: 'Welcome to LibreChat! Enjoy your experience.'
@@ -146,24 +177,30 @@ interface:
   #   share: false
   #   public: false
   # MCP Servers configuration example
+  # Shared Links configuration
+  # Controls user permissions for shared links (e.g. sharing conversations via link)
+  # sharedLinks:
+  #   create: false
+  #   share: true
+  #   public: true # Allows users to toggle "share with everyone" for their links. Whether anonymous access is permitted is controlled by ALLOW_SHARED_LINKS_PUBLIC.
   # mcpServers:
-    # Controls user permissions for MCP (Model Context Protocol) server management
-    # - use: Allow users to use configured MCP servers
-    # - create: Allow users to create and manage new MCP servers
-    # - share: Allow users to share MCP servers with other users
-    # - public: Allow users to share MCP servers publicly (with everyone)
-
-    # Creation / edit MCP server config Dialog config example
-    # trustCheckbox:
-    #   label:
-    #     en: 'I understand and I want to continue'
-    #     de: 'Ich verstehe und möchte fortfahren'
-    #     de-DE: 'Ich verstehe und möchte fortfahren' # You can narrow translation to regions like (de-DE or de-CH)
-    #   subLabel:
-    #     en: |
-    #       Librechat hasn't reviewed this MCP server. Attackers may attempt to steal your data or trick the model into taking unintended actions, including destroying data. <a href="https://google.de" target="_blank"><strong>Learn more.</strong></a>
-    #     de: |
-    #       LibreChat hat diesen MCP-Server nicht überprüft. Angreifer könnten versuchen, Ihre Daten zu stehlen oder das Modell zu unbeabsichtigten Aktionen zu verleiten, einschließlich der Zerstörung von Daten. <a href="https://google.de" target="_blank"><strong>Mehr erfahren.</strong></a>
+  # Controls user permissions for MCP (Model Context Protocol) server management
+  # - use: Allow users to use configured MCP servers
+  # - create: Allow users to create and manage new MCP servers
+  # - share: Allow users to share MCP servers with other users
+  # - public: Allow users to share MCP servers publicly (with everyone)
+
+  # Creation / edit MCP server config Dialog config example
+  # trustCheckbox:
+  #   label:
+  #     en: 'I understand and I want to continue'
+  #     de: 'Ich verstehe und möchte fortfahren'
+  #     de-DE: 'Ich verstehe und möchte fortfahren' # You can narrow translation to regions like (de-DE or de-CH)
+  #   subLabel:
+  #     en: |
+  #       Librechat hasn't reviewed this MCP server. Attackers may attempt to steal your data or trick the model into taking unintended actions, including destroying data. <a href="https://google.de" target="_blank"><strong>Learn more.</strong></a>
+  #     de: |
+  #       LibreChat hat diesen MCP-Server nicht überprüft. Angreifer könnten versuchen, Ihre Daten zu stehlen oder das Modell zu unbeabsichtigten Aktionen zu verleiten, einschließlich der Zerstörung von Daten. <a href="https://google.de" target="_blank"><strong>Mehr erfahren.</strong></a>
 
   # Temporary chat retention period in hours (default: 720, min: 1, max: 8760)
   # temporaryChatRetention: 1
@@ -375,9 +412,28 @@ endpoints:
   #   # (optional) Minimum relevance score for sources to be included in responses, defaults to 0.45 (45% relevance threshold)
   #   # Set to 0.0 to show all sources (no filtering), or higher like 0.7 for stricter filtering
   #   minRelevanceScore: 0.45
+  #   # (optional) Cap the number of active accessible skills shown in the model-visible catalog.
+  #   # Useful for large organizations where many department-specific skills may be available.
+  #   skills:
+  #     maxCatalogSkills: 20
   #   # (optional) Agent Capabilities available to all users. Omit the ones you wish to exclude. Defaults to list below.
   #   capabilities: ["deferred_tools", "execute_code", "file_search", "actions", "tools"]
 
+  # (optional) Custom request headers for the built-in OpenAI / Google endpoints.
+  # Forwarded on every request to the provider (or an AI gateway / reverse proxy
+  # in front of it) while keeping provider-native request shaping intact. Values
+  # support env vars (${VAR}), user fields ({{LIBRECHAT_USER_*}}), and request-body
+  # fields ({{LIBRECHAT_BODY_CONVERSATIONID}}). Set the same `headers:` block under
+  # `endpoints.all` to apply globally across endpoints (endpoint values win on key
+  # collisions). NOTE: send metadata headers like these only behind a gateway that
+  # consumes them — native provider APIs ignore unknown headers.
+  # openAI:
+  #   headers:
+  #     cf-aig-metadata: '{"user_email":"{{LIBRECHAT_USER_EMAIL}}","app":"librechat"}'
+  # google:
+  #   headers:
+  #     cf-aig-metadata: '{"user_email":"{{LIBRECHAT_USER_EMAIL}}","app":"librechat"}'
+
   # Anthropic endpoint configuration with Vertex AI support
   # Use this to run Anthropic Claude models through Google Cloud Vertex AI
   # anthropic:
@@ -385,6 +441,12 @@ endpoints:
   #   streamRate: 20
   #   # (optional) Title model for conversation titles
   #   titleModel: claude-3.5-haiku  # Use the visible model name (key from models config)
+  #   # (optional) Custom request headers, same placeholder resolution as above.
+  #   # Useful for correlating reverse-proxied requests by conversation, since an
+  #   # unknown header is simply ignored by the native Anthropic API.
+  #   headers:
+  #     cf-aig-metadata: '{"user_email":"{{LIBRECHAT_USER_EMAIL}}","app":"librechat"}'
+  #     X-Conversation-Id: '{{LIBRECHAT_BODY_CONVERSATIONID}}'
   #
   #   # Vertex AI Configuration - enables running Claude models via Google Cloud
   #   # This is similar to Azure OpenAI but for Anthropic models on Google Cloud
@@ -410,6 +472,7 @@ endpoints:
   #     # Option 1: Simple array (legacy format - model name = deployment name)
   #     # Use this if you want the technical model IDs to show in the UI
   #     # models:
+  #     #   - "claude-fable-5"
   #     #   - "claude-opus-4-8"
   #     #   - "claude-sonnet-4-6"
   #     #   - "claude-3-7-sonnet-20250219"
@@ -421,6 +484,8 @@ endpoints:
   #     # The deploymentName is the actual Vertex AI model ID used for API calls
   #     # You can use friendly names (avoid spaces for cleaner YAML) or technical IDs as keys
   #     models:
+  #       claude-fable-5:
+  #         deploymentName: claude-fable-5
   #       claude-opus-4.8:
   #         deploymentName: claude-opus-4-8
   #       claude-opus-4.5:
@@ -443,6 +508,29 @@ endpoints:
   #     #     deploymentName: claude-3-5-haiku@20241022  # Override for this model
 
   custom:
+    # Anthropic-compatible Example (native `/v1/messages` API)
+    # Set `provider: anthropic` to use the native Anthropic client instead of the
+    # default OpenAI-compatible one — for Anthropic itself or Anthropic-compatible
+    # gateways (e.g. AI gateways, OpenCode Zen). The `baseURL` must be the API root
+    # the Anthropic SDK appends `/v1/messages` to. List models explicitly: model
+    # auto-fetch uses the OpenAI `/models` convention and is not used for this provider.
+    - name: 'Claude-Compatible'
+      provider: 'anthropic'
+      apiKey: '${ANTHROPIC_API_KEY}'
+      baseURL: 'https://api.anthropic.com'
+      # (optional) headers forwarded on every request (e.g. for a reverse proxy);
+      # values support the same placeholders as built-in endpoints.
+      headers:
+        anthropic-version: '2023-06-01'
+      models:
+        default:
+          - 'claude-sonnet-4-5'
+          - 'claude-opus-4-5'
+        fetch: false
+      titleConvo: true
+      titleModel: 'claude-sonnet-4-5'
+      modelDisplayLabel: 'Claude (Compatible)'
+
     # Groq Example
     - name: 'groq'
       apiKey: '${GROQ_API_KEY}'
@@ -596,10 +684,22 @@ endpoints:
 #     - name: "gpt-4o"
 #       label: "GPT-4 Optimized"
 #       description: "Most capable GPT-4 model with multimodal support"
+#       # default: true      # Hard admin default; takes precedence over prior user choices
+#       # softDefault: true  # First-time default only; skipped after a user selects a model/spec/agent
 #       group: "openAI"  # String value matching the endpoint name
 #       preset:
 #         endpoint: "openAI"
 #         model: "gpt-4o"
+#       # Skills can be enabled per model spec. Use true for the user's active
+#       # accessible skill catalog, false to force skills off, or a name list as
+#       # a strict allowlist for catalog, manual, and always-apply resolution.
+#       # skills: ["brand-guidelines", "code-review"]
+#       # Subagents can be enabled per model spec. `allowSelf: true` lets the
+#       # ephemeral agent spawn a fresh isolated copy of itself for focused work.
+#       # subagents:
+#       #   enabled: true
+#       #   allowSelf: true
+#       #   agent_ids: []
 #
 #     # Example 2: Nested under a custom endpoint (grouped with groq endpoint)
 #     - name: "llama3-70b-8192"
@@ -736,8 +836,10 @@ endpoints:
 #   disabled: false
 #   # (optional) Restrict memory keys to specific values to limit memory storage and improve consistency
 #   validKeys: ["preferences", "work_info", "personal_info", "skills", "interests", "context"]
-#   # (optional) Maximum token limit for memory storage (not yet implemented for token counting)
+#   # (optional) Maximum token limit for stored memory values
 #   tokenLimit: 10000
+#   # (optional) Maximum tokens from recent chat sent to the memory agent before truncation
+#   maxInputTokens: 12000
 #   # (optional) Enable personalization features (defaults to true if memory is configured)
 #   # When false, users will not see the Personalization tab in settings
 #   personalize: true
@@ -754,3 +856,21 @@ endpoints:
 #     # instructions: "You are a memory management assistant. Store and manage user information accurately."
 #     # model_parameters:
 #     #   temperature: 0.1
+
+# Reject chat messages whose text matches credential-shaped patterns
+# before they reach moderation, the model, or persistence. Filter
+# types live under `messageFilter.<type>`; today only `pii` ships, but
+# the namespace is structured so future filter types can plug in.
+# Omit the whole section to disable.
+# messageFilter:
+#   pii:
+#     # (optional) Pick a subset of the starter catalog by id; omit to
+#     # enable all starters (sk_prefix, bearer_header, api_key_header).
+#     starterPatterns: [sk_prefix, bearer_header, api_key_header]
+#     # (optional) Operator-defined patterns. Each entry needs id,
+#     # label, and a JavaScript-flavor regex; the regex is validated
+#     # at config load time.
+#     customPatterns:
+#       - id: anthropic_api_key
+#         label: Anthropic API key
+#         regex: "sk-ant-[A-Za-z0-9_-]{20,}"
diff --git a/package-lock.json b/package-lock.json
index e5b549fa476..c45c70dc9bd 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "LibreChat",
-  "version": "v0.8.6",
+  "version": "v0.8.7-rc1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "LibreChat",
-      "version": "v0.8.6",
+      "version": "v0.8.7-rc1",
       "license": "ISC",
       "workspaces": [
         "api",
@@ -40,13 +40,13 @@
         "lint-staged": "^15.4.3",
         "prettier": "^3.5.0",
         "prettier-plugin-tailwindcss": "^0.6.11",
-        "turbo": "^2.9.14",
-        "typescript-eslint": "^8.24.0"
+        "turbo": "^2.9.17",
+        "typescript-eslint": "^8.60.1"
       }
     },
     "api": {
       "name": "@librechat/backend",
-      "version": "v0.8.6",
+      "version": "v0.8.7-rc1",
       "license": "ISC",
       "dependencies": {
         "@anthropic-ai/vertex-sdk": "^0.16.0",
@@ -59,9 +59,9 @@
         "@azure/identity": "^4.13.1",
         "@azure/search-documents": "^12.0.0",
         "@azure/storage-blob": "^12.30.0",
-        "@google/genai": "^2.0.1",
+        "@google/genai": "^2.8.0",
         "@keyv/redis": "^4.3.3",
-        "@librechat/agents": "^3.2.1",
+        "@librechat/agents": "^3.2.36",
         "@librechat/api": "*",
         "@librechat/data-schemas": "*",
         "@microsoft/microsoft-graph-client": "^3.0.7",
@@ -97,11 +97,13 @@
         "file-type": "^21.3.2",
         "firebase": "^11.0.2",
         "form-data": "^4.0.4",
+        "get-stream": "^6.0.1",
         "handlebars": "^4.7.9",
         "https-proxy-agent": "^7.0.6",
         "ioredis": "^5.3.2",
         "js-yaml": "^4.1.1",
         "jsonwebtoken": "^9.0.0",
+        "jszip": "^3.10.1",
         "jwks-rsa": "^3.2.0",
         "keyv": "^5.3.2",
         "keyv-file": "^5.1.2",
@@ -114,6 +116,7 @@
         "memorystore": "^1.6.7",
         "mime": "^3.0.0",
         "module-alias": "^2.2.3",
+        "mongodb": "^6.14.2",
         "mongoose": "^8.23.1",
         "multer": "^2.1.1",
         "nanoid": "^3.3.7",
@@ -136,7 +139,6 @@
         "rate-limit-redis": "^4.2.0",
         "sanitize-html": "^2.13.0",
         "sharp": "^0.33.5",
-        "traverse": "^0.6.7",
         "ua-parser-js": "^1.0.36",
         "undici": "^7.24.1",
         "winston": "^3.11.0",
@@ -146,6 +148,7 @@
         "zod": "^3.22.4"
       },
       "devDependencies": {
+        "@babel/preset-env": "^7.29.5",
         "@types/sanitize-html": "^2.13.0",
         "jest": "^30.2.0",
         "mongodb-memory-server": "^11.0.1",
@@ -407,7 +410,7 @@
     },
     "client": {
       "name": "@librechat/frontend",
-      "version": "v0.8.6",
+      "version": "v0.8.7-rc1",
       "license": "ISC",
       "dependencies": {
         "@ariakit/react": "^0.4.15",
@@ -451,7 +454,7 @@
         "downloadjs": "^1.4.7",
         "export-from-json": "^1.7.2",
         "filenamify": "^6.0.0",
-        "framer-motion": "^11.5.4",
+        "framer-motion": "^12.40.0",
         "heic-to": "^1.1.14",
         "html-to-image": "^1.11.11",
         "i18next": "^24.2.2",
@@ -463,8 +466,15 @@
         "lodash": "^4.17.23",
         "lucide-react": "^0.394.0",
         "match-sorter": "^8.1.0",
+        "mdast-util-directive": "^3.0.0",
+        "mdast-util-from-markdown": "^2.0.1",
+        "mdast-util-gfm": "^3.0.0",
+        "mdast-util-math": "^3.0.0",
         "mermaid": "^11.15.0",
+        "micromark-extension-directive": "^3.0.1",
+        "micromark-extension-gfm": "^3.0.0",
         "micromark-extension-llm-math": "^3.1.0",
+        "micromark-extension-math": "^3.1.0",
         "qrcode.react": "^4.2.0",
         "rc-input-number": "^7.4.2",
         "react": "^18.2.0",
@@ -530,12 +540,12 @@
         "jest-canvas-mock": "^2.5.2",
         "jest-environment-jsdom": "^30.2.0",
         "jest-file-loader": "^1.0.3",
-        "jest-junit": "^16.0.0",
+        "jest-junit": "^17.0.0",
         "monaco-editor": "^0.55.1",
         "postcss": "^8.4.31",
         "postcss-preset-env": "^11.2.0",
         "tailwindcss": "^3.4.1",
-        "typescript": "^5.3.3",
+        "typescript": "^5.9.3",
         "vite": "^8.0.16",
         "vite-plugin-compression2": "^2.5.3",
         "vite-plugin-node-polyfills": "^0.28.0",
@@ -849,33 +859,6 @@
         "@babel/core": "^7.10.0"
       }
     },
-    "client/node_modules/framer-motion": {
-      "version": "11.18.2",
-      "resolved": "https://registry.npmjs.org/framer-motion/-/framer-motion-11.18.2.tgz",
-      "integrity": "sha512-5F5Och7wrvtLVElIpclDT0CBzMVg3dL22B64aZwHtsIY8RB4mXICLrkajK4G9R+ieSAGcgrLeae2SeUTg2pr6w==",
-      "license": "MIT",
-      "dependencies": {
-        "motion-dom": "^11.18.1",
-        "motion-utils": "^11.18.1",
-        "tslib": "^2.4.0"
-      },
-      "peerDependencies": {
-        "@emotion/is-prop-valid": "*",
-        "react": "^18.0.0 || ^19.0.0",
-        "react-dom": "^18.0.0 || ^19.0.0"
-      },
-      "peerDependenciesMeta": {
-        "@emotion/is-prop-valid": {
-          "optional": true
-        },
-        "react": {
-          "optional": true
-        },
-        "react-dom": {
-          "optional": true
-        }
-      }
-    },
     "client/node_modules/lucide-react": {
       "version": "0.394.0",
       "resolved": "https://registry.npmjs.org/lucide-react/-/lucide-react-0.394.0.tgz",
@@ -8579,9 +8562,9 @@
       }
     },
     "node_modules/@eslint-community/eslint-utils": {
-      "version": "4.9.0",
-      "resolved": "https://registry.npmjs.org/@eslint-community/eslint-utils/-/eslint-utils-4.9.0.tgz",
-      "integrity": "sha512-ayVFHdtZ+hsq1t2Dy24wCmGXGe4q9Gu3smhLYALJrr473ZH27MsnSL+LKUlimp4BWJqMDMLmPpx/Q9R3OAlL4g==",
+      "version": "4.9.1",
+      "resolved": "https://registry.npmjs.org/@eslint-community/eslint-utils/-/eslint-utils-4.9.1.tgz",
+      "integrity": "sha512-phrYmNiYppR7znFEdqgfWHXR6NCkZEK7hwWDHZUjit/2/U0r6XvkDl0SYnoM51Hq7FhCGdLDT6zxCCOY1hexsQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -8598,9 +8581,9 @@
       }
     },
     "node_modules/@eslint-community/regexpp": {
-      "version": "4.12.1",
-      "resolved": "https://registry.npmjs.org/@eslint-community/regexpp/-/regexpp-4.12.1.tgz",
-      "integrity": "sha512-CCZCDJuduB9OUkFkY2IgppNZMi2lBQgD2qzwXkEia16cge2pijY/aXi96CJMquDMn3nJdlPV1A5KrJEXwfLNzQ==",
+      "version": "4.12.2",
+      "resolved": "https://registry.npmjs.org/@eslint-community/regexpp/-/regexpp-4.12.2.tgz",
+      "integrity": "sha512-EriSTlt5OC9/7SXkRSCAhfSxxoSUgBm33OH+IkwbdpgoqsSsUg7y3uh+IICI/Qg4BBWr3U2i39RpmycbxMq4ew==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -9379,9 +9362,9 @@
       "license": "MIT"
     },
     "node_modules/@google/genai": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/@google/genai/-/genai-2.0.1.tgz",
-      "integrity": "sha512-trxxbVePM9J8Cuni5x7+xvApoqb2y6Zk27/wugjT2cuwHOT78nFGdf/Ni29MkDxzWwrj90OQpno1Ana6dm3D2A==",
+      "version": "2.8.0",
+      "resolved": "https://registry.npmjs.org/@google/genai/-/genai-2.8.0.tgz",
+      "integrity": "sha512-pc2ayxqO5+O7AvnHBqpNHIk7PAZkHZgL31tbyx0gJZBSS9qPYiQoqwK7oYOw/ePmG6QY4EMSu+304vD5QlhXAw==",
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -9418,13 +9401,13 @@
       }
     },
     "node_modules/@google/genai/node_modules/gcp-metadata": {
-      "version": "8.1.2",
-      "resolved": "https://registry.npmjs.org/gcp-metadata/-/gcp-metadata-8.1.2.tgz",
-      "integrity": "sha512-zV/5HKTfCeKWnxG0Dmrw51hEWFGfcF2xiXqcA3+J90WDuP0SvoiSO5ORvcBsifmx/FoIjgQN3oNOGaQ5PhLFkg==",
+      "version": "8.1.3",
+      "resolved": "https://registry.npmjs.org/gcp-metadata/-/gcp-metadata-8.1.3.tgz",
+      "integrity": "sha512-ziTrzUhhpL9Zk5k0HHzgP/KIpWDJT0VMBC/ynt/QIBvTW+UUcSivQRl6VlwTf/EilDxtSWklHoRsKy1c4k+59w==",
       "license": "Apache-2.0",
       "dependencies": {
-        "gaxios": "^7.0.0",
-        "google-logging-utils": "^1.0.0",
+        "gaxios": "7.1.3",
+        "google-logging-utils": "1.1.3",
         "json-bigint": "^1.0.0"
       },
       "engines": {
@@ -9512,9 +9495,10 @@
       }
     },
     "node_modules/@grpc/grpc-js": {
-      "version": "1.9.15",
-      "resolved": "https://registry.npmjs.org/@grpc/grpc-js/-/grpc-js-1.9.15.tgz",
-      "integrity": "sha512-nqE7Hc0AzI+euzUwDAy0aY5hCp10r734gMGRdU+qOPX0XSceI2ULrcXB5U2xSc5VkWwalCj4M7GzCAygZl2KoQ==",
+      "version": "1.9.16",
+      "resolved": "https://registry.npmjs.org/@grpc/grpc-js/-/grpc-js-1.9.16.tgz",
+      "integrity": "sha512-wE4Ut/olIzfKqp631XrG+wbF0v1vWFN4YL9FyXC2LJiG33DsV7PLzURjrCvY/6je2ntdRkeLpPDluzSRGaVltQ==",
+      "license": "Apache-2.0",
       "dependencies": {
         "@grpc/proto-loader": "^0.7.8",
         "@types/node": ">=12.12.47"
@@ -11187,16 +11171,13 @@
       }
     },
     "node_modules/@langchain/core": {
-      "version": "1.1.44",
-      "resolved": "https://registry.npmjs.org/@langchain/core/-/core-1.1.44.tgz",
-      "integrity": "sha512-RePW1IjGCHr9ua2vcby3aE8mOOz3EnwDZxMEGbNDT91kf14eqkJqxDXvaZFviGdcN9DTrxM5RPQNAHmwSm4tbg==",
+      "version": "1.1.48",
+      "resolved": "https://registry.npmjs.org/@langchain/core/-/core-1.1.48.tgz",
+      "integrity": "sha512-fQU6Guyb1pwc2fEplmA8FPbKfOMAofjnyJzExevro0FxEiuGHE18Ov/ZHmT9trWCDTZRI9eW1VIc6aChxV8pAQ==",
       "license": "MIT",
       "dependencies": {
         "@cfworker/json-schema": "^4.0.2",
         "@standard-schema/spec": "^1.1.0",
-        "ansi-styles": "^5.0.0",
-        "camelcase": "6",
-        "decamelize": "1.2.0",
         "js-tiktoken": "^1.0.12",
         "langsmith": ">=0.5.0 <1.0.0",
         "mustache": "^4.2.0",
@@ -11207,17 +11188,6 @@
         "node": ">=20"
       }
     },
-    "node_modules/@langchain/core/node_modules/ansi-styles": {
-      "version": "5.2.0",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-5.2.0.tgz",
-      "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
-      }
-    },
     "node_modules/@langchain/core/node_modules/zod": {
       "version": "4.4.2",
       "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.2.tgz",
@@ -11243,41 +11213,24 @@
       }
     },
     "node_modules/@langchain/google-common": {
-      "version": "2.1.28",
-      "resolved": "https://registry.npmjs.org/@langchain/google-common/-/google-common-2.1.28.tgz",
-      "integrity": "sha512-iSQ3IKYDWW56F0FMrk4ztm1vABox4S3EfY2ZFhEHRD/ckC3pvcAa6n5ZEH0cuMUY63OBKxPiLS0+lJG3TgLJ2A==",
+      "version": "2.1.31",
+      "resolved": "https://registry.npmjs.org/@langchain/google-common/-/google-common-2.1.31.tgz",
+      "integrity": "sha512-UZylzgnG7pGq3KdLZy2UHIB5BO5ssQXL69OwQurvwJxsbZ1gg8eixB345o0fw9/AuJkOulgRMJWm8Lmr3vDI9w==",
       "license": "MIT",
-      "dependencies": {
-        "uuid": "^10.0.0"
-      },
       "engines": {
         "node": ">=20"
       },
       "peerDependencies": {
-        "@langchain/core": "^1.1.41"
-      }
-    },
-    "node_modules/@langchain/google-common/node_modules/uuid": {
-      "version": "10.0.0",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-10.0.0.tgz",
-      "integrity": "sha512-8XkAphELsDnEGrDxUOHB3RGvXz6TeuYSGEZBOjtTtPm2lwhGBjLgOzLHB63IUWfBpNucQjND6d3AOudO+H3RWQ==",
-      "deprecated": "uuid@10 and below is no longer supported.  For ESM codebases, update to uuid@latest.  For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).",
-      "funding": [
-        "https://github.com/sponsors/broofa",
-        "https://github.com/sponsors/ctavan"
-      ],
-      "license": "MIT",
-      "bin": {
-        "uuid": "dist/bin/uuid"
+        "@langchain/core": "^1.1.47"
       }
     },
     "node_modules/@langchain/google-gauth": {
-      "version": "2.1.28",
-      "resolved": "https://registry.npmjs.org/@langchain/google-gauth/-/google-gauth-2.1.28.tgz",
-      "integrity": "sha512-aMxBwv0OrAa+oNQ/5kUuBo1MLXi6xtjOLtRN5XF6qpbCmqx21Z0PsMfZ4+dD0128H3O8jY8M4whgr3cdyhbVpQ==",
+      "version": "2.1.31",
+      "resolved": "https://registry.npmjs.org/@langchain/google-gauth/-/google-gauth-2.1.31.tgz",
+      "integrity": "sha512-k4il0hff88bQ4HiGCTiGraRGsNiKAOkb2neAea27U7m6Tmomn5Pn0WItCoyBmoEm6GoE/874pSNNk1Ze7qj07g==",
       "license": "MIT",
       "dependencies": {
-        "@langchain/google-common": "2.1.28",
+        "@langchain/google-common": "2.1.31",
         "google-auth-library": "^10.6.2"
       },
       "engines": {
@@ -11285,9 +11238,9 @@
       }
     },
     "node_modules/@langchain/google-gauth/node_modules/gaxios": {
-      "version": "7.1.4",
-      "resolved": "https://registry.npmjs.org/gaxios/-/gaxios-7.1.4.tgz",
-      "integrity": "sha512-bTIgTsM2bWn3XklZISBTQX7ZSddGW+IO3bMdGaemHZ3tbqExMENHLx6kKZ/KlejgrMtj8q7wBItt51yegqalrA==",
+      "version": "7.1.5",
+      "resolved": "https://registry.npmjs.org/gaxios/-/gaxios-7.1.5.tgz",
+      "integrity": "sha512-5FZy72Rh8LhtjmvDrKkI+lVhrsQrVKVsItxMoDm5mNQE+xR0WVIIs+jzPSJgBvKVsLi24fZhXJIsNI0bihDzFg==",
       "license": "Apache-2.0",
       "dependencies": {
         "extend": "^3.0.2",
@@ -11313,9 +11266,9 @@
       }
     },
     "node_modules/@langchain/google-gauth/node_modules/google-auth-library": {
-      "version": "10.6.2",
-      "resolved": "https://registry.npmjs.org/google-auth-library/-/google-auth-library-10.6.2.tgz",
-      "integrity": "sha512-e27Z6EThmVNNvtYASwQxose/G57rkRuaRbQyxM2bvYLLX/GqWZ5chWq2EBoUchJbCc57eC9ArzO5wMsEmWftCw==",
+      "version": "10.7.0",
+      "resolved": "https://registry.npmjs.org/google-auth-library/-/google-auth-library-10.7.0.tgz",
+      "integrity": "sha512-QpTAbNJ36TliZLx3TTtahR8HG0hN9RllL1e3FymOvQSIKK8JmgV58H924ub2wa2DsS3ANjjP1Aw1N+Ramc8hqQ==",
       "license": "Apache-2.0",
       "dependencies": {
         "base64-js": "^1.3.0",
@@ -11357,44 +11310,43 @@
       }
     },
     "node_modules/@langchain/google-genai": {
-      "version": "2.1.28",
-      "resolved": "https://registry.npmjs.org/@langchain/google-genai/-/google-genai-2.1.28.tgz",
-      "integrity": "sha512-iTzNYWST8hTRqOXZdme18tq5GnCUwtrrJECE51ZCjg6Vg0mPsV44amdC+/bc+UK0+uphKWESGWs277aAyM2MlA==",
+      "version": "2.1.31",
+      "resolved": "https://registry.npmjs.org/@langchain/google-genai/-/google-genai-2.1.31.tgz",
+      "integrity": "sha512-lHIJGtZab0jqoufKRPXyHHg1nLXrE74LXd0ftgibWEACc1SpSLu6XwtA23+dX4l7Q/YeSgb9n40YJx5k00/fqw==",
       "license": "MIT",
       "dependencies": {
-        "@google/generative-ai": "^0.24.0",
-        "uuid": "^11.1.0"
+        "@google/generative-ai": "^0.24.1"
       },
       "engines": {
         "node": ">=20"
       },
       "peerDependencies": {
-        "@langchain/core": "^1.1.41"
+        "@langchain/core": "^1.1.47"
       }
     },
     "node_modules/@langchain/google-vertexai": {
-      "version": "2.1.28",
-      "resolved": "https://registry.npmjs.org/@langchain/google-vertexai/-/google-vertexai-2.1.28.tgz",
-      "integrity": "sha512-NuZAvM3xlkQWZa2CCFhPAaeYwGI+raY+piwwF0f5sZTjWgYEwAQC2/GMoOK4/uaC23visNdhKGW2GeY31AQoNw==",
+      "version": "2.1.31",
+      "resolved": "https://registry.npmjs.org/@langchain/google-vertexai/-/google-vertexai-2.1.31.tgz",
+      "integrity": "sha512-ZJwUumwyVyyU5z0PoaMm7nAeGTm9Rp3QcEfm5WVUJl2ag4bqiQhd33+7jzb8h0GkiqvK9INtpmfvtUh29rH3qg==",
       "license": "MIT",
       "dependencies": {
-        "@langchain/google-gauth": "2.1.28"
+        "@langchain/google-gauth": "2.1.31"
       },
       "engines": {
         "node": ">=20"
       }
     },
     "node_modules/@langchain/langgraph": {
-      "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/@langchain/langgraph/-/langgraph-1.3.2.tgz",
-      "integrity": "sha512-SL7Ktsr681R7da+1b2MVOWEbaCoFJOXEJPTGOjg4JIG4C7quWbTYC8DzxhcCxte6D/8cGp0rYDBnbKLXEpNqlA==",
+      "version": "1.3.4",
+      "resolved": "https://registry.npmjs.org/@langchain/langgraph/-/langgraph-1.3.4.tgz",
+      "integrity": "sha512-i5nlhy2INcX326sTJ+dAkvSe+sYO8DoGHn4OwxcI7U6OSm/n8xek24yvL5ahX09M1PES9hfooKz1lYn+cyPULw==",
       "license": "MIT",
       "dependencies": {
-        "@langchain/langgraph-checkpoint": "^1.0.2",
-        "@langchain/langgraph-sdk": "~1.9.4",
-        "@langchain/protocol": "^0.0.15",
+        "@langchain/langgraph-checkpoint": "^1.0.4",
+        "@langchain/langgraph-sdk": "~1.9.12",
+        "@langchain/protocol": "^0.0.16",
         "@standard-schema/spec": "1.1.0",
-        "uuid": "^10.0.0"
+        "uuid": "^14.0.0"
       },
       "engines": {
         "node": ">=18"
@@ -11411,12 +11363,12 @@
       }
     },
     "node_modules/@langchain/langgraph-checkpoint": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/@langchain/langgraph-checkpoint/-/langgraph-checkpoint-1.0.2.tgz",
-      "integrity": "sha512-F4E5Tr0nt8FGghgdscJtHw+ABzChOHeI80R7Y1pjIHdiJom6c2ieo76vL+FWiny80JmoGqhrVAEIWrw0cXKPxg==",
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/@langchain/langgraph-checkpoint/-/langgraph-checkpoint-1.0.4.tgz",
+      "integrity": "sha512-1y5MgZ0gXXrtmoy56e3kaBChI3GwFPIKl27xkrHwN+VE/3iUsyr9gO3Jtp7kdKAe6diZGbcas5bdC/r0yUwTZA==",
       "license": "MIT",
       "dependencies": {
-        "uuid": "^10.0.0"
+        "uuid": "^14.0.0"
       },
       "engines": {
         "node": ">=18"
@@ -11426,30 +11378,29 @@
       }
     },
     "node_modules/@langchain/langgraph-checkpoint/node_modules/uuid": {
-      "version": "10.0.0",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-10.0.0.tgz",
-      "integrity": "sha512-8XkAphELsDnEGrDxUOHB3RGvXz6TeuYSGEZBOjtTtPm2lwhGBjLgOzLHB63IUWfBpNucQjND6d3AOudO+H3RWQ==",
-      "deprecated": "uuid@10 and below is no longer supported.  For ESM codebases, update to uuid@latest.  For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).",
+      "version": "14.0.0",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-14.0.0.tgz",
+      "integrity": "sha512-Qo+uWgilfSmAhXCMav1uYFynlQO7fMFiMVZsQqZRMIXp0O7rR7qjkj+cPvBHLgBqi960QCoo/PH2/6ZtVqKvrg==",
       "funding": [
         "https://github.com/sponsors/broofa",
         "https://github.com/sponsors/ctavan"
       ],
       "license": "MIT",
       "bin": {
-        "uuid": "dist/bin/uuid"
+        "uuid": "dist-node/bin/uuid"
       }
     },
     "node_modules/@langchain/langgraph-sdk": {
-      "version": "1.9.4",
-      "resolved": "https://registry.npmjs.org/@langchain/langgraph-sdk/-/langgraph-sdk-1.9.4.tgz",
-      "integrity": "sha512-hhASJGKa2MDJDtDkuIFdWGysMTog/HkYe0r6B6Gn1XqsURWnF7FIFl9diITAPOv1tB8YpyjnbpsBj/NkT5d+jQ==",
+      "version": "1.9.15",
+      "resolved": "https://registry.npmjs.org/@langchain/langgraph-sdk/-/langgraph-sdk-1.9.15.tgz",
+      "integrity": "sha512-QUW9c7ikycmTkpr/eQYkKA4gpriqizG1OJ6H2YLbDOVkEYLSFnJeTO4MG6pBBO8EqHHa8m1zavKi5ug259VSQQ==",
       "license": "MIT",
       "dependencies": {
-        "@langchain/protocol": "^0.0.15",
+        "@langchain/protocol": "^0.0.16",
         "@types/json-schema": "^7.0.15",
         "p-queue": "^9.0.1",
         "p-retry": "^7.1.1",
-        "uuid": "^13.0.0"
+        "uuid": "^14.0.0"
       },
       "peerDependencies": {
         "@langchain/core": "^1.1.44",
@@ -11502,9 +11453,9 @@
       }
     },
     "node_modules/@langchain/langgraph-sdk/node_modules/uuid": {
-      "version": "13.0.2",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-13.0.2.tgz",
-      "integrity": "sha512-vzi9uRZ926x4XV73S/4qQaTwPXM2JBj6/6lI/byHH1jOpCzb0zDbfytgA9LcN/hzb2l7WQSQnxITOVx5un/wGw==",
+      "version": "14.0.0",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-14.0.0.tgz",
+      "integrity": "sha512-Qo+uWgilfSmAhXCMav1uYFynlQO7fMFiMVZsQqZRMIXp0O7rR7qjkj+cPvBHLgBqi960QCoo/PH2/6ZtVqKvrg==",
       "funding": [
         "https://github.com/sponsors/broofa",
         "https://github.com/sponsors/ctavan"
@@ -11515,17 +11466,16 @@
       }
     },
     "node_modules/@langchain/langgraph/node_modules/uuid": {
-      "version": "10.0.0",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-10.0.0.tgz",
-      "integrity": "sha512-8XkAphELsDnEGrDxUOHB3RGvXz6TeuYSGEZBOjtTtPm2lwhGBjLgOzLHB63IUWfBpNucQjND6d3AOudO+H3RWQ==",
-      "deprecated": "uuid@10 and below is no longer supported.  For ESM codebases, update to uuid@latest.  For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).",
+      "version": "14.0.0",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-14.0.0.tgz",
+      "integrity": "sha512-Qo+uWgilfSmAhXCMav1uYFynlQO7fMFiMVZsQqZRMIXp0O7rR7qjkj+cPvBHLgBqi960QCoo/PH2/6ZtVqKvrg==",
       "funding": [
         "https://github.com/sponsors/broofa",
         "https://github.com/sponsors/ctavan"
       ],
       "license": "MIT",
       "bin": {
-        "uuid": "dist/bin/uuid"
+        "uuid": "dist-node/bin/uuid"
       }
     },
     "node_modules/@langchain/mistralai": {
@@ -11591,9 +11541,9 @@
       }
     },
     "node_modules/@langchain/protocol": {
-      "version": "0.0.15",
-      "resolved": "https://registry.npmjs.org/@langchain/protocol/-/protocol-0.0.15.tgz",
-      "integrity": "sha512-MllvbpMjqHevUm+v94M422mH7XKN+wGCvJRBVROTWBotEDOATYB4Ktk2UheYP859y9o2LlhtPek5t1T9eyfAbQ==",
+      "version": "0.0.16",
+      "resolved": "https://registry.npmjs.org/@langchain/protocol/-/protocol-0.0.16.tgz",
+      "integrity": "sha512-ws+J7MaHyhO5dG7f0vdyHQiUn9hoCnki0f3crJPa4MCTGzcRC39jYSCghyrGtBPYQnZbUQiGyRVpW3z3M8IpJg==",
       "license": "MIT"
     },
     "node_modules/@langchain/textsplitters": {
@@ -11734,21 +11684,21 @@
       }
     },
     "node_modules/@librechat/agents": {
-      "version": "3.2.1",
-      "resolved": "https://registry.npmjs.org/@librechat/agents/-/agents-3.2.1.tgz",
-      "integrity": "sha512-CusD5Iif0rd/mTAC/3J32ZZwm0EjArRkOUGEXQoMWlh5hrU2pGw/XjNK54GwSaqOAKV31bD569BhJ12BR2WXBQ==",
+      "version": "3.2.36",
+      "resolved": "https://registry.npmjs.org/@librechat/agents/-/agents-3.2.36.tgz",
+      "integrity": "sha512-y9Bm5CMACNZh6OfDCUcABK84WUYndAfgO36Bu5EEyLqDm1S6TvoYUwQ/6P3jdsMy+Vj1ESrxAfCdQgy7fxtcjg==",
       "license": "MIT",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.92.0",
         "@aws-sdk/client-bedrock-runtime": "^3.1013.0",
         "@langchain/anthropic": "^1.3.28",
         "@langchain/aws": "^1.3.5",
-        "@langchain/core": "1.1.44",
+        "@langchain/core": "1.1.48",
         "@langchain/deepseek": "^1.0.25",
-        "@langchain/google-common": "2.1.28",
-        "@langchain/google-gauth": "2.1.28",
-        "@langchain/google-genai": "2.1.28",
-        "@langchain/google-vertexai": "2.1.28",
+        "@langchain/google-common": "2.1.31",
+        "@langchain/google-gauth": "2.1.31",
+        "@langchain/google-genai": "2.1.31",
+        "@langchain/google-vertexai": "2.1.31",
         "@langchain/langgraph": "^1.2.9",
         "@langchain/mistralai": "^1.0.8",
         "@langchain/openai": "1.4.5",
@@ -11774,10 +11724,10 @@
         "uuid": "^11.1.1"
       },
       "engines": {
-        "node": ">=20.0.0"
+        "node": ">=24.0.0"
       },
       "peerDependencies": {
-        "@anthropic-ai/sandbox-runtime": "^0.0.49"
+        "@anthropic-ai/sandbox-runtime": "^0.0.54"
       },
       "peerDependenciesMeta": {
         "@anthropic-ai/sandbox-runtime": {
@@ -12407,9 +12357,9 @@
       }
     },
     "node_modules/@opentelemetry/exporter-logs-otlp-grpc/node_modules/@grpc/grpc-js": {
-      "version": "1.14.3",
-      "resolved": "https://registry.npmjs.org/@grpc/grpc-js/-/grpc-js-1.14.3.tgz",
-      "integrity": "sha512-Iq8QQQ/7X3Sac15oB6p0FmUg/klxQvXLeileoqrTRGJYLV+/9tubbr9ipz0GKHjmXVsgFPo/+W+2cA8eNcR+XA==",
+      "version": "1.14.4",
+      "resolved": "https://registry.npmjs.org/@grpc/grpc-js/-/grpc-js-1.14.4.tgz",
+      "integrity": "sha512-k9Dj3DV/itK9D06Y8f190Qgop7/Ui+D0njFV3LHMPwPT75DpXLQohE9Wmz0QElrJnzsjB7KPWiKJbOl7IPDArQ==",
       "license": "Apache-2.0",
       "dependencies": {
         "@grpc/proto-loader": "^0.8.0",
@@ -12500,9 +12450,9 @@
       }
     },
     "node_modules/@opentelemetry/exporter-metrics-otlp-grpc/node_modules/@grpc/grpc-js": {
-      "version": "1.14.3",
-      "resolved": "https://registry.npmjs.org/@grpc/grpc-js/-/grpc-js-1.14.3.tgz",
-      "integrity": "sha512-Iq8QQQ/7X3Sac15oB6p0FmUg/klxQvXLeileoqrTRGJYLV+/9tubbr9ipz0GKHjmXVsgFPo/+W+2cA8eNcR+XA==",
+      "version": "1.14.4",
+      "resolved": "https://registry.npmjs.org/@grpc/grpc-js/-/grpc-js-1.14.4.tgz",
+      "integrity": "sha512-k9Dj3DV/itK9D06Y8f190Qgop7/Ui+D0njFV3LHMPwPT75DpXLQohE9Wmz0QElrJnzsjB7KPWiKJbOl7IPDArQ==",
       "license": "Apache-2.0",
       "dependencies": {
         "@grpc/proto-loader": "^0.8.0",
@@ -12609,9 +12559,9 @@
       }
     },
     "node_modules/@opentelemetry/exporter-trace-otlp-grpc/node_modules/@grpc/grpc-js": {
-      "version": "1.14.3",
-      "resolved": "https://registry.npmjs.org/@grpc/grpc-js/-/grpc-js-1.14.3.tgz",
-      "integrity": "sha512-Iq8QQQ/7X3Sac15oB6p0FmUg/klxQvXLeileoqrTRGJYLV+/9tubbr9ipz0GKHjmXVsgFPo/+W+2cA8eNcR+XA==",
+      "version": "1.14.4",
+      "resolved": "https://registry.npmjs.org/@grpc/grpc-js/-/grpc-js-1.14.4.tgz",
+      "integrity": "sha512-k9Dj3DV/itK9D06Y8f190Qgop7/Ui+D0njFV3LHMPwPT75DpXLQohE9Wmz0QElrJnzsjB7KPWiKJbOl7IPDArQ==",
       "license": "Apache-2.0",
       "dependencies": {
         "@grpc/proto-loader": "^0.8.0",
@@ -13073,9 +13023,9 @@
       }
     },
     "node_modules/@opentelemetry/otlp-grpc-exporter-base/node_modules/@grpc/grpc-js": {
-      "version": "1.14.3",
-      "resolved": "https://registry.npmjs.org/@grpc/grpc-js/-/grpc-js-1.14.3.tgz",
-      "integrity": "sha512-Iq8QQQ/7X3Sac15oB6p0FmUg/klxQvXLeileoqrTRGJYLV+/9tubbr9ipz0GKHjmXVsgFPo/+W+2cA8eNcR+XA==",
+      "version": "1.14.4",
+      "resolved": "https://registry.npmjs.org/@grpc/grpc-js/-/grpc-js-1.14.4.tgz",
+      "integrity": "sha512-k9Dj3DV/itK9D06Y8f190Qgop7/Ui+D0njFV3LHMPwPT75DpXLQohE9Wmz0QElrJnzsjB7KPWiKJbOl7IPDArQ==",
       "license": "Apache-2.0",
       "dependencies": {
         "@grpc/proto-loader": "^0.8.0",
@@ -13467,6 +13417,19 @@
       "integrity": "sha512-oOAWABowe8EAbMyWKM0tYDKi8Yaox52D+HWZhAIJqQXbqe0xI/GV7FhLWqlEKreMkfDjshR5FKgi3mnle0h6Eg==",
       "license": "BSD-3-Clause"
     },
+    "node_modules/@quansync/fs": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/@quansync/fs/-/fs-1.0.0.tgz",
+      "integrity": "sha512-4TJ3DFtlf1L5LDMaM6CanJ/0lckGNtJcMjQ1NAV6zDmA0tEHKZtxNKin8EgPaVX1YzljbxckyT2tJrpQKAtngQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "quansync": "^1.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sxzz"
+      }
+    },
     "node_modules/@quilted/events": {
       "version": "2.1.3",
       "resolved": "https://registry.npmjs.org/@quilted/events/-/events-2.1.3.tgz",
@@ -17354,9 +17317,9 @@
       }
     },
     "node_modules/@remix-run/router": {
-      "version": "1.23.2",
-      "resolved": "https://registry.npmjs.org/@remix-run/router/-/router-1.23.2.tgz",
-      "integrity": "sha512-Ic6m2U/rMjTkhERIa/0ZtXJP17QUi2CbWE7cqx4J58M8aA3QTfW+2UlQ4psvTX9IO1RfNVhK3pcpdjej7L+t2w==",
+      "version": "1.23.3",
+      "resolved": "https://registry.npmjs.org/@remix-run/router/-/router-1.23.3.tgz",
+      "integrity": "sha512-4An71tdz9X8+3sI4Qqqd2LWd9vS39J7sqd9EU4Scw7TJE/qB10Flv/UuqbPVgfQV9XoK8Np6jNquZitnZq5i+Q==",
       "license": "MIT",
       "engines": {
         "node": ">=14.0.0"
@@ -19719,9 +19682,9 @@
       "devOptional": true
     },
     "node_modules/@turbo/darwin-64": {
-      "version": "2.9.14",
-      "resolved": "https://registry.npmjs.org/@turbo/darwin-64/-/darwin-64-2.9.14.tgz",
-      "integrity": "sha512-t7QiPflaEyBE4oayeZtSmu4mEfjgIrcNlNNl1z1dmIVPqEdtA7+CfTf8d7KXsOGPh6aNgWjKxyvQg9uGfDQF+A==",
+      "version": "2.9.17",
+      "resolved": "https://registry.npmjs.org/@turbo/darwin-64/-/darwin-64-2.9.17.tgz",
+      "integrity": "sha512-io5jn5RDeU+9YV78rWhwG++HD/OZ/Lxg1sg93+jDGKQNP3UDxY6RX2dmarbCILhNxNuAM8FH3WgGMY9E96Mf8w==",
       "cpu": [
         "x64"
       ],
@@ -19733,9 +19696,9 @@
       ]
     },
     "node_modules/@turbo/darwin-arm64": {
-      "version": "2.9.14",
-      "resolved": "https://registry.npmjs.org/@turbo/darwin-arm64/-/darwin-arm64-2.9.14.tgz",
-      "integrity": "sha512-d23147mC9BsCPA9mJ0h/ubcpbRgcJBXbcG3+Vq7YLhjz3IXuvQsJ1UXH8f4MD76ZjJ4m/E4aRdJV+MW88CDfbw==",
+      "version": "2.9.17",
+      "resolved": "https://registry.npmjs.org/@turbo/darwin-arm64/-/darwin-arm64-2.9.17.tgz",
+      "integrity": "sha512-83YZTYmN2sxFWf2LTMOwqbOvR3qZMa/TSFwnB6BHVBbIWyoPPe+TAdSTd8KevEx8ml8KkycJ/9A70DFVReyUww==",
       "cpu": [
         "arm64"
       ],
@@ -19747,9 +19710,9 @@
       ]
     },
     "node_modules/@turbo/linux-64": {
-      "version": "2.9.14",
-      "resolved": "https://registry.npmjs.org/@turbo/linux-64/-/linux-64-2.9.14.tgz",
-      "integrity": "sha512-P3ZKB5tuUDdDQWuAsACGUR1qv9W7BNWxdxqVJ0kZNuNNPRaVYTPPikLcp79+GiEcW3npsR+KyP38lnQiBc5aSA==",
+      "version": "2.9.17",
+      "resolved": "https://registry.npmjs.org/@turbo/linux-64/-/linux-64-2.9.17.tgz",
+      "integrity": "sha512-teKfwJg0zSC+C2ZSOsX3VnAJGVgcN+pgKNmnGWzcpXQ9eIkAQtYP+getrQ2f1Tw/ePudnreQhq8tVP8S73Vy6Q==",
       "cpu": [
         "x64"
       ],
@@ -19761,9 +19724,9 @@
       ]
     },
     "node_modules/@turbo/linux-arm64": {
-      "version": "2.9.14",
-      "resolved": "https://registry.npmjs.org/@turbo/linux-arm64/-/linux-arm64-2.9.14.tgz",
-      "integrity": "sha512-ZRTlzcUMrrPv9ZuDzRF9n60Ym13bKeG9jDB8WjxyLhWNzV+AJQN+zdpIk3NJYf2zQsGUm1mNar2P0elRzLw25g==",
+      "version": "2.9.17",
+      "resolved": "https://registry.npmjs.org/@turbo/linux-arm64/-/linux-arm64-2.9.17.tgz",
+      "integrity": "sha512-mqO36x2CNtJ9CCbEf5xOqH662tVSc1wB0mxh7dopBpgXg0fEifdzwX0IEAUW1WUAaNH986L7iEUUgw3HNqUWgg==",
       "cpu": [
         "arm64"
       ],
@@ -19775,9 +19738,9 @@
       ]
     },
     "node_modules/@turbo/windows-64": {
-      "version": "2.9.14",
-      "resolved": "https://registry.npmjs.org/@turbo/windows-64/-/windows-64-2.9.14.tgz",
-      "integrity": "sha512-exanwN6sIduZwykYeiTQj8kCmOhazP5WOz3bvXMcYtjhL6Z3iRWLewKrXCBq0bqwSP3iBMb/AerRCnHI4lx46A==",
+      "version": "2.9.17",
+      "resolved": "https://registry.npmjs.org/@turbo/windows-64/-/windows-64-2.9.17.tgz",
+      "integrity": "sha512-jbyoNePufyMoSSrvVr+/mglcjmya/MOgoIrSHPr67iZ1VFgrlMQXHXtptR2lR48gi+86b1XBvsviJZ9A7zrydg==",
       "cpu": [
         "x64"
       ],
@@ -19789,9 +19752,9 @@
       ]
     },
     "node_modules/@turbo/windows-arm64": {
-      "version": "2.9.14",
-      "resolved": "https://registry.npmjs.org/@turbo/windows-arm64/-/windows-arm64-2.9.14.tgz",
-      "integrity": "sha512-fVdCsnmYoKICsycbWuuGp6Jvi51/3G/UluFWuAUCvR8PIW5IJkAk5BM9UF8PSm0Q2IphWHFZjYEgjHsh3B9y/g==",
+      "version": "2.9.17",
+      "resolved": "https://registry.npmjs.org/@turbo/windows-arm64/-/windows-arm64-2.9.17.tgz",
+      "integrity": "sha512-+ql0wYc99Y2AMvyHCcC/P+xtyV4nz522L+C9HDnyi7ryHXBGM+ZjBP28M7SLBGMDImgpN8sk2szpgbvreMeXVA==",
       "cpu": [
         "arm64"
       ],
@@ -19887,6 +19850,13 @@
         "@types/node": "*"
       }
     },
+    "node_modules/@types/cookiejar": {
+      "version": "2.1.5",
+      "resolved": "https://registry.npmjs.org/@types/cookiejar/-/cookiejar-2.1.5.tgz",
+      "integrity": "sha512-he+DHOWReW0nghN24E1WUqM0efK4kI9oTqDm6XmK8ZPe2djZ90BSNdGnIyCLzCPw7/pogPlGbzI2wHGGmi4O/Q==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@types/css-font-loading-module": {
       "version": "0.0.7",
       "resolved": "https://registry.npmjs.org/@types/css-font-loading-module/-/css-font-loading-module-0.0.7.tgz",
@@ -20283,6 +20253,13 @@
         "parse5": "^7.0.0"
       }
     },
+    "node_modules/@types/jsesc": {
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/@types/jsesc/-/jsesc-2.5.1.tgz",
+      "integrity": "sha512-9VN+6yxLOPLOav+7PwjZbxiID2bVaeq0ED4qSQmdQTdjnXJSaCVKTR58t15oqH1H5t8Ng2ZX1SabJVoN9Q34bw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@types/json-schema": {
       "version": "7.0.15",
       "resolved": "https://registry.npmjs.org/@types/json-schema/-/json-schema-7.0.15.tgz",
@@ -20332,6 +20309,13 @@
         "@types/unist": "*"
       }
     },
+    "node_modules/@types/methods": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@types/methods/-/methods-1.1.4.tgz",
+      "integrity": "sha512-ymXWVrDiCxTBE3+RIrrP533E70eA+9qu7zdWoHuOmGujkYtzf4HQF96b8nwHLqhuf4ykX61IGRIB38CC6/sImQ==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@types/mime": {
       "version": "1.3.5",
       "resolved": "https://registry.npmjs.org/@types/mime/-/mime-1.3.5.tgz",
@@ -20504,6 +20488,30 @@
       "integrity": "sha512-9aEbYZ3TbYMznPdcdr3SmIrLXwC/AKZXQeCf9Pgao5CKb8CyHuEX5jzWPTkvregvhRJHcpRO6BFoGW9ycaOkYw==",
       "dev": true
     },
+    "node_modules/@types/superagent": {
+      "version": "8.1.10",
+      "resolved": "https://registry.npmjs.org/@types/superagent/-/superagent-8.1.10.tgz",
+      "integrity": "sha512-nbt4IWXABhW0jGmmpRzCFNlbmwCTzZ2gTUsNIr+X+ItdqPms+PAJZbWsNzpS2USqXjcoNLQcO6nXo60zcPQiIg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/cookiejar": "^2.1.5",
+        "@types/methods": "^1.1.4",
+        "@types/node": "*",
+        "form-data": "^4.0.0"
+      }
+    },
+    "node_modules/@types/supertest": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/@types/supertest/-/supertest-7.2.0.tgz",
+      "integrity": "sha512-uh2Lv57xvggst6lCqNdFAmDSvoMG7M/HDtX4iUCquxQ5EGPtaPM5PL5Hmi7LCvOG8db7YaCPNJEeoI8s/WzIQw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/methods": "^1.1.4",
+        "@types/superagent": "^8.1.0"
+      }
+    },
     "node_modules/@types/testing-library__jest-dom": {
       "version": "5.14.9",
       "resolved": "https://registry.npmjs.org/@types/testing-library__jest-dom/-/testing-library__jest-dom-5.14.9.tgz",
@@ -20619,21 +20627,20 @@
       }
     },
     "node_modules/@typescript-eslint/eslint-plugin": {
-      "version": "8.24.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.24.0.tgz",
-      "integrity": "sha512-aFcXEJJCI4gUdXgoo/j9udUYIHgF23MFkg09LFz2dzEmU0+1Plk4rQWv/IYKvPHAtlkkGoB3m5e6oUp+JPsNaQ==",
+      "version": "8.60.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.60.1.tgz",
+      "integrity": "sha512-JQ4S5GB0tfjO8BuJ4fcX+HodkzJjYBV+7OJ+wLygaX7OGQ7FudyHL4NSCA6ob+w3Yn+5MkKIozOwQhXeM7opVg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@eslint-community/regexpp": "^4.10.0",
-        "@typescript-eslint/scope-manager": "8.24.0",
-        "@typescript-eslint/type-utils": "8.24.0",
-        "@typescript-eslint/utils": "8.24.0",
-        "@typescript-eslint/visitor-keys": "8.24.0",
-        "graphemer": "^1.4.0",
-        "ignore": "^5.3.1",
+        "@eslint-community/regexpp": "^4.12.2",
+        "@typescript-eslint/scope-manager": "8.60.1",
+        "@typescript-eslint/type-utils": "8.60.1",
+        "@typescript-eslint/utils": "8.60.1",
+        "@typescript-eslint/visitor-keys": "8.60.1",
+        "ignore": "^7.0.5",
         "natural-compare": "^1.4.0",
-        "ts-api-utils": "^2.0.1"
+        "ts-api-utils": "^2.5.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -20643,23 +20650,33 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "@typescript-eslint/parser": "^8.0.0 || ^8.0.0-alpha.0",
-        "eslint": "^8.57.0 || ^9.0.0",
-        "typescript": ">=4.8.4 <5.8.0"
+        "@typescript-eslint/parser": "^8.60.1",
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
+    "node_modules/@typescript-eslint/eslint-plugin/node_modules/ignore": {
+      "version": "7.0.5",
+      "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.5.tgz",
+      "integrity": "sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 4"
       }
     },
     "node_modules/@typescript-eslint/parser": {
-      "version": "8.24.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.24.0.tgz",
-      "integrity": "sha512-MFDaO9CYiard9j9VepMNa9MTcqVvSny2N4hkY6roquzj8pdCBRENhErrteaQuu7Yjn1ppk0v1/ZF9CG3KIlrTA==",
+      "version": "8.60.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.60.1.tgz",
+      "integrity": "sha512-A0M6ua6H252bVjPvvtSgl2QA4+ET9S5Mtkb2GDyTxIhH/C4qDItT7RQNO5PhMC6NXGYXOR9dIalcDDgBKT7oFA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/scope-manager": "8.24.0",
-        "@typescript-eslint/types": "8.24.0",
-        "@typescript-eslint/typescript-estree": "8.24.0",
-        "@typescript-eslint/visitor-keys": "8.24.0",
-        "debug": "^4.3.4"
+        "@typescript-eslint/scope-manager": "8.60.1",
+        "@typescript-eslint/types": "8.60.1",
+        "@typescript-eslint/typescript-estree": "8.60.1",
+        "@typescript-eslint/visitor-keys": "8.60.1",
+        "debug": "^4.4.3"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -20669,19 +20686,41 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "eslint": "^8.57.0 || ^9.0.0",
-        "typescript": ">=4.8.4 <5.8.0"
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
+    "node_modules/@typescript-eslint/project-service": {
+      "version": "8.60.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.60.1.tgz",
+      "integrity": "sha512-eXkTH2bxmXlqD1RnOPmLZ9ZM9D3VwSx04JOwBnP9RQ+yUA5a2Mu7SfW8uaV2Aon53NJzZlZYuX7tn91Izf+xaw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@typescript-eslint/tsconfig-utils": "^8.60.1",
+        "@typescript-eslint/types": "^8.60.1",
+        "debug": "^4.4.3"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "typescript": ">=4.8.4 <6.1.0"
       }
     },
     "node_modules/@typescript-eslint/scope-manager": {
-      "version": "8.24.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.24.0.tgz",
-      "integrity": "sha512-HZIX0UByphEtdVBKaQBgTDdn9z16l4aTUz8e8zPQnyxwHBtf5vtl1L+OhH+m1FGV9DrRmoDuYKqzVrvWDcDozw==",
+      "version": "8.60.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.60.1.tgz",
+      "integrity": "sha512-gvI5OQoptnxQnchOirukCuQ55svJSTuD/4k5+pC267xyBtYry748R9/c3tYUzb/iE6RZfllRz2lVulLCHkTm4w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.24.0",
-        "@typescript-eslint/visitor-keys": "8.24.0"
+        "@typescript-eslint/types": "8.60.1",
+        "@typescript-eslint/visitor-keys": "8.60.1"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -20691,17 +20730,35 @@
         "url": "https://opencollective.com/typescript-eslint"
       }
     },
+    "node_modules/@typescript-eslint/tsconfig-utils": {
+      "version": "8.60.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.60.1.tgz",
+      "integrity": "sha512-nh8w4qAteiKuZu3pSSzG/yGKpw0OlkrKnzFmbVRenKaD4qc+7i1GrmZaLVkr8rk4uipiPGMOW4YsM6WmKZ5CvA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
     "node_modules/@typescript-eslint/type-utils": {
-      "version": "8.24.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.24.0.tgz",
-      "integrity": "sha512-8fitJudrnY8aq0F1wMiPM1UUgiXQRJ5i8tFjq9kGfRajU+dbPyOuHbl0qRopLEidy0MwqgTHDt6CnSeXanNIwA==",
+      "version": "8.60.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.60.1.tgz",
+      "integrity": "sha512-sdwTrpjosW7ANQYJ39ZBF1ZyEMEGVB2UsikrserVM/30a/F1dTLnu9bGxEdosugyu5caigjLrR2qiD11asjI1A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/typescript-estree": "8.24.0",
-        "@typescript-eslint/utils": "8.24.0",
-        "debug": "^4.3.4",
-        "ts-api-utils": "^2.0.1"
+        "@typescript-eslint/types": "8.60.1",
+        "@typescript-eslint/typescript-estree": "8.60.1",
+        "@typescript-eslint/utils": "8.60.1",
+        "debug": "^4.4.3",
+        "ts-api-utils": "^2.5.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -20711,14 +20768,14 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "eslint": "^8.57.0 || ^9.0.0",
-        "typescript": ">=4.8.4 <5.8.0"
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+        "typescript": ">=4.8.4 <6.1.0"
       }
     },
     "node_modules/@typescript-eslint/types": {
-      "version": "8.24.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.24.0.tgz",
-      "integrity": "sha512-VacJCBTyje7HGAw7xp11q439A+zeGG0p0/p2zsZwpnMzjPB5WteaWqt4g2iysgGFafrqvyLWqq6ZPZAOCoefCw==",
+      "version": "8.60.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.60.1.tgz",
+      "integrity": "sha512-4h0tY8ppCkdCzcrl2YM5M3my0xsE1Tf8om3owEu5oPWmXwkKRmk0j0LGDzYBGUcAlesEbxBhazqu/K4cu3Ug7w==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -20730,20 +20787,21 @@
       }
     },
     "node_modules/@typescript-eslint/typescript-estree": {
-      "version": "8.24.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.24.0.tgz",
-      "integrity": "sha512-ITjYcP0+8kbsvT9bysygfIfb+hBj6koDsu37JZG7xrCiy3fPJyNmfVtaGsgTUSEuTzcvME5YI5uyL5LD1EV5ZQ==",
+      "version": "8.60.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.60.1.tgz",
+      "integrity": "sha512-alpRkfG8hlVE5kdJW2GkfgDgXxold3e8e4l6EnmhRmRLbekgAPCCGDVD++sABy9FcgPFroq+uFcCSM1vR57Cew==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.24.0",
-        "@typescript-eslint/visitor-keys": "8.24.0",
-        "debug": "^4.3.4",
-        "fast-glob": "^3.3.2",
-        "is-glob": "^4.0.3",
-        "minimatch": "^9.0.4",
-        "semver": "^7.6.0",
-        "ts-api-utils": "^2.0.1"
+        "@typescript-eslint/project-service": "8.60.1",
+        "@typescript-eslint/tsconfig-utils": "8.60.1",
+        "@typescript-eslint/types": "8.60.1",
+        "@typescript-eslint/visitor-keys": "8.60.1",
+        "debug": "^4.4.3",
+        "minimatch": "^10.2.2",
+        "semver": "^7.7.3",
+        "tinyglobby": "^0.2.15",
+        "ts-api-utils": "^2.5.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -20753,46 +20811,59 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "typescript": ">=4.8.4 <5.8.0"
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
+    "node_modules/@typescript-eslint/typescript-estree/node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
       }
     },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz",
-      "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==",
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
+      "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "balanced-match": "^1.0.0"
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
       }
     },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch": {
-      "version": "9.0.9",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
-      "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
+      "version": "10.2.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
+      "integrity": "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==",
       "dev": true,
-      "license": "ISC",
+      "license": "BlueOak-1.0.0",
       "dependencies": {
-        "brace-expansion": "^2.0.2"
+        "brace-expansion": "^5.0.5"
       },
       "engines": {
-        "node": ">=16 || 14 >=14.17"
+        "node": "18 || 20 || >=22"
       },
       "funding": {
         "url": "https://github.com/sponsors/isaacs"
       }
     },
     "node_modules/@typescript-eslint/utils": {
-      "version": "8.24.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.24.0.tgz",
-      "integrity": "sha512-07rLuUBElvvEb1ICnafYWr4hk8/U7X9RDCOqd9JcAMtjh/9oRmcfN4yGzbPVirgMR0+HLVHehmu19CWeh7fsmQ==",
+      "version": "8.60.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.60.1.tgz",
+      "integrity": "sha512-h2MPBLoNtjc3qZWfY3Tl51yPorQ2McHn8pJfcMNTcIvrrZrr90Ykffit0yjrPFWQcRcUxzH20+6OcVdW4yHtUg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@eslint-community/eslint-utils": "^4.4.0",
-        "@typescript-eslint/scope-manager": "8.24.0",
-        "@typescript-eslint/types": "8.24.0",
-        "@typescript-eslint/typescript-estree": "8.24.0"
+        "@eslint-community/eslint-utils": "^4.9.1",
+        "@typescript-eslint/scope-manager": "8.60.1",
+        "@typescript-eslint/types": "8.60.1",
+        "@typescript-eslint/typescript-estree": "8.60.1"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -20802,19 +20873,19 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "eslint": "^8.57.0 || ^9.0.0",
-        "typescript": ">=4.8.4 <5.8.0"
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+        "typescript": ">=4.8.4 <6.1.0"
       }
     },
     "node_modules/@typescript-eslint/visitor-keys": {
-      "version": "8.24.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.24.0.tgz",
-      "integrity": "sha512-kArLq83QxGLbuHrTMoOEWO+l2MwsNS2TGISEdx8xgqpkbytB07XmlQyQdNDrCc1ecSqx0cnmhGvpX+VBwqqSkg==",
+      "version": "8.60.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.60.1.tgz",
+      "integrity": "sha512-EbGRQg4FhrmwLodl+t3JNAnXHWVr9Vp+Zl1QBZVPY4ByfkzIT8cX3K6QWODHtkIZqqJVEWvhHSx3v5PDHsaQag==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.24.0",
-        "eslint-visitor-keys": "^4.2.0"
+        "@typescript-eslint/types": "8.60.1",
+        "eslint-visitor-keys": "^5.0.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -20825,13 +20896,13 @@
       }
     },
     "node_modules/@typescript-eslint/visitor-keys/node_modules/eslint-visitor-keys": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-4.2.0.tgz",
-      "integrity": "sha512-UyLnSehNt62FFhSwjZlHmeokpRK59rcz29j+F1/aDgbkbRTk7wIc9XzdoasMUbRNKDM0qQt/+BJ4BrpFeABemw==",
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-5.0.1.tgz",
+      "integrity": "sha512-tD40eHxA35h0PEIZNeIjkHoDR4YjjJp34biM0mDvplBe//mB+IHCqHDGV7pxF+7MklTvighcCPPZC7ynWyjdTA==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+        "node": "^20.19.0 || ^22.13.0 || >=24"
       },
       "funding": {
         "url": "https://opencollective.com/eslint"
@@ -21359,6 +21430,16 @@
         "url": "https://github.com/chalk/ansi-styles?sponsor=1"
       }
     },
+    "node_modules/ansis": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/ansis/-/ansis-4.3.1.tgz",
+      "integrity": "sha512-BJ8/l4R5LRE7hW9WdSuGYrLSHi2ynxeFpDFbH0K/CgNeY/tyhk+vO6TYxXC5r5CpUhNVX310xzPsN/H9lCdfOA==",
+      "dev": true,
+      "license": "ISC",
+      "engines": {
+        "node": ">=14"
+      }
+    },
     "node_modules/any-promise": {
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/any-promise/-/any-promise-1.3.0.tgz",
@@ -21624,6 +21705,84 @@
         "node": ">=0.8"
       }
     },
+    "node_modules/ast-kit": {
+      "version": "3.0.0-beta.1",
+      "resolved": "https://registry.npmjs.org/ast-kit/-/ast-kit-3.0.0-beta.1.tgz",
+      "integrity": "sha512-trmleAnZ2PxN/loHWVhhx1qeOHSRXq4TDsBBxq3GqeJitfk3+jTQ+v/C1km/KYq9M7wKqCewMh+/NAvVH7m+bw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/parser": "^8.0.0-beta.4",
+        "estree-walker": "^3.0.3",
+        "pathe": "^2.0.3"
+      },
+      "engines": {
+        "node": ">=20.19.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sxzz"
+      }
+    },
+    "node_modules/ast-kit/node_modules/@babel/helper-string-parser": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-8.0.0-rc.6.tgz",
+      "integrity": "sha512-BCkFy+zN6kXQed3YOT7aJl93NfDSzQc3pBfsvTVPs9gU9X3V0aefEF5kwBT0E+mDWH9QgKaZstYUQN9VdQZT4g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "node_modules/ast-kit/node_modules/@babel/helper-validator-identifier": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-8.0.0-rc.6.tgz",
+      "integrity": "sha512-nVJ+1JcCgntv8d78rRo++o2wuODT0Irknx2BF8Np4Ft2CRgjLqIs4qzSZ8b66yGbBdMWGmZBO9WEZv1hhNiSpg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "node_modules/ast-kit/node_modules/@babel/parser": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-8.0.0-rc.6.tgz",
+      "integrity": "sha512-rOS8IpdO7mQELkTPlCsTgPejO0bFuZdEDCGQJouYbYf9e1FLTym7Fei2pEjq8q7MWbX0ravcd7QQYKs1TxOuog==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/types": "^8.0.0-rc.6"
+      },
+      "bin": {
+        "parser": "bin/babel-parser.js"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "node_modules/ast-kit/node_modules/@babel/types": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-8.0.0-rc.6.tgz",
+      "integrity": "sha512-p7/ABylAYlexb31wtRdIfH9L9A0Z2T/9H6zAqzqndkY2PLkvNNc580wGhp/gGKN4Sp9sQvSkhc6Oga8/O+wTyw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-string-parser": "^8.0.0-rc.6",
+        "@babel/helper-validator-identifier": "^8.0.0-rc.6"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "node_modules/ast-kit/node_modules/estree-walker": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-3.0.3.tgz",
+      "integrity": "sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/estree": "^1.0.0"
+      }
+    },
     "node_modules/ast-types-flow": {
       "version": "0.0.8",
       "resolved": "https://registry.npmjs.org/ast-types-flow/-/ast-types-flow-0.0.8.tgz",
@@ -22269,6 +22428,16 @@
       "integrity": "sha512-VOMgTMwjAaUG580SXn3LacVgjurrbMme7ZZNYGSSV7mmtY6QQRh0Eg3pwIcntQ77DErK1L0NxkbetjcoXzVwKw==",
       "license": "MIT"
     },
+    "node_modules/birpc": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/birpc/-/birpc-4.0.0.tgz",
+      "integrity": "sha512-LShSxJP0KTmd101b6DRyGBj57LZxSDYWKitQNW/mi8GRMvZb078Uf9+pveax1DrVL89vm7mWe+TovdI/UDOuPw==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/antfu"
+      }
+    },
     "node_modules/bluebird": {
       "version": "3.4.7",
       "resolved": "https://registry.npmjs.org/bluebird/-/bluebird-3.4.7.tgz",
@@ -22684,6 +22853,16 @@
         "node": ">= 0.8"
       }
     },
+    "node_modules/cac": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/cac/-/cac-7.0.0.tgz",
+      "integrity": "sha512-tixWYgm5ZoOD+3g6UTea91eow5z6AAHaho3g0V9CNSNb45gM8SmflpAc+GRd1InC4AqN/07Unrgp56Y94N9hJQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=20.19.0"
+      }
+    },
     "node_modules/call-bind": {
       "version": "1.0.8",
       "resolved": "https://registry.npmjs.org/call-bind/-/call-bind-1.0.8.tgz",
@@ -22745,6 +22924,7 @@
       "version": "6.3.0",
       "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-6.3.0.tgz",
       "integrity": "sha512-Gmy6FhYlCY7uOElZUSbxo2UCDH8owEk996gkbrpsgGtrJLM3J7jGxl9Ic7Qwwj4ivOE5AWZWRMecDdF7hqGjFA==",
+      "dev": true,
       "engines": {
         "node": ">=10"
       },
@@ -24688,14 +24868,6 @@
         }
       }
     },
-    "node_modules/decamelize": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/decamelize/-/decamelize-1.2.0.tgz",
-      "integrity": "sha512-z2S+W9X73hAUUki+N+9Za2lBlun89zigOyGrsax+KUQ6wKW4ZoWpEYBkGhQjwAjjDCkWxhY0VKEhk8wzY7F5cA==",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
     "node_modules/decimal.js": {
       "version": "10.6.0",
       "resolved": "https://registry.npmjs.org/decimal.js/-/decimal.js-10.6.0.tgz",
@@ -24848,6 +25020,13 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/defu": {
+      "version": "6.1.7",
+      "resolved": "https://registry.npmjs.org/defu/-/defu-6.1.7.tgz",
+      "integrity": "sha512-7z22QmUWiQ/2d0KkdYmANbRUVABpZ9SNYyH5vx6PZ+nE5bcC0l7uFvEfHlyld/HcGBFTL536ClDt3DEcSlEJAQ==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/delaunator": {
       "version": "5.0.1",
       "resolved": "https://registry.npmjs.org/delaunator/-/delaunator-5.0.1.tgz",
@@ -25127,6 +25306,27 @@
       "resolved": "https://registry.npmjs.org/downloadjs/-/downloadjs-1.4.7.tgz",
       "integrity": "sha512-LN1gO7+u9xjU5oEScGFKvXhYf7Y/empUIIEAGBs1LzUq/rg5duiDrkuH5A2lQGd5jfMOb9X9usDa2oVXwJ0U/Q=="
     },
+    "node_modules/dts-resolver": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/dts-resolver/-/dts-resolver-3.0.0.tgz",
+      "integrity": "sha512-1T1f+z+4tl9XD+m+0HBgWoL/nm0bOIffyWaUuUSBlFg/86IWvfx+wjNaO/ybU0AJzG9/Mi5hBUgGV6zCmWEN7Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^22.18.0 || >=24.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sxzz"
+      },
+      "peerDependencies": {
+        "oxc-resolver": ">=11.0.0"
+      },
+      "peerDependenciesMeta": {
+        "oxc-resolver": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/duck": {
       "version": "0.1.12",
       "resolved": "https://registry.npmjs.org/duck/-/duck-0.1.12.tgz",
@@ -25231,6 +25431,16 @@
       "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-9.2.2.tgz",
       "integrity": "sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg=="
     },
+    "node_modules/empathic": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/empathic/-/empathic-2.0.1.tgz",
+      "integrity": "sha512-YGRs8knHhKHVShLkFET/rWAU8kmHbOV5LwN938RHI0pljAJ1Gf6SzXsSmRaEzcXTtOOmVqJ5+WtQPL5uigY50Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=14"
+      }
+    },
     "node_modules/enabled": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/enabled/-/enabled-2.0.0.tgz",
@@ -27146,14 +27356,13 @@
       }
     },
     "node_modules/framer-motion": {
-      "version": "12.23.9",
-      "resolved": "https://registry.npmjs.org/framer-motion/-/framer-motion-12.23.9.tgz",
-      "integrity": "sha512-TqEHXj8LWfQSKqfdr5Y4mYltYLw96deu6/K9kGDd+ysqRJPNwF9nb5mZcrLmybHbU7gcJ+HQar41U3UTGanbbQ==",
+      "version": "12.40.0",
+      "resolved": "https://registry.npmjs.org/framer-motion/-/framer-motion-12.40.0.tgz",
+      "integrity": "sha512-uaBd3qC1v3KQqBEjwTUd183K6PbS+j0yR9w9VmEOLWA/tnUcSn8Xa3uck7t4dgpDoUss8xQTcj8W2L07lrnLFg==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
-        "motion-dom": "^12.23.9",
-        "motion-utils": "^12.23.6",
+        "motion-dom": "^12.40.0",
+        "motion-utils": "^12.39.0",
         "tslib": "^2.4.0"
       },
       "peerDependencies": {
@@ -27173,23 +27382,6 @@
         }
       }
     },
-    "node_modules/framer-motion/node_modules/motion-dom": {
-      "version": "12.23.9",
-      "resolved": "https://registry.npmjs.org/motion-dom/-/motion-dom-12.23.9.tgz",
-      "integrity": "sha512-6Sv++iWS8XMFCgU1qwKj9l4xuC47Hp4+2jvPfyTXkqDg2tTzSgX6nWKD4kNFXk0k7llO59LZTPuJigza4A2K1A==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "motion-utils": "^12.23.6"
-      }
-    },
-    "node_modules/framer-motion/node_modules/motion-utils": {
-      "version": "12.23.6",
-      "resolved": "https://registry.npmjs.org/motion-utils/-/motion-utils-12.23.6.tgz",
-      "integrity": "sha512-eAWoPgr4eFEOFfg2WjIsMoqJTW6Z8MTUCgn/GZ3VRpClWBdnbjryiA3ZSNLyxCTmCQx4RmYX6jX1iWHbenUPNQ==",
-      "license": "MIT",
-      "peer": true
-    },
     "node_modules/fresh": {
       "version": "0.5.2",
       "resolved": "https://registry.npmjs.org/fresh/-/fresh-0.5.2.tgz",
@@ -27397,7 +27589,6 @@
       "version": "6.0.1",
       "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-6.0.1.tgz",
       "integrity": "sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg==",
-      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=10"
@@ -27620,13 +27811,6 @@
       "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==",
       "dev": true
     },
-    "node_modules/graphemer": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/graphemer/-/graphemer-1.4.0.tgz",
-      "integrity": "sha512-EtKwoO6kxCL9WO5xipiHTZlSzBm7WLT627TqC/uVRd0HKmq8NXyebnNYxDoBi7wt8eTWrUrKXCOVaFq9x1kgag==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/gtoken": {
       "version": "7.1.0",
       "resolved": "https://registry.npmjs.org/gtoken/-/gtoken-7.1.0.tgz",
@@ -28082,14 +28266,21 @@
       "integrity": "sha512-24e6ynE2H+OKt4kqsOvNd8kBpV65zoxbA4BVsEOB3ARVWQki/DHzaUoC5KuON/BiccDaCCTZBuOcfZs70kR8bQ=="
     },
     "node_modules/hono": {
-      "version": "4.12.18",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.18.tgz",
-      "integrity": "sha512-RWzP96k/yv0PQfyXnWjs6zot20TqfpfsNXhOnev8d1InAxubW93L11/oNUc3tQqn2G0bSdAOBpX+2uDFHV7kdQ==",
+      "version": "4.12.23",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.23.tgz",
+      "integrity": "sha512-eIaZ9qDgu7XV0pxOCrg7/WhnQ6Ivm22UcxhXx/A3dcbqbbYgBEkc6e/J/s7j2tS96zoB0S9VBdLwQNCWwUo4LA==",
       "license": "MIT",
       "engines": {
         "node": ">=16.9.0"
       }
     },
+    "node_modules/hookable": {
+      "version": "6.1.1",
+      "resolved": "https://registry.npmjs.org/hookable/-/hookable-6.1.1.tgz",
+      "integrity": "sha512-U9LYDy1CwhMCnprUfeAZWZGByVbhd54hwepegYTK7Pi5NvqEj63ifz5z+xukznehT7i6NIZRu89Ay1AZmRsLEQ==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/hookified": {
       "version": "1.12.1",
       "resolved": "https://registry.npmjs.org/hookified/-/hookified-1.12.1.tgz",
@@ -28474,6 +28665,19 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/import-without-cache": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/import-without-cache/-/import-without-cache-0.4.0.tgz",
+      "integrity": "sha512-NkJQA7oZ4YHQhd2+H3BoRFKF3d/XNsiKpHZCQEMH9pDX27hQQLsTyOocyRgaIVtf8gHX3Nt3LPkR4e5EdtPAGQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^22.18.0 || >=24.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sxzz"
+      }
+    },
     "node_modules/imurmurhash": {
       "version": "0.1.4",
       "resolved": "https://registry.npmjs.org/imurmurhash/-/imurmurhash-0.1.4.tgz",
@@ -29474,27 +29678,33 @@
       }
     },
     "node_modules/jest-junit": {
-      "version": "16.0.0",
-      "resolved": "https://registry.npmjs.org/jest-junit/-/jest-junit-16.0.0.tgz",
-      "integrity": "sha512-A94mmw6NfJab4Fg/BlvVOUXzXgF0XIH6EmTgJ5NDPp4xoKq0Kr7sErb+4Xs9nZvu58pJojz5RFGpqnZYJTrRfQ==",
+      "version": "17.0.0",
+      "resolved": "https://registry.npmjs.org/jest-junit/-/jest-junit-17.0.0.tgz",
+      "integrity": "sha512-RYWCkq4j59gUXj5DsgbIE7xFBZzu1gtibPhyjSjMmGaOTLnqlXhg7x9zuGCwgbCuMAyoyvk0Mi8wSrRR5uOeLA==",
       "dev": true,
+      "license": "Apache-2.0",
       "dependencies": {
         "mkdirp": "^1.0.4",
         "strip-ansi": "^6.0.1",
-        "uuid": "^8.3.2",
+        "uuid": "^14.0.0",
         "xml": "^1.0.1"
       },
       "engines": {
-        "node": ">=10.12.0"
+        "node": ">=20.0.0"
       }
     },
     "node_modules/jest-junit/node_modules/uuid": {
-      "version": "8.3.2",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz",
-      "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==",
+      "version": "14.0.0",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-14.0.0.tgz",
+      "integrity": "sha512-Qo+uWgilfSmAhXCMav1uYFynlQO7fMFiMVZsQqZRMIXp0O7rR7qjkj+cPvBHLgBqi960QCoo/PH2/6ZtVqKvrg==",
       "dev": true,
+      "funding": [
+        "https://github.com/sponsors/broofa",
+        "https://github.com/sponsors/ctavan"
+      ],
+      "license": "MIT",
       "bin": {
-        "uuid": "dist/bin/uuid"
+        "uuid": "dist-node/bin/uuid"
       }
     },
     "node_modules/jest-matcher-utils": {
@@ -34107,18 +34317,18 @@
       }
     },
     "node_modules/motion-dom": {
-      "version": "11.18.1",
-      "resolved": "https://registry.npmjs.org/motion-dom/-/motion-dom-11.18.1.tgz",
-      "integrity": "sha512-g76KvA001z+atjfxczdRtw/RXOM3OMSdd1f4DL77qCTF/+avrRJiawSG4yDibEQ215sr9kpinSlX2pCTJ9zbhw==",
+      "version": "12.40.0",
+      "resolved": "https://registry.npmjs.org/motion-dom/-/motion-dom-12.40.0.tgz",
+      "integrity": "sha512-HxU3ZaBwNPVQUBQf1xxgq+7JrPNZvjLVxgbpEZL7RrWJnsxOf0/OM+yrHG9ogLQ31Do/r57Oz2gQWPK+6q62mg==",
       "license": "MIT",
       "dependencies": {
-        "motion-utils": "^11.18.1"
+        "motion-utils": "^12.39.0"
       }
     },
     "node_modules/motion-utils": {
-      "version": "11.18.1",
-      "resolved": "https://registry.npmjs.org/motion-utils/-/motion-utils-11.18.1.tgz",
-      "integrity": "sha512-49Kt+HKjtbJKLtgO/LKj9Ld+6vw9BjH5d9sc40R/kVyH8GLAXgT42M2NnuPcJNuA3s9ZfZBUcwIgpmZWGEE+hA==",
+      "version": "12.39.0",
+      "resolved": "https://registry.npmjs.org/motion-utils/-/motion-utils-12.39.0.tgz",
+      "integrity": "sha512-8nadJAJjTtqRkmRF36FoJTrywK9nnFmnPwnSMyxaOCU7GDjN9RTMJIxx9De8ErM+vpPhMccr/6fo5WciyQLnMQ==",
       "license": "MIT"
     },
     "node_modules/mpath": {
@@ -34706,6 +34916,20 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/obug": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/obug/-/obug-2.1.2.tgz",
+      "integrity": "sha512-AWGB9WFcRXOQs48Z/udjI5ZcZMHXwX8XPByNpOydgcGsDLIzjGizhoMWJyKAWze7AVW/2W1i+/gPX4YtKe5cyg==",
+      "dev": true,
+      "funding": [
+        "https://github.com/sponsors/sxzz",
+        "https://opencollective.com/debug"
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.20.0"
+      }
+    },
     "node_modules/okapibm25": {
       "version": "1.4.1",
       "resolved": "https://registry.npmjs.org/okapibm25/-/okapibm25-1.4.1.tgz",
@@ -37529,6 +37753,23 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/quansync": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/quansync/-/quansync-1.0.0.tgz",
+      "integrity": "sha512-5xZacEEufv3HSTPQuchrvV6soaiACMFnq1H8wkVioctoH3TRha9Sz66lOxRwPK/qZj7HPiSveih9yAyh98gvqA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://github.com/sponsors/antfu"
+        },
+        {
+          "type": "individual",
+          "url": "https://github.com/sponsors/sxzz"
+        }
+      ],
+      "license": "MIT"
+    },
     "node_modules/querystring-es3": {
       "version": "0.2.1",
       "resolved": "https://registry.npmjs.org/querystring-es3/-/querystring-es3-0.2.1.tgz",
@@ -38052,12 +38293,12 @@
       }
     },
     "node_modules/react-router": {
-      "version": "6.30.3",
-      "resolved": "https://registry.npmjs.org/react-router/-/react-router-6.30.3.tgz",
-      "integrity": "sha512-XRnlbKMTmktBkjCLE8/XcZFlnHvr2Ltdr1eJX4idL55/9BbORzyZEaIkBFDhFGCEWBBItsVrDxwx3gnisMitdw==",
+      "version": "6.30.4",
+      "resolved": "https://registry.npmjs.org/react-router/-/react-router-6.30.4.tgz",
+      "integrity": "sha512-SVUsDe+DybHM/WmYKIVYhZh1o5Dcuf16yM6WjG02Q9XVFMZIJyHYhwrr6bFBXZkVP6z69kNkMyBCujt8FaFLJA==",
       "license": "MIT",
       "dependencies": {
-        "@remix-run/router": "1.23.2"
+        "@remix-run/router": "1.23.3"
       },
       "engines": {
         "node": ">=14.0.0"
@@ -38067,13 +38308,13 @@
       }
     },
     "node_modules/react-router-dom": {
-      "version": "6.30.3",
-      "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-6.30.3.tgz",
-      "integrity": "sha512-pxPcv1AczD4vso7G4Z3TKcvlxK7g7TNt3/FNGMhfqyntocvYKj+GCatfigGDjbLozC4baguJ0ReCigoDJXb0ag==",
+      "version": "6.30.4",
+      "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-6.30.4.tgz",
+      "integrity": "sha512-q4HvNl+mmDdkS0g+MqiBZNteQJCuimWoOyHMy4T/RQLAn9Z29+E91QXRaxOujeMl2HTzRSS0KFPd7lxX3PjV0Q==",
       "license": "MIT",
       "dependencies": {
-        "@remix-run/router": "1.23.2",
-        "react-router": "6.30.3"
+        "@remix-run/router": "1.23.3",
+        "react-router": "6.30.4"
       },
       "engines": {
         "node": ">=14.0.0"
@@ -39773,9 +40014,9 @@
       "license": "MIT"
     },
     "node_modules/semver": {
-      "version": "7.7.3",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.3.tgz",
-      "integrity": "sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q==",
+      "version": "7.8.2",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.2.tgz",
+      "integrity": "sha512-c8jsqUZm3omBOI66G90z1Dyw5z622G8oLG+omfsHBJf3CWQTlOcwOjvOG6wtiNfW6anKm/eA39LMwMtMez2TiQ==",
       "license": "ISC",
       "bin": {
         "semver": "bin/semver.js"
@@ -41367,9 +41608,9 @@
       "license": "MIT"
     },
     "node_modules/tinyexec": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.0.2.tgz",
-      "integrity": "sha512-W/KYk+NFhkmsYpuHq5JykngiOCnxeVL8v8dFnqxSD8qEEdRfXk1SDM6JzNqcERbcGYj9tMrDQBYV9cjgnunFIg==",
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.2.4.tgz",
+      "integrity": "sha512-SHf/r48b7vOrjve9PxJo3MN5v5yuyjHvdUcrQffT3WXMUfnGmHDVbC4k3sHJaJTgZCwpUplIaAo5ANtMyp3YHg==",
       "license": "MIT",
       "engines": {
         "node": ">=18"
@@ -41525,15 +41766,14 @@
         "node": ">=18"
       }
     },
-    "node_modules/traverse": {
-      "version": "0.6.8",
-      "resolved": "https://registry.npmjs.org/traverse/-/traverse-0.6.8.tgz",
-      "integrity": "sha512-aXJDbk6SnumuaZSANd21XAo15ucCDE38H4fkqiGsc3MhCK+wOlZvLP9cB/TvpHT0mOyWgC4Z8EwRlzqYSUzdsA==",
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
+    "node_modules/tree-kill": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/tree-kill/-/tree-kill-1.2.2.tgz",
+      "integrity": "sha512-L0Orpi8qGpRG//Nd+H90vFB+3iHnue1zSSGmNOOCh1GLJ7rUKVwV2HvijphGQS2UmhUZewS9VgvxYIdgr+fG1A==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "tree-kill": "cli.js"
       }
     },
     "node_modules/trim-lines": {
@@ -41569,9 +41809,9 @@
       "license": "MIT"
     },
     "node_modules/ts-api-utils": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/ts-api-utils/-/ts-api-utils-2.0.1.tgz",
-      "integrity": "sha512-dnlgjFSVetynI8nzgJ+qF62efpglpWRk8isUEWZGWlJYySCTD6aKvbUDu+zbPeDakk3bg5H4XpitHukgfL1m9w==",
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/ts-api-utils/-/ts-api-utils-2.5.0.tgz",
+      "integrity": "sha512-OJ/ibxhPlqrMM0UiNHJ/0CKQkoKF243/AEmplt3qpRgkW8VG7IfOS41h7V8TjITqdByHzrjcS/2si+y4lIh8NA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -41700,21 +41940,21 @@
       "license": "MIT"
     },
     "node_modules/turbo": {
-      "version": "2.9.14",
-      "resolved": "https://registry.npmjs.org/turbo/-/turbo-2.9.14.tgz",
-      "integrity": "sha512-BQqXRr4UoWI3UPFrtznCLykYHxwxWh53iCB57x092jPMjIlW1wnm3N895g5irpiXmnxUhREBB0n6+y8BHhs4nw==",
+      "version": "2.9.17",
+      "resolved": "https://registry.npmjs.org/turbo/-/turbo-2.9.17.tgz",
+      "integrity": "sha512-91Q3KxfHJn7esFu2Ic6j9pkvQqWjncQCOp7r1gCKChRSb/+T/yIjsavAmbGLmFRKAzSjmWW/FMrcknmJ4hEOPA==",
       "dev": true,
       "license": "MIT",
       "bin": {
         "turbo": "bin/turbo"
       },
       "optionalDependencies": {
-        "@turbo/darwin-64": "2.9.14",
-        "@turbo/darwin-arm64": "2.9.14",
-        "@turbo/linux-64": "2.9.14",
-        "@turbo/linux-arm64": "2.9.14",
-        "@turbo/windows-64": "2.9.14",
-        "@turbo/windows-arm64": "2.9.14"
+        "@turbo/darwin-64": "2.9.17",
+        "@turbo/darwin-arm64": "2.9.17",
+        "@turbo/linux-64": "2.9.17",
+        "@turbo/linux-arm64": "2.9.17",
+        "@turbo/windows-64": "2.9.17",
+        "@turbo/windows-arm64": "2.9.17"
       }
     },
     "node_modules/type": {
@@ -41863,10 +42103,11 @@
       "license": "MIT"
     },
     "node_modules/typescript": {
-      "version": "5.3.3",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.3.3.tgz",
-      "integrity": "sha512-pXWcraxM0uxAS+tN0AG/BF2TyqmHO014Z070UsJ+pFvYuRSq8KH8DmWpnbXe0pEPDHXZV3FcAbJkijJ5oNEnWw==",
+      "version": "5.9.3",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
+      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
       "devOptional": true,
+      "license": "Apache-2.0",
       "bin": {
         "tsc": "bin/tsc",
         "tsserver": "bin/tsserver"
@@ -41876,15 +42117,16 @@
       }
     },
     "node_modules/typescript-eslint": {
-      "version": "8.24.0",
-      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.24.0.tgz",
-      "integrity": "sha512-/lmv4366en/qbB32Vz5+kCNZEMf6xYHwh1z48suBwZvAtnXKbP+YhGe8OLE2BqC67LMqKkCNLtjejdwsdW6uOQ==",
+      "version": "8.60.1",
+      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.60.1.tgz",
+      "integrity": "sha512-6m5hkkRAp8lKvhVpcprAIn5KkehQEh+47oHH2VGnExEh7dhNxXlg6GPAOIu6TxbVQxhebrJDvjl3020ooiWCMA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/eslint-plugin": "8.24.0",
-        "@typescript-eslint/parser": "8.24.0",
-        "@typescript-eslint/utils": "8.24.0"
+        "@typescript-eslint/eslint-plugin": "8.60.1",
+        "@typescript-eslint/parser": "8.60.1",
+        "@typescript-eslint/typescript-estree": "8.60.1",
+        "@typescript-eslint/utils": "8.60.1"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -41894,8 +42136,8 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "eslint": "^8.57.0 || ^9.0.0",
-        "typescript": ">=4.8.4 <5.8.0"
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+        "typescript": ">=4.8.4 <6.1.0"
       }
     },
     "node_modules/ua-parser-js": {
@@ -41985,6 +42227,20 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/unconfig-core": {
+      "version": "7.5.0",
+      "resolved": "https://registry.npmjs.org/unconfig-core/-/unconfig-core-7.5.0.tgz",
+      "integrity": "sha512-Su3FauozOGP44ZmKdHy2oE6LPjk51M/TRRjHv2HNCWiDvfvCoxC2lno6jevMA91MYAdCdwP05QnWdWpSbncX/w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@quansync/fs": "^1.0.0",
+        "quansync": "^1.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/antfu"
+      }
+    },
     "node_modules/undefsafe": {
       "version": "2.0.5",
       "resolved": "https://registry.npmjs.org/undefsafe/-/undefsafe-2.0.5.tgz",
@@ -43962,7 +44218,7 @@
     },
     "packages/api": {
       "name": "@librechat/api",
-      "version": "1.7.31",
+      "version": "1.7.32",
       "license": "ISC",
       "devDependencies": {
         "@babel/preset-env": "^7.29.5",
@@ -43984,22 +44240,28 @@
         "@types/node-fetch": "^2.6.13",
         "@types/react": "^18.2.18",
         "@types/sanitize-html": "^2.13.0",
+        "@types/supertest": "^7.2.0",
         "@types/winston": "^2.4.4",
         "@types/yauzl": "^2.10.3",
         "aws-sdk-client-mock": "^4.1.0",
+        "dedent": "^1.5.3",
+        "get-stream": "^6.0.1",
         "jest": "^30.2.0",
-        "jest-junit": "^16.0.0",
+        "jest-junit": "^17.0.0",
         "jszip": "^3.10.1",
         "librechat-data-provider": "*",
+        "lodash": "^4.17.23",
         "mammoth": "^1.11.0",
         "mongodb": "^6.14.2",
+        "nanoid": "^3.3.7",
         "pdfjs-dist": "^5.4.624",
         "rimraf": "^6.1.3",
         "rollup": "^4.34.9",
         "rollup-plugin-peer-deps-external": "^2.2.4",
         "sanitize-html": "^2.13.0",
         "ts-node": "^10.9.2",
-        "typescript": "^5.0.4",
+        "tsdown": "^0.22.2",
+        "typescript": "^5.9.3",
         "xlsx": "https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz",
         "yauzl": "^3.2.1"
       },
@@ -44014,9 +44276,9 @@
         "@azure/identity": "^4.13.1",
         "@azure/search-documents": "^12.0.0",
         "@azure/storage-blob": "^12.30.0",
-        "@google/genai": "^2.0.1",
+        "@google/genai": "^2.8.0",
         "@keyv/redis": "^4.3.3",
-        "@librechat/agents": "^3.2.1",
+        "@librechat/agents": "^3.2.36",
         "@librechat/data-schemas": "*",
         "@modelcontextprotocol/sdk": "^1.29.0",
         "@opentelemetry/api": "^1.9.0",
@@ -44033,24 +44295,30 @@
         "ai-tokenizer": "^1.0.6",
         "axios": "^1.16.0",
         "connect-redis": "^8.1.0",
+        "dedent": "^1.5.3",
         "eventsource": "^3.0.2",
         "express": "^5.1.0",
         "express-session": "^1.18.2",
         "firebase": "^11.0.2",
         "form-data": "^4.0.4",
+        "get-stream": "^6.0.1",
         "google-auth-library": "^9.15.1",
         "https-proxy-agent": "^7.0.6",
         "ioredis": "^5.3.2",
         "js-yaml": "^4.1.1",
         "jsonwebtoken": "^9.0.0",
+        "jszip": "^3.10.1",
         "jwks-rsa": "^3.2.0",
         "keyv": "^5.3.2",
         "keyv-file": "^5.1.2",
         "librechat-data-provider": "*",
+        "lodash": "^4.17.23",
         "mammoth": "^1.11.0",
         "mathjs": "^15.2.0",
         "memorystore": "^1.6.7",
+        "mongodb": "^6.14.2",
         "mongoose": "^8.23.1",
+        "nanoid": "^3.3.7",
         "node-fetch": "2.7.0",
         "pdfjs-dist": "^5.4.624",
         "prom-client": "^15.1.3",
@@ -44062,6 +44330,74 @@
         "zod": "^3.22.4"
       }
     },
+    "packages/api/node_modules/@babel/generator": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-8.0.0-rc.6.tgz",
+      "integrity": "sha512-6mIzgVK8DgEzvIapoQwhXTMnnkuE4STQmVv9H03i/tZ2ml8oev3TRvZJgTenK2Bsq0YWNtzOrFdTyNzCMFtjJQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/parser": "^8.0.0-rc.6",
+        "@babel/types": "^8.0.0-rc.6",
+        "@jridgewell/gen-mapping": "^0.3.12",
+        "@jridgewell/trace-mapping": "^0.3.28",
+        "@types/jsesc": "^2.5.0",
+        "jsesc": "^3.0.2"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "packages/api/node_modules/@babel/helper-string-parser": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-8.0.0-rc.6.tgz",
+      "integrity": "sha512-BCkFy+zN6kXQed3YOT7aJl93NfDSzQc3pBfsvTVPs9gU9X3V0aefEF5kwBT0E+mDWH9QgKaZstYUQN9VdQZT4g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "packages/api/node_modules/@babel/helper-validator-identifier": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-8.0.0-rc.6.tgz",
+      "integrity": "sha512-nVJ+1JcCgntv8d78rRo++o2wuODT0Irknx2BF8Np4Ft2CRgjLqIs4qzSZ8b66yGbBdMWGmZBO9WEZv1hhNiSpg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "packages/api/node_modules/@babel/parser": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-8.0.0-rc.6.tgz",
+      "integrity": "sha512-rOS8IpdO7mQELkTPlCsTgPejO0bFuZdEDCGQJouYbYf9e1FLTym7Fei2pEjq8q7MWbX0ravcd7QQYKs1TxOuog==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/types": "^8.0.0-rc.6"
+      },
+      "bin": {
+        "parser": "bin/babel-parser.js"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "packages/api/node_modules/@babel/types": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-8.0.0-rc.6.tgz",
+      "integrity": "sha512-p7/ABylAYlexb31wtRdIfH9L9A0Z2T/9H6zAqzqndkY2PLkvNNc580wGhp/gGKN4Sp9sQvSkhc6Oga8/O+wTyw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-string-parser": "^8.0.0-rc.6",
+        "@babel/helper-validator-identifier": "^8.0.0-rc.6"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
     "packages/api/node_modules/@keyv/redis": {
       "version": "4.6.0",
       "resolved": "https://registry.npmjs.org/@keyv/redis/-/redis-4.6.0.tgz",
@@ -44080,6 +44416,339 @@
         "keyv": "^5.3.4"
       }
     },
+    "packages/api/node_modules/@napi-rs/wasm-runtime": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.4.tgz",
+      "integrity": "sha512-3NQNNgA1YSlJb/kMH1ildASP9HW7/7kYnRI2szWJaofaS1hWmbGI4H+d3+22aGzXXN9IJ+n+GiFVcGipJP18ow==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@tybys/wasm-util": "^0.10.1"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
+      },
+      "peerDependencies": {
+        "@emnapi/core": "^1.7.1",
+        "@emnapi/runtime": "^1.7.1"
+      }
+    },
+    "packages/api/node_modules/@oxc-project/types": {
+      "version": "0.134.0",
+      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.134.0.tgz",
+      "integrity": "sha512-T0xuRRKrQFmocH8y+jGfpmSkGcheaJExY9lEihmR1Gm2aH+75B8CzgU2rABRQSzzDxLjZ15Sc0bRVLj5lVeNXQ==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/Boshen"
+      }
+    },
+    "packages/api/node_modules/@rolldown/binding-android-arm64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.1.0.tgz",
+      "integrity": "sha512-gCYzGOSkYY6Z034suzd20euvds7lPzMEEla62DJGE/ZAlR4OMBnNbvnBSsIGUCAr52gaWMsloGxP4tVGtN5aCA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/api/node_modules/@rolldown/binding-darwin-arm64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.1.0.tgz",
+      "integrity": "sha512-JQBD77MNgu+4Z6RAyg69acugdrhhVoWesr3l47zohYZ2YV2fwkWMArkN/2p4l6Ei+Sno7W5q+UsKdVWq5Ens0w==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/api/node_modules/@rolldown/binding-darwin-x64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.1.0.tgz",
+      "integrity": "sha512-p/8cXUTK4Sob604e+xxPhVSbDFf29E6J0l/xESM9rdCfn3aDai3nEs6TnMHUsdD5aNlFz0+gDbiGlozLKGa2YA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/api/node_modules/@rolldown/binding-freebsd-x64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.1.0.tgz",
+      "integrity": "sha512-KbtOSlVv6fElujiZWMcC3aQYhEwLVVf073RcwlSmpGQvIsKZFUqc0ef4sjUuurRwfbiI6JJXji9DQn+86hawmQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/api/node_modules/@rolldown/binding-linux-arm-gnueabihf": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.1.0.tgz",
+      "integrity": "sha512-9fZ9i0o0/MQaw7om6Z6TsT7tfCk0jtbEFtC+aPqZL5RNsGWNcHvn6EHgL3dAprjq+AZzPTAQjg2JtpJaMt+6pg==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/api/node_modules/@rolldown/binding-linux-arm64-gnu": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.1.0.tgz",
+      "integrity": "sha512-+tog7T66i+yFyIuuAnjL6xmW182W/qTBOUt6BtQ6lBIM1Eikh/fSMz4HGgvuCp5uU0zuIVWng7kDYthjCMOHcg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/api/node_modules/@rolldown/binding-linux-arm64-musl": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.1.0.tgz",
+      "integrity": "sha512-4b7yruLIIj/oZ3GpcLOvxcLCLDMraohn3IhQfN2hBP4w9UekG0DTIajWguJosRGfySf/+h/NwRUiMKoCpxCrqQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/api/node_modules/@rolldown/binding-linux-ppc64-gnu": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.1.0.tgz",
+      "integrity": "sha512-QRDOVZd0bhQ5jLsUsCC3dUxDWdTSVY9WMznowZgCGOrZfLLgctWpelhUASEiBwsXfat/JwYnVd1EaxMhqyT+UQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/api/node_modules/@rolldown/binding-linux-s390x-gnu": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.1.0.tgz",
+      "integrity": "sha512-ypxT+Hq76NFG7woFbNbySnGEajFuYuIXeKz/jfCU+lXUoxfi3zLE6OG/ZQNeK3RpZSYJlAe2bokpsQ046CaieQ==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/api/node_modules/@rolldown/binding-linux-x64-gnu": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.1.0.tgz",
+      "integrity": "sha512-IdovCmfROFmpTLahdecTDFL74aLERVYN68F/mLZjfVh6LfoplPfI6deyHNMTcVujbokDV5k05XrFO22zfv+qjg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/api/node_modules/@rolldown/binding-linux-x64-musl": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.1.0.tgz",
+      "integrity": "sha512-pcA8xlFp2tyk9T2R6Fi/rPe3bQ1MA+sSMDNUU5Ogu80GHOatkE4P8YCreGAvZErm5Ho2YRXnyvNrWiRncfVysQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/api/node_modules/@rolldown/binding-openharmony-arm64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.1.0.tgz",
+      "integrity": "sha512-4+fexHayrLCWpriPh4c6dNvL4an34DEZCG7zOM/FD5QNF6h8DT+bDXzyB/kfC8lDJbaFb7jKShtnjDQFXVQEjg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/api/node_modules/@rolldown/binding-wasm32-wasi": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.1.0.tgz",
+      "integrity": "sha512-SbL++MNmOw6QamrwIGDMSSfM4ceTzFr+RjbOExJSLLBinScU4WI5OdA413h1qwPw2yH7lVF1+H4svQ+6mSXKTQ==",
+      "cpu": [
+        "wasm32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/core": "1.10.0",
+        "@emnapi/runtime": "1.10.0",
+        "@napi-rs/wasm-runtime": "^1.1.4"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/api/node_modules/@rolldown/binding-win32-arm64-msvc": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.1.0.tgz",
+      "integrity": "sha512-+xTE6XC7wBgk0VKRXGG+QAnyW5S9b8vfsFpiMjf0waQTmSQSU8onsH/beyZ8X4aXVveJnotiy7VDjLOaW8bTrg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/api/node_modules/@rolldown/binding-win32-x64-msvc": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.1.0.tgz",
+      "integrity": "sha512-Ogji1TQNqH3ACLnYr+1Ns1nyrJ0CO2P585u9Hsh02pXvtFiFpgtgT2b3P4PnCOU86VVCvqtAeCN4OftMT8KU4w==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/api/node_modules/get-tsconfig": {
+      "version": "5.0.0-beta.5",
+      "resolved": "https://registry.npmjs.org/get-tsconfig/-/get-tsconfig-5.0.0-beta.5.tgz",
+      "integrity": "sha512-/6gFNr0N04nob252sTQxyFLi3eKFRqIg1I87YcqAMT1i6SQrSF6KujUEQrtrjMV0H/eejTCltLdDSTEMzHbnsQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "resolve-pkg-maps": "^1.0.0"
+      },
+      "engines": {
+        "node": ">=20.20.0"
+      },
+      "funding": {
+        "url": "https://github.com/privatenumber/get-tsconfig?sponsor=1"
+      }
+    },
+    "packages/api/node_modules/picomatch": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
     "packages/api/node_modules/rimraf": {
       "version": "6.1.3",
       "resolved": "https://registry.npmjs.org/rimraf/-/rimraf-6.1.3.tgz",
@@ -44100,9 +44769,160 @@
         "url": "https://github.com/sponsors/isaacs"
       }
     },
+    "packages/api/node_modules/rolldown": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.1.0.tgz",
+      "integrity": "sha512-zpMvlJhs5PkXRTtKc0CaLBVI9AR/VDiJFpM+kx//hgToEca7FgMlGjaRIisXBcb19T76LswgmKECSQ96hjWr5A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@oxc-project/types": "=0.134.0",
+        "@rolldown/pluginutils": "^1.0.0"
+      },
+      "bin": {
+        "rolldown": "bin/cli.mjs"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      },
+      "optionalDependencies": {
+        "@rolldown/binding-android-arm64": "1.1.0",
+        "@rolldown/binding-darwin-arm64": "1.1.0",
+        "@rolldown/binding-darwin-x64": "1.1.0",
+        "@rolldown/binding-freebsd-x64": "1.1.0",
+        "@rolldown/binding-linux-arm-gnueabihf": "1.1.0",
+        "@rolldown/binding-linux-arm64-gnu": "1.1.0",
+        "@rolldown/binding-linux-arm64-musl": "1.1.0",
+        "@rolldown/binding-linux-ppc64-gnu": "1.1.0",
+        "@rolldown/binding-linux-s390x-gnu": "1.1.0",
+        "@rolldown/binding-linux-x64-gnu": "1.1.0",
+        "@rolldown/binding-linux-x64-musl": "1.1.0",
+        "@rolldown/binding-openharmony-arm64": "1.1.0",
+        "@rolldown/binding-wasm32-wasi": "1.1.0",
+        "@rolldown/binding-win32-arm64-msvc": "1.1.0",
+        "@rolldown/binding-win32-x64-msvc": "1.1.0"
+      }
+    },
+    "packages/api/node_modules/tsdown": {
+      "version": "0.22.2",
+      "resolved": "https://registry.npmjs.org/tsdown/-/tsdown-0.22.2.tgz",
+      "integrity": "sha512-VX9gsyKXsTnBZjnIM4jsHl9aRv+GfgkE/k1hQslilaBfZMlaw3JuGR+6yhiU0QxWBtOCDnTjwOSoXzgB7Rr50g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansis": "^4.3.1",
+        "cac": "^7.0.0",
+        "defu": "^6.1.7",
+        "empathic": "^2.0.1",
+        "hookable": "^6.1.1",
+        "import-without-cache": "^0.4.0",
+        "obug": "^2.1.1",
+        "picomatch": "^4.0.4",
+        "rolldown": "~1.1.0",
+        "rolldown-plugin-dts": "^0.25.2",
+        "semver": "^7.8.1",
+        "tinyexec": "^1.2.4",
+        "tinyglobby": "^0.2.17",
+        "tree-kill": "^1.2.2",
+        "unconfig-core": "^7.5.0"
+      },
+      "bin": {
+        "tsdown": "dist/run.mjs"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sxzz"
+      },
+      "peerDependencies": {
+        "@arethetypeswrong/core": "^0.18.1",
+        "@tsdown/css": "0.22.2",
+        "@tsdown/exe": "0.22.2",
+        "@vitejs/devtools": "*",
+        "publint": "^0.3.8",
+        "tsx": "*",
+        "typescript": "^5.0.0 || ^6.0.0",
+        "unplugin-unused": "^0.5.0",
+        "unrun": "*"
+      },
+      "peerDependenciesMeta": {
+        "@arethetypeswrong/core": {
+          "optional": true
+        },
+        "@tsdown/css": {
+          "optional": true
+        },
+        "@tsdown/exe": {
+          "optional": true
+        },
+        "@vitejs/devtools": {
+          "optional": true
+        },
+        "publint": {
+          "optional": true
+        },
+        "tsx": {
+          "optional": true
+        },
+        "typescript": {
+          "optional": true
+        },
+        "unplugin-unused": {
+          "optional": true
+        },
+        "unrun": {
+          "optional": true
+        }
+      }
+    },
+    "packages/api/node_modules/tsdown/node_modules/rolldown-plugin-dts": {
+      "version": "0.25.2",
+      "resolved": "https://registry.npmjs.org/rolldown-plugin-dts/-/rolldown-plugin-dts-0.25.2.tgz",
+      "integrity": "sha512-nMhN/R+vmR8GM45ZW1FWMSjRTSDDn/6w4GTf8RNrEFCBdl8B1kySWrU1ixPtbwzXoRlcO+R/S88VgXuJQwfdDg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/generator": "8.0.0-rc.6",
+        "@babel/helper-validator-identifier": "8.0.0-rc.6",
+        "@babel/parser": "8.0.0-rc.6",
+        "ast-kit": "^3.0.0-beta.1",
+        "birpc": "^4.0.0",
+        "dts-resolver": "^3.0.0",
+        "get-tsconfig": "5.0.0-beta.5",
+        "obug": "^2.1.1"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sxzz"
+      },
+      "peerDependencies": {
+        "@ts-macro/tsc": "^0.3.6",
+        "@typescript/native-preview": ">=7.0.0-dev.20260325.1",
+        "rolldown": "^1.0.0",
+        "typescript": "^5.0.0 || ^6.0.0",
+        "vue-tsc": "~3.2.0"
+      },
+      "peerDependenciesMeta": {
+        "@ts-macro/tsc": {
+          "optional": true
+        },
+        "@typescript/native-preview": {
+          "optional": true
+        },
+        "typescript": {
+          "optional": true
+        },
+        "vue-tsc": {
+          "optional": true
+        }
+      }
+    },
     "packages/client": {
       "name": "@librechat/client",
-      "version": "0.4.60",
+      "version": "0.4.61",
       "devDependencies": {
         "@babel/core": "^7.28.5",
         "@babel/preset-env": "^7.29.5",
@@ -44117,6 +44937,7 @@
         "@tanstack/react-virtual": "^3.13.13",
         "@testing-library/jest-dom": "^6.9.1",
         "@testing-library/react": "^14.0.0",
+        "@tsdown/css": "^0.22.2",
         "@types/jest": "^29.5.14",
         "@types/react": "^18.2.11",
         "@types/react-dom": "^18.2.4",
@@ -44139,7 +44960,8 @@
         "rollup-plugin-postcss": "^4.0.2",
         "rollup-plugin-typescript2": "^0.37.0",
         "tailwindcss-radix": "^2.8.0",
-        "typescript": "^5.0.0"
+        "tsdown": "^0.22.2",
+        "typescript": "^5.9.3"
       },
       "peerDependencies": {
         "@ariakit/react": "^0.4.16",
@@ -44172,7 +44994,7 @@
         "class-variance-authority": "^0.7.1",
         "clsx": "^2.1.1",
         "dompurify": "^3.4.0",
-        "framer-motion": "^12.23.6",
+        "framer-motion": "^12.40.0",
         "i18next": "^24.2.2 || ^25.3.2",
         "i18next-browser-languagedetector": "^8.2.0",
         "input-otp": "^1.4.2",
@@ -44197,6 +45019,88 @@
       "dev": true,
       "license": "MIT"
     },
+    "packages/client/node_modules/@babel/generator": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-8.0.0-rc.6.tgz",
+      "integrity": "sha512-6mIzgVK8DgEzvIapoQwhXTMnnkuE4STQmVv9H03i/tZ2ml8oev3TRvZJgTenK2Bsq0YWNtzOrFdTyNzCMFtjJQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/parser": "^8.0.0-rc.6",
+        "@babel/types": "^8.0.0-rc.6",
+        "@jridgewell/gen-mapping": "^0.3.12",
+        "@jridgewell/trace-mapping": "^0.3.28",
+        "@types/jsesc": "^2.5.0",
+        "jsesc": "^3.0.2"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "packages/client/node_modules/@babel/generator/node_modules/@babel/types": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-8.0.0-rc.6.tgz",
+      "integrity": "sha512-p7/ABylAYlexb31wtRdIfH9L9A0Z2T/9H6zAqzqndkY2PLkvNNc580wGhp/gGKN4Sp9sQvSkhc6Oga8/O+wTyw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-string-parser": "^8.0.0-rc.6",
+        "@babel/helper-validator-identifier": "^8.0.0-rc.6"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "packages/client/node_modules/@babel/helper-string-parser": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-8.0.0-rc.6.tgz",
+      "integrity": "sha512-BCkFy+zN6kXQed3YOT7aJl93NfDSzQc3pBfsvTVPs9gU9X3V0aefEF5kwBT0E+mDWH9QgKaZstYUQN9VdQZT4g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "packages/client/node_modules/@babel/helper-validator-identifier": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-8.0.0-rc.6.tgz",
+      "integrity": "sha512-nVJ+1JcCgntv8d78rRo++o2wuODT0Irknx2BF8Np4Ft2CRgjLqIs4qzSZ8b66yGbBdMWGmZBO9WEZv1hhNiSpg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "packages/client/node_modules/@babel/parser": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-8.0.0-rc.6.tgz",
+      "integrity": "sha512-rOS8IpdO7mQELkTPlCsTgPejO0bFuZdEDCGQJouYbYf9e1FLTym7Fei2pEjq8q7MWbX0ravcd7QQYKs1TxOuog==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/types": "^8.0.0-rc.6"
+      },
+      "bin": {
+        "parser": "bin/babel-parser.js"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "packages/client/node_modules/@babel/parser/node_modules/@babel/types": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-8.0.0-rc.6.tgz",
+      "integrity": "sha512-p7/ABylAYlexb31wtRdIfH9L9A0Z2T/9H6zAqzqndkY2PLkvNNc580wGhp/gGKN4Sp9sQvSkhc6Oga8/O+wTyw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-string-parser": "^8.0.0-rc.6",
+        "@babel/helper-validator-identifier": "^8.0.0-rc.6"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
     "packages/client/node_modules/@babel/plugin-transform-react-display-name": {
       "version": "7.28.0",
       "resolved": "https://registry.npmjs.org/@babel/plugin-transform-react-display-name/-/plugin-transform-react-display-name-7.28.0.tgz",
@@ -44287,6 +45191,310 @@
         "@babel/core": "^7.0.0-0"
       }
     },
+    "packages/client/node_modules/@napi-rs/wasm-runtime": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.4.tgz",
+      "integrity": "sha512-3NQNNgA1YSlJb/kMH1ildASP9HW7/7kYnRI2szWJaofaS1hWmbGI4H+d3+22aGzXXN9IJ+n+GiFVcGipJP18ow==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@tybys/wasm-util": "^0.10.1"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
+      },
+      "peerDependencies": {
+        "@emnapi/core": "^1.7.1",
+        "@emnapi/runtime": "^1.7.1"
+      }
+    },
+    "packages/client/node_modules/@oxc-project/types": {
+      "version": "0.134.0",
+      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.134.0.tgz",
+      "integrity": "sha512-T0xuRRKrQFmocH8y+jGfpmSkGcheaJExY9lEihmR1Gm2aH+75B8CzgU2rABRQSzzDxLjZ15Sc0bRVLj5lVeNXQ==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/Boshen"
+      }
+    },
+    "packages/client/node_modules/@rolldown/binding-android-arm64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.1.0.tgz",
+      "integrity": "sha512-gCYzGOSkYY6Z034suzd20euvds7lPzMEEla62DJGE/ZAlR4OMBnNbvnBSsIGUCAr52gaWMsloGxP4tVGtN5aCA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/client/node_modules/@rolldown/binding-darwin-arm64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.1.0.tgz",
+      "integrity": "sha512-JQBD77MNgu+4Z6RAyg69acugdrhhVoWesr3l47zohYZ2YV2fwkWMArkN/2p4l6Ei+Sno7W5q+UsKdVWq5Ens0w==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/client/node_modules/@rolldown/binding-darwin-x64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.1.0.tgz",
+      "integrity": "sha512-p/8cXUTK4Sob604e+xxPhVSbDFf29E6J0l/xESM9rdCfn3aDai3nEs6TnMHUsdD5aNlFz0+gDbiGlozLKGa2YA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/client/node_modules/@rolldown/binding-freebsd-x64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.1.0.tgz",
+      "integrity": "sha512-KbtOSlVv6fElujiZWMcC3aQYhEwLVVf073RcwlSmpGQvIsKZFUqc0ef4sjUuurRwfbiI6JJXji9DQn+86hawmQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/client/node_modules/@rolldown/binding-linux-arm-gnueabihf": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.1.0.tgz",
+      "integrity": "sha512-9fZ9i0o0/MQaw7om6Z6TsT7tfCk0jtbEFtC+aPqZL5RNsGWNcHvn6EHgL3dAprjq+AZzPTAQjg2JtpJaMt+6pg==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/client/node_modules/@rolldown/binding-linux-arm64-gnu": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.1.0.tgz",
+      "integrity": "sha512-+tog7T66i+yFyIuuAnjL6xmW182W/qTBOUt6BtQ6lBIM1Eikh/fSMz4HGgvuCp5uU0zuIVWng7kDYthjCMOHcg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/client/node_modules/@rolldown/binding-linux-arm64-musl": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.1.0.tgz",
+      "integrity": "sha512-4b7yruLIIj/oZ3GpcLOvxcLCLDMraohn3IhQfN2hBP4w9UekG0DTIajWguJosRGfySf/+h/NwRUiMKoCpxCrqQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/client/node_modules/@rolldown/binding-linux-ppc64-gnu": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.1.0.tgz",
+      "integrity": "sha512-QRDOVZd0bhQ5jLsUsCC3dUxDWdTSVY9WMznowZgCGOrZfLLgctWpelhUASEiBwsXfat/JwYnVd1EaxMhqyT+UQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/client/node_modules/@rolldown/binding-linux-s390x-gnu": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.1.0.tgz",
+      "integrity": "sha512-ypxT+Hq76NFG7woFbNbySnGEajFuYuIXeKz/jfCU+lXUoxfi3zLE6OG/ZQNeK3RpZSYJlAe2bokpsQ046CaieQ==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/client/node_modules/@rolldown/binding-linux-x64-gnu": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.1.0.tgz",
+      "integrity": "sha512-IdovCmfROFmpTLahdecTDFL74aLERVYN68F/mLZjfVh6LfoplPfI6deyHNMTcVujbokDV5k05XrFO22zfv+qjg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/client/node_modules/@rolldown/binding-linux-x64-musl": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.1.0.tgz",
+      "integrity": "sha512-pcA8xlFp2tyk9T2R6Fi/rPe3bQ1MA+sSMDNUU5Ogu80GHOatkE4P8YCreGAvZErm5Ho2YRXnyvNrWiRncfVysQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/client/node_modules/@rolldown/binding-openharmony-arm64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.1.0.tgz",
+      "integrity": "sha512-4+fexHayrLCWpriPh4c6dNvL4an34DEZCG7zOM/FD5QNF6h8DT+bDXzyB/kfC8lDJbaFb7jKShtnjDQFXVQEjg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/client/node_modules/@rolldown/binding-wasm32-wasi": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.1.0.tgz",
+      "integrity": "sha512-SbL++MNmOw6QamrwIGDMSSfM4ceTzFr+RjbOExJSLLBinScU4WI5OdA413h1qwPw2yH7lVF1+H4svQ+6mSXKTQ==",
+      "cpu": [
+        "wasm32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/core": "1.10.0",
+        "@emnapi/runtime": "1.10.0",
+        "@napi-rs/wasm-runtime": "^1.1.4"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/client/node_modules/@rolldown/binding-win32-arm64-msvc": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.1.0.tgz",
+      "integrity": "sha512-+xTE6XC7wBgk0VKRXGG+QAnyW5S9b8vfsFpiMjf0waQTmSQSU8onsH/beyZ8X4aXVveJnotiy7VDjLOaW8bTrg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/client/node_modules/@rolldown/binding-win32-x64-msvc": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.1.0.tgz",
+      "integrity": "sha512-Ogji1TQNqH3ACLnYr+1Ns1nyrJ0CO2P585u9Hsh02pXvtFiFpgtgT2b3P4PnCOU86VVCvqtAeCN4OftMT8KU4w==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
     "packages/client/node_modules/@tanstack/react-table": {
       "version": "8.21.3",
       "resolved": "https://registry.npmjs.org/@tanstack/react-table/-/react-table-8.21.3.tgz",
@@ -44427,6 +45635,49 @@
         }
       }
     },
+    "packages/client/node_modules/@tsdown/css": {
+      "version": "0.22.2",
+      "resolved": "https://registry.npmjs.org/@tsdown/css/-/css-0.22.2.tgz",
+      "integrity": "sha512-Go3Im9TaQnoX68vfU8Jv0OVzlxAkbKcAhTHBSkO0oC3ULClKcKETFqF4GN3P5Tcsu43NlyzOnob5po5zKSFNCA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "lightningcss": "^1.32.0",
+        "postcss-load-config": "^6.0.1",
+        "rolldown": "~1.1.0"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sxzz"
+      },
+      "peerDependencies": {
+        "postcss": "^8.4.0",
+        "postcss-import": "^16.0.0",
+        "postcss-modules": "^6.0.0",
+        "sass": "*",
+        "sass-embedded": "*",
+        "tsdown": "0.22.2"
+      },
+      "peerDependenciesMeta": {
+        "postcss": {
+          "optional": true
+        },
+        "postcss-import": {
+          "optional": true
+        },
+        "postcss-modules": {
+          "optional": true
+        },
+        "sass": {
+          "optional": true
+        },
+        "sass-embedded": {
+          "optional": true
+        }
+      }
+    },
     "packages/client/node_modules/@types/jest": {
       "version": "29.5.14",
       "resolved": "https://registry.npmjs.org/@types/jest/-/jest-29.5.14.tgz",
@@ -44483,6 +45734,22 @@
         "dequal": "^2.0.3"
       }
     },
+    "packages/client/node_modules/get-tsconfig": {
+      "version": "5.0.0-beta.5",
+      "resolved": "https://registry.npmjs.org/get-tsconfig/-/get-tsconfig-5.0.0-beta.5.tgz",
+      "integrity": "sha512-/6gFNr0N04nob252sTQxyFLi3eKFRqIg1I87YcqAMT1i6SQrSF6KujUEQrtrjMV0H/eejTCltLdDSTEMzHbnsQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "resolve-pkg-maps": "^1.0.0"
+      },
+      "engines": {
+        "node": ">=20.20.0"
+      },
+      "funding": {
+        "url": "https://github.com/privatenumber/get-tsconfig?sponsor=1"
+      }
+    },
     "packages/client/node_modules/i18next": {
       "version": "24.2.3",
       "resolved": "https://registry.npmjs.org/i18next/-/i18next-24.2.3.tgz",
@@ -44515,6 +45782,75 @@
         }
       }
     },
+    "packages/client/node_modules/lilconfig": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/lilconfig/-/lilconfig-3.1.3.tgz",
+      "integrity": "sha512-/vlFKAoH5Cgt3Ie+JLhRbwOsCQePABiU3tJ1egGvyQ+33R/vcwM2Zl2QR/LzjsBeItPt3oSVXapn+m4nQDvpzw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=14"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/antonk52"
+      }
+    },
+    "packages/client/node_modules/picomatch": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
+    "packages/client/node_modules/postcss-load-config": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/postcss-load-config/-/postcss-load-config-6.0.1.tgz",
+      "integrity": "sha512-oPtTM4oerL+UXmx+93ytZVN82RrlY/wPUV8IeDxFrzIjXOLF1pN+EmKPLbubvKHT2HC20xXsCAH2Z+CKV6Oz/g==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/postcss/"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "lilconfig": "^3.1.1"
+      },
+      "engines": {
+        "node": ">= 18"
+      },
+      "peerDependencies": {
+        "jiti": ">=1.21.0",
+        "postcss": ">=8.0.9",
+        "tsx": "^4.8.1",
+        "yaml": "^2.4.2"
+      },
+      "peerDependenciesMeta": {
+        "jiti": {
+          "optional": true
+        },
+        "postcss": {
+          "optional": true
+        },
+        "tsx": {
+          "optional": true
+        },
+        "yaml": {
+          "optional": true
+        }
+      }
+    },
     "packages/client/node_modules/pretty-format": {
       "version": "27.5.1",
       "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-27.5.1.tgz",
@@ -44576,9 +45912,160 @@
         "url": "https://github.com/sponsors/isaacs"
       }
     },
+    "packages/client/node_modules/rolldown": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.1.0.tgz",
+      "integrity": "sha512-zpMvlJhs5PkXRTtKc0CaLBVI9AR/VDiJFpM+kx//hgToEca7FgMlGjaRIisXBcb19T76LswgmKECSQ96hjWr5A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@oxc-project/types": "=0.134.0",
+        "@rolldown/pluginutils": "^1.0.0"
+      },
+      "bin": {
+        "rolldown": "bin/cli.mjs"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      },
+      "optionalDependencies": {
+        "@rolldown/binding-android-arm64": "1.1.0",
+        "@rolldown/binding-darwin-arm64": "1.1.0",
+        "@rolldown/binding-darwin-x64": "1.1.0",
+        "@rolldown/binding-freebsd-x64": "1.1.0",
+        "@rolldown/binding-linux-arm-gnueabihf": "1.1.0",
+        "@rolldown/binding-linux-arm64-gnu": "1.1.0",
+        "@rolldown/binding-linux-arm64-musl": "1.1.0",
+        "@rolldown/binding-linux-ppc64-gnu": "1.1.0",
+        "@rolldown/binding-linux-s390x-gnu": "1.1.0",
+        "@rolldown/binding-linux-x64-gnu": "1.1.0",
+        "@rolldown/binding-linux-x64-musl": "1.1.0",
+        "@rolldown/binding-openharmony-arm64": "1.1.0",
+        "@rolldown/binding-wasm32-wasi": "1.1.0",
+        "@rolldown/binding-win32-arm64-msvc": "1.1.0",
+        "@rolldown/binding-win32-x64-msvc": "1.1.0"
+      }
+    },
+    "packages/client/node_modules/tsdown": {
+      "version": "0.22.2",
+      "resolved": "https://registry.npmjs.org/tsdown/-/tsdown-0.22.2.tgz",
+      "integrity": "sha512-VX9gsyKXsTnBZjnIM4jsHl9aRv+GfgkE/k1hQslilaBfZMlaw3JuGR+6yhiU0QxWBtOCDnTjwOSoXzgB7Rr50g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansis": "^4.3.1",
+        "cac": "^7.0.0",
+        "defu": "^6.1.7",
+        "empathic": "^2.0.1",
+        "hookable": "^6.1.1",
+        "import-without-cache": "^0.4.0",
+        "obug": "^2.1.1",
+        "picomatch": "^4.0.4",
+        "rolldown": "~1.1.0",
+        "rolldown-plugin-dts": "^0.25.2",
+        "semver": "^7.8.1",
+        "tinyexec": "^1.2.4",
+        "tinyglobby": "^0.2.17",
+        "tree-kill": "^1.2.2",
+        "unconfig-core": "^7.5.0"
+      },
+      "bin": {
+        "tsdown": "dist/run.mjs"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sxzz"
+      },
+      "peerDependencies": {
+        "@arethetypeswrong/core": "^0.18.1",
+        "@tsdown/css": "0.22.2",
+        "@tsdown/exe": "0.22.2",
+        "@vitejs/devtools": "*",
+        "publint": "^0.3.8",
+        "tsx": "*",
+        "typescript": "^5.0.0 || ^6.0.0",
+        "unplugin-unused": "^0.5.0",
+        "unrun": "*"
+      },
+      "peerDependenciesMeta": {
+        "@arethetypeswrong/core": {
+          "optional": true
+        },
+        "@tsdown/css": {
+          "optional": true
+        },
+        "@tsdown/exe": {
+          "optional": true
+        },
+        "@vitejs/devtools": {
+          "optional": true
+        },
+        "publint": {
+          "optional": true
+        },
+        "tsx": {
+          "optional": true
+        },
+        "typescript": {
+          "optional": true
+        },
+        "unplugin-unused": {
+          "optional": true
+        },
+        "unrun": {
+          "optional": true
+        }
+      }
+    },
+    "packages/client/node_modules/tsdown/node_modules/rolldown-plugin-dts": {
+      "version": "0.25.2",
+      "resolved": "https://registry.npmjs.org/rolldown-plugin-dts/-/rolldown-plugin-dts-0.25.2.tgz",
+      "integrity": "sha512-nMhN/R+vmR8GM45ZW1FWMSjRTSDDn/6w4GTf8RNrEFCBdl8B1kySWrU1ixPtbwzXoRlcO+R/S88VgXuJQwfdDg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/generator": "8.0.0-rc.6",
+        "@babel/helper-validator-identifier": "8.0.0-rc.6",
+        "@babel/parser": "8.0.0-rc.6",
+        "ast-kit": "^3.0.0-beta.1",
+        "birpc": "^4.0.0",
+        "dts-resolver": "^3.0.0",
+        "get-tsconfig": "5.0.0-beta.5",
+        "obug": "^2.1.1"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sxzz"
+      },
+      "peerDependencies": {
+        "@ts-macro/tsc": "^0.3.6",
+        "@typescript/native-preview": ">=7.0.0-dev.20260325.1",
+        "rolldown": "^1.0.0",
+        "typescript": "^5.0.0 || ^6.0.0",
+        "vue-tsc": "~3.2.0"
+      },
+      "peerDependenciesMeta": {
+        "@ts-macro/tsc": {
+          "optional": true
+        },
+        "@typescript/native-preview": {
+          "optional": true
+        },
+        "typescript": {
+          "optional": true
+        },
+        "vue-tsc": {
+          "optional": true
+        }
+      }
+    },
     "packages/data-provider": {
       "name": "librechat-data-provider",
-      "version": "0.8.503",
+      "version": "0.8.505",
       "license": "ISC",
       "dependencies": {
         "axios": "^1.16.0",
@@ -44595,53 +46082,603 @@
         "@rollup/plugin-json": "^6.1.0",
         "@rollup/plugin-node-resolve": "^15.1.0",
         "@rollup/plugin-replace": "^5.0.5",
-        "@rollup/plugin-terser": "^1.0.0",
         "@types/jest": "^29.5.2",
         "@types/js-yaml": "^4.0.9",
         "@types/node": "^24.12.4",
         "@types/react": "^18.2.18",
         "@types/winston": "^2.4.4",
         "jest": "^30.2.0",
-        "jest-junit": "^16.0.0",
+        "jest-junit": "^17.0.0",
         "openapi-types": "^12.1.3",
         "rimraf": "^6.1.3",
         "rollup": "^4.34.9",
-        "rollup-plugin-peer-deps-external": "^2.2.4",
-        "rollup-plugin-typescript2": "^0.37.0",
-        "typescript": "^5.0.4"
+        "tsdown": "^0.22.2",
+        "typescript": "^5.9.3"
       },
       "peerDependencies": {
         "@tanstack/react-query": "^4.28.0"
       }
     },
-    "packages/data-provider/node_modules/rimraf": {
-      "version": "6.1.3",
-      "resolved": "https://registry.npmjs.org/rimraf/-/rimraf-6.1.3.tgz",
-      "integrity": "sha512-LKg+Cr2ZF61fkcaK1UdkH2yEBBKnYjTyWzTJT6KNPcSPaiT7HSdhtMXQuN5wkTX0Xu72KQ1l8S42rlmexS2hSA==",
+    "packages/data-provider/node_modules/@babel/generator": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-8.0.0-rc.6.tgz",
+      "integrity": "sha512-6mIzgVK8DgEzvIapoQwhXTMnnkuE4STQmVv9H03i/tZ2ml8oev3TRvZJgTenK2Bsq0YWNtzOrFdTyNzCMFtjJQ==",
       "dev": true,
-      "license": "BlueOak-1.0.0",
+      "license": "MIT",
       "dependencies": {
-        "glob": "^13.0.3",
-        "package-json-from-dist": "^1.0.1"
+        "@babel/parser": "^8.0.0-rc.6",
+        "@babel/types": "^8.0.0-rc.6",
+        "@jridgewell/gen-mapping": "^0.3.12",
+        "@jridgewell/trace-mapping": "^0.3.28",
+        "@types/jsesc": "^2.5.0",
+        "jsesc": "^3.0.2"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "packages/data-provider/node_modules/@babel/helper-string-parser": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-8.0.0-rc.6.tgz",
+      "integrity": "sha512-BCkFy+zN6kXQed3YOT7aJl93NfDSzQc3pBfsvTVPs9gU9X3V0aefEF5kwBT0E+mDWH9QgKaZstYUQN9VdQZT4g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "packages/data-provider/node_modules/@babel/helper-validator-identifier": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-8.0.0-rc.6.tgz",
+      "integrity": "sha512-nVJ+1JcCgntv8d78rRo++o2wuODT0Irknx2BF8Np4Ft2CRgjLqIs4qzSZ8b66yGbBdMWGmZBO9WEZv1hhNiSpg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "packages/data-provider/node_modules/@babel/parser": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-8.0.0-rc.6.tgz",
+      "integrity": "sha512-rOS8IpdO7mQELkTPlCsTgPejO0bFuZdEDCGQJouYbYf9e1FLTym7Fei2pEjq8q7MWbX0ravcd7QQYKs1TxOuog==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/types": "^8.0.0-rc.6"
       },
       "bin": {
-        "rimraf": "dist/esm/bin.mjs"
+        "parser": "bin/babel-parser.js"
       },
       "engines": {
-        "node": "20 || >=22"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
+        "node": "^22.18.0 || >=24.11.0"
       }
     },
-    "packages/data-schemas": {
-      "name": "@librechat/data-schemas",
-      "version": "0.0.52",
+    "packages/data-provider/node_modules/@babel/types": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-8.0.0-rc.6.tgz",
+      "integrity": "sha512-p7/ABylAYlexb31wtRdIfH9L9A0Z2T/9H6zAqzqndkY2PLkvNNc580wGhp/gGKN4Sp9sQvSkhc6Oga8/O+wTyw==",
+      "dev": true,
       "license": "MIT",
-      "devDependencies": {
-        "@rollup/plugin-alias": "^5.1.0",
-        "@rollup/plugin-commonjs": "^29.0.0",
-        "@rollup/plugin-json": "^6.1.0",
+      "dependencies": {
+        "@babel/helper-string-parser": "^8.0.0-rc.6",
+        "@babel/helper-validator-identifier": "^8.0.0-rc.6"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "packages/data-provider/node_modules/@napi-rs/wasm-runtime": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.4.tgz",
+      "integrity": "sha512-3NQNNgA1YSlJb/kMH1ildASP9HW7/7kYnRI2szWJaofaS1hWmbGI4H+d3+22aGzXXN9IJ+n+GiFVcGipJP18ow==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@tybys/wasm-util": "^0.10.1"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
+      },
+      "peerDependencies": {
+        "@emnapi/core": "^1.7.1",
+        "@emnapi/runtime": "^1.7.1"
+      }
+    },
+    "packages/data-provider/node_modules/@oxc-project/types": {
+      "version": "0.134.0",
+      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.134.0.tgz",
+      "integrity": "sha512-T0xuRRKrQFmocH8y+jGfpmSkGcheaJExY9lEihmR1Gm2aH+75B8CzgU2rABRQSzzDxLjZ15Sc0bRVLj5lVeNXQ==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/Boshen"
+      }
+    },
+    "packages/data-provider/node_modules/@rolldown/binding-android-arm64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.1.0.tgz",
+      "integrity": "sha512-gCYzGOSkYY6Z034suzd20euvds7lPzMEEla62DJGE/ZAlR4OMBnNbvnBSsIGUCAr52gaWMsloGxP4tVGtN5aCA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-provider/node_modules/@rolldown/binding-darwin-arm64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.1.0.tgz",
+      "integrity": "sha512-JQBD77MNgu+4Z6RAyg69acugdrhhVoWesr3l47zohYZ2YV2fwkWMArkN/2p4l6Ei+Sno7W5q+UsKdVWq5Ens0w==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-provider/node_modules/@rolldown/binding-darwin-x64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.1.0.tgz",
+      "integrity": "sha512-p/8cXUTK4Sob604e+xxPhVSbDFf29E6J0l/xESM9rdCfn3aDai3nEs6TnMHUsdD5aNlFz0+gDbiGlozLKGa2YA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-provider/node_modules/@rolldown/binding-freebsd-x64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.1.0.tgz",
+      "integrity": "sha512-KbtOSlVv6fElujiZWMcC3aQYhEwLVVf073RcwlSmpGQvIsKZFUqc0ef4sjUuurRwfbiI6JJXji9DQn+86hawmQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-provider/node_modules/@rolldown/binding-linux-arm-gnueabihf": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.1.0.tgz",
+      "integrity": "sha512-9fZ9i0o0/MQaw7om6Z6TsT7tfCk0jtbEFtC+aPqZL5RNsGWNcHvn6EHgL3dAprjq+AZzPTAQjg2JtpJaMt+6pg==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-provider/node_modules/@rolldown/binding-linux-arm64-gnu": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.1.0.tgz",
+      "integrity": "sha512-+tog7T66i+yFyIuuAnjL6xmW182W/qTBOUt6BtQ6lBIM1Eikh/fSMz4HGgvuCp5uU0zuIVWng7kDYthjCMOHcg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-provider/node_modules/@rolldown/binding-linux-arm64-musl": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.1.0.tgz",
+      "integrity": "sha512-4b7yruLIIj/oZ3GpcLOvxcLCLDMraohn3IhQfN2hBP4w9UekG0DTIajWguJosRGfySf/+h/NwRUiMKoCpxCrqQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-provider/node_modules/@rolldown/binding-linux-ppc64-gnu": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.1.0.tgz",
+      "integrity": "sha512-QRDOVZd0bhQ5jLsUsCC3dUxDWdTSVY9WMznowZgCGOrZfLLgctWpelhUASEiBwsXfat/JwYnVd1EaxMhqyT+UQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-provider/node_modules/@rolldown/binding-linux-s390x-gnu": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.1.0.tgz",
+      "integrity": "sha512-ypxT+Hq76NFG7woFbNbySnGEajFuYuIXeKz/jfCU+lXUoxfi3zLE6OG/ZQNeK3RpZSYJlAe2bokpsQ046CaieQ==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-provider/node_modules/@rolldown/binding-linux-x64-gnu": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.1.0.tgz",
+      "integrity": "sha512-IdovCmfROFmpTLahdecTDFL74aLERVYN68F/mLZjfVh6LfoplPfI6deyHNMTcVujbokDV5k05XrFO22zfv+qjg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-provider/node_modules/@rolldown/binding-linux-x64-musl": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.1.0.tgz",
+      "integrity": "sha512-pcA8xlFp2tyk9T2R6Fi/rPe3bQ1MA+sSMDNUU5Ogu80GHOatkE4P8YCreGAvZErm5Ho2YRXnyvNrWiRncfVysQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-provider/node_modules/@rolldown/binding-openharmony-arm64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.1.0.tgz",
+      "integrity": "sha512-4+fexHayrLCWpriPh4c6dNvL4an34DEZCG7zOM/FD5QNF6h8DT+bDXzyB/kfC8lDJbaFb7jKShtnjDQFXVQEjg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-provider/node_modules/@rolldown/binding-wasm32-wasi": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.1.0.tgz",
+      "integrity": "sha512-SbL++MNmOw6QamrwIGDMSSfM4ceTzFr+RjbOExJSLLBinScU4WI5OdA413h1qwPw2yH7lVF1+H4svQ+6mSXKTQ==",
+      "cpu": [
+        "wasm32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/core": "1.10.0",
+        "@emnapi/runtime": "1.10.0",
+        "@napi-rs/wasm-runtime": "^1.1.4"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-provider/node_modules/@rolldown/binding-win32-arm64-msvc": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.1.0.tgz",
+      "integrity": "sha512-+xTE6XC7wBgk0VKRXGG+QAnyW5S9b8vfsFpiMjf0waQTmSQSU8onsH/beyZ8X4aXVveJnotiy7VDjLOaW8bTrg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-provider/node_modules/@rolldown/binding-win32-x64-msvc": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.1.0.tgz",
+      "integrity": "sha512-Ogji1TQNqH3ACLnYr+1Ns1nyrJ0CO2P585u9Hsh02pXvtFiFpgtgT2b3P4PnCOU86VVCvqtAeCN4OftMT8KU4w==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-provider/node_modules/get-tsconfig": {
+      "version": "5.0.0-beta.5",
+      "resolved": "https://registry.npmjs.org/get-tsconfig/-/get-tsconfig-5.0.0-beta.5.tgz",
+      "integrity": "sha512-/6gFNr0N04nob252sTQxyFLi3eKFRqIg1I87YcqAMT1i6SQrSF6KujUEQrtrjMV0H/eejTCltLdDSTEMzHbnsQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "resolve-pkg-maps": "^1.0.0"
+      },
+      "engines": {
+        "node": ">=20.20.0"
+      },
+      "funding": {
+        "url": "https://github.com/privatenumber/get-tsconfig?sponsor=1"
+      }
+    },
+    "packages/data-provider/node_modules/picomatch": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
+    "packages/data-provider/node_modules/rimraf": {
+      "version": "6.1.3",
+      "resolved": "https://registry.npmjs.org/rimraf/-/rimraf-6.1.3.tgz",
+      "integrity": "sha512-LKg+Cr2ZF61fkcaK1UdkH2yEBBKnYjTyWzTJT6KNPcSPaiT7HSdhtMXQuN5wkTX0Xu72KQ1l8S42rlmexS2hSA==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "glob": "^13.0.3",
+        "package-json-from-dist": "^1.0.1"
+      },
+      "bin": {
+        "rimraf": "dist/esm/bin.mjs"
+      },
+      "engines": {
+        "node": "20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "packages/data-provider/node_modules/rolldown": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.1.0.tgz",
+      "integrity": "sha512-zpMvlJhs5PkXRTtKc0CaLBVI9AR/VDiJFpM+kx//hgToEca7FgMlGjaRIisXBcb19T76LswgmKECSQ96hjWr5A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@oxc-project/types": "=0.134.0",
+        "@rolldown/pluginutils": "^1.0.0"
+      },
+      "bin": {
+        "rolldown": "bin/cli.mjs"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      },
+      "optionalDependencies": {
+        "@rolldown/binding-android-arm64": "1.1.0",
+        "@rolldown/binding-darwin-arm64": "1.1.0",
+        "@rolldown/binding-darwin-x64": "1.1.0",
+        "@rolldown/binding-freebsd-x64": "1.1.0",
+        "@rolldown/binding-linux-arm-gnueabihf": "1.1.0",
+        "@rolldown/binding-linux-arm64-gnu": "1.1.0",
+        "@rolldown/binding-linux-arm64-musl": "1.1.0",
+        "@rolldown/binding-linux-ppc64-gnu": "1.1.0",
+        "@rolldown/binding-linux-s390x-gnu": "1.1.0",
+        "@rolldown/binding-linux-x64-gnu": "1.1.0",
+        "@rolldown/binding-linux-x64-musl": "1.1.0",
+        "@rolldown/binding-openharmony-arm64": "1.1.0",
+        "@rolldown/binding-wasm32-wasi": "1.1.0",
+        "@rolldown/binding-win32-arm64-msvc": "1.1.0",
+        "@rolldown/binding-win32-x64-msvc": "1.1.0"
+      }
+    },
+    "packages/data-provider/node_modules/tsdown": {
+      "version": "0.22.2",
+      "resolved": "https://registry.npmjs.org/tsdown/-/tsdown-0.22.2.tgz",
+      "integrity": "sha512-VX9gsyKXsTnBZjnIM4jsHl9aRv+GfgkE/k1hQslilaBfZMlaw3JuGR+6yhiU0QxWBtOCDnTjwOSoXzgB7Rr50g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansis": "^4.3.1",
+        "cac": "^7.0.0",
+        "defu": "^6.1.7",
+        "empathic": "^2.0.1",
+        "hookable": "^6.1.1",
+        "import-without-cache": "^0.4.0",
+        "obug": "^2.1.1",
+        "picomatch": "^4.0.4",
+        "rolldown": "~1.1.0",
+        "rolldown-plugin-dts": "^0.25.2",
+        "semver": "^7.8.1",
+        "tinyexec": "^1.2.4",
+        "tinyglobby": "^0.2.17",
+        "tree-kill": "^1.2.2",
+        "unconfig-core": "^7.5.0"
+      },
+      "bin": {
+        "tsdown": "dist/run.mjs"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sxzz"
+      },
+      "peerDependencies": {
+        "@arethetypeswrong/core": "^0.18.1",
+        "@tsdown/css": "0.22.2",
+        "@tsdown/exe": "0.22.2",
+        "@vitejs/devtools": "*",
+        "publint": "^0.3.8",
+        "tsx": "*",
+        "typescript": "^5.0.0 || ^6.0.0",
+        "unplugin-unused": "^0.5.0",
+        "unrun": "*"
+      },
+      "peerDependenciesMeta": {
+        "@arethetypeswrong/core": {
+          "optional": true
+        },
+        "@tsdown/css": {
+          "optional": true
+        },
+        "@tsdown/exe": {
+          "optional": true
+        },
+        "@vitejs/devtools": {
+          "optional": true
+        },
+        "publint": {
+          "optional": true
+        },
+        "tsx": {
+          "optional": true
+        },
+        "typescript": {
+          "optional": true
+        },
+        "unplugin-unused": {
+          "optional": true
+        },
+        "unrun": {
+          "optional": true
+        }
+      }
+    },
+    "packages/data-provider/node_modules/tsdown/node_modules/rolldown-plugin-dts": {
+      "version": "0.25.2",
+      "resolved": "https://registry.npmjs.org/rolldown-plugin-dts/-/rolldown-plugin-dts-0.25.2.tgz",
+      "integrity": "sha512-nMhN/R+vmR8GM45ZW1FWMSjRTSDDn/6w4GTf8RNrEFCBdl8B1kySWrU1ixPtbwzXoRlcO+R/S88VgXuJQwfdDg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/generator": "8.0.0-rc.6",
+        "@babel/helper-validator-identifier": "8.0.0-rc.6",
+        "@babel/parser": "8.0.0-rc.6",
+        "ast-kit": "^3.0.0-beta.1",
+        "birpc": "^4.0.0",
+        "dts-resolver": "^3.0.0",
+        "get-tsconfig": "5.0.0-beta.5",
+        "obug": "^2.1.1"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sxzz"
+      },
+      "peerDependencies": {
+        "@ts-macro/tsc": "^0.3.6",
+        "@typescript/native-preview": ">=7.0.0-dev.20260325.1",
+        "rolldown": "^1.0.0",
+        "typescript": "^5.0.0 || ^6.0.0",
+        "vue-tsc": "~3.2.0"
+      },
+      "peerDependenciesMeta": {
+        "@ts-macro/tsc": {
+          "optional": true
+        },
+        "@typescript/native-preview": {
+          "optional": true
+        },
+        "typescript": {
+          "optional": true
+        },
+        "vue-tsc": {
+          "optional": true
+        }
+      }
+    },
+    "packages/data-schemas": {
+      "name": "@librechat/data-schemas",
+      "version": "0.0.53",
+      "license": "MIT",
+      "devDependencies": {
+        "@rollup/plugin-alias": "^5.1.0",
+        "@rollup/plugin-commonjs": "^29.0.0",
+        "@rollup/plugin-json": "^6.1.0",
         "@rollup/plugin-node-resolve": "^15.1.0",
         "@rollup/plugin-replace": "^5.0.5",
         "@rollup/plugin-terser": "^1.0.0",
@@ -44650,14 +46687,15 @@
         "@types/jest": "^29.5.2",
         "@types/node": "^24.12.4",
         "jest": "^30.2.0",
-        "jest-junit": "^16.0.0",
+        "jest-junit": "^17.0.0",
         "mongodb-memory-server": "^11.0.1",
         "rimraf": "^6.1.3",
         "rollup": "^4.34.9",
         "rollup-plugin-peer-deps-external": "^2.2.4",
         "rollup-plugin-typescript2": "^0.37.0",
         "ts-node": "^10.9.2",
-        "typescript": "^5.0.4"
+        "tsdown": "^0.22.2",
+        "typescript": "^5.9.3"
       },
       "peerDependencies": {
         "jsonwebtoken": "^9.0.2",
@@ -44671,6 +46709,394 @@
         "winston-daily-rotate-file": "^5.0.0"
       }
     },
+    "packages/data-schemas/node_modules/@babel/generator": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-8.0.0-rc.6.tgz",
+      "integrity": "sha512-6mIzgVK8DgEzvIapoQwhXTMnnkuE4STQmVv9H03i/tZ2ml8oev3TRvZJgTenK2Bsq0YWNtzOrFdTyNzCMFtjJQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/parser": "^8.0.0-rc.6",
+        "@babel/types": "^8.0.0-rc.6",
+        "@jridgewell/gen-mapping": "^0.3.12",
+        "@jridgewell/trace-mapping": "^0.3.28",
+        "@types/jsesc": "^2.5.0",
+        "jsesc": "^3.0.2"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "packages/data-schemas/node_modules/@babel/helper-string-parser": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-8.0.0-rc.6.tgz",
+      "integrity": "sha512-BCkFy+zN6kXQed3YOT7aJl93NfDSzQc3pBfsvTVPs9gU9X3V0aefEF5kwBT0E+mDWH9QgKaZstYUQN9VdQZT4g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "packages/data-schemas/node_modules/@babel/helper-validator-identifier": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-8.0.0-rc.6.tgz",
+      "integrity": "sha512-nVJ+1JcCgntv8d78rRo++o2wuODT0Irknx2BF8Np4Ft2CRgjLqIs4qzSZ8b66yGbBdMWGmZBO9WEZv1hhNiSpg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "packages/data-schemas/node_modules/@babel/parser": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-8.0.0-rc.6.tgz",
+      "integrity": "sha512-rOS8IpdO7mQELkTPlCsTgPejO0bFuZdEDCGQJouYbYf9e1FLTym7Fei2pEjq8q7MWbX0ravcd7QQYKs1TxOuog==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/types": "^8.0.0-rc.6"
+      },
+      "bin": {
+        "parser": "bin/babel-parser.js"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "packages/data-schemas/node_modules/@babel/types": {
+      "version": "8.0.0-rc.6",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-8.0.0-rc.6.tgz",
+      "integrity": "sha512-p7/ABylAYlexb31wtRdIfH9L9A0Z2T/9H6zAqzqndkY2PLkvNNc580wGhp/gGKN4Sp9sQvSkhc6Oga8/O+wTyw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-string-parser": "^8.0.0-rc.6",
+        "@babel/helper-validator-identifier": "^8.0.0-rc.6"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.11.0"
+      }
+    },
+    "packages/data-schemas/node_modules/@napi-rs/wasm-runtime": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.4.tgz",
+      "integrity": "sha512-3NQNNgA1YSlJb/kMH1ildASP9HW7/7kYnRI2szWJaofaS1hWmbGI4H+d3+22aGzXXN9IJ+n+GiFVcGipJP18ow==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@tybys/wasm-util": "^0.10.1"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
+      },
+      "peerDependencies": {
+        "@emnapi/core": "^1.7.1",
+        "@emnapi/runtime": "^1.7.1"
+      }
+    },
+    "packages/data-schemas/node_modules/@oxc-project/types": {
+      "version": "0.134.0",
+      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.134.0.tgz",
+      "integrity": "sha512-T0xuRRKrQFmocH8y+jGfpmSkGcheaJExY9lEihmR1Gm2aH+75B8CzgU2rABRQSzzDxLjZ15Sc0bRVLj5lVeNXQ==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/Boshen"
+      }
+    },
+    "packages/data-schemas/node_modules/@rolldown/binding-android-arm64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.1.0.tgz",
+      "integrity": "sha512-gCYzGOSkYY6Z034suzd20euvds7lPzMEEla62DJGE/ZAlR4OMBnNbvnBSsIGUCAr52gaWMsloGxP4tVGtN5aCA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-schemas/node_modules/@rolldown/binding-darwin-arm64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.1.0.tgz",
+      "integrity": "sha512-JQBD77MNgu+4Z6RAyg69acugdrhhVoWesr3l47zohYZ2YV2fwkWMArkN/2p4l6Ei+Sno7W5q+UsKdVWq5Ens0w==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-schemas/node_modules/@rolldown/binding-darwin-x64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.1.0.tgz",
+      "integrity": "sha512-p/8cXUTK4Sob604e+xxPhVSbDFf29E6J0l/xESM9rdCfn3aDai3nEs6TnMHUsdD5aNlFz0+gDbiGlozLKGa2YA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-schemas/node_modules/@rolldown/binding-freebsd-x64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.1.0.tgz",
+      "integrity": "sha512-KbtOSlVv6fElujiZWMcC3aQYhEwLVVf073RcwlSmpGQvIsKZFUqc0ef4sjUuurRwfbiI6JJXji9DQn+86hawmQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-schemas/node_modules/@rolldown/binding-linux-arm-gnueabihf": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.1.0.tgz",
+      "integrity": "sha512-9fZ9i0o0/MQaw7om6Z6TsT7tfCk0jtbEFtC+aPqZL5RNsGWNcHvn6EHgL3dAprjq+AZzPTAQjg2JtpJaMt+6pg==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-schemas/node_modules/@rolldown/binding-linux-arm64-gnu": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.1.0.tgz",
+      "integrity": "sha512-+tog7T66i+yFyIuuAnjL6xmW182W/qTBOUt6BtQ6lBIM1Eikh/fSMz4HGgvuCp5uU0zuIVWng7kDYthjCMOHcg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-schemas/node_modules/@rolldown/binding-linux-arm64-musl": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.1.0.tgz",
+      "integrity": "sha512-4b7yruLIIj/oZ3GpcLOvxcLCLDMraohn3IhQfN2hBP4w9UekG0DTIajWguJosRGfySf/+h/NwRUiMKoCpxCrqQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-schemas/node_modules/@rolldown/binding-linux-ppc64-gnu": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.1.0.tgz",
+      "integrity": "sha512-QRDOVZd0bhQ5jLsUsCC3dUxDWdTSVY9WMznowZgCGOrZfLLgctWpelhUASEiBwsXfat/JwYnVd1EaxMhqyT+UQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-schemas/node_modules/@rolldown/binding-linux-s390x-gnu": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.1.0.tgz",
+      "integrity": "sha512-ypxT+Hq76NFG7woFbNbySnGEajFuYuIXeKz/jfCU+lXUoxfi3zLE6OG/ZQNeK3RpZSYJlAe2bokpsQ046CaieQ==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-schemas/node_modules/@rolldown/binding-linux-x64-gnu": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.1.0.tgz",
+      "integrity": "sha512-IdovCmfROFmpTLahdecTDFL74aLERVYN68F/mLZjfVh6LfoplPfI6deyHNMTcVujbokDV5k05XrFO22zfv+qjg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-schemas/node_modules/@rolldown/binding-linux-x64-musl": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.1.0.tgz",
+      "integrity": "sha512-pcA8xlFp2tyk9T2R6Fi/rPe3bQ1MA+sSMDNUU5Ogu80GHOatkE4P8YCreGAvZErm5Ho2YRXnyvNrWiRncfVysQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-schemas/node_modules/@rolldown/binding-openharmony-arm64": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.1.0.tgz",
+      "integrity": "sha512-4+fexHayrLCWpriPh4c6dNvL4an34DEZCG7zOM/FD5QNF6h8DT+bDXzyB/kfC8lDJbaFb7jKShtnjDQFXVQEjg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-schemas/node_modules/@rolldown/binding-wasm32-wasi": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.1.0.tgz",
+      "integrity": "sha512-SbL++MNmOw6QamrwIGDMSSfM4ceTzFr+RjbOExJSLLBinScU4WI5OdA413h1qwPw2yH7lVF1+H4svQ+6mSXKTQ==",
+      "cpu": [
+        "wasm32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/core": "1.10.0",
+        "@emnapi/runtime": "1.10.0",
+        "@napi-rs/wasm-runtime": "^1.1.4"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-schemas/node_modules/@rolldown/binding-win32-arm64-msvc": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.1.0.tgz",
+      "integrity": "sha512-+xTE6XC7wBgk0VKRXGG+QAnyW5S9b8vfsFpiMjf0waQTmSQSU8onsH/beyZ8X4aXVveJnotiy7VDjLOaW8bTrg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-schemas/node_modules/@rolldown/binding-win32-x64-msvc": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.1.0.tgz",
+      "integrity": "sha512-Ogji1TQNqH3ACLnYr+1Ns1nyrJ0CO2P585u9Hsh02pXvtFiFpgtgT2b3P4PnCOU86VVCvqtAeCN4OftMT8KU4w==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "packages/data-schemas/node_modules/get-tsconfig": {
+      "version": "5.0.0-beta.5",
+      "resolved": "https://registry.npmjs.org/get-tsconfig/-/get-tsconfig-5.0.0-beta.5.tgz",
+      "integrity": "sha512-/6gFNr0N04nob252sTQxyFLi3eKFRqIg1I87YcqAMT1i6SQrSF6KujUEQrtrjMV0H/eejTCltLdDSTEMzHbnsQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "resolve-pkg-maps": "^1.0.0"
+      },
+      "engines": {
+        "node": ">=20.20.0"
+      },
+      "funding": {
+        "url": "https://github.com/privatenumber/get-tsconfig?sponsor=1"
+      }
+    },
     "packages/data-schemas/node_modules/logform": {
       "version": "2.7.0",
       "resolved": "https://registry.npmjs.org/logform/-/logform-2.7.0.tgz",
@@ -44697,6 +47123,19 @@
         "node": ">= 6"
       }
     },
+    "packages/data-schemas/node_modules/picomatch": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
     "packages/data-schemas/node_modules/rimraf": {
       "version": "6.1.3",
       "resolved": "https://registry.npmjs.org/rimraf/-/rimraf-6.1.3.tgz",
@@ -44717,6 +47156,157 @@
         "url": "https://github.com/sponsors/isaacs"
       }
     },
+    "packages/data-schemas/node_modules/rolldown": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.1.0.tgz",
+      "integrity": "sha512-zpMvlJhs5PkXRTtKc0CaLBVI9AR/VDiJFpM+kx//hgToEca7FgMlGjaRIisXBcb19T76LswgmKECSQ96hjWr5A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@oxc-project/types": "=0.134.0",
+        "@rolldown/pluginutils": "^1.0.0"
+      },
+      "bin": {
+        "rolldown": "bin/cli.mjs"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      },
+      "optionalDependencies": {
+        "@rolldown/binding-android-arm64": "1.1.0",
+        "@rolldown/binding-darwin-arm64": "1.1.0",
+        "@rolldown/binding-darwin-x64": "1.1.0",
+        "@rolldown/binding-freebsd-x64": "1.1.0",
+        "@rolldown/binding-linux-arm-gnueabihf": "1.1.0",
+        "@rolldown/binding-linux-arm64-gnu": "1.1.0",
+        "@rolldown/binding-linux-arm64-musl": "1.1.0",
+        "@rolldown/binding-linux-ppc64-gnu": "1.1.0",
+        "@rolldown/binding-linux-s390x-gnu": "1.1.0",
+        "@rolldown/binding-linux-x64-gnu": "1.1.0",
+        "@rolldown/binding-linux-x64-musl": "1.1.0",
+        "@rolldown/binding-openharmony-arm64": "1.1.0",
+        "@rolldown/binding-wasm32-wasi": "1.1.0",
+        "@rolldown/binding-win32-arm64-msvc": "1.1.0",
+        "@rolldown/binding-win32-x64-msvc": "1.1.0"
+      }
+    },
+    "packages/data-schemas/node_modules/tsdown": {
+      "version": "0.22.2",
+      "resolved": "https://registry.npmjs.org/tsdown/-/tsdown-0.22.2.tgz",
+      "integrity": "sha512-VX9gsyKXsTnBZjnIM4jsHl9aRv+GfgkE/k1hQslilaBfZMlaw3JuGR+6yhiU0QxWBtOCDnTjwOSoXzgB7Rr50g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansis": "^4.3.1",
+        "cac": "^7.0.0",
+        "defu": "^6.1.7",
+        "empathic": "^2.0.1",
+        "hookable": "^6.1.1",
+        "import-without-cache": "^0.4.0",
+        "obug": "^2.1.1",
+        "picomatch": "^4.0.4",
+        "rolldown": "~1.1.0",
+        "rolldown-plugin-dts": "^0.25.2",
+        "semver": "^7.8.1",
+        "tinyexec": "^1.2.4",
+        "tinyglobby": "^0.2.17",
+        "tree-kill": "^1.2.2",
+        "unconfig-core": "^7.5.0"
+      },
+      "bin": {
+        "tsdown": "dist/run.mjs"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sxzz"
+      },
+      "peerDependencies": {
+        "@arethetypeswrong/core": "^0.18.1",
+        "@tsdown/css": "0.22.2",
+        "@tsdown/exe": "0.22.2",
+        "@vitejs/devtools": "*",
+        "publint": "^0.3.8",
+        "tsx": "*",
+        "typescript": "^5.0.0 || ^6.0.0",
+        "unplugin-unused": "^0.5.0",
+        "unrun": "*"
+      },
+      "peerDependenciesMeta": {
+        "@arethetypeswrong/core": {
+          "optional": true
+        },
+        "@tsdown/css": {
+          "optional": true
+        },
+        "@tsdown/exe": {
+          "optional": true
+        },
+        "@vitejs/devtools": {
+          "optional": true
+        },
+        "publint": {
+          "optional": true
+        },
+        "tsx": {
+          "optional": true
+        },
+        "typescript": {
+          "optional": true
+        },
+        "unplugin-unused": {
+          "optional": true
+        },
+        "unrun": {
+          "optional": true
+        }
+      }
+    },
+    "packages/data-schemas/node_modules/tsdown/node_modules/rolldown-plugin-dts": {
+      "version": "0.25.2",
+      "resolved": "https://registry.npmjs.org/rolldown-plugin-dts/-/rolldown-plugin-dts-0.25.2.tgz",
+      "integrity": "sha512-nMhN/R+vmR8GM45ZW1FWMSjRTSDDn/6w4GTf8RNrEFCBdl8B1kySWrU1ixPtbwzXoRlcO+R/S88VgXuJQwfdDg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/generator": "8.0.0-rc.6",
+        "@babel/helper-validator-identifier": "8.0.0-rc.6",
+        "@babel/parser": "8.0.0-rc.6",
+        "ast-kit": "^3.0.0-beta.1",
+        "birpc": "^4.0.0",
+        "dts-resolver": "^3.0.0",
+        "get-tsconfig": "5.0.0-beta.5",
+        "obug": "^2.1.1"
+      },
+      "engines": {
+        "node": "^22.18.0 || >=24.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sxzz"
+      },
+      "peerDependencies": {
+        "@ts-macro/tsc": "^0.3.6",
+        "@typescript/native-preview": ">=7.0.0-dev.20260325.1",
+        "rolldown": "^1.0.0",
+        "typescript": "^5.0.0 || ^6.0.0",
+        "vue-tsc": "~3.2.0"
+      },
+      "peerDependenciesMeta": {
+        "@ts-macro/tsc": {
+          "optional": true
+        },
+        "@typescript/native-preview": {
+          "optional": true
+        },
+        "typescript": {
+          "optional": true
+        },
+        "vue-tsc": {
+          "optional": true
+        }
+      }
+    },
     "packages/data-schemas/node_modules/winston": {
       "version": "3.17.0",
       "resolved": "https://registry.npmjs.org/winston/-/winston-3.17.0.tgz",
diff --git a/package.json b/package.json
index 4f57b426993..7f83b60f7a4 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "LibreChat",
-  "version": "v0.8.6",
+  "version": "v0.8.7-rc1",
   "description": "",
   "packageManager": "npm@11.13.0",
   "workspaces": [
@@ -59,6 +59,7 @@
     "e2e:a11y": "npm run e2e:prepare && playwright test --config=e2e/playwright.config.a11y.ts --headed",
     "e2e:ci": "npm run e2e:prepare && playwright test --config=e2e/playwright.config.ts",
     "e2e:mock": "npm run e2e:prepare && playwright test --config=e2e/playwright.config.mock.ts",
+    "e2e:mock:enforce": "npm run e2e:prepare && cross-env E2E_MODEL_SPECS_ENFORCE=true playwright test --config=e2e/playwright.config.mock.ts enforced-model-specs.spec.ts",
     "e2e:mock:ci": "npm run e2e:prepare && playwright test --config=e2e/playwright.config.mock.ts",
     "e2e:debug": "npm run e2e:prepare && cross-env PWDEBUG=1 playwright test --config=e2e/playwright.config.local.ts",
     "e2e:record": "npm run e2e:prepare && cross-env E2E_BASE_URL=http://localhost:3333 node e2e/setup/record.js",
@@ -71,11 +72,14 @@
     "test:packages:api": "cd packages/api && npm run test:ci",
     "test:packages:data-provider": "cd packages/data-provider && npm run test:ci",
     "test:packages:data-schemas": "cd packages/data-schemas && npm run test:ci",
+    "test:config": "jest --config config/jest.config.js",
     "test:all": "npm run test:client && npm run test:api && npm run test:packages:api && npm run test:packages:data-provider && npm run test:packages:data-schemas",
     "e2e:update": "npm run e2e:prepare && playwright test --config=e2e/playwright.config.local.ts --update-snapshots",
     "e2e:report": "npx playwright show-report e2e/playwright-report",
     "lint:fix": "eslint --fix \"{,!(node_modules|venv)/**/}*.{js,jsx,ts,tsx}\"",
     "lint": "eslint \"{,!(node_modules|venv)/**/}*.{js,jsx,ts,tsx}\"",
+    "sort-imports": "node scripts/sort-imports.mts",
+    "sort-imports:check": "node scripts/sort-imports.mts --check",
     "format": "npx prettier --write \"{,!(node_modules|venv)/**/}*.{js,jsx,ts,tsx}\"",
     "b:api": "NODE_ENV=production bun run api/server/index.js",
     "b:api-inspect": "NODE_ENV=production bun --inspect run api/server/index.js",
@@ -99,6 +103,9 @@
     "migrate:prompt-permissions:dry-run": "node config/migrate-prompt-permissions.js --dry-run",
     "migrate:prompt-permissions": "node config/migrate-prompt-permissions.js",
     "migrate:prompt-permissions:batch": "node config/migrate-prompt-permissions.js --batch-size=50",
+    "migrate:shared-link-permissions:dry-run": "node config/migrate-shared-link-permissions.js --dry-run",
+    "migrate:shared-link-permissions": "node config/migrate-shared-link-permissions.js",
+    "migrate:shared-link-permissions:batch": "node config/migrate-shared-link-permissions.js --batch-size=50",
     "migrate:orphaned-agent-files:dry-run": "node config/migrate-orphaned-agent-files.js --dry-run",
     "migrate:orphaned-agent-files": "node config/migrate-orphaned-agent-files.js",
     "migrate:orphaned-agent-files:batch": "node config/migrate-orphaned-agent-files.js --batch-size=50"
@@ -140,8 +147,8 @@
     "lint-staged": "^15.4.3",
     "prettier": "^3.5.0",
     "prettier-plugin-tailwindcss": "^0.6.11",
-    "turbo": "^2.9.14",
-    "typescript-eslint": "^8.24.0"
+    "turbo": "^2.9.17",
+    "typescript-eslint": "^8.60.1"
   },
   "overrides": {
     "@xmldom/xmldom": "^0.8.13",
diff --git a/packages/api/jest.config.mjs b/packages/api/jest.config.mjs
index b0029fe1a65..c49f4cc7cfa 100644
--- a/packages/api/jest.config.mjs
+++ b/packages/api/jest.config.mjs
@@ -1,3 +1,10 @@
+const esModules = [
+  '@langchain/langgraph',
+  '@langchain/langgraph-checkpoint',
+  '@langchain/langgraph-sdk',
+  'uuid',
+].join('|');
+
 export default {
   collectCoverageFrom: ['src/**/*.{js,jsx,ts,tsx}', '!<rootDir>/node_modules/'],
   coveragePathIgnorePatterns: ['/node_modules/', '/dist/'],
@@ -23,6 +30,7 @@ export default {
       },
     ],
   },
+  transformIgnorePatterns: [`/node_modules/(?!(${esModules})/).*/`],
   moduleNameMapper: {
     '^@src/(.*)$': '<rootDir>/src/$1',
     '~/(.*)': '<rootDir>/src/$1',
diff --git a/packages/api/package.json b/packages/api/package.json
index e8fe6d74adc..82e04dae289 100644
--- a/packages/api/package.json
+++ b/packages/api/package.json
@@ -1,27 +1,30 @@
 {
   "name": "@librechat/api",
-  "version": "1.7.31",
+  "version": "1.7.32",
   "type": "commonjs",
   "description": "MCP services for LibreChat",
-  "main": "dist/index.js",
-  "module": "dist/index.es.js",
-  "types": "./dist/types/index.d.ts",
+  "main": "dist/index.cjs",
+  "types": "./dist/index.d.cts",
   "exports": {
     ".": {
-      "require": "./dist/index.js",
-      "types": "./dist/types/index.d.ts"
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
     },
     "./telemetry": {
-      "require": "./dist/telemetry.js",
-      "types": "./dist/types/telemetry/index.d.ts"
+      "require": {
+        "types": "./dist/telemetry.d.cts",
+        "default": "./dist/telemetry.cjs"
+      }
     }
   },
   "scripts": {
     "clean": "rimraf dist",
-    "build": "npm run clean && rollup -c --bundleConfigAsCjs",
-    "build:dev": "npm run clean && NODE_ENV=development rollup -c --bundleConfigAsCjs",
-    "build:watch": "NODE_ENV=development rollup -c -w --bundleConfigAsCjs",
-    "build:watch:prod": "rollup -c -w --bundleConfigAsCjs",
+    "build": "npm run clean && tsdown",
+    "build:dev": "npm run clean && tsdown",
+    "build:watch": "tsdown --watch",
+    "build:watch:prod": "tsdown --watch",
     "test": "jest --coverage --watch --testPathIgnorePatterns=\"\\.*integration\\.|\\.*helper\\.|__tests__/helpers/|\\.*manual\\.spec\\.\"",
     "test:ci": "jest --coverage --ci --testPathIgnorePatterns=\"\\.*integration\\.|\\.*helper\\.|__tests__/helpers/|\\.*manual\\.spec\\.\"",
     "test:cache-integration:core": "jest --testPathPatterns=\"src/cache/.*\\.cache_integration\\.spec\\.ts$\" --coverage=false",
@@ -32,8 +35,8 @@
     "test:s3-integration": "jest --testPathPatterns=\"src/storage/s3/.*\\.integration\\.spec\\.ts$\" --coverage=false --runInBand",
     "verify": "npm run test:ci",
     "b:clean": "bun run rimraf dist",
-    "b:build": "bun run b:clean && bun run rollup -c --silent --bundleConfigAsCjs",
-    "b:build:dev": "bun run b:clean && NODE_ENV=development bun run rollup -c --silent --bundleConfigAsCjs",
+    "b:build": "bun run b:clean && bun run tsdown",
+    "b:build:dev": "bun run b:clean && bun run tsdown",
     "start:everything-sse": "node -r dotenv/config --loader ./tsconfig-paths-bootstrap.mjs --experimental-specifier-resolution=node ./src/examples/everything/sse.ts",
     "start:everything": "node -r dotenv/config --loader ./tsconfig-paths-bootstrap.mjs --experimental-specifier-resolution=node ./src/demo/everything.ts",
     "start:filesystem": "node -r dotenv/config --loader ./tsconfig-paths-bootstrap.mjs --experimental-specifier-resolution=node ./src/demo/filesystem.ts",
@@ -69,22 +72,28 @@
     "@types/node-fetch": "^2.6.13",
     "@types/react": "^18.2.18",
     "@types/sanitize-html": "^2.13.0",
+    "@types/supertest": "^7.2.0",
     "@types/winston": "^2.4.4",
     "@types/yauzl": "^2.10.3",
     "aws-sdk-client-mock": "^4.1.0",
+    "dedent": "^1.5.3",
+    "get-stream": "^6.0.1",
     "jest": "^30.2.0",
-    "jest-junit": "^16.0.0",
+    "jest-junit": "^17.0.0",
     "jszip": "^3.10.1",
     "librechat-data-provider": "*",
+    "lodash": "^4.17.23",
     "mammoth": "^1.11.0",
     "mongodb": "^6.14.2",
+    "nanoid": "^3.3.7",
     "pdfjs-dist": "^5.4.624",
     "rimraf": "^6.1.3",
     "rollup": "^4.34.9",
     "rollup-plugin-peer-deps-external": "^2.2.4",
     "sanitize-html": "^2.13.0",
     "ts-node": "^10.9.2",
-    "typescript": "^5.0.4",
+    "tsdown": "^0.22.2",
+    "typescript": "^5.9.3",
     "xlsx": "https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz",
     "yauzl": "^3.2.1"
   },
@@ -102,9 +111,9 @@
     "@azure/identity": "^4.13.1",
     "@azure/search-documents": "^12.0.0",
     "@azure/storage-blob": "^12.30.0",
-    "@google/genai": "^2.0.1",
+    "@google/genai": "^2.8.0",
     "@keyv/redis": "^4.3.3",
-    "@librechat/agents": "^3.2.1",
+    "@librechat/agents": "^3.2.36",
     "@librechat/data-schemas": "*",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@opentelemetry/api": "^1.9.0",
@@ -121,24 +130,30 @@
     "ai-tokenizer": "^1.0.6",
     "axios": "^1.16.0",
     "connect-redis": "^8.1.0",
+    "dedent": "^1.5.3",
     "eventsource": "^3.0.2",
     "express": "^5.1.0",
     "express-session": "^1.18.2",
     "firebase": "^11.0.2",
     "form-data": "^4.0.4",
+    "get-stream": "^6.0.1",
     "google-auth-library": "^9.15.1",
     "https-proxy-agent": "^7.0.6",
     "ioredis": "^5.3.2",
     "js-yaml": "^4.1.1",
     "jsonwebtoken": "^9.0.0",
+    "jszip": "^3.10.1",
     "jwks-rsa": "^3.2.0",
     "keyv": "^5.3.2",
     "keyv-file": "^5.1.2",
     "librechat-data-provider": "*",
+    "lodash": "^4.17.23",
     "mammoth": "^1.11.0",
     "mathjs": "^15.2.0",
     "memorystore": "^1.6.7",
+    "mongodb": "^6.14.2",
     "mongoose": "^8.23.1",
+    "nanoid": "^3.3.7",
     "node-fetch": "2.7.0",
     "pdfjs-dist": "^5.4.624",
     "prom-client": "^15.1.3",
diff --git a/packages/api/rollup.config.js b/packages/api/rollup.config.js
deleted file mode 100644
index becc4822916..00000000000
--- a/packages/api/rollup.config.js
+++ /dev/null
@@ -1,68 +0,0 @@
-// rollup.config.js
-import { readFileSync } from 'fs';
-import json from '@rollup/plugin-json';
-import replace from '@rollup/plugin-replace';
-import commonjs from '@rollup/plugin-commonjs';
-import resolve from '@rollup/plugin-node-resolve';
-import typescript from '@rollup/plugin-typescript';
-import peerDepsExternal from 'rollup-plugin-peer-deps-external';
-
-const pkg = JSON.parse(readFileSync(new URL('./package.json', import.meta.url), 'utf8'));
-
-/**
- * Check if we're in development mode
- */
-const isDevelopment = process.env.NODE_ENV === 'development';
-
-const plugins = [
-  peerDepsExternal(),
-  resolve({
-    preferBuiltins: true,
-    skipSelf: true,
-  }),
-  replace({
-    __IS_DEV__: isDevelopment,
-    preventAssignment: true,
-  }),
-  commonjs({
-    transformMixedEsModules: true,
-    requireReturnsDefault: 'auto',
-  }),
-  typescript({
-    tsconfig: './tsconfig.build.json',
-    outDir: './dist',
-    sourceMap: true,
-    /**
-     * Remove inline sourcemaps - they conflict with external sourcemaps
-     */
-    inlineSourceMap: false,
-    /**
-     * Always include source content in sourcemaps for better debugging
-     */
-    inlineSources: true,
-  }),
-  json(),
-];
-
-const cjsBuild = {
-  input: {
-    index: 'src/index.ts',
-    telemetry: 'src/telemetry/index.ts',
-  },
-  output: {
-    dir: 'dist',
-    format: 'cjs',
-    sourcemap: true,
-    exports: 'named',
-    entryFileNames: '[name].js',
-    /**
-     * Always include sources in sourcemap for better debugging
-     */
-    sourcemapExcludeSources: false,
-  },
-  external: [...Object.keys(pkg.dependencies || {}), ...Object.keys(pkg.devDependencies || {})],
-  preserveSymlinks: true,
-  plugins,
-};
-
-export default cjsBuild;
diff --git a/packages/api/src/acl/accessControlService.spec.ts b/packages/api/src/acl/accessControlService.spec.ts
index ad1dcf18acf..4af5fab7772 100644
--- a/packages/api/src/acl/accessControlService.spec.ts
+++ b/packages/api/src/acl/accessControlService.spec.ts
@@ -810,6 +810,66 @@ describe('AccessControlService', () => {
     });
   });
 
+  describe('hasPublicAccess', () => {
+    const publicResource = new Types.ObjectId();
+    const privateResource = new Types.ObjectId();
+
+    beforeEach(async () => {
+      await service.grantPermission({
+        principalType: PrincipalType.PUBLIC,
+        principalId: null,
+        resourceType: ResourceType.AGENT,
+        resourceId: publicResource,
+        accessRoleId: AccessRoleIds.AGENT_VIEWER,
+        grantedBy: grantedById,
+      });
+
+      await service.grantPermission({
+        principalType: PrincipalType.USER,
+        principalId: userId,
+        resourceType: ResourceType.AGENT,
+        resourceId: privateResource,
+        accessRoleId: AccessRoleIds.AGENT_OWNER,
+        grantedBy: grantedById,
+      });
+    });
+
+    test('should return true for resource with PUBLIC AclEntry', async () => {
+      const findPublicResourceIdsSpy = jest.spyOn(service['_dbMethods'], 'findPublicResourceIds');
+      const result = await service.hasPublicAccess({
+        resourceType: ResourceType.AGENT,
+        resourceId: publicResource,
+      });
+      expect(result).toBe(true);
+      expect(findPublicResourceIdsSpy).not.toHaveBeenCalled();
+      findPublicResourceIdsSpy.mockRestore();
+    });
+
+    test('should return false for resource with only user AclEntry', async () => {
+      const result = await service.hasPublicAccess({
+        resourceType: ResourceType.AGENT,
+        resourceId: privateResource,
+      });
+      expect(result).toBe(false);
+    });
+
+    test('should return false for non-existent resource', async () => {
+      const result = await service.hasPublicAccess({
+        resourceType: ResourceType.AGENT,
+        resourceId: new Types.ObjectId(),
+      });
+      expect(result).toBe(false);
+    });
+
+    test('should return false for invalid resource type', async () => {
+      const result = await service.hasPublicAccess({
+        resourceType: 'invalid' as ResourceType,
+        resourceId: publicResource,
+      });
+      expect(result).toBe(false);
+    });
+  });
+
   describe('checkPermission', () => {
     const testResource = new Types.ObjectId();
     const groupResource = new Types.ObjectId();
diff --git a/packages/api/src/acl/accessControlService.ts b/packages/api/src/acl/accessControlService.ts
index eeed3a6a2f5..bc5e2a41b70 100644
--- a/packages/api/src/acl/accessControlService.ts
+++ b/packages/api/src/acl/accessControlService.ts
@@ -1,6 +1,11 @@
 import { Types } from 'mongoose';
 import { createMethods, logger } from '@librechat/data-schemas';
-import { AccessRoleIds, PrincipalType, ResourceType } from 'librechat-data-provider';
+import {
+  AccessRoleIds,
+  PermissionBits,
+  PrincipalType,
+  ResourceType,
+} from 'librechat-data-provider';
 import type { AllMethods, IAclEntry } from '@librechat/data-schemas';
 import type { ClientSession, DeleteResult } from 'mongoose';
 
@@ -23,6 +28,7 @@ export class AccessControlService {
    * @param {string} params.accessRoleId - The ID of the role (e.g., AccessRoleIds.AGENT_VIEWER, AccessRoleIds.AGENT_EDITOR)
    * @param {Types.ObjectId} params.grantedBy - User ID granting the permission
    * @param {ClientSession} [params.session] - Optional MongoDB session for transactions
+   * @param {Date} [params.expiredAt] - Optional expiration for resource-tied permissions
    * @returns {Promise<IAclEntry>} The created or updated ACL entry
    */
   public async grantPermission(args: {
@@ -32,9 +38,10 @@ export class AccessControlService {
     resourceId: string | Types.ObjectId;
     accessRoleId: AccessRoleIds;
 
-    grantedBy: string | Types.ObjectId;
+    grantedBy?: string | Types.ObjectId;
     session?: ClientSession;
     roleId?: string | Types.ObjectId;
+    expiredAt?: Date;
   }): Promise<IAclEntry | null> {
     const {
       principalType,
@@ -44,6 +51,7 @@ export class AccessControlService {
       accessRoleId,
       grantedBy,
       session,
+      expiredAt,
     } = args;
     try {
       if (!Object.values(PrincipalType).includes(principalType)) {
@@ -96,6 +104,7 @@ export class AccessControlService {
         grantedBy,
         session,
         role._id,
+        expiredAt,
       );
     } catch (error) {
       logger.error(
@@ -375,6 +384,33 @@ export class AccessControlService {
     }
   }
 
+  /**
+   * Check if a resource has a PUBLIC AclEntry (accessible to everyone).
+   * Unlike checkPermission, this does not require a user context.
+   */
+  public async hasPublicAccess({
+    resourceType,
+    resourceId,
+  }: {
+    resourceType: ResourceType;
+    resourceId: string | Types.ObjectId;
+  }): Promise<boolean> {
+    try {
+      this.validateResourceType(resourceType);
+      return await this._dbMethods.hasPermission(
+        [{ principalType: PrincipalType.PUBLIC }],
+        resourceType,
+        resourceId,
+        PermissionBits.VIEW,
+      );
+    } catch (error) {
+      if (error instanceof Error) {
+        logger.error(`[PermissionService.hasPublicAccess] Error: ${error.message}`);
+      }
+      return false;
+    }
+  }
+
   /**
    * Validates that the resourceType is one of the supported enum values
    * @param {string} resourceType - The resource type to validate
diff --git a/packages/api/src/actions/credentials.spec.ts b/packages/api/src/actions/credentials.spec.ts
new file mode 100644
index 00000000000..d10b0410ca5
--- /dev/null
+++ b/packages/api/src/actions/credentials.spec.ts
@@ -0,0 +1,183 @@
+jest.mock(
+  'librechat-data-provider',
+  () => ({
+    AuthTypeEnum: {
+      ServiceHttp: 'service_http',
+      OAuth: 'oauth',
+      None: 'none',
+    },
+    AuthorizationTypeEnum: {
+      Bearer: 'bearer',
+    },
+    TokenExchangeMethodEnum: {
+      DefaultPost: 'default_post',
+    },
+    validateAndParseOpenAPISpec: (specString: string) => {
+      const spec = JSON.parse(specString) as { servers?: Array<{ url?: string }> };
+      return {
+        status: true,
+        spec,
+        serverUrl: spec.servers?.[0]?.url,
+      };
+    },
+  }),
+  { virtual: true },
+);
+
+import {
+  AuthTypeEnum,
+  AuthorizationTypeEnum,
+  TokenExchangeMethodEnum,
+} from 'librechat-data-provider';
+import type { ActionMetadata } from 'librechat-data-provider';
+import { mergeActionMetadataForUpdate } from './credentials';
+
+const specFor = (serverUrl: string): string =>
+  JSON.stringify({
+    openapi: '3.0.0',
+    info: { title: 'Action API', version: '1.0.0' },
+    servers: [{ url: serverUrl }],
+    paths: {
+      '/echo': {
+        get: {
+          operationId: 'echo',
+          responses: { 200: { description: 'OK' } },
+        },
+      },
+    },
+  });
+
+const serviceMetadata = (serverUrl = 'https://api.example.com/v1'): ActionMetadata => ({
+  domain: 'https://api.example.com',
+  raw_spec: specFor(serverUrl),
+  api_key: 'encrypted-owner-key',
+  auth: {
+    type: AuthTypeEnum.ServiceHttp,
+    authorization_type: AuthorizationTypeEnum.Bearer,
+  },
+});
+
+describe('mergeActionMetadataForUpdate', () => {
+  it('preserves existing service credentials when the action target is unchanged', () => {
+    const incoming: ActionMetadata = {
+      domain: 'https://api.example.com',
+      raw_spec: specFor('https://api.example.com/v1'),
+    };
+
+    const result = mergeActionMetadataForUpdate({
+      storedMetadata: serviceMetadata(),
+      incomingMetadata: incoming,
+    });
+
+    expect(result.targetChanged).toBe(false);
+    expect(result.requiresCredentialRefresh).toBe(false);
+    expect(result.metadata.api_key).toBe('encrypted-owner-key');
+  });
+
+  it('requires a fresh service credential when the domain changes', () => {
+    const incoming: ActionMetadata = {
+      domain: 'https://attacker.example',
+      raw_spec: specFor('https://attacker.example/v1'),
+    };
+
+    const result = mergeActionMetadataForUpdate({
+      storedMetadata: serviceMetadata(),
+      incomingMetadata: incoming,
+    });
+
+    expect(result.targetChanged).toBe(true);
+    expect(result.requiresCredentialRefresh).toBe(true);
+    expect(result.metadata.api_key).toBeUndefined();
+  });
+
+  it('treats OpenAPI server path changes as target changes', () => {
+    const incoming: ActionMetadata = {
+      domain: 'https://api.example.com',
+      raw_spec: specFor('https://api.example.com/debug'),
+    };
+
+    const result = mergeActionMetadataForUpdate({
+      storedMetadata: serviceMetadata(),
+      incomingMetadata: incoming,
+    });
+
+    expect(result.targetChanged).toBe(true);
+    expect(result.requiresCredentialRefresh).toBe(true);
+    expect(result.metadata.api_key).toBeUndefined();
+  });
+
+  it('allows target changes when the request supplies a fresh service credential', () => {
+    const incoming: ActionMetadata = {
+      domain: 'https://api.example.com',
+      raw_spec: specFor('https://api.example.com/v2'),
+      api_key: 'encrypted-new-key',
+      auth: {
+        type: AuthTypeEnum.ServiceHttp,
+        authorization_type: AuthorizationTypeEnum.Bearer,
+      },
+    };
+
+    const result = mergeActionMetadataForUpdate({
+      storedMetadata: serviceMetadata(),
+      incomingMetadata: incoming,
+    });
+
+    expect(result.targetChanged).toBe(true);
+    expect(result.requiresCredentialRefresh).toBe(false);
+    expect(result.metadata.api_key).toBe('encrypted-new-key');
+  });
+
+  it('allows target changes when auth is explicitly removed', () => {
+    const incoming: ActionMetadata = {
+      domain: 'https://api.example.com',
+      raw_spec: specFor('https://api.example.com/v2'),
+      auth: {
+        type: AuthTypeEnum.None,
+      },
+    };
+
+    const result = mergeActionMetadataForUpdate({
+      storedMetadata: serviceMetadata(),
+      incomingMetadata: incoming,
+    });
+
+    expect(result.targetChanged).toBe(true);
+    expect(result.requiresCredentialRefresh).toBe(false);
+    expect(result.metadata.api_key).toBeUndefined();
+  });
+
+  it('requires fresh OAuth client credentials when OAuth endpoints change', () => {
+    const storedMetadata: ActionMetadata = {
+      domain: 'https://api.example.com',
+      raw_spec: specFor('https://api.example.com/v1'),
+      oauth_client_id: 'encrypted-client-id',
+      oauth_client_secret: 'encrypted-client-secret',
+      auth: {
+        type: AuthTypeEnum.OAuth,
+        authorization_url: 'https://auth.example.com/authorize',
+        client_url: 'https://auth.example.com/token',
+        scope: 'read',
+        token_exchange_method: TokenExchangeMethodEnum.DefaultPost,
+      },
+    };
+    const incomingMetadata: ActionMetadata = {
+      auth: {
+        type: AuthTypeEnum.OAuth,
+        authorization_url: 'https://evil.example/authorize',
+        client_url: 'https://evil.example/token',
+        scope: 'read',
+        token_exchange_method: TokenExchangeMethodEnum.DefaultPost,
+      },
+    };
+
+    const result = mergeActionMetadataForUpdate({
+      storedMetadata,
+      incomingMetadata,
+    });
+
+    expect(result.targetChanged).toBe(true);
+    expect(result.requiresCredentialRefresh).toBe(true);
+    expect(result.metadata.oauth_client_id).toBeUndefined();
+    expect(result.metadata.oauth_client_secret).toBeUndefined();
+  });
+});
diff --git a/packages/api/src/actions/credentials.ts b/packages/api/src/actions/credentials.ts
new file mode 100644
index 00000000000..ad53d21c8b1
--- /dev/null
+++ b/packages/api/src/actions/credentials.ts
@@ -0,0 +1,194 @@
+import { AuthTypeEnum, validateAndParseOpenAPISpec } from 'librechat-data-provider';
+import type { ActionAuth, ActionMetadata } from 'librechat-data-provider';
+
+const authBoundaryFields: Array<keyof ActionAuth> = [
+  'type',
+  'authorization_type',
+  'custom_auth_header',
+  'authorization_url',
+  'client_url',
+  'scope',
+  'token_exchange_method',
+];
+
+export type ActionMetadataUpdateResult = {
+  metadata: ActionMetadata;
+  targetChanged: boolean;
+  requiresCredentialRefresh: boolean;
+};
+
+export type ActionMetadataUpdateParams = {
+  storedMetadata: ActionMetadata;
+  incomingMetadata: ActionMetadata;
+};
+
+function hasOwn<T extends object, K extends PropertyKey>(
+  obj: T | null | undefined,
+  key: K,
+): obj is T & Record<K, unknown> {
+  return obj != null && Object.prototype.hasOwnProperty.call(obj, key);
+}
+
+function hasValue(value: string | undefined): boolean {
+  return typeof value === 'string' && value.length > 0;
+}
+
+function normalizeUrlTarget(value: string | undefined): string {
+  if (!value) {
+    return '';
+  }
+
+  try {
+    const url = new URL(value);
+    const pathname = url.pathname.replace(/\/+$/, '');
+    return `${url.protocol}//${url.host.toLowerCase()}${pathname}${url.search}`;
+  } catch {
+    return value.trim().toLowerCase().replace(/\/+$/, '');
+  }
+}
+
+function normalizeDomainTarget(value: string | undefined): string {
+  if (!value) {
+    return '';
+  }
+
+  const urlValue = value.includes('://') ? value : `https://${value}`;
+  try {
+    const url = new URL(urlValue);
+    return `${url.protocol}//${url.host.toLowerCase()}`;
+  } catch {
+    return value.trim().toLowerCase().replace(/\/+$/, '');
+  }
+}
+
+function getSpecServerTarget(rawSpec: string | undefined): string {
+  if (!rawSpec) {
+    return '';
+  }
+
+  const result = validateAndParseOpenAPISpec(rawSpec);
+  return normalizeUrlTarget(result.serverUrl);
+}
+
+function didDomainChange(
+  storedMetadata: ActionMetadata,
+  incomingMetadata: ActionMetadata,
+): boolean {
+  if (!hasOwn(incomingMetadata, 'domain')) {
+    return false;
+  }
+
+  return (
+    normalizeDomainTarget(storedMetadata.domain) !== normalizeDomainTarget(incomingMetadata.domain)
+  );
+}
+
+function didSpecServerChange(
+  storedMetadata: ActionMetadata,
+  incomingMetadata: ActionMetadata,
+): boolean {
+  if (!hasOwn(incomingMetadata, 'raw_spec')) {
+    return false;
+  }
+
+  return (
+    getSpecServerTarget(storedMetadata.raw_spec) !== getSpecServerTarget(incomingMetadata.raw_spec)
+  );
+}
+
+function didAuthBoundaryChange(
+  storedMetadata: ActionMetadata,
+  incomingMetadata: ActionMetadata,
+): boolean {
+  if (!hasOwn(incomingMetadata, 'auth')) {
+    return false;
+  }
+
+  return authBoundaryFields.some(
+    (field) => storedMetadata.auth?.[field] !== incomingMetadata.auth?.[field],
+  );
+}
+
+function getTargetChanged(
+  storedMetadata: ActionMetadata,
+  incomingMetadata: ActionMetadata,
+): boolean {
+  return (
+    didDomainChange(storedMetadata, incomingMetadata) ||
+    didSpecServerChange(storedMetadata, incomingMetadata) ||
+    didAuthBoundaryChange(storedMetadata, incomingMetadata)
+  );
+}
+
+function getNextAuthType(
+  storedMetadata: ActionMetadata,
+  incomingMetadata: ActionMetadata,
+): AuthTypeEnum | undefined {
+  return incomingMetadata.auth?.type ?? storedMetadata.auth?.type;
+}
+
+function requiresCredentialRefresh(
+  storedMetadata: ActionMetadata,
+  incomingMetadata: ActionMetadata,
+): boolean {
+  const authType = getNextAuthType(storedMetadata, incomingMetadata);
+
+  if (authType === AuthTypeEnum.ServiceHttp) {
+    return hasValue(storedMetadata.api_key) && !hasValue(incomingMetadata.api_key);
+  }
+
+  if (authType === AuthTypeEnum.OAuth) {
+    return (
+      (hasValue(storedMetadata.oauth_client_id) && !hasValue(incomingMetadata.oauth_client_id)) ||
+      (hasValue(storedMetadata.oauth_client_secret) &&
+        !hasValue(incomingMetadata.oauth_client_secret))
+    );
+  }
+
+  return false;
+}
+
+function removeUnsubmittedCredentials(
+  metadata: ActionMetadata,
+  incomingMetadata: ActionMetadata,
+): ActionMetadata {
+  const sanitized = { ...metadata };
+
+  if (!hasValue(incomingMetadata.api_key)) {
+    delete sanitized.api_key;
+  }
+
+  if (!hasValue(incomingMetadata.oauth_client_id)) {
+    delete sanitized.oauth_client_id;
+  }
+
+  if (!hasValue(incomingMetadata.oauth_client_secret)) {
+    delete sanitized.oauth_client_secret;
+  }
+
+  return sanitized;
+}
+
+/**
+ * Preserves saved credentials only while an Action continues to point at the
+ * same request/auth boundary. A changed domain, OpenAPI server URL, or auth
+ * endpoint must come with fresh credentials or explicitly remove auth.
+ */
+export function mergeActionMetadataForUpdate({
+  storedMetadata,
+  incomingMetadata,
+}: ActionMetadataUpdateParams): ActionMetadataUpdateResult {
+  const targetChanged = getTargetChanged(storedMetadata, incomingMetadata);
+  const refreshRequired = targetChanged
+    ? requiresCredentialRefresh(storedMetadata, incomingMetadata)
+    : false;
+  const mergedMetadata = { ...storedMetadata, ...incomingMetadata };
+
+  return {
+    targetChanged,
+    requiresCredentialRefresh: refreshRequired,
+    metadata: targetChanged
+      ? removeUnsubmittedCredentials(mergedMetadata, incomingMetadata)
+      : mergedMetadata,
+  };
+}
diff --git a/packages/api/src/actions/index.ts b/packages/api/src/actions/index.ts
new file mode 100644
index 00000000000..bd6bb74bd5d
--- /dev/null
+++ b/packages/api/src/actions/index.ts
@@ -0,0 +1,3 @@
+export * from './credentials';
+export * from './tools';
+export * from './update';
diff --git a/packages/api/src/actions/tools.spec.ts b/packages/api/src/actions/tools.spec.ts
new file mode 100644
index 00000000000..2b4747de646
--- /dev/null
+++ b/packages/api/src/actions/tools.spec.ts
@@ -0,0 +1,92 @@
+jest.mock(
+  'librechat-data-provider',
+  () => ({
+    actionDelimiter: '_action_',
+    validateAndParseOpenAPISpec: (specString: string) => {
+      const spec = JSON.parse(specString) as { paths?: Record<string, unknown> };
+      return {
+        status: true,
+        message: 'OpenAPI spec is valid.',
+        spec,
+        serverUrl: 'https://api.example.com',
+      };
+    },
+  }),
+  { virtual: true },
+);
+
+import { mergeAgentActionTools } from './tools';
+
+const specFor = (operationId: string): string =>
+  JSON.stringify({
+    openapi: '3.0.0',
+    info: { title: 'Action API', version: '1.0.0' },
+    servers: [{ url: 'https://api.example.com' }],
+    paths: {
+      '/items': {
+        get: {
+          operationId,
+          responses: { 200: { description: 'OK' } },
+        },
+      },
+    },
+  });
+
+const toolFor = (name: string) => ({
+  function: {
+    name,
+  },
+});
+
+describe('mergeAgentActionTools', () => {
+  it('preserves other action tools that share the previous domain', () => {
+    const result = mergeAgentActionTools({
+      existingTools: [
+        'listItems_action_shared_domain',
+        'echoMessage_action_shared_domain',
+        'echoMessage_action_legacy_domain',
+      ],
+      incomingFunctions: [toolFor('echoMessage')],
+      encodedDomain: 'new_domain',
+      actionId: 'action-a',
+      requestedActionId: 'action-a',
+      previousEncodedDomain: 'shared_domain',
+      previousLegacyDomain: 'legacy_domain',
+      previousRawSpec: specFor('echoMessage'),
+    });
+
+    expect(result).toEqual(['listItems_action_shared_domain', 'echoMessage_action_new_domain']);
+  });
+
+  it('removes previous operation names when an action function is renamed', () => {
+    const result = mergeAgentActionTools({
+      existingTools: ['oldName_action_shared_domain', 'unrelated_action_shared_domain'],
+      incomingFunctions: [toolFor('newName')],
+      encodedDomain: 'shared_domain',
+      actionId: 'action-a',
+      requestedActionId: 'action-a',
+      previousEncodedDomain: 'shared_domain',
+      previousRawSpec: specFor('oldName'),
+    });
+
+    expect(result).toEqual(['unrelated_action_shared_domain', 'newName_action_shared_domain']);
+  });
+
+  it('removes legacy action-id keyed entries without dropping unrelated tools', () => {
+    const result = mergeAgentActionTools({
+      existingTools: [
+        'legacy-action-a',
+        'listItems_action_shared_domain',
+        'echoMessage_action_shared_domain',
+      ],
+      incomingFunctions: [toolFor('echoMessage')],
+      encodedDomain: 'shared_domain',
+      actionId: 'action-a',
+      requestedActionId: 'action-a',
+      previousEncodedDomain: 'shared_domain',
+      previousRawSpec: specFor('echoMessage'),
+    });
+
+    expect(result).toEqual(['listItems_action_shared_domain', 'echoMessage_action_shared_domain']);
+  });
+});
diff --git a/packages/api/src/actions/tools.ts b/packages/api/src/actions/tools.ts
new file mode 100644
index 00000000000..2647d5cde50
--- /dev/null
+++ b/packages/api/src/actions/tools.ts
@@ -0,0 +1,127 @@
+import { actionDelimiter, validateAndParseOpenAPISpec } from 'librechat-data-provider';
+
+export type ActionToolLike = {
+  function?: {
+    name?: string;
+  };
+};
+
+export type MergeAgentActionToolsParams = {
+  existingTools: string[];
+  incomingFunctions: ActionToolLike[];
+  encodedDomain: string;
+  actionId: string;
+  requestedActionId?: string;
+  legacyDomain?: string;
+  previousEncodedDomain?: string;
+  previousLegacyDomain?: string;
+  previousRawSpec?: string;
+};
+
+const httpMethods = new Set(['get', 'put', 'post', 'delete', 'options', 'head', 'patch', 'trace']);
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null;
+}
+
+function sanitizeOperationId(input: string): string {
+  return input.replace(/[^a-zA-Z0-9_-]/g, '');
+}
+
+function getFunctionNames(functions: ActionToolLike[]): string[] {
+  const names = new Set<string>();
+
+  for (const tool of functions) {
+    const name = tool.function?.name;
+    if (typeof name === 'string' && name.length > 0) {
+      names.add(name);
+    }
+  }
+
+  return [...names];
+}
+
+function getSpecOperationNames(rawSpec?: string): string[] {
+  if (!rawSpec) {
+    return [];
+  }
+
+  const result = validateAndParseOpenAPISpec(rawSpec);
+  if (!result.status || !isRecord(result.spec?.paths)) {
+    return [];
+  }
+
+  const names = new Set<string>();
+  for (const [path, methods] of Object.entries(result.spec.paths)) {
+    if (!isRecord(methods)) {
+      continue;
+    }
+
+    for (const [method, operation] of Object.entries(methods)) {
+      if (!httpMethods.has(method.toLowerCase()) || !isRecord(operation)) {
+        continue;
+      }
+
+      const operationId = operation.operationId;
+      names.add(
+        typeof operationId === 'string' && operationId.length > 0
+          ? operationId
+          : sanitizeOperationId(`${method}_${path}`),
+      );
+    }
+  }
+
+  return [...names];
+}
+
+function getUniqueValues(values: Array<string | undefined>): string[] {
+  return [...new Set(values.filter((value): value is string => !!value))];
+}
+
+export function mergeAgentActionTools({
+  existingTools,
+  incomingFunctions,
+  encodedDomain,
+  actionId,
+  requestedActionId,
+  legacyDomain,
+  previousEncodedDomain,
+  previousLegacyDomain,
+  previousRawSpec,
+}: MergeAgentActionToolsParams): string[] {
+  const incomingNames = getFunctionNames(incomingFunctions);
+  const domainsToReplace = getUniqueValues([
+    encodedDomain,
+    legacyDomain,
+    previousEncodedDomain,
+    previousLegacyDomain,
+  ]);
+  const namesToReplace = getUniqueValues([
+    ...incomingNames,
+    ...getSpecOperationNames(previousRawSpec),
+  ]);
+  const toolsToReplace = new Set<string>();
+
+  for (const name of namesToReplace) {
+    for (const domain of domainsToReplace) {
+      toolsToReplace.add(`${name}${actionDelimiter}${domain}`);
+    }
+  }
+
+  const actionIdsToReplace = getUniqueValues([actionId, requestedActionId]);
+  const retainedTools = existingTools.filter((tool) => {
+    if (!tool) {
+      return false;
+    }
+
+    if (toolsToReplace.has(tool)) {
+      return false;
+    }
+
+    return !actionIdsToReplace.some((id) => tool.includes(id));
+  });
+
+  return retainedTools.concat(
+    incomingNames.map((name) => `${name}${actionDelimiter}${encodedDomain}`),
+  );
+}
diff --git a/packages/api/src/actions/update.spec.ts b/packages/api/src/actions/update.spec.ts
new file mode 100644
index 00000000000..ed356100aff
--- /dev/null
+++ b/packages/api/src/actions/update.spec.ts
@@ -0,0 +1,152 @@
+jest.mock(
+  'librechat-data-provider',
+  () => ({
+    actionDelimiter: '_action_',
+    actionDomainSeparator: '---',
+    Constants: {
+      ENCODED_DOMAIN_LENGTH: 64,
+    },
+    AuthTypeEnum: {
+      ServiceHttp: 'service_http',
+      OAuth: 'oauth',
+      None: 'none',
+    },
+    AuthorizationTypeEnum: {
+      Bearer: 'bearer',
+    },
+    validateAndParseOpenAPISpec: (specString: string) => {
+      const spec = JSON.parse(specString) as { servers?: Array<{ url?: string }> };
+      return {
+        status: true,
+        message: 'OpenAPI spec is valid.',
+        spec,
+        serverUrl: spec.servers?.[0]?.url,
+      };
+    },
+  }),
+  { virtual: true },
+);
+
+import { AuthTypeEnum, AuthorizationTypeEnum } from 'librechat-data-provider';
+import type { ActionMetadata } from 'librechat-data-provider';
+import {
+  buildActionOAuthTokenDeleteQueries,
+  legacyActionDomainEncode,
+  planAgentActionUpdate,
+} from './update';
+
+const specFor = (serverUrl: string, operationId = 'echoMessage'): string =>
+  JSON.stringify({
+    openapi: '3.0.0',
+    info: { title: 'Action API', version: '1.0.0' },
+    servers: [{ url: serverUrl }],
+    paths: {
+      '/echo': {
+        get: {
+          operationId,
+          responses: { 200: { description: 'OK' } },
+        },
+      },
+    },
+  });
+
+const toolFor = (name: string) => ({
+  function: {
+    name,
+  },
+});
+
+const storedServiceMetadata: ActionMetadata = {
+  domain: 'https://api.example.com',
+  raw_spec: specFor('https://api.example.com/v1'),
+  api_key: 'encrypted-owner-key',
+  auth: {
+    type: AuthTypeEnum.ServiceHttp,
+    authorization_type: AuthorizationTypeEnum.Bearer,
+  },
+};
+
+describe('planAgentActionUpdate', () => {
+  it('requires refreshed credentials when an existing target changes without new credentials', () => {
+    const result = planAgentActionUpdate({
+      agentActions: ['api---example---com_action_action-1'],
+      agentTools: ['echoMessage_action_api---example---com'],
+      incomingFunctions: [toolFor('echoMessage')],
+      incomingMetadata: {
+        domain: 'https://other.example.com',
+        raw_spec: specFor('https://other.example.com/v1'),
+      },
+      actionId: 'action-1',
+      requestedActionId: 'action-1',
+      encodedDomain: 'other---example---com',
+      legacyDomain: legacyActionDomainEncode('https://other.example.com'),
+      previousLegacyDomain: legacyActionDomainEncode('https://api.example.com'),
+      storedAction: {
+        metadata: storedServiceMetadata,
+      },
+    });
+
+    expect(result.requiresCredentialRefresh).toBe(true);
+    expect(result.targetChanged).toBe(true);
+    expect(result.deleteOAuthTokens).toBe(true);
+    expect(result.metadata.api_key).toBeUndefined();
+  });
+
+  it('plans a stable-id target update while preserving unrelated same-domain tools', () => {
+    const result = planAgentActionUpdate({
+      agentActions: ['api---example---com_action_action-1', 'api---example---com_action_action-2'],
+      agentTools: [
+        'echoMessage_action_api---example---com',
+        'listItems_action_api---example---com',
+      ],
+      incomingFunctions: [toolFor('echoMessage')],
+      incomingMetadata: {
+        domain: 'https://other.example.com',
+        raw_spec: specFor('https://other.example.com/v1'),
+        api_key: 'encrypted-new-key',
+        auth: {
+          type: AuthTypeEnum.ServiceHttp,
+          authorization_type: AuthorizationTypeEnum.Bearer,
+        },
+      },
+      actionId: 'action-1',
+      requestedActionId: 'action-1',
+      encodedDomain: 'other---example---com',
+      legacyDomain: legacyActionDomainEncode('https://other.example.com'),
+      previousLegacyDomain: legacyActionDomainEncode('https://api.example.com'),
+      storedAction: {
+        metadata: storedServiceMetadata,
+      },
+    });
+
+    expect(result.requiresCredentialRefresh).toBe(false);
+    expect(result.actionId).toBe('action-1');
+    expect(result.deleteOAuthTokens).toBe(true);
+    expect(result.actions).toEqual([
+      'api---example---com_action_action-2',
+      'other---example---com_action_action-1',
+    ]);
+    expect(result.tools).toEqual([
+      'listItems_action_api---example---com',
+      'echoMessage_action_other---example---com',
+    ]);
+  });
+});
+
+describe('buildActionOAuthTokenDeleteQueries', () => {
+  it('builds escaped access and refresh token identifier queries', () => {
+    const [accessQuery, refreshQuery] = buildActionOAuthTokenDeleteQueries('action.1');
+
+    expect(accessQuery).toEqual({
+      type: 'oauth',
+      identifier: expect.any(RegExp),
+    });
+    expect(refreshQuery).toEqual({
+      type: 'oauth_refresh',
+      identifier: expect.any(RegExp),
+    });
+    expect(accessQuery.identifier.test('user-1:action.1')).toBe(true);
+    expect(accessQuery.identifier.test('user-1:actionx1')).toBe(false);
+    expect(refreshQuery.identifier.test('user-1:action.1:refresh')).toBe(true);
+  });
+});
diff --git a/packages/api/src/actions/update.ts b/packages/api/src/actions/update.ts
new file mode 100644
index 00000000000..03bb3ba8617
--- /dev/null
+++ b/packages/api/src/actions/update.ts
@@ -0,0 +1,163 @@
+import { Constants, actionDelimiter, actionDomainSeparator } from 'librechat-data-provider';
+import type { ActionMetadata } from 'librechat-data-provider';
+import type { ActionToolLike } from './tools';
+import { mergeActionMetadataForUpdate } from './credentials';
+import { mergeAgentActionTools } from './tools';
+
+export const ACTION_CREDENTIAL_REFRESH_MESSAGE =
+  'Action credentials must be re-entered when changing the domain, OpenAPI server URL, or authentication settings';
+
+type StoredActionForUpdate = {
+  metadata?: ActionMetadata | null;
+};
+
+export type PlanAgentActionUpdateParams = {
+  agentActions: string[];
+  agentTools: string[];
+  incomingFunctions: ActionToolLike[];
+  incomingMetadata: ActionMetadata;
+  actionId: string;
+  requestedActionId?: string;
+  encodedDomain: string;
+  legacyDomain?: string;
+  previousLegacyDomain?: string;
+  storedAction?: StoredActionForUpdate | null;
+};
+
+export type PlannedAgentActionUpdate = {
+  actionId: string;
+  metadata: ActionMetadata;
+  actions: string[];
+  tools: string[];
+  targetChanged: boolean;
+  requiresCredentialRefresh: boolean;
+  deleteOAuthTokens: boolean;
+};
+
+export type ActionOAuthTokenDeleteQuery = {
+  type: 'oauth' | 'oauth_refresh';
+  identifier: RegExp;
+};
+
+function escapeRegExp(value: string): string {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+function getUpdatedAgentActionRefs({
+  agentActions,
+  actionId,
+  requestedActionId,
+  encodedDomain,
+}: Pick<
+  PlanAgentActionUpdateParams,
+  'agentActions' | 'actionId' | 'requestedActionId' | 'encodedDomain'
+>): {
+  actions: string[];
+  previousEncodedDomain?: string;
+} {
+  const actions: string[] = [];
+  let previousEncodedDomain: string | undefined;
+
+  for (const action of agentActions) {
+    const [actionDomain, currentActionId] = action.split(actionDelimiter);
+    if (
+      (requestedActionId && currentActionId === requestedActionId) ||
+      currentActionId === actionId
+    ) {
+      previousEncodedDomain = actionDomain;
+      continue;
+    }
+
+    actions.push(action);
+  }
+
+  actions.push(`${encodedDomain}${actionDelimiter}${actionId}`);
+
+  return {
+    actions,
+    previousEncodedDomain,
+  };
+}
+
+export function legacyActionDomainEncode(domain?: string): string {
+  if (!domain) {
+    return '';
+  }
+
+  if (domain.length <= Constants.ENCODED_DOMAIN_LENGTH) {
+    return domain.replace(/\./g, actionDomainSeparator);
+  }
+
+  const modifiedDomain = Buffer.from(domain).toString('base64');
+  return modifiedDomain.substring(0, Constants.ENCODED_DOMAIN_LENGTH);
+}
+
+export function buildActionOAuthTokenDeleteQueries(
+  actionId: string,
+): ActionOAuthTokenDeleteQuery[] {
+  const escapedActionId = escapeRegExp(actionId);
+
+  return [
+    {
+      type: 'oauth',
+      identifier: new RegExp(`^[^:]+:${escapedActionId}$`),
+    },
+    {
+      type: 'oauth_refresh',
+      identifier: new RegExp(`^[^:]+:${escapedActionId}:refresh$`),
+    },
+  ];
+}
+
+export function planAgentActionUpdate({
+  agentActions,
+  agentTools,
+  incomingFunctions,
+  incomingMetadata,
+  actionId,
+  requestedActionId,
+  encodedDomain,
+  legacyDomain,
+  previousLegacyDomain,
+  storedAction,
+}: PlanAgentActionUpdateParams): PlannedAgentActionUpdate {
+  const metadataUpdate = storedAction
+    ? mergeActionMetadataForUpdate({
+        storedMetadata: storedAction.metadata ?? {},
+        incomingMetadata,
+      })
+    : {
+        metadata: incomingMetadata,
+        targetChanged: false,
+        requiresCredentialRefresh: false,
+      };
+
+  const { actions, previousEncodedDomain } = getUpdatedAgentActionRefs({
+    agentActions,
+    actionId,
+    requestedActionId,
+    encodedDomain,
+  });
+
+  const tools = mergeAgentActionTools({
+    existingTools: agentTools,
+    incomingFunctions,
+    encodedDomain,
+    actionId,
+    requestedActionId,
+    legacyDomain,
+    previousEncodedDomain,
+    previousLegacyDomain,
+    previousRawSpec: storedAction?.metadata?.raw_spec,
+  });
+
+  return {
+    actionId,
+    actions,
+    tools,
+    metadata: metadataUpdate.metadata,
+    targetChanged: metadataUpdate.targetChanged,
+    requiresCredentialRefresh: metadataUpdate.requiresCredentialRefresh,
+    deleteOAuthTokens: Boolean(metadataUpdate.targetChanged && requestedActionId),
+  };
+}
diff --git a/packages/api/src/admin/config.handler.spec.ts b/packages/api/src/admin/config.handler.spec.ts
index a052544d111..b3f8e9ee3b3 100644
--- a/packages/api/src/admin/config.handler.spec.ts
+++ b/packages/api/src/admin/config.handler.spec.ts
@@ -49,6 +49,9 @@ function createHandlers(overrides = {}) {
     patchConfigFields: jest
       .fn()
       .mockResolvedValue({ _id: 'c1', overrides: { registration: { enabled: false } } }),
+    tombstoneConfigField: jest
+      .fn()
+      .mockResolvedValue({ _id: 'c1', tombstones: ['mcpServers.github'] }),
     unsetConfigField: jest.fn().mockResolvedValue({ _id: 'c1', overrides: {} }),
     deleteConfig: jest.fn().mockResolvedValue({ _id: 'c1' }),
     toggleConfigActive: jest.fn().mockResolvedValue({ _id: 'c1', isActive: false }),
@@ -191,6 +194,29 @@ describe('createAdminConfigHandlers', () => {
       expect(savedOverrides.interface).toEqual({ modelSelect: false });
     });
 
+    it('preserves skillSync sections in admin overrides', async () => {
+      const { handlers, deps } = createHandlers({
+        upsertConfig: jest.fn().mockResolvedValue({ _id: 'c1', configVersion: 1 }),
+      });
+      const req = mockReq({
+        params: { principalType: 'role', principalId: 'admin' },
+        body: {
+          overrides: {
+            skillSync: { github: { enabled: true } },
+            interface: { modelSelect: false },
+          },
+        },
+      });
+      const res = mockRes();
+
+      await handlers.upsertConfigOverrides(req, res);
+
+      expect(res.statusCode).toBe(201);
+      const savedOverrides = deps.upsertConfig.mock.calls[0][3];
+      expect(savedOverrides.skillSync).toEqual({ github: { enabled: true } });
+      expect(savedOverrides.interface).toEqual({ modelSelect: false });
+    });
+
     it('preserves UI sub-keys in composite permission fields like mcpServers', async () => {
       const { handlers, deps } = createHandlers({
         upsertConfig: jest.fn().mockResolvedValue({ _id: 'c1', configVersion: 1 }),
@@ -335,6 +361,24 @@ describe('createAdminConfigHandlers', () => {
       expect(deps.unsetConfigField).not.toHaveBeenCalled();
     });
 
+    it('allows deleting skillSync field paths', async () => {
+      const { handlers, deps } = createHandlers();
+      const req = mockReq({
+        params: { principalType: 'role', principalId: 'admin' },
+        query: { fieldPath: 'skillSync.github.enabled' },
+      });
+      const res = mockRes();
+
+      await handlers.deleteConfigField(req, res);
+
+      expect(res.statusCode).toBe(200);
+      expect(deps.unsetConfigField).toHaveBeenCalledWith(
+        'role',
+        'admin',
+        'skillSync.github.enabled',
+      );
+    });
+
     it('allows deleting interface UI field paths', async () => {
       const { handlers, deps } = createHandlers();
       const req = mockReq({
@@ -377,6 +421,78 @@ describe('createAdminConfigHandlers', () => {
     });
   });
 
+  describe('tombstoneConfigField', () => {
+    it('writes an explicit tombstone for a valid field path', async () => {
+      const { handlers, deps } = createHandlers();
+      const req = mockReq({
+        params: { principalType: 'role', principalId: 'admin' },
+        body: { fieldPath: 'mcpServers.github' },
+      });
+      const res = mockRes();
+
+      await handlers.tombstoneConfigField(req, res);
+
+      expect(res.statusCode).toBe(200);
+      expect(deps.tombstoneConfigField).toHaveBeenCalledWith(
+        'role',
+        'admin',
+        expect.anything(),
+        'mcpServers.github',
+        10,
+      );
+    });
+
+    it('uses the existing config priority when priority is omitted', async () => {
+      const { handlers, deps } = createHandlers({
+        findConfigByPrincipal: jest.fn().mockResolvedValue({ _id: 'c1', priority: 42 }),
+      });
+      const req = mockReq({
+        params: { principalType: 'role', principalId: 'admin' },
+        body: { fieldPath: 'mcpServers.github' },
+      });
+      const res = mockRes();
+
+      await handlers.tombstoneConfigField(req, res);
+
+      expect(deps.tombstoneConfigField).toHaveBeenCalledWith(
+        'role',
+        'admin',
+        expect.anything(),
+        'mcpServers.github',
+        42,
+      );
+    });
+
+    it('blocks interface permission paths', async () => {
+      const { handlers, deps } = createHandlers();
+      const req = mockReq({
+        params: { principalType: 'role', principalId: 'admin' },
+        body: { fieldPath: 'interface.mcpServers.use' },
+      });
+      const res = mockRes();
+
+      await handlers.tombstoneConfigField(req, res);
+
+      expect(res.statusCode).toBe(200);
+      expect(res.body!.message).toBeDefined();
+      expect(deps.tombstoneConfigField).not.toHaveBeenCalled();
+    });
+
+    it('rejects unsafe field paths', async () => {
+      const { handlers, deps } = createHandlers();
+      const req = mockReq({
+        params: { principalType: 'role', principalId: 'admin' },
+        body: { fieldPath: '__proto__.polluted' },
+      });
+      const res = mockRes();
+
+      await handlers.tombstoneConfigField(req, res);
+
+      expect(res.statusCode).toBe(400);
+      expect(deps.tombstoneConfigField).not.toHaveBeenCalled();
+    });
+  });
+
   describe('patchConfigField', () => {
     it('returns 403 when user lacks capability for section', async () => {
       const { handlers } = createHandlers({
@@ -414,6 +530,27 @@ describe('createAdminConfigHandlers', () => {
       expect(patchedFields['interface.prompts']).toBeUndefined();
     });
 
+    it('preserves skillSync field entries in patches', async () => {
+      const { handlers, deps } = createHandlers();
+      const req = mockReq({
+        params: { principalType: 'role', principalId: 'admin' },
+        body: {
+          entries: [
+            { fieldPath: 'skillSync.github.enabled', value: true },
+            { fieldPath: 'interface.modelSelect', value: false },
+          ],
+        },
+      });
+      const res = mockRes();
+
+      await handlers.patchConfigField(req, res);
+
+      expect(res.statusCode).toBe(200);
+      const patchedFields = deps.patchConfigFields.mock.calls[0][3];
+      expect(patchedFields['skillSync.github.enabled']).toBe(true);
+      expect(patchedFields['interface.modelSelect']).toBe(false);
+    });
+
     it('blocks peoplePicker permission sub-key paths', async () => {
       const { handlers, deps } = createHandlers();
       const req = mockReq({
@@ -641,6 +778,13 @@ describe('createAdminConfigHandlers', () => {
         query: { fieldPath: 'interface.modelSelect' },
       },
     },
+    {
+      name: 'tombstoneConfigField',
+      reqOverrides: {
+        params: { principalType: 'role', principalId: 'admin' },
+        body: { fieldPath: 'mcpServers.github' },
+      },
+    },
     {
       name: 'deleteConfigOverrides',
       reqOverrides: {
diff --git a/packages/api/src/admin/config.ts b/packages/api/src/admin/config.ts
index dc07a9d18f5..1a79e01384c 100644
--- a/packages/api/src/admin/config.ts
+++ b/packages/api/src/admin/config.ts
@@ -1,12 +1,13 @@
 import { logger } from '@librechat/data-schemas';
 import {
+  BASE_ONLY_CONFIG_SECTIONS,
   PrincipalType,
   PrincipalModel,
   INTERFACE_PERMISSION_FIELDS,
   PERMISSION_SUB_KEYS,
 } from 'librechat-data-provider';
-import type { TCustomConfig } from 'librechat-data-provider';
 import type { AppConfig, ConfigSection, IConfig } from '@librechat/data-schemas';
+import type { TCustomConfig } from 'librechat-data-provider';
 import type { Types, ClientSession } from 'mongoose';
 import type { Response } from 'express';
 import type { CapabilityUser } from '~/middleware/capabilities';
@@ -15,6 +16,7 @@ import type { ServerRequest } from '~/types/http';
 const UNSAFE_SEGMENTS = /(?:^|\.)(__[\w]*|constructor|prototype)(?:\.|$)/;
 const MAX_PATCH_ENTRIES = 100;
 const DEFAULT_PRIORITY = 10;
+const BASE_ONLY_OVERRIDE_SECTIONS = new Set<string>(BASE_ONLY_CONFIG_SECTIONS);
 
 export function isValidFieldPath(path: string): boolean {
   return (
@@ -31,6 +33,10 @@ export function getTopLevelSection(fieldPath: string): string {
   return fieldPath.split('.')[0];
 }
 
+function isBaseOnlyFieldPath(fieldPath: string): boolean {
+  return BASE_ONLY_OVERRIDE_SECTIONS.has(getTopLevelSection(fieldPath));
+}
+
 /**
  * Returns true if `fieldPath` targets an interface permission field or permission sub-key.
  *
@@ -82,6 +88,14 @@ export interface AdminConfigDeps {
     priority: number,
     session?: ClientSession,
   ) => Promise<IConfig | null>;
+  tombstoneConfigField: (
+    principalType: PrincipalType,
+    principalId: string | Types.ObjectId,
+    principalModel: PrincipalModel,
+    fieldPath: string,
+    priority: number,
+    session?: ClientSession,
+  ) => Promise<IConfig | null>;
   unsetConfigField: (
     principalType: PrincipalType,
     principalId: string | Types.ObjectId,
@@ -157,12 +171,23 @@ function getCapabilityUser(req: ServerRequest): CapabilityUser | null {
 
 // ── Handler factory ──────────────────────────────────────────────────
 
-export function createAdminConfigHandlers(deps: AdminConfigDeps) {
+export function createAdminConfigHandlers(deps: AdminConfigDeps): {
+  listConfigs: (req: ServerRequest, res: Response) => Promise<Response>;
+  getBaseConfig: (req: ServerRequest, res: Response) => Promise<Response>;
+  getConfig: (req: ServerRequest, res: Response) => Promise<Response>;
+  upsertConfigOverrides: (req: ServerRequest, res: Response) => Promise<Response>;
+  patchConfigField: (req: ServerRequest, res: Response) => Promise<Response>;
+  tombstoneConfigField: (req: ServerRequest, res: Response) => Promise<Response>;
+  deleteConfigField: (req: ServerRequest, res: Response) => Promise<Response>;
+  deleteConfigOverrides: (req: ServerRequest, res: Response) => Promise<Response>;
+  toggleConfig: (req: ServerRequest, res: Response) => Promise<Response>;
+} {
   const {
     listAllConfigs,
     findConfigByPrincipal,
     upsertConfig,
     patchConfigFields,
+    tombstoneConfigField: writeConfigTombstone,
     unsetConfigField,
     deleteConfig,
     toggleConfigActive,
@@ -174,7 +199,7 @@ export function createAdminConfigHandlers(deps: AdminConfigDeps) {
   /**
    * GET / — List all active config overrides.
    */
-  async function listConfigs(req: ServerRequest, res: Response) {
+  async function listConfigs(req: ServerRequest, res: Response): Promise<Response> {
     try {
       const user = getCapabilityUser(req);
       if (!user) {
@@ -197,7 +222,7 @@ export function createAdminConfigHandlers(deps: AdminConfigDeps) {
    * GET /base — Return the raw AppConfig (YAML + DB base merged).
    * This is the full config structure admins can edit, NOT the startup payload.
    */
-  async function getBaseConfig(req: ServerRequest, res: Response) {
+  async function getBaseConfig(req: ServerRequest, res: Response): Promise<Response> {
     try {
       const user = getCapabilityUser(req);
       if (!user) {
@@ -227,7 +252,7 @@ export function createAdminConfigHandlers(deps: AdminConfigDeps) {
   /**
    * GET /:principalType/:principalId — Get config for a specific principal.
    */
-  async function getConfig(req: ServerRequest, res: Response) {
+  async function getConfig(req: ServerRequest, res: Response): Promise<Response> {
     try {
       const { principalType, principalId } = req.params as {
         principalType: string;
@@ -264,7 +289,7 @@ export function createAdminConfigHandlers(deps: AdminConfigDeps) {
   /**
    * PUT /:principalType/:principalId — Replace entire overrides for a principal.
    */
-  async function upsertConfigOverrides(req: ServerRequest, res: Response) {
+  async function upsertConfigOverrides(req: ServerRequest, res: Response): Promise<Response> {
     try {
       const { principalType, principalId } = req.params as {
         principalType: string;
@@ -297,7 +322,17 @@ export function createAdminConfigHandlers(deps: AdminConfigDeps) {
         return res.status(403).json({ error: 'Insufficient permissions' });
       }
 
-      let filteredOverrides = overrides;
+      const filteredOverrides = {
+        ...(overrides as Record<string, unknown>),
+      } as Partial<TCustomConfig>;
+      for (const section of BASE_ONLY_OVERRIDE_SECTIONS) {
+        if (section in filteredOverrides) {
+          delete (filteredOverrides as Record<string, unknown>)[section];
+          logger.warn(
+            `[adminConfig] Stripping base-only config section "${section}" - configure it in librechat.yaml instead`,
+          );
+        }
+      }
       const iface = (overrides as Record<string, unknown>).interface;
       if (iface != null && typeof iface === 'object' && !Array.isArray(iface)) {
         const filteredIface: Record<string, unknown> = {};
@@ -326,7 +361,6 @@ export function createAdminConfigHandlers(deps: AdminConfigDeps) {
             );
           }
         }
-        filteredOverrides = { ...(overrides as Record<string, unknown>) } as Partial<TCustomConfig>;
         if (Object.keys(filteredIface).length > 0) {
           (filteredOverrides as Record<string, unknown>).interface = filteredIface;
         } else {
@@ -373,7 +407,7 @@ export function createAdminConfigHandlers(deps: AdminConfigDeps) {
   /**
    * PATCH /:principalType/:principalId/fields — Set individual fields via dot-paths.
    */
-  async function patchConfigField(req: ServerRequest, res: Response) {
+  async function patchConfigField(req: ServerRequest, res: Response): Promise<Response> {
     try {
       const { principalType, principalId } = req.params as {
         principalType: string;
@@ -417,6 +451,12 @@ export function createAdminConfigHandlers(deps: AdminConfigDeps) {
       }
 
       const validEntries = entries.filter((entry) => {
+        if (isBaseOnlyFieldPath(entry.fieldPath)) {
+          logger.warn(
+            `[adminConfig] Stripping base-only config field "${entry.fieldPath}" - configure it in librechat.yaml instead`,
+          );
+          return false;
+        }
         if (isInterfacePermissionPath(entry.fieldPath)) {
           logger.warn(
             `[adminConfig] Stripping interface permission field "${entry.fieldPath}" — use role permissions instead`,
@@ -479,10 +519,84 @@ export function createAdminConfigHandlers(deps: AdminConfigDeps) {
     }
   }
 
+  /**
+   * POST /:principalType/:principalId/fields/tombstone — Suppress an inherited config path.
+   */
+  async function tombstoneConfigField(req: ServerRequest, res: Response): Promise<Response> {
+    try {
+      const { principalType, principalId } = req.params as {
+        principalType: string;
+        principalId: string;
+      };
+
+      if (!validatePrincipalType(principalType)) {
+        return res.status(400).json({ error: `Invalid principalType: ${principalType}` });
+      }
+
+      const { fieldPath, priority } = req.body as {
+        fieldPath?: string;
+        priority?: number;
+      };
+
+      if (!fieldPath || typeof fieldPath !== 'string') {
+        return res.status(400).json({ error: 'fieldPath is required' });
+      }
+
+      if (priority != null && (typeof priority !== 'number' || priority < 0)) {
+        return res.status(400).json({ error: 'priority must be a non-negative number' });
+      }
+
+      if (!isValidFieldPath(fieldPath)) {
+        return res.status(400).json({ error: `Invalid or unsafe field path: ${fieldPath}` });
+      }
+
+      const user = getCapabilityUser(req);
+      if (!user) {
+        return res.status(401).json({ error: 'Authentication required' });
+      }
+
+      const section = getTopLevelSection(fieldPath);
+
+      if (!(await hasConfigCapability(user, section as ConfigSection, 'manage'))) {
+        return res.status(403).json({
+          error: `Insufficient permissions for config section: ${section}`,
+        });
+      }
+
+      if (isInterfacePermissionPath(fieldPath)) {
+        logger.warn(
+          `[adminConfig] Ignoring tombstone for interface permission field "${fieldPath}" — use role permissions instead`,
+        );
+        return res.status(200).json({ message: 'No actionable field path provided' });
+      }
+
+      const existing =
+        priority == null
+          ? await findConfigByPrincipal(principalType, principalId, { includeInactive: true })
+          : null;
+
+      const config = await writeConfigTombstone(
+        principalType,
+        principalId,
+        principalModel(principalType),
+        fieldPath,
+        priority ?? existing?.priority ?? DEFAULT_PRIORITY,
+      );
+
+      invalidateConfigCaches?.(user.tenantId)?.catch((err) =>
+        logger.error('[adminConfig] Cache invalidation failed after field tombstone:', err),
+      );
+      return res.status(200).json({ config });
+    } catch (error) {
+      logger.error('[adminConfig] tombstoneConfigField error:', error);
+      return res.status(500).json({ error: 'Failed to tombstone config field' });
+    }
+  }
+
   /**
    * DELETE /:principalType/:principalId/fields?fieldPath=dotted.path
    */
-  async function deleteConfigField(req: ServerRequest, res: Response) {
+  async function deleteConfigField(req: ServerRequest, res: Response): Promise<Response> {
     try {
       const { principalType, principalId } = req.params as {
         principalType: string;
@@ -515,6 +629,13 @@ export function createAdminConfigHandlers(deps: AdminConfigDeps) {
         });
       }
 
+      if (isBaseOnlyFieldPath(fieldPath)) {
+        logger.warn(
+          `[adminConfig] Ignoring delete for base-only config field "${fieldPath}" - configure it in librechat.yaml instead`,
+        );
+        return res.status(200).json({ message: 'No actionable field path provided' });
+      }
+
       if (isInterfacePermissionPath(fieldPath)) {
         logger.warn(
           `[adminConfig] Ignoring delete for interface permission field "${fieldPath}" — use role permissions instead`,
@@ -540,7 +661,7 @@ export function createAdminConfigHandlers(deps: AdminConfigDeps) {
   /**
    * DELETE /:principalType/:principalId — Delete an entire config override.
    */
-  async function deleteConfigOverrides(req: ServerRequest, res: Response) {
+  async function deleteConfigOverrides(req: ServerRequest, res: Response): Promise<Response> {
     try {
       const { principalType, principalId } = req.params as {
         principalType: string;
@@ -578,7 +699,7 @@ export function createAdminConfigHandlers(deps: AdminConfigDeps) {
   /**
    * PATCH /:principalType/:principalId/active — Toggle isActive.
    */
-  async function toggleConfig(req: ServerRequest, res: Response) {
+  async function toggleConfig(req: ServerRequest, res: Response): Promise<Response> {
     try {
       const { principalType, principalId } = req.params as {
         principalType: string;
@@ -624,6 +745,7 @@ export function createAdminConfigHandlers(deps: AdminConfigDeps) {
     getConfig,
     upsertConfigOverrides,
     patchConfigField,
+    tombstoneConfigField,
     deleteConfigField,
     deleteConfigOverrides,
     toggleConfig,
diff --git a/packages/api/src/admin/grants.ts b/packages/api/src/admin/grants.ts
index b7205d6c7cc..f5d42ce0713 100644
--- a/packages/api/src/admin/grants.ts
+++ b/packages/api/src/admin/grants.ts
@@ -78,7 +78,13 @@ export interface AdminGrantsDeps {
 export type GrantPrincipalType = PrincipalType.ROLE;
 
 /** Creates admin grant handlers with dependency injection for the /api/admin/grants routes. */
-export function createAdminGrantsHandlers(deps: AdminGrantsDeps) {
+export function createAdminGrantsHandlers(deps: AdminGrantsDeps): {
+  listGrants: (req: ServerRequest, res: Response) => Promise<Response>;
+  getEffectiveCapabilities: (req: ServerRequest, res: Response) => Promise<Response>;
+  getPrincipalGrants: (req: ServerRequest, res: Response) => Promise<Response>;
+  assignGrant: (req: ServerRequest, res: Response) => Promise<Response>;
+  revokeGrant: (req: ServerRequest, res: Response) => Promise<Response>;
+} {
   const {
     listGrants,
     countGrants,
diff --git a/packages/api/src/admin/groups.ts b/packages/api/src/admin/groups.ts
index 41dfba6cac2..d37ca3d294a 100644
--- a/packages/api/src/admin/groups.ts
+++ b/packages/api/src/admin/groups.ts
@@ -84,7 +84,16 @@ export interface AdminGroupsDeps {
   }) => Promise<DeleteResult>;
 }
 
-export function createAdminGroupsHandlers(deps: AdminGroupsDeps) {
+export function createAdminGroupsHandlers(deps: AdminGroupsDeps): {
+  listGroups: (req: ServerRequest, res: Response) => Promise<Response>;
+  getGroup: (req: ServerRequest, res: Response) => Promise<Response>;
+  createGroup: (req: ServerRequest, res: Response) => Promise<Response>;
+  updateGroup: (req: ServerRequest, res: Response) => Promise<Response>;
+  deleteGroup: (req: ServerRequest, res: Response) => Promise<Response>;
+  getGroupMembers: (req: ServerRequest, res: Response) => Promise<Response>;
+  addGroupMember: (req: ServerRequest, res: Response) => Promise<Response>;
+  removeGroupMember: (req: ServerRequest, res: Response) => Promise<Response>;
+} {
   const {
     listGroups,
     countGroups,
diff --git a/packages/api/src/admin/index.ts b/packages/api/src/admin/index.ts
index 038ca239154..90f826d7bfc 100644
--- a/packages/api/src/admin/index.ts
+++ b/packages/api/src/admin/index.ts
@@ -2,9 +2,11 @@ export { createAdminConfigHandlers } from './config';
 export { createAdminGrantsHandlers } from './grants';
 export { createAdminGroupsHandlers } from './groups';
 export { createAdminRolesHandlers } from './roles';
+export { createAdminSkillsSyncAccess, createAdminSkillsSyncHandlers } from './skills';
 export { createAdminUsersHandlers } from './users';
 export type { AdminConfigDeps } from './config';
 export type { AdminGrantsDeps, GrantPrincipalType } from './grants';
 export type { AdminGroupsDeps } from './groups';
 export type { AdminRolesDeps } from './roles';
+export type { AdminSkillSyncAccessDeps, AdminSkillSyncDeps } from './skills';
 export type { AdminUsersDeps } from './users';
diff --git a/packages/api/src/admin/roles.ts b/packages/api/src/admin/roles.ts
index db592c02d02..910e962a5cf 100644
--- a/packages/api/src/admin/roles.ts
+++ b/packages/api/src/admin/roles.ts
@@ -123,7 +123,17 @@ export interface AdminRolesDeps {
   ) => Promise<void>;
 }
 
-export function createAdminRolesHandlers(deps: AdminRolesDeps) {
+export function createAdminRolesHandlers(deps: AdminRolesDeps): {
+  listRoles: (req: ServerRequest, res: Response) => Promise<Response>;
+  getRole: (req: ServerRequest, res: Response) => Promise<Response>;
+  createRole: (req: ServerRequest, res: Response) => Promise<Response>;
+  updateRole: (req: ServerRequest, res: Response) => Promise<Response>;
+  updateRolePermissions: (req: ServerRequest, res: Response) => Promise<Response>;
+  deleteRole: (req: ServerRequest, res: Response) => Promise<Response>;
+  getRoleMembers: (req: ServerRequest, res: Response) => Promise<Response>;
+  addRoleMember: (req: ServerRequest, res: Response) => Promise<Response>;
+  removeRoleMember: (req: ServerRequest, res: Response) => Promise<Response>;
+} {
   const {
     listRoles,
     countRoles,
diff --git a/packages/api/src/admin/skills.spec.ts b/packages/api/src/admin/skills.spec.ts
new file mode 100644
index 00000000000..ce5e970d5ba
--- /dev/null
+++ b/packages/api/src/admin/skills.spec.ts
@@ -0,0 +1,454 @@
+import { SystemCapabilities } from '@librechat/data-schemas';
+import type { ISkillSyncStatus } from '@librechat/data-schemas';
+import type { NextFunction, Response } from 'express';
+import { createAdminSkillsSyncAccess, createAdminSkillsSyncHandlers } from './skills';
+
+function createResponse() {
+  const res = {
+    status: jest.fn().mockReturnThis(),
+    json: jest.fn().mockReturnThis(),
+  };
+  return res as unknown as Response & {
+    status: jest.Mock;
+    json: jest.Mock;
+  };
+}
+
+function createNext(): NextFunction & jest.Mock {
+  return jest.fn() as NextFunction & jest.Mock;
+}
+
+type SourceStatus = ISkillSyncStatus & { credentialPresent: boolean };
+
+function createSourceStatus(overrides: Partial<SourceStatus> = {}): SourceStatus {
+  return {
+    provider: 'github',
+    sourceId: 'tenant-skills',
+    tenantId: 'tenant-a',
+    status: 'idle',
+    credentialKey: 'github-skills-prod',
+    credentialPresent: true,
+    owner: 'LibreChat',
+    repo: 'skills',
+    ref: 'main',
+    paths: ['skills'],
+    syncedSkillCount: 0,
+    syncedFileCount: 0,
+    deletedSkillCount: 0,
+    deletedFileCount: 0,
+    errorCode: undefined,
+    errorMessage: undefined,
+    startedAt: undefined,
+    finishedAt: undefined,
+    lastSuccessAt: undefined,
+    lastFailureAt: undefined,
+    createdAt: undefined,
+    updatedAt: undefined,
+    ...overrides,
+  };
+}
+
+function createHandlers({
+  statusErrorCode,
+  statusErrorMessage,
+}: { statusErrorCode?: string; statusErrorMessage?: string } = {}) {
+  const runner = {
+    getStatus: jest.fn(async () => ({
+      enabled: true,
+      intervalMinutes: 60,
+      runOnStartup: false,
+      sources: [
+        createSourceStatus({
+          errorCode: statusErrorCode,
+          errorMessage: statusErrorMessage,
+        }),
+      ],
+      credentials: [
+        {
+          provider: 'github' as const,
+          credentialKey: 'github-skills-prod',
+          credentialPresent: true,
+          tokenFingerprint: 'abc123',
+        },
+      ],
+      fineGrainedTokenRecommendation: 'Use a fine-grained token.',
+    })),
+    runOnce: jest.fn(async () => ({
+      status: 'completed' as const,
+      sources: [
+        createSourceStatus({
+          status: 'succeeded',
+          syncedSkillCount: 1,
+          syncedFileCount: 2,
+          errorCode: statusErrorCode,
+          errorMessage: statusErrorMessage,
+        }),
+      ],
+    })),
+  };
+  const handlers = createAdminSkillsSyncHandlers({
+    runner,
+    upsertCredential: jest.fn(),
+    deleteCredential: jest.fn(),
+  });
+  return { handlers, runner };
+}
+
+describe('createAdminSkillsSyncHandlers', () => {
+  it('omits credential summaries and source credential metadata for tenant-scoped status reads', async () => {
+    const { handlers } = createHandlers();
+    const res = createResponse();
+
+    await handlers.getSyncStatus(
+      {
+        user: { id: 'user-1', tenantId: 'tenant-a' },
+        skillSyncCanReadCredentials: false,
+      } as never,
+      res,
+    );
+
+    expect(res.status).toHaveBeenCalledWith(200);
+    expect(res.json).toHaveBeenCalledWith(
+      expect.objectContaining({
+        credentials: [],
+        sources: [
+          expect.objectContaining({
+            credentialKey: undefined,
+            credentialPresent: false,
+            owner: undefined,
+            repo: undefined,
+            ref: undefined,
+            paths: undefined,
+          }),
+        ],
+      }),
+    );
+  });
+
+  it('filters tenant-scoped status reads to the request tenant and unscoped sources', async () => {
+    const runner = {
+      getStatus: jest.fn(async () => ({
+        enabled: true,
+        intervalMinutes: 60,
+        runOnStartup: false,
+        sources: [
+          createSourceStatus({
+            sourceId: 'tenant-a-source',
+            tenantId: 'tenant-a',
+            status: 'succeeded',
+            syncedSkillCount: 4,
+            syncedFileCount: 8,
+          }),
+          createSourceStatus({
+            sourceId: 'shared-source',
+            tenantId: undefined,
+            status: 'succeeded',
+            syncedSkillCount: 2,
+            syncedFileCount: 3,
+          }),
+          createSourceStatus({
+            sourceId: 'tenant-b-source',
+            tenantId: 'tenant-b',
+            status: 'failed',
+            errorCode: 'PARSE_ERROR',
+            errorMessage: 'Failed to parse skills/private-b/SKILL.md',
+            syncedSkillCount: 7,
+            syncedFileCount: 11,
+            deletedSkillCount: 1,
+            deletedFileCount: 2,
+          }),
+        ],
+        credentials: [],
+        fineGrainedTokenRecommendation: 'Use a fine-grained token.',
+      })),
+      runOnce: jest.fn(),
+    };
+    const handlers = createAdminSkillsSyncHandlers({
+      runner,
+      upsertCredential: jest.fn(),
+      deleteCredential: jest.fn(),
+    });
+    const res = createResponse();
+
+    await handlers.getSyncStatus(
+      {
+        user: { id: 'user-1', tenantId: 'tenant-a' },
+        skillSyncCanReadCredentials: false,
+      } as never,
+      res,
+    );
+
+    expect(res.json).toHaveBeenCalledWith(
+      expect.objectContaining({
+        sources: [
+          expect.objectContaining({
+            sourceId: 'tenant-a-source',
+            tenantId: 'tenant-a',
+            status: 'succeeded',
+            syncedSkillCount: 4,
+            syncedFileCount: 8,
+          }),
+          expect.objectContaining({
+            sourceId: 'shared-source',
+            tenantId: undefined,
+            status: 'succeeded',
+            syncedSkillCount: 2,
+            syncedFileCount: 3,
+          }),
+        ],
+      }),
+    );
+    const response = res.json.mock.calls[0]?.[0] as { sources: Array<{ tenantId?: string }> };
+    expect(response.sources).toHaveLength(2);
+    expect(response.sources).toEqual([
+      expect.objectContaining({ sourceId: 'tenant-a-source' }),
+      expect.objectContaining({ sourceId: 'shared-source', tenantId: undefined }),
+    ]);
+  });
+
+  it('redacts credential-related errors from tenant-scoped status reads', async () => {
+    const { handlers } = createHandlers({
+      statusErrorCode: 'MISSING_CREDENTIAL',
+      statusErrorMessage: 'Missing GitHub token environment variable "GITHUB_SKILLS_TOKEN"',
+    });
+    const res = createResponse();
+
+    await handlers.getSyncStatus(
+      {
+        user: { id: 'user-1', tenantId: 'tenant-a' },
+        skillSyncCanReadCredentials: false,
+      } as never,
+      res,
+    );
+
+    expect(res.json).toHaveBeenCalledWith(
+      expect.objectContaining({
+        sources: [
+          expect.objectContaining({
+            errorCode: 'MISSING_CREDENTIAL',
+            errorMessage: 'GitHub skill sync credentials are not available',
+          }),
+        ],
+      }),
+    );
+  });
+
+  it('includes credential summaries and source credential metadata for platform status reads', async () => {
+    const { handlers } = createHandlers({
+      statusErrorCode: 'MISSING_CREDENTIAL',
+      statusErrorMessage: 'Missing GitHub credential "github-skills-prod"',
+    });
+    const res = createResponse();
+
+    await handlers.getSyncStatus({ skillSyncCanReadCredentials: true } as never, res);
+
+    expect(res.json).toHaveBeenCalledWith(
+      expect.objectContaining({
+        credentials: [expect.objectContaining({ credentialKey: 'github-skills-prod' })],
+        sources: [
+          expect.objectContaining({
+            credentialKey: 'github-skills-prod',
+            credentialPresent: true,
+            owner: 'LibreChat',
+            repo: 'skills',
+            ref: 'main',
+            paths: ['skills'],
+            errorMessage: 'Missing GitHub credential "github-skills-prod"',
+          }),
+        ],
+      }),
+    );
+  });
+
+  it('omits source credential metadata from tenant-scoped manual run responses', async () => {
+    const { handlers } = createHandlers({
+      statusErrorCode: 'MISSING_CREDENTIAL',
+      statusErrorMessage: 'Missing GitHub credential "github-skills-prod"',
+    });
+    const res = createResponse();
+
+    await handlers.runSync(
+      {
+        skillSyncAllowServerCredentials: true,
+        skillSyncCanReadCredentials: false,
+      } as never,
+      res,
+    );
+
+    expect(res.json).toHaveBeenCalledWith(
+      expect.objectContaining({
+        sources: [
+          expect.objectContaining({
+            credentialKey: undefined,
+            credentialPresent: false,
+            errorMessage: 'GitHub skill sync credentials are not available',
+          }),
+        ],
+      }),
+    );
+  });
+});
+
+describe('createAdminSkillsSyncAccess', () => {
+  const baseSkillSync = {
+    github: {
+      enabled: true,
+      intervalMinutes: 60,
+      runOnStartup: false,
+      sources: [
+        {
+          id: 'base-skills',
+          owner: 'LibreChat',
+          repo: 'skills',
+          ref: 'main',
+          paths: ['skills'],
+          token: '${GITHUB_SKILLS_TOKEN}',
+        },
+      ],
+    },
+  };
+
+  function createAccess({
+    hasCapability = jest.fn().mockResolvedValue(true),
+    getAppConfig = jest.fn().mockResolvedValue({ skillSync: undefined }),
+  }: {
+    hasCapability?: jest.Mock;
+    getAppConfig?: jest.Mock;
+  } = {}) {
+    return {
+      access: createAdminSkillsSyncAccess({ getAppConfig, hasCapability }),
+      getAppConfig,
+      hasCapability,
+    };
+  }
+
+  it('attaches the base skill sync config for override comparison', async () => {
+    const getAppConfig = jest.fn().mockResolvedValue({ skillSync: baseSkillSync });
+    const { access } = createAccess({ getAppConfig });
+    const req = { config: { skillSync: undefined, config: { endpoints: {} } } };
+    const res = createResponse();
+    const next = createNext();
+
+    await access.attachBaseSkillSyncConfig(req as never, res, next);
+
+    expect(getAppConfig).toHaveBeenCalledWith({ baseOnly: true });
+    expect(req.config.config).toEqual({ endpoints: {}, skillSync: baseSkillSync });
+    expect(next).toHaveBeenCalledTimes(1);
+  });
+
+  it('marks credential metadata hidden for tenant-scoped status reads', async () => {
+    const hasCapability = jest.fn(
+      async (user: { tenantId?: string }, capability: string): Promise<boolean> => {
+        if (capability === SystemCapabilities.READ_SKILLS) {
+          return Boolean(user.tenantId);
+        }
+        return true;
+      },
+    );
+    const { access } = createAccess({ hasCapability });
+    const req = { user: { id: 'user-1', role: 'ADMIN', tenantId: 'tenant-a' } };
+    const res = createResponse();
+    const next = createNext();
+
+    await access.requireReadSkills(req as never, res, next);
+    await access.attachCredentialReadAccess(req as never, res, next);
+
+    expect(req).toMatchObject({
+      skillSyncCanReadCredentials: false,
+      skillSyncAllowServerCredentials: false,
+    });
+    expect(hasCapability).toHaveBeenCalledWith(
+      { id: 'user-1', role: 'ADMIN', tenantId: 'tenant-a' },
+      SystemCapabilities.READ_SKILLS,
+    );
+    expect(hasCapability).toHaveBeenCalledWith(
+      { id: 'user-1', role: 'ADMIN' },
+      SystemCapabilities.READ_SKILLS,
+    );
+  });
+
+  it('prevents tenant admins from running overrides that require server credentials', async () => {
+    const tenantSkillSync = {
+      github: {
+        enabled: true,
+        intervalMinutes: 60,
+        runOnStartup: false,
+        sources: [
+          {
+            id: 'tenant-skills',
+            owner: 'LibreChat',
+            repo: 'skills',
+            ref: 'main',
+            paths: ['skills'],
+            token: '${GITHUB_SKILLS_TOKEN}',
+          },
+        ],
+      },
+    };
+    const hasCapability = jest.fn(
+      async (user: { tenantId?: string }, capability: string): Promise<boolean> => {
+        if (capability === SystemCapabilities.MANAGE_SKILLS) {
+          return Boolean(user.tenantId);
+        }
+        return true;
+      },
+    );
+    const { access } = createAccess({ hasCapability });
+    const req = {
+      user: { id: 'user-1', role: 'ADMIN', tenantId: 'tenant-a' },
+      config: { skillSync: tenantSkillSync, config: {} },
+    };
+    const res = createResponse();
+    const next = createNext();
+
+    await access.requireSyncRunCapability(req as never, res, next);
+
+    expect(res.status).toHaveBeenCalledWith(403);
+    expect(res.json).toHaveBeenCalledWith({
+      message: 'Tenant-scoped manual skill sync requires platform credential access',
+    });
+    expect(next).not.toHaveBeenCalled();
+  });
+
+  it('prevents tenant admins from manually running base skill sync config', async () => {
+    const hasCapability = jest.fn(
+      async (user: { tenantId?: string }, capability: string): Promise<boolean> => {
+        if (capability === SystemCapabilities.MANAGE_SKILLS) {
+          return Boolean(user.tenantId);
+        }
+        return true;
+      },
+    );
+    const { access } = createAccess({ hasCapability });
+    const req = {
+      user: { id: 'user-1', role: 'ADMIN', tenantId: 'tenant-a' },
+      config: { skillSync: baseSkillSync, config: { skillSync: baseSkillSync } },
+    };
+    const res = createResponse();
+    const next = createNext();
+
+    await access.requireSyncRunCapability(req as never, res, next);
+
+    expect(res.status).toHaveBeenCalledWith(403);
+    expect(res.json).toHaveBeenCalledWith({ message: 'Forbidden' });
+    expect(next).not.toHaveBeenCalled();
+  });
+
+  it('allows platform admins to manually run base skill sync config with server credentials', async () => {
+    const { access } = createAccess();
+    const req = {
+      user: { id: 'user-1', role: 'ADMIN', tenantId: 'tenant-a' },
+      config: { skillSync: baseSkillSync, config: { skillSync: baseSkillSync } },
+    };
+    const res = createResponse();
+    const next = createNext();
+
+    await access.requireSyncRunCapability(req as never, res, next);
+
+    expect(req).toMatchObject({
+      skillSyncAllowServerCredentials: true,
+      skillSyncCanReadCredentials: true,
+    });
+    expect(next).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/packages/api/src/admin/skills.ts b/packages/api/src/admin/skills.ts
new file mode 100644
index 00000000000..8d481047f8d
--- /dev/null
+++ b/packages/api/src/admin/skills.ts
@@ -0,0 +1,410 @@
+import { SystemCapabilities } from '@librechat/data-schemas';
+import { skillSyncConfigSchema } from 'librechat-data-provider';
+import type {
+  TGitHubSkillSyncStatusResponse,
+  TGitHubSkillSyncSourceStatus,
+  TGitHubSkillSyncCredentialSummary,
+  TGitHubSkillSyncManualRunResponse,
+  SkillSyncConfig,
+} from 'librechat-data-provider';
+import type {
+  ISkillSyncStatus,
+  SkillSyncProvider,
+  SkillSyncCredentialSummary,
+  UpsertSkillSyncCredentialInput,
+  SystemCapability,
+} from '@librechat/data-schemas';
+import type { NextFunction, Request, RequestHandler, Response } from 'express';
+import type { Types } from 'mongoose';
+import type { GitHubSkillSyncRunner } from '~/skills/sync';
+
+export type AdminSkillsRequest = Request & {
+  user?: {
+    _id?: Types.ObjectId;
+    id?: string;
+    tenantId?: string;
+  };
+  skillSyncAllowServerCredentials?: boolean;
+  skillSyncCanReadCredentials?: boolean;
+};
+
+type SkillSyncConfigContainer = {
+  skillSync?: unknown;
+  config?: {
+    skillSync?: unknown;
+  } & Record<string, unknown>;
+} & Record<string, unknown>;
+
+type AdminSkillSyncAccessRequest = Request & {
+  user?: {
+    _id?: Types.ObjectId | { toString(): string };
+    id?: string;
+    role?: string;
+    tenantId?: string;
+  };
+  config?: SkillSyncConfigContainer;
+  skillSyncAllowServerCredentials?: boolean;
+  skillSyncCanReadCredentials?: boolean;
+};
+
+type SkillSyncCapabilityUser = {
+  id: string;
+  role: string;
+  tenantId?: string;
+};
+
+export type AdminSkillSyncDeps = {
+  runner?: GitHubSkillSyncRunner;
+  getRunner?: (req: Request) => GitHubSkillSyncRunner;
+  upsertCredential: (input: UpsertSkillSyncCredentialInput) => Promise<SkillSyncCredentialSummary>;
+  deleteCredential: (
+    provider: SkillSyncProvider,
+    credentialKey: string,
+  ) => Promise<{ deleted: boolean }>;
+};
+
+export type AdminSkillSyncAccessDeps = {
+  getAppConfig: (options: { baseOnly: true }) => Promise<{ skillSync?: unknown } | undefined>;
+  hasCapability: (user: SkillSyncCapabilityUser, capability: SystemCapability) => Promise<boolean>;
+};
+
+type AdminSkillsSyncHandler = (req: AdminSkillsRequest, res: Response) => Promise<Response>;
+
+export type AdminSkillsSyncHandlers = {
+  getSyncStatus: AdminSkillsSyncHandler;
+  runSync: AdminSkillsSyncHandler;
+  setCredential: AdminSkillsSyncHandler;
+  deleteCredential: (req: Request, res: Response) => Promise<Response>;
+};
+
+export type AdminSkillsSyncAccess = {
+  attachBaseSkillSyncConfig: RequestHandler;
+  attachCredentialReadAccess: RequestHandler;
+  requireReadSkills: RequestHandler;
+  requirePlatformManageSkills: RequestHandler;
+  requireSyncRunCapability: RequestHandler;
+};
+
+const CREDENTIAL_KEY_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/;
+
+function toIso(date: Date | undefined): string | undefined {
+  return date ? date.toISOString() : undefined;
+}
+
+function serializeCredential(
+  credential: SkillSyncCredentialSummary,
+): TGitHubSkillSyncCredentialSummary {
+  return {
+    provider: credential.provider,
+    credentialKey: credential.credentialKey,
+    credentialPresent: credential.credentialPresent,
+    tokenFingerprint: credential.tokenFingerprint,
+    createdAt: toIso(credential.createdAt),
+    updatedAt: toIso(credential.updatedAt),
+  };
+}
+
+function isCredentialError(status: ISkillSyncStatus): boolean {
+  if (status.errorCode === 'MISSING_CREDENTIAL') {
+    return true;
+  }
+  return /credential|token environment variable|server github credentials/i.test(
+    status.errorMessage ?? '',
+  );
+}
+
+function serializeErrorMessage(
+  status: ISkillSyncStatus,
+  { includeCredentialMetadata }: { includeCredentialMetadata: boolean },
+): string | undefined {
+  if (includeCredentialMetadata || !isCredentialError(status)) {
+    return status.errorMessage;
+  }
+  return 'GitHub skill sync credentials are not available';
+}
+
+function serializeSourceStatus(
+  status: ISkillSyncStatus & { credentialPresent?: boolean },
+  { includeCredentialMetadata = true }: { includeCredentialMetadata?: boolean } = {},
+): TGitHubSkillSyncSourceStatus {
+  const includePrivateSourceMetadata = includeCredentialMetadata;
+  return {
+    provider: status.provider,
+    sourceId: status.sourceId,
+    tenantId: status.tenantId,
+    status: status.status,
+    credentialKey: includeCredentialMetadata ? status.credentialKey : undefined,
+    credentialPresent: includeCredentialMetadata ? (status.credentialPresent ?? false) : false,
+    owner: includePrivateSourceMetadata ? status.owner : undefined,
+    repo: includePrivateSourceMetadata ? status.repo : undefined,
+    ref: includePrivateSourceMetadata ? status.ref : undefined,
+    paths: includePrivateSourceMetadata ? status.paths : undefined,
+    startedAt: toIso(status.startedAt),
+    finishedAt: toIso(status.finishedAt),
+    lastSuccessAt: toIso(status.lastSuccessAt),
+    lastFailureAt: toIso(status.lastFailureAt),
+    errorCode: status.errorCode,
+    errorMessage: serializeErrorMessage(status, { includeCredentialMetadata }),
+    syncedSkillCount: status.syncedSkillCount,
+    syncedFileCount: status.syncedFileCount,
+    deletedSkillCount: status.deletedSkillCount,
+    deletedFileCount: status.deletedFileCount,
+    createdAt: toIso(status.createdAt),
+    updatedAt: toIso(status.updatedAt),
+  };
+}
+
+function getRequestTenantId(req: AdminSkillsRequest): string | undefined {
+  const tenantId = req.user?.tenantId;
+  return typeof tenantId === 'string' && tenantId ? tenantId : undefined;
+}
+
+function getVisibleSourceStatuses<T extends ISkillSyncStatus>(
+  req: AdminSkillsRequest,
+  sources: T[],
+): T[] {
+  if (req.skillSyncCanReadCredentials !== false) {
+    return sources;
+  }
+  const tenantId = getRequestTenantId(req);
+  if (!tenantId) {
+    return [];
+  }
+  return sources.filter((source) => !source.tenantId || source.tenantId === tenantId);
+}
+
+function isCredentialKey(value: unknown): value is string {
+  return typeof value === 'string' && CREDENTIAL_KEY_PATTERN.test(value);
+}
+
+function getUserObjectId(req: AdminSkillsRequest): Types.ObjectId | undefined {
+  return req.user?._id;
+}
+
+function getCapabilityUser(
+  req: AdminSkillSyncAccessRequest,
+  { platformOnly = false }: { platformOnly?: boolean } = {},
+): SkillSyncCapabilityUser | null {
+  const id = req.user?.id ?? req.user?._id?.toString?.();
+  if (!id) {
+    return null;
+  }
+  return {
+    id,
+    role: req.user?.role ?? '',
+    ...(platformOnly ? {} : { tenantId: req.user?.tenantId }),
+  };
+}
+
+function parseSkillSyncConfig(raw: unknown): SkillSyncConfig | undefined {
+  if (!raw || typeof raw !== 'object') {
+    return undefined;
+  }
+  const parsed = skillSyncConfigSchema.safeParse(raw);
+  return parsed.success ? parsed.data : undefined;
+}
+
+function isSameSkillSyncConfig(left: SkillSyncConfig, right: SkillSyncConfig): boolean {
+  return JSON.stringify(left ?? null) === JSON.stringify(right ?? null);
+}
+
+function hasResolvedSkillSyncOverride(req: AdminSkillSyncAccessRequest): boolean {
+  const resolved = parseSkillSyncConfig(req.config?.skillSync);
+  const base = parseSkillSyncConfig(req.config?.config?.skillSync);
+  return Boolean(resolved?.github && !isSameSkillSyncConfig(resolved, base));
+}
+
+function sendInternalServerError(res: Response): void {
+  res.status(500).json({ message: 'Internal Server Error' });
+}
+
+export function createAdminSkillsSyncAccess(deps: AdminSkillSyncAccessDeps): AdminSkillsSyncAccess {
+  async function hasSkillCapability(
+    req: AdminSkillSyncAccessRequest,
+    capability: SystemCapability,
+    { platformOnly = false }: { platformOnly?: boolean } = {},
+  ): Promise<boolean> {
+    const user = getCapabilityUser(req, { platformOnly });
+    if (!user) {
+      return false;
+    }
+    return deps.hasCapability(user, capability);
+  }
+
+  function requireSkillCapability(
+    capability: SystemCapability,
+    { platformOnly = false }: { platformOnly?: boolean } = {},
+  ): RequestHandler {
+    return async (
+      req: AdminSkillSyncAccessRequest,
+      res: Response,
+      next: NextFunction,
+    ): Promise<void> => {
+      try {
+        const user = getCapabilityUser(req, { platformOnly });
+        if (!user) {
+          res.status(401).json({ message: 'Authentication required' });
+          return;
+        }
+        if (await deps.hasCapability(user, capability)) {
+          next();
+          return;
+        }
+        res.status(403).json({ message: 'Forbidden' });
+      } catch {
+        sendInternalServerError(res);
+      }
+    };
+  }
+
+  const attachBaseSkillSyncConfig: RequestHandler = async (
+    req: AdminSkillSyncAccessRequest,
+    res: Response,
+    next: NextFunction,
+  ): Promise<void> => {
+    try {
+      const baseConfig = await deps.getAppConfig({ baseOnly: true });
+      const existingConfig = req.config ?? {};
+      req.config = {
+        ...existingConfig,
+        config: {
+          ...(existingConfig.config ?? {}),
+          skillSync: baseConfig?.skillSync,
+        },
+      };
+      next();
+    } catch {
+      sendInternalServerError(res);
+    }
+  };
+
+  const attachCredentialReadAccess: RequestHandler = async (
+    req: AdminSkillSyncAccessRequest,
+    res: Response,
+    next: NextFunction,
+  ): Promise<void> => {
+    try {
+      const canReadCredentials = await hasSkillCapability(req, SystemCapabilities.READ_SKILLS, {
+        platformOnly: true,
+      });
+      req.skillSyncCanReadCredentials = canReadCredentials;
+      req.skillSyncAllowServerCredentials = canReadCredentials;
+      next();
+    } catch {
+      sendInternalServerError(res);
+    }
+  };
+
+  const requireSyncRunCapability: RequestHandler = async (
+    req: AdminSkillSyncAccessRequest,
+    res: Response,
+    next: NextFunction,
+  ): Promise<void> => {
+    try {
+      const canManagePlatform = await hasSkillCapability(req, SystemCapabilities.MANAGE_SKILLS, {
+        platformOnly: true,
+      });
+      if (canManagePlatform) {
+        req.skillSyncAllowServerCredentials = true;
+        req.skillSyncCanReadCredentials = true;
+        next();
+        return;
+      }
+      if (
+        hasResolvedSkillSyncOverride(req) &&
+        (await hasSkillCapability(req, SystemCapabilities.MANAGE_SKILLS))
+      ) {
+        res.status(403).json({
+          message: 'Tenant-scoped manual skill sync requires platform credential access',
+        });
+        return;
+      }
+      res.status(403).json({ message: 'Forbidden' });
+    } catch {
+      sendInternalServerError(res);
+    }
+  };
+
+  return {
+    attachBaseSkillSyncConfig,
+    attachCredentialReadAccess,
+    requireReadSkills: requireSkillCapability(SystemCapabilities.READ_SKILLS),
+    requirePlatformManageSkills: requireSkillCapability(SystemCapabilities.MANAGE_SKILLS, {
+      platformOnly: true,
+    }),
+    requireSyncRunCapability,
+  };
+}
+
+export function createAdminSkillsSyncHandlers(deps: AdminSkillSyncDeps): AdminSkillsSyncHandlers {
+  function getRunner(req: Request): GitHubSkillSyncRunner {
+    const runner = deps.getRunner?.(req) ?? deps.runner;
+    if (!runner) {
+      throw new Error('GitHub skill sync runner is not configured');
+    }
+    return runner;
+  }
+
+  async function getSyncStatus(req: AdminSkillsRequest, res: Response) {
+    const includeCredentialMetadata = req.skillSyncCanReadCredentials !== false;
+    const status = await getRunner(req).getStatus();
+    const response: TGitHubSkillSyncStatusResponse = {
+      enabled: status.enabled,
+      intervalMinutes: status.intervalMinutes,
+      runOnStartup: status.runOnStartup,
+      sources: getVisibleSourceStatuses(req, status.sources).map((source) =>
+        serializeSourceStatus(source, { includeCredentialMetadata }),
+      ),
+      credentials: includeCredentialMetadata ? status.credentials.map(serializeCredential) : [],
+      fineGrainedTokenRecommendation: status.fineGrainedTokenRecommendation,
+    };
+    return res.status(200).json(response);
+  }
+
+  async function runSync(req: AdminSkillsRequest, res: Response) {
+    const includeCredentialMetadata = req.skillSyncCanReadCredentials === true;
+    const result = await getRunner(req).runOnce();
+    const response: TGitHubSkillSyncManualRunResponse = {
+      status: result.status,
+      message: result.message,
+      sources: result.sources.map((source) =>
+        serializeSourceStatus(source, { includeCredentialMetadata }),
+      ),
+    };
+    return res.status(result.status === 'skipped' ? 202 : 200).json(response);
+  }
+
+  async function setCredential(req: AdminSkillsRequest, res: Response) {
+    const { credentialKey } = req.params;
+    if (!isCredentialKey(credentialKey)) {
+      return res.status(400).json({ error: 'Invalid credential key' });
+    }
+    const token = (req.body as { token?: unknown } | undefined)?.token;
+    if (typeof token !== 'string' || token.trim().length === 0) {
+      return res.status(400).json({ error: 'GitHub token is required' });
+    }
+    const credential = await deps.upsertCredential({
+      provider: 'github',
+      credentialKey,
+      token: token.trim(),
+      userId: getUserObjectId(req),
+    });
+    return res.status(200).json(serializeCredential(credential));
+  }
+
+  async function deleteCredential(req: Request, res: Response) {
+    const { credentialKey } = req.params;
+    if (!isCredentialKey(credentialKey)) {
+      return res.status(400).json({ error: 'Invalid credential key' });
+    }
+    const result = await deps.deleteCredential('github', credentialKey);
+    return res.status(200).json({ credentialKey, deleted: result.deleted });
+  }
+
+  return {
+    getSyncStatus,
+    runSync,
+    setCredential,
+    deleteCredential,
+  };
+}
diff --git a/packages/api/src/admin/users.ts b/packages/api/src/admin/users.ts
index 6fc13fd97fd..d24eb1b7594 100644
--- a/packages/api/src/admin/users.ts
+++ b/packages/api/src/admin/users.ts
@@ -42,7 +42,11 @@ export interface AdminUsersDeps {
   }) => Promise<void>;
 }
 
-export function createAdminUsersHandlers(deps: AdminUsersDeps) {
+export function createAdminUsersHandlers(deps: AdminUsersDeps): {
+  listUsers: (req: ServerRequest, res: Response) => Promise<Response>;
+  searchUsers: (req: ServerRequest, res: Response) => Promise<Response>;
+  deleteUser: (req: ServerRequest, res: Response) => Promise<Response>;
+} {
   const { findUsers, countUsers, deleteUserById, deleteConfig, deleteAclEntries } = deps;
 
   async function listUsersHandler(req: ServerRequest, res: Response) {
diff --git a/packages/api/src/agents/__tests__/initialize.test.ts b/packages/api/src/agents/__tests__/initialize.test.ts
index eba713916fb..1bec88f837b 100644
--- a/packages/api/src/agents/__tests__/initialize.test.ts
+++ b/packages/api/src/agents/__tests__/initialize.test.ts
@@ -33,7 +33,8 @@ jest.mock('@librechat/agents', () => ({
 }));
 
 import { Providers } from '@librechat/agents';
-import { EModelEndpoint, Tools } from 'librechat-data-provider';
+import { EModelEndpoint, EToolResources, Tools } from 'librechat-data-provider';
+import type { IMongoFile } from '@librechat/data-schemas';
 import type { Agent } from 'librechat-data-provider';
 import type { ServerRequest, InitializeResultBase, EndpointTokenConfig } from '~/types';
 import type { InitializeAgentDbMethods } from '../initialize';
@@ -338,6 +339,29 @@ describe('initializeAgent — provider web_search precedence', () => {
     jest.clearAllMocks();
   });
 
+  async function initializeGoogleMixedToolAgent(model: string, provider = Providers.GOOGLE) {
+    const { agent, req, res, loadTools, db } = createMocks({
+      provider,
+      model,
+      providerTools: [nativeGoogleSearchTool],
+      loadedToolDefinitions: [mcpToolDefinition],
+    });
+    agent.tools = ['mcp_lookup'];
+
+    return initializeAgent(
+      {
+        req,
+        res,
+        agent,
+        loadTools,
+        endpointOption: { endpoint: EModelEndpoint.agents },
+        allowedProviders: new Set([provider]),
+        isInitialAgent: true,
+      },
+      db,
+    );
+  }
+
   it('keeps Anthropic native web_search when LibreChat search is not selected', async () => {
     const { agent, req, res, loadTools, db } = createMocks({
       provider: Providers.ANTHROPIC,
@@ -438,31 +462,126 @@ describe('initializeAgent — provider web_search precedence', () => {
     expect(result.tools).toEqual([nativeGoogleSearchTool]);
     expect(countGoogleSearchTools(result.tools)).toBe(1);
     expect(result.toolDefinitions).toContain(mcpToolDefinition);
+    expect(result.model_parameters).toEqual(
+      expect.objectContaining({
+        includeServerSideToolInvocations: true,
+      }),
+    );
   });
 
-  it('rejects Google native search with external tools for unsupported Gemini models', async () => {
+  it('includes the mixed-tool flag for Vertex AI native search with external tools', async () => {
     const { agent, req, res, loadTools, db } = createMocks({
-      provider: Providers.GOOGLE,
-      model: 'gemini-2.5-flash',
+      provider: Providers.VERTEXAI,
+      model: 'gemini-3.5-flash',
       providerTools: [nativeGoogleSearchTool],
       loadedToolDefinitions: [mcpToolDefinition],
     });
     agent.tools = ['mcp_lookup'];
 
-    await expect(
-      initializeAgent(
-        {
-          req,
-          res,
-          agent,
-          loadTools,
-          endpointOption: { endpoint: EModelEndpoint.agents },
-          allowedProviders: new Set([Providers.GOOGLE]),
-          isInitialAgent: true,
-        },
-        db,
-      ),
-    ).rejects.toThrow(/google_tool_conflict/);
+    const result = await initializeAgent(
+      {
+        req,
+        res,
+        agent,
+        loadTools,
+        endpointOption: { endpoint: EModelEndpoint.agents },
+        allowedProviders: new Set([Providers.VERTEXAI]),
+        isInitialAgent: true,
+      },
+      db,
+    );
+
+    expect(result.tools).toEqual([nativeGoogleSearchTool]);
+    expect(result.toolDefinitions).toContain(mcpToolDefinition);
+    expect(result.model_parameters).toEqual(
+      expect.objectContaining({
+        includeServerSideToolInvocations: true,
+      }),
+    );
+  });
+
+  it.each([
+    'gemini-3-flash-preview',
+    'gemini-3-pro-preview',
+    'gemini-3.1-pro-preview',
+    'gemini-3.1-pro-preview-customtools',
+    'gemini-3.1-flash-lite',
+    'gemini-3.1-flash-lite-preview',
+    'gemini-3.5-flash',
+    'google/gemini-3.5-flash-latest',
+    'models/gemini-3.10-pro-preview',
+    'gemini-4-pro-preview',
+  ])('allows Google mixed tools for supported Gemini text model %s', async (model) => {
+    const result = await initializeGoogleMixedToolAgent(model);
+
+    expect(result.tools).toEqual([nativeGoogleSearchTool]);
+    expect(result.toolDefinitions).toContain(mcpToolDefinition);
+    expect(result.model_parameters).toEqual(
+      expect.objectContaining({
+        includeServerSideToolInvocations: true,
+      }),
+    );
+  });
+
+  it('sets the mixed-tool flag when the skill catalog adds the external tool', async () => {
+    const { agent, req, res, loadTools, db } = createMocks({
+      provider: Providers.GOOGLE,
+      model: 'gemini-3.5-flash',
+      providerTools: [nativeGoogleSearchTool],
+    });
+    const { Types } = await import('mongoose');
+    const skillId = new Types.ObjectId();
+    const author = {
+      toString: () => req.user?.id,
+    } as unknown as import('mongoose').Types.ObjectId;
+
+    const result = await initializeAgent(
+      {
+        req,
+        res,
+        agent,
+        loadTools,
+        endpointOption: { endpoint: EModelEndpoint.agents },
+        allowedProviders: new Set([Providers.GOOGLE]),
+        isInitialAgent: true,
+        accessibleSkillIds: [skillId],
+      },
+      {
+        ...db,
+        listSkillsByAccess: jest.fn().mockResolvedValue({
+          skills: [
+            {
+              _id: skillId,
+              name: 'research-helper',
+              description: 'Research current information.',
+              author,
+            },
+          ],
+          has_more: false,
+          after: null,
+        }),
+      },
+    );
+
+    expect(result.tools).toEqual([nativeGoogleSearchTool]);
+    expect(result.toolDefinitions?.map((toolDefinition) => toolDefinition.name)).toContain('skill');
+    expect(result.model_parameters).toEqual(
+      expect.objectContaining({
+        includeServerSideToolInvocations: true,
+      }),
+    );
+  });
+
+  it.each([
+    'gemini-2.5-flash',
+    'gemini-3',
+    'gemini-3.1',
+    'gemini-3-pro-image-preview',
+    'gemini-3.1-flash-image',
+    'gemini-3.5-flash-live',
+    'gemini-4-pro-tts',
+  ])('rejects Google mixed tools for unsupported Gemini model %s', async (model) => {
+    await expect(initializeGoogleMixedToolAgent(model)).rejects.toThrow(/google_tool_conflict/);
   });
 
   it('prefers LibreChat web_search when Google native search is also enabled', async () => {
@@ -632,6 +751,44 @@ describe('initializeAgent — attachment scoping', () => {
     expect(result.requestAttachments).toEqual([requestFile]);
     expect(result.agentContextAttachments).toEqual([agentContextFile]);
   });
+
+  it('owner-scopes request file usage updates while preserving trusted tool files', async () => {
+    const requestFile = { file_id: 'request-file', filename: 'request.txt' } as IMongoFile;
+    const toolFile = { file_id: 'tool-file', filename: 'tool.txt' } as IMongoFile;
+    const { agent, req, res, loadTools, db } = createMocks();
+
+    agent.tools = [EToolResources.file_search];
+    mockExtractLibreChatParams.mockReturnValueOnce({
+      resendFiles: true,
+      maxContextTokens: undefined,
+      modelOptions: { model: agent.model },
+    });
+    (db.getConvoFiles as jest.Mock).mockResolvedValueOnce([toolFile.file_id]);
+    (db.getToolFilesByIds as jest.Mock).mockResolvedValueOnce([toolFile]);
+    (db.updateFilesUsage as jest.Mock)
+      .mockResolvedValueOnce([requestFile])
+      .mockResolvedValueOnce([toolFile]);
+
+    await initializeAgent(
+      {
+        req,
+        res,
+        agent,
+        loadTools,
+        requestFiles: [requestFile],
+        conversationId: 'conversation-1',
+        endpointOption: { endpoint: EModelEndpoint.agents },
+        allowedProviders: new Set([Providers.OPENAI]),
+        isInitialAgent: true,
+      },
+      db,
+    );
+
+    expect(db.updateFilesUsage).toHaveBeenNthCalledWith(1, [requestFile], undefined, {
+      user: 'user-1',
+    });
+    expect(db.updateFilesUsage).toHaveBeenNthCalledWith(2, [toolFile]);
+  });
 });
 
 describe('initializeAgent — maxContextTokens', () => {
@@ -1251,13 +1408,11 @@ describe('initializeAgent — skill `allowed-tools` union (Phase 6)', () => {
     expect(definedNames).not.toContain('mcp__broken__tool');
   });
 
-  it('falls through to empty toolDefinitions when BOTH the union and base-only loadTools calls return undefined', async () => {
+  it('falls back to host-provided skill authoring tools when BOTH loadTools calls return undefined', async () => {
     /* Worst-case silent-failure path: production loaders catch errors
        and return undefined. If the agent's own tools fail to load AND
-       the retry without extras also fails, we have nothing to give the
-       LLM. The current behavior is to fall through to the `?? {}`
-       fallback rather than throw — pinning that contract here so the
-       turn doesn't crash hard but the agent simply has no tools. */
+       the retry without extras also fails, loaded registry tools drop out,
+       but host-provided file authoring remains available for skill access. */
     const { agent, req, res, loadTools, db } = createMocks();
     agent.tools = ['web_search'];
     const { Types } = await import('mongoose');
@@ -1283,16 +1438,18 @@ describe('initializeAgent — skill `allowed-tools` union (Phase 6)', () => {
         allowedProviders: new Set([Providers.OPENAI]),
         isInitialAgent: true,
         accessibleSkillIds: [skillId],
+        skillAuthoringAvailable: true,
         manualSkills: ['broken-skill'],
       },
       { ...db, listSkillsByAccess: emptyListSkillsByAccess, getSkillByName },
     );
 
-    /* Two attempts (initial + retry), both undefined → empty fallback.
-       The agent gets no tool definitions for the turn but does NOT
-       crash; downstream code handles the empty case. */
+    /* Two attempts (initial + retry), both undefined. Registry-backed tools
+       fall away, but read/create/edit_file are registered by the initializer
+       so skill authoring still works. */
     expect(loadTools).toHaveBeenCalledTimes(2);
-    expect(result.toolDefinitions).toEqual([]);
+    const definedNames = result.toolDefinitions?.map((d) => d.name) ?? [];
+    expect(definedNames).toEqual(['read_file', 'create_file', 'edit_file']);
   });
 
   it('propagates the error when loadTools fails AND there are no skill-added extras to drop', async () => {
@@ -1374,6 +1531,8 @@ describe('initializeAgent — execute_code capability expansion', () => {
     const names = (result.toolDefinitions ?? []).map((d) => d.name);
     expect(names).toContain('bash_tool');
     expect(names).toContain('read_file');
+    expect(names).toContain('create_file');
+    expect(names).toContain('edit_file');
     /* The legacy `execute_code` tool def is no longer registered by this
        path — the string stays in `agent.tools` as the capability trigger
        but never appears in the tool definitions the LLM sees. */
@@ -1382,6 +1541,12 @@ describe('initializeAgent — execute_code capability expansion', () => {
     expect(readFile?.description).toContain('code-execution sandbox');
     expect(readFile?.description).not.toContain('{skillName}');
     expect(readFile?.description).not.toContain('SKILL.md');
+    const createFile = result.toolDefinitions?.find((d) => d.name === 'create_file');
+    expect(createFile?.description).toContain('code-execution sandbox');
+    expect(createFile?.description).toContain('/mnt/data/');
+    expect(createFile?.description).not.toContain('skills/');
+    expect(result.skillAuthoringAvailable).toBe(false);
+    expect(result.fileAuthoringToolNames).toEqual(new Set(['create_file', 'edit_file']));
   });
 
   it('upgrades read_file to the skill-aware description when active skills are in scope', async () => {
@@ -1422,8 +1587,92 @@ describe('initializeAgent — execute_code capability expansion', () => {
 
     const readFile = result.toolDefinitions?.find((d) => d.name === 'read_file');
     expect(readFile?.description).toContain('{skillName}/{filePath}');
+    expect(readFile?.description).toContain('skills/{skillName}/');
     expect(readFile?.description).toContain('SKILL.md');
-    expect(result.toolDefinitions?.map((d) => d.name)).toContain('skill');
+    const names = result.toolDefinitions?.map((d) => d.name) ?? [];
+    expect(names).toContain('skill');
+    expect(names).toContain('create_file');
+    expect(names).toContain('edit_file');
+  });
+
+  it('keeps skill authoring tools hidden for read-only skill access', async () => {
+    const { agent, req, res, loadTools, db } = createMocks();
+    agent.tools = [];
+    const { Types } = await import('mongoose');
+    const skillId = new Types.ObjectId();
+    const author = { toString: () => req.user?.id } as unknown as import('mongoose').Types.ObjectId;
+
+    const result = await initializeAgent(
+      {
+        req,
+        res,
+        agent,
+        loadTools,
+        endpointOption: { endpoint: EModelEndpoint.agents },
+        allowedProviders: new Set([Providers.OPENAI]),
+        isInitialAgent: true,
+        codeEnvAvailable: false,
+        accessibleSkillIds: [skillId],
+        skillAuthoringAvailable: false,
+      },
+      {
+        ...db,
+        listSkillsByAccess: jest.fn().mockResolvedValue({
+          skills: [
+            {
+              _id: skillId,
+              name: 'read-only-skill',
+              description: 'Read-only skill.',
+              author,
+            },
+          ],
+          has_more: false,
+          after: null,
+        }),
+      },
+    );
+
+    const names = result.toolDefinitions?.map((d) => d.name) ?? [];
+    expect(names).toContain('skill');
+    expect(names).toContain('read_file');
+    expect(names).not.toContain('create_file');
+    expect(names).not.toContain('edit_file');
+    expect(names).not.toContain('bash_tool');
+    expect(result.skillAuthoringAvailable).toBe(false);
+  });
+
+  it('registers skill authoring tools for first-time skill creators', async () => {
+    const { agent, req, res, loadTools, db } = createMocks();
+    agent.tools = [];
+
+    const result = await initializeAgent(
+      {
+        req,
+        res,
+        agent,
+        loadTools,
+        endpointOption: { endpoint: EModelEndpoint.agents },
+        allowedProviders: new Set([Providers.OPENAI]),
+        isInitialAgent: true,
+        accessibleSkillIds: [],
+        skillAuthoringAvailable: true,
+        codeEnvAvailable: false,
+      },
+      db,
+    );
+
+    const names = (result.toolDefinitions ?? []).map((d) => d.name);
+    expect(names).toContain('create_file');
+    expect(names).toContain('edit_file');
+    expect(names).toContain('read_file');
+    expect(names).not.toContain('bash_tool');
+    const readFile = result.toolDefinitions?.find((d) => d.name === 'read_file');
+    expect(readFile?.description).toContain('skills/{skillName}/');
+    expect(readFile?.description).toContain('SKILL.md');
+    const createFile = result.toolDefinitions?.find((d) => d.name === 'create_file');
+    expect(createFile?.description).toContain('skills/');
+    expect(result.skillAuthoringAvailable).toBe(true);
+    expect(result.fileAuthoringToolNames).toEqual(new Set(['create_file', 'edit_file']));
   });
 
   it('does not register bash_tool + read_file when codeEnvAvailable=false', async () => {
@@ -1447,6 +1696,8 @@ describe('initializeAgent — execute_code capability expansion', () => {
     const names = (result.toolDefinitions ?? []).map((d) => d.name);
     expect(names).not.toContain('bash_tool');
     expect(names).not.toContain('read_file');
+    expect(names).not.toContain('create_file');
+    expect(names).not.toContain('edit_file');
   });
 
   it('does not register bash_tool + read_file when agent does not request execute_code', async () => {
@@ -1470,6 +1721,8 @@ describe('initializeAgent — execute_code capability expansion', () => {
     const names = (result.toolDefinitions ?? []).map((d) => d.name);
     expect(names).not.toContain('bash_tool');
     expect(names).not.toContain('read_file');
+    expect(names).not.toContain('create_file');
+    expect(names).not.toContain('edit_file');
   });
 
   it('narrows codeEnvAvailable on InitializedAgent to the per-agent effective value', async () => {
@@ -1585,6 +1838,9 @@ describe('initializeAgent — execute_code capability expansion', () => {
     ).resolves.toEqual(
       expect.objectContaining({
         tools: [{ googleSearch: {} }],
+        model_parameters: expect.objectContaining({
+          includeServerSideToolInvocations: true,
+        }),
         toolDefinitions: expect.arrayContaining([
           expect.objectContaining({ name: 'bash_tool' }),
           expect.objectContaining({ name: 'read_file' }),
@@ -1626,6 +1882,9 @@ describe('initializeAgent — execute_code capability expansion', () => {
     ).resolves.toEqual(
       expect.objectContaining({
         tools: [structuredTool, providerTool],
+        model_parameters: expect.objectContaining({
+          includeServerSideToolInvocations: true,
+        }),
       }),
     );
   });
@@ -1809,3 +2068,54 @@ describe('initializeAgent — code-generated file thread filter (regression)', (
     expect(getUserCodeFiles).not.toHaveBeenCalled();
   });
 });
+
+describe('initializeAgent — run-scoped MCP tool definitions', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('carries mcpAvailableTools from the loadTools result onto the initialized agent', async () => {
+    /** Regression guard for the request-scoped MCP/PTC handoff: dropping this
+     *  field at the destructure boundary forces per-call reinitialization
+     *  downstream and can storm the MCP circuit breaker. */
+    const { agent, req, res, loadTools, db } = createMocks();
+    const mcpTool = 'list_tables_mcp_ClickHouse';
+    const mcpAvailableTools = {
+      ClickHouse: {
+        [mcpTool]: {
+          type: 'function' as const,
+          function: {
+            name: mcpTool,
+            description: 'List tables',
+            parameters: { type: 'object' as const, properties: {} },
+          },
+        },
+      },
+    };
+    loadTools.mockResolvedValue({
+      tools: [],
+      toolContextMap: {},
+      dynamicToolContextMap: {},
+      userMCPAuthMap: undefined,
+      toolRegistry: undefined,
+      toolDefinitions: [],
+      hasDeferredTools: false,
+      mcpAvailableTools,
+    });
+
+    const result = await initializeAgent(
+      {
+        req,
+        res,
+        agent,
+        loadTools,
+        endpointOption: { endpoint: EModelEndpoint.agents },
+        allowedProviders: new Set([Providers.OPENAI]),
+        isInitialAgent: true,
+      },
+      db,
+    );
+
+    expect(result.mcpAvailableTools).toEqual(mcpAvailableTools);
+  });
+});
diff --git a/packages/api/src/agents/__tests__/load.spec.ts b/packages/api/src/agents/__tests__/load.spec.ts
index 2419310b832..705c5e8ef78 100644
--- a/packages/api/src/agents/__tests__/load.spec.ts
+++ b/packages/api/src/agents/__tests__/load.spec.ts
@@ -1,10 +1,17 @@
 import mongoose from 'mongoose';
 import { v4 as uuidv4 } from 'uuid';
-import { Constants } from 'librechat-data-provider';
 import { MongoMemoryServer } from 'mongodb-memory-server';
+import { Constants, FileSources } from 'librechat-data-provider';
 import { agentSchema, createMethods } from '@librechat/data-schemas';
-import type { AgentModelParameters } from 'librechat-data-provider';
+import type {
+  Agent as LibreChatAgent,
+  AgentModelParameters,
+  TEphemeralAgent,
+  TConversation,
+} from 'librechat-data-provider';
+import type { AppConfig } from '@librechat/data-schemas';
 import type { LoadAgentParams, LoadAgentDeps } from '../load';
+import { loadAddedAgent } from '../added';
 import { loadAgent } from '../load';
 
 let Agent: mongoose.Model<unknown>;
@@ -14,7 +21,7 @@ let getAgent: ReturnType<typeof createMethods>['getAgent'];
 const mockGetMCPServerTools = jest.fn();
 
 const deps: LoadAgentDeps = {
-  getAgent: (searchParameter) => getAgent(searchParameter),
+  getAgent: (searchParameter) => getAgent(searchParameter) as Promise<LibreChatAgent | null>,
   getMCPServerTools: mockGetMCPServerTools,
 };
 
@@ -122,6 +129,44 @@ describe('loadAgent', () => {
     }
   });
 
+  test('should skip cached tools for servers made request-scoped by a config overlay', async () => {
+    const { EPHEMERAL_AGENT_ID } = Constants;
+
+    mockGetMCPServerTools.mockResolvedValue({ tool1_mcp_server1: {} });
+
+    const mockReq = {
+      user: { id: 'user123' },
+      config: {
+        mcpConfig: {
+          'body-scoped': {
+            type: 'streamable-http' as const,
+            url: 'https://mcp.example.com/{{LIBRECHAT_BODY_CONVERSATIONID}}/mcp',
+          },
+        },
+      } as unknown as AppConfig,
+      body: {
+        ephemeralAgent: {
+          mcp: ['body-scoped', 'server1'],
+        },
+      },
+    };
+
+    const result = await loadAgent(
+      {
+        req: mockReq,
+        agent_id: EPHEMERAL_AGENT_ID as string,
+        endpoint: 'openai',
+        model_parameters: { model: 'gpt-4' } as unknown as AgentModelParameters,
+      },
+      deps,
+    );
+
+    expect(mockGetMCPServerTools).toHaveBeenCalledTimes(1);
+    expect(mockGetMCPServerTools).toHaveBeenCalledWith('user123', 'server1');
+    expect(result?.tools).toContain(`${Constants.mcp_all}${Constants.mcp_delimiter}body-scoped`);
+    expect(result?.tools).toContain('tool1_mcp_server1');
+  });
+
   test('should return null for non-existent agent', async () => {
     const mockReq = { user: { id: 'user123' } };
     const result = await loadAgent(
@@ -253,6 +298,336 @@ describe('loadAgent', () => {
     expect(result?.model_parameters).not.toHaveProperty('promptPrefix');
   });
 
+  test('should enable full skill scope for ephemeral model spec with skills true', async () => {
+    const { EPHEMERAL_AGENT_ID } = Constants;
+
+    const result = await loadAgent(
+      {
+        req: {
+          user: { id: 'user123' },
+          body: {
+            ephemeralAgent: {
+              subagents: { enabled: false, agent_ids: ['agent_tampered'] },
+            } as unknown as TEphemeralAgent,
+          },
+          config: {
+            config: {},
+            fileStrategy: FileSources.local,
+            imageOutputType: 'png',
+            modelSpecs: {
+              list: [
+                {
+                  name: 'skills-on',
+                  label: 'Skills On',
+                  preset: { endpoint: 'openai', model: 'gpt-4' },
+                  skills: true,
+                },
+              ],
+            },
+          },
+        },
+        spec: 'skills-on',
+        agent_id: EPHEMERAL_AGENT_ID as string,
+        endpoint: 'openai',
+        model_parameters: { model: 'gpt-4' } as unknown as AgentModelParameters,
+      },
+      deps,
+    );
+
+    expect(result?.skills_enabled).toBe(true);
+    expect(result?.skills).toBeUndefined();
+    expect(result?.subagents).toBeUndefined();
+  });
+
+  test('should initialize an empty allowlist for ephemeral model spec skill names', async () => {
+    const { EPHEMERAL_AGENT_ID } = Constants;
+
+    const result = await loadAgent(
+      {
+        req: {
+          user: { id: 'user123' },
+          body: {},
+          config: {
+            config: {},
+            fileStrategy: FileSources.local,
+            imageOutputType: 'png',
+            modelSpecs: {
+              list: [
+                {
+                  name: 'scoped-skills',
+                  label: 'Scoped Skills',
+                  preset: { endpoint: 'openai', model: 'gpt-4' },
+                  skills: ['finance-analyst', 'brand-writer'],
+                },
+              ],
+            },
+          },
+        },
+        spec: 'scoped-skills',
+        agent_id: EPHEMERAL_AGENT_ID as string,
+        endpoint: 'openai',
+        model_parameters: { model: 'gpt-4' } as unknown as AgentModelParameters,
+      },
+      deps,
+    );
+
+    expect(result?.skills_enabled).toBe(true);
+    expect(result?.skills).toEqual([]);
+  });
+
+  test('should apply subagent config for ephemeral model specs', async () => {
+    const { EPHEMERAL_AGENT_ID } = Constants;
+    const subagents = { enabled: true, allowSelf: true, agent_ids: [] };
+
+    const result = await loadAgent(
+      {
+        req: {
+          user: { id: 'user123' },
+          body: {},
+          config: {
+            config: {},
+            fileStrategy: FileSources.local,
+            imageOutputType: 'png',
+            modelSpecs: {
+              list: [
+                {
+                  name: 'self-spawn',
+                  label: 'Self Spawn',
+                  preset: { endpoint: 'openai', model: 'gpt-4' },
+                  subagents,
+                },
+              ],
+            },
+          },
+        },
+        spec: 'self-spawn',
+        agent_id: EPHEMERAL_AGENT_ID as string,
+        endpoint: 'openai',
+        model_parameters: { model: 'gpt-4' } as unknown as AgentModelParameters,
+      },
+      deps,
+    );
+
+    expect(result?.subagents).toEqual(subagents);
+  });
+
+  test('should ignore request subagents for ephemeral agents', async () => {
+    const { EPHEMERAL_AGENT_ID } = Constants;
+
+    const result = await loadAgent(
+      {
+        req: {
+          user: { id: 'user123' },
+          body: {
+            ephemeralAgent: {
+              subagents: { enabled: true, allowSelf: true, agent_ids: ['agent_other'] },
+            } as unknown as TEphemeralAgent,
+          },
+        },
+        agent_id: EPHEMERAL_AGENT_ID as string,
+        endpoint: 'openai',
+        model_parameters: { model: 'gpt-4' } as unknown as AgentModelParameters,
+      },
+      deps,
+    );
+
+    expect(result?.subagents).toBeUndefined();
+  });
+
+  test('should ignore request subagents when added agent mirrors ephemeral primary tools', async () => {
+    const { EPHEMERAL_AGENT_ID } = Constants;
+
+    const result = await loadAddedAgent(
+      {
+        req: {
+          user: { id: 'user123' },
+          config: {
+            config: {},
+            fileStrategy: FileSources.local,
+            imageOutputType: 'png',
+          },
+        },
+        conversation: {
+          endpoint: 'openai',
+          model: 'gpt-4',
+          ephemeralAgent: { subagents: { enabled: true, allowSelf: true, agent_ids: [] } },
+        } as unknown as TConversation,
+        primaryAgent: { id: EPHEMERAL_AGENT_ID as string, tools: ['web_search'] } as LibreChatAgent,
+      },
+      deps,
+    );
+
+    expect(result?.tools).toEqual(['web_search']);
+    expect(result?.subagents).toBeUndefined();
+  });
+
+  test('should ignore request subagents for added ephemeral agents', async () => {
+    const result = await loadAddedAgent(
+      {
+        req: {
+          user: { id: 'user123' },
+          config: {
+            config: {},
+            fileStrategy: FileSources.local,
+            imageOutputType: 'png',
+          },
+        },
+        conversation: {
+          endpoint: 'openai',
+          model: 'gpt-4',
+          ephemeralAgent: { subagents: { enabled: true, allowSelf: true, agent_ids: [] } },
+        } as unknown as TConversation,
+      },
+      deps,
+    );
+
+    expect(result?.subagents).toBeUndefined();
+  });
+
+  test('should enable full skill scope for added ephemeral model spec with skills true', async () => {
+    const result = await loadAddedAgent(
+      {
+        req: {
+          user: { id: 'user123' },
+          config: {
+            config: {},
+            fileStrategy: FileSources.local,
+            imageOutputType: 'png',
+            modelSpecs: {
+              list: [
+                {
+                  name: 'added-skills-on',
+                  label: 'Added Skills On',
+                  preset: { endpoint: 'openai', model: 'gpt-4' },
+                  skills: true,
+                },
+              ],
+            },
+          },
+        },
+        conversation: {
+          endpoint: 'openai',
+          model: 'gpt-4',
+          spec: 'added-skills-on',
+        } as unknown as TConversation,
+      },
+      deps,
+    );
+
+    expect(result?.skills_enabled).toBe(true);
+    expect(result?.skills).toBeUndefined();
+  });
+
+  test('should initialize an empty allowlist for added ephemeral model spec skill names', async () => {
+    const result = await loadAddedAgent(
+      {
+        req: {
+          user: { id: 'user123' },
+          config: {
+            config: {},
+            fileStrategy: FileSources.local,
+            imageOutputType: 'png',
+            modelSpecs: {
+              list: [
+                {
+                  name: 'added-scoped-skills',
+                  label: 'Added Scoped Skills',
+                  preset: { endpoint: 'openai', model: 'gpt-4' },
+                  skills: ['finance-analyst', 'brand-writer'],
+                },
+              ],
+            },
+          },
+        },
+        conversation: {
+          endpoint: 'openai',
+          model: 'gpt-4',
+          spec: 'added-scoped-skills',
+        } as unknown as TConversation,
+      },
+      deps,
+    );
+
+    expect(result?.skills_enabled).toBe(true);
+    expect(result?.skills).toEqual([]);
+  });
+
+  test('should apply subagent config for added ephemeral model specs', async () => {
+    const subagents = { enabled: true, allowSelf: true, agent_ids: [] };
+
+    const result = await loadAddedAgent(
+      {
+        req: {
+          user: { id: 'user123' },
+          config: {
+            config: {},
+            fileStrategy: FileSources.local,
+            imageOutputType: 'png',
+            modelSpecs: {
+              list: [
+                {
+                  name: 'added-self-spawn',
+                  label: 'Added Self Spawn',
+                  preset: { endpoint: 'openai', model: 'gpt-4' },
+                  subagents,
+                },
+              ],
+            },
+          },
+        },
+        conversation: {
+          endpoint: 'openai',
+          model: 'gpt-4',
+          spec: 'added-self-spawn',
+        } as unknown as TConversation,
+      },
+      deps,
+    );
+
+    expect(result?.subagents).toEqual(subagents);
+  });
+
+  test('should apply model spec skills when added agent mirrors ephemeral primary tools', async () => {
+    const { EPHEMERAL_AGENT_ID } = Constants;
+    const subagents = { enabled: true, allowSelf: true, agent_ids: [] };
+
+    const result = await loadAddedAgent(
+      {
+        req: {
+          user: { id: 'user123' },
+          config: {
+            config: {},
+            fileStrategy: FileSources.local,
+            imageOutputType: 'png',
+            modelSpecs: {
+              list: [
+                {
+                  name: 'mirrored-scoped-skills',
+                  label: 'Mirrored Scoped Skills',
+                  preset: { endpoint: 'openai', model: 'gpt-4' },
+                  skills: ['brand-writer'],
+                  subagents,
+                },
+              ],
+            },
+          },
+        },
+        conversation: {
+          endpoint: 'openai',
+          model: 'gpt-4',
+          spec: 'mirrored-scoped-skills',
+        } as unknown as TConversation,
+        primaryAgent: { id: EPHEMERAL_AGENT_ID as string, tools: ['web_search'] } as LibreChatAgent,
+      },
+      deps,
+    );
+
+    expect(result?.tools).toEqual(['web_search']);
+    expect(result?.skills_enabled).toBe(true);
+    expect(result?.skills).toEqual([]);
+    expect(result?.subagents).toEqual(subagents);
+  });
+
   test('should handle ephemeral agent with undefined ephemeralAgent in body', async () => {
     const { EPHEMERAL_AGENT_ID } = Constants;
 
diff --git a/packages/api/src/agents/__tests__/memory.test.ts b/packages/api/src/agents/__tests__/memory.test.ts
index d23a07aa7dd..25551020574 100644
--- a/packages/api/src/agents/__tests__/memory.test.ts
+++ b/packages/api/src/agents/__tests__/memory.test.ts
@@ -410,6 +410,7 @@ describe('processMemory - GPT-5+ handling', () => {
           llmConfig: expect.objectContaining({
             model: 'gpt-4.1-mini',
             temperature: 0.4, // Default temperature should remain
+            maxRetries: 0,
           }),
         }),
       }),
diff --git a/packages/api/src/agents/__tests__/skills.test.ts b/packages/api/src/agents/__tests__/skills.test.ts
index 3142273f7cf..87c849fc8f6 100644
--- a/packages/api/src/agents/__tests__/skills.test.ts
+++ b/packages/api/src/agents/__tests__/skills.test.ts
@@ -38,12 +38,14 @@ import {
   scopeSkillIds,
   resolveSkillActive,
   resolveAgentScopedSkillIds,
+  resolveModelSpecSkillIds,
   injectSkillCatalog,
   buildSkillPrimeMessage,
   resolveManualSkills,
   resolveAlwaysApplySkills,
   injectManualSkillPrimes,
   injectSkillPrimes,
+  collectFreshSkillPrimeNames,
   extractManualSkills,
   isSkillPrimeMessage,
   buildSkillPrimeContentParts,
@@ -252,9 +254,9 @@ describe('scopeSkillIds', () => {
     expect(scopeSkillIds(accessible, null)).toBe(accessible);
   });
 
-  it('returns [] when agentSkills is an empty array (explicit none)', () => {
+  it('returns the full set when agentSkills is an empty array (no allowlist)', () => {
     const accessible = [makeId(), makeId()];
-    expect(scopeSkillIds(accessible, [])).toEqual([]);
+    expect(scopeSkillIds(accessible, [])).toBe(accessible);
   });
 
   it('returns intersection when agentSkills overlaps accessibleSkillIds', () => {
@@ -312,9 +314,11 @@ describe('resolveAgentScopedSkillIds', () => {
   });
   const ephemeralAgent = (
     skills?: string[],
+    skills_enabled?: boolean,
   ): { id: string; skills?: string[]; skills_enabled?: boolean } => ({
     id: 'ephemeral_convo_xyz',
     skills,
+    skills_enabled,
   });
 
   it('returns [] when the skills capability is disabled, even with every other signal on', () => {
@@ -366,14 +370,50 @@ describe('resolveAgentScopedSkillIds', () => {
       expect(scoped.map((o) => o.toString()).sort()).toEqual([a.toString(), b.toString()].sort());
     });
 
-    it('ignores any `skills` field on an ephemeral agent (toggle is the only signal)', () => {
+    it('returns the full accessible catalog when a model spec enables skills', () => {
+      const a = makeId();
+      const b = makeId();
+      const scoped = resolveAgentScopedSkillIds({
+        agent: ephemeralAgent(undefined, true),
+        accessibleSkillIds: [a, b],
+        skillsCapabilityEnabled: true,
+        ephemeralSkillsToggle: false,
+      });
+      expect(scoped.map((o) => o.toString()).sort()).toEqual([a.toString(), b.toString()].sort());
+    });
+
+    it('returns the model-spec allowlist intersection when configured', () => {
+      const a = makeId();
+      const b = makeId();
+      const scoped = resolveAgentScopedSkillIds({
+        agent: ephemeralAgent([a.toString()], true),
+        accessibleSkillIds: [a, b],
+        skillsCapabilityEnabled: true,
+        ephemeralSkillsToggle: false,
+      });
+      expect(scoped.map((o) => o.toString())).toEqual([a.toString()]);
+    });
+
+    it('treats an empty model-spec allowlist as explicit none', () => {
       const a = makeId();
       expect(
         resolveAgentScopedSkillIds({
-          agent: ephemeralAgent([a.toString()]),
+          agent: ephemeralAgent([], true),
           accessibleSkillIds: [a],
           skillsCapabilityEnabled: true,
-          ephemeralSkillsToggle: false,
+          ephemeralSkillsToggle: true,
+        }),
+      ).toEqual([]);
+    });
+
+    it('lets an explicit model-spec skills=false override the badge toggle', () => {
+      const a = makeId();
+      expect(
+        resolveAgentScopedSkillIds({
+          agent: ephemeralAgent(undefined, false),
+          accessibleSkillIds: [a],
+          skillsCapabilityEnabled: true,
+          ephemeralSkillsToggle: true,
         }),
       ).toEqual([]);
     });
@@ -470,6 +510,95 @@ describe('resolveAgentScopedSkillIds', () => {
   });
 });
 
+describe('resolveModelSpecSkillIds', () => {
+  const userObjectId = new Types.ObjectId();
+
+  it('resolves configured names against accessible skills and skips misses without failing', async () => {
+    const knownId = new Types.ObjectId();
+    const getSkillByName = jest.fn(async (name: string) => {
+      if (name === 'known-skill') {
+        return {
+          _id: knownId,
+          name,
+          body: 'body',
+          author: userObjectId,
+        };
+      }
+      if (name === 'throws') {
+        throw new Error('lookup failed');
+      }
+      return null;
+    });
+
+    const result = await resolveModelSpecSkillIds({
+      names: [' known-skill ', 'missing-skill', 'throws', 'known-skill'],
+      accessibleSkillIds: [knownId],
+      getSkillByName,
+    });
+
+    expect(result.map((id) => id.toString())).toEqual([knownId.toString()]);
+    expect(getSkillByName).toHaveBeenCalledTimes(3);
+    expect(getSkillByName).toHaveBeenCalledWith('known-skill', [knownId], {
+      preferModelInvocable: true,
+    });
+  });
+
+  it('resolves configured names sequentially to avoid query bursts', async () => {
+    const firstId = new Types.ObjectId();
+    const secondId = new Types.ObjectId();
+    const order: string[] = [];
+    let releaseFirst!: () => void;
+    const firstLookup = new Promise<void>((resolve) => {
+      releaseFirst = resolve;
+    });
+    const getSkillByName = jest.fn(async (name: string) => {
+      order.push(`start:${name}`);
+      if (name === 'first') {
+        await firstLookup;
+        order.push(`end:${name}`);
+        return {
+          _id: firstId,
+          name,
+          body: 'body',
+          author: userObjectId,
+        };
+      }
+      order.push(`end:${name}`);
+      return {
+        _id: secondId,
+        name,
+        body: 'body',
+        author: userObjectId,
+      };
+    });
+
+    const promise = resolveModelSpecSkillIds({
+      names: ['first', 'second'],
+      accessibleSkillIds: [firstId, secondId],
+      getSkillByName,
+    });
+
+    await Promise.resolve();
+    expect(order).toEqual(['start:first']);
+
+    releaseFirst();
+    const result = await promise;
+
+    expect(result.map((id) => id.toString())).toEqual([firstId.toString(), secondId.toString()]);
+    expect(order).toEqual(['start:first', 'end:first', 'start:second', 'end:second']);
+  });
+
+  it('returns [] when no skill lookup is available', async () => {
+    const result = await resolveModelSpecSkillIds({
+      names: ['known-skill'],
+      accessibleSkillIds: [new Types.ObjectId()],
+      getSkillByName: undefined,
+    });
+
+    expect(result).toEqual([]);
+  });
+});
+
 describe('resolveSkillActive', () => {
   const makeSkill = (author: Types.ObjectId) => ({ _id: new Types.ObjectId(), author });
 
@@ -523,6 +652,30 @@ describe('resolveSkillActive', () => {
     ).toBe(false);
   });
 
+  it('respects explicit override = false even for deployment skills', () => {
+    const deploymentSkill = { ...makeSkill(new Types.ObjectId()), deployment: true };
+    expect(
+      resolveSkillActive({
+        skill: deploymentSkill,
+        skillStates: { [deploymentSkill._id.toString()]: false },
+        userId: undefined,
+        defaultActiveOnShare: true,
+      }),
+    ).toBe(false);
+  });
+
+  it('defaults deployment skills to active without ownership or shared defaults', () => {
+    const deploymentSkill = { ...makeSkill(new Types.ObjectId()), deployment: true };
+    expect(
+      resolveSkillActive({
+        skill: deploymentSkill,
+        skillStates: {},
+        userId: undefined,
+        defaultActiveOnShare: false,
+      }),
+    ).toBe(true);
+  });
+
   it('owned skills default to active when no override is present', () => {
     const userObjectId = new Types.ObjectId();
     const userId = userObjectId.toString();
@@ -744,6 +897,26 @@ describe('injectSkillCatalog', () => {
     expect(agent.additional_instructions).toContain('desc-my-skill');
   });
 
+  it('honors a configured maxCatalogSkills below the default hard limit', async () => {
+    const first = makeSkill('first-skill', userObjectId);
+    const second = makeSkill('second-skill', userObjectId);
+    const third = makeSkill('third-skill', userObjectId);
+    const listSkillsByAccess = buildPager([[first, second, third]]);
+    const agent = makeAgent();
+    const result = await injectSkillCatalog(
+      baseParams({ listSkillsByAccess, agent, maxCatalogSkills: 2 }),
+    );
+
+    expect(result.skillCount).toBe(2);
+    expect(result.activeSkillIds.map((id) => id.toString())).toEqual([
+      first._id.toString(),
+      second._id.toString(),
+    ]);
+    expect(agent.additional_instructions).toContain('first-skill');
+    expect(agent.additional_instructions).toContain('second-skill');
+    expect(agent.additional_instructions).not.toContain('third-skill');
+  });
+
   it('fails closed when userId is absent (shared skills drop, owned would need override)', async () => {
     const owned = makeSkill('my-skill', userObjectId);
     const shared = makeSkill('shared-skill', new Types.ObjectId());
@@ -990,6 +1163,7 @@ describe('resolveManualSkills', () => {
     author: Types.ObjectId;
     allowedTools?: string[];
     userInvocable?: boolean;
+    deployment?: boolean;
   };
 
   const buildGetSkillByName =
@@ -1199,6 +1373,21 @@ describe('resolveManualSkills', () => {
     expect(result).toEqual([{ _id: shared._id, name: 'shared', body: 'shared-body' }]);
   });
 
+  it('allows deployment skills even when shared skills default inactive', async () => {
+    const deployment = {
+      ...mkSkill('deployment', otherAuthor, 'deployment-body'),
+      deployment: true,
+    };
+    const result = await resolveManualSkills({
+      names: ['deployment'],
+      getSkillByName: buildGetSkillByName({ deployment }),
+      accessibleSkillIds: [deployment._id],
+      userId,
+      defaultActiveOnShare: false,
+    });
+    expect(result).toEqual([{ _id: deployment._id, name: 'deployment', body: 'deployment-body' }]);
+  });
+
   it('drops explicitly-deactivated skills (skillStates override wins over ownership default)', async () => {
     const owned = mkSkill('owned-off', userOid);
     const result = await resolveManualSkills({
@@ -1633,6 +1822,7 @@ describe('resolveAlwaysApplySkills', () => {
     body: string;
     author: Types.ObjectId | string;
     allowedTools?: string[];
+    deployment?: boolean;
   };
 
   const mkRow = (
@@ -1720,6 +1910,22 @@ describe('resolveAlwaysApplySkills', () => {
     expect(result).toEqual([{ _id: shared._id, name: 'shared-on', body: 'shared-body' }]);
   });
 
+  it('allows deployment always-apply skills even when shared skills default inactive', async () => {
+    const deployment: AlwaysApplyRow = {
+      ...mkRow('deployment-always', otherAuthor, 'deployment body'),
+      deployment: true,
+    };
+    const result = await resolveAlwaysApplySkills({
+      listAlwaysApplySkills: buildLister([deployment]),
+      accessibleSkillIds: [deployment._id],
+      userId,
+      defaultActiveOnShare: false,
+    });
+    expect(result).toEqual([
+      { _id: deployment._id, name: 'deployment-always', body: 'deployment body' },
+    ]);
+  });
+
   it('honors explicit deactivation override even for owned skills', async () => {
     const owned = mkRow('owned-off', userOid);
     const result = await resolveAlwaysApplySkills({
@@ -2042,3 +2248,45 @@ describe('injectSkillPrimes', () => {
     expect(result.inserted).toBe(2);
   });
 });
+
+describe('collectFreshSkillPrimeNames', () => {
+  it('returns the union of manual + always-apply prime names', () => {
+    const names = collectFreshSkillPrimeNames({
+      manualSkillPrimes: [{ name: 'pdf-analyzer' }, { name: 'code-review' }],
+      alwaysApplySkillPrimes: [{ name: 'clickhouse-best-practices' }],
+    });
+    expect(names).toEqual(new Set(['pdf-analyzer', 'code-review', 'clickhouse-best-practices']));
+  });
+
+  it('dedupes a skill that is both manual and always-apply', () => {
+    const names = collectFreshSkillPrimeNames({
+      manualSkillPrimes: [{ name: 'clickhouse-best-practices' }],
+      alwaysApplySkillPrimes: [{ name: 'clickhouse-best-practices' }],
+    });
+    expect(names.size).toBe(1);
+    expect(names.has('clickhouse-best-practices')).toBe(true);
+  });
+
+  it('handles undefined / empty inputs', () => {
+    expect(collectFreshSkillPrimeNames({}).size).toBe(0);
+    expect(
+      collectFreshSkillPrimeNames({
+        manualSkillPrimes: [],
+        alwaysApplySkillPrimes: [],
+      }).size,
+    ).toBe(0);
+  });
+
+  it('collects names from only one side when the other is absent', () => {
+    expect(
+      collectFreshSkillPrimeNames({
+        alwaysApplySkillPrimes: [{ name: 'only-always' }],
+      }),
+    ).toEqual(new Set(['only-always']));
+    expect(
+      collectFreshSkillPrimeNames({
+        manualSkillPrimes: [{ name: 'only-manual' }],
+      }),
+    ).toEqual(new Set(['only-manual']));
+  });
+});
diff --git a/packages/api/src/agents/added.ts b/packages/api/src/agents/added.ts
index de1f9186efe..ce9d2ffb6e7 100644
--- a/packages/api/src/agents/added.ts
+++ b/packages/api/src/agents/added.ts
@@ -1,5 +1,4 @@
 import { logger } from '@librechat/data-schemas';
-import type { AppConfig } from '@librechat/data-schemas';
 import {
   Tools,
   Constants,
@@ -8,13 +7,43 @@ import {
   appendAgentIdSuffix,
   encodeEphemeralAgentId,
 } from 'librechat-data-provider';
-import type { Agent, TConversation } from 'librechat-data-provider';
+import type { Agent, TConversation, TModelSpec } from 'librechat-data-provider';
+import type { AppConfig } from '@librechat/data-schemas';
+import { requiresEphemeralUserConnection } from '~/mcp/utils';
 import { getCustomEndpointConfig } from '~/app/config';
 
 const { mcp_all, mcp_delimiter } = Constants;
 
 export const ADDED_AGENT_ID = 'added_agent';
 
+function applyModelSpecSkills(
+  result: Record<string, unknown>,
+  modelSpec: Pick<TModelSpec, 'skills'> | null | undefined,
+): void {
+  if (!modelSpec || !Object.prototype.hasOwnProperty.call(modelSpec, 'skills')) {
+    return;
+  }
+  if (modelSpec.skills === true) {
+    result.skills_enabled = true;
+    delete result.skills;
+  } else if (modelSpec.skills === false) {
+    result.skills_enabled = false;
+    result.skills = [];
+  } else if (Array.isArray(modelSpec.skills)) {
+    result.skills_enabled = true;
+    result.skills = [];
+  }
+}
+
+function applyModelSpecSubagents(
+  result: Record<string, unknown>,
+  modelSpec: Pick<TModelSpec, 'subagents'> | null | undefined,
+): void {
+  if (modelSpec?.subagents) {
+    result.subagents = modelSpec.subagents;
+  }
+}
+
 export interface LoadAddedAgentDeps {
   getAgent: (searchParameter: { id: string }) => Promise<Agent | null>;
   getMCPServerTools: (
@@ -80,6 +109,16 @@ export async function loadAddedAgent(
   }
 
   const appConfig = req.config as AppConfig | undefined;
+  const ephemeralAgent = rest.ephemeralAgent as
+    | {
+        mcp?: string[];
+        execute_code?: boolean;
+        file_search?: boolean;
+        web_search?: boolean;
+        image_generation?: boolean;
+        artifacts?: unknown;
+      }
+    | undefined;
 
   const primaryIsEphemeral = primaryAgent && isEphemeralAgentId(primaryAgent.id);
   if (primaryIsEphemeral && Array.isArray(primaryAgent.tools)) {
@@ -96,8 +135,7 @@ export async function loadAddedAgent(
       }
     }
 
-    const modelSpecs = (appConfig?.modelSpecs as { list?: Array<{ name: string; label?: string }> })
-      ?.list;
+    const modelSpecs = (appConfig?.modelSpecs as { list?: TModelSpec[] })?.list;
     const modelSpec = spec != null && spec !== '' ? modelSpecs?.find((s) => s.name === spec) : null;
     const sender =
       rest.modelLabel ??
@@ -106,41 +144,23 @@ export async function loadAddedAgent(
       '';
     const ephemeralId = encodeEphemeralAgentId({ endpoint, model, sender, index: 1 });
 
-    return {
+    const result: Record<string, unknown> = {
       id: ephemeralId,
       instructions: promptPrefix || '',
       provider: endpoint,
       model_parameters: {},
       model,
       tools: [...primaryAgent.tools],
-    } as unknown as Agent;
+    };
+    applyModelSpecSkills(result, modelSpec);
+    applyModelSpecSubagents(result, modelSpec);
+    return result as unknown as Agent;
   }
 
-  const ephemeralAgent = rest.ephemeralAgent as
-    | {
-        mcp?: string[];
-        execute_code?: boolean;
-        file_search?: boolean;
-        web_search?: boolean;
-        image_generation?: boolean;
-        artifacts?: unknown;
-      }
-    | undefined;
   const mcpServers = new Set<string>(ephemeralAgent?.mcp);
   const userId = req.user?.id ?? '';
 
-  const modelSpecs = (
-    appConfig?.modelSpecs as {
-      list?: Array<{
-        name: string;
-        label?: string;
-        mcpServers?: string[];
-        executeCode?: boolean;
-        fileSearch?: boolean;
-        webSearch?: boolean;
-      }>;
-    }
-  )?.list;
+  const modelSpecs = (appConfig?.modelSpecs as { list?: TModelSpec[] })?.list;
   let modelSpec: (typeof modelSpecs extends Array<infer T> | undefined ? T : never) | null = null;
   if (spec != null && spec !== '') {
     modelSpec = modelSpecs?.find((s) => s.name === spec) ?? null;
@@ -170,7 +190,13 @@ export async function loadAddedAgent(
     if (addedServers.has(mcpServer)) {
       continue;
     }
-    const serverTools = await deps.getMCPServerTools(userId, mcpServer);
+    /** Request-tier overlays are invisible to the cache service's registry
+     *  resolver — overlay-scoped servers expand fresh via `mcp_all` instead */
+    const overlayConfig = appConfig?.mcpConfig?.[mcpServer];
+    const serverTools =
+      overlayConfig && requiresEphemeralUserConnection(overlayConfig)
+        ? null
+        : await deps.getMCPServerTools(userId, mcpServer);
     if (!serverTools) {
       tools.push(`${mcp_all}${mcp_delimiter}${mcpServer}`);
       addedServers.add(mcpServer);
@@ -230,6 +256,8 @@ export async function loadAddedAgent(
   if (ephemeralAgent?.artifacts != null && ephemeralAgent.artifacts) {
     result.artifacts = ephemeralAgent.artifacts;
   }
+  applyModelSpecSubagents(result, modelSpec);
+  applyModelSpecSkills(result, modelSpec);
 
   return result as unknown as Agent;
 }
diff --git a/packages/api/src/agents/chain.ts b/packages/api/src/agents/chain.ts
index e00d5373259..62eb697d776 100644
--- a/packages/api/src/agents/chain.ts
+++ b/packages/api/src/agents/chain.ts
@@ -14,7 +14,7 @@ const DEFAULT_PROMPT_TEMPLATE = `Based on the following conversation and analysi
  */
 export async function createSequentialChainEdges(
   agentIds: string[],
-  promptTemplate = DEFAULT_PROMPT_TEMPLATE,
+  promptTemplate: string = DEFAULT_PROMPT_TEMPLATE,
 ): Promise<GraphEdge[]> {
   const edges: GraphEdge[] = [];
 
diff --git a/packages/api/src/agents/client.spec.ts b/packages/api/src/agents/client.spec.ts
new file mode 100644
index 00000000000..ab2c32ac249
--- /dev/null
+++ b/packages/api/src/agents/client.spec.ts
@@ -0,0 +1,54 @@
+import { ContentTypes } from 'librechat-data-provider';
+import { prependFileContext, type FormattedMessageWithContent } from './client';
+
+describe('prependFileContext', () => {
+  it('prepends file context to string content', () => {
+    const message: FormattedMessageWithContent = { content: 'Answer this question.' };
+
+    prependFileContext(message, 'Attached file text');
+
+    expect(message.content).toBe('Attached file text\nAnswer this question.');
+  });
+
+  it('prepends file context to the first text content part', () => {
+    const message: FormattedMessageWithContent = {
+      content: [
+        { type: ContentTypes.IMAGE_URL, image_url: { url: 'data:image/png;base64,abc' } },
+        { type: ContentTypes.TEXT, text: 'Answer this question.' },
+      ],
+    };
+
+    prependFileContext(message, 'Attached file text');
+
+    expect(Array.isArray(message.content)).toBe(true);
+    if (!Array.isArray(message.content)) {
+      throw new Error('Expected array content');
+    }
+    expect(message.content[1].text).toBe('Attached file text\nAnswer this question.');
+    expect(message.content[0]).toEqual({
+      type: ContentTypes.IMAGE_URL,
+      image_url: { url: 'data:image/png;base64,abc' },
+    });
+  });
+
+  it('adds a text content part when an array has no text part', () => {
+    const message: FormattedMessageWithContent = {
+      content: [{ type: ContentTypes.IMAGE_URL, image_url: { url: 'data:image/png;base64,abc' } }],
+    };
+
+    prependFileContext(message, 'Attached file text');
+
+    expect(message.content).toEqual([
+      { type: ContentTypes.TEXT, text: 'Attached file text' },
+      { type: ContentTypes.IMAGE_URL, image_url: { url: 'data:image/png;base64,abc' } },
+    ]);
+  });
+
+  it('leaves content unchanged when file context is empty', () => {
+    const message: FormattedMessageWithContent = { content: 'Answer this question.' };
+
+    prependFileContext(message, '');
+
+    expect(message.content).toBe('Answer this question.');
+  });
+});
diff --git a/packages/api/src/agents/client.ts b/packages/api/src/agents/client.ts
index e4969bf7fac..f758df9745d 100644
--- a/packages/api/src/agents/client.ts
+++ b/packages/api/src/agents/client.ts
@@ -14,7 +14,7 @@ import type { ServerRequest } from '~/types';
 import Tokenizer from '~/utils/tokenizer';
 import { logAxiosError } from '~/utils';
 
-export const omitTitleOptions = new Set([
+export const omitTitleOptions: Set<string> = new Set([
   'stream',
   'thinking',
   'streaming',
@@ -26,7 +26,13 @@ export const omitTitleOptions = new Set([
   'additionalModelRequestFields',
 ]);
 
-export function payloadParser({ req, endpoint }: { req: ServerRequest; endpoint: string }) {
+export function payloadParser({
+  req,
+  endpoint,
+}: {
+  req: ServerRequest;
+  endpoint: string;
+}): Record<string, unknown> | undefined {
   if (isAgentsEndpoint(endpoint)) {
     return;
   }
@@ -56,6 +62,42 @@ type ContentBlock = {
   tool_call?: { name?: string; args?: string; output?: string };
 };
 
+export type FormattedMessageContentPart = {
+  type?: string;
+  text?: string;
+  [key: string]: unknown;
+};
+
+export type FormattedMessageWithContent = {
+  content?: string | FormattedMessageContentPart[];
+};
+
+export function prependFileContext(
+  formattedMessage: FormattedMessageWithContent,
+  fileContext?: string | null,
+): void {
+  if (!fileContext) {
+    return;
+  }
+
+  if (typeof formattedMessage.content === 'string') {
+    formattedMessage.content = `${fileContext}\n${formattedMessage.content}`;
+    return;
+  }
+
+  if (!Array.isArray(formattedMessage.content)) {
+    return;
+  }
+
+  const textPart = formattedMessage.content.find((part) => part.type === ContentTypes.TEXT);
+  if (textPart != null && typeof textPart.text === 'string') {
+    textPart.text = `${fileContext}\n${textPart.text}`;
+    return;
+  }
+
+  formattedMessage.content.unshift({ type: ContentTypes.TEXT, text: fileContext });
+}
+
 function estimateImageDataTokens(data: string, isClaude: boolean): number {
   const dims = extractImageDimensions(data);
   if (dims == null) {
@@ -267,7 +309,7 @@ export function countFormattedMessageTokens(
 export function createTokenCounter(encoding: Parameters<typeof Tokenizer.getTokenCount>[1]) {
   const isClaude = encoding === 'claude';
   const countTokens = (text: string) => Tokenizer.getTokenCount(text, encoding);
-  return function (message: BaseMessage) {
+  return function (message: BaseMessage): number {
     const count = getTokenCountForMessage(
       message,
       countTokens,
@@ -277,7 +319,7 @@ export function createTokenCounter(encoding: Parameters<typeof Tokenizer.getToke
   };
 }
 
-export function logToolError(_graph: unknown, error: unknown, toolId: string) {
+export function logToolError(_graph: unknown, error: unknown, toolId: string): void {
   logAxiosError({
     error,
     message: `[api/server/controllers/agents/client.js #chatCompletion] Tool Error "${toolId}"`,
diff --git a/packages/api/src/agents/discovery.ts b/packages/api/src/agents/discovery.ts
index 57321a4cb3d..a627fdd5dda 100644
--- a/packages/api/src/agents/discovery.ts
+++ b/packages/api/src/agents/discovery.ts
@@ -69,6 +69,11 @@ export interface DiscoverConnectedAgentsParams {
    * allowlist (or the full accessible set when scoping is disabled).
    */
   computeAccessibleSkillIds?: (agent: Agent) => InitializeAgentParams['accessibleSkillIds'];
+  /** Optional per-sub-agent skill authoring gate, paired with the scoped skill IDs. */
+  computeSkillAuthoringAvailable?: (
+    agent: Agent,
+    accessibleSkillIds: InitializeAgentParams['accessibleSkillIds'],
+  ) => InitializeAgentParams['skillAuthoringAvailable'];
   /** Per-user skill active/inactive state, forwarded to each sub-agent. */
   skillStates?: InitializeAgentParams['skillStates'];
   /** Default active-on-share flag, forwarded to each sub-agent. */
@@ -148,6 +153,7 @@ export async function discoverConnectedAgents(
     parentMessageId,
     resourceType = ResourceType.AGENT,
     computeAccessibleSkillIds,
+    computeSkillAuthoringAvailable,
     skillStates,
     defaultActiveOnShare,
     codeEnvAvailable,
@@ -237,6 +243,7 @@ export async function discoverConnectedAgents(
       endpoint: EModelEndpoint.agents,
     };
 
+    const scopedSkillIds = computeAccessibleSkillIds?.(agent);
     const config = await initializeAgent(
       {
         req,
@@ -248,7 +255,8 @@ export async function discoverConnectedAgents(
         parentMessageId,
         endpointOption: subAgentEndpointOption,
         allowedProviders,
-        accessibleSkillIds: computeAccessibleSkillIds?.(agent),
+        accessibleSkillIds: scopedSkillIds,
+        skillAuthoringAvailable: computeSkillAuthoringAvailable?.(agent, scopedSkillIds),
         skillStates,
         defaultActiveOnShare,
         codeEnvAvailable,
diff --git a/packages/api/src/agents/handlers.spec.ts b/packages/api/src/agents/handlers.spec.ts
index 58a3b7287ac..0d843c92900 100644
--- a/packages/api/src/agents/handlers.spec.ts
+++ b/packages/api/src/agents/handlers.spec.ts
@@ -51,6 +51,22 @@ function invokeHandler(
   });
 }
 
+function invokeHandlerWithConfig(
+  handler: ReturnType<typeof createToolExecuteHandler>,
+  toolCalls: ToolCallRequest[],
+  configurable: Record<string, unknown>,
+): Promise<ToolExecuteResult[]> {
+  return new Promise((resolve, reject) => {
+    const request: ToolExecuteBatchRequest = {
+      toolCalls,
+      configurable,
+      resolve,
+      reject,
+    };
+    handler.handle('on_tool_execute', request);
+  });
+}
+
 /**
  * Sentinel non-empty `accessibleSkillIds` for fixtures that need to opt
  * into "skills are effectively in scope". The `read_file` handler short-
@@ -334,6 +350,7 @@ describe('createToolExecuteHandler', () => {
       const legacyPtcTool = createMockTool(Constants.PROGRAMMATIC_TOOL_CALLING, capturedConfigs);
       const toolRegistry = new Map([
         ['custom_tool', { name: 'custom_tool' }],
+        ['create_file', { name: 'create_file' }],
         [Constants.PROGRAMMATIC_TOOL_CALLING, { name: Constants.PROGRAMMATIC_TOOL_CALLING }],
         [
           Constants.BASH_PROGRAMMATIC_TOOL_CALLING,
@@ -344,7 +361,11 @@ describe('createToolExecuteHandler', () => {
       const ptcToolMap = new Map([['custom_tool', createMockTool('custom_tool', [])]]);
       const loadTools: ToolExecuteOptions['loadTools'] = jest.fn(async () => ({
         loadedTools: [legacyPtcTool] as never[],
-        configurable: { toolRegistry, ptcToolMap },
+        configurable: {
+          toolRegistry,
+          ptcToolMap,
+          fileAuthoringToolNames: new Set(['create_file']),
+        },
       }));
       const handler = createToolExecuteHandler({ loadTools });
 
@@ -362,6 +383,45 @@ describe('createToolExecuteHandler', () => {
     });
   });
 
+  describe('host file authoring collisions', () => {
+    it('invokes a loaded user tool named create_file when host file authoring is not active', async () => {
+      const capturedArgs: unknown[] = [];
+      const capturedConfigs: Record<string, unknown>[] = [];
+      const tool = createMockTool('create_file', capturedConfigs, { capturedArgs });
+      const loadTools: ToolExecuteOptions['loadTools'] = jest.fn(async () => ({
+        loadedTools: [tool] as never[],
+        configurable: { fileAuthoringToolNames: new Set<string>() },
+      }));
+      const handler = createToolExecuteHandler({ loadTools });
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_user_create_file',
+          name: 'create_file',
+          args: { custom: true },
+          codeSessionContext: {
+            session_id: 'ignored-session',
+            files: [
+              {
+                id: 'ignored-file',
+                name: 'ignored.txt',
+                storage_session_id: 'ignored-session',
+                resource_id: 'user-1',
+                kind: 'user',
+              },
+            ],
+          },
+        },
+      ]);
+
+      expect(result.status).toBe('success');
+      expect(result.content).toContain('create_file executed');
+      expect(capturedArgs).toEqual([{ custom: true }]);
+      expect(capturedConfigs[0].session_id).toBeUndefined();
+      expect(capturedConfigs[0]._injected_files).toBeUndefined();
+    });
+  });
+
   describe('tool error handling', () => {
     it('truncates oversized tool errors in the result and log context', async () => {
       const oversizedMessage = `tool failed: ${'x'.repeat(15_000)}`;
@@ -975,225 +1035,1479 @@ describe('createToolExecuteHandler', () => {
     });
   });
 
-  describe('read_file sandbox fallback (code-env paths + non-skill segments)', () => {
-    function makeReadFileHandler(params: {
-      codeEnvAvailable?: boolean;
-      accessibleSkillIds?: unknown[];
-      activeSkillNames?: Set<string>;
-      skillPrimedIdsByName?: Record<string, string>;
-      readSandboxFile?: ToolExecuteOptions['readSandboxFile'];
-      getSkillByName?: ToolExecuteOptions['getSkillByName'];
-    }) {
+  describe('file authoring tools for skills', () => {
+    const { Types } = jest.requireActual('mongoose') as typeof import('mongoose');
+    const SKILL_ID = new Types.ObjectId();
+    const req = {
+      user: {
+        id: 'user-1',
+        _id: new Types.ObjectId(),
+        role: 'USER',
+        name: 'Test User',
+      },
+      config: {},
+    } as never;
+
+    function makeAuthoringHandler(
+      params: Partial<ToolExecuteOptions>,
+      configurable?: Record<string, unknown>,
+    ) {
+      const toolConfigurable = {
+        req,
+        accessibleSkillIds: skillsInScope(),
+        skillAuthoringAvailable: true,
+        fileAuthoringToolNames: new Set(['create_file', 'edit_file']),
+        ...(configurable ?? {}),
+      };
       const loadTools: ToolExecuteOptions['loadTools'] = jest.fn(async () => ({
         loadedTools: [],
-        configurable: {
-          codeEnvAvailable: params.codeEnvAvailable === true,
-          accessibleSkillIds: params.accessibleSkillIds ?? [],
-          activeSkillNames: params.activeSkillNames,
-          skillPrimedIdsByName: params.skillPrimedIdsByName,
-        },
+        configurable: toolConfigurable,
       }));
       return createToolExecuteHandler({
         loadTools,
-        getSkillByName: params.getSkillByName,
-        readSandboxFile: params.readSandboxFile,
+        canCreateSkill: jest.fn(async () => true),
+        canEditSkill: jest.fn(async () => true),
+        grantSkillOwner: jest.fn(async () => undefined),
+        ...params,
       });
     }
 
-    it('routes /mnt/data/ paths to the sandbox fallback when codeEnv is available', async () => {
-      const readSandboxFile = jest.fn(async () => ({ content: 'hello-world' }));
-      const handler = makeReadFileHandler({
-        codeEnvAvailable: true,
-        accessibleSkillIds: skillsInScope(),
-        readSandboxFile,
+    it('creates a new SKILL.md through create_file', async () => {
+      const createSkill = jest.fn(async () => ({
+        skill: {
+          _id: SKILL_ID,
+          name: 'new-skill',
+          body: '# New skill',
+          version: 1,
+        },
+      }));
+      const grantSkillOwner = jest.fn(async () => undefined);
+      const handler = makeAuthoringHandler({
+        getSkillByName: jest.fn(async () => null),
+        createSkill: createSkill as unknown as ToolExecuteOptions['createSkill'],
+        grantSkillOwner,
       });
 
       const [result] = await invokeHandler(handler, [
         {
-          id: 'call_mnt_1',
-          name: Constants.READ_FILE,
-          args: { file_path: '/mnt/data/sentinel.txt' },
-          codeSessionContext: {
-            session_id: 'sess-X',
-            files: [{ id: 'f1', name: 'sentinel.txt', session_id: 'sess-X' }],
+          id: 'call_create_skill',
+          name: 'create_file',
+          args: {
+            file_path: 'skills/new-skill/SKILL.md',
+            content:
+              '---\nname: new-skill\ndescription: Use for tests\ndisable-model-invocation: true\nallowed-tools:\n  - execute_code\n---\n# New skill\n',
           },
-        } as unknown as ToolCallRequest,
+        },
       ]);
 
-      expect(readSandboxFile).toHaveBeenCalledWith({
-        file_path: '/mnt/data/sentinel.txt',
-        session_id: 'sess-X',
-        files: [{ id: 'f1', name: 'sentinel.txt', session_id: 'sess-X' }],
-      });
       expect(result.status).toBe('success');
-      expect(result.content).toContain('hello-world');
+      expect(result.content).toContain('Created skills/new-skill/SKILL.md');
+      expect(result.artifact).toMatchObject({
+        path: 'skills/new-skill/SKILL.md',
+        created: true,
+      });
+      expect(createSkill).toHaveBeenCalledWith(
+        expect.objectContaining({
+          name: 'new-skill',
+          description: 'Use for tests',
+          frontmatter: expect.objectContaining({
+            name: 'new-skill',
+            description: 'Use for tests',
+            'disable-model-invocation': true,
+            'allowed-tools': ['execute_code'],
+          }),
+        }),
+      );
+      expect(grantSkillOwner).toHaveBeenCalledWith({ req, skillId: SKILL_ID });
     });
 
-    it('returns a clear error for /mnt/data/ when codeEnv is not available', async () => {
-      const readSandboxFile = jest.fn();
-      const handler = makeReadFileHandler({
-        codeEnvAvailable: false,
-        accessibleSkillIds: skillsInScope(),
-        readSandboxFile,
+    it('adds required SKILL.md frontmatter when create_file only provides markdown', async () => {
+      const createSkill = jest.fn(async () => ({
+        skill: {
+          _id: SKILL_ID,
+          name: 'auto-skill',
+          body: '# Auto skill',
+          version: 1,
+        },
+      }));
+      const handler = makeAuthoringHandler({
+        getSkillByName: jest.fn(async () => null),
+        createSkill: createSkill as unknown as ToolExecuteOptions['createSkill'],
       });
 
       const [result] = await invokeHandler(handler, [
         {
-          id: 'call_mnt_2',
-          name: Constants.READ_FILE,
-          args: { file_path: '/mnt/data/sentinel.txt' },
+          id: 'call_create_auto_frontmatter',
+          name: 'create_file',
+          args: {
+            file_path: 'skills/auto-skill/SKILL.md',
+            content: '# Auto skill\nUse this skill when testing generated frontmatter.\n',
+          },
         },
       ]);
 
-      expect(readSandboxFile).not.toHaveBeenCalled();
-      expect(result.status).toBe('error');
-      expect(result.errorMessage).toContain('code-execution sandbox path');
+      expect(result.status).toBe('success');
+      expect(createSkill).toHaveBeenCalledWith(
+        expect.objectContaining({
+          name: 'auto-skill',
+          description: 'Use this skill when testing generated frontmatter.',
+          body: expect.stringContaining('name: auto-skill'),
+          frontmatter: expect.objectContaining({
+            name: 'auto-skill',
+            description: 'Use this skill when testing generated frontmatter.',
+          }),
+        }),
+      );
     });
 
-    it('falls back to sandbox when first segment is not a known skill name', async () => {
-      const readSandboxFile = jest.fn(async () => ({ content: 'sandbox-data' }));
-      const handler = makeReadFileHandler({
-        codeEnvAvailable: true,
-        accessibleSkillIds: skillsInScope(),
-        activeSkillNames: new Set(['only-real-skill']),
-        readSandboxFile,
+    it('preserves block-scalar SKILL.md descriptions when creating skills', async () => {
+      const createSkill = jest.fn(async () => ({
+        skill: {
+          _id: SKILL_ID,
+          name: 'block-description-skill',
+          body: '# Block description skill',
+          version: 1,
+        },
+      }));
+      const handler = makeAuthoringHandler({
+        getSkillByName: jest.fn(async () => null),
+        createSkill: createSkill as unknown as ToolExecuteOptions['createSkill'],
       });
 
       const [result] = await invokeHandler(handler, [
         {
-          id: 'call_unknown_skill',
-          name: Constants.READ_FILE,
-          args: { file_path: 'not-a-skill/foo.md' },
-          codeSessionContext: { session_id: 'sess-Y' },
-        } as unknown as ToolCallRequest,
+          id: 'call_create_block_description',
+          name: 'create_file',
+          args: {
+            file_path: 'skills/block-description-skill/SKILL.md',
+            content:
+              '---\nname: block-description-skill\ndescription: |-\n  Use this skill for long descriptions.\n  Keep both lines searchable.\n---\n# Block description skill\n',
+          },
+        },
       ]);
 
-      expect(readSandboxFile).toHaveBeenCalledWith(
-        expect.objectContaining({ file_path: 'not-a-skill/foo.md', session_id: 'sess-Y' }),
-      );
       expect(result.status).toBe('success');
-      expect(result.content).toContain('sandbox-data');
+      expect(createSkill).toHaveBeenCalledWith(
+        expect.objectContaining({
+          name: 'block-description-skill',
+          description: 'Use this skill for long descriptions.\nKeep both lines searchable.',
+          frontmatter: expect.objectContaining({
+            description: 'Use this skill for long descriptions.\nKeep both lines searchable.',
+          }),
+        }),
+      );
     });
 
-    it('does NOT misroute primed skills outside the catalog cap to the sandbox', async () => {
-      /**
-       * Regression for review P2 #2: manual ($-popover) and always-apply
-       * primes are intentionally resolved off the wider `accessibleSkillIds`
-       * ACL set BEFORE catalog injection — see `resolveManualSkills`.
-       * A primed skill name can therefore legitimately be ABSENT from
-       * `activeSkillNames` (which reflects the catalog after the
-       * `SKILL_CATALOG_LIMIT` cap and active filter).
-       *
-       * Without the primed-bypass, the `activeSkillNames` shortcut would
-       * misroute `read_file("primed-only-skill/references/foo.md")` to
-       * the sandbox even though the primed skill is in scope and
-       * `getSkillByName` would resolve it via the pinned `_id`.
-       */
-      const primedHex = '507f1f77bcf86cd799439060';
-      const getSkillByName = jest.fn(async () => ({
-        _id: primedHex as unknown as never,
-        name: 'primed-only-skill',
-        body: '# Primed skill body',
-        fileCount: 1,
+    it('can add bundled files to a newly created skill in the same tool batch', async () => {
+      const createdSkill = {
+        _id: SKILL_ID,
+        name: 'new-skill',
+        body: '# New skill',
+        fileCount: 0,
         version: 1,
+      };
+      const createSkill = jest.fn(async () => ({
+        skill: createdSkill,
       }));
-      const readSandboxFile = jest.fn();
-      const getSkillFileByPath = jest.fn(async () => ({
-        content: 'references content',
-        mimeType: 'text/markdown',
-        bytes: 18,
-        filepath: 'references/foo.md',
-        source: 'local',
-        relativePath: 'references/foo.md',
-        isBinary: false,
+      const getSkillByName = jest.fn(async () => createdSkill);
+      const saveSkillFileContent = jest.fn(async () => ({
+        bytes: 12,
+        relativePath: 'references/a.md',
       }));
-      const handler = createToolExecuteHandler({
-        loadTools: jest.fn(async () => ({
-          loadedTools: [],
-          configurable: {
-            codeEnvAvailable: true,
-            accessibleSkillIds: skillsInScope(),
-            /* Catalog visible names DO NOT include the primed skill — it's
-               outside the cap. */
-            activeSkillNames: new Set(['some-other-skill']),
-            /* But the prime resolver authorized it for this turn. */
-            skillPrimedIdsByName: { 'primed-only-skill': primedHex },
-          },
-        })),
-        getSkillByName,
-        getSkillFileByPath,
-        readSandboxFile,
-      });
+      const handler = makeAuthoringHandler(
+        {
+          getSkillByName,
+          createSkill: createSkill as unknown as ToolExecuteOptions['createSkill'],
+          getSkillFileByPath: jest.fn(async () => null),
+          saveSkillFileContent,
+        },
+        {
+          accessibleSkillIds: [],
+          skillPrimedIdsByName: {},
+          activeSkillNames: new Set(['stale-skill']),
+        },
+      );
 
-      const [result] = await invokeHandler(handler, [
+      const results = await invokeHandler(handler, [
         {
-          id: 'call_primed_outside_catalog',
-          name: Constants.READ_FILE,
-          args: { file_path: 'primed-only-skill/references/foo.md' },
+          id: 'call_create_skill',
+          name: 'create_file',
+          args: {
+            file_path: 'skills/new-skill/SKILL.md',
+            content: '---\nname: new-skill\ndescription: Use for tests\n---\n# New skill\n',
+          },
+        },
+        {
+          id: 'call_create_reference',
+          name: 'create_file',
+          args: {
+            file_path: 'skills/new-skill/references/a.md',
+            content: 'reference text',
+          },
         },
       ]);
 
-      // Primed skill resolved through the existing skill path, not the
-      // sandbox shortcut.
-      expect(readSandboxFile).not.toHaveBeenCalled();
-      expect(getSkillByName).toHaveBeenCalledWith('primed-only-skill', expect.any(Array), {});
-      expect(result.status).toBe('success');
-      expect(result.content).toContain('references content');
+      expect(results.map((r) => r.status)).toEqual(['success', 'success']);
+      expect(saveSkillFileContent).toHaveBeenCalledWith(
+        expect.objectContaining({
+          skillId: SKILL_ID,
+          relativePath: 'references/a.md',
+          content: 'reference text',
+        }),
+      );
     });
 
-    it('routes through sandbox when skills are not effectively enabled (empty accessibleSkillIds)', async () => {
-      /**
-       * `accessibleSkillIds: []` is what `resolveAgentScopedSkillIds`
-       * returns when the admin capability is off, the ephemeral badge is
-       * off, or the persisted agent has `skills_enabled !== true`. Skip
-       * the skill resolver entirely.
-       */
-      const readSandboxFile = jest.fn(async () => ({ content: 'sandbox-content' }));
-      const getSkillByName = jest.fn();
-      const handler = makeReadFileHandler({
-        codeEnvAvailable: true,
+    it('preserves newly authored skills across later tool execution rounds', async () => {
+      const createdSkill = {
+        _id: SKILL_ID,
+        name: 'round-skill',
+        body: '---\nname: round-skill\ndescription: Use for tests\n---\n# Round skill\n',
+        fileCount: 0,
+        version: 1,
+      };
+      const runtimeConfigurable = {
+        req,
         accessibleSkillIds: [],
-        readSandboxFile,
+        skillPrimedIdsByName: {},
+        activeSkillNames: new Set<string>(),
+        skillAuthoringAvailable: true,
+        fileAuthoringToolNames: new Set(['create_file', 'edit_file']),
+      };
+      const staleLoadedConfigurable = {
+        req,
+        accessibleSkillIds: [],
+        skillPrimedIdsByName: {},
+        activeSkillNames: new Set<string>(),
+        skillAuthoringAvailable: true,
+        fileAuthoringToolNames: new Set(['create_file', 'edit_file']),
+      };
+      let created = false;
+      const createSkill = jest.fn(async () => {
+        created = true;
+        return { skill: createdSkill };
+      });
+      const getSkillByName = jest.fn(async () => (created ? createdSkill : null));
+      const loadTools: ToolExecuteOptions['loadTools'] = jest.fn(async () => ({
+        loadedTools: [],
+        configurable: staleLoadedConfigurable,
+      }));
+      const handler = createToolExecuteHandler({
+        loadTools,
+        canCreateSkill: jest.fn(async () => true),
+        canEditSkill: jest.fn(async () => true),
+        grantSkillOwner: jest.fn(async () => undefined),
         getSkillByName,
+        createSkill: createSkill as unknown as ToolExecuteOptions['createSkill'],
       });
 
-      const [result] = await invokeHandler(handler, [
-        {
-          id: 'call_skills_off',
-          name: Constants.READ_FILE,
-          args: { file_path: 'whatever/path.md' },
-        },
-      ]);
+      const [createResult] = await invokeHandlerWithConfig(
+        handler,
+        [
+          {
+            id: 'call_create_round_skill',
+            name: 'create_file',
+            args: {
+              file_path: 'skills/round-skill/SKILL.md',
+              content: createdSkill.body,
+            },
+          },
+        ],
+        runtimeConfigurable,
+      );
+      const [readResult] = await invokeHandlerWithConfig(
+        handler,
+        [
+          {
+            id: 'call_read_round_skill',
+            name: Constants.READ_FILE,
+            args: { file_path: 'skills/round-skill/SKILL.md' },
+          },
+        ],
+        runtimeConfigurable,
+      );
 
-      expect(getSkillByName).not.toHaveBeenCalled();
-      expect(readSandboxFile).toHaveBeenCalled();
-      expect(result.status).toBe('success');
-      expect(result.content).toContain('sandbox-content');
+      expect(createResult.status).toBe('success');
+      expect(readResult.status).toBe('success');
+      expect(readResult.content).toContain('Round skill');
+      const lookupCalls = getSkillByName.mock.calls as unknown as Array<
+        [string, import('mongoose').Types.ObjectId[], Record<string, unknown>]
+      >;
+      const lastLookup = lookupCalls[lookupCalls.length - 1];
+      const lookupIds = lastLookup?.[1];
+      expect(lastLookup?.[0]).toBe('round-skill');
+      expect(lookupIds?.[0].toString()).toBe(SKILL_ID.toString());
+      expect(lastLookup?.[2]).toEqual({});
     });
 
-    it('returns a clear error when skills off + codeEnv off (nowhere to route)', async () => {
-      const handler = makeReadFileHandler({
-        codeEnvAvailable: false,
-        accessibleSkillIds: [],
+    it('refuses to overwrite an existing SKILL.md without overwrite: true', async () => {
+      const updateSkill = jest.fn();
+      const handler = makeAuthoringHandler({
+        getSkillByName: jest.fn(async () => ({
+          _id: SKILL_ID,
+          name: 'existing-skill',
+          body: '# Existing',
+          fileCount: 0,
+          version: 1,
+        })),
+        updateSkill,
       });
 
       const [result] = await invokeHandler(handler, [
         {
-          id: 'call_no_route',
-          name: Constants.READ_FILE,
-          args: { file_path: 'whatever/path.md' },
+          id: 'call_create_existing',
+          name: 'create_file',
+          args: {
+            file_path: 'skills/existing-skill/SKILL.md',
+            content: '---\nname: existing-skill\ndescription: Use for tests\n---\n# Updated\n',
+          },
         },
       ]);
 
       expect(result.status).toBe('error');
-      expect(result.errorMessage).toContain('Skill files are not available');
+      expect(result.errorMessage).toContain('overwrite: true');
+      expect(updateSkill).not.toHaveBeenCalled();
     });
 
-    it('still resolves a real skill when activeSkillNames knows the name', async () => {
-      const getSkillByName = jest.fn(async () => ({
-        _id: 'real-skill-id' as unknown as never,
-        name: 'real-skill',
-        body: '# Real Body',
+    it('rehydrates same-author existing skills before refusing a duplicate create_file', async () => {
+      const existingSkill = {
+        _id: SKILL_ID,
+        name: 'stale-skill',
+        body: '---\nname: stale-skill\ndescription: Existing\n---\n# Existing\n',
+        fileCount: 0,
+        version: 3,
+      };
+      const updateSkill = jest.fn();
+      const getAuthorSkillByName = jest.fn(async () => existingSkill);
+      const handler = makeAuthoringHandler(
+        {
+          getSkillByName: jest.fn(async () => null),
+          getAuthorSkillByName,
+          updateSkill,
+        },
+        {
+          accessibleSkillIds: [],
+          skillPrimedIdsByName: {},
+          activeSkillNames: new Set(['stale-skill']),
+        },
+      );
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_duplicate_stale_skill',
+          name: 'create_file',
+          args: {
+            file_path: 'skills/stale-skill/SKILL.md',
+            content: '---\nname: stale-skill\ndescription: Replacement\n---\n# Replacement\n',
+          },
+        },
+      ]);
+
+      expect(getAuthorSkillByName).toHaveBeenCalledWith({ req, name: 'stale-skill' });
+      expect(result.status).toBe('error');
+      expect(result.errorMessage).toContain('already exists');
+      expect(result.errorMessage).toContain('edit_file');
+      expect(result.errorMessage).toContain('overwrite: true');
+      expect(updateSkill).not.toHaveBeenCalled();
+    });
+
+    it('does not rehydrate same-author skills outside the current agent scope', async () => {
+      const updateSkill = jest.fn();
+      const getAuthorSkillByName = jest.fn(async () => ({
+        _id: SKILL_ID,
+        name: 'excluded-skill',
+        body: '---\nname: excluded-skill\ndescription: Excluded\n---\n# Excluded\n',
+        fileCount: 0,
+        version: 1,
+      }));
+      const handler = makeAuthoringHandler(
+        {
+          getSkillByName: jest.fn(async () => null),
+          getAuthorSkillByName,
+          updateSkill,
+        },
+        {
+          accessibleSkillIds: [],
+          skillPrimedIdsByName: {},
+          activeSkillNames: new Set(['hidden-recovered-skill']),
+        },
+      );
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_edit_excluded_skill',
+          name: 'edit_file',
+          args: {
+            file_path: 'skills/excluded-skill/SKILL.md',
+            old_text: '# Excluded',
+            new_text: '# Changed',
+          },
+        },
+      ]);
+
+      expect(result.status).toBe('error');
+      expect(result.errorMessage).toContain('not found or not accessible');
+      expect(getAuthorSkillByName).not.toHaveBeenCalled();
+      expect(updateSkill).not.toHaveBeenCalled();
+    });
+
+    it('does not treat stale same-author recovery as a hidden-skill prime', async () => {
+      const updateSkill = jest.fn();
+      const handler = makeAuthoringHandler(
+        {
+          getSkillByName: jest.fn(async () => null),
+          getAuthorSkillByName: jest.fn(async () => ({
+            _id: SKILL_ID,
+            name: 'hidden-recovered-skill',
+            body: '---\nname: hidden-recovered-skill\ndescription: Hidden\n---\n# Hidden\n',
+            fileCount: 0,
+            version: 1,
+            disableModelInvocation: true,
+          })),
+          updateSkill,
+        },
+        {
+          accessibleSkillIds: [],
+          skillPrimedIdsByName: {},
+          activeSkillNames: new Set(['hidden-recovered-skill']),
+        },
+      );
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_recovered_hidden_skill',
+          name: 'edit_file',
+          args: {
+            file_path: 'skills/hidden-recovered-skill/SKILL.md',
+            old_text: '# Hidden',
+            new_text: '# Changed',
+          },
+        },
+      ]);
+
+      expect(result.status).toBe('error');
+      expect(result.errorMessage).toContain('cannot be authored by the model');
+      expect(updateSkill).not.toHaveBeenCalled();
+    });
+
+    it('edits a bundled skill file and returns strategies plus a diff', async () => {
+      const saveSkillFileContent = jest.fn(async () => ({
+        bytes: 10,
+        relativePath: 'references/a.md',
+      }));
+      const handler = makeAuthoringHandler({
+        getSkillByName: jest.fn(async () => ({
+          _id: SKILL_ID,
+          name: 'edit-skill',
+          body: '# Existing',
+          fileCount: 1,
+          version: 1,
+        })),
+        getSkillFileByPath: jest.fn(async () => ({
+          content: 'hello old\n',
+          isBinary: false,
+          mimeType: 'text/markdown',
+          bytes: 10,
+          filepath: '/tmp/a.md',
+          source: 'local',
+          relativePath: 'references/a.md',
+        })),
+        saveSkillFileContent,
+      });
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_edit_file',
+          name: 'edit_file',
+          args: {
+            file_path: 'skills/edit-skill/references/a.md',
+            old_text: 'hello old',
+            new_text: 'hello new',
+          },
+        },
+      ]);
+
+      expect(result.status).toBe('success');
+      expect(result.content).toContain('Strategies: exact');
+      expect(result.content).toContain('-hello old');
+      expect(result.content).toContain('+hello new');
+      expect(result.artifact).toMatchObject({
+        path: 'skills/edit-skill/references/a.md',
+        edits: 1,
+        strategies: ['exact'],
+      });
+      expect(saveSkillFileContent).toHaveBeenCalledWith(
+        expect.objectContaining({
+          relativePath: 'references/a.md',
+          content: 'hello new\n',
+          mimeType: 'text/markdown',
+        }),
+      );
+    });
+
+    it('rejects bundled skill file writes when the skill version changed after reading', async () => {
+      const getSkillByName = jest
+        .fn()
+        .mockResolvedValueOnce({
+          _id: SKILL_ID,
+          name: 'edit-skill',
+          body: '# Existing',
+          fileCount: 1,
+          version: 1,
+        })
+        .mockResolvedValueOnce({
+          _id: SKILL_ID,
+          name: 'edit-skill',
+          body: '# Existing changed elsewhere',
+          fileCount: 1,
+          version: 2,
+        });
+      const saveSkillFileContent = jest.fn();
+      const handler = makeAuthoringHandler({
+        getSkillByName,
+        getSkillFileByPath: jest.fn(async () => ({
+          content: 'hello old\n',
+          isBinary: false,
+          mimeType: 'text/markdown',
+          bytes: 10,
+          filepath: '/tmp/a.md',
+          source: 'local',
+          relativePath: 'references/a.md',
+        })),
+        saveSkillFileContent,
+      });
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_edit_stale_bundled_file',
+          name: 'edit_file',
+          args: {
+            file_path: 'skills/edit-skill/references/a.md',
+            old_text: 'hello old',
+            new_text: 'hello new',
+          },
+        },
+      ]);
+
+      expect(result.status).toBe('error');
+      expect(result.errorMessage).toContain('changed while editing');
+      expect(result.errorMessage).toContain('skills/edit-skill/references/a.md');
+      expect(saveSkillFileContent).not.toHaveBeenCalled();
+    });
+
+    it('passes structured frontmatter when editing SKILL.md', async () => {
+      const oldBody =
+        '---\nname: runtime-skill\ndescription: Use before\naction: ignored\n---\n# Body\n';
+      const currentBody =
+        '---\nname: runtime-skill\ndescription: Use before\nuser-invocable: true\ndisable-model-invocation: false\nallowed-tools:\n  - web_search\nalways-apply: true\n---\n# Body\n';
+      const updateSkill = jest.fn(async () => ({
+        status: 'updated',
+        skill: {
+          _id: SKILL_ID,
+          name: 'runtime-skill',
+          body: currentBody,
+          version: 2,
+        },
+      }));
+      const handler = makeAuthoringHandler({
+        getSkillByName: jest.fn(async () => ({
+          _id: SKILL_ID,
+          name: 'runtime-skill',
+          body: oldBody,
+          fileCount: 0,
+          version: 1,
+        })),
+        updateSkill: updateSkill as unknown as ToolExecuteOptions['updateSkill'],
+      });
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_edit_skill_md_frontmatter',
+          name: 'edit_file',
+          args: {
+            file_path: 'skills/runtime-skill/SKILL.md',
+            old_text: 'description: Use before\naction: ignored',
+            new_text:
+              'description: Use before\nuser-invocable: false\ndisable-model-invocation: true\nallowed-tools:\n  - execute_code\nalways-apply: true',
+          },
+        },
+      ]);
+
+      expect(result.status).toBe('success');
+      expect(updateSkill).toHaveBeenCalledWith(
+        expect.objectContaining({
+          update: expect.objectContaining({
+            alwaysApply: true,
+            frontmatter: expect.objectContaining({
+              name: 'runtime-skill',
+              description: 'Use before',
+              'user-invocable': false,
+              'disable-model-invocation': true,
+              'allowed-tools': ['execute_code'],
+              'always-apply': true,
+            }),
+          }),
+        }),
+      );
+    });
+
+    it('preserves block-scalar SKILL.md descriptions when editing skills', async () => {
+      const oldBody = '---\nname: runtime-skill\ndescription: Use before\n---\n# Runtime skill\n';
+      const updateSkill = jest.fn(async () => ({
+        status: 'updated',
+        skill: {
+          _id: SKILL_ID,
+          name: 'runtime-skill',
+          body: oldBody,
+          version: 2,
+        },
+      }));
+      const handler = makeAuthoringHandler({
+        getSkillByName: jest.fn(async () => ({
+          _id: SKILL_ID,
+          name: 'runtime-skill',
+          body: oldBody,
+          fileCount: 0,
+          version: 1,
+        })),
+        updateSkill: updateSkill as unknown as ToolExecuteOptions['updateSkill'],
+      });
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_edit_skill_md_block_description',
+          name: 'edit_file',
+          args: {
+            file_path: 'skills/runtime-skill/SKILL.md',
+            old_text: 'description: Use before',
+            new_text:
+              'description: |-\n  Use this skill for long descriptions.\n  Keep both lines searchable.',
+          },
+        },
+      ]);
+
+      expect(result.status).toBe('success');
+      expect(updateSkill).toHaveBeenCalledWith(
+        expect.objectContaining({
+          update: expect.objectContaining({
+            description: 'Use this skill for long descriptions.\nKeep both lines searchable.',
+            frontmatter: expect.objectContaining({
+              description: 'Use this skill for long descriptions.\nKeep both lines searchable.',
+            }),
+          }),
+        }),
+      );
+    });
+
+    it('rejects edit_file attempts to rename a skill through SKILL.md frontmatter', async () => {
+      const oldBody = '---\nname: runtime-skill\ndescription: Use before\n---\n# Runtime skill\n';
+      const updateSkill = jest.fn();
+      const handler = makeAuthoringHandler({
+        getSkillByName: jest.fn(async () => ({
+          _id: SKILL_ID,
+          name: 'runtime-skill',
+          body: oldBody,
+          fileCount: 0,
+          version: 1,
+        })),
+        updateSkill: updateSkill as unknown as ToolExecuteOptions['updateSkill'],
+      });
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_edit_skill_md_name',
+          name: 'edit_file',
+          args: {
+            file_path: 'skills/runtime-skill/SKILL.md',
+            old_text: 'name: runtime-skill',
+            new_text: 'name: dev-toolkit',
+          },
+        },
+      ]);
+
+      expect(result.status).toBe('error');
+      expect(result.errorMessage).toContain(
+        'frontmatter name "dev-toolkit" must match path skill name "runtime-skill"',
+      );
+      expect(result.errorMessage).toContain('edit_file cannot rename skills');
+      expect(updateSkill).not.toHaveBeenCalled();
+    });
+
+    it('fails loudly when edit_file old_text is ambiguous', async () => {
+      const saveSkillFileContent = jest.fn();
+      const handler = makeAuthoringHandler({
+        getSkillByName: jest.fn(async () => ({
+          _id: SKILL_ID,
+          name: 'ambiguous-skill',
+          body: '# Existing',
+          fileCount: 1,
+          version: 1,
+        })),
+        getSkillFileByPath: jest.fn(async () => ({
+          content: 'same\nsame\n',
+          isBinary: false,
+          mimeType: 'text/markdown',
+          bytes: 10,
+          filepath: '/tmp/a.md',
+          source: 'local',
+          relativePath: 'references/a.md',
+        })),
+        saveSkillFileContent,
+      });
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_edit_ambiguous',
+          name: 'edit_file',
+          args: {
+            file_path: 'skills/ambiguous-skill/references/a.md',
+            old_text: 'same',
+            new_text: 'different',
+          },
+        },
+      ]);
+
+      expect(result.status).toBe('error');
+      expect(result.errorMessage).toContain('matched 2 locations');
+      expect(saveSkillFileContent).not.toHaveBeenCalled();
+    });
+
+    it('blocks authoring hidden skills unless they were primed this turn', async () => {
+      const updateSkill = jest.fn();
+      const handler = makeAuthoringHandler(
+        {
+          getSkillByName: jest.fn(async () => ({
+            _id: SKILL_ID,
+            name: 'hidden-skill',
+            body: '---\nname: hidden-skill\ndescription: Hidden\n---\n# Hidden\n',
+            fileCount: 0,
+            version: 1,
+            disableModelInvocation: true,
+          })),
+          updateSkill: updateSkill as unknown as ToolExecuteOptions['updateSkill'],
+        },
+        {
+          skillPrimedIdsByName: {},
+          activeSkillNames: new Set(['hidden-skill']),
+        },
+      );
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_edit_hidden_skill',
+          name: 'edit_file',
+          args: {
+            file_path: 'skills/hidden-skill/SKILL.md',
+            old_text: '# Hidden',
+            new_text: '# Changed',
+          },
+        },
+      ]);
+
+      expect(result.status).toBe('error');
+      expect(result.errorMessage).toContain('cannot be authored by the model');
+      expect(updateSkill).not.toHaveBeenCalled();
+    });
+
+    it('allows authoring a hidden skill that was primed this turn', async () => {
+      const updateSkill = jest.fn(async () => ({
+        status: 'updated',
+        skill: {
+          _id: SKILL_ID,
+          name: 'primed-hidden-skill',
+          body: '---\nname: primed-hidden-skill\ndescription: Hidden\n---\n# Changed\n',
+          version: 2,
+        },
+      }));
+      const handler = makeAuthoringHandler(
+        {
+          getSkillByName: jest.fn(async () => ({
+            _id: SKILL_ID,
+            name: 'primed-hidden-skill',
+            body: '---\nname: primed-hidden-skill\ndescription: Hidden\n---\n# Hidden\n',
+            fileCount: 0,
+            version: 1,
+            disableModelInvocation: true,
+          })),
+          updateSkill: updateSkill as unknown as ToolExecuteOptions['updateSkill'],
+        },
+        {
+          skillPrimedIdsByName: { 'primed-hidden-skill': SKILL_ID.toString() },
+          activeSkillNames: new Set(['primed-hidden-skill']),
+        },
+      );
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_edit_primed_hidden_skill',
+          name: 'edit_file',
+          args: {
+            file_path: 'skills/primed-hidden-skill/SKILL.md',
+            old_text: '# Hidden',
+            new_text: '# Changed',
+          },
+        },
+      ]);
+
+      expect(result.status).toBe('success');
+      expect(updateSkill).toHaveBeenCalled();
+    });
+
+    it('overwrites large bundled skill files without reading the old content', async () => {
+      const saveSkillFileContent = jest.fn(async () => ({
+        bytes: 11,
+        relativePath: 'references/large.md',
+      }));
+      const getStrategyFunctions = jest.fn();
+      const handler = makeAuthoringHandler({
+        getSkillByName: jest.fn(async () => ({
+          _id: SKILL_ID,
+          name: 'large-skill',
+          body: '# Existing',
+          fileCount: 1,
+          version: 1,
+        })),
+        getSkillFileByPath: jest.fn(async () => ({
+          isBinary: false,
+          mimeType: 'text/markdown',
+          bytes: 600 * 1024,
+          filepath: '/tmp/large.md',
+          source: 'local',
+          relativePath: 'references/large.md',
+        })),
+        getStrategyFunctions,
+        saveSkillFileContent,
+      });
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_overwrite_large',
+          name: 'create_file',
+          args: {
+            file_path: 'skills/large-skill/references/large.md',
+            content: 'replacement',
+            overwrite: true,
+          },
+        },
+      ]);
+
+      expect(result.status).toBe('success');
+      expect(result.content).toContain('Updated skills/large-skill/references/large.md');
+      expect(saveSkillFileContent).toHaveBeenCalledWith(
+        expect.objectContaining({
+          relativePath: 'references/large.md',
+          content: 'replacement',
+        }),
+      );
+      expect(getStrategyFunctions).not.toHaveBeenCalled();
+    });
+
+    it('serializes same-file authoring calls so later edits see prior writes', async () => {
+      let storedContent = 'one\n';
+      const saveSkillFileContent = jest.fn(async ({ content }: { content: string }) => {
+        storedContent = content;
+        return {
+          bytes: Buffer.byteLength(content, 'utf8'),
+          relativePath: 'references/a.md',
+        };
+      });
+      const handler = makeAuthoringHandler({
+        getSkillByName: jest.fn(async () => ({
+          _id: SKILL_ID,
+          name: 'serial-skill',
+          body: '# Existing',
+          fileCount: 1,
+          version: 1,
+        })),
+        getSkillFileByPath: jest.fn(async () => ({
+          content: storedContent,
+          isBinary: false,
+          mimeType: 'text/markdown',
+          bytes: Buffer.byteLength(storedContent, 'utf8'),
+          filepath: '/tmp/a.md',
+          source: 'local',
+          relativePath: 'references/a.md',
+        })),
+        saveSkillFileContent,
+      });
+
+      const results = await invokeHandler(handler, [
+        {
+          id: 'call_edit_one',
+          name: 'edit_file',
+          args: {
+            file_path: 'skills/serial-skill/references/a.md',
+            old_text: 'one',
+            new_text: 'two',
+          },
+        },
+        {
+          id: 'call_edit_two',
+          name: 'edit_file',
+          args: {
+            file_path: 'skills/serial-skill/references/a.md',
+            old_text: 'two',
+            new_text: 'three',
+          },
+        },
+      ]);
+
+      expect(results.map((r) => r.status)).toEqual(['success', 'success']);
+      expect(storedContent).toBe('three\n');
+      expect(saveSkillFileContent).toHaveBeenCalledTimes(2);
+    });
+  });
+
+  describe('file authoring tools for code-exec sandbox files', () => {
+    const req = {
+      user: { id: 'user-1' },
+      config: {},
+    } as never;
+
+    function makeSandboxAuthoringHandler(params: Partial<ToolExecuteOptions>) {
+      const loadTools: ToolExecuteOptions['loadTools'] = jest.fn(async () => ({
+        loadedTools: [],
+        configurable: {
+          req,
+          codeEnvAvailable: true,
+          accessibleSkillIds: [],
+          skillAuthoringAvailable: false,
+          fileAuthoringToolNames: new Set(['create_file', 'edit_file']),
+        },
+      }));
+      return createToolExecuteHandler({
+        loadTools,
+        ...params,
+      });
+    }
+
+    it('creates a sandbox file when it does not already exist', async () => {
+      const readSandboxFile = jest.fn(async () => {
+        throw new Error('cat: /mnt/data/new.txt: No such file or directory');
+      });
+      const writeSandboxFile = jest.fn(async () => ({
+        stdout: 'WROTE 11 bytes to /mnt/data/new.txt\n',
+        session_id: 'sess-new',
+        files: [{ id: 'file-new', name: 'new.txt', storage_session_id: 'sess-new' }],
+      }));
+      const handler = makeSandboxAuthoringHandler({
+        readSandboxFile,
+        writeSandboxFile,
+      });
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_create_sandbox',
+          name: 'create_file',
+          args: {
+            file_path: '/mnt/data/new.txt',
+            content: 'hello world',
+          },
+          codeSessionContext: {
+            session_id: 'sess-prev',
+            files: [{ id: 'f1', name: 'input.csv', session_id: 'sess-prev' }],
+          },
+        } as unknown as ToolCallRequest,
+      ]);
+
+      expect(result.status).toBe('success');
+      expect(result.content).toContain('Created /mnt/data/new.txt');
+      expect(result.artifact).toMatchObject({
+        path: '/mnt/data/new.txt',
+        created: true,
+        session_id: 'sess-new',
+        files: [{ id: 'file-new', name: 'new.txt' }],
+      });
+      expect(writeSandboxFile).toHaveBeenCalledWith({
+        file_path: '/mnt/data/new.txt',
+        content: 'hello world',
+        session_id: 'sess-prev',
+        files: [{ id: 'f1', name: 'input.csv', session_id: 'sess-prev' }],
+        req,
+      });
+    });
+
+    it('refuses to overwrite an existing sandbox file without overwrite: true', async () => {
+      const writeSandboxFile = jest.fn();
+      const handler = makeSandboxAuthoringHandler({
+        readSandboxFile: jest.fn(async () => ({ content: 'existing text\n' })),
+        writeSandboxFile,
+      });
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_create_existing_sandbox',
+          name: 'create_file',
+          args: {
+            file_path: '/mnt/data/existing.txt',
+            content: 'new text\n',
+          },
+        },
+      ]);
+
+      expect(result.status).toBe('error');
+      expect(result.errorMessage).toContain('overwrite: true');
+      expect(writeSandboxFile).not.toHaveBeenCalled();
+    });
+
+    it('edits a sandbox file and returns diff, strategies, and session artifact', async () => {
+      const writeSandboxFile = jest.fn(async () => ({
+        stdout: 'WROTE 10 bytes to /mnt/data/edit.txt\n',
+        session_id: 'sess-edit',
+        files: [{ id: 'file-edit', name: 'edit.txt', storage_session_id: 'sess-edit' }],
+      }));
+      const handler = makeSandboxAuthoringHandler({
+        readSandboxFile: jest.fn(async () => ({ content: 'alpha old\n' })),
+        writeSandboxFile,
+      });
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_edit_sandbox',
+          name: 'edit_file',
+          args: {
+            file_path: '/mnt/data/edit.txt',
+            old_text: 'alpha old',
+            new_text: 'alpha new',
+          },
+        },
+      ]);
+
+      expect(result.status).toBe('success');
+      expect(result.content).toContain('Strategies: exact');
+      expect(result.content).toContain('-alpha old');
+      expect(result.content).toContain('+alpha new');
+      expect(result.artifact).toMatchObject({
+        path: '/mnt/data/edit.txt',
+        edits: 1,
+        strategies: ['exact'],
+        session_id: 'sess-edit',
+      });
+      expect(writeSandboxFile).toHaveBeenCalledWith(
+        expect.objectContaining({
+          file_path: '/mnt/data/edit.txt',
+          content: 'alpha new\n',
+        }),
+      );
+    });
+
+    it('propagates newly created sandbox sessions to queued same-path authoring calls', async () => {
+      let readCount = 0;
+      let writeCount = 0;
+      const sandboxFiles = [
+        { id: 'file-queued', name: 'queued.txt', storage_session_id: 'sess-new' },
+      ];
+      const readSandboxFile = jest.fn(
+        async ({
+          session_id,
+          files,
+        }: {
+          session_id?: string;
+          files?: Array<{ id: string; name: string; storage_session_id?: string }>;
+        }) => {
+          readCount++;
+          if (readCount === 1) {
+            throw new Error('cat: /mnt/data/queued.txt: No such file or directory');
+          }
+
+          expect(session_id).toBe('sess-new');
+          expect(files).toEqual(sandboxFiles);
+          return { content: 'hello world\n' };
+        },
+      );
+      const writeSandboxFile = jest.fn(
+        async ({
+          session_id,
+          files,
+          content,
+        }: {
+          session_id?: string;
+          files?: Array<{ id: string; name: string; storage_session_id?: string }>;
+          content: string;
+        }) => {
+          writeCount++;
+          if (writeCount === 1) {
+            expect(session_id).toBeUndefined();
+            expect(files).toBeUndefined();
+            expect(content).toBe('hello world\n');
+          } else {
+            expect(session_id).toBe('sess-new');
+            expect(files).toEqual(sandboxFiles);
+            expect(content).toBe('goodbye world\n');
+          }
+          return {
+            stdout: `WROTE ${content.length} bytes to /mnt/data/queued.txt\n`,
+            session_id: 'sess-new',
+            files: sandboxFiles,
+          };
+        },
+      );
+      const handler = makeSandboxAuthoringHandler({
+        readSandboxFile,
+        writeSandboxFile,
+      });
+
+      const results = await invokeHandler(handler, [
+        {
+          id: 'call_create_queued_sandbox',
+          name: 'create_file',
+          args: {
+            file_path: '/mnt/data/queued.txt',
+            content: 'hello world\n',
+          },
+        },
+        {
+          id: 'call_edit_queued_sandbox',
+          name: 'edit_file',
+          args: {
+            file_path: '/mnt/data/queued.txt',
+            old_text: 'hello world',
+            new_text: 'goodbye world',
+          },
+        },
+      ]);
+
+      expect(results.map((result) => result.status)).toEqual(['success', 'success']);
+      expect(readSandboxFile).toHaveBeenCalledTimes(2);
+      expect(writeSandboxFile).toHaveBeenCalledTimes(2);
+    });
+
+    it('rejects non-skill paths when code execution is unavailable', async () => {
+      const writeSandboxFile = jest.fn();
+      const loadTools: ToolExecuteOptions['loadTools'] = jest.fn(async () => ({
+        loadedTools: [],
+        configurable: {
+          req,
+          codeEnvAvailable: false,
+          accessibleSkillIds: [],
+          skillAuthoringAvailable: false,
+          fileAuthoringToolNames: new Set(['create_file', 'edit_file']),
+        },
+      }));
+      const handler = createToolExecuteHandler({
+        loadTools,
+        writeSandboxFile,
+      });
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_no_code_env_authoring',
+          name: 'create_file',
+          args: {
+            file_path: '/mnt/data/nope.txt',
+            content: 'nope',
+          },
+        },
+      ]);
+
+      expect(result.status).toBe('error');
+      expect(result.errorMessage).toContain('code execution enabled');
+      expect(writeSandboxFile).not.toHaveBeenCalled();
+    });
+
+    it('rejects skills/ paths for code-exec-only agents', async () => {
+      const createSkill = jest.fn();
+      const writeSandboxFile = jest.fn();
+      const handler = makeSandboxAuthoringHandler({
+        getSkillByName: jest.fn(async () => null),
+        createSkill: createSkill as unknown as ToolExecuteOptions['createSkill'],
+        writeSandboxFile,
+      });
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_code_only_skill_path',
+          name: 'create_file',
+          args: {
+            file_path: 'skills/nope/SKILL.md',
+            content: '---\nname: nope\ndescription: Nope\n---\n# Nope\n',
+          },
+        },
+      ]);
+
+      expect(result.status).toBe('error');
+      expect(result.errorMessage).toContain('Skill file authoring is not available');
+      expect(createSkill).not.toHaveBeenCalled();
+      expect(writeSandboxFile).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('read_file sandbox fallback (code-env paths + non-skill segments)', () => {
+    function makeReadFileHandler(params: {
+      codeEnvAvailable?: boolean;
+      accessibleSkillIds?: unknown[];
+      activeSkillNames?: Set<string>;
+      skillPrimedIdsByName?: Record<string, string>;
+      skillAuthoringAvailable?: boolean;
+      req?: unknown;
+      readSandboxFile?: ToolExecuteOptions['readSandboxFile'];
+      getSkillByName?: ToolExecuteOptions['getSkillByName'];
+      getAuthorSkillByName?: ToolExecuteOptions['getAuthorSkillByName'];
+    }) {
+      const loadTools: ToolExecuteOptions['loadTools'] = jest.fn(async () => ({
+        loadedTools: [],
+        configurable: {
+          req: params.req,
+          codeEnvAvailable: params.codeEnvAvailable === true,
+          accessibleSkillIds: params.accessibleSkillIds ?? [],
+          activeSkillNames: params.activeSkillNames,
+          skillPrimedIdsByName: params.skillPrimedIdsByName,
+          skillAuthoringAvailable: params.skillAuthoringAvailable === true,
+        },
+      }));
+      return createToolExecuteHandler({
+        loadTools,
+        getSkillByName: params.getSkillByName,
+        getAuthorSkillByName: params.getAuthorSkillByName,
+        readSandboxFile: params.readSandboxFile,
+      });
+    }
+
+    it('routes /mnt/data/ paths to the sandbox fallback when codeEnv is available', async () => {
+      const readSandboxFile = jest.fn(async () => ({ content: 'hello-world' }));
+      const handler = makeReadFileHandler({
+        codeEnvAvailable: true,
+        accessibleSkillIds: skillsInScope(),
+        readSandboxFile,
+      });
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_mnt_1',
+          name: Constants.READ_FILE,
+          args: { file_path: '/mnt/data/sentinel.txt' },
+          codeSessionContext: {
+            session_id: 'sess-X',
+            files: [{ id: 'f1', name: 'sentinel.txt', session_id: 'sess-X' }],
+          },
+        } as unknown as ToolCallRequest,
+      ]);
+
+      expect(readSandboxFile).toHaveBeenCalledWith({
+        file_path: '/mnt/data/sentinel.txt',
+        session_id: 'sess-X',
+        files: [{ id: 'f1', name: 'sentinel.txt', session_id: 'sess-X' }],
+      });
+      expect(result.status).toBe('success');
+      expect(result.content).toContain('hello-world');
+    });
+
+    it('returns a clear error for /mnt/data/ when codeEnv is not available', async () => {
+      const readSandboxFile = jest.fn();
+      const handler = makeReadFileHandler({
+        codeEnvAvailable: false,
+        accessibleSkillIds: skillsInScope(),
+        readSandboxFile,
+      });
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_mnt_2',
+          name: Constants.READ_FILE,
+          args: { file_path: '/mnt/data/sentinel.txt' },
+        },
+      ]);
+
+      expect(readSandboxFile).not.toHaveBeenCalled();
+      expect(result.status).toBe('error');
+      expect(result.errorMessage).toContain('code-execution sandbox path');
+    });
+
+    it('falls back to sandbox when first segment is not a known skill name', async () => {
+      const readSandboxFile = jest.fn(async () => ({ content: 'sandbox-data' }));
+      const handler = makeReadFileHandler({
+        codeEnvAvailable: true,
+        accessibleSkillIds: skillsInScope(),
+        activeSkillNames: new Set(['only-real-skill']),
+        readSandboxFile,
+      });
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_unknown_skill',
+          name: Constants.READ_FILE,
+          args: { file_path: 'not-a-skill/foo.md' },
+          codeSessionContext: { session_id: 'sess-Y' },
+        } as unknown as ToolCallRequest,
+      ]);
+
+      expect(readSandboxFile).toHaveBeenCalledWith(
+        expect.objectContaining({ file_path: 'not-a-skill/foo.md', session_id: 'sess-Y' }),
+      );
+      expect(result.status).toBe('success');
+      expect(result.content).toContain('sandbox-data');
+    });
+
+    it('does NOT misroute primed skills outside the catalog cap to the sandbox', async () => {
+      /**
+       * Regression for review P2 #2: manual ($-popover) and always-apply
+       * primes are intentionally resolved off the wider `accessibleSkillIds`
+       * ACL set BEFORE catalog injection — see `resolveManualSkills`.
+       * A primed skill name can therefore legitimately be ABSENT from
+       * `activeSkillNames` (which reflects the catalog after the
+       * `SKILL_CATALOG_LIMIT` cap and active filter).
+       *
+       * Without the primed-bypass, the `activeSkillNames` shortcut would
+       * misroute `read_file("primed-only-skill/references/foo.md")` to
+       * the sandbox even though the primed skill is in scope and
+       * `getSkillByName` would resolve it via the pinned `_id`.
+       */
+      const primedHex = '507f1f77bcf86cd799439060';
+      const getSkillByName = jest.fn(async () => ({
+        _id: primedHex as unknown as never,
+        name: 'primed-only-skill',
+        body: '# Primed skill body',
+        fileCount: 1,
+        version: 1,
+      }));
+      const readSandboxFile = jest.fn();
+      const getSkillFileByPath = jest.fn(async () => ({
+        content: 'references content',
+        mimeType: 'text/markdown',
+        bytes: 18,
+        filepath: 'references/foo.md',
+        source: 'local',
+        relativePath: 'references/foo.md',
+        isBinary: false,
+      }));
+      const handler = createToolExecuteHandler({
+        loadTools: jest.fn(async () => ({
+          loadedTools: [],
+          configurable: {
+            codeEnvAvailable: true,
+            accessibleSkillIds: skillsInScope(),
+            /* Catalog visible names DO NOT include the primed skill — it's
+               outside the cap. */
+            activeSkillNames: new Set(['some-other-skill']),
+            /* But the prime resolver authorized it for this turn. */
+            skillPrimedIdsByName: { 'primed-only-skill': primedHex },
+          },
+        })),
+        getSkillByName,
+        getSkillFileByPath,
+        readSandboxFile,
+      });
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_primed_outside_catalog',
+          name: Constants.READ_FILE,
+          args: { file_path: 'primed-only-skill/references/foo.md' },
+        },
+      ]);
+
+      // Primed skill resolved through the existing skill path, not the
+      // sandbox shortcut.
+      expect(readSandboxFile).not.toHaveBeenCalled();
+      expect(getSkillByName).toHaveBeenCalledWith('primed-only-skill', expect.any(Array), {});
+      expect(result.status).toBe('success');
+      expect(result.content).toContain('references content');
+    });
+
+    it('rehydrates same-author skills when activeSkillNames is stale', async () => {
+      const { Types } = jest.requireActual('mongoose') as typeof import('mongoose');
+      const skillId = new Types.ObjectId();
+      const req = {
+        user: {
+          id: 'user-1',
+          _id: new Types.ObjectId(),
+          role: 'USER',
+        },
+      } as never;
+      const recoveredSkill = {
+        _id: skillId,
+        name: 'stale-catalog-skill',
+        body: '# Recovered Body',
+        fileCount: 0,
+        version: 4,
+      };
+      const getAuthorSkillByName = jest.fn(async () => recoveredSkill);
+      const getSkillByName = jest.fn(async (_name: string, ids: unknown[]) =>
+        ids.some((id) => id?.toString() === skillId.toString()) ? recoveredSkill : null,
+      );
+      const readSandboxFile = jest.fn();
+      const handler = makeReadFileHandler({
+        req,
+        codeEnvAvailable: true,
+        skillAuthoringAvailable: true,
+        accessibleSkillIds: skillsInScope(),
+        activeSkillNames: new Set(['stale-catalog-skill']),
+        readSandboxFile,
+        getAuthorSkillByName,
+        getSkillByName,
+      });
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_stale_catalog_skill',
+          name: Constants.READ_FILE,
+          args: { file_path: 'stale-catalog-skill/SKILL.md' },
+        },
+      ]);
+
+      expect(getAuthorSkillByName).toHaveBeenCalledWith({ req, name: 'stale-catalog-skill' });
+      expect(readSandboxFile).not.toHaveBeenCalled();
+      expect(getSkillByName).toHaveBeenCalledWith(
+        'stale-catalog-skill',
+        expect.arrayContaining([skillId]),
+        expect.objectContaining({ preferModelInvocable: true }),
+      );
+      expect(result.status).toBe('success');
+      expect(result.content).toContain('Recovered Body');
+    });
+
+    it('routes through sandbox when skills are not effectively enabled (empty accessibleSkillIds)', async () => {
+      /**
+       * `accessibleSkillIds: []` is what `resolveAgentScopedSkillIds`
+       * returns when the admin capability is off, the ephemeral badge is
+       * off, or the persisted agent has `skills_enabled !== true`. Skip
+       * the skill resolver entirely.
+       */
+      const readSandboxFile = jest.fn(async () => ({ content: 'sandbox-content' }));
+      const getSkillByName = jest.fn();
+      const handler = makeReadFileHandler({
+        codeEnvAvailable: true,
+        accessibleSkillIds: [],
+        readSandboxFile,
+        getSkillByName,
+      });
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_skills_off',
+          name: Constants.READ_FILE,
+          args: { file_path: 'whatever/path.md' },
+        },
+      ]);
+
+      expect(getSkillByName).not.toHaveBeenCalled();
+      expect(readSandboxFile).toHaveBeenCalled();
+      expect(result.status).toBe('success');
+      expect(result.content).toContain('sandbox-content');
+    });
+
+    it('returns a clear error when skills off + codeEnv off (nowhere to route)', async () => {
+      const handler = makeReadFileHandler({
+        codeEnvAvailable: false,
+        accessibleSkillIds: [],
+      });
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_no_route',
+          name: Constants.READ_FILE,
+          args: { file_path: 'whatever/path.md' },
+        },
+      ]);
+
+      expect(result.status).toBe('error');
+      expect(result.errorMessage).toContain('Skill files are not available');
+    });
+
+    it('still resolves a real skill when activeSkillNames knows the name', async () => {
+      const getSkillByName = jest.fn(async () => ({
+        _id: 'real-skill-id' as unknown as never,
+        name: 'real-skill',
+        body: '# Real Body',
         fileCount: 0,
         version: 1,
       }));
@@ -1220,6 +2534,66 @@ describe('createToolExecuteHandler', () => {
       expect(result.content).toContain('Real Body');
     });
 
+    it('resolves authored skills/{skillName}/... paths without falling back to sandbox', async () => {
+      const getSkillByName = jest.fn(async () => ({
+        _id: 'real-skill-id' as unknown as never,
+        name: 'real-skill',
+        body: '# Real Body',
+        fileCount: 0,
+        version: 1,
+      }));
+      const readSandboxFile = jest.fn();
+      const handler = makeReadFileHandler({
+        codeEnvAvailable: true,
+        accessibleSkillIds: skillsInScope(),
+        activeSkillNames: new Set(['real-skill']),
+        readSandboxFile,
+        getSkillByName,
+      });
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_real_skill_namespace',
+          name: Constants.READ_FILE,
+          args: { file_path: 'skills/real-skill/SKILL.md' },
+        },
+      ]);
+
+      expect(getSkillByName).toHaveBeenCalledWith(
+        'real-skill',
+        expect.any(Array),
+        expect.objectContaining({ preferModelInvocable: true }),
+      );
+      expect(readSandboxFile).not.toHaveBeenCalled();
+      expect(result.status).toBe('success');
+      expect(result.content).toContain('File: skills/real-skill/SKILL.md');
+      expect(result.content).toContain('Real Body');
+    });
+
+    it('does not route explicit skills/ paths to the sandbox when skills are unavailable', async () => {
+      const readSandboxFile = jest.fn(async () => ({ content: 'sandbox-content' }));
+      const getSkillByName = jest.fn();
+      const handler = makeReadFileHandler({
+        codeEnvAvailable: true,
+        accessibleSkillIds: [],
+        readSandboxFile,
+        getSkillByName,
+      });
+
+      const [result] = await invokeHandler(handler, [
+        {
+          id: 'call_explicit_skill_namespace_off',
+          name: Constants.READ_FILE,
+          args: { file_path: 'skills/whatever/SKILL.md' },
+        },
+      ]);
+
+      expect(getSkillByName).not.toHaveBeenCalled();
+      expect(readSandboxFile).not.toHaveBeenCalled();
+      expect(result.status).toBe('error');
+      expect(result.errorMessage).toContain('Skill files are not available');
+    });
+
     it('falls back to sandbox for trailing-slash paths (empty relativePath, codeEnv on)', async () => {
       /**
        * Regression for review Finding #4: `read_file("output/")` is
@@ -1554,3 +2928,108 @@ describe('createToolExecuteHandler', () => {
     });
   });
 });
+
+describe('per-call onResult reporting', () => {
+  function deferred<T>(): { promise: Promise<T>; resolve: (value: T) => void } {
+    let resolveFn!: (value: T) => void;
+    const promise = new Promise<T>((res) => {
+      resolveFn = res;
+    });
+    return { promise, resolve: resolveFn };
+  }
+
+  it('reports each result as it settles, before the batch resolves', async () => {
+    const slowGate = deferred<void>();
+    const timeline: string[] = [];
+
+    const fastTool = {
+      name: 'fast_tool',
+      invoke: jest.fn(async () => {
+        timeline.push('fast:done');
+        return { content: 'fast result' };
+      }),
+    };
+    const slowTool = {
+      name: 'slow_tool',
+      invoke: jest.fn(async () => {
+        await slowGate.promise;
+        timeline.push('slow:done');
+        return { content: 'slow result' };
+      }),
+    };
+
+    const loadTools: ToolExecuteOptions['loadTools'] = jest.fn(async () => ({
+      loadedTools: [fastTool, slowTool] as never[],
+    }));
+    const handler = createToolExecuteHandler({ loadTools });
+
+    const reported: ToolExecuteResult[] = [];
+    const batchPromise = new Promise<ToolExecuteResult[]>((resolve, reject) => {
+      const request = {
+        toolCalls: [
+          { id: 'call_fast', name: 'fast_tool', args: {} },
+          { id: 'call_slow', name: 'slow_tool', args: {} },
+        ],
+        resolve,
+        reject,
+        onResult: (result: ToolExecuteResult) => {
+          reported.push(result);
+          timeline.push(`reported:${result.toolCallId}`);
+        },
+      } as ToolExecuteBatchRequest & {
+        onResult: (result: ToolExecuteResult) => void;
+      };
+      handler.handle('on_tool_execute', request);
+    });
+
+    // Let the fast tool settle and report while the slow tool is gated.
+    await new Promise((res) => setTimeout(res, 0));
+    expect(reported.map((r) => r.toolCallId)).toEqual(['call_fast']);
+
+    slowGate.resolve();
+    const results = await batchPromise;
+
+    expect(reported.map((r) => r.toolCallId)).toEqual(['call_fast', 'call_slow']);
+    expect(timeline.indexOf('reported:call_fast')).toBeLessThan(timeline.indexOf('slow:done'));
+    expect(results.map((r) => r.toolCallId).sort()).toEqual(['call_fast', 'call_slow']);
+    expect(results.find((r) => r.toolCallId === 'call_fast')?.content).toBe('fast result');
+  });
+
+  it('keeps the batch resolving when onResult throws', async () => {
+    const tool = {
+      name: 'sturdy_tool',
+      invoke: jest.fn(async () => ({ content: 'ok' })),
+    };
+    const loadTools: ToolExecuteOptions['loadTools'] = jest.fn(async () => ({
+      loadedTools: [tool] as never[],
+    }));
+    const handler = createToolExecuteHandler({ loadTools });
+
+    const results = await new Promise<ToolExecuteResult[]>((resolve, reject) => {
+      const request = {
+        toolCalls: [{ id: 'call_1', name: 'sturdy_tool', args: {} }],
+        resolve,
+        reject,
+        onResult: () => {
+          throw new Error('listener exploded');
+        },
+      } as ToolExecuteBatchRequest & { onResult: () => void };
+      handler.handle('on_tool_execute', request);
+    });
+
+    expect(results).toHaveLength(1);
+    expect(results[0]).toMatchObject({ toolCallId: 'call_1', content: 'ok' });
+  });
+
+  it('behaves identically when no onResult is provided', async () => {
+    const capturedConfigs: Record<string, unknown>[] = [];
+    const handler = createHandler(capturedConfigs);
+
+    const results = await invokeHandler(handler, [
+      { id: 'call_1', name: Constants.EXECUTE_CODE, args: { lang: 'py', code: '1' } },
+    ]);
+
+    expect(results).toHaveLength(1);
+    expect(results[0].status).toBe('success');
+  });
+});
diff --git a/packages/api/src/agents/handlers.ts b/packages/api/src/agents/handlers.ts
index 18eb86c4a3d..2de8884d2c9 100644
--- a/packages/api/src/agents/handlers.ts
+++ b/packages/api/src/agents/handlers.ts
@@ -1,5 +1,7 @@
+import yaml from 'js-yaml';
+import { Types } from 'mongoose';
 import { logger } from '@librechat/data-schemas';
-import { GraphEvents, Constants, CODE_EXECUTION_TOOLS } from '@librechat/agents';
+import { GraphEvents, Constants } from '@librechat/agents';
 import type {
   LCTool,
   EventHandler,
@@ -9,12 +11,18 @@ import type {
   ToolExecuteResult,
   ToolExecuteBatchRequest,
 } from '@librechat/agents';
-import { Types } from 'mongoose';
-import type { CodeEnvRef } from 'librechat-data-provider';
 import type { StructuredToolInterface } from '@librechat/agents/langchain/tools';
+import type { CodeEnvRef } from 'librechat-data-provider';
 import type { SkillFileRecord } from './skillFiles';
 import type { ServerRequest } from '~/types';
+import {
+  CREATE_FILE_TOOL_NAME,
+  EDIT_FILE_TOOL_NAME,
+  HOST_FILE_AUTHORING_ARTIFACT_KEY,
+  isCodeSessionToolName,
+} from './tools';
 import { logAxiosError, runOutsideTracing } from '~/utils';
+import { parseFrontmatter } from '../skills/import';
 import { buildSkillPrimeMessage } from './skills';
 import { cleanCodeToolOutput } from './cleanup';
 import { primeSkillFiles } from './skillFiles';
@@ -74,6 +82,8 @@ export interface ToolExecuteOptions {
      *  prior cache entry. */
     version: number;
     fileCount: number;
+    /** True for deployment-directory skills that are loaded in memory. */
+    deployment?: boolean;
     /**
      * Set when the skill author opted out of model invocation. The handler
      * rejects the call and returns an instructive error so the model knows
@@ -82,6 +92,81 @@ export interface ToolExecuteOptions {
      */
     disableModelInvocation?: boolean;
   } | null>;
+  /**
+   * Loads a skill by name when the current user is the author. This is a
+   * narrow recovery path for freshly-authored skills whose runtime catalog
+   * snapshot has not caught up yet; normal skill resolution still goes
+   * through `accessibleSkillIds`.
+   */
+  getAuthorSkillByName?: (params: { req: ServerRequest; name: string }) => Promise<{
+    body: string;
+    name: string;
+    _id: Types.ObjectId;
+    version: number;
+    fileCount: number;
+    disableModelInvocation?: boolean;
+  } | null>;
+  /** Creates a skill from a tool-authored SKILL.md body. */
+  createSkill?: (data: {
+    name: string;
+    description: string;
+    body: string;
+    frontmatter?: Record<string, unknown>;
+    author: Types.ObjectId;
+    authorName: string;
+    alwaysApply?: boolean;
+    tenantId?: string;
+  }) => Promise<{
+    skill: {
+      _id: Types.ObjectId;
+      name: string;
+      body: string;
+      version: number;
+    };
+  }>;
+  /** Updates a skill body and derived metadata from a tool-authored SKILL.md body. */
+  updateSkill?: (params: {
+    id: string;
+    expectedVersion: number;
+    update: {
+      body?: string;
+      description?: string;
+      frontmatter?: Record<string, unknown>;
+      alwaysApply?: boolean;
+    };
+  }) => Promise<
+    | {
+        status: 'updated';
+        skill: { _id: Types.ObjectId; name: string; body: string; version: number };
+      }
+    | { status: 'conflict'; current: { _id: Types.ObjectId; name: string; version: number } }
+    | { status: 'not_found' }
+  >;
+  /** Checks role-level skill creation permission for the current user. */
+  canCreateSkill?: (params: { req: ServerRequest }) => Promise<boolean>;
+  /** Checks resource-level edit permission for an existing skill. */
+  canEditSkill?: (params: {
+    req: ServerRequest;
+    skillId: Types.ObjectId | string;
+  }) => Promise<boolean>;
+  /** Grants SKILL_OWNER to the current user after a tool-created skill is inserted. */
+  grantSkillOwner?: (params: {
+    req: ServerRequest;
+    skillId: Types.ObjectId | string;
+  }) => Promise<void>;
+  /** Deletes a freshly-created skill if owner-permission setup fails. */
+  deleteSkill?: (id: string) => Promise<{ deleted: boolean }>;
+  /** Saves or replaces a bundled skill file in configured storage and metadata. */
+  saveSkillFileContent?: (params: {
+    req: ServerRequest;
+    skillId: Types.ObjectId | string;
+    relativePath: string;
+    content: string;
+    mimeType: string;
+  }) => Promise<{
+    bytes: number;
+    relativePath: string;
+  }>;
   /** Lists files bundled with a skill (for code env priming) */
   listSkillFiles?: (skillId: Types.ObjectId | string) => Promise<SkillFileRecord[]>;
   /** Storage strategy resolver for skill file streaming */
@@ -146,16 +231,37 @@ export interface ToolExecuteOptions {
   readSandboxFile?: (params: {
     file_path: string;
     session_id?: string;
-    files?: Array<{ id: string; name: string; session_id?: string }>;
+    files?: Array<{ id: string; name: string; session_id?: string; storage_session_id?: string }>;
     req?: ServerRequest;
   }) => Promise<{ content: string } | null>;
+  /**
+   * Writes a UTF-8 text file into the code-execution sandbox via the
+   * sandbox `/exec` endpoint. Mirrors `readSandboxFile` session forwarding
+   * so host-side file-authoring tools can operate in the same sandbox
+   * session as `bash_tool` / `read_file`.
+   */
+  writeSandboxFile?: (params: {
+    file_path: string;
+    content: string;
+    session_id?: string;
+    files?: Array<{ id: string; name: string; session_id?: string; storage_session_id?: string }>;
+    req?: ServerRequest;
+  }) => Promise<{
+    stdout?: string;
+    stderr?: string;
+    session_id?: string;
+    files?: Array<{ id: string; name: string; storage_session_id?: string; session_id?: string }>;
+  } | null>;
 }
 
 const MAX_READABLE_BYTES = 262_144;
 const MAX_BINARY_BYTES = 5 * 1024 * 1024;
 const MAX_CACHE_BYTES = 512 * 1024;
+const MAX_AUTHORING_BYTES = 10 * 1024 * 1024;
 const MAX_TOOL_ERROR_MESSAGE_CHARS = 12_000;
 const MAX_TOOL_ERROR_STACK_CHARS = 4_000;
+const SKILL_FILE_PREFIX = 'skills/';
+const SKILL_MD = 'SKILL.md';
 
 const IMAGE_MIMES = new Set(['image/png', 'image/jpeg', 'image/gif', 'image/webp']);
 
@@ -350,6 +456,599 @@ function addLineNumbers(content: string): string {
   return lines.map((l, i) => `${String(i + 1).padStart(w, ' ')} | ${l}`).join('\n');
 }
 
+type AuthoringSkill = NonNullable<
+  Awaited<ReturnType<NonNullable<ToolExecuteOptions['getSkillByName']>>>
+>;
+
+type AuthoringResult = Promise<ToolExecuteResult>;
+
+type ParsedSkillAuthoringPath = {
+  skillName: string;
+  relativePath: string;
+  displayPath: string;
+};
+
+type TextEdit = {
+  old_text: string;
+  new_text: string;
+};
+
+type MatchStatus =
+  | { status: 'matched'; index: number; length: number; strategy: string }
+  | { status: 'none' }
+  | { status: 'ambiguous'; strategy: string; count: number };
+
+type LoadedSkillText =
+  | { status: 'loaded'; content: string; bytes: number }
+  | { status: 'missing' }
+  | { status: 'error'; message: string };
+
+type ExistingSkillFile =
+  | { status: 'present'; oldContent?: string }
+  | { status: 'missing' }
+  | { status: 'error'; message: string };
+
+type LoadedSandboxText = LoadedSkillText;
+
+type SandboxSessionContext = {
+  session_id?: string;
+  files?: Array<{ id: string; name: string; session_id?: string; storage_session_id?: string }>;
+};
+
+const MIME_MAP: Readonly<Record<string, string>> = Object.freeze({
+  '.md': 'text/markdown',
+  '.txt': 'text/plain',
+  '.json': 'application/json',
+  '.js': 'application/javascript',
+  '.mjs': 'application/javascript',
+  '.cjs': 'application/javascript',
+  '.ts': 'application/typescript',
+  '.tsx': 'application/typescript',
+  '.jsx': 'application/javascript',
+  '.py': 'text/x-python',
+  '.sh': 'application/x-sh',
+  '.yaml': 'application/yaml',
+  '.yml': 'application/yaml',
+  '.css': 'text/css',
+  '.html': 'text/html',
+  '.xml': 'application/xml',
+  '.csv': 'text/csv',
+  '.toml': 'text/toml',
+  '.ini': 'text/ini',
+  '.svg': 'image/svg+xml',
+});
+
+function errorResult(tc: ToolCallRequest, errorMessage: string): ToolExecuteResult {
+  return {
+    toolCallId: tc.id,
+    status: 'error',
+    content: '',
+    errorMessage,
+  };
+}
+
+function successResult(
+  tc: ToolCallRequest,
+  content: string,
+  artifact?: unknown,
+): ToolExecuteResult {
+  const result: ToolExecuteResult = {
+    toolCallId: tc.id,
+    status: 'success',
+    content,
+  };
+  if (artifact !== undefined) {
+    result.artifact = artifact;
+  }
+  return result;
+}
+
+function guessMimeType(filename: string): string {
+  return MIME_MAP[lowercaseExtension(filename)] ?? 'application/octet-stream';
+}
+
+function isValidSkillName(value: string): boolean {
+  return /^[a-z0-9][a-z0-9-]*$/.test(value);
+}
+
+function isValidSkillFileRelativePath(value: string): boolean {
+  if (!value || value.length > 500) {
+    return false;
+  }
+  if (value.startsWith('/') || value.startsWith('\\')) {
+    return false;
+  }
+  if (!/^[a-zA-Z0-9._\-/]+$/.test(value)) {
+    return false;
+  }
+  const segments = value.split('/');
+  if (segments.some((segment) => segment === '' || segment === '.' || segment === '..')) {
+    return false;
+  }
+  return value !== SKILL_MD && segments[0] !== SKILL_MD;
+}
+
+function parseSkillAuthoringPath(filePath: string): ParsedSkillAuthoringPath | string {
+  if (!filePath.startsWith(SKILL_FILE_PREFIX)) {
+    return `Only skill file paths are supported. Use "skills/{skillName}/SKILL.md" or "skills/{skillName}/{path}".`;
+  }
+
+  const rest = filePath.slice(SKILL_FILE_PREFIX.length);
+  const slashIdx = rest.indexOf('/');
+  const skillName = slashIdx === -1 ? rest : rest.slice(0, slashIdx);
+  const relativePath = slashIdx === -1 ? SKILL_MD : rest.slice(slashIdx + 1) || SKILL_MD;
+
+  if (!isValidSkillName(skillName)) {
+    return `Invalid skill name "${skillName}". Skill names must be kebab-case.`;
+  }
+  if (relativePath !== SKILL_MD && !isValidSkillFileRelativePath(relativePath)) {
+    return (
+      `Invalid skill file path "${relativePath}". ` +
+      'Paths must be relative and cannot contain empty, "." or ".." segments.'
+    );
+  }
+
+  return {
+    skillName,
+    relativePath,
+    displayPath: `${SKILL_FILE_PREFIX}${skillName}/${relativePath}`,
+  };
+}
+
+function deriveSkillDescription(body: string, skillName: string): string {
+  const fallback = `Use this skill for ${skillName.replace(/-/g, ' ')}.`;
+  const headingCandidates: string[] = [];
+  for (const line of body.split('\n')) {
+    const trimmed = line.trim();
+    if (!trimmed) {
+      continue;
+    }
+    const withoutMarkdown = trimmed
+      .replace(/^#{1,6}\s+/, '')
+      .replace(/^[*>-]\s+/, '')
+      .trim();
+    if (!withoutMarkdown) {
+      continue;
+    }
+    if (/^#{1,6}\s+/.test(trimmed)) {
+      headingCandidates.push(withoutMarkdown);
+      continue;
+    }
+    return truncateMiddle(withoutMarkdown.replace(/\s+/g, ' '), 180);
+  }
+  const heading = headingCandidates[0];
+  return heading ? truncateMiddle(heading.replace(/\s+/g, ' '), 180) : fallback;
+}
+
+function splitSkillFrontmatter(content: string):
+  | {
+      block: string;
+      body: string;
+    }
+  | { error: string }
+  | null {
+  const trimmed = content.trim();
+  if (!trimmed.startsWith('---')) {
+    return null;
+  }
+  const afterOpening = trimmed.slice(3);
+  const closingIdx = afterOpening.indexOf('\n---');
+  if (closingIdx === -1) {
+    return { error: `Invalid ${SKILL_MD} frontmatter: missing closing "---".` };
+  }
+  const afterClosing = afterOpening.slice(closingIdx + '\n---'.length);
+  return {
+    block: afterOpening.slice(0, closingIdx),
+    body: afterClosing.startsWith('\n') ? afterClosing.slice(1) : afterClosing,
+  };
+}
+
+function buildSkillMdContent(frontmatter: Record<string, unknown>, body: string): string {
+  const dumped = yaml.dump(frontmatter, { lineWidth: -1 }).trimEnd();
+  const normalizedBody = body.trimStart();
+  return `---\n${dumped}\n---\n${normalizedBody}`;
+}
+
+function skillNameMismatchError(frontmatterName: string, skillName: string): string {
+  return `${SKILL_MD} frontmatter name "${frontmatterName}" must match path skill name "${skillName}". edit_file cannot rename skills; keep the name unchanged or create a new skills/{newName}/SKILL.md.`;
+}
+
+function normalizeSkillMdContent(
+  content: string,
+  skillName: string,
+): { status: 'success'; content: string } | { status: 'error'; error: string } {
+  const split = splitSkillFrontmatter(content);
+  if (split && 'error' in split) {
+    return { status: 'error', error: split.error };
+  }
+
+  let normalizedContent = content;
+  if (!split) {
+    normalizedContent = buildSkillMdContent(
+      {
+        name: skillName,
+        description: deriveSkillDescription(content, skillName),
+      },
+      content,
+    );
+  } else {
+    const structured = parseStructuredSkillFrontmatter(content);
+    if (structured.error) {
+      return { status: 'error', error: structured.error };
+    }
+    const frontmatter = { ...(structured.frontmatter ?? {}) };
+    const parsed = parseFrontmatter(content);
+    const frontmatterName =
+      typeof frontmatter.name === 'string' ? frontmatter.name : parsed.name || undefined;
+    if (frontmatterName && frontmatterName !== skillName) {
+      return {
+        status: 'error',
+        error: skillNameMismatchError(frontmatterName, skillName),
+      };
+    }
+    frontmatter.name = skillName;
+    const frontmatterDescription =
+      typeof frontmatter.description === 'string'
+        ? frontmatter.description
+        : parsed.description || undefined;
+    frontmatter.description =
+      frontmatterDescription || deriveSkillDescription(split.body, skillName);
+    normalizedContent = buildSkillMdContent(frontmatter, split.body);
+  }
+
+  const parsed = parseFrontmatter(normalizedContent);
+  if (!parsed.name || !parsed.description) {
+    return {
+      status: 'error',
+      error: `${SKILL_MD} must include YAML frontmatter with "name" and "description".`,
+    };
+  }
+  if (parsed.name !== skillName) {
+    return {
+      status: 'error',
+      error: skillNameMismatchError(parsed.name, skillName),
+    };
+  }
+  if (parsed.invalidBooleans.length > 0) {
+    return {
+      status: 'error',
+      error: parsed.invalidBooleans
+        .map((key) => `"${key}" in ${SKILL_MD} frontmatter must be a boolean`)
+        .join('; '),
+    };
+  }
+  return { status: 'success', content: normalizedContent };
+}
+
+function extractSkillFrontmatterBlock(content: string): string | null {
+  const split = splitSkillFrontmatter(content);
+  if (!split || 'error' in split) {
+    return null;
+  }
+  return split.block;
+}
+
+function parseStructuredSkillFrontmatter(
+  content: string,
+):
+  | { frontmatter?: Record<string, unknown>; error?: undefined }
+  | { frontmatter?: undefined; error: string } {
+  const block = extractSkillFrontmatterBlock(content);
+  if (block == null) {
+    return {};
+  }
+  try {
+    const parsed = yaml.load(block);
+    if (parsed == null) {
+      return { frontmatter: {} };
+    }
+    if (typeof parsed !== 'object' || Array.isArray(parsed)) {
+      return { error: `${SKILL_MD} frontmatter must be a YAML mapping.` };
+    }
+    return { frontmatter: parsed as Record<string, unknown> };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return { error: `Invalid ${SKILL_MD} frontmatter: ${message}` };
+  }
+}
+
+function parseSkillMdUpdate(content: string): {
+  description: string;
+  frontmatter?: Record<string, unknown>;
+  alwaysApply?: boolean;
+} {
+  const parsed = parseFrontmatter(content);
+  const structured = parseStructuredSkillFrontmatter(content);
+  const structuredDescription =
+    typeof structured.frontmatter?.description === 'string'
+      ? structured.frontmatter.description
+      : undefined;
+  return {
+    description: structuredDescription ?? parsed.description,
+    ...(structured.frontmatter !== undefined ? { frontmatter: structured.frontmatter } : {}),
+    ...(parsed.alwaysApply !== undefined ? { alwaysApply: parsed.alwaysApply } : {}),
+  };
+}
+
+function getAuthorInfo(req: ServerRequest): {
+  author: Types.ObjectId;
+  authorName: string;
+  tenantId?: string;
+} | null {
+  const user = req.user as
+    | {
+        id?: string;
+        _id?: Types.ObjectId | string;
+        name?: string;
+        username?: string;
+        tenantId?: string;
+      }
+    | undefined;
+  if (!user?.id) {
+    return null;
+  }
+  return {
+    author: (user._id ?? user.id) as Types.ObjectId,
+    authorName: user.name ?? user.username ?? 'Unknown',
+    ...(user.tenantId ? { tenantId: user.tenantId } : {}),
+  };
+}
+
+function normalizeEditArgs(args: {
+  old_text?: unknown;
+  new_text?: unknown;
+  edits?: unknown;
+}): TextEdit[] | string {
+  if (Array.isArray(args.edits) && args.edits.length > 0) {
+    const edits: TextEdit[] = [];
+    for (const edit of args.edits) {
+      if (!edit || typeof edit !== 'object') {
+        return 'Each edit must be an object with old_text and new_text.';
+      }
+      const entry = edit as { old_text?: unknown; new_text?: unknown };
+      if (typeof entry.old_text !== 'string' || typeof entry.new_text !== 'string') {
+        return 'Each edit requires string old_text and new_text.';
+      }
+      if (entry.old_text.length === 0) {
+        return 'old_text cannot be empty.';
+      }
+      edits.push({ old_text: entry.old_text, new_text: entry.new_text });
+    }
+    return edits;
+  }
+
+  if (typeof args.old_text !== 'string' || typeof args.new_text !== 'string') {
+    return 'Provide old_text and new_text, or a non-empty edits array.';
+  }
+  if (args.old_text.length === 0) {
+    return 'old_text cannot be empty.';
+  }
+  return [{ old_text: args.old_text, new_text: args.new_text }];
+}
+
+function countExactOccurrences(content: string, needle: string): number[] {
+  const indexes: number[] = [];
+  let start = 0;
+  while (start <= content.length) {
+    const index = content.indexOf(needle, start);
+    if (index === -1) {
+      break;
+    }
+    indexes.push(index);
+    start = index + Math.max(1, needle.length);
+  }
+  return indexes;
+}
+
+function findExactMatch(content: string, needle: string): MatchStatus {
+  const matches = countExactOccurrences(content, needle);
+  if (matches.length === 1) {
+    return { status: 'matched', index: matches[0], length: needle.length, strategy: 'exact' };
+  }
+  if (matches.length > 1) {
+    return { status: 'ambiguous', strategy: 'exact', count: matches.length };
+  }
+  return { status: 'none' };
+}
+
+function lineStarts(content: string): number[] {
+  const starts = [0];
+  for (let i = 0; i < content.length; i++) {
+    if (content[i] === '\n') {
+      starts.push(i + 1);
+    }
+  }
+  return starts;
+}
+
+function commonIndent(lines: string[]): number {
+  const indents = lines
+    .filter((line) => line.trim().length > 0)
+    .map((line) => {
+      const match = /^(\s*)/.exec(line);
+      return match ? match[1].length : 0;
+    });
+  return indents.length > 0 ? Math.min(...indents) : 0;
+}
+
+function stripCommonIndent(text: string): string {
+  const lines = text.split('\n');
+  const indent = commonIndent(lines);
+  if (indent === 0) {
+    return text;
+  }
+  return lines.map((line) => line.slice(Math.min(indent, line.length))).join('\n');
+}
+
+function findLineWindowMatch(
+  content: string,
+  needle: string,
+  strategy: 'line-trimmed' | 'indentation-flexible',
+): MatchStatus {
+  const contentLines = content.split('\n');
+  const needleLines = needle.split('\n');
+  if (needleLines.length > contentLines.length) {
+    return { status: 'none' };
+  }
+
+  const starts = lineStarts(content);
+  const normalizedNeedle =
+    strategy === 'line-trimmed'
+      ? needleLines.map((line) => line.trimEnd()).join('\n')
+      : stripCommonIndent(needle);
+  const matches: Array<{ index: number; length: number }> = [];
+
+  for (let i = 0; i <= contentLines.length - needleLines.length; i++) {
+    const windowLines = contentLines.slice(i, i + needleLines.length);
+    const candidate =
+      strategy === 'line-trimmed'
+        ? windowLines.map((line) => line.trimEnd()).join('\n')
+        : stripCommonIndent(windowLines.join('\n'));
+    if (candidate !== normalizedNeedle) {
+      continue;
+    }
+    const index = starts[i];
+    const endLine = i + needleLines.length;
+    const end = endLine < starts.length ? starts[endLine] - 1 : content.length;
+    matches.push({ index, length: end - index });
+  }
+
+  if (matches.length === 1) {
+    return { status: 'matched', ...matches[0], strategy };
+  }
+  if (matches.length > 1) {
+    return { status: 'ambiguous', strategy, count: matches.length };
+  }
+  return { status: 'none' };
+}
+
+function escapeRegExp(value: string): string {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+function findWhitespaceNormalizedMatch(content: string, needle: string): MatchStatus {
+  const tokens = needle.trim().split(/\s+/).filter(Boolean);
+  if (tokens.length < 2) {
+    return { status: 'none' };
+  }
+  const pattern = tokens.map(escapeRegExp).join('\\s+');
+  const regex = new RegExp(pattern, 'g');
+  const matches: Array<{ index: number; length: number }> = [];
+  let match: RegExpExecArray | null;
+  while ((match = regex.exec(content)) != null) {
+    matches.push({ index: match.index, length: match[0].length });
+    if (match[0].length === 0) {
+      regex.lastIndex += 1;
+    }
+  }
+  if (matches.length === 1) {
+    return { status: 'matched', ...matches[0], strategy: 'whitespace-normalized' };
+  }
+  if (matches.length > 1) {
+    return { status: 'ambiguous', strategy: 'whitespace-normalized', count: matches.length };
+  }
+  return { status: 'none' };
+}
+
+function findReplacementMatch(content: string, needle: string): MatchStatus {
+  const exact = findExactMatch(content, needle);
+  if (exact.status !== 'none') {
+    return exact;
+  }
+  const lineTrimmed = findLineWindowMatch(content, needle, 'line-trimmed');
+  if (lineTrimmed.status !== 'none') {
+    return lineTrimmed;
+  }
+  const whitespaceNormalized = findWhitespaceNormalizedMatch(content, needle);
+  if (whitespaceNormalized.status !== 'none') {
+    return whitespaceNormalized;
+  }
+  return findLineWindowMatch(content, needle, 'indentation-flexible');
+}
+
+function applyTextEdits(
+  content: string,
+  edits: TextEdit[],
+): { content: string; strategies: string[] } {
+  let working = content;
+  const strategies: string[] = [];
+
+  for (const edit of edits) {
+    const match = findReplacementMatch(working, edit.old_text);
+    if (match.status === 'none') {
+      throw new Error('old_text did not match the file content.');
+    }
+    if (match.status === 'ambiguous') {
+      throw new Error(
+        `old_text matched ${match.count} locations with ${match.strategy}; make it unique before retrying.`,
+      );
+    }
+    working =
+      working.slice(0, match.index) + edit.new_text + working.slice(match.index + match.length);
+    strategies.push(match.strategy);
+  }
+
+  return { content: working, strategies };
+}
+
+function formatRange(start: number, count: number): string {
+  return count === 1 ? String(start) : `${start},${count}`;
+}
+
+function createUnifiedDiff(filePath: string, oldContent: string, newContent: string): string {
+  if (oldContent === newContent) {
+    return '';
+  }
+
+  const oldLines = oldContent.split('\n');
+  const newLines = newContent.split('\n');
+  let prefix = 0;
+  while (
+    prefix < oldLines.length &&
+    prefix < newLines.length &&
+    oldLines[prefix] === newLines[prefix]
+  ) {
+    prefix += 1;
+  }
+
+  let oldSuffix = oldLines.length - 1;
+  let newSuffix = newLines.length - 1;
+  while (
+    oldSuffix >= prefix &&
+    newSuffix >= prefix &&
+    oldLines[oldSuffix] === newLines[newSuffix]
+  ) {
+    oldSuffix -= 1;
+    newSuffix -= 1;
+  }
+
+  const contextStart = Math.max(0, prefix - 3);
+  const oldContextEnd = Math.min(oldLines.length - 1, oldSuffix + 3);
+  const newContextEnd = Math.min(newLines.length - 1, newSuffix + 3);
+  const oldCount = oldContextEnd >= contextStart ? oldContextEnd - contextStart + 1 : 0;
+  const newCount = newContextEnd >= contextStart ? newContextEnd - contextStart + 1 : 0;
+  const lines = [
+    `--- a/${filePath}`,
+    `+++ b/${filePath}`,
+    `@@ -${formatRange(contextStart + 1, oldCount)} +${formatRange(contextStart + 1, newCount)} @@`,
+  ];
+
+  for (let i = contextStart; i < prefix; i++) {
+    lines.push(` ${oldLines[i]}`);
+  }
+  for (let i = prefix; i <= oldSuffix; i++) {
+    lines.push(`-${oldLines[i]}`);
+  }
+  for (let i = prefix; i <= newSuffix; i++) {
+    lines.push(`+${newLines[i]}`);
+  }
+  for (let i = oldSuffix + 1; i <= oldContextEnd; i++) {
+    lines.push(` ${oldLines[i]}`);
+  }
+
+  return lines.join('\n');
+}
+
 /**
  * Extensions whose contents `read_file` must never serialize as text. `cat`
  * on a PNG inside the sandbox returns the raw bytes as stdout, JSON-encoded
@@ -542,9 +1241,7 @@ async function handleSandboxFileFallback(
     };
   }
 
-  const ctx = tc.codeSessionContext as
-    | { session_id?: string; files?: Array<{ id: string; name: string; session_id?: string }> }
-    | undefined;
+  const ctx = tc.codeSessionContext as SandboxSessionContext | undefined;
   try {
     const result = await readSandboxFile({
       file_path: filePath,
@@ -604,74 +1301,1235 @@ async function handleSandboxFileFallback(
   }
 }
 
-async function handleReadFileCall(
+function sandboxSessionContext(
   tc: ToolCallRequest,
-  mergedConfigurable: Record<string, unknown>,
-  options: ToolExecuteOptions,
-  req?: ServerRequest,
-): Promise<ToolExecuteResult> {
-  const { getSkillByName, getSkillFileByPath, getStrategyFunctions, updateSkillFileContent } =
-    options;
-  const args = tc.args as { file_path?: string };
-  if (!args.file_path) {
-    return {
-      toolCallId: tc.id,
-      status: 'error',
-      content: '',
-      errorMessage: 'file_path is required',
+  override?: SandboxSessionContext,
+): SandboxSessionContext | undefined {
+  return override ?? (tc.codeSessionContext as SandboxSessionContext | undefined);
+}
+
+function cloneSandboxSessionContext(
+  context: SandboxSessionContext | undefined,
+): SandboxSessionContext {
+  return {
+    ...(context?.session_id ? { session_id: context.session_id } : {}),
+    ...(context?.files ? { files: context.files.map((file) => ({ ...file })) } : {}),
+  };
+}
+
+function mergeSandboxSessionArtifact(
+  context: SandboxSessionContext,
+  artifact: ToolExecuteResult['artifact'],
+): void {
+  if (!artifact || typeof artifact !== 'object') {
+    return;
+  }
+  const value = artifact as {
+    session_id?: unknown;
+    files?: unknown;
+  };
+  if (typeof value.session_id === 'string' && value.session_id.length > 0) {
+    context.session_id = value.session_id;
+  }
+  if (!Array.isArray(value.files)) {
+    return;
+  }
+
+  const files: SandboxSessionContext['files'] = [];
+  for (const file of value.files) {
+    if (!file || typeof file !== 'object') {
+      continue;
+    }
+    const ref = file as {
+      id?: unknown;
+      name?: unknown;
+      session_id?: unknown;
+      storage_session_id?: unknown;
     };
+    if (typeof ref.id !== 'string' || typeof ref.name !== 'string') {
+      continue;
+    }
+    files.push({
+      id: ref.id,
+      name: ref.name,
+      ...(typeof ref.session_id === 'string' ? { session_id: ref.session_id } : {}),
+      ...(typeof ref.storage_session_id === 'string'
+        ? { storage_session_id: ref.storage_session_id }
+        : {}),
+    });
   }
+  if (files.length > 0) {
+    context.files = files;
+  }
+}
 
-  const codeEnvAvailable = mergedConfigurable?.codeEnvAvailable === true;
-  const accessibleIds = (mergedConfigurable?.accessibleSkillIds as Types.ObjectId[]) ?? [];
-  /**
-   * `accessibleSkillIds` is the resolver's authoritative output (admin
-   * capability AND ACL access AND ephemeral badge / persisted
-   * `skills_enabled`). Empty ⇒ skills are not effectively in scope, so we
-   * skip skill resolution entirely and route to the sandbox fallback when
-   * the agent has code-execution available.
-   */
-  const skillsEffectivelyEnabled = accessibleIds.length > 0;
+function isSandboxMissingFileError(error: unknown): boolean {
+  const message = getThrownValueMessage(error).toLowerCase();
+  return (
+    message.includes('no such file or directory') ||
+    message.includes('cannot access') ||
+    message.includes('not found')
+  );
+}
 
-  /**
-   * Short-circuit absolute code-env paths: the path can never be a skill
-   * reference (skill paths are relative `{skillName}/...`), and consulting
-   * `getSkillByName` would just burn a DB round-trip on a guaranteed miss.
-   */
-  if (args.file_path.startsWith('/mnt/data/')) {
-    if (codeEnvAvailable) {
-      return handleSandboxFileFallback(tc, args.file_path, options, req);
+function invalidSandboxAuthoringPath(filePath: string): string | null {
+  if (filePath.length === 0) {
+    return 'file_path is required';
+  }
+  if (filePath.includes('\0')) {
+    return 'file_path cannot contain NUL bytes';
+  }
+  if (filePath.endsWith('/')) {
+    return `File path "${filePath}" points to a directory. Provide a file path.`;
+  }
+  return null;
+}
+
+async function loadSandboxTextForAuthoring({
+  filePath,
+  tc,
+  options,
+  req,
+  sandboxContext,
+}: {
+  filePath: string;
+  tc: ToolCallRequest;
+  options: ToolExecuteOptions;
+  req?: ServerRequest;
+  sandboxContext?: SandboxSessionContext;
+}): Promise<LoadedSandboxText> {
+  const ext = lowercaseExtension(filePath);
+  if (BINARY_EXTENSIONS_NEVER_READABLE.has(ext)) {
+    return { status: 'error', message: buildBinaryFileError(filePath, ext) };
+  }
+  if (!options.readSandboxFile) {
+    return {
+      status: 'error',
+      message: `Sandbox file reading is not configured. Use \`bash_tool\` to inspect "${filePath}".`,
+    };
+  }
+
+  const ctx = sandboxSessionContext(tc, sandboxContext);
+  try {
+    const result = await options.readSandboxFile({
+      file_path: filePath,
+      session_id: ctx?.session_id,
+      files: ctx?.files,
+      ...(req ? { req } : {}),
+    });
+    if (!result || result.content == null) {
+      return {
+        status: 'error',
+        message: `Failed to read "${filePath}" from the code-execution sandbox.`,
+      };
+    }
+    if (looksBinary(result.content)) {
+      return {
+        status: 'error',
+        message: `"${filePath}" appears to be binary and cannot be edited as text.`,
+      };
+    }
+    if (Buffer.byteLength(result.content, 'utf8') > MAX_AUTHORING_BYTES) {
+      return {
+        status: 'error',
+        message: `File "${filePath}" is too large to edit directly (${Buffer.byteLength(
+          result.content,
+          'utf8',
+        )} bytes, limit: ${MAX_AUTHORING_BYTES}).`,
+      };
     }
     return {
-      toolCallId: tc.id,
+      status: 'loaded',
+      content: result.content,
+      bytes: Buffer.byteLength(result.content, 'utf8'),
+    };
+  } catch (error) {
+    if (isSandboxMissingFileError(error)) {
+      return { status: 'missing' };
+    }
+    const message = getThrownValueMessage(error);
+    logger.warn(`[file_authoring] Sandbox read failed for "${filePath}": ${message}`);
+    return {
       status: 'error',
-      content: '',
-      errorMessage: `Path "${args.file_path}" is a code-execution sandbox path, but this agent does not have code execution enabled.`,
+      message: `Error reading "${filePath}" from the code-execution sandbox: ${message}.`,
     };
   }
+}
 
-  const slashIdx = args.file_path.indexOf('/');
-  if (slashIdx < 1) {
-    if (codeEnvAvailable) {
-      return handleSandboxFileFallback(tc, args.file_path, options, req);
+async function writeSandboxTextForAuthoring({
+  tc,
+  options,
+  req,
+  filePath,
+  content,
+  oldContent,
+  created,
+  sandboxContext,
+}: {
+  tc: ToolCallRequest;
+  options: ToolExecuteOptions;
+  req?: ServerRequest;
+  filePath: string;
+  content: string;
+  oldContent?: string;
+  created: boolean;
+  sandboxContext?: SandboxSessionContext;
+}): AuthoringResult {
+  if (!options.writeSandboxFile) {
+    return errorResult(
+      tc,
+      `Sandbox file writing is not configured. Use \`bash_tool\` to write "${filePath}".`,
+    );
+  }
+  const ctx = sandboxSessionContext(tc, sandboxContext);
+  let writeResult: Awaited<ReturnType<NonNullable<ToolExecuteOptions['writeSandboxFile']>>>;
+  try {
+    writeResult = await options.writeSandboxFile({
+      file_path: filePath,
+      content,
+      session_id: ctx?.session_id,
+      files: ctx?.files,
+      ...(req ? { req } : {}),
+    });
+  } catch (error) {
+    const message = getThrownValueMessage(error);
+    logger.warn(`[file_authoring] Sandbox write failed for "${filePath}": ${message}`);
+    return errorResult(
+      tc,
+      `Error writing "${filePath}" to the code-execution sandbox: ${message}.`,
+    );
+  }
+  if (!writeResult) {
+    return errorResult(tc, `Failed to write "${filePath}" to the code-execution sandbox.`);
+  }
+
+  const diff =
+    oldContent !== undefined ? createUnifiedDiff(filePath, oldContent, content) : undefined;
+  const action = created ? 'Created' : 'Updated';
+  const summary = `${action} ${filePath} (${content.length} chars).`;
+  return successResult(tc, diff ? `${summary}\n\n${diff}` : summary, {
+    path: filePath,
+    [HOST_FILE_AUTHORING_ARTIFACT_KEY]: true,
+    bytes_written: Buffer.byteLength(content, 'utf8'),
+    created,
+    ...(diff ? { diff } : {}),
+    ...(writeResult.session_id ? { session_id: writeResult.session_id } : {}),
+    ...(writeResult.files ? { files: writeResult.files } : {}),
+  });
+}
+
+async function resolveSkillForAuthoring(
+  skillName: string,
+  mergedConfigurable: Record<string, unknown>,
+  options: ToolExecuteOptions,
+): Promise<AuthoringSkill | null> {
+  const { getSkillByName } = options;
+  if (!getSkillByName) {
+    return null;
+  }
+
+  const skillPrimedIdsByName =
+    (mergedConfigurable?.skillPrimedIdsByName as Record<string, string> | undefined) ?? {};
+  const primedIdString = skillPrimedIdsByName[skillName];
+  if (primedIdString) {
+    return await getSkillByName(skillName, [new Types.ObjectId(primedIdString)], {});
+  }
+
+  const accessibleIds = (mergedConfigurable?.accessibleSkillIds as Types.ObjectId[]) ?? [];
+  if (accessibleIds.length === 0) {
+    return null;
+  }
+
+  return await getSkillByName(skillName, accessibleIds, { preferModelInvocable: true });
+}
+
+async function resolveAuthorSkillForCurrentUser({
+  skillName,
+  mergedConfigurable,
+  sourceConfigurable,
+  options,
+  req,
+}: {
+  skillName: string;
+  mergedConfigurable: Record<string, unknown>;
+  sourceConfigurable?: Record<string, unknown>;
+  options: ToolExecuteOptions;
+  req?: ServerRequest;
+}): Promise<AuthoringSkill | null> {
+  if (!req || !options.getAuthorSkillByName) {
+    return null;
+  }
+  if (!isSkillKnownToCurrentRun(skillName, mergedConfigurable)) {
+    return null;
+  }
+  const skill = await options.getAuthorSkillByName({ req, name: skillName });
+  if (!skill) {
+    return null;
+  }
+  rememberAuthoredSkill([mergedConfigurable, sourceConfigurable], skill, { prime: false });
+  return skill;
+}
+
+function isDuplicateSkillNameError(error: unknown): boolean {
+  const maybeError = error as { code?: string | number; message?: string } | undefined;
+  return (
+    maybeError?.code === 11000 ||
+    /skill with name .* already exists/i.test(maybeError?.message ?? '')
+  );
+}
+
+function isSkillAuthoringAvailable(mergedConfigurable: Record<string, unknown>): boolean {
+  return mergedConfigurable.skillAuthoringAvailable === true;
+}
+
+function getFileAuthoringToolNames(
+  mergedConfigurable: Record<string, unknown>,
+): Set<string> | undefined {
+  const names = mergedConfigurable.fileAuthoringToolNames;
+  return names instanceof Set ? (names as Set<string>) : undefined;
+}
+
+function isHostFileAuthoringToolCall(
+  toolName: string,
+  mergedConfigurable: Record<string, unknown>,
+): boolean {
+  return getFileAuthoringToolNames(mergedConfigurable)?.has(toolName) === true;
+}
+
+function isCodeSessionAwareToolCall(
+  toolName: string,
+  mergedConfigurable: Record<string, unknown>,
+): boolean {
+  return isCodeSessionToolName(toolName, getFileAuthoringToolNames(mergedConfigurable));
+}
+
+function isSkillPrimedForAuthoring(
+  skillName: string,
+  mergedConfigurable: Record<string, unknown>,
+): boolean {
+  const skillPrimedIdsByName =
+    (mergedConfigurable.skillPrimedIdsByName as Record<string, string> | undefined) ?? {};
+  return typeof skillPrimedIdsByName[skillName] === 'string';
+}
+
+function isSkillKnownToCurrentRun(
+  skillName: string,
+  mergedConfigurable: Record<string, unknown>,
+): boolean {
+  if (isSkillPrimedForAuthoring(skillName, mergedConfigurable)) {
+    return true;
+  }
+  const activeSkillNames = mergedConfigurable.activeSkillNames;
+  return activeSkillNames instanceof Set && activeSkillNames.has(skillName);
+}
+
+function hiddenSkillAuthoringDenied(
+  tc: ToolCallRequest,
+  skill: AuthoringSkill | null,
+  skillName: string,
+  mergedConfigurable: Record<string, unknown>,
+): ToolExecuteResult | null {
+  if (
+    skill?.disableModelInvocation !== true ||
+    isSkillPrimedForAuthoring(skillName, mergedConfigurable)
+  ) {
+    return null;
+  }
+  return errorResult(tc, `Skill "${skillName}" cannot be authored by the model`);
+}
+
+function mergeAccessibleSkillIds(
+  base: Record<string, unknown> | undefined,
+  loaded: Record<string, unknown> | undefined,
+): Types.ObjectId[] | undefined {
+  const values = [
+    ...(Array.isArray(loaded?.accessibleSkillIds)
+      ? (loaded.accessibleSkillIds as Types.ObjectId[])
+      : []),
+    ...(Array.isArray(base?.accessibleSkillIds)
+      ? (base.accessibleSkillIds as Types.ObjectId[])
+      : []),
+  ];
+  if (values.length === 0) {
+    return undefined;
+  }
+  const seen = new Set<string>();
+  const merged: Types.ObjectId[] = [];
+  for (const value of values) {
+    const key = value.toString();
+    if (seen.has(key)) {
+      continue;
+    }
+    seen.add(key);
+    merged.push(value);
+  }
+  return merged;
+}
+
+function mergeSkillPrimedIdsByName(
+  base: Record<string, unknown> | undefined,
+  loaded: Record<string, unknown> | undefined,
+): Record<string, string> | undefined {
+  const loadedPrimed = loaded?.skillPrimedIdsByName as Record<string, string> | undefined;
+  const basePrimed = base?.skillPrimedIdsByName as Record<string, string> | undefined;
+  const merged = { ...(loadedPrimed ?? {}), ...(basePrimed ?? {}) };
+  return Object.keys(merged).length > 0 ? merged : undefined;
+}
+
+function mergeActiveSkillNames(
+  base: Record<string, unknown> | undefined,
+  loaded: Record<string, unknown> | undefined,
+): Set<string> | undefined {
+  const names = new Set<string>();
+  const loadedNames = loaded?.activeSkillNames;
+  if (loadedNames instanceof Set) {
+    for (const name of loadedNames) {
+      names.add(name);
+    }
+  }
+  const baseNames = base?.activeSkillNames;
+  if (baseNames instanceof Set) {
+    for (const name of baseNames) {
+      names.add(name);
+    }
+  }
+  return names.size > 0 ? names : undefined;
+}
+
+function mergeToolConfigurables(
+  base: Record<string, unknown> | undefined,
+  loaded: Record<string, unknown> | undefined,
+): Record<string, unknown> {
+  const merged = { ...base, ...loaded };
+  const accessibleSkillIds = mergeAccessibleSkillIds(base, loaded);
+  if (accessibleSkillIds) {
+    merged.accessibleSkillIds = accessibleSkillIds;
+  }
+  const skillPrimedIdsByName = mergeSkillPrimedIdsByName(base, loaded);
+  if (skillPrimedIdsByName) {
+    merged.skillPrimedIdsByName = skillPrimedIdsByName;
+  }
+  const activeSkillNames = mergeActiveSkillNames(base, loaded);
+  if (activeSkillNames) {
+    merged.activeSkillNames = activeSkillNames;
+  }
+  return merged;
+}
+
+function rememberAuthoredSkill(
+  configurables: Array<Record<string, unknown> | undefined>,
+  skill: { _id: Types.ObjectId; name: string },
+  options: { prime?: boolean } = {},
+): void {
+  const prime = options.prime !== false;
+  const idString = skill._id.toString();
+  for (const configurable of configurables) {
+    if (!configurable) {
+      continue;
+    }
+
+    const accessibleIds = Array.isArray(configurable.accessibleSkillIds)
+      ? (configurable.accessibleSkillIds as Types.ObjectId[])
+      : [];
+    if (!Array.isArray(configurable.accessibleSkillIds)) {
+      configurable.accessibleSkillIds = accessibleIds;
+    }
+    if (!accessibleIds.some((id) => id.toString() === idString)) {
+      accessibleIds.push(skill._id);
+    }
+
+    if (prime) {
+      const primedIds =
+        (configurable.skillPrimedIdsByName as Record<string, string> | undefined) ?? {};
+      primedIds[skill.name] = idString;
+      configurable.skillPrimedIdsByName = primedIds;
     }
+
+    const activeSkillNames = configurable.activeSkillNames as Set<string> | undefined;
+    if (activeSkillNames) {
+      activeSkillNames.add(skill.name);
+    } else {
+      configurable.activeSkillNames = new Set([skill.name]);
+    }
+  }
+}
+
+async function ensureCanEditSkill(
+  tc: ToolCallRequest,
+  options: ToolExecuteOptions,
+  req: ServerRequest | undefined,
+  skillId: Types.ObjectId | string,
+): Promise<ToolExecuteResult | null> {
+  if (!req) {
+    return errorResult(tc, 'Skill file editing is not configured for this request.');
+  }
+  if (!options.canEditSkill) {
+    return errorResult(tc, 'Skill file editing is not configured.');
+  }
+  const allowed = await options.canEditSkill({ req, skillId });
+  return allowed ? null : errorResult(tc, 'Insufficient permissions to edit this skill.');
+}
+
+async function ensureCanCreateSkill(
+  tc: ToolCallRequest,
+  options: ToolExecuteOptions,
+  req: ServerRequest | undefined,
+): Promise<ToolExecuteResult | null> {
+  if (!req) {
+    return errorResult(tc, 'Skill creation is not configured for this request.');
+  }
+  if (!options.canCreateSkill) {
+    return errorResult(tc, 'Skill creation is not configured.');
+  }
+  const allowed = await options.canCreateSkill({ req });
+  return allowed ? null : errorResult(tc, 'Insufficient permissions to create skills.');
+}
+
+async function loadSkillFileTextForAuthoring({
+  skill,
+  relativePath,
+  options,
+  req,
+}: {
+  skill: AuthoringSkill;
+  relativePath: string;
+  options: ToolExecuteOptions;
+  req?: ServerRequest;
+}): Promise<LoadedSkillText> {
+  if (relativePath === SKILL_MD) {
+    return {
+      status: 'loaded',
+      content: skill.body ?? '',
+      bytes: Buffer.byteLength(skill.body ?? '', 'utf8'),
+    };
+  }
+
+  const { getSkillFileByPath, getStrategyFunctions, updateSkillFileContent } = options;
+  if (!getSkillFileByPath) {
+    return { status: 'error', message: 'Skill file reading is not configured.' };
+  }
+
+  const file = await getSkillFileByPath(skill._id, relativePath);
+  if (!file) {
+    return { status: 'missing' };
+  }
+  if (file.isBinary === true) {
+    return { status: 'error', message: `File "${relativePath}" is binary and cannot be edited.` };
+  }
+  if (file.content != null && file.content !== '') {
+    return {
+      status: 'loaded',
+      content: file.content,
+      bytes: Buffer.byteLength(file.content, 'utf8'),
+    };
+  }
+  if (file.bytes > MAX_CACHE_BYTES) {
+    return {
+      status: 'error',
+      message: `File "${relativePath}" is too large to edit directly (${file.bytes} bytes, limit: ${MAX_CACHE_BYTES}).`,
+    };
+  }
+  if (!getStrategyFunctions || !req) {
+    return { status: 'error', message: 'Storage access is not configured.' };
+  }
+
+  const strategy = getStrategyFunctions(file.source);
+  if (!strategy.getDownloadStream) {
+    return { status: 'error', message: 'Download is not supported for this storage backend.' };
+  }
+
+  const stream = await strategy.getDownloadStream(req, file.filepath);
+  const chunks: Uint8Array[] = [];
+  let streamedBytes = 0;
+  for await (const chunk of stream as AsyncIterable<Uint8Array>) {
+    streamedBytes += chunk.byteLength;
+    if (streamedBytes > MAX_CACHE_BYTES) {
+      if (
+        'destroy' in stream &&
+        typeof (stream as NodeJS.ReadableStream & { destroy?: () => void }).destroy === 'function'
+      ) {
+        (stream as NodeJS.ReadableStream & { destroy: () => void }).destroy();
+      }
+      return {
+        status: 'error',
+        message: `File "${relativePath}" exceeded edit limit (${MAX_CACHE_BYTES} bytes).`,
+      };
+    }
+    chunks.push(chunk);
+  }
+
+  const buffer = Buffer.concat(chunks);
+  const checkLen = Math.min(buffer.length, 8192);
+  for (let i = 0; i < checkLen; i++) {
+    if (buffer[i] === 0) {
+      if (updateSkillFileContent) {
+        updateSkillFileContent(skill._id, relativePath, { isBinary: true }).catch(
+          (err: unknown) => {
+            logAxiosError({
+              message: '[loadSkillFileTextForAuthoring] cache write failed',
+              error: err,
+            });
+          },
+        );
+      }
+      return { status: 'error', message: `File "${relativePath}" is binary and cannot be edited.` };
+    }
+  }
+
+  const text = buffer.toString('utf-8');
+  if (updateSkillFileContent) {
+    updateSkillFileContent(skill._id, relativePath, { content: text, isBinary: false }).catch(
+      (err: unknown) => {
+        logAxiosError({
+          message: '[loadSkillFileTextForAuthoring] cache write failed',
+          error: err,
+        });
+      },
+    );
+  }
+  return { status: 'loaded', content: text, bytes: buffer.length };
+}
+
+async function inspectBundledSkillFileForCreate({
+  skill,
+  relativePath,
+  options,
+  req,
+}: {
+  skill: AuthoringSkill;
+  relativePath: string;
+  options: ToolExecuteOptions;
+  req?: ServerRequest;
+}): Promise<ExistingSkillFile> {
+  const { getSkillFileByPath } = options;
+  if (!getSkillFileByPath) {
+    return { status: 'error', message: 'Skill file reading is not configured.' };
+  }
+
+  const file = await getSkillFileByPath(skill._id, relativePath);
+  if (!file) {
+    return { status: 'missing' };
+  }
+  if (file.isBinary === true || file.bytes > MAX_CACHE_BYTES) {
+    return { status: 'present' };
+  }
+  if (file.content != null && file.content !== '') {
+    return { status: 'present', oldContent: file.content };
+  }
+  if (!options.getStrategyFunctions || !req) {
+    return { status: 'present' };
+  }
+
+  const loaded = await loadSkillFileTextForAuthoring({
+    skill,
+    relativePath,
+    options,
+    req,
+  });
+  if (loaded.status === 'missing') {
+    return { status: 'missing' };
+  }
+  if (loaded.status === 'error') {
+    return { status: 'present' };
+  }
+  return { status: 'present', oldContent: loaded.content };
+}
+
+async function ensureBundledSkillVersionCurrent({
+  tc,
+  options,
+  skill,
+  displayPath,
+}: {
+  tc: ToolCallRequest;
+  options: ToolExecuteOptions;
+  skill: AuthoringSkill;
+  displayPath: string;
+}): Promise<ToolExecuteResult | null> {
+  if (!options.getSkillByName) {
+    return null;
+  }
+
+  const current = await options.getSkillByName(skill.name, [skill._id], {});
+  if (!current) {
+    return errorResult(tc, `Skill "${skill.name}" not found or not accessible.`);
+  }
+  if (current.version !== skill.version) {
+    return errorResult(
+      tc,
+      `Skill "${skill.name}" changed while editing. Re-read ${displayPath} and retry.`,
+    );
+  }
+  return null;
+}
+
+async function writeSkillMd({
+  tc,
+  options,
+  req,
+  mergedConfigurable,
+  sourceConfigurable,
+  skill,
+  skillName,
+  content,
+}: {
+  tc: ToolCallRequest;
+  options: ToolExecuteOptions;
+  req?: ServerRequest;
+  mergedConfigurable: Record<string, unknown>;
+  sourceConfigurable?: Record<string, unknown>;
+  skill: AuthoringSkill | null;
+  skillName: string;
+  content: string;
+}): AuthoringResult {
+  const normalized = normalizeSkillMdContent(content, skillName);
+  if (normalized.status === 'error') {
+    return errorResult(tc, normalized.error);
+  }
+  content = normalized.content;
+  const structured = parseStructuredSkillFrontmatter(content);
+  if (structured.error) {
+    return errorResult(tc, structured.error);
+  }
+
+  if (!skill) {
+    const createDenied = await ensureCanCreateSkill(tc, options, req);
+    if (createDenied) {
+      return createDenied;
+    }
+    if (!req || !options.createSkill || !options.grantSkillOwner) {
+      return errorResult(tc, 'Skill creation is not configured.');
+    }
+    const author = getAuthorInfo(req);
+    if (!author) {
+      return errorResult(tc, 'Authentication required to create a skill.');
+    }
+    const parsed = parseSkillMdUpdate(content);
+    let result: Awaited<ReturnType<NonNullable<ToolExecuteOptions['createSkill']>>>;
+    try {
+      result = await options.createSkill({
+        name: skillName,
+        description: parsed.description,
+        body: content,
+        ...(parsed.frontmatter !== undefined ? { frontmatter: parsed.frontmatter } : {}),
+        author: author.author,
+        authorName: author.authorName,
+        ...(parsed.alwaysApply !== undefined ? { alwaysApply: parsed.alwaysApply } : {}),
+        ...(author.tenantId ? { tenantId: author.tenantId } : {}),
+      });
+    } catch (error) {
+      if (isDuplicateSkillNameError(error)) {
+        return errorResult(
+          tc,
+          `Skill "${skillName}" already exists for this author. It cannot be created again or overwritten blindly. Read or enable the existing skill, then use edit_file for targeted changes, or choose a new skill name.`,
+        );
+      }
+      throw error;
+    }
+    try {
+      await options.grantSkillOwner({ req, skillId: result.skill._id });
+    } catch (error) {
+      if (options.deleteSkill) {
+        await options.deleteSkill(result.skill._id.toString()).catch((rollbackError: unknown) => {
+          logger.error('[create_file] Failed to roll back skill after permission error', {
+            rollbackError,
+          });
+        });
+      }
+      throw error;
+    }
+    rememberAuthoredSkill([mergedConfigurable, sourceConfigurable], result.skill);
+    return successResult(
+      tc,
+      `Created ${SKILL_FILE_PREFIX}${skillName}/${SKILL_MD} (${content.length} chars).`,
+      {
+        path: `${SKILL_FILE_PREFIX}${skillName}/${SKILL_MD}`,
+        bytes_written: Buffer.byteLength(content, 'utf8'),
+        created: true,
+      },
+    );
+  }
+
+  const editDenied = await ensureCanEditSkill(tc, options, req, skill._id);
+  if (editDenied) {
+    return editDenied;
+  }
+  if (!options.updateSkill) {
+    return errorResult(tc, 'Skill updating is not configured.');
+  }
+  const parsedUpdate = parseSkillMdUpdate(content);
+  const result = await options.updateSkill({
+    id: skill._id.toString(),
+    expectedVersion: skill.version,
+    update: {
+      body: content,
+      description: parsedUpdate.description,
+      ...(parsedUpdate.frontmatter !== undefined ? { frontmatter: parsedUpdate.frontmatter } : {}),
+      ...(parsedUpdate.alwaysApply !== undefined ? { alwaysApply: parsedUpdate.alwaysApply } : {}),
+    },
+  });
+  if (result.status === 'conflict') {
+    return errorResult(
+      tc,
+      `Skill "${skillName}" changed while editing. Re-read ${SKILL_FILE_PREFIX}${skillName}/${SKILL_MD} and retry.`,
+    );
+  }
+  if (result.status === 'not_found') {
+    return errorResult(tc, `Skill "${skillName}" not found or not accessible.`);
+  }
+
+  const diff = createUnifiedDiff(
+    `${SKILL_FILE_PREFIX}${skillName}/${SKILL_MD}`,
+    skill.body,
+    content,
+  );
+  const summary = `Updated ${SKILL_FILE_PREFIX}${skillName}/${SKILL_MD} (${content.length} chars).`;
+  return successResult(tc, diff ? `${summary}\n\n${diff}` : summary, {
+    path: `${SKILL_FILE_PREFIX}${skillName}/${SKILL_MD}`,
+    bytes_written: Buffer.byteLength(content, 'utf8'),
+    created: false,
+    ...(diff ? { diff } : {}),
+  });
+}
+
+async function writeBundledSkillFile({
+  tc,
+  options,
+  req,
+  skill,
+  relativePath,
+  displayPath,
+  content,
+  oldContent,
+  created,
+}: {
+  tc: ToolCallRequest;
+  options: ToolExecuteOptions;
+  req?: ServerRequest;
+  skill: AuthoringSkill;
+  relativePath: string;
+  displayPath: string;
+  content: string;
+  oldContent?: string;
+  created: boolean;
+}): AuthoringResult {
+  const editDenied = await ensureCanEditSkill(tc, options, req, skill._id);
+  if (editDenied) {
+    return editDenied;
+  }
+  if (!req || !options.saveSkillFileContent) {
+    return errorResult(tc, 'Skill file writing is not configured.');
+  }
+  const staleDenied = await ensureBundledSkillVersionCurrent({
+    tc,
+    options,
+    skill,
+    displayPath,
+  });
+  if (staleDenied) {
+    return staleDenied;
+  }
+
+  await options.saveSkillFileContent({
+    req,
+    skillId: skill._id,
+    relativePath,
+    content,
+    mimeType: guessMimeType(relativePath),
+  });
+  const diff =
+    oldContent !== undefined ? createUnifiedDiff(displayPath, oldContent, content) : undefined;
+  const action = created ? 'Created' : 'Updated';
+  const summary = `${action} ${displayPath} (${content.length} chars).`;
+  return successResult(tc, diff ? `${summary}\n\n${diff}` : summary, {
+    path: displayPath,
+    bytes_written: Buffer.byteLength(content, 'utf8'),
+    created,
+    ...(diff ? { diff } : {}),
+  });
+}
+
+async function handleSandboxCreateFileCall({
+  tc,
+  options,
+  req,
+  filePath,
+  content,
+  overwrite,
+  sandboxContext,
+}: {
+  tc: ToolCallRequest;
+  options: ToolExecuteOptions;
+  req?: ServerRequest;
+  filePath: string;
+  content: string;
+  overwrite: boolean;
+  sandboxContext?: SandboxSessionContext;
+}): AuthoringResult {
+  const pathError = invalidSandboxAuthoringPath(filePath);
+  if (pathError) {
+    return errorResult(tc, pathError);
+  }
+
+  const current = await loadSandboxTextForAuthoring({
+    filePath,
+    tc,
+    options,
+    req,
+    sandboxContext,
+  });
+  if (current.status === 'error') {
+    return errorResult(tc, current.message);
+  }
+  if (current.status === 'loaded' && !overwrite) {
+    return errorResult(tc, 'File already exists. Pass overwrite: true to replace.');
+  }
+
+  return await writeSandboxTextForAuthoring({
+    tc,
+    options,
+    req,
+    filePath,
+    content,
+    oldContent: current.status === 'loaded' ? current.content : undefined,
+    created: current.status === 'missing',
+    sandboxContext,
+  });
+}
+
+async function handleSandboxEditFileCall({
+  tc,
+  options,
+  req,
+  filePath,
+  edits,
+  sandboxContext,
+}: {
+  tc: ToolCallRequest;
+  options: ToolExecuteOptions;
+  req?: ServerRequest;
+  filePath: string;
+  edits: TextEdit[];
+  sandboxContext?: SandboxSessionContext;
+}): AuthoringResult {
+  const pathError = invalidSandboxAuthoringPath(filePath);
+  if (pathError) {
+    return errorResult(tc, pathError);
+  }
+
+  const current = await loadSandboxTextForAuthoring({
+    filePath,
+    tc,
+    options,
+    req,
+    sandboxContext,
+  });
+  if (current.status === 'missing') {
+    return errorResult(tc, `File not found: "${filePath}"`);
+  }
+  if (current.status === 'error') {
+    return errorResult(tc, current.message);
+  }
+
+  let edited: { content: string; strategies: string[] };
+  try {
+    edited = applyTextEdits(current.content, edits);
+  } catch (error) {
+    return errorResult(tc, error instanceof Error ? error.message : 'Failed to edit file');
+  }
+  if (Buffer.byteLength(edited.content, 'utf8') > MAX_AUTHORING_BYTES) {
+    return errorResult(tc, `edited content exceeds ${MAX_AUTHORING_BYTES} byte limit`);
+  }
+
+  const result = await writeSandboxTextForAuthoring({
+    tc,
+    options,
+    req,
+    filePath,
+    content: edited.content,
+    oldContent: current.content,
+    created: false,
+    sandboxContext,
+  });
+  if (result.status === 'success') {
+    result.artifact = {
+      ...(typeof result.artifact === 'object' && result.artifact ? result.artifact : {}),
+      edits: edits.length,
+      strategies: edited.strategies,
+    };
+    result.content = `${String(result.content)}\n\nStrategies: ${edited.strategies.join(', ')}`;
+  }
+  return result;
+}
+
+async function handleCreateFileCall(
+  tc: ToolCallRequest,
+  mergedConfigurable: Record<string, unknown>,
+  options: ToolExecuteOptions,
+  req?: ServerRequest,
+  sourceConfigurable?: Record<string, unknown>,
+  sandboxContext?: SandboxSessionContext,
+): AuthoringResult {
+  const args = tc.args as { file_path?: unknown; content?: unknown; overwrite?: unknown };
+  if (typeof args.file_path !== 'string' || args.file_path.length === 0) {
+    return errorResult(tc, 'file_path is required');
+  }
+  if (typeof args.content !== 'string') {
+    return errorResult(tc, 'content is required');
+  }
+  if (Buffer.byteLength(args.content, 'utf8') > MAX_AUTHORING_BYTES) {
+    return errorResult(tc, `content exceeds ${MAX_AUTHORING_BYTES} byte limit`);
+  }
+
+  const overwrite = args.overwrite === true;
+  if (!args.file_path.startsWith(SKILL_FILE_PREFIX)) {
+    if (mergedConfigurable?.codeEnvAvailable !== true) {
+      return errorResult(
+        tc,
+        `Path "${args.file_path}" is not a skill file, and this agent does not have code execution enabled.`,
+      );
+    }
+    return await handleSandboxCreateFileCall({
+      tc,
+      options,
+      req,
+      filePath: args.file_path,
+      content: args.content,
+      overwrite,
+      sandboxContext,
+    });
+  }
+
+  const parsed = parseSkillAuthoringPath(args.file_path);
+  if (typeof parsed === 'string') {
+    return errorResult(tc, parsed);
+  }
+  if (!isSkillAuthoringAvailable(mergedConfigurable)) {
+    return errorResult(tc, 'Skill file authoring is not available for this agent.');
+  }
+
+  let skill = await resolveSkillForAuthoring(parsed.skillName, mergedConfigurable, options);
+  if (!skill) {
+    skill = await resolveAuthorSkillForCurrentUser({
+      skillName: parsed.skillName,
+      mergedConfigurable,
+      sourceConfigurable,
+      options,
+      req,
+    });
+  }
+  const hiddenDenied = hiddenSkillAuthoringDenied(tc, skill, parsed.skillName, mergedConfigurable);
+  if (hiddenDenied) {
+    return hiddenDenied;
+  }
+  if (parsed.relativePath === SKILL_MD) {
+    if (skill && !overwrite) {
+      return errorResult(
+        tc,
+        `Skill "${parsed.skillName}" already exists. Use edit_file for targeted changes, or pass overwrite: true only if replacing the entire ${parsed.displayPath} is intended.`,
+      );
+    }
+    return await writeSkillMd({
+      tc,
+      options,
+      req,
+      mergedConfigurable,
+      sourceConfigurable,
+      skill,
+      skillName: parsed.skillName,
+      content: args.content,
+    });
+  }
+
+  if (!skill) {
+    return errorResult(tc, `Skill "${parsed.skillName}" not found or not accessible.`);
+  }
+
+  const current = await inspectBundledSkillFileForCreate({
+    skill,
+    relativePath: parsed.relativePath,
+    options,
+    req,
+  });
+  if (current.status === 'error') {
+    return errorResult(tc, current.message);
+  }
+  if (current.status === 'present' && !overwrite) {
+    return errorResult(tc, 'File already exists. Pass overwrite: true to replace.');
+  }
+  return await writeBundledSkillFile({
+    tc,
+    options,
+    req,
+    skill,
+    relativePath: parsed.relativePath,
+    displayPath: parsed.displayPath,
+    content: args.content,
+    oldContent: current.status === 'present' ? current.oldContent : undefined,
+    created: current.status === 'missing',
+  });
+}
+
+async function handleEditFileCall(
+  tc: ToolCallRequest,
+  mergedConfigurable: Record<string, unknown>,
+  options: ToolExecuteOptions,
+  req?: ServerRequest,
+  sandboxContext?: SandboxSessionContext,
+): AuthoringResult {
+  const args = tc.args as {
+    file_path?: unknown;
+    old_text?: unknown;
+    new_text?: unknown;
+    edits?: unknown;
+  };
+  if (typeof args.file_path !== 'string' || args.file_path.length === 0) {
+    return errorResult(tc, 'file_path is required');
+  }
+
+  const edits = normalizeEditArgs(args);
+  if (typeof edits === 'string') {
+    return errorResult(tc, edits);
+  }
+
+  if (!args.file_path.startsWith(SKILL_FILE_PREFIX)) {
+    if (mergedConfigurable?.codeEnvAvailable !== true) {
+      return errorResult(
+        tc,
+        `Path "${args.file_path}" is not a skill file, and this agent does not have code execution enabled.`,
+      );
+    }
+    return await handleSandboxEditFileCall({
+      tc,
+      options,
+      req,
+      filePath: args.file_path,
+      edits,
+      sandboxContext,
+    });
+  }
+
+  const parsed = parseSkillAuthoringPath(args.file_path);
+  if (typeof parsed === 'string') {
+    return errorResult(tc, parsed);
+  }
+  if (!isSkillAuthoringAvailable(mergedConfigurable)) {
+    return errorResult(tc, 'Skill file authoring is not available for this agent.');
+  }
+
+  let skill = await resolveSkillForAuthoring(parsed.skillName, mergedConfigurable, options);
+  if (!skill) {
+    skill = await resolveAuthorSkillForCurrentUser({
+      skillName: parsed.skillName,
+      mergedConfigurable,
+      options,
+      req,
+    });
+  }
+  if (!skill) {
+    return errorResult(tc, `Skill "${parsed.skillName}" not found or not accessible.`);
+  }
+  const hiddenDenied = hiddenSkillAuthoringDenied(tc, skill, parsed.skillName, mergedConfigurable);
+  if (hiddenDenied) {
+    return hiddenDenied;
+  }
+
+  const current = await loadSkillFileTextForAuthoring({
+    skill,
+    relativePath: parsed.relativePath,
+    options,
+    req,
+  });
+  if (current.status === 'missing') {
+    return errorResult(
+      tc,
+      `File not found: "${parsed.relativePath}" in skill "${parsed.skillName}"`,
+    );
+  }
+  if (current.status === 'error') {
+    return errorResult(tc, current.message);
+  }
+
+  let edited: { content: string; strategies: string[] };
+  try {
+    edited = applyTextEdits(current.content, edits);
+  } catch (error) {
+    return errorResult(tc, error instanceof Error ? error.message : 'Failed to edit file');
+  }
+  if (Buffer.byteLength(edited.content, 'utf8') > MAX_AUTHORING_BYTES) {
+    return errorResult(tc, `edited content exceeds ${MAX_AUTHORING_BYTES} byte limit`);
+  }
+
+  if (parsed.relativePath === SKILL_MD) {
+    const result = await writeSkillMd({
+      tc,
+      options,
+      req,
+      mergedConfigurable,
+      skill,
+      skillName: parsed.skillName,
+      content: edited.content,
+    });
+    if (result.status === 'success') {
+      result.artifact = {
+        ...(typeof result.artifact === 'object' && result.artifact ? result.artifact : {}),
+        edits: edits.length,
+        strategies: edited.strategies,
+      };
+      result.content = `${String(result.content)}\n\nStrategies: ${edited.strategies.join(', ')}`;
+    }
+    return result;
+  }
+
+  const result = await writeBundledSkillFile({
+    tc,
+    options,
+    req,
+    skill,
+    relativePath: parsed.relativePath,
+    displayPath: parsed.displayPath,
+    content: edited.content,
+    oldContent: current.content,
+    created: false,
+  });
+  if (result.status === 'success') {
+    result.artifact = {
+      ...(typeof result.artifact === 'object' && result.artifact ? result.artifact : {}),
+      edits: edits.length,
+      strategies: edited.strategies,
+    };
+    result.content = `${String(result.content)}\n\nStrategies: ${edited.strategies.join(', ')}`;
+  }
+  return result;
+}
+
+async function handleReadFileCall(
+  tc: ToolCallRequest,
+  mergedConfigurable: Record<string, unknown>,
+  options: ToolExecuteOptions,
+  req?: ServerRequest,
+): Promise<ToolExecuteResult> {
+  const { getSkillByName, getSkillFileByPath, getStrategyFunctions, updateSkillFileContent } =
+    options;
+  const args = tc.args as { file_path?: string };
+  if (!args.file_path) {
     return {
       toolCallId: tc.id,
       status: 'error',
       content: '',
-      errorMessage: `Invalid file path "${args.file_path}". Use format: {skillName}/{path}`,
+      errorMessage: 'file_path is required',
     };
   }
 
-  const skillName = args.file_path.slice(0, slashIdx);
-  const relativePath = args.file_path.slice(slashIdx + 1);
-  if (!relativePath) {
-    /**
-     * `read_file("output/")`: a malformed-but-unambiguously-not-a-skill
-     * path. Stay consistent with the other malformed-path branches and
-     * route to the sandbox when code execution is available, instead of
-     * dead-ending with a skill-centric error message.
-     */
+  const codeEnvAvailable = mergedConfigurable?.codeEnvAvailable === true;
+  let accessibleIds = (mergedConfigurable?.accessibleSkillIds as Types.ObjectId[]) ?? [];
+
+  /**
+   * Short-circuit absolute code-env paths: the path can never be a skill
+   * reference (skill paths are relative `{skillName}/...`), and consulting
+   * `getSkillByName` would just burn a DB round-trip on a guaranteed miss.
+   */
+  if (args.file_path.startsWith('/mnt/data/')) {
     if (codeEnvAvailable) {
       return handleSandboxFileFallback(tc, args.file_path, options, req);
     }
@@ -679,10 +2537,102 @@ async function handleReadFileCall(
       toolCallId: tc.id,
       status: 'error',
       content: '',
-      errorMessage: 'Missing file path after skill name',
+      errorMessage: `Path "${args.file_path}" is a code-execution sandbox path, but this agent does not have code execution enabled.`,
     };
   }
 
+  let skillName: string;
+  let relativePath: string;
+  const explicitSkillNamespace = args.file_path.startsWith(SKILL_FILE_PREFIX);
+  if (explicitSkillNamespace) {
+    const parsed = parseSkillAuthoringPath(args.file_path);
+    if (typeof parsed === 'string') {
+      return {
+        toolCallId: tc.id,
+        status: 'error',
+        content: '',
+        errorMessage: parsed,
+      };
+    }
+    skillName = parsed.skillName;
+    relativePath = parsed.relativePath;
+  } else {
+    const slashIdx = args.file_path.indexOf('/');
+    if (slashIdx < 1) {
+      if (codeEnvAvailable) {
+        return handleSandboxFileFallback(tc, args.file_path, options, req);
+      }
+      return {
+        toolCallId: tc.id,
+        status: 'error',
+        content: '',
+        errorMessage: `Invalid file path "${args.file_path}". Use format: {skillName}/{path}`,
+      };
+    }
+
+    skillName = args.file_path.slice(0, slashIdx);
+    relativePath = args.file_path.slice(slashIdx + 1);
+    if (!relativePath) {
+      /**
+       * `read_file("output/")`: a malformed-but-unambiguously-not-a-skill
+       * path. Stay consistent with the other malformed-path branches and
+       * route to the sandbox when code execution is available, instead of
+       * dead-ending with a skill-centric error message.
+       */
+      if (codeEnvAvailable) {
+        return handleSandboxFileFallback(tc, args.file_path, options, req);
+      }
+      return {
+        toolCallId: tc.id,
+        status: 'error',
+        content: '',
+        errorMessage: 'Missing file path after skill name',
+      };
+    }
+  }
+
+  let skillPrimedIdsByName =
+    (mergedConfigurable?.skillPrimedIdsByName as Record<string, string> | undefined) ?? {};
+  let primedIdString = skillPrimedIdsByName[skillName];
+  let isPrimedThisTurn = primedIdString != null;
+  const refreshSkillReadScope = () => {
+    accessibleIds = (mergedConfigurable?.accessibleSkillIds as Types.ObjectId[]) ?? [];
+    skillPrimedIdsByName =
+      (mergedConfigurable?.skillPrimedIdsByName as Record<string, string> | undefined) ?? {};
+    primedIdString = skillPrimedIdsByName[skillName];
+    isPrimedThisTurn = primedIdString != null;
+  };
+  let recoveredAuthorSkill: AuthoringSkill | null | undefined;
+  const recoverAuthorSkill = async () => {
+    if (recoveredAuthorSkill !== undefined) {
+      return recoveredAuthorSkill;
+    }
+    recoveredAuthorSkill = await resolveAuthorSkillForCurrentUser({
+      skillName,
+      mergedConfigurable,
+      options,
+      req,
+    });
+    refreshSkillReadScope();
+    return recoveredAuthorSkill;
+  };
+  /**
+   * `accessibleSkillIds` is the resolver's normal output (admin
+   * capability AND ACL access AND ephemeral badge / persisted
+   * `skills_enabled`). A skill authored earlier in this run is also
+   * resolvable through `skillPrimedIdsByName`, even when the run started
+   * with an empty accessible set for a first-time creator.
+   */
+  let skillsEffectivelyEnabled = accessibleIds.length > 0 || isPrimedThisTurn;
+  if (
+    !skillsEffectivelyEnabled &&
+    explicitSkillNamespace &&
+    isSkillAuthoringAvailable(mergedConfigurable)
+  ) {
+    await recoverAuthorSkill();
+    skillsEffectivelyEnabled = accessibleIds.length > 0 || isPrimedThisTurn;
+  }
+
   /**
    * Skills not in scope (admin capability off, ephemeral badge off, or
    * persisted `skills_enabled !== true` — all already collapsed into
@@ -691,7 +2641,7 @@ async function handleReadFileCall(
    * the lookup truly has nowhere to go.
    */
   if (!skillsEffectivelyEnabled) {
-    if (codeEnvAvailable) {
+    if (codeEnvAvailable && !explicitSkillNamespace) {
       return handleSandboxFileFallback(tc, args.file_path, options, req);
     }
     return {
@@ -718,11 +2668,6 @@ async function handleReadFileCall(
    * shortcut would misroute `read_file("primed-skill/references/foo.md")`
    * to the sandbox even though the primed skill is in scope.
    */
-  const skillPrimedIdsByName =
-    (mergedConfigurable?.skillPrimedIdsByName as Record<string, string> | undefined) ?? {};
-  const primedIdString = skillPrimedIdsByName[skillName];
-  const isPrimedThisTurn = primedIdString != null;
-
   /**
    * Skills are in scope, but the first segment isn't a name we know.
    * Use the catalog-derived `activeSkillNames` Set (no DB read) to detect
@@ -733,15 +2678,18 @@ async function handleReadFileCall(
    */
   const activeSkillNames = mergedConfigurable?.activeSkillNames as Set<string> | undefined;
   if (activeSkillNames && !activeSkillNames.has(skillName) && !isPrimedThisTurn) {
-    if (codeEnvAvailable) {
-      return handleSandboxFileFallback(tc, args.file_path, options, req);
+    const recovered = await recoverAuthorSkill();
+    if (!recovered) {
+      if (codeEnvAvailable && !explicitSkillNamespace) {
+        return handleSandboxFileFallback(tc, args.file_path, options, req);
+      }
+      return {
+        toolCallId: tc.id,
+        status: 'error',
+        content: '',
+        errorMessage: `Skill "${skillName}" not found or not accessible`,
+      };
     }
-    return {
-      toolCallId: tc.id,
-      status: 'error',
-      content: '',
-      errorMessage: `Skill "${skillName}" not found or not accessible`,
-    };
   }
 
   if (!getSkillByName) {
@@ -763,19 +2711,20 @@ async function handleReadFileCall(
      (rather than relying on mongoose's string auto-cast in `$in` queries)
      keeps the value correct for any future consumer that compares with
      `.equals()` or `===`. */
-  const lookupAccessibleIds = isPrimedThisTurn
-    ? [new Types.ObjectId(primedIdString)]
-    : accessibleIds;
+  const lookupAccessibleIds = primedIdString ? [new Types.ObjectId(primedIdString)] : accessibleIds;
   const lookupOptions: { preferUserInvocable?: boolean; preferModelInvocable?: boolean } =
-    isPrimedThisTurn ? {} : { preferModelInvocable: true };
-  const skill = await getSkillByName(skillName, lookupAccessibleIds, lookupOptions);
+    primedIdString ? {} : { preferModelInvocable: true };
+  let skill = await getSkillByName(skillName, lookupAccessibleIds, lookupOptions);
   if (!skill) {
-    return {
-      toolCallId: tc.id,
-      status: 'error',
-      content: '',
-      errorMessage: `Skill "${skillName}" not found or not accessible`,
-    };
+    skill = await recoverAuthorSkill();
+    if (!skill) {
+      return {
+        toolCallId: tc.id,
+        status: 'error',
+        content: '',
+        errorMessage: `Skill "${skillName}" not found or not accessible`,
+      };
+    }
   }
 
   /**
@@ -1170,6 +3119,27 @@ async function handleSkillToolCall(
   };
 }
 
+function getFileAuthoringQueueKey(
+  tc: ToolCallRequest,
+  mergedConfigurable: Record<string, unknown>,
+): string | undefined {
+  if (!isHostFileAuthoringToolCall(tc.name, mergedConfigurable)) {
+    return undefined;
+  }
+  const args = tc.args as { file_path?: unknown };
+  if (typeof args.file_path !== 'string' || args.file_path.length === 0) {
+    return undefined;
+  }
+  if (!args.file_path.startsWith(SKILL_FILE_PREFIX)) {
+    return `sandbox:${args.file_path}`;
+  }
+  const parsed = parseSkillAuthoringPath(args.file_path);
+  if (typeof parsed === 'string') {
+    return `skill:${args.file_path}`;
+  }
+  return `skill:${parsed.skillName}`;
+}
+
 /**
  * Creates the ON_TOOL_EXECUTE handler for event-driven tool execution.
  * This handler receives batched tool calls, loads the required tools,
@@ -1181,6 +3151,24 @@ export function createToolExecuteHandler(options: ToolExecuteOptions): EventHand
   return {
     handle: async (_event: string, data: ToolExecuteBatchRequest) => {
       const { toolCalls, agentId, configurable, metadata, resolve, reject } = data;
+      /** Optional per-call channel (agents SDK > 3.2.33); cast keeps older
+       * installed SDK typings compiling until the release lands. */
+      const onResult = (
+        data as ToolExecuteBatchRequest & {
+          onResult?: (result: ToolExecuteResult) => void;
+        }
+      ).onResult;
+      /** Reports a settled result so the agent graph can emit that call's
+       * completion immediately instead of waiting for the whole batch;
+       * `resolve` below remains the authoritative batch outcome. */
+      const reportResult = (result: ToolExecuteResult): ToolExecuteResult => {
+        try {
+          onResult?.(result);
+        } catch (callbackError) {
+          logger.warn('[ON_TOOL_EXECUTE] onResult callback error:', callbackError);
+        }
+        return result;
+      };
 
       try {
         await runOutsideTracing(async () => {
@@ -1191,210 +3179,322 @@ export function createToolExecuteHandler(options: ToolExecuteOptions): EventHand
               agentId,
             );
             const toolMap = new Map(loadedTools.map((t) => [t.name, t]));
-            const mergedConfigurable = { ...configurable, ...toolConfigurable };
+            const sourceConfigurable = configurable as Record<string, unknown> | undefined;
+            const loadedConfigurable = toolConfigurable as Record<string, unknown> | undefined;
+            const mergedConfigurable = mergeToolConfigurables(
+              sourceConfigurable,
+              loadedConfigurable,
+            );
+            const authoringQueues = new Map<string, Promise<void>>();
+            const sandboxAuthoringContexts = new Map<string, SandboxSessionContext>();
 
             const results: ToolExecuteResult[] = await Promise.all(
               toolCalls.map(async (tc: ToolCallRequest) => {
-                if (tc.name === Constants.SKILL_TOOL || tc.name === Constants.READ_FILE) {
-                  const req = mergedConfigurable?.req as ServerRequest | undefined;
-                  const handlerResult =
-                    tc.name === Constants.SKILL_TOOL
-                      ? await handleSkillToolCall(tc, mergedConfigurable, options, req)
-                      : await handleReadFileCall(tc, mergedConfigurable, options, req);
-
-                  if (toolEndCallback && handlerResult.artifact) {
-                    await toolEndCallback(
-                      {
-                        output: {
-                          name: tc.name,
-                          tool_call_id: tc.id,
-                          content: handlerResult.content,
-                          artifact: handlerResult.artifact,
+                const execute = async (
+                  sandboxContext?: SandboxSessionContext,
+                ): Promise<ToolExecuteResult> => {
+                  const isFileAuthoringCall = isHostFileAuthoringToolCall(
+                    tc.name,
+                    mergedConfigurable,
+                  );
+                  const isSandboxFileAuthoringCall =
+                    isFileAuthoringCall &&
+                    typeof (tc.args as { file_path?: unknown }).file_path === 'string' &&
+                    !(tc.args as { file_path: string }).file_path.startsWith(SKILL_FILE_PREFIX);
+                  if (
+                    tc.name === Constants.SKILL_TOOL ||
+                    tc.name === Constants.READ_FILE ||
+                    isFileAuthoringCall
+                  ) {
+                    const req = mergedConfigurable?.req as ServerRequest | undefined;
+                    let handlerResult: ToolExecuteResult;
+                    try {
+                      if (tc.name === Constants.SKILL_TOOL) {
+                        handlerResult = await handleSkillToolCall(
+                          tc,
+                          mergedConfigurable,
+                          options,
+                          req,
+                        );
+                      } else if (tc.name === Constants.READ_FILE) {
+                        handlerResult = await handleReadFileCall(
+                          tc,
+                          mergedConfigurable,
+                          options,
+                          req,
+                        );
+                      } else if (tc.name === CREATE_FILE_TOOL_NAME && isFileAuthoringCall) {
+                        handlerResult = await handleCreateFileCall(
+                          tc,
+                          mergedConfigurable,
+                          options,
+                          req,
+                          sourceConfigurable,
+                          sandboxContext,
+                        );
+                      } else if (tc.name === EDIT_FILE_TOOL_NAME && isFileAuthoringCall) {
+                        handlerResult = await handleEditFileCall(
+                          tc,
+                          mergedConfigurable,
+                          options,
+                          req,
+                          sandboxContext,
+                        );
+                      } else {
+                        handlerResult = errorResult(tc, `Tool ${tc.name} not found`);
+                      }
+                    } catch (toolError) {
+                      const { message, logContext } = getSafeToolError(toolError);
+                      logger.error(`[ON_TOOL_EXECUTE] Tool ${tc.name} error`, {
+                        ...logContext,
+                        toolCallArgsShape: getValueShape(tc.args),
+                      });
+                      return {
+                        toolCallId: tc.id,
+                        status: 'error' as const,
+                        content: '',
+                        errorMessage: message,
+                      };
+                    }
+
+                    if (
+                      isSandboxFileAuthoringCall &&
+                      handlerResult.status === 'success' &&
+                      sandboxContext
+                    ) {
+                      mergeSandboxSessionArtifact(sandboxContext, handlerResult.artifact);
+                    }
+
+                    if (toolEndCallback && handlerResult.artifact) {
+                      await toolEndCallback(
+                        {
+                          output: {
+                            name: tc.name,
+                            tool_call_id: tc.id,
+                            content: handlerResult.content,
+                            artifact: handlerResult.artifact,
+                          },
                         },
-                      },
-                      {
-                        run_id: (metadata as Record<string, unknown>)?.run_id as string | undefined,
-                        thread_id: (metadata as Record<string, unknown>)?.thread_id as
-                          | string
-                          | undefined,
-                        ...metadata,
-                      },
-                    );
-                  }
+                        {
+                          run_id: (metadata as Record<string, unknown>)?.run_id as
+                            | string
+                            | undefined,
+                          thread_id: (metadata as Record<string, unknown>)?.thread_id as
+                            | string
+                            | undefined,
+                          ...metadata,
+                        },
+                      );
+                    }
 
-                  return handlerResult;
-                }
+                    return handlerResult;
+                  }
 
-                const tool = toolMap.get(tc.name);
+                  const tool = toolMap.get(tc.name);
 
-                if (!tool) {
-                  logger.warn(
-                    `[ON_TOOL_EXECUTE] Tool "${tc.name}" not found. Available: ${[...toolMap.keys()].map((k) => `"${k}"`).join(', ')}`,
-                  );
-                  return {
-                    toolCallId: tc.id,
-                    status: 'error' as const,
-                    content: '',
-                    errorMessage: `Tool ${tc.name} not found`,
-                  };
-                }
+                  if (!tool) {
+                    logger.warn(
+                      `[ON_TOOL_EXECUTE] Tool "${tc.name}" not found. Available: ${[...toolMap.keys()].map((k) => `"${k}"`).join(', ')}`,
+                    );
+                    return {
+                      toolCallId: tc.id,
+                      status: 'error' as const,
+                      content: '',
+                      errorMessage: `Tool ${tc.name} not found`,
+                    };
+                  }
 
-                try {
-                  const toolCallConfig: Record<string, unknown> = {
-                    id: tc.id,
-                    stepId: tc.stepId,
-                    turn: tc.turn,
-                  };
-
-                  if (tc.codeSessionContext && CODE_EXECUTION_TOOLS.has(tc.name)) {
-                    toolCallConfig.session_id = tc.codeSessionContext.session_id;
-                    if (tc.codeSessionContext.files && tc.codeSessionContext.files.length > 0) {
-                      toolCallConfig._injected_files = tc.codeSessionContext.files;
-                      /* Last LC-controlled point before the wire. Mirrors
-                       * codeapi's validator context so the two log sides
-                       * correlate on a single grep. */
-                      const refs = tc.codeSessionContext.files as Array<{
-                        id?: unknown;
-                        resource_id?: unknown;
-                        storage_session_id?: unknown;
-                        kind?: unknown;
-                        version?: unknown;
-                        name?: unknown;
-                      }>;
-                      const summary = refs.map((f) => ({
-                        kind: f.kind,
-                        hasResourceId: typeof f.resource_id === 'string' && !!f.resource_id,
-                        hasStorageSessionId:
-                          typeof f.storage_session_id === 'string' && !!f.storage_session_id,
-                        hasVersion: typeof f.version === 'number',
-                      }));
-                      let missingResourceId = 0;
-                      let missingStorageSessionId = 0;
-                      let missingVersion = 0;
-                      const kindCounts: Record<string, number> = {};
-                      for (const s of summary) {
-                        if (!s.hasResourceId) missingResourceId++;
-                        if (!s.hasStorageSessionId) missingStorageSessionId++;
-                        if (!s.hasVersion) missingVersion++;
-                        const k = typeof s.kind === 'string' ? s.kind : 'unknown';
-                        kindCounts[k] = (kindCounts[k] ?? 0) + 1;
-                      }
-                      logger.debug(
-                        `[code-env:inject] tool=${tc.name} files=${refs.length} ` +
-                          `missingResourceId=${missingResourceId} ` +
-                          `missingStorageSessionId=${missingStorageSessionId} ` +
-                          `missingVersion=${missingVersion} ` +
-                          `kinds=${JSON.stringify(kindCounts)}`,
-                      );
-                      if (missingResourceId > 0) {
+                  try {
+                    const toolCallConfig: Record<string, unknown> = {
+                      id: tc.id,
+                      stepId: tc.stepId,
+                      turn: tc.turn,
+                    };
+
+                    if (
+                      tc.codeSessionContext &&
+                      isCodeSessionAwareToolCall(tc.name, mergedConfigurable)
+                    ) {
+                      toolCallConfig.session_id = tc.codeSessionContext.session_id;
+                      if (tc.codeSessionContext.files && tc.codeSessionContext.files.length > 0) {
+                        toolCallConfig._injected_files = tc.codeSessionContext.files;
+                        /* Last LC-controlled point before the wire. Mirrors
+                         * codeapi's validator context so the two log sides
+                         * correlate on a single grep. */
+                        const refs = tc.codeSessionContext.files as Array<{
+                          id?: unknown;
+                          resource_id?: unknown;
+                          storage_session_id?: unknown;
+                          kind?: unknown;
+                          version?: unknown;
+                          name?: unknown;
+                        }>;
+                        const summary = refs.map((f) => ({
+                          kind: f.kind,
+                          hasResourceId: typeof f.resource_id === 'string' && !!f.resource_id,
+                          hasStorageSessionId:
+                            typeof f.storage_session_id === 'string' && !!f.storage_session_id,
+                          hasVersion: typeof f.version === 'number',
+                        }));
+                        let missingResourceId = 0;
+                        let missingStorageSessionId = 0;
+                        let missingVersion = 0;
+                        const kindCounts: Record<string, number> = {};
+                        for (const s of summary) {
+                          if (!s.hasResourceId) missingResourceId++;
+                          if (!s.hasStorageSessionId) missingStorageSessionId++;
+                          if (!s.hasVersion) missingVersion++;
+                          const k = typeof s.kind === 'string' ? s.kind : 'unknown';
+                          kindCounts[k] = (kindCounts[k] ?? 0) + 1;
+                        }
+                        logger.debug(
+                          `[code-env:inject] tool=${tc.name} files=${refs.length} ` +
+                            `missingResourceId=${missingResourceId} ` +
+                            `missingStorageSessionId=${missingStorageSessionId} ` +
+                            `missingVersion=${missingVersion} ` +
+                            `kinds=${JSON.stringify(kindCounts)}`,
+                        );
+                        if (missingResourceId > 0) {
+                          logger.warn(
+                            `[code-env:inject] ${missingResourceId}/${refs.length} files missing resource_id ` +
+                              `for tool=${tc.name} — codeapi will reject with 400`,
+                            { summary },
+                          );
+                        }
+                      } else {
+                        /* Empty `_injected_files` on a code-execution tool
+                         * call. Almost always means the seeding chain
+                         * (primeCodeFiles → initialSessions →
+                         * CodeSessionContext) dropped the file upstream.
+                         * `session_id` is still emitted for continuity, but
+                         * concrete file refs must arrive through
+                         * `_injected_files`; agents no longer falls back to
+                         * `/files/<sid>`. Pair with `[primeCodeFiles]`
+                         * traces below to locate the layer that lost the ref. */
                         logger.warn(
-                          `[code-env:inject] ${missingResourceId}/${refs.length} files missing resource_id ` +
-                            `for tool=${tc.name} — codeapi will reject with 400`,
-                          { summary },
+                          `[code-env:inject] tool=${tc.name} _injected_files=0 — sandbox will see no input files`,
+                          {
+                            tool: tc.name,
+                            session_id: tc.codeSessionContext.session_id,
+                            codeSessionContextHasFiles: tc.codeSessionContext.files !== undefined,
+                            codeSessionContextFileCount: tc.codeSessionContext.files?.length ?? 0,
+                          },
                         );
                       }
-                    } else {
-                      /* Empty `_injected_files` on a code-execution tool
-                       * call. Almost always means the seeding chain
-                       * (primeCodeFiles → initialSessions →
-                       * CodeSessionContext) dropped the file upstream.
-                       * `session_id` is still emitted for continuity, but
-                       * concrete file refs must arrive through
-                       * `_injected_files`; agents no longer falls back to
-                       * `/files/<sid>`. Pair with `[primeCodeFiles]`
-                       * traces below to locate the layer that lost the ref. */
-                      logger.warn(
-                        `[code-env:inject] tool=${tc.name} _injected_files=0 — sandbox will see no input files`,
-                        {
-                          tool: tc.name,
-                          session_id: tc.codeSessionContext.session_id,
-                          codeSessionContextHasFiles: tc.codeSessionContext.files !== undefined,
-                          codeSessionContextFileCount: tc.codeSessionContext.files?.length ?? 0,
-                        },
-                      );
                     }
-                  }
 
-                  if (
-                    tc.name === Constants.BASH_PROGRAMMATIC_TOOL_CALLING ||
-                    tc.name === Constants.PROGRAMMATIC_TOOL_CALLING
-                  ) {
-                    const toolRegistry = mergedConfigurable?.toolRegistry as
-                      | LCToolRegistry
-                      | undefined;
-                    const ptcToolMap = mergedConfigurable?.ptcToolMap as
-                      | Map<string, StructuredToolInterface>
-                      | undefined;
-                    if (toolRegistry) {
-                      const toolDefs: LCTool[] = Array.from(toolRegistry.values()).filter(
-                        (t) =>
-                          t.name !== Constants.PROGRAMMATIC_TOOL_CALLING &&
-                          t.name !== Constants.BASH_PROGRAMMATIC_TOOL_CALLING &&
-                          t.name !== Constants.TOOL_SEARCH,
-                      );
-                      toolCallConfig.toolDefs = toolDefs;
-                      toolCallConfig.toolMap = ptcToolMap ?? toolMap;
+                    if (
+                      tc.name === Constants.BASH_PROGRAMMATIC_TOOL_CALLING ||
+                      tc.name === Constants.PROGRAMMATIC_TOOL_CALLING
+                    ) {
+                      const toolRegistry = mergedConfigurable?.toolRegistry as
+                        | LCToolRegistry
+                        | undefined;
+                      const ptcToolMap = mergedConfigurable?.ptcToolMap as
+                        | Map<string, StructuredToolInterface>
+                        | undefined;
+                      if (toolRegistry) {
+                        const fileAuthoringToolNames =
+                          getFileAuthoringToolNames(mergedConfigurable) ?? new Set<string>();
+                        const toolDefs: LCTool[] = Array.from(toolRegistry.values()).filter(
+                          (t) =>
+                            t.name !== Constants.PROGRAMMATIC_TOOL_CALLING &&
+                            t.name !== Constants.BASH_PROGRAMMATIC_TOOL_CALLING &&
+                            t.name !== Constants.TOOL_SEARCH &&
+                            !fileAuthoringToolNames.has(t.name),
+                        );
+                        toolCallConfig.toolDefs = toolDefs;
+                        toolCallConfig.toolMap = ptcToolMap ?? toolMap;
+                      }
                     }
-                  }
 
-                  const result = await tool.invoke(normalizeToolInvokeArgs(tc.args, tool), {
-                    toolCall: toolCallConfig,
-                    configurable: mergedConfigurable,
-                    metadata,
-                  } as Record<string, unknown>);
-
-                  // Code-execution tools emit per-call boilerplate
-                  // ("Note: ..." paragraphs and `| <annotation>` per-file
-                  // suffixes) that wastes tokens when re-injected into
-                  // every subsequent model turn. Strip it here, *after*
-                  // the tool resolved but *before* downstream consumers
-                  // (model context, SSE forwarding, persistence) see it.
-                  // Non-code-execution tools pass through unchanged.
-                  const cleanedContent =
-                    CODE_EXECUTION_TOOLS.has(tc.name) && typeof result.content === 'string'
-                      ? cleanCodeToolOutput(result.content)
-                      : result.content;
-
-                  if (toolEndCallback) {
-                    await toolEndCallback(
-                      {
-                        output: {
-                          name: tc.name,
-                          tool_call_id: tc.id,
-                          content: cleanedContent,
-                          artifact: result.artifact,
+                    const result = await tool.invoke(normalizeToolInvokeArgs(tc.args, tool), {
+                      toolCall: toolCallConfig,
+                      configurable: mergedConfigurable,
+                      metadata,
+                    } as Record<string, unknown>);
+
+                    // Code-execution tools emit per-call boilerplate
+                    // ("Note: ..." paragraphs and `| <annotation>` per-file
+                    // suffixes) that wastes tokens when re-injected into
+                    // every subsequent model turn. Strip it here, *after*
+                    // the tool resolved but *before* downstream consumers
+                    // (model context, SSE forwarding, persistence) see it.
+                    // Non-code-execution tools pass through unchanged.
+                    const cleanedContent =
+                      isCodeSessionAwareToolCall(tc.name, mergedConfigurable) &&
+                      typeof result.content === 'string'
+                        ? cleanCodeToolOutput(result.content)
+                        : result.content;
+
+                    if (toolEndCallback) {
+                      await toolEndCallback(
+                        {
+                          output: {
+                            name: tc.name,
+                            tool_call_id: tc.id,
+                            content: cleanedContent,
+                            artifact: result.artifact,
+                          },
                         },
-                      },
-                      {
-                        run_id: (metadata as Record<string, unknown>)?.run_id as string | undefined,
-                        thread_id: (metadata as Record<string, unknown>)?.thread_id as
-                          | string
-                          | undefined,
-                        ...metadata,
-                      },
-                    );
+                        {
+                          run_id: (metadata as Record<string, unknown>)?.run_id as
+                            | string
+                            | undefined,
+                          thread_id: (metadata as Record<string, unknown>)?.thread_id as
+                            | string
+                            | undefined,
+                          ...metadata,
+                        },
+                      );
+                    }
+
+                    return {
+                      toolCallId: tc.id,
+                      content: cleanedContent,
+                      artifact: result.artifact,
+                      status: 'success' as const,
+                    };
+                  } catch (toolError) {
+                    const { message, logContext } = getSafeToolError(toolError);
+                    logger.error(`[ON_TOOL_EXECUTE] Tool ${tc.name} error`, {
+                      ...logContext,
+                      toolCallArgsShape: getValueShape(tc.args),
+                      toolInputSchemaKind: getToolInputSchemaKind(tool),
+                    });
+                    return {
+                      toolCallId: tc.id,
+                      status: 'error' as const,
+                      content: '',
+                      errorMessage: message,
+                    };
                   }
+                };
 
-                  return {
-                    toolCallId: tc.id,
-                    content: cleanedContent,
-                    artifact: result.artifact,
-                    status: 'success' as const,
-                  };
-                } catch (toolError) {
-                  const { message, logContext } = getSafeToolError(toolError);
-                  logger.error(`[ON_TOOL_EXECUTE] Tool ${tc.name} error`, {
-                    ...logContext,
-                    toolCallArgsShape: getValueShape(tc.args),
-                    toolInputSchemaKind: getToolInputSchemaKind(tool),
-                  });
-                  return {
-                    toolCallId: tc.id,
-                    status: 'error' as const,
-                    content: '',
-                    errorMessage: message,
-                  };
+                const queueKey = getFileAuthoringQueueKey(tc, mergedConfigurable);
+                if (!queueKey) {
+                  return reportResult(await execute());
+                }
+                let sandboxContext: SandboxSessionContext | undefined;
+                if (queueKey.startsWith('sandbox:')) {
+                  sandboxContext =
+                    sandboxAuthoringContexts.get(queueKey) ??
+                    cloneSandboxSessionContext(sandboxSessionContext(tc));
+                  sandboxAuthoringContexts.set(queueKey, sandboxContext);
                 }
+                const previous = authoringQueues.get(queueKey) ?? Promise.resolve();
+                const resultPromise = previous.then(
+                  () => execute(sandboxContext),
+                  () => execute(sandboxContext),
+                );
+                authoringQueues.set(
+                  queueKey,
+                  resultPromise.then(
+                    () => undefined,
+                    () => undefined,
+                  ),
+                );
+                return reportResult(await resultPromise);
               }),
             );
 
diff --git a/packages/api/src/agents/index.ts b/packages/api/src/agents/index.ts
index 31d2485a01a..14e0f480fd5 100644
--- a/packages/api/src/agents/index.ts
+++ b/packages/api/src/agents/index.ts
@@ -22,6 +22,7 @@ export * from './skillConfigurable';
 export * from './skillFiles';
 export * from './codeFilesSession';
 export * from './run';
+export * from './testHook';
 export * from './tools';
 export * from './validation';
 export * from './added';
diff --git a/packages/api/src/agents/initialize.ts b/packages/api/src/agents/initialize.ts
index 00f391f0b15..5edd1844c82 100644
--- a/packages/api/src/agents/initialize.ts
+++ b/packages/api/src/agents/initialize.ts
@@ -23,27 +23,37 @@ import type {
 import type { GenericTool, LCToolRegistry, ToolMap, LCTool } from '@librechat/agents';
 import type { Response as ServerResponse } from 'express';
 import type { IMongoFile } from '@librechat/data-schemas';
-import type { InitializeResultBase, ServerRequest, EndpointDbMethods } from '~/types';
+import type {
+  ServerRequest,
+  EndpointDbMethods,
+  EndpointTokenConfig,
+  InitializeResultBase,
+} from '~/types';
+import type { LCAvailableTools, RequestScopedMCPConnectionStore } from '../mcp/types';
+import type { ResolvedManualSkill, ResolvedAlwaysApplySkill } from './skills';
+import type { TFilterFilesByAgentAccess } from './resources';
+import {
+  injectSkillCatalog,
+  resolveManualSkills,
+  resolveAlwaysApplySkills,
+  unionPrimeAllowedTools,
+  MAX_PRIMED_SKILLS_PER_TURN,
+} from './skills';
 import {
   optionalChainWithEmptyCheck,
   extractLibreChatParams,
   getModelMaxTokens,
   getThreadData,
 } from '~/utils';
+import {
+  registerCodeExecutionTools,
+  registerFileAuthoringTools,
+  isFileAuthoringToolDefinition,
+} from './tools';
 import { filterFilesByEndpointConfig } from '~/files';
 import { generateArtifactsPrompt } from '~/prompts';
 import { getProviderConfig } from '~/endpoints';
-import {
-  injectSkillCatalog,
-  resolveManualSkills,
-  resolveAlwaysApplySkills,
-  unionPrimeAllowedTools,
-  MAX_PRIMED_SKILLS_PER_TURN,
-} from './skills';
-import { registerCodeExecutionTools } from './tools';
 import { primeResources } from './resources';
-import type { ResolvedManualSkill, ResolvedAlwaysApplySkill } from './skills';
-import type { TFilterFilesByAgentAccess } from './resources';
 
 /**
  * Fraction of context budget reserved as headroom when no explicit maxContextTokens is set.
@@ -52,6 +62,15 @@ import type { TFilterFilesByAgentAccess } from './resources';
  */
 const DEFAULT_RESERVE_RATIO = 0.05;
 const temporalSpecialVarRegex = /{{\s*(current_date|current_datetime|iso_datetime)\s*}}/i;
+const geminiModelVersionRegex = /^gemini-(\d+)(?:\.(\d+))?(?:-|$)/;
+const googleToolCombinationTextModels = [
+  'gemini-3-flash-preview',
+  'gemini-3-pro-preview',
+  'gemini-3.1-flash-lite',
+  'gemini-3.1-pro-preview',
+];
+const googleToolCombinationExcludedModalityRegex =
+  /(?:^|-)image(?:-|$)|(?:^|-)live(?:-|$)|(?:^|-)tts(?:-|$)/;
 
 function hasTemporalSpecialVars(text: string): boolean {
   return temporalSpecialVarRegex.test(text);
@@ -66,6 +85,13 @@ function appendAdditionalInstructions(agent: Agent, text?: string | null): void
     .join('\n\n');
 }
 
+function getMaxCatalogSkills(req: ServerRequest): number | undefined {
+  const endpoints = req.config?.endpoints as
+    | Record<string, { skills?: { maxCatalogSkills?: number } } | undefined>
+    | undefined;
+  return endpoints?.[EModelEndpoint.agents]?.skills?.maxCatalogSkills;
+}
+
 function getToolName(tool: unknown): string | undefined {
   if (tool == null || typeof tool !== 'object') {
     return undefined;
@@ -85,12 +111,71 @@ function hasGoogleSearchTool(tool: unknown): boolean {
   return 'googleSearch' in tool || 'googleSearchRetrieval' in tool;
 }
 
+function normalizeGoogleModelName(model: string): string {
+  const normalized = model.trim().toLowerCase();
+  return normalized.split('/').pop() ?? normalized;
+}
+
+function isKnownGoogleToolCombinationTextModel(model: string): boolean {
+  return googleToolCombinationTextModels.some(
+    (knownModel) => model === knownModel || model.startsWith(`${knownModel}-`),
+  );
+}
+
+function isGemini35OrLater(model: string): boolean {
+  const match = geminiModelVersionRegex.exec(model);
+  if (!match) {
+    return false;
+  }
+  const major = Number(match[1]);
+  const minor = Number(match[2] ?? '0');
+  return major > 3 || (major === 3 && minor >= 5);
+}
+
 function supportsGoogleToolCombination(model: unknown): boolean {
   if (typeof model !== 'string') {
     return false;
   }
-  const normalized = model.toLowerCase().split('/').pop() ?? model.toLowerCase();
-  return normalized.startsWith('gemini-3');
+  const normalized = normalizeGoogleModelName(model);
+  if (googleToolCombinationExcludedModalityRegex.test(normalized)) {
+    return false;
+  }
+  return isKnownGoogleToolCombinationTextModel(normalized) || isGemini35OrLater(normalized);
+}
+
+function isGoogleToolCombinationProvider(provider?: string): boolean {
+  return provider === Providers.GOOGLE || provider === Providers.VERTEXAI;
+}
+
+function shouldIncludeGoogleServerSideToolInvocations({
+  provider,
+  hasProviderTools,
+  hasAgentTools,
+}: {
+  provider?: string;
+  hasProviderTools: boolean;
+  hasAgentTools: boolean;
+}): boolean {
+  return isGoogleToolCombinationProvider(provider) && hasProviderTools && hasAgentTools;
+}
+
+function assertGoogleToolCombinationSupport(model: unknown): void {
+  if (!supportsGoogleToolCombination(model)) {
+    throw new Error(`{ "type": "${ErrorTypes.GOOGLE_TOOL_CONFLICT}"}`);
+  }
+}
+
+function enableGoogleServerSideToolInvocations({
+  agent,
+  llmConfig,
+}: {
+  agent: Agent;
+  llmConfig: Record<string, unknown>;
+}): void {
+  llmConfig.includeServerSideToolInvocations = true;
+  if (agent.model_parameters) {
+    (agent.model_parameters as Record<string, unknown>).includeServerSideToolInvocations = true;
+  }
 }
 
 function resolveProviderToolConflicts({
@@ -162,6 +247,10 @@ export type InitializedAgent = Agent & {
   toolMap?: ToolMap;
   /** Tool registry for PTC and tool search (only present when MCP tools with env classification exist) */
   toolRegistry?: LCToolRegistry;
+  /** Run-scoped MCP tool definitions for request-scoped servers. */
+  mcpAvailableTools?: Record<string, LCAvailableTools>;
+  /** Run-scoped MCP connections for request-scoped servers. */
+  requestScopedConnections?: RequestScopedMCPConnectionStore;
   /** Serializable tool definitions for event-driven execution */
   toolDefinitions?: LCTool[];
   /** Precomputed flag indicating if any tools have defer_loading enabled (for efficient runtime checks) */
@@ -184,6 +273,10 @@ export type InitializedAgent = Agent & {
    * (`packages/api/src/agents/added.ts`), so the check is uniform.
    */
   codeEnvAvailable: boolean;
+  /** Whether host-side skill file authoring is available for this agent/run. */
+  skillAuthoringAvailable: boolean;
+  /** Host-side file authoring tool names registered for this run. */
+  fileAuthoringToolNames?: Set<string>;
   /** Accessible skill IDs for ACL checking at execute time */
   accessibleSkillIds?: import('mongoose').Types.ObjectId[];
   /**
@@ -223,6 +316,13 @@ export type InitializedAgent = Agent & {
    * call #1 the sandbox can't see the files at all.
    */
   primedCodeFiles?: import('@librechat/agents').CodeEnvFile[];
+  /**
+   * Resolved token/pricing config for this agent's endpoint (admin static
+   * `tokenConfig` and/or fetched custom-endpoint config). Surfaced from the
+   * provider `getOptions` result so the AgentClient bills, prices, and resolves
+   * context limits with the same numbers the UI shows — not default rates.
+   */
+  endpointTokenConfig?: EndpointTokenConfig;
 };
 
 export const DEFAULT_MAX_CONTEXT_TOKENS = 32000;
@@ -261,6 +361,8 @@ export interface InitializeAgentParams {
     dynamicToolContextMap?: Record<string, unknown>;
     userMCPAuthMap?: Record<string, Record<string, string>>;
     toolRegistry?: LCToolRegistry;
+    mcpAvailableTools?: Record<string, LCAvailableTools>;
+    requestScopedConnections?: RequestScopedMCPConnectionStore;
     /** Serializable tool definitions for event-driven mode */
     toolDefinitions?: LCTool[];
     hasDeferredTools?: boolean;
@@ -282,6 +384,8 @@ export interface InitializeAgentParams {
   isInitialAgent?: boolean;
   /** Accessible skill IDs for this user (pre-computed by the caller via ACL query) */
   accessibleSkillIds?: import('mongoose').Types.ObjectId[];
+  /** Whether skill file authoring should be exposed even before a user has viewable skills. */
+  skillAuthoringAvailable?: boolean;
   /** Whether the code execution environment is available (execute_code capability enabled) */
   codeEnvAvailable?: boolean;
   /** Per-user skill active/inactive overrides for filtering the skill catalog. */
@@ -304,7 +408,11 @@ export interface InitializeAgentParams {
  */
 export interface InitializeAgentDbMethods extends EndpointDbMethods {
   /** Update usage tracking for multiple files */
-  updateFilesUsage: (files: Array<{ file_id: string }>, fileIds?: string[]) => Promise<unknown[]>;
+  updateFilesUsage: (
+    files: Array<{ file_id: string }>,
+    fileIds?: string[],
+    options?: { user?: string },
+  ) => Promise<unknown[]>;
   /** Get files from database */
   getFiles: (filter: unknown, sort: unknown, select: unknown) => Promise<unknown[]>;
   /** Filter files by agent access permissions (ownership or agent attachment) */
@@ -350,6 +458,8 @@ export interface InitializeAgentDbMethods extends EndpointDbMethods {
        * by the manual-invocation resolver. Defaults to `true`.
        */
       userInvocable?: boolean;
+      /** True for deployment-directory skills that are loaded in memory. */
+      deployment?: boolean;
     }>;
     has_more?: boolean;
     after?: string | null;
@@ -395,6 +505,8 @@ export interface InitializeAgentDbMethods extends EndpointDbMethods {
      * caller can't bypass the popover-side filter.
      */
     userInvocable?: boolean;
+    /** True for deployment-directory skills that are loaded in memory. */
+    deployment?: boolean;
   } | null>;
   /**
    * Load accessible skills with `alwaysApply: true`, eagerly including
@@ -414,6 +526,8 @@ export interface InitializeAgentDbMethods extends EndpointDbMethods {
       body: string;
       author: import('mongoose').Types.ObjectId;
       allowedTools?: string[];
+      /** True for deployment-directory skills that are loaded in memory. */
+      deployment?: boolean;
     }>;
     has_more?: boolean;
     after?: string | null;
@@ -448,6 +562,7 @@ export async function initializeAgent(
     allowedProviders,
     isInitialAgent = false,
   } = params;
+  const requestFileOwnerId = req.user?.id;
 
   if (!db) {
     throw new Error('initializeAgent requires db methods to be passed');
@@ -549,10 +664,27 @@ export async function initializeAgent(
 
     const allToolFiles = toolFiles.concat(codeGeneratedFiles, userCodeFiles);
     if (requestFiles.length || allToolFiles.length) {
-      currentFiles = (await db.updateFilesUsage(requestFiles.concat(allToolFiles))) as IMongoFile[];
+      const requestUsageFiles =
+        requestFiles.length && requestFileOwnerId
+          ? ((await db.updateFilesUsage(requestFiles, undefined, {
+              user: requestFileOwnerId,
+            })) as IMongoFile[])
+          : [];
+      const requestUsageFileIds = new Set(requestUsageFiles.map((file) => file.file_id));
+      const trustedToolFiles = allToolFiles.filter(
+        (file) => !requestUsageFileIds.has(file.file_id),
+      );
+      const toolUsageFiles = trustedToolFiles.length
+        ? ((await db.updateFilesUsage(trustedToolFiles)) as IMongoFile[])
+        : [];
+      currentFiles = requestUsageFiles.concat(toolUsageFiles);
     }
   } else if (requestFiles.length) {
-    currentFiles = (await db.updateFilesUsage(requestFiles)) as IMongoFile[];
+    currentFiles = requestFileOwnerId
+      ? ((await db.updateFilesUsage(requestFiles, undefined, {
+          user: requestFileOwnerId,
+        })) as IMongoFile[])
+      : [];
   }
 
   if (currentFiles && currentFiles.length) {
@@ -607,7 +739,8 @@ export async function initializeAgent(
    * go first so their names win on dedup (primes earlier in the list
    * contribute before the same name gets deduped on a later prime).
    */
-  const hasSkillAccess = params.accessibleSkillIds && params.accessibleSkillIds.length > 0;
+  const hasSkillAccess = (params.accessibleSkillIds?.length ?? 0) > 0;
+  const skillAuthoringAvailable = params.skillAuthoringAvailable === true;
   let manualSkillPrimes: ResolvedManualSkill[] | undefined;
   let alwaysApplySkillPrimes: ResolvedAlwaysApplySkill[] | undefined;
   let extraAllowedToolNames: string[] = [];
@@ -761,6 +894,8 @@ export async function initializeAgent(
     dynamicToolContextMap,
     userMCPAuthMap,
     toolDefinitions: loadedToolDefinitions,
+    mcpAvailableTools,
+    requestScopedConnections,
     hasDeferredTools,
     actionsEnabled,
     tools: structuredTools,
@@ -771,6 +906,8 @@ export async function initializeAgent(
     dynamicToolContextMap: {},
     userMCPAuthMap: undefined,
     toolRegistry: undefined,
+    mcpAvailableTools: undefined,
+    requestScopedConnections: undefined,
     toolDefinitions: [],
     hasDeferredTools: false,
     actionsEnabled: undefined,
@@ -908,6 +1045,26 @@ export async function initializeAgent(
     );
   }
 
+  if (skillAuthoringAvailable) {
+    const skillReadResult = registerCodeExecutionTools({
+      toolRegistry,
+      toolDefinitions,
+      includeBash: false,
+      includeSkillFileInstructions: true,
+      enableToolOutputReferences: effectiveCodeEnvAvailable,
+    });
+    toolDefinitions = skillReadResult.toolDefinitions;
+  }
+
+  if (effectiveCodeEnvAvailable || skillAuthoringAvailable) {
+    const fileAuthoringResult = registerFileAuthoringTools({
+      toolRegistry,
+      toolDefinitions,
+      includeSkillFileInstructions: skillAuthoringAvailable,
+    });
+    toolDefinitions = fileAuthoringResult.toolDefinitions;
+  }
+
   /** Check for tool presence from either full instances or definitions (event-driven mode) */
   const hasAgentTools = (structuredTools?.length ?? 0) > 0 || (toolDefinitions?.length ?? 0) > 0;
   const providerTools = resolveProviderToolConflicts({
@@ -921,13 +1078,16 @@ export async function initializeAgent(
     ? (providerTools as GenericTool[])
     : (structuredTools ?? []);
 
-  if (
-    (agent.provider === Providers.GOOGLE || agent.provider === Providers.VERTEXAI) &&
-    hasProviderTools &&
-    hasAgentTools
-  ) {
-    if (!supportsGoogleToolCombination(llmConfig.model)) {
-      throw new Error(`{ "type": "${ErrorTypes.GOOGLE_TOOL_CONFLICT}"}`);
+  if (isGoogleToolCombinationProvider(agent.provider) && hasProviderTools && hasAgentTools) {
+    assertGoogleToolCombinationSupport(llmConfig.model);
+    if (
+      shouldIncludeGoogleServerSideToolInvocations({
+        provider: agent.provider,
+        hasProviderTools,
+        hasAgentTools,
+      })
+    ) {
+      enableGoogleServerSideToolInvocations({ agent, llmConfig });
     }
     if (structuredTools?.length) {
       tools = structuredTools.concat(providerTools as GenericTool[]);
@@ -993,6 +1153,7 @@ export async function initializeAgent(
       userId: req.user?.id,
       skillStates: params.skillStates,
       defaultActiveOnShare: params.defaultActiveOnShare,
+      maxCatalogSkills: getMaxCatalogSkills(req),
     });
     toolDefinitions = skillResult.toolDefinitions;
     skillCount = skillResult.skillCount;
@@ -1000,6 +1161,21 @@ export async function initializeAgent(
     activeSkillNames = skillResult.activeSkillNames;
   }
 
+  const hasFinalAgentTools =
+    (structuredTools?.length ?? 0) > 0 || (toolDefinitions?.length ?? 0) > 0;
+  if (isGoogleToolCombinationProvider(agent.provider) && hasProviderTools && hasFinalAgentTools) {
+    assertGoogleToolCombinationSupport(llmConfig.model);
+    if (
+      shouldIncludeGoogleServerSideToolInvocations({
+        provider: agent.provider,
+        hasProviderTools,
+        hasAgentTools: hasFinalAgentTools,
+      })
+    ) {
+      enableGoogleServerSideToolInvocations({ agent, llmConfig });
+    }
+  }
+
   const agentMaxContextNum = Number(agentMaxContextTokens) || DEFAULT_MAX_CONTEXT_TOKENS;
   const maxOutputTokensNum = Number(maxOutputTokens) || 0;
   const baseContextTokens = Math.max(0, agentMaxContextNum - maxOutputTokensNum);
@@ -1028,11 +1204,18 @@ export async function initializeAgent(
       : undefined;
   const maxToolResultCharsResolved =
     providerMaxToolResultChars ?? endpointConfigs?.all?.maxToolResultChars;
+  const fileAuthoringToolNames = new Set(
+    (toolDefinitions ?? [])
+      .filter((toolDefinition) => isFileAuthoringToolDefinition(toolDefinition))
+      .map((toolDefinition) => toolDefinition.name),
+  );
 
   const initializedAgent: InitializedAgent = {
     ...agent,
     resendFiles,
     toolRegistry,
+    mcpAvailableTools,
+    requestScopedConnections,
     tool_resources,
     userMCPAuthMap,
     toolDefinitions,
@@ -1041,6 +1224,8 @@ export async function initializeAgent(
     baseContextTokens,
     codeEnvAvailable: effectiveCodeEnvAvailable,
     reasoningKey: customEndpointConfig?.customParams?.reasoningKey,
+    skillAuthoringAvailable,
+    fileAuthoringToolNames: fileAuthoringToolNames.size > 0 ? fileAuthoringToolNames : undefined,
     skillCount,
     accessibleSkillIds: executableSkillIds,
     activeSkillNames,
@@ -1059,6 +1244,7 @@ export async function initializeAgent(
         ? maxContextTokens
         : Math.max(1024, Math.round(baseContextTokens * (1 - DEFAULT_RESERVE_RATIO))),
     primedCodeFiles,
+    endpointTokenConfig: options.endpointTokenConfig,
   };
 
   return initializedAgent;
diff --git a/packages/api/src/agents/load.ts b/packages/api/src/agents/load.ts
index b0cfb3d6a6c..16789831cdc 100644
--- a/packages/api/src/agents/load.ts
+++ b/packages/api/src/agents/load.ts
@@ -1,5 +1,4 @@
 import { logger } from '@librechat/data-schemas';
-import type { AppConfig } from '@librechat/data-schemas';
 import {
   Tools,
   Constants,
@@ -13,6 +12,8 @@ import type {
   TModelSpec,
   Agent,
 } from 'librechat-data-provider';
+import type { AppConfig } from '@librechat/data-schemas';
+import { requiresEphemeralUserConnection } from '~/mcp/utils';
 import { getCustomEndpointConfig } from '~/app/config';
 
 const { mcp_all, mcp_delimiter } = Constants;
@@ -82,7 +83,13 @@ export async function loadEphemeralAgent(
       if (addedServers.has(mcpServer)) {
         continue;
       }
-      const serverTools = await deps.getMCPServerTools(userId, mcpServer);
+      /** Request-tier overlays are invisible to the cache service's registry
+       *  resolver — overlay-scoped servers expand fresh via `mcp_all` instead */
+      const overlayConfig = req.config?.mcpConfig?.[mcpServer];
+      const serverTools =
+        overlayConfig && requiresEphemeralUserConnection(overlayConfig)
+          ? null
+          : await deps.getMCPServerTools(userId, mcpServer);
       if (!serverTools) {
         tools.push(`${mcp_all}${mcp_delimiter}${mcpServer}`);
         addedServers.add(mcpServer);
@@ -138,6 +145,20 @@ export async function loadEphemeralAgent(
   if (ephemeralAgent?.artifacts) {
     result.artifacts = ephemeralAgent.artifacts;
   }
+  if (modelSpec?.subagents) {
+    result.subagents = modelSpec.subagents;
+  }
+  if (modelSpec && Object.prototype.hasOwnProperty.call(modelSpec, 'skills')) {
+    if (modelSpec.skills === true) {
+      result.skills_enabled = true;
+    } else if (modelSpec.skills === false) {
+      result.skills_enabled = false;
+      result.skills = [];
+    } else if (Array.isArray(modelSpec.skills)) {
+      result.skills_enabled = true;
+      result.skills = [];
+    }
+  }
   return result as Agent;
 }
 
diff --git a/packages/api/src/agents/memory.spec.ts b/packages/api/src/agents/memory.spec.ts
index 622bc970d18..699d01017a8 100644
--- a/packages/api/src/agents/memory.spec.ts
+++ b/packages/api/src/agents/memory.spec.ts
@@ -27,12 +27,34 @@ const mockResolveHeaders = jest.fn((opts) => {
   return result;
 });
 
+type HeaderCarrier = { defaultHeaders?: Record<string, string> };
+const mockResolveConfigHeaders = jest.fn(
+  (opts: {
+    llmConfig?: { configuration?: HeaderCarrier; clientOptions?: HeaderCarrier };
+    user?: { id?: string; email?: string };
+  }) => {
+    const cfg = opts?.llmConfig;
+    if (cfg?.configuration?.defaultHeaders != null) {
+      cfg.configuration.defaultHeaders = mockResolveHeaders({
+        headers: cfg.configuration.defaultHeaders,
+        user: opts.user,
+      });
+    }
+    if (cfg?.clientOptions?.defaultHeaders != null) {
+      cfg.clientOptions.defaultHeaders = mockResolveHeaders({
+        headers: cfg.clientOptions.defaultHeaders,
+        user: opts.user,
+      });
+    }
+  },
+);
+
 jest.mock('~/utils', () => ({
   Tokenizer: {
     getTokenCount: jest.fn(() => 10),
   },
   createSafeUser: (user: unknown) => mockCreateSafeUser(user),
-  resolveHeaders: (opts: unknown) => mockResolveHeaders(opts),
+  resolveConfigHeaders: (opts: unknown) => mockResolveConfigHeaders(opts as never),
 }));
 
 const { createSafeUser } = jest.requireMock('~/utils');
diff --git a/packages/api/src/agents/memory.ts b/packages/api/src/agents/memory.ts
index d47ab2bf6e6..feecb6ab4fb 100644
--- a/packages/api/src/agents/memory.ts
+++ b/packages/api/src/agents/memory.ts
@@ -18,8 +18,9 @@ import type { DynamicStructuredTool } from '@librechat/agents/langchain/tools';
 import type { ObjectId, MemoryMethods, IUser } from '@librechat/data-schemas';
 import type { TAttachment, MemoryArtifact } from 'librechat-data-provider';
 import type { Response as ServerResponse } from 'express';
+import type { RunLLMConfig } from '~/types';
 import { GenerationJobManager } from '~/stream/GenerationJobManager';
-import { resolveHeaders, createSafeUser } from '~/utils';
+import { resolveConfigHeaders, createSafeUser } from '~/utils';
 import Tokenizer from '~/utils/tokenizer';
 
 type RequiredMemoryMethods = Pick<
@@ -355,6 +356,7 @@ ${memory ?? 'No existing memories'}`;
     const finalLLMConfig = {
       ...defaultLLMConfig,
       ...normalizeMemoryLLMConfig(llmConfig),
+      maxRetries: 0,
       /**
        * Ensure streaming is always disabled for memory processing
        */
@@ -404,13 +406,17 @@ ${memory ?? 'No existing memories'}`;
       delete (finalLLMConfig as Record<string, unknown>).temperature;
     }
 
-    const llmConfigWithHeaders = finalLLMConfig as OpenAIClientOptions;
-    if (llmConfigWithHeaders?.configuration?.defaultHeaders != null) {
-      llmConfigWithHeaders.configuration.defaultHeaders = resolveHeaders({
-        headers: llmConfigWithHeaders.configuration.defaultHeaders as Record<string, string>,
-        user: user ? createSafeUser(user) : undefined,
-      });
-    }
+    /**
+     * Resolve request-based headers across provider-specific carriers (OpenAI
+     * `configuration.defaultHeaders`, native Anthropic `clientOptions.defaultHeaders`)
+     * so gateway-fronted built-in providers receive resolved metadata/auth headers
+     * on memory extraction too. Native Google headers are resolved at init.
+     */
+    resolveConfigHeaders({
+      llmConfig: finalLLMConfig as unknown as RunLLMConfig,
+      user: user ? createSafeUser(user) : undefined,
+      body: { conversationId, messageId },
+    });
 
     const artifactPromises: Promise<TAttachment | null>[] = [];
     const memoryCallback = createMemoryCallback({ res, artifactPromises, streamId });
diff --git a/packages/api/src/agents/run.ts b/packages/api/src/agents/run.ts
index 85b614f4f7d..833213a86ce 100644
--- a/packages/api/src/agents/run.ts
+++ b/packages/api/src/agents/run.ts
@@ -2,6 +2,7 @@ import { logger } from '@librechat/data-schemas';
 import { Run, Providers, Constants } from '@librechat/agents';
 import {
   KnownEndpoints,
+  EModelEndpoint,
   MAX_SUBAGENT_DEPTH,
   MAX_SUBAGENT_RUN_CONFIGS,
   extractEnvVariable,
@@ -31,10 +32,15 @@ import type {
 } from 'librechat-data-provider';
 import type { BaseMessage } from '@librechat/agents/langchain/messages';
 import type { AppConfig, IUser } from '@librechat/data-schemas';
+import type { SubagentUsageEvent } from '~/agents/usage';
 import type * as t from '~/types';
+import { getLLMConfig as getAnthropicLLMConfig } from '~/endpoints/anthropic/llm';
 import { getProviderConfig } from '~/endpoints/config/providers';
+import { extractDefaultParams } from '~/endpoints/openai/llm';
 import { resolveHeaders, createSafeUser } from '~/utils/env';
 import { getOpenAIConfig } from '~/endpoints/openai/config';
+import { resolveConfigHeaders } from '~/utils/headers';
+import { applyTestRunHook } from '~/agents/testHook';
 import { isUserProvided } from '~/utils/common';
 
 /** Expected shape of JSON tool search results */
@@ -454,6 +460,37 @@ function resolveSummarizationProvider(
             body: headerContext.requestBody,
           })
         : undefined;
+    /**
+     * Native Anthropic custom endpoints must build their config with the
+     * Anthropic client (`/v1/messages`), not `getOpenAIConfig` (which would emit
+     * OpenAI-shaped requests). The self-summarize case is handled earlier by
+     * `isSameEndpointAsAgent`; this covers summarizing against a *different*
+     * Anthropic-native custom endpoint.
+     */
+    if (customEndpointConfig.provider === EModelEndpoint.anthropic) {
+      const { llmConfig } = getAnthropicLLMConfig(apiKey, {
+        modelOptions: {},
+        proxy: process.env.PROXY ?? undefined,
+        reverseProxyUrl: baseURL,
+        headers: resolvedHeaders,
+        addParams: customEndpointConfig.addParams,
+        dropParams: customEndpointConfig.dropParams,
+        defaultParams: extractDefaultParams(customEndpointConfig.customParams?.paramDefinitions),
+      });
+      const { apiKey: resolvedApiKey, ...llmConfigOverrides } = llmConfig as Record<
+        string,
+        unknown
+      >;
+      const clientOverrides: SummarizationClientOverrides = { ...llmConfigOverrides };
+      if (typeof resolvedApiKey === 'string') {
+        clientOverrides.apiKey = resolvedApiKey;
+      }
+      /** Strip the default model so the user-supplied `summarization.model` wins. */
+      delete clientOverrides.model;
+      delete clientOverrides.modelName;
+      return { provider: Providers.ANTHROPIC, clientOverrides };
+    }
+
     /**
      * Run the endpoint config through `getOpenAIConfig` so summarization
      * inherits the same `headers`, `defaultQuery`, `addParams`/`dropParams`,
@@ -787,6 +824,7 @@ export async function createRun({
   initialSummary,
   calibrationRatio,
   appConfig,
+  subagentUsageSink,
   streaming = true,
   streamUsage = true,
 }: {
@@ -809,6 +847,15 @@ export async function createRun({
    * (e.g. "Ollama") in the summarization config to SDK-recognized providers.
    */
   appConfig?: AppConfig;
+  /**
+   * Receives per-model-call usage from subagent child runs so hosts can bill
+   * them (child graphs execute outside the run's `streamEvents` loop, so
+   * their usage never reaches `customHandlers`). Typed structurally — not as
+   * `Pick<RunConfig, 'subagentUsageSink'>` — because the field ships in
+   * `@librechat/agents` > 3.2.33; older SDK versions ignore it at runtime.
+   * Switch to the `RunConfig` pick once the dependency is bumped.
+   */
+  subagentUsageSink?: (event: SubagentUsageEvent) => void;
 } & Pick<
   RunConfig,
   'tokenCounter' | 'customHandlers' | 'indexTokenCountMap' | 'initialSessions'
@@ -875,18 +922,17 @@ export async function createRun({
       .trim();
 
     /**
-     * Resolve request-based headers for Custom Endpoints. Note: if this is added to
-     *  non-custom endpoints, needs consideration of varying provider header configs.
-     *  This is done at this step because the request body may contain dynamic values
-     *  that need to be resolved after agent initialization.
+     * Resolve request-based headers across provider-specific header locations
+     * (OpenAI `configuration.defaultHeaders`, Anthropic `clientOptions.defaultHeaders`,
+     * Google `customHeaders`). Done at this step because the request body may
+     * contain dynamic values (e.g. conversationId) that are only known after
+     * agent initialization.
      */
-    if (llmConfig?.configuration?.defaultHeaders != null) {
-      llmConfig.configuration.defaultHeaders = resolveHeaders({
-        headers: llmConfig.configuration.defaultHeaders as Record<string, string>,
-        user: createSafeUser(user),
-        body: requestBody,
-      });
-    }
+    resolveConfigHeaders({
+      llmConfig,
+      user: createSafeUser(user),
+      body: requestBody,
+    });
 
     /** Resolves issues with new OpenAI usage field */
     if (
@@ -1030,7 +1076,14 @@ export async function createRun({
    */
   const enableToolOutputReferences = anyAgentHasCodeEnv(agents);
 
-  return Run.create({
+  /**
+   * Built as a variable (not an inline literal) so the extra
+   * `subagentUsageSink` field passes assignability against SDK versions
+   * whose `RunConfig` predates it (<= 3.2.33, where it is ignored at
+   * runtime) — excess-property checks only apply to fresh literals. Inline
+   * the field at the call site once the dependency is bumped.
+   */
+  const runConfig = {
     runId,
     graphConfig,
     tokenCounter,
@@ -1038,9 +1091,19 @@ export async function createRun({
     initialSessions,
     calibrationRatio,
     indexTokenCountMap,
+    subagentUsageSink,
     eagerEventToolExecution: { enabled: true },
+    // Derive the Langfuse trace id deterministically from runId so message
+    // feedback can be scored against the trace without a lookup (see the
+    // feedback route in api/server/routes/messages.js). No-op unless Langfuse
+    // tracing is enabled. Requires @librechat/agents >= 3.2.21.
+    langfuse: { deterministicTraceId: true },
     ...(enableToolOutputReferences && {
       toolOutputReferences: { enabled: true },
     }),
-  });
+  };
+  const run = await Run.create(runConfig);
+
+  applyTestRunHook(run, { messages, agents });
+  return run;
 }
diff --git a/packages/api/src/agents/skillConfigurable.spec.ts b/packages/api/src/agents/skillConfigurable.spec.ts
index 5b22a23cfa8..94bc5dbd28d 100644
--- a/packages/api/src/agents/skillConfigurable.spec.ts
+++ b/packages/api/src/agents/skillConfigurable.spec.ts
@@ -5,12 +5,10 @@ describe('enrichWithSkillConfigurable', () => {
   const accessibleSkillIds = ['skill-a', 'skill-b'];
 
   it('augments configurable with req, accessibleSkillIds, and codeEnvAvailable', () => {
-    const result = enrichWithSkillConfigurable(
-      { loadedTools: [], configurable: { other: 'value' } },
-      req,
-      accessibleSkillIds,
-      true,
-    );
+    const result = enrichWithSkillConfigurable({
+      result: { loadedTools: [], configurable: { other: 'value' } },
+      context: { req, accessibleSkillIds, codeEnvAvailable: true },
+    });
 
     expect(result.configurable).toEqual({
       other: 'value',
@@ -18,21 +16,36 @@ describe('enrichWithSkillConfigurable', () => {
       codeEnvAvailable: true,
       accessibleSkillIds,
       skillPrimedIdsByName: undefined,
+      skillAuthoringAvailable: undefined,
+      fileAuthoringToolNames: undefined,
     });
   });
 
   it('propagates codeEnvAvailable=false verbatim (not coerced)', () => {
-    const result = enrichWithSkillConfigurable(
-      { loadedTools: [], configurable: {} },
-      req,
-      accessibleSkillIds,
-      false,
-    );
+    const result = enrichWithSkillConfigurable({
+      result: { loadedTools: [], configurable: {} },
+      context: { req, accessibleSkillIds, codeEnvAvailable: false },
+    });
 
     expect(result.configurable.codeEnvAvailable).toBe(false);
   });
 
   it('threads skillPrimedIdsByName through unchanged', () => {
+    const primed = { 'brand-guidelines': 'abc123' };
+    const result = enrichWithSkillConfigurable({
+      result: { loadedTools: [], configurable: {} },
+      context: {
+        req,
+        accessibleSkillIds,
+        codeEnvAvailable: true,
+        skillPrimedIdsByName: primed,
+      },
+    });
+
+    expect(result.configurable.skillPrimedIdsByName).toBe(primed);
+  });
+
+  it('supports the legacy positional shape', () => {
     const primed = { 'brand-guidelines': 'abc123' };
     const result = enrichWithSkillConfigurable(
       { loadedTools: [], configurable: {} },
@@ -45,14 +58,29 @@ describe('enrichWithSkillConfigurable', () => {
     expect(result.configurable.skillPrimedIdsByName).toBe(primed);
   });
 
+  it('threads skill authoring gates through unchanged', () => {
+    const fileAuthoringToolNames = new Set(['create_file', 'edit_file']);
+    const result = enrichWithSkillConfigurable({
+      result: { loadedTools: [], configurable: {} },
+      context: {
+        req,
+        accessibleSkillIds,
+        codeEnvAvailable: true,
+        skillAuthoringAvailable: true,
+        fileAuthoringToolNames,
+      },
+    });
+
+    expect(result.configurable.skillAuthoringAvailable).toBe(true);
+    expect(result.configurable.fileAuthoringToolNames).toBe(fileAuthoringToolNames);
+  });
+
   it('preserves loadedTools unchanged', () => {
     const tools = [{ name: 'x' }];
-    const result = enrichWithSkillConfigurable(
-      { loadedTools: tools, configurable: undefined },
-      req,
-      accessibleSkillIds,
-      false,
-    );
+    const result = enrichWithSkillConfigurable({
+      result: { loadedTools: tools, configurable: undefined },
+      context: { req, accessibleSkillIds, codeEnvAvailable: false },
+    });
 
     expect(result.loadedTools).toBe(tools);
   });
diff --git a/packages/api/src/agents/skillConfigurable.ts b/packages/api/src/agents/skillConfigurable.ts
index 9157701c438..ada280d6a00 100644
--- a/packages/api/src/agents/skillConfigurable.ts
+++ b/packages/api/src/agents/skillConfigurable.ts
@@ -24,17 +24,16 @@
  * Empty/missing → no exception, the gate applies as normal and the
  * lookup uses the full ACL set.
  */
-export function enrichWithSkillConfigurable(
-  result: { loadedTools: unknown[]; configurable?: Record<string, unknown> },
-  req: { user?: { id?: string } },
-  accessibleSkillIds: unknown[],
-  codeEnvAvailable: boolean,
+export interface SkillConfigurableContext {
+  req: { user?: { id?: string } };
+  accessibleSkillIds?: unknown[];
+  codeEnvAvailable: boolean;
   /**
    * `{ [skillName]: skillIdString }` for every skill primed this turn
    * (manual or always-apply). The id pins same-name collision lookups to
    * the exact doc the resolver primed and relaxes the disable-model gate.
    */
-  skillPrimedIdsByName?: Record<string, string>,
+  skillPrimedIdsByName?: Record<string, string>;
   /**
    * Names of skills the runtime can resolve, captured at agent init by
    * `injectSkillCatalog`. Lets `read_file` decide whether a
@@ -45,17 +44,74 @@ export function enrichWithSkillConfigurable(
    * off, ephemeral badge off, or persisted `skills_enabled !== true`),
    * which is the same signal as `accessibleSkillIds.length === 0`.
    */
+  activeSkillNames?: Set<string>;
+  /** True when skills/{skillName}/... write paths are enabled for this run. */
+  skillAuthoringAvailable?: boolean;
+  /** Host file-authoring names registered by initializeAgent for this run. */
+  fileAuthoringToolNames?: Set<string>;
+}
+
+export interface SkillConfigurableLoadResult {
+  loadedTools: unknown[];
+  configurable?: Record<string, unknown>;
+}
+
+export interface EnrichWithSkillConfigurableParams {
+  result: SkillConfigurableLoadResult;
+  context: SkillConfigurableContext;
+}
+
+export function enrichWithSkillConfigurable(params: EnrichWithSkillConfigurableParams): {
+  loadedTools: unknown[];
+  configurable: Record<string, unknown>;
+};
+export function enrichWithSkillConfigurable(
+  result: SkillConfigurableLoadResult,
+  req: { user?: { id?: string } },
+  accessibleSkillIds: unknown[] | undefined,
+  codeEnvAvailable: boolean,
+  skillPrimedIdsByName?: Record<string, string>,
+  activeSkillNames?: Set<string>,
+  skillAuthoringAvailable?: boolean,
+  fileAuthoringToolNames?: Set<string>,
+): { loadedTools: unknown[]; configurable: Record<string, unknown> };
+export function enrichWithSkillConfigurable(
+  first: EnrichWithSkillConfigurableParams | SkillConfigurableLoadResult,
+  req?: { user?: { id?: string } },
+  accessibleSkillIds?: unknown[],
+  codeEnvAvailable?: boolean,
+  skillPrimedIdsByName?: Record<string, string>,
   activeSkillNames?: Set<string>,
+  skillAuthoringAvailable?: boolean,
+  fileAuthoringToolNames?: Set<string>,
 ): { loadedTools: unknown[]; configurable: Record<string, unknown> } {
+  const { result, context } =
+    'result' in first && 'context' in first
+      ? first
+      : {
+          result: first,
+          context: {
+            req: req ?? {},
+            accessibleSkillIds,
+            codeEnvAvailable: codeEnvAvailable === true,
+            skillPrimedIdsByName,
+            activeSkillNames,
+            skillAuthoringAvailable,
+            fileAuthoringToolNames,
+          },
+        };
+
   return {
     ...result,
     configurable: {
       ...result.configurable,
-      req,
-      codeEnvAvailable,
-      accessibleSkillIds,
-      skillPrimedIdsByName,
-      activeSkillNames,
+      req: context.req,
+      codeEnvAvailable: context.codeEnvAvailable,
+      accessibleSkillIds: context.accessibleSkillIds,
+      skillPrimedIdsByName: context.skillPrimedIdsByName,
+      activeSkillNames: context.activeSkillNames,
+      skillAuthoringAvailable: context.skillAuthoringAvailable,
+      fileAuthoringToolNames: context.fileAuthoringToolNames,
     },
   };
 }
diff --git a/packages/api/src/agents/skills.ts b/packages/api/src/agents/skills.ts
index 7112ee95920..b074daad5f6 100644
--- a/packages/api/src/agents/skills.ts
+++ b/packages/api/src/agents/skills.ts
@@ -11,10 +11,13 @@ import { registerCodeExecutionTools } from './tools';
 import { logAxiosError } from '~/utils';
 
 const SKILL_CATALOG_LIMIT = 100;
+const MIN_SKILL_CATALOG_LIMIT = 1;
 /** Max pages scanned per run when filtering out inactive skills. */
 const MAX_CATALOG_PAGES = 10;
 /** Page size used when paginating to fill the active-skill quota. */
 const CATALOG_PAGE_SIZE = 100;
+/** Hard ceiling on skill names a model spec can request by config. */
+const MAX_MODEL_SPEC_SKILLS = SKILL_CATALOG_LIMIT;
 /**
  * Hard ceiling on skill names resolved per request via `$` popover or
  * `always-apply`. The popover realistically surfaces only a few per turn;
@@ -98,9 +101,9 @@ export function isSkillPrimeMessage(msg: unknown): boolean {
  *
  * Semantics (pinned by unit tests):
  * - `undefined` / `null` → not configured, returns the full accessible catalog.
- * - `[]` (empty array) → explicitly none, returns `[]`. A user who narrows their
- *   agent to a subset and then removes all entries is explicitly opting out of
- *   the full catalog fallback.
+ * - `[]` (empty array) → no allowlist, returns the full accessible catalog.
+ *   Removing all selected skills in the builder restores the default full-catalog
+ *   behavior while `skills_enabled` remains true.
  * - non-empty array of skill `_id` hex strings → intersection of accessible IDs
  *   and agent-configured IDs.
  *
@@ -117,12 +120,102 @@ export function scopeSkillIds(
     return accessibleSkillIds;
   }
   if (agentSkills.length === 0) {
-    return [];
+    return accessibleSkillIds;
   }
   const agentSet = new Set(agentSkills);
   return accessibleSkillIds.filter((oid) => agentSet.has(oid.toString()));
 }
 
+function normalizeSkillCatalogLimit(limit: number | undefined): number {
+  if (typeof limit !== 'number' || !Number.isFinite(limit)) {
+    return SKILL_CATALOG_LIMIT;
+  }
+  return Math.min(SKILL_CATALOG_LIMIT, Math.max(MIN_SKILL_CATALOG_LIMIT, Math.floor(limit)));
+}
+
+export interface ResolveModelSpecSkillIdsParams {
+  /** Skill names configured on a model spec. */
+  names: string[];
+  /** Full VIEW-accessible skill IDs for this user before model-spec scoping. */
+  accessibleSkillIds: Types.ObjectId[];
+  /** DB lookup: name → skill doc constrained to the user's accessible IDs. */
+  getSkillByName?: InitializeAgentDbMethods['getSkillByName'];
+}
+
+/**
+ * Resolves model-spec skill names against the current user's accessible skill
+ * set. Config is advisory: unrecognized, inaccessible, malformed, or errored
+ * names are skipped with a warning so a stale model-spec entry never blocks
+ * the actual chat request.
+ */
+export async function resolveModelSpecSkillIds({
+  names,
+  accessibleSkillIds,
+  getSkillByName,
+}: ResolveModelSpecSkillIdsParams): Promise<Types.ObjectId[]> {
+  if (!names.length || accessibleSkillIds.length === 0 || !getSkillByName) {
+    return [];
+  }
+
+  const seenNames = new Set<string>();
+  const uniqueNames: string[] = [];
+  for (const name of names) {
+    if (typeof name !== 'string') {
+      continue;
+    }
+    const trimmed = name.trim();
+    if (!trimmed || trimmed.length > MAX_SKILL_NAME_LENGTH || seenNames.has(trimmed)) {
+      continue;
+    }
+    seenNames.add(trimmed);
+    uniqueNames.push(trimmed);
+  }
+
+  let boundedNames = uniqueNames;
+  if (uniqueNames.length > MAX_MODEL_SPEC_SKILLS) {
+    logger.warn(
+      `[resolveModelSpecSkillIds] Truncating model spec skill list from ${uniqueNames.length} to ${MAX_MODEL_SPEC_SKILLS}.`,
+    );
+    boundedNames = uniqueNames.slice(0, MAX_MODEL_SPEC_SKILLS);
+  }
+
+  const resolved: Array<Types.ObjectId | null> = [];
+  for (const name of boundedNames) {
+    try {
+      const skill = await getSkillByName(name, accessibleSkillIds, {
+        preferModelInvocable: true,
+      });
+      if (!skill) {
+        logger.warn(
+          `[resolveModelSpecSkillIds] Skill "${name}" not found or not accessible for this user`,
+        );
+        resolved.push(null);
+        continue;
+      }
+      resolved.push(skill._id);
+    } catch (err) {
+      logger.warn(
+        `[resolveModelSpecSkillIds] Failed to resolve skill "${name}":`,
+        err instanceof Error ? err.message : err,
+      );
+      resolved.push(null);
+    }
+  }
+
+  const seenIds = new Set<string>();
+  return resolved.filter((id): id is Types.ObjectId => {
+    if (!id) {
+      return false;
+    }
+    const key = id.toString();
+    if (seenIds.has(key)) {
+      return false;
+    }
+    seenIds.add(key);
+    return true;
+  });
+}
+
 export interface ResolveAgentScopedSkillIdsParams {
   /** Agent being initialized. Reads `id`, `skills`, and `skills_enabled`. */
   agent: Pick<Agent, 'id' | 'skills' | 'skills_enabled'>;
@@ -137,8 +230,10 @@ export interface ResolveAgentScopedSkillIdsParams {
 /**
  * Strict opt-in resolver for per-agent skill scope. Activation requires an
  * explicit signal from the user or the agent author:
- *  - Ephemeral agent  → the skills badge toggle for this conversation.
- *    Toggle ON = full accessible catalog; OFF = no skills.
+ *  - Ephemeral agent  → model-spec `skills` wins when configured:
+ *    `true` = full accessible catalog, string list = scoped allowlist,
+ *    empty list / `false` = no skills. Otherwise the skills badge toggle
+ *    controls the full accessible catalog.
  *  - Persisted agent  → the builder's `skills_enabled` master switch.
  *    Enabled + empty allowlist = full catalog; enabled + non-empty
  *    allowlist = narrow to those ids; disabled (or undefined) = no skills.
@@ -158,6 +253,17 @@ export function resolveAgentScopedSkillIds(
     return [];
   }
   if (isEphemeralAgentId(agent.id)) {
+    if (agent.skills_enabled === false) {
+      return [];
+    }
+    if (agent.skills_enabled === true) {
+      if (Array.isArray(agent.skills) && agent.skills.length === 0) {
+        return [];
+      }
+      return Array.isArray(agent.skills)
+        ? scopeSkillIds(accessibleSkillIds, agent.skills)
+        : scopeSkillIds(accessibleSkillIds, undefined);
+    }
     return ephemeralSkillsToggle ? scopeSkillIds(accessibleSkillIds, undefined) : [];
   }
   if (agent.skills_enabled !== true) {
@@ -171,7 +277,7 @@ export function resolveAgentScopedSkillIds(
 
 export interface ResolveSkillActiveParams {
   /** Skill being evaluated. Only `_id` and `author` matter for resolution. */
-  skill: { _id: Types.ObjectId | string; author: Types.ObjectId | string };
+  skill: { _id: Types.ObjectId | string; author: Types.ObjectId | string; deployment?: boolean };
   /** Per-user overrides: `{ [skillId]: boolean }`. Missing entries use the default. */
   skillStates?: Record<string, boolean>;
   /** Current user ID. When absent, the function fails closed for all non-overridden skills. */
@@ -196,6 +302,9 @@ export function resolveSkillActive(params: ResolveSkillActiveParams): boolean {
   if (override !== undefined) {
     return override;
   }
+  if (skill.deployment === true) {
+    return true;
+  }
   if (!userId) {
     return false;
   }
@@ -217,6 +326,8 @@ export interface InjectSkillCatalogParams {
   skillStates?: Record<string, boolean>;
   /** Admin-configured default for shared skills. `true` = shared skills auto-activate. */
   defaultActiveOnShare?: boolean;
+  /** Admin-configured cap on the model-visible catalog. Defaults to 100. */
+  maxCatalogSkills?: number;
 }
 
 export interface InjectSkillCatalogResult {
@@ -268,7 +379,9 @@ export async function injectSkillCatalog(
     userId,
     skillStates,
     defaultActiveOnShare = false,
+    maxCatalogSkills,
   } = params;
+  const catalogLimit = normalizeSkillCatalogLimit(maxCatalogSkills);
 
   if (!listSkillsByAccess || accessibleSkillIds.length === 0) {
     return {
@@ -299,7 +412,7 @@ export async function injectSkillCatalog(
   let pages = 0;
   let reachedEnd = false;
 
-  while (visibleCount < SKILL_CATALOG_LIMIT && pages < MAX_CATALOG_PAGES) {
+  while (visibleCount < catalogLimit && pages < MAX_CATALOG_PAGES) {
     const page = await listSkillsByAccess({
       accessibleIds: accessibleSkillIds,
       limit: CATALOG_PAGE_SIZE,
@@ -307,7 +420,7 @@ export async function injectSkillCatalog(
     });
 
     for (const skill of page.skills) {
-      if (visibleCount >= SKILL_CATALOG_LIMIT) {
+      if (visibleCount >= catalogLimit) {
         break;
       }
       /**
@@ -344,9 +457,9 @@ export async function injectSkillCatalog(
     };
   }
 
-  if (!reachedEnd && visibleCount < SKILL_CATALOG_LIMIT) {
+  if (!reachedEnd && visibleCount < catalogLimit) {
     logger.warn(
-      `[injectSkillCatalog] Scanned ${MAX_CATALOG_PAGES} pages without filling the ${SKILL_CATALOG_LIMIT}-skill catalog. Some active skills may be excluded.`,
+      `[injectSkillCatalog] Scanned ${MAX_CATALOG_PAGES} pages without filling the ${catalogLimit}-skill catalog. Some active skills may be excluded.`,
     );
   }
 
@@ -508,6 +621,7 @@ export interface ResolveManualSkillsParams {
     name: string;
     body: string;
     author: Types.ObjectId | string;
+    deployment?: boolean;
     /**
      * Skill-declared tool allowlist, forwarded verbatim from the skill doc.
      * Surfaced on `ResolvedManualSkill` so future runtime enforcement can
@@ -678,7 +792,7 @@ export async function resolveManualSkills(
           return null;
         }
         const active = resolveSkillActive({
-          skill: { _id: skill._id, author: skill.author },
+          skill: { _id: skill._id, author: skill.author, deployment: skill.deployment },
           skillStates,
           userId,
           defaultActiveOnShare,
@@ -728,6 +842,7 @@ export interface ResolveAlwaysApplySkillsParams {
       body: string;
       author: Types.ObjectId | string;
       allowedTools?: string[];
+      deployment?: boolean;
     }>;
     has_more?: boolean;
     after?: string | null;
@@ -826,7 +941,7 @@ export async function resolveAlwaysApplySkills(
         continue;
       }
       const active = resolveSkillActive({
-        skill: { _id: skill._id, author: skill.author },
+        skill: { _id: skill._id, author: skill.author, deployment: skill.deployment },
         skillStates,
         userId,
         defaultActiveOnShare,
@@ -972,6 +1087,32 @@ export function injectManualSkillPrimes(
   return { initialMessages, indexTokenCountMap, inserted: numPrimes, insertIdx };
 }
 
+/**
+ * Collects the set of skill names primed fresh this turn — the union of manual
+ * ($-popover) and always-apply (frontmatter) primes. Passed to
+ * `formatAgentMessages` as `skipSkillBodyNames` so a skill that is BOTH primed
+ * this turn AND present in history (as a `skill` tool_call) has its SKILL.md
+ * body injected exactly once — by the fresh prime via `injectSkillPrimes` — and
+ * is NOT also reconstructed from history. Names absent from this set still
+ * reconstruct from history, preserving sticky manual re-priming across turns.
+ */
+export function collectFreshSkillPrimeNames({
+  manualSkillPrimes,
+  alwaysApplySkillPrimes,
+}: {
+  manualSkillPrimes?: Pick<ResolvedManualSkill, 'name'>[];
+  alwaysApplySkillPrimes?: Pick<ResolvedAlwaysApplySkill, 'name'>[];
+}): Set<string> {
+  const names = new Set<string>();
+  for (const prime of manualSkillPrimes ?? []) {
+    names.add(prime.name);
+  }
+  for (const prime of alwaysApplySkillPrimes ?? []) {
+    names.add(prime.name);
+  }
+  return names;
+}
+
 export interface InjectSkillPrimesParams {
   /** Formatted LangChain messages produced by `formatAgentMessages`. Mutated in place. */
   initialMessages: BaseMessage[];
diff --git a/packages/api/src/agents/testHook.ts b/packages/api/src/agents/testHook.ts
new file mode 100644
index 00000000000..1599669c823
--- /dev/null
+++ b/packages/api/src/agents/testHook.ts
@@ -0,0 +1,40 @@
+import { logger } from '@librechat/data-schemas';
+import type { Run, IState } from '@librechat/agents';
+import type { BaseMessage } from '@librechat/agents/langchain/messages';
+
+/**
+ * Context handed to a test run hook so it can shape fake-model behavior from
+ * the conversation and the agents' advertised tools.
+ */
+export interface TestRunHookContext {
+  messages?: BaseMessage[];
+  agents: ReadonlyArray<{ tools?: ReadonlyArray<{ name: string }> }>;
+}
+
+export type TestRunHook = (run: Run<IState>, context: TestRunHookContext) => void;
+
+/**
+ * Env-gated extension point used only by the e2e harness. When
+ * `LIBRECHAT_TEST_RUN_HOOK` points at a module, it is loaded and invoked with
+ * the freshly created run so a test can swap in a fake model via
+ * `run.Graph.overrideTestModel(...)` instead of reaching a live provider. A
+ * no-op (returns immediately) in normal operation since the env var is unset.
+ */
+export function applyTestRunHook(run: Run<IState>, context: TestRunHookContext): void {
+  const hookPath = process.env.LIBRECHAT_TEST_RUN_HOOK;
+  if (!hookPath) {
+    return;
+  }
+  try {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const loaded = require(hookPath) as TestRunHook | { default?: TestRunHook };
+    const hook = typeof loaded === 'function' ? loaded : loaded.default;
+    if (typeof hook !== 'function') {
+      logger.warn(`[applyTestRunHook] ${hookPath} did not export a function`);
+      return;
+    }
+    hook(run, context);
+  } catch (error) {
+    logger.error(`[applyTestRunHook] Failed to apply hook from ${hookPath}`, error);
+  }
+}
diff --git a/packages/api/src/agents/tools.spec.ts b/packages/api/src/agents/tools.spec.ts
index 0643259847e..570eba17089 100644
--- a/packages/api/src/agents/tools.spec.ts
+++ b/packages/api/src/agents/tools.spec.ts
@@ -5,7 +5,7 @@
  * Mirrors the same pattern used in `__tests__/skills.test.ts`.
  */
 jest.mock('@librechat/agents', () => ({
-  ...jest.requireActual('@librechat/agents'),
+  CODE_EXECUTION_TOOLS: new Set(['execute_code', 'bash_tool']),
   ReadFileToolDefinition: {
     name: 'read_file',
     description: 'read skill files using {skillName}/{filePath} and SKILL.md',
@@ -38,8 +38,34 @@ jest.mock('@librechat/agents', () => ({
     enableToolOutputReferences === true ? 'bash {{tool<idx>turn<turn>}}' : 'bash',
 }));
 
+import { CODE_EXECUTION_TOOLS } from '@librechat/agents';
 import type { LCTool, LCToolRegistry } from '@librechat/agents';
-import { buildToolSet, BuildToolSetConfig, registerCodeExecutionTools } from './tools';
+import {
+  buildToolSet,
+  BuildToolSetConfig,
+  registerCodeExecutionTools,
+  registerFileAuthoringTools,
+  FILE_AUTHORING_TOOL_NAMES,
+  isFileAuthoringToolDefinition,
+  isCodeSessionToolName,
+} from './tools';
+
+/** Portable ceiling for OpenAI-compatible tool description validators. */
+const TOOL_DESCRIPTION_ADVISORY_MAX_LENGTH = 1024;
+
+function filePathDescription(tool?: LCTool): string {
+  const parameters = tool?.parameters as
+    | { properties?: { file_path?: { description?: string } } }
+    | undefined;
+  return parameters?.properties?.file_path?.description ?? '';
+}
+
+function maxToolDescriptionLength(definitions: LCTool[]): number {
+  return definitions.reduce((max, definition) => {
+    const length = definition.description?.length ?? Number.POSITIVE_INFINITY;
+    return Math.max(max, length);
+  }, 0);
+}
 
 describe('buildToolSet', () => {
   describe('event-driven mode (toolDefinitions)', () => {
@@ -238,6 +264,7 @@ describe('registerCodeExecutionTools', () => {
       const readFile = upgraded.toolDefinitions.find((d) => d.name === 'read_file');
       expect(upgraded.registered).toEqual([]);
       expect(readFile?.description).toContain('{skillName}/{filePath}');
+      expect(readFile?.description).toContain('skills/{skillName}/');
       expect(readFile?.description).toContain('SKILL.md');
       expect(toolRegistry.get('read_file')?.description).toBe(readFile?.description);
     });
@@ -256,6 +283,30 @@ describe('registerCodeExecutionTools', () => {
       const names = result.toolDefinitions.map((d) => d.name);
       expect(names).toEqual(['calculator', 'read_file', 'bash_tool']);
     });
+
+    it('keeps code-execution tool descriptions within provider advisory limits', () => {
+      const skillAwareWithRefs = registerCodeExecutionTools({
+        toolRegistry: makeRegistry(),
+        toolDefinitions: [],
+        includeBash: true,
+        includeSkillFileInstructions: true,
+        enableToolOutputReferences: true,
+      });
+      const codeOnlyWithoutRefs = registerCodeExecutionTools({
+        toolRegistry: makeRegistry(),
+        toolDefinitions: [],
+        includeBash: true,
+        includeSkillFileInstructions: false,
+        enableToolOutputReferences: false,
+      });
+
+      expect(
+        maxToolDescriptionLength([
+          ...skillAwareWithRefs.toolDefinitions,
+          ...codeOnlyWithoutRefs.toolDefinitions,
+        ]),
+      ).toBeLessThanOrEqual(TOOL_DESCRIPTION_ADVISORY_MAX_LENGTH);
+    });
   });
 
   describe('idempotence (second call in same run)', () => {
@@ -421,3 +472,151 @@ describe('registerCodeExecutionTools', () => {
     });
   });
 });
+
+describe('registerFileAuthoringTools', () => {
+  const makeRegistry = (): LCToolRegistry => new Map() as unknown as LCToolRegistry;
+
+  it('recognizes host-side file authoring tools as code-session-aware without mutating the shared set', () => {
+    expect(isCodeSessionToolName('bash_tool')).toBe(true);
+    expect(isCodeSessionToolName('create_file')).toBe(false);
+    expect(isCodeSessionToolName('edit_file')).toBe(false);
+    expect(isCodeSessionToolName('create_file', FILE_AUTHORING_TOOL_NAMES)).toBe(true);
+    expect(isCodeSessionToolName('edit_file', FILE_AUTHORING_TOOL_NAMES)).toBe(true);
+    expect(CODE_EXECUTION_TOOLS.has('create_file')).toBe(false);
+    expect(CODE_EXECUTION_TOOLS.has('edit_file')).toBe(false);
+  });
+
+  it('registers create_file and edit_file with skill-aware descriptions', () => {
+    const toolRegistry = makeRegistry();
+    const result = registerFileAuthoringTools({
+      toolRegistry,
+      toolDefinitions: [],
+      includeSkillFileInstructions: true,
+    });
+
+    const names = result.toolDefinitions.map((d) => d.name).sort();
+    expect(names).toEqual(['create_file', 'edit_file']);
+    expect(result.registered.sort()).toEqual(['create_file', 'edit_file']);
+    expect(toolRegistry.has('create_file')).toBe(true);
+    expect(toolRegistry.has('edit_file')).toBe(true);
+    expect(result.toolDefinitions[0].responseFormat).toBe('content_and_artifact');
+    expect(result.toolDefinitions.map((d) => d.description).join('\n')).toContain('skills/');
+    expect(toolRegistry.get('create_file')?.description).toContain('frontmatter name must match');
+    expect(toolRegistry.get('create_file')?.description).toContain('trigger-friendly');
+    expect(toolRegistry.get('create_file')?.description).toContain('references/template.html');
+    expect(toolRegistry.get('create_file')?.description).toContain('templates/{file}');
+    expect(toolRegistry.get('edit_file')?.description).toContain('edit_file cannot rename skills');
+    expect(toolRegistry.get('edit_file')?.description).toContain('Keep SKILL.md concise');
+    expect(toolRegistry.get('edit_file')?.description).toContain('templates/');
+    expect(filePathDescription(toolRegistry.get('create_file'))).toContain(
+      'frontmatter name must match',
+    );
+    expect(filePathDescription(toolRegistry.get('edit_file'))).toContain(
+      'edit_file cannot rename skills',
+    );
+  });
+
+  it('registers code-only descriptions for code-exec-only agents', () => {
+    const toolRegistry = makeRegistry();
+    const result = registerFileAuthoringTools({
+      toolRegistry,
+      toolDefinitions: [],
+      includeSkillFileInstructions: false,
+    });
+
+    const createFile = result.toolDefinitions.find((d) => d.name === 'create_file');
+    const editFile = result.toolDefinitions.find((d) => d.name === 'edit_file');
+    expect(createFile?.description).toContain('code-execution sandbox');
+    expect(createFile?.description).toContain('/mnt/data/');
+    expect(createFile?.description).not.toContain('skills/');
+    expect(editFile?.description).toContain('code-execution sandbox');
+    expect(editFile?.description).toContain('/mnt/data/');
+    expect(editFile?.description).not.toContain('skills/');
+    expect(filePathDescription(createFile)).toContain('code-execution sandbox');
+    expect(filePathDescription(createFile)).not.toContain('skills/');
+    expect(filePathDescription(createFile)).not.toContain('SKILL.md');
+    expect(filePathDescription(editFile)).toContain('code-execution sandbox');
+    expect(filePathDescription(editFile)).not.toContain('skills/');
+    expect(filePathDescription(editFile)).not.toContain('rename skills');
+  });
+
+  it('is idempotent across repeated registration calls', () => {
+    const toolRegistry = makeRegistry();
+    const first = registerFileAuthoringTools({
+      toolRegistry,
+      toolDefinitions: [],
+    });
+    const second = registerFileAuthoringTools({
+      toolRegistry,
+      toolDefinitions: first.toolDefinitions,
+    });
+
+    expect(second.registered).toEqual([]);
+    expect(second.toolDefinitions).toHaveLength(2);
+  });
+
+  it('upgrades code-only definitions to skill-aware definitions', () => {
+    const toolRegistry = makeRegistry();
+    const codeOnly = registerFileAuthoringTools({
+      toolRegistry,
+      toolDefinitions: [],
+      includeSkillFileInstructions: false,
+    });
+    const upgraded = registerFileAuthoringTools({
+      toolRegistry,
+      toolDefinitions: codeOnly.toolDefinitions,
+      includeSkillFileInstructions: true,
+    });
+
+    expect(upgraded.registered).toEqual([]);
+    expect(upgraded.toolDefinitions.find((d) => d.name === 'create_file')?.description).toContain(
+      'skills/',
+    );
+    expect(toolRegistry.get('edit_file')?.description).toContain('skills/');
+  });
+
+  it('keeps file-authoring tool descriptions within provider advisory limits', () => {
+    const skillAware = registerFileAuthoringTools({
+      toolRegistry: makeRegistry(),
+      toolDefinitions: [],
+      includeSkillFileInstructions: true,
+    });
+    const codeOnlyRegistry = makeRegistry();
+    const codeOnly = registerFileAuthoringTools({
+      toolRegistry: codeOnlyRegistry,
+      toolDefinitions: [],
+      includeSkillFileInstructions: false,
+    });
+    const upgraded = registerFileAuthoringTools({
+      toolRegistry: codeOnlyRegistry,
+      toolDefinitions: codeOnly.toolDefinitions,
+      includeSkillFileInstructions: true,
+    });
+
+    expect(
+      maxToolDescriptionLength([
+        ...skillAware.toolDefinitions,
+        ...codeOnly.toolDefinitions,
+        ...upgraded.toolDefinitions,
+      ]),
+    ).toBeLessThanOrEqual(TOOL_DESCRIPTION_ADVISORY_MAX_LENGTH);
+  });
+
+  it('distinguishes host file authoring definitions from user tools with matching names', () => {
+    const result = registerFileAuthoringTools({
+      toolRegistry: makeRegistry(),
+      toolDefinitions: [],
+      includeSkillFileInstructions: true,
+    });
+    const createFile = result.toolDefinitions.find((d) => d.name === 'create_file');
+
+    expect(isFileAuthoringToolDefinition(createFile)).toBe(true);
+    expect(
+      isFileAuthoringToolDefinition({
+        name: 'create_file',
+        description: 'A user-defined create_file action',
+        parameters: { type: 'object', properties: {} } as LCTool['parameters'],
+      }),
+    ).toBe(false);
+  });
+});
diff --git a/packages/api/src/agents/tools.ts b/packages/api/src/agents/tools.ts
index 59c7ade5d80..f554dd3df64 100644
--- a/packages/api/src/agents/tools.ts
+++ b/packages/api/src/agents/tools.ts
@@ -1,10 +1,26 @@
 import {
+  CODE_EXECUTION_TOOLS,
   BashExecutionToolDefinition,
   ReadFileToolDefinition,
   buildBashExecutionToolDescription,
 } from '@librechat/agents';
 import type { LCTool, LCToolRegistry } from '@librechat/agents';
 
+export const CREATE_FILE_TOOL_NAME = 'create_file';
+export const EDIT_FILE_TOOL_NAME = 'edit_file';
+export const HOST_FILE_AUTHORING_ARTIFACT_KEY = '__librechat_file_authoring';
+export const FILE_AUTHORING_TOOL_NAMES: ReadonlySet<string> = new Set([
+  CREATE_FILE_TOOL_NAME,
+  EDIT_FILE_TOOL_NAME,
+]);
+
+export function isCodeSessionToolName(
+  name: string,
+  hostFileAuthoringToolNames?: ReadonlySet<string>,
+): boolean {
+  return CODE_EXECUTION_TOOLS.has(name) || hostFileAuthoringToolNames?.has(name) === true;
+}
+
 interface ToolDefLike {
   name: string;
   [key: string]: unknown;
@@ -86,6 +102,19 @@ export interface RegisterCodeExecutionToolsResult {
   registered: string[];
 }
 
+export type RegisterFileAuthoringToolsResult = RegisterCodeExecutionToolsResult;
+
+export interface RegisterFileAuthoringToolsParams {
+  toolRegistry: LCToolRegistry | undefined;
+  toolDefinitions: LCTool[] | undefined;
+  /**
+   * When true, descriptions point the model at the skill file namespace
+   * (`skills/{skillName}/...`) in addition to sandbox paths. When false,
+   * descriptions stay focused on code-execution sandbox files.
+   */
+  includeSkillFileInstructions?: boolean;
+}
+
 /**
  * Hoisted module-level definition for skill-aware `read_file` so
  * `registerCodeExecutionTools` doesn't re-allocate on every call. The
@@ -93,9 +122,13 @@ export interface RegisterCodeExecutionToolsResult {
  * per-request state — so a single frozen object is safe to share across
  * every agent init.
  */
+const SKILL_READ_FILE_DESCRIPTION = `${ReadFileToolDefinition.description}
+
+Also accepts authored skill file paths using "skills/{skillName}/...", including "skills/{skillName}/SKILL.md".`;
+
 const READ_FILE_DEF: LCTool = Object.freeze({
   name: ReadFileToolDefinition.name,
-  description: ReadFileToolDefinition.description,
+  description: SKILL_READ_FILE_DESCRIPTION,
   parameters: ReadFileToolDefinition.parameters as unknown as LCTool['parameters'],
   responseFormat: ReadFileToolDefinition.responseFormat,
 }) as LCTool;
@@ -123,16 +156,216 @@ const CODE_READ_FILE_DEF: LCTool = Object.freeze({
   responseFormat: ReadFileToolDefinition.responseFormat,
 }) as LCTool;
 
+const SKILL_CREATE_FILE_PARAMETERS: LCTool['parameters'] = Object.freeze({
+  type: 'object',
+  properties: {
+    file_path: {
+      type: 'string',
+      description:
+        'Path to write. Use "skills/{skillName}/..." for skill files when available, or a code-execution sandbox path such as "/mnt/data/result.txt" when code execution is enabled. For SKILL.md, the YAML frontmatter name must match {skillName}.',
+    },
+    content: {
+      type: 'string',
+      description: 'Complete file contents.',
+    },
+    overwrite: {
+      type: 'boolean',
+      description: 'Must be true to replace an existing file. Refuses otherwise.',
+      default: false,
+    },
+  },
+  required: ['file_path', 'content'],
+}) as LCTool['parameters'];
+
+const CODE_CREATE_FILE_PARAMETERS: LCTool['parameters'] = Object.freeze({
+  type: 'object',
+  properties: {
+    file_path: {
+      type: 'string',
+      description:
+        'Path to write in the code-execution sandbox, such as "/mnt/data/result.txt". Prefer /mnt/data/{file} for files that should remain available to later sandbox calls.',
+    },
+    content: {
+      type: 'string',
+      description: 'Complete file contents.',
+    },
+    overwrite: {
+      type: 'boolean',
+      description: 'Must be true to replace an existing file. Refuses otherwise.',
+      default: false,
+    },
+  },
+  required: ['file_path', 'content'],
+}) as LCTool['parameters'];
+
+const SKILL_EDIT_FILE_PARAMETERS: LCTool['parameters'] = Object.freeze({
+  type: 'object',
+  properties: {
+    file_path: {
+      type: 'string',
+      description:
+        'Path to edit. Use "skills/{skillName}/..." for skill files when available, or a code-execution sandbox path such as "/mnt/data/result.txt" when code execution is enabled. edit_file cannot rename skills; keep SKILL.md frontmatter name equal to {skillName}.',
+    },
+    old_text: {
+      type: 'string',
+      description: 'Exact text to find. Must match exactly one location in the file.',
+    },
+    new_text: {
+      type: 'string',
+      description: 'Replacement text.',
+    },
+    edits: {
+      type: 'array',
+      description: 'Optional batch of replacements. Each old_text must match exactly once.',
+      items: {
+        type: 'object',
+        properties: {
+          old_text: { type: 'string' },
+          new_text: { type: 'string' },
+        },
+        required: ['old_text', 'new_text'],
+      },
+    },
+  },
+  required: ['file_path'],
+}) as LCTool['parameters'];
+
+const CODE_EDIT_FILE_PARAMETERS: LCTool['parameters'] = Object.freeze({
+  type: 'object',
+  properties: {
+    file_path: {
+      type: 'string',
+      description: 'Path to edit in the code-execution sandbox, such as "/mnt/data/result.txt".',
+    },
+    old_text: {
+      type: 'string',
+      description: 'Exact text to find. Must match exactly one location in the file.',
+    },
+    new_text: {
+      type: 'string',
+      description: 'Replacement text.',
+    },
+    edits: {
+      type: 'array',
+      description: 'Optional batch of replacements. Each old_text must match exactly once.',
+      items: {
+        type: 'object',
+        properties: {
+          old_text: { type: 'string' },
+          new_text: { type: 'string' },
+        },
+        required: ['old_text', 'new_text'],
+      },
+    },
+  },
+  required: ['file_path'],
+}) as LCTool['parameters'];
+
+const SKILL_CREATE_FILE_DESCRIPTION = `Create a new file, or overwrite an existing file with explicit intent.
+
+Use for new files and full rewrites. Requires overwrite: true to replace existing files.
+
+Paths starting with "skills/" write skill files:
+- skills/{skillName}/SKILL.md - main instructions; keep it lean with YAML frontmatter, trigger-friendly description, workflow steps, and short snippets.
+- skills/{skillName}/references/{file} - long docs, schemas, examples, large templates, HTML/CSS/JS dashboards.
+- skills/{skillName}/scripts/{file} - helper scripts.
+- skills/{skillName}/assets/{file} - static assets.
+- skills/{skillName}/templates/{file} - reusable output templates.
+
+For SKILL.md, frontmatter name must match {skillName}; create skills/{newName}/SKILL.md to rename. Put large runnable artifacts in bundled files such as references/template.html, and have SKILL.md tell the agent when to read or reuse them.
+
+Non-skills paths target the code-execution sandbox when enabled. Prefer /mnt/data/{file}.`;
+
+const CODE_CREATE_FILE_DESCRIPTION = `Create a new file, or overwrite an existing file with explicit intent.
+
+Use for new files and full rewrites where the change is larger than half the file. Requires overwrite: true to replace existing files. Refuses otherwise.
+
+Targets code-execution sandbox paths. Prefer /mnt/data/{file} for files that should remain available to later sandbox calls.`;
+
+const SKILL_EDIT_FILE_DESCRIPTION = `Apply targeted text replacements to an existing file.
+
+Use for small, precise changes. Each old_text must match exactly one location. Tries exact match first; falls back to whitespace-tolerant matching if needed. Reports which matching strategy was used. Returns a unified diff.
+
+For skills/{skillName}/SKILL.md, edit description, title, or body content, but keep YAML frontmatter name equal to {skillName}. edit_file cannot rename skills; create a new skills/{newName}/SKILL.md for a different skill name. Keep SKILL.md concise; move large templates, HTML/CSS/JS dashboards, examples, schemas, and long docs into references/, scripts/, assets/, or templates/ files and point to them from SKILL.md.
+
+Paths starting with "skills/" target the skill file system. When code execution is enabled, non-skills paths target the code-execution sandbox.`;
+
+const CODE_EDIT_FILE_DESCRIPTION = `Apply targeted text replacements to an existing file.
+
+Use for small, precise changes. Each old_text must match exactly one location. Tries exact match first; falls back to whitespace-tolerant matching if needed. Reports which matching strategy was used. Returns a unified diff.
+
+Targets code-execution sandbox paths, such as /mnt/data/result.txt.`;
+
+const SKILL_CREATE_FILE_DEF: LCTool = Object.freeze({
+  name: CREATE_FILE_TOOL_NAME,
+  description: SKILL_CREATE_FILE_DESCRIPTION,
+  parameters: SKILL_CREATE_FILE_PARAMETERS,
+  responseFormat: 'content_and_artifact' as LCTool['responseFormat'],
+}) as LCTool;
+
+const CODE_CREATE_FILE_DEF: LCTool = Object.freeze({
+  name: CREATE_FILE_TOOL_NAME,
+  description: CODE_CREATE_FILE_DESCRIPTION,
+  parameters: CODE_CREATE_FILE_PARAMETERS,
+  responseFormat: 'content_and_artifact' as LCTool['responseFormat'],
+}) as LCTool;
+
+const SKILL_EDIT_FILE_DEF: LCTool = Object.freeze({
+  name: EDIT_FILE_TOOL_NAME,
+  description: SKILL_EDIT_FILE_DESCRIPTION,
+  parameters: SKILL_EDIT_FILE_PARAMETERS,
+  responseFormat: 'content_and_artifact' as LCTool['responseFormat'],
+}) as LCTool;
+
+const CODE_EDIT_FILE_DEF: LCTool = Object.freeze({
+  name: EDIT_FILE_TOOL_NAME,
+  description: CODE_EDIT_FILE_DESCRIPTION,
+  parameters: CODE_EDIT_FILE_PARAMETERS,
+  responseFormat: 'content_and_artifact' as LCTool['responseFormat'],
+}) as LCTool;
+
 function buildReadFileDef(includeSkillFileInstructions: boolean): LCTool {
   return includeSkillFileInstructions ? READ_FILE_DEF : CODE_READ_FILE_DEF;
 }
 
+function buildFileAuthoringDefs(includeSkillFileInstructions: boolean): LCTool[] {
+  return includeSkillFileInstructions
+    ? [SKILL_CREATE_FILE_DEF, SKILL_EDIT_FILE_DEF]
+    : [CODE_CREATE_FILE_DEF, CODE_EDIT_FILE_DEF];
+}
+
 function isCodeOnlyReadFileDef(def: LCTool | undefined): boolean {
   return (
     def?.name === ReadFileToolDefinition.name && def?.description === CODE_READ_FILE_DESCRIPTION
   );
 }
 
+function isCodeOnlyFileAuthoringDef(def: LCTool | undefined): boolean {
+  if (def?.name === CREATE_FILE_TOOL_NAME) {
+    return def.description === CODE_CREATE_FILE_DESCRIPTION;
+  }
+  if (def?.name === EDIT_FILE_TOOL_NAME) {
+    return def.description === CODE_EDIT_FILE_DESCRIPTION;
+  }
+  return false;
+}
+
+export function isFileAuthoringToolDefinition(def: LCTool | undefined): boolean {
+  if (def?.name === CREATE_FILE_TOOL_NAME) {
+    return (
+      def.description === CODE_CREATE_FILE_DESCRIPTION ||
+      def.description === SKILL_CREATE_FILE_DESCRIPTION
+    );
+  }
+  if (def?.name === EDIT_FILE_TOOL_NAME) {
+    return (
+      def.description === CODE_EDIT_FILE_DESCRIPTION ||
+      def.description === SKILL_EDIT_FILE_DESCRIPTION
+    );
+  }
+  return false;
+}
+
 /**
  * The `bash_tool` description varies along exactly one axis — whether
  * the LLM-facing `{{tool<idx>turn<turn>}}` reference syntax guide is
@@ -239,3 +472,54 @@ export function registerCodeExecutionTools(
     registered,
   };
 }
+
+export function registerFileAuthoringTools(
+  params: RegisterFileAuthoringToolsParams,
+): RegisterFileAuthoringToolsResult {
+  const { toolRegistry, toolDefinitions, includeSkillFileInstructions = true } = params;
+
+  const candidates = buildFileAuthoringDefs(includeSkillFileInstructions);
+  const inputDefinitions = toolDefinitions ?? [];
+  let workingDefinitions = inputDefinitions;
+
+  const registered: string[] = [];
+  const newDefs: LCTool[] = [];
+  for (const def of candidates) {
+    const existingIndex = workingDefinitions.findIndex((d) => d.name === def.name);
+    const existingDef = existingIndex >= 0 ? workingDefinitions[existingIndex] : undefined;
+    const registryDef = toolRegistry?.get(def.name);
+
+    if (
+      includeSkillFileInstructions &&
+      (isCodeOnlyFileAuthoringDef(existingDef) || isCodeOnlyFileAuthoringDef(registryDef))
+    ) {
+      if (isCodeOnlyFileAuthoringDef(existingDef)) {
+        workingDefinitions =
+          workingDefinitions === inputDefinitions ? [...inputDefinitions] : workingDefinitions;
+        workingDefinitions[existingIndex] = def;
+      }
+      if (isCodeOnlyFileAuthoringDef(registryDef)) {
+        toolRegistry?.set(def.name, def);
+      }
+      continue;
+    }
+
+    const inRegistry = toolRegistry?.has(def.name) === true;
+    const inDefs = existingIndex >= 0;
+    if (inRegistry || inDefs) {
+      continue;
+    }
+
+    toolRegistry?.set(def.name, def);
+    newDefs.push(def);
+    registered.push(def.name);
+  }
+
+  if (newDefs.length === 0) {
+    return { toolDefinitions: workingDefinitions, registered };
+  }
+  return {
+    toolDefinitions: [...workingDefinitions, ...newDefs],
+    registered,
+  };
+}
diff --git a/packages/api/src/agents/usage.bulk-parity.spec.ts b/packages/api/src/agents/usage.bulk-parity.spec.ts
index a18565ba0db..5520b667949 100644
--- a/packages/api/src/agents/usage.bulk-parity.spec.ts
+++ b/packages/api/src/agents/usage.bulk-parity.spec.ts
@@ -223,12 +223,17 @@ describe('recordCollectedUsage — bulk path parity', () => {
   });
 
   describe('cache token handling - Anthropic format', () => {
-    it('should route Anthropic cache entries to structured path — same input_tokens as legacy', async () => {
+    it('routes Anthropic cache entries to structured path and subtracts cache from input', async () => {
+      /** Production Anthropic wire: input_tokens is cache-inclusive (140 =
+       *  100 fresh + 25 write + 15 read) and provider is tagged. The billed
+       *  input must be the fresh 100, not 140 — otherwise cache is charged
+       *  twice (full input rate + cache rate). Regression for LibreChat#13795. */
       const collectedUsage: UsageMetadata[] = [
         {
-          input_tokens: 100,
+          input_tokens: 140,
           output_tokens: 50,
           model: 'claude-3',
+          provider: 'anthropic',
           cache_creation_input_tokens: 25,
           cache_read_input_tokens: 15,
         },
@@ -236,7 +241,7 @@ describe('recordCollectedUsage — bulk path parity', () => {
 
       const result = await recordCollectedUsage(deps, { ...baseParams, collectedUsage });
 
-      expect(result?.input_tokens).toBe(140); // 100 + 25 + 15
+      expect(result?.input_tokens).toBe(140);
       expect(mockInsertMany).toHaveBeenCalledTimes(1);
       expect(mockSpendStructuredTokens).not.toHaveBeenCalled();
 
@@ -339,34 +344,48 @@ describe('recordCollectedUsage — bulk path parity', () => {
     });
 
     it('should handle cache tokens with multiple tool calls — same totals as legacy', async () => {
+      /** Cache-inclusive Anthropic wire (input_tokens = fresh + write + read).
+       *  The billed input on each call is the fresh portion only. */
       const collectedUsage: UsageMetadata[] = [
         {
-          input_tokens: 788,
+          input_tokens: 31596, // 788 fresh + 30808 write
           output_tokens: 163,
           model: 'claude-opus',
+          provider: 'anthropic',
           input_token_details: { cache_read: 0, cache_creation: 30808 },
         },
         {
-          input_tokens: 3802,
+          input_tokens: 35378, // 3802 fresh + 30808 read + 768 write
           output_tokens: 149,
           model: 'claude-opus',
+          provider: 'anthropic',
           input_token_details: { cache_read: 30808, cache_creation: 768 },
         },
         {
-          input_tokens: 26808,
+          input_tokens: 58384, // 26808 fresh + 31576 read
           output_tokens: 225,
           model: 'claude-opus',
+          provider: 'anthropic',
           input_token_details: { cache_read: 31576, cache_creation: 0 },
         },
       ];
 
       const result = await recordCollectedUsage(deps, { ...baseParams, collectedUsage });
 
-      expect(result?.input_tokens).toBe(31596); // 788 + 30808 + 0
+      expect(result?.input_tokens).toBe(31596); // total prompt of first call
       expect(result?.output_tokens).toBe(537); // 163 + 149 + 225
       expect(mockInsertMany).toHaveBeenCalledTimes(1);
       expect(mockSpendStructuredTokens).not.toHaveBeenCalled();
       expect(mockSpendTokens).not.toHaveBeenCalled();
+
+      /** Each prompt doc bills only the fresh portion — cache is never folded
+       *  into inputTokens on top of its own write/read charge. */
+      const promptDocs = mockInsertMany.mock.calls[0][0].filter(
+        (d: { tokenType: string }) => d.tokenType === 'prompt',
+      );
+      expect(promptDocs.map((d: { inputTokens: number }) => d.inputTokens)).toEqual([
+        -788, -3802, -26808,
+      ]);
     });
   });
 
diff --git a/packages/api/src/agents/usage.spec.ts b/packages/api/src/agents/usage.spec.ts
index 4521de8eb4f..a9a33151463 100644
--- a/packages/api/src/agents/usage.spec.ts
+++ b/packages/api/src/agents/usage.spec.ts
@@ -1,7 +1,18 @@
+import type { TContextUsageEvent, TTokenUsageEvent } from 'librechat-data-provider';
+import type { RecordUsageDeps, RecordUsageParams, SubagentUsageEvent } from './usage';
 import type { UsageMetadata } from '../stream/interfaces/IJobStore';
-import type { RecordUsageDeps, RecordUsageParams } from './usage';
 import type { BulkWriteDeps, PricingFns } from './transactions';
-import { recordCollectedUsage } from './usage';
+import {
+  computeUsageCostUSD,
+  aggregateEmittedUsage,
+  createSubagentUsageSink,
+  recordCollectedUsage,
+  resolveAgentTokenConfig,
+  buildPersistedContextUsage,
+  buildAbortedResponseMetadata,
+  computeSummaryUsedTokens,
+  priorRunOutputTokens,
+} from './usage';
 
 describe('recordCollectedUsage', () => {
   let mockSpendTokens: jest.Mock;
@@ -148,6 +159,140 @@ describe('recordCollectedUsage', () => {
     });
   });
 
+  describe('subagent usage segregation', () => {
+    it('bills subagent entries under separate context while excluding them from reported totals', async () => {
+      const collectedUsage: UsageMetadata[] = [
+        {
+          usage_type: 'message',
+          input_tokens: 120,
+          output_tokens: 40,
+          model: 'gpt-4',
+        },
+        {
+          usage_type: 'subagent',
+          input_tokens: 900,
+          output_tokens: 700,
+          model: 'claude-haiku-4-5',
+          provider: 'anthropic',
+        },
+        {
+          usage_type: 'subagent',
+          input_tokens: 1100,
+          output_tokens: 300,
+          model: 'claude-haiku-4-5',
+          provider: 'anthropic',
+        },
+      ];
+
+      const result = await recordCollectedUsage(deps, {
+        ...baseParams,
+        collectedUsage,
+      });
+
+      /**
+       * `input_tokens` comes from the first MESSAGE usage; `output_tokens`
+       * excludes subagent completions — the result becomes the parent
+       * response message's tokenCount, and child output the parent never
+       * saw must not distort next-turn context accounting.
+       */
+      expect(result).toEqual({ input_tokens: 120, output_tokens: 40 });
+      /** ...but every subagent call is still billed against balance. */
+      expect(mockSpendTokens).toHaveBeenCalledTimes(3);
+      expect(mockSpendTokens).toHaveBeenNthCalledWith(
+        2,
+        expect.objectContaining({
+          context: 'subagent',
+          model: 'claude-haiku-4-5',
+        }),
+        { promptTokens: 900, completionTokens: 700 },
+      );
+      expect(mockSpendTokens).toHaveBeenNthCalledWith(
+        3,
+        expect.objectContaining({
+          context: 'subagent',
+          model: 'claude-haiku-4-5',
+        }),
+        { promptTokens: 1100, completionTokens: 300 },
+      );
+    });
+
+    it('bills hidden sequential-agent usage but excludes it from reported totals', async () => {
+      const collectedUsage: UsageMetadata[] = [
+        { usage_type: 'message', input_tokens: 120, output_tokens: 40, model: 'gpt-4' },
+        { usage_type: 'sequential', input_tokens: 800, output_tokens: 250, model: 'gpt-4' },
+      ];
+
+      const result = await recordCollectedUsage(deps, { ...baseParams, collectedUsage });
+
+      /** Hidden intermediate output stays out of the parent's tokenCount... */
+      expect(result).toEqual({ input_tokens: 120, output_tokens: 40 });
+      /** ...but is still billed under its own context. */
+      expect(mockSpendTokens).toHaveBeenCalledTimes(2);
+      expect(mockSpendTokens).toHaveBeenNthCalledWith(
+        2,
+        expect.objectContaining({ context: 'sequential', model: 'gpt-4' }),
+        { promptTokens: 800, completionTokens: 250 },
+      );
+    });
+
+    it('does not let a leading subagent entry hijack reported input_tokens', async () => {
+      const collectedUsage: UsageMetadata[] = [
+        {
+          usage_type: 'subagent',
+          input_tokens: 5000,
+          output_tokens: 900,
+          model: 'claude-haiku-4-5',
+        },
+        {
+          input_tokens: 120,
+          output_tokens: 40,
+          model: 'gpt-4',
+        },
+      ];
+
+      const result = await recordCollectedUsage(deps, {
+        ...baseParams,
+        collectedUsage,
+      });
+
+      expect(result).toEqual({ input_tokens: 120, output_tokens: 40 });
+      expect(mockSpendTokens).toHaveBeenCalledTimes(2);
+    });
+
+    it('uses structured spend for subagent entries with cache tokens', async () => {
+      const collectedUsage: UsageMetadata[] = [
+        { input_tokens: 100, output_tokens: 50, model: 'gpt-4' },
+        {
+          usage_type: 'subagent',
+          input_tokens: 200,
+          output_tokens: 80,
+          model: 'claude-haiku-4-5',
+          provider: 'anthropic',
+          input_token_details: { cache_creation: 60, cache_read: 30 },
+        },
+      ];
+
+      await recordCollectedUsage(deps, {
+        ...baseParams,
+        collectedUsage,
+      });
+
+      expect(mockSpendStructuredTokens).toHaveBeenCalledTimes(1);
+      /** Anthropic input_tokens is cache-inclusive, so cache is subtracted out
+       *  of the billed input: 200 − 60 − 30 = 110 (not double-charged). */
+      expect(mockSpendStructuredTokens).toHaveBeenCalledWith(
+        expect.objectContaining({
+          context: 'subagent',
+          model: 'claude-haiku-4-5',
+        }),
+        {
+          promptTokens: { input: 110, write: 60, read: 30 },
+          completionTokens: 80,
+        },
+      );
+    });
+  });
+
   describe('parallel execution (multiple agents)', () => {
     it('should handle parallel agents with independent input tokens', async () => {
       const collectedUsage: UsageMetadata[] = [
@@ -336,11 +481,13 @@ describe('recordCollectedUsage', () => {
 
   describe('cache token handling - Anthropic format', () => {
     it('should use spendStructuredTokens for cache tokens (cache_*_input_tokens)', async () => {
+      /** Cache-inclusive input_tokens (140 = 100 fresh + 25 write + 15 read). */
       const collectedUsage: UsageMetadata[] = [
         {
-          input_tokens: 100,
+          input_tokens: 140,
           output_tokens: 50,
           model: 'claude-3',
+          provider: 'anthropic',
           cache_creation_input_tokens: 25,
           cache_read_input_tokens: 15,
         },
@@ -360,7 +507,7 @@ describe('recordCollectedUsage', () => {
           completionTokens: 50,
         },
       );
-      expect(result?.input_tokens).toBe(140); // 100 + 25 + 15
+      expect(result?.input_tokens).toBe(140);
     });
   });
 
@@ -565,23 +712,27 @@ describe('recordCollectedUsage', () => {
     });
 
     it('should handle cache tokens with multiple tool calls', async () => {
+      /** Cache-inclusive Anthropic wire: input_tokens = fresh + write + read. */
       const collectedUsage: UsageMetadata[] = [
         {
-          input_tokens: 788,
+          input_tokens: 31596, // 788 fresh + 30808 write
           output_tokens: 163,
           model: 'claude-opus',
+          provider: 'anthropic',
           input_token_details: { cache_read: 0, cache_creation: 30808 },
         },
         {
-          input_tokens: 3802,
+          input_tokens: 35378, // 3802 fresh + 30808 read + 768 write
           output_tokens: 149,
           model: 'claude-opus',
+          provider: 'anthropic',
           input_token_details: { cache_read: 30808, cache_creation: 768 },
         },
         {
-          input_tokens: 26808,
+          input_tokens: 58384, // 26808 fresh + 31576 read
           output_tokens: 225,
           model: 'claude-opus',
+          provider: 'anthropic',
           input_token_details: { cache_read: 31576, cache_creation: 0 },
         },
       ];
@@ -591,7 +742,7 @@ describe('recordCollectedUsage', () => {
         collectedUsage,
       });
 
-      // input_tokens = 788 + 30808 + 0 = 31596
+      // input_tokens = total prompt of first call (cache-inclusive)
       expect(result?.input_tokens).toBe(31596);
       // output_tokens = 163 + 149 + 225 = 537
       expect(result?.output_tokens).toBe(537);
@@ -669,6 +820,77 @@ describe('recordCollectedUsage', () => {
       );
     });
 
+    it('prices each usage with its agent endpoint config (multi-endpoint graph)', async () => {
+      /** Two endpoints share a model id but bill at different rates. */
+      const primaryConfig = { 'shared-model': { prompt: 0.01, completion: 0.03, context: 8192 } };
+      const subagentConfig = { 'shared-model': { prompt: 0.05, completion: 0.15, context: 8192 } };
+      const byAgent: Record<string, typeof primaryConfig> = {
+        primary: primaryConfig,
+        sub: subagentConfig,
+      };
+      const collectedUsage: UsageMetadata[] = [
+        {
+          usage_type: 'message',
+          agentId: 'primary',
+          input_tokens: 100,
+          output_tokens: 50,
+          model: 'shared-model',
+        },
+        {
+          usage_type: 'subagent',
+          agentId: 'sub',
+          input_tokens: 200,
+          output_tokens: 80,
+          model: 'shared-model',
+        },
+      ];
+
+      await recordCollectedUsage(deps, {
+        ...baseParams,
+        collectedUsage,
+        endpointTokenConfig: primaryConfig,
+        resolveEndpointTokenConfig: (usage) =>
+          usage.agentId != null ? byAgent[usage.agentId] : undefined,
+      });
+
+      expect(mockSpendTokens).toHaveBeenCalledWith(
+        expect.objectContaining({
+          context: 'message',
+          model: 'shared-model',
+          endpointTokenConfig: primaryConfig,
+        }),
+        { promptTokens: 100, completionTokens: 50 },
+      );
+      expect(mockSpendTokens).toHaveBeenCalledWith(
+        expect.objectContaining({
+          context: 'subagent',
+          model: 'shared-model',
+          endpointTokenConfig: subagentConfig,
+        }),
+        { promptTokens: 200, completionTokens: 80 },
+      );
+    });
+
+    it('trusts the resolver result, including undefined (built-in pricing for known agents)', async () => {
+      const batch = { 'gpt-4': { prompt: 0.01, completion: 0.03, context: 8192 } };
+      await recordCollectedUsage(deps, {
+        ...baseParams,
+        collectedUsage: [
+          { agentId: 'known-openai', input_tokens: 100, output_tokens: 50, model: 'gpt-4' },
+        ],
+        endpointTokenConfig: batch,
+        /** A known agent with no configured rates: the resolver returns undefined
+         *  and the billing path must honor it (built-in pricing), NOT re-apply
+         *  the batch/primary config. */
+        resolveEndpointTokenConfig: () => undefined,
+      });
+
+      expect(mockSpendTokens).toHaveBeenCalledWith(
+        expect.objectContaining({ endpointTokenConfig: undefined }),
+        { promptTokens: 100, completionTokens: 50 },
+      );
+    });
+
     it('should use default context "message" when not provided', async () => {
       const collectedUsage: UsageMetadata[] = [
         { input_tokens: 100, output_tokens: 50, model: 'gpt-4' },
@@ -988,6 +1210,107 @@ describe('recordCollectedUsage', () => {
     });
   });
 
+  describe('Bedrock prompt caching — completion token inflation regression', () => {
+    it('does not fold cache_creation into completion on the first cached step', async () => {
+      // Bedrock: total = input + output + cache_creation (additive, not subset).
+      // Before fix: resolveCompletionTokens returned output + cache_creation (5500)
+      // instead of output (500).
+      const collectedUsage: UsageMetadata[] = [
+        {
+          input_tokens: 100,
+          output_tokens: 500,
+          total_tokens: 5600,
+          cache_creation_input_tokens: 5000,
+          cache_read_input_tokens: 0,
+          model: 'claude-sonnet-4-6',
+        },
+      ];
+
+      const result = await recordCollectedUsage(deps, { ...baseParams, collectedUsage });
+
+      expect(mockSpendStructuredTokens).toHaveBeenCalledWith(
+        expect.objectContaining({ model: 'claude-sonnet-4-6' }),
+        {
+          promptTokens: { input: 100, write: 5000, read: 0 },
+          completionTokens: 500,
+        },
+      );
+      expect(result?.output_tokens).toBe(500);
+    });
+
+    it('does not fold cache_read into completion on subsequent cached steps', async () => {
+      // Bedrock: total = input + output + cache_read on every read step.
+      // Before fix: each step returned output + cache_read instead of output.
+      const collectedUsage: UsageMetadata[] = [
+        {
+          input_tokens: 200,
+          output_tokens: 300,
+          total_tokens: 4500,
+          cache_read_input_tokens: 4000,
+          cache_creation_input_tokens: 0,
+          model: 'claude-sonnet-4-6',
+        },
+      ];
+
+      const result = await recordCollectedUsage(deps, { ...baseParams, collectedUsage });
+
+      expect(mockSpendStructuredTokens).toHaveBeenCalledWith(
+        expect.objectContaining({ model: 'claude-sonnet-4-6' }),
+        {
+          promptTokens: { input: 200, write: 0, read: 4000 },
+          completionTokens: 300,
+        },
+      );
+      expect(result?.output_tokens).toBe(300);
+    });
+
+    it('handles cache tokens in input_token_details format (alternate field path)', async () => {
+      const collectedUsage: UsageMetadata[] = [
+        {
+          input_tokens: 200,
+          output_tokens: 300,
+          total_tokens: 4500,
+          input_token_details: { cache_read: 4000, cache_creation: 0 },
+          model: 'claude-sonnet-4-6',
+        },
+      ];
+
+      const result = await recordCollectedUsage(deps, { ...baseParams, collectedUsage });
+
+      expect(result?.output_tokens).toBe(300);
+    });
+
+    it('accumulates only true output across a multi-step cached agent run', async () => {
+      // 1 write step + 4 read steps. Without the fix, each step folds its
+      // cache tokens into completion, inflating the total by the full cache size.
+      const writeStep: UsageMetadata = {
+        input_tokens: 100,
+        output_tokens: 500,
+        total_tokens: 5600,
+        cache_creation_input_tokens: 5000,
+        cache_read_input_tokens: 0,
+        model: 'claude-sonnet-4-6',
+      };
+      const readSteps: UsageMetadata[] = Array.from({ length: 4 }, (_, i) => ({
+        input_tokens: 200,
+        output_tokens: 300 + i * 50,
+        total_tokens: 200 + (300 + i * 50) + 5000,
+        cache_read_input_tokens: 5000,
+        cache_creation_input_tokens: 0,
+        model: 'claude-sonnet-4-6',
+      }));
+
+      const result = await recordCollectedUsage(deps, {
+        ...baseParams,
+        collectedUsage: [writeStep, ...readSteps],
+      });
+
+      // True output: 500 + 300 + 350 + 400 + 450 = 2000
+      const trueOutput = 500 + readSteps.reduce((sum, s) => sum + (s.output_tokens ?? 0), 0);
+      expect(result?.output_tokens).toBe(trueOutput);
+    });
+  });
+
   describe('bulk write with summarization usage', () => {
     let mockInsertMany: jest.Mock;
     let mockUpdateBalance: jest.Mock;
@@ -1114,3 +1437,657 @@ describe('recordCollectedUsage', () => {
     });
   });
 });
+
+describe('createSubagentUsageSink', () => {
+  const makeEvent = (overrides: Partial<SubagentUsageEvent> = {}): SubagentUsageEvent => ({
+    usage: { input_tokens: 900, output_tokens: 700, total_tokens: 1600 },
+    model: 'claude-haiku-4-5',
+    provider: 'anthropic',
+    subagentType: 'researcher',
+    subagentRunId: 'run-1_sub_abc',
+    subagentAgentId: 'researcher',
+    runId: 'run-1',
+    ...overrides,
+  });
+
+  it('pushes usage tagged with usage_type subagent and the child model/provider', () => {
+    const collectedUsage: UsageMetadata[] = [];
+    const sink = createSubagentUsageSink(collectedUsage);
+
+    sink(makeEvent());
+
+    expect(collectedUsage).toEqual([
+      {
+        usage_type: 'subagent',
+        input_tokens: 900,
+        output_tokens: 700,
+        total_tokens: 1600,
+        model: 'claude-haiku-4-5',
+        provider: 'anthropic',
+        agentId: 'researcher',
+      },
+    ]);
+  });
+
+  it('tags the child agent id so the host can price with the subagent endpoint config', () => {
+    const collectedUsage: UsageMetadata[] = [];
+    const emitted: UsageMetadata[] = [];
+    const sink = createSubagentUsageSink(collectedUsage, (u) => emitted.push(u));
+
+    sink(makeEvent({ subagentAgentId: 'agent_xyz' }));
+
+    expect(collectedUsage[0].agentId).toBe('agent_xyz');
+    /** The same tagged object is handed to onUsage (the live emitter). */
+    expect(emitted[0]).toBe(collectedUsage[0]);
+    expect(emitted[0].agentId).toBe('agent_xyz');
+  });
+
+  it('preserves cache token details from the child call', () => {
+    const collectedUsage: UsageMetadata[] = [];
+    const sink = createSubagentUsageSink(collectedUsage);
+
+    sink(
+      makeEvent({
+        usage: {
+          input_tokens: 200,
+          output_tokens: 80,
+          total_tokens: 280,
+          input_token_details: { cache_creation: 60, cache_read: 30 },
+        } as SubagentUsageEvent['usage'],
+      }),
+    );
+
+    expect(collectedUsage[0].input_token_details).toEqual({
+      cache_creation: 60,
+      cache_read: 30,
+    });
+  });
+
+  it('omits model/provider tags when the event carries none', () => {
+    const collectedUsage: UsageMetadata[] = [];
+    const sink = createSubagentUsageSink(collectedUsage);
+
+    sink(makeEvent({ model: undefined, provider: undefined }));
+
+    expect(collectedUsage).toHaveLength(1);
+    expect(collectedUsage[0].usage_type).toBe('subagent');
+    expect(collectedUsage[0]).not.toHaveProperty('model');
+    expect(collectedUsage[0]).not.toHaveProperty('provider');
+  });
+
+  it('ignores events without usage', () => {
+    const collectedUsage: UsageMetadata[] = [];
+    const sink = createSubagentUsageSink(collectedUsage);
+
+    sink(makeEvent({ usage: undefined as unknown as SubagentUsageEvent['usage'] }));
+
+    expect(collectedUsage).toEqual([]);
+  });
+
+  it('round-trips into recordCollectedUsage as billed subagent transactions', async () => {
+    const collectedUsage: UsageMetadata[] = [];
+    const sink = createSubagentUsageSink(collectedUsage);
+
+    /** Parent's own call, collected by ModelEndHandler as usual. */
+    collectedUsage.push({ input_tokens: 120, output_tokens: 40, model: 'gpt-4' });
+    /** Child calls reported through the sink mid-run. */
+    sink(makeEvent());
+    sink(
+      makeEvent({
+        usage: { input_tokens: 1100, output_tokens: 300, total_tokens: 1400 },
+      }),
+    );
+
+    const spendTokens = jest.fn().mockResolvedValue(undefined);
+    const spendStructuredTokens = jest.fn().mockResolvedValue(undefined);
+    const result = await recordCollectedUsage(
+      { spendTokens, spendStructuredTokens },
+      {
+        user: 'user-123',
+        conversationId: 'convo-123',
+        model: 'gpt-4',
+        collectedUsage,
+      },
+    );
+
+    /** All three calls billed; child output excluded from reported totals. */
+    expect(spendTokens).toHaveBeenCalledTimes(3);
+    expect(spendTokens).toHaveBeenNthCalledWith(
+      2,
+      expect.objectContaining({ context: 'subagent', model: 'claude-haiku-4-5' }),
+      { promptTokens: 900, completionTokens: 700 },
+    );
+    expect(result).toEqual({ input_tokens: 120, output_tokens: 40 });
+  });
+});
+
+describe('computeUsageCostUSD', () => {
+  /** Stub pricing: base prompt 3 / completion 15, cache write 3.75 / read 0.3;
+   *  a premium tier above 200k input prompt tokens (8 / 40). Mirrors the
+   *  shape of the real getMultiplier(inputTokenCount) premium switch. */
+  const pricing: PricingFns = {
+    getMultiplier: ({ tokenType, inputTokenCount }) => {
+      const premium = (inputTokenCount ?? 0) > 200000;
+      if (tokenType === 'completion') {
+        return premium ? 40 : 15;
+      }
+      return premium ? 8 : 3;
+    },
+    getCacheMultiplier: ({ cacheType }) => (cacheType === 'write' ? 3.75 : 0.3),
+  };
+
+  it('prices a standard call at base rates', () => {
+    const cost = computeUsageCostUSD(
+      { input_tokens: 1000, output_tokens: 500, model: 'gpt-4', provider: 'openAI' },
+      pricing,
+    );
+    expect(cost).toBeCloseTo((1000 * 3 + 500 * 15) / 1e6);
+  });
+
+  it('applies the premium tier when the call exceeds the input threshold', () => {
+    /** The exact gap finding A flagged: a long-context call bills premium */
+    const cost = computeUsageCostUSD(
+      { input_tokens: 300000, output_tokens: 1000, model: 'gpt-5.5', provider: 'openAI' },
+      pricing,
+    );
+    expect(cost).toBeCloseTo((300000 * 8 + 1000 * 40) / 1e6);
+  });
+
+  it('prices cache-inclusive Anthropic input by subtracting cache, then cache at its own rates', () => {
+    /** input_tokens is cache-inclusive (13000 = 1000 fresh + 2000 write + 10000
+     *  read). The fresh 1000 is billed at the input rate, the cache at its own
+     *  rates — never the cache portion at the input rate too (LibreChat#13795). */
+    const cost = computeUsageCostUSD(
+      {
+        input_tokens: 13000,
+        output_tokens: 500,
+        model: 'claude-haiku-4-5',
+        provider: 'anthropic',
+        input_token_details: { cache_creation: 2000, cache_read: 10000 },
+      },
+      pricing,
+    );
+    expect(cost).toBeCloseTo((1000 * 3 + 2000 * 3.75 + 10000 * 0.3 + 500 * 15) / 1e6);
+  });
+});
+
+describe('aggregateEmittedUsage', () => {
+  it('returns null for no emitted events', () => {
+    expect(aggregateEmittedUsage([])).toBeNull();
+  });
+
+  it('normalizes each call into display units (input excludes cache) and sums cost', () => {
+    const events: TTokenUsageEvent[] = [
+      {
+        input_tokens: 100,
+        output_tokens: 20,
+        total_tokens: 120,
+        model: 'gpt-4o-mini',
+        provider: 'openAI',
+        cost: 0.001,
+      },
+      {
+        input_tokens: 150,
+        output_tokens: 10,
+        total_tokens: 160,
+        input_token_details: { cache_creation: 30, cache_read: 50 },
+        model: 'gpt-4o-mini',
+        provider: 'openAI',
+        cost: 0.002,
+      },
+    ];
+    /** openAI is cache-subset: input excludes cache (150−30−50=70) */
+    expect(aggregateEmittedUsage(events)).toEqual({
+      input: 170,
+      output: 30,
+      cacheWrite: 30,
+      cacheRead: 50,
+      cost: 0.003,
+    });
+  });
+
+  it('omits cost when no event carried it (contextCost off)', () => {
+    const rollup = aggregateEmittedUsage([
+      { input_tokens: 100, output_tokens: 20, total_tokens: 120, provider: 'openAI' },
+    ]);
+    expect(rollup).toEqual({ input: 100, output: 20, cacheWrite: 0, cacheRead: 0 });
+    expect(rollup?.cost).toBeUndefined();
+  });
+
+  it('omits cost when any call lacked it (partial pricing failure)', () => {
+    /** One call priced, one missing cost (e.g. computeUsageCostUSD threw) →
+     *  the sum would under-report, so coverage is incomplete and cost omitted. */
+    const rollup = aggregateEmittedUsage([
+      { input_tokens: 100, output_tokens: 20, provider: 'openAI', cost: 0.01 },
+      { input_tokens: 50, output_tokens: 10, provider: 'openAI' },
+    ]);
+    expect(rollup?.cost).toBeUndefined();
+    expect(rollup?.input).toBe(150);
+    expect(rollup?.output).toBe(30);
+  });
+
+  it('normalizes mixed-provider calls per their own provider before summing', () => {
+    /** bedrock is additive (cache separate from input), openAI is subset */
+    const rollup = aggregateEmittedUsage([
+      {
+        input_tokens: 100,
+        output_tokens: 20,
+        provider: 'bedrock',
+        input_token_details: { cache_read: 40 },
+        cost: 0.01,
+      },
+      {
+        input_tokens: 90,
+        output_tokens: 5,
+        usage_type: 'subagent',
+        provider: 'openAI',
+        input_token_details: { cache_read: 30 },
+        cost: 0.02,
+      },
+    ]);
+    /** bedrock input stays 100 (additive); openAI input 90−30=60 → 160 */
+    expect(rollup?.input).toBe(160);
+    expect(rollup?.output).toBe(25);
+    expect(rollup?.cacheRead).toBe(70);
+    expect(rollup?.cost).toBeCloseTo(0.03);
+  });
+
+  it('uses the magnitude fallback for provider-less cached events (matches live)', () => {
+    /** No provider: the client's normalizeUsageUnits uses a magnitude heuristic
+     *  (cache ≤ input ⇒ input includes cache), so the rollup must too — billing
+     *  splitUsage would treat it as additive and leave input at 1000, diverging
+     *  from the live display after reload. */
+    const rollup = aggregateEmittedUsage([
+      { input_tokens: 1000, output_tokens: 100, input_token_details: { cache_read: 400 } },
+    ]);
+    expect(rollup).toEqual({ input: 600, output: 100, cacheWrite: 0, cacheRead: 400 });
+  });
+});
+
+describe('buildPersistedContextUsage', () => {
+  const baseSnapshot: TContextUsageEvent = {
+    runId: 'run-1',
+    breakdown: {
+      maxContextTokens: 8000,
+      instructionTokens: 100,
+      systemMessageTokens: 80,
+      dynamicInstructionTokens: 20,
+      toolSchemaTokens: 30,
+      summaryTokens: 0,
+      toolCount: 2,
+      messageCount: 3,
+      messageTokens: 500,
+      availableForMessages: 7000,
+      toolTokenCounts: { add: 15, noop: 0 },
+    },
+    contextBudget: 7800,
+  };
+
+  it('trims zero-valued per-tool counts', () => {
+    const result = buildPersistedContextUsage(baseSnapshot);
+    expect(result.breakdown.toolTokenCounts).toEqual({ add: 15 });
+    expect(result.contextBudget).toBe(7800);
+  });
+
+  it('drops the tool counts object entirely when all are zero', () => {
+    const result = buildPersistedContextUsage({
+      ...baseSnapshot,
+      breakdown: { ...baseSnapshot.breakdown, toolTokenCounts: { add: 0 } },
+    });
+    expect(result.breakdown.toolTokenCounts).toBeUndefined();
+  });
+
+  it('passes through a snapshot without tool counts', () => {
+    const { toolTokenCounts: _omit, ...breakdown } = baseSnapshot.breakdown;
+    const result = buildPersistedContextUsage({ ...baseSnapshot, breakdown });
+    expect(result.breakdown.toolTokenCounts).toBeUndefined();
+    expect(result.breakdown.messageTokens).toBe(500);
+  });
+
+  it('records the final primary call output as completedOutputTokens', () => {
+    /** The latest snapshot precedes the final call, so its post-snapshot delta
+     *  is that call's output — not the full multi-call response tokenCount. */
+    const events: TTokenUsageEvent[] = [
+      { input_tokens: 100, output_tokens: 40, total_tokens: 140, provider: 'openAI' },
+      { input_tokens: 200, output_tokens: 25, total_tokens: 225, provider: 'openAI' },
+      {
+        input_tokens: 50,
+        output_tokens: 12,
+        usage_type: 'subagent',
+        provider: 'openAI',
+      },
+    ];
+    const result = buildPersistedContextUsage(baseSnapshot, events);
+    /** Last PRIMARY call's completion (25), skipping the trailing subagent event */
+    expect(result.completedOutputTokens).toBe(25);
+  });
+
+  it('omits completedOutputTokens when there are no primary calls', () => {
+    expect(buildPersistedContextUsage(baseSnapshot, []).completedOutputTokens).toBeUndefined();
+  });
+
+  it('reconciles the inflated estimate to the final call’s real prompt tokens', () => {
+    /** Real web-search + summarization turn: calibration pinned at 5 inflated
+     *  messageTokens to 187471 (used 213375), but the answer call's true prompt was
+     *  55773 (Anthropic input_tokens is cache-inclusive; 2071 of it is cache read).
+     *  The persisted blob must show the real context so a reload isn't stuck
+     *  several× too high. */
+    const inflated: TContextUsageEvent = {
+      runId: 'run-1',
+      breakdown: {
+        maxContextTokens: 250000,
+        instructionTokens: 4205,
+        systemMessageTokens: 384,
+        dynamicInstructionTokens: 1525,
+        toolSchemaTokens: 2296,
+        summaryTokens: 1938,
+        toolCount: 1,
+        messageCount: 2,
+        messageTokens: 187471,
+        availableForMessages: 233295,
+      },
+      contextBudget: 237500,
+      remainingContextTokens: 24125,
+      calibrationRatio: 5,
+    };
+    const events: TTokenUsageEvent[] = [
+      {
+        input_tokens: 55773, // cache-inclusive: 53702 fresh + 2071 read
+        output_tokens: 3780,
+        input_token_details: { cache_read: 2071, cache_creation: 0 },
+        provider: 'anthropic',
+        runId: 'run-1',
+      },
+    ];
+    const result = buildPersistedContextUsage(inflated, events);
+    expect(237500 - (result.remainingContextTokens ?? 0)).toBe(55773);
+    expect(result.breakdown.messageTokens).toBe(55773 - 4205 - 1938);
+    expect(result.completedOutputTokens).toBe(3780);
+  });
+
+  it('attributes completedOutputTokens to the snapshot run, not a parallel run', () => {
+    /** Parallel/direct runs interleave: this snapshot is run-1, but run-2 emits a
+     *  later primary usage. The persisted delta must be run-1's own output (40),
+     *  never run-2's trailing output (99). */
+    const events: TTokenUsageEvent[] = [
+      {
+        input_tokens: 100,
+        output_tokens: 40,
+        total_tokens: 140,
+        provider: 'openAI',
+        runId: 'run-1',
+      },
+      {
+        input_tokens: 200,
+        output_tokens: 99,
+        total_tokens: 299,
+        provider: 'openAI',
+        runId: 'run-2',
+      },
+    ];
+    const result = buildPersistedContextUsage(baseSnapshot, events);
+    expect(result.completedOutputTokens).toBe(40);
+  });
+
+  it('omits completedOutputTokens when only other runs emitted usage', () => {
+    /** The snapshot run never completed (no matching primary); a sibling run's
+     *  output must not be borrowed — fall back to the per-message estimate. */
+    const events: TTokenUsageEvent[] = [
+      {
+        input_tokens: 200,
+        output_tokens: 99,
+        total_tokens: 299,
+        provider: 'openAI',
+        runId: 'run-2',
+      },
+    ];
+    expect(buildPersistedContextUsage(baseSnapshot, events).completedOutputTokens).toBeUndefined();
+  });
+
+  it('matches untagged usage events for back-compat (older lib / resume)', () => {
+    /** Events without a runId predate run tagging; they match any snapshot so the
+     *  last primary (25) is still recorded. */
+    const events: TTokenUsageEvent[] = [
+      { input_tokens: 100, output_tokens: 40, total_tokens: 140, provider: 'openAI' },
+      { input_tokens: 200, output_tokens: 25, total_tokens: 225, provider: 'openAI' },
+    ];
+    expect(buildPersistedContextUsage(baseSnapshot, events).completedOutputTokens).toBe(25);
+  });
+});
+
+describe('computeSummaryUsedTokens', () => {
+  const summarized = (over?: Partial<TContextUsageEvent>): TContextUsageEvent => ({
+    runId: 'run-1',
+    breakdown: {
+      maxContextTokens: 1000,
+      instructionTokens: 50,
+      systemMessageTokens: 50,
+      dynamicInstructionTokens: 0,
+      toolSchemaTokens: 0,
+      summaryTokens: 80,
+      toolCount: 0,
+      messageCount: 1,
+      messageTokens: 20,
+      availableForMessages: 900,
+    },
+    contextBudget: 1000,
+    remainingContextTokens: 700,
+    effectiveInstructionTokens: 50,
+    ...over,
+  });
+
+  it('uses contextBudget − remainingContextTokens when available', () => {
+    expect(computeSummaryUsedTokens(summarized())).toBe(300);
+  });
+
+  it('falls back to instructions + summary + messages, including summaryTokens', () => {
+    /** summaryTokens is a separate breakdown field, so the no-remaining fallback
+     *  must add it: 50 + 80 + 20 = 150, not 70. */
+    expect(computeSummaryUsedTokens(summarized({ remainingContextTokens: undefined }))).toBe(150);
+  });
+
+  it('returns undefined when the turn did not summarize', () => {
+    expect(
+      computeSummaryUsedTokens(
+        summarized({ breakdown: { ...summarized().breakdown, summaryTokens: 0 } }),
+      ),
+    ).toBeUndefined();
+    expect(computeSummaryUsedTokens(null)).toBeUndefined();
+    expect(computeSummaryUsedTokens(undefined)).toBeUndefined();
+  });
+
+  it('subtracts the response’s earlier tool-loop outputs from the marker', () => {
+    /** 300 baseUsed − 90 earlier outputs = 210, so the client estimate
+     *  (summaryBaseline + full response tokenCount) doesn’t double-count them. */
+    expect(computeSummaryUsedTokens(summarized(), 90)).toBe(210);
+  });
+
+  it('clamps to undefined when the prior outputs exceed the baseline', () => {
+    expect(computeSummaryUsedTokens(summarized(), 5000)).toBeUndefined();
+  });
+});
+
+describe('priorRunOutputTokens', () => {
+  const ev = (over: Partial<TTokenUsageEvent>): TTokenUsageEvent => ({
+    input_tokens: 10,
+    output_tokens: 0,
+    total_tokens: 10,
+    provider: 'openAI',
+    ...over,
+  });
+
+  it('sums primary outputs before the index for the matching run', () => {
+    const events = [
+      ev({ output_tokens: 20, runId: 'run-1' }),
+      ev({ output_tokens: 30, runId: 'run-1' }),
+      ev({ output_tokens: 99, runId: 'run-1' }), // at/after the index — excluded
+    ];
+    expect(priorRunOutputTokens(events, 2, 'run-1')).toBe(50);
+  });
+
+  it('counts run-matched primary + summarization, skips subagent/sequential and other runs', () => {
+    /** Both the primary and the summarization output are in this run's tokenCount
+     *  AND baseline, so both are subtracted; subagent/sequential are excluded from
+     *  the reported output total; a parallel run's primary is not this snapshot's. */
+    const events = [
+      ev({ output_tokens: 20, runId: 'run-1' }), // primary, matches
+      ev({ output_tokens: 8, runId: 'run-1', usage_type: 'summarization' }), // counted
+      ev({ output_tokens: 5, runId: 'run-1', usage_type: 'subagent' }), // skipped
+      ev({ output_tokens: 7, runId: 'run-1', usage_type: 'sequential' }), // skipped
+      ev({ output_tokens: 40, runId: 'run-2' }), // other-run primary — skipped
+    ];
+    expect(priorRunOutputTokens(events, 5, 'run-1')).toBe(28);
+  });
+
+  it('does not subtract a parallel sibling run’s summarization output', () => {
+    /** The summarize detour inherits the graph run id (traceConfig), so a sibling
+     *  run's summary carries a DIFFERENT runId; its summary is in the sibling's
+     *  baseline, not this snapshot's, so subtracting it would under-report. */
+    const events = [
+      ev({ output_tokens: 20, runId: 'run-1' }),
+      ev({ output_tokens: 8, runId: 'run-2', usage_type: 'summarization' }), // sibling — skipped
+    ];
+    expect(priorRunOutputTokens(events, 2, 'run-1')).toBe(20);
+  });
+
+  it('matches untagged events for back-compat and returns 0 with no prior calls', () => {
+    const events = [ev({ output_tokens: 20 }), ev({ output_tokens: 30 })];
+    expect(priorRunOutputTokens(events, 2, 'run-1')).toBe(50);
+    expect(priorRunOutputTokens(events, 0, 'run-1')).toBe(0);
+  });
+});
+
+describe('buildAbortedResponseMetadata', () => {
+  it('returns undefined for an empty job', () => {
+    expect(buildAbortedResponseMetadata(undefined)).toBeUndefined();
+    expect(buildAbortedResponseMetadata({})).toBeUndefined();
+    expect(buildAbortedResponseMetadata({ tokenUsage: 'not json' })).toBeUndefined();
+  });
+
+  it('rebuilds the usage/cost rollup from the job’s persisted emitted usage', () => {
+    const events: TTokenUsageEvent[] = [
+      { input_tokens: 100, output_tokens: 20, total_tokens: 120, provider: 'openAI', cost: 0.001 },
+    ];
+    const result = buildAbortedResponseMetadata({ tokenUsage: JSON.stringify(events) });
+    expect(result?.usage).toEqual({
+      input: 100,
+      output: 20,
+      cacheWrite: 0,
+      cacheRead: 0,
+      cost: 0.001,
+    });
+  });
+
+  it('never persists a breakdown for a stopped response (avoids final-call over-count)', () => {
+    const events: TTokenUsageEvent[] = [
+      { input_tokens: 100, output_tokens: 20, total_tokens: 120, provider: 'openAI' },
+    ];
+    const result = buildAbortedResponseMetadata({ tokenUsage: JSON.stringify(events) });
+    expect(result).toEqual({ usage: { input: 100, output: 20, cacheWrite: 0, cacheRead: 0 } });
+    expect((result as { contextUsage?: unknown }).contextUsage).toBeUndefined();
+  });
+
+  const abortSnapshot: TContextUsageEvent = {
+    runId: 'run-1',
+    breakdown: {
+      maxContextTokens: 1000,
+      instructionTokens: 50,
+      systemMessageTokens: 50,
+      dynamicInstructionTokens: 0,
+      toolSchemaTokens: 0,
+      summaryTokens: 80,
+      toolCount: 0,
+      messageCount: 1,
+      messageTokens: 20,
+      availableForMessages: 900,
+    },
+    contextBudget: 1000,
+    remainingContextTokens: 700,
+  };
+
+  it('persists the summary marker (but not the full snapshot) for a stopped summarized turn', () => {
+    /** A single-call stopped turn: the interrupted call emitted no usage, so the
+     *  marker is the full baseUsed (300) with nothing to subtract. */
+    const result = buildAbortedResponseMetadata({
+      tokenUsage: JSON.stringify([]),
+      contextUsage: JSON.stringify(abortSnapshot),
+    });
+    expect(result?.summaryUsedTokens).toBe(300);
+    /** The full snapshot stays off the abort path (completedOutputTokens ambiguity). */
+    expect((result as { contextUsage?: unknown }).contextUsage).toBeUndefined();
+  });
+
+  it('does not subtract any output from the marker on a stopped turn', () => {
+    /** The abort tokenCount comes from countTokens(text) or is absent — it does
+     *  NOT fold in summarization/earlier-call output the way recordCollectedUsage
+     *  does. So the marker is the full baseUsed (300); subtracting the summarization
+     *  (8) or the primary (20) here would under-report after reload. */
+    const events: TTokenUsageEvent[] = [
+      {
+        input_tokens: 100,
+        output_tokens: 20,
+        total_tokens: 120,
+        provider: 'openAI',
+        runId: 'run-1',
+      },
+      {
+        input_tokens: 60,
+        output_tokens: 8,
+        total_tokens: 68,
+        provider: 'openAI',
+        runId: 'run-1',
+        usage_type: 'summarization',
+      },
+    ];
+    const result = buildAbortedResponseMetadata({
+      tokenUsage: JSON.stringify(events),
+      contextUsage: JSON.stringify(abortSnapshot),
+    });
+    expect(result?.summaryUsedTokens).toBe(300);
+  });
+});
+
+describe('resolveAgentTokenConfig', () => {
+  const primary = { 'gpt-4': { prompt: 0.01, completion: 0.03, context: 8192 } };
+  const subagent = { 'gpt-4': { prompt: 0.05, completion: 0.15, context: 8192 } };
+
+  it('returns the producing agent’s own config', () => {
+    const byAgentId = new Map([
+      ['primary', primary],
+      ['sub', subagent],
+    ]);
+    expect(resolveAgentTokenConfig({ agentId: 'sub', byAgentId, fallback: primary })).toBe(
+      subagent,
+    );
+  });
+
+  it('returns undefined for a known agent with no configured rates (built-in pricing)', () => {
+    /** A known non-custom agent (e.g. a normal OpenAI agent) is recorded with an
+     *  undefined config; it must NOT inherit the custom-primary rates. */
+    const byAgentId = new Map<string, typeof primary | undefined>([
+      ['primary', primary],
+      ['known-openai', undefined],
+    ]);
+    expect(
+      resolveAgentTokenConfig({ agentId: 'known-openai', byAgentId, fallback: primary }),
+    ).toBeUndefined();
+  });
+
+  it('falls back to the primary config for an untagged usage', () => {
+    const byAgentId = new Map([['primary', primary]]);
+    expect(resolveAgentTokenConfig({ agentId: undefined, byAgentId, fallback: primary })).toBe(
+      primary,
+    );
+  });
+
+  it('falls back to the primary config for an unknown agent id', () => {
+    const byAgentId = new Map([['primary', primary]]);
+    expect(resolveAgentTokenConfig({ agentId: 'ghost', byAgentId, fallback: primary })).toBe(
+      primary,
+    );
+  });
+
+  it('returns the fallback when there is no per-agent map (single-endpoint graphs)', () => {
+    expect(resolveAgentTokenConfig({ agentId: 'primary', fallback: primary })).toBe(primary);
+  });
+});
diff --git a/packages/api/src/agents/usage.ts b/packages/api/src/agents/usage.ts
index 3d8ddf37991..6e6b1c14f3d 100644
--- a/packages/api/src/agents/usage.ts
+++ b/packages/api/src/agents/usage.ts
@@ -1,6 +1,16 @@
 import { logger } from '@librechat/data-schemas';
-import { Providers } from 'librechat-data-provider';
-import type { TCustomConfig, TTransactionsConfig } from 'librechat-data-provider';
+import {
+  inputTokensIncludesCache,
+  reconcileContextUsage,
+  promptTokensFromUsage,
+} from 'librechat-data-provider';
+import type {
+  TCustomConfig,
+  TResponseUsage,
+  TTokenUsageEvent,
+  TContextUsageEvent,
+  TTransactionsConfig,
+} from 'librechat-data-provider';
 import type {
   StructuredTokenUsage,
   BulkWriteDeps,
@@ -23,33 +33,6 @@ type SpendStructuredTokensFn = (
   tokenUsage: StructuredTokenUsage,
 ) => Promise<unknown>;
 
-/**
- * Providers whose `usage_metadata.input_tokens` ALREADY INCLUDES cached tokens
- * (i.e. `input_token_details.cache_*` is a subset, not an additional charge):
- *
- *   - Google / Vertex AI: `input_tokens` = `promptTokenCount` (includes `cachedContentTokenCount`)
- *   - OpenAI / Azure OpenAI: `input_tokens` = `prompt_tokens` (includes `prompt_tokens_details.cached_tokens`)
- *   - xAI, DeepSeek, OpenRouter, Moonshot: extend `ChatOpenAI`, same semantics
- *
- * Anthropic and Bedrock keep cache values separate from `input_tokens`, so they
- * must be added back to compute the total prompt size — that's the historical
- * additive default. Providers not listed here fall through to additive.
- */
-const SUBSET_PROVIDERS: ReadonlySet<string> = new Set([
-  Providers.OPENAI,
-  Providers.AZURE,
-  Providers.GOOGLE,
-  Providers.VERTEXAI,
-  Providers.XAI,
-  Providers.DEEPSEEK,
-  Providers.OPENROUTER,
-  Providers.MOONSHOT,
-]);
-
-function inputTokensIncludesCache(provider?: string): boolean {
-  return provider != null && SUBSET_PROVIDERS.has(provider);
-}
-
 /**
  * Resolves `completionTokens` for billing, repairing providers whose
  * `usage_metadata.output_tokens` undercounts.
@@ -58,22 +41,43 @@ function inputTokensIncludesCache(provider?: string): boolean {
  * `total_tokens === input_tokens + output_tokens`. Compliant providers
  * (OpenAI, Anthropic, Google API via agents' `CustomChatGoogleGenerativeAI`)
  * include any reasoning/thinking tokens inside `output_tokens` already,
- * so the invariant holds.
+ * so the invariant holds and this function is a no-op for them.
  *
- * Vertex AI Gemini through `@langchain/google-common`'s streaming path
- * emits `output_tokens = candidatesTokenCount` and drops `thoughtsTokenCount`,
- * leaving `total - input > output`. When that gap shows up we use the
- * invariant to recover the correct billable output (`total - input`).
- * Compliant providers have a zero gap, so this is a no-op for them.
+ * **Vertex AI undercount (issue #13006):** `@langchain/google-common`'s streaming
+ * path emits `output_tokens = candidatesTokenCount` and drops `thoughtsTokenCount`,
+ * so `total - input > output`. The gap is recovered as `total - input`.
  *
- * Tracked in: https://github.com/danny-avila/LibreChat/issues/13006
+ * **Bedrock cache inflation:** additive providers keep cache tokens
+ * separate from `input_tokens`, making
+ * `total = input + output + cache_read + cache_creation`. Without adjustment
+ * the Vertex recovery fires on every cached step and returns
+ * `output + cache_read + cache_creation` instead of `output`, inflating
+ * completion counts by orders of magnitude. The fix subtracts the cache
+ * adjustment before the gap test — but only for additive providers; subset
+ * providers (Anthropic, Google, OpenAI, …) already include cache inside
+ * `input_tokens` so their `cacheAdjustment` is zero and the Vertex recovery
+ * is unaffected.
  */
 function resolveCompletionTokens(usage: UsageMetadata): number {
   const output = Number(usage.output_tokens) || 0;
   const total = Number(usage.total_tokens) || 0;
   const input = Number(usage.input_tokens) || 0;
-  if (total > input + output) {
-    return total - input;
+
+  // For additive providers (Bedrock), cache tokens are separate
+  // from input_tokens and are included in total_tokens, widening the gap
+  // independently of any missing thinking tokens. Subtract them so the gap
+  // check only fires when output_tokens genuinely undercounts (Vertex case).
+  // Subset providers fold cache into input_tokens, so their adjustment is 0.
+  const cacheRead =
+    Number(usage.input_token_details?.cache_read) || Number(usage.cache_read_input_tokens) || 0;
+  const cacheCreation =
+    Number(usage.input_token_details?.cache_creation) ||
+    Number(usage.cache_creation_input_tokens) ||
+    0;
+  const cacheAdjustment = inputTokensIncludesCache(usage.provider) ? 0 : cacheRead + cacheCreation;
+
+  if (total > input + output + cacheAdjustment) {
+    return total - input - cacheAdjustment;
   }
   return output;
 }
@@ -123,6 +127,356 @@ export interface RecordUsageDeps {
   bulkWriteOps?: BulkWriteDeps;
 }
 
+/**
+ * Authoritative USD cost of one model call. Reuses the exact billing
+ * functions (`prepareTokenSpend`/`prepareStructuredTokenSpend` → `getMultiplier`
+ * with `inputTokenCount` for premium tiers) so the figure emitted to the
+ * client matches what is charged against balance — the client must not
+ * re-derive pricing from base rates. `tokenValue` is credits (USD × 1e6).
+ */
+export function computeUsageCostUSD(
+  usage: UsageMetadata,
+  pricing: PricingFns,
+  endpointTokenConfig?: EndpointTokenConfig,
+): number {
+  const { inputOnly, cacheCreation, cacheRead, completion } = splitUsage(usage);
+  /** user/context/conversationId only populate the transaction doc, which is
+   *  discarded here — only `tokenValue` (credits) is summed */
+  const txData: TxMetadata = {
+    user: '',
+    context: 'message',
+    conversationId: '',
+    model: usage.model,
+    endpointTokenConfig,
+  };
+  const entries =
+    cacheCreation > 0 || cacheRead > 0
+      ? prepareStructuredTokenSpend(
+          txData,
+          {
+            promptTokens: { input: inputOnly, write: cacheCreation, read: cacheRead },
+            completionTokens: completion,
+          },
+          pricing,
+        )
+      : prepareTokenSpend(
+          txData,
+          { promptTokens: inputOnly, completionTokens: completion },
+          pricing,
+        );
+  const credits = entries.reduce((sum, entry) => sum + Math.abs(entry.tokenValue), 0);
+  return credits / 1e6;
+}
+
+/**
+ * Aggregates the per-model-call `on_token_usage` payloads emitted for one
+ * response into a single rollup, persisted on `responseMessage.metadata.usage`.
+ *
+ * Each event is normalized into display units with the SAME logic the live
+ * client uses (`splitUsage`: input excludes cache, output is repaired) BEFORE
+ * summing, so the rollup reproduces the live branch/total usage exactly even
+ * when a turn mixes providers (e.g. a summarization or subagent call on a
+ * different provider than the primary). `cost` is the additive sum of the
+ * authoritative per-event cost, included only when at least one event carried
+ * it (i.e. `interface.contextCost` was on).
+ */
+export function aggregateEmittedUsage(
+  events: ReadonlyArray<TTokenUsageEvent>,
+): TResponseUsage | null {
+  if (events.length === 0) {
+    return null;
+  }
+  let input = 0;
+  let output = 0;
+  let cacheWrite = 0;
+  let cacheRead = 0;
+  let cost = 0;
+  /** Persist cost only with COMPLETE coverage — every call priced. A partial
+   *  sum (e.g. one call's `computeUsageCostUSD` threw and emitted without cost)
+   *  would read back as authoritative and under-report; omitting it makes the
+   *  client treat coverage as unknown and hide the cost, matching the live fold.
+   *  Naturally false when `contextCost` is off (no event carries cost). */
+  let allHaveCost = true;
+  for (const event of events) {
+    const units = normalizeEventUnits(event);
+    input += units.input;
+    output += units.output;
+    cacheWrite += units.cacheWrite;
+    cacheRead += units.cacheRead;
+    if (event.cost != null) {
+      cost += event.cost;
+    } else {
+      allHaveCost = false;
+    }
+  }
+  const rollup: TResponseUsage = { input, output, cacheWrite, cacheRead };
+  if (allHaveCost) {
+    rollup.cost = cost;
+  }
+  return rollup;
+}
+
+/**
+ * Per-event display-unit normalization, mirroring the client's
+ * `normalizeUsageUnits` EXACTLY — including the magnitude fallback when
+ * `provider` is absent — so a reloaded rollup matches what the live client
+ * folded. This is deliberately distinct from billing `splitUsage`, which treats
+ * a missing provider as additive (no magnitude fallback); the divergence only
+ * surfaces for provider-less cached events (e.g. some OpenAI-compatible/custom
+ * payloads), where the client subtracts cache from input but `splitUsage`
+ * would not. Keep in sync with `normalizeUsageUnits` in client/src/utils/tokens.ts.
+ */
+function normalizeEventUnits(event: TTokenUsageEvent): {
+  input: number;
+  output: number;
+  cacheWrite: number;
+  cacheRead: number;
+} {
+  const rawInput = event.input_tokens ?? 0;
+  const rawOutput = event.output_tokens ?? 0;
+  const total = event.total_tokens ?? 0;
+  const cacheWrite = event.input_token_details?.cache_creation ?? 0;
+  const cacheRead = event.input_token_details?.cache_read ?? 0;
+  const includesCache =
+    event.provider != null
+      ? inputTokensIncludesCache(event.provider)
+      : cacheWrite + cacheRead <= rawInput;
+  const cacheAdjustment = includesCache ? 0 : cacheRead + cacheWrite;
+  const output =
+    total > rawInput + rawOutput + cacheAdjustment ? total - rawInput - cacheAdjustment : rawOutput;
+  return {
+    input: includesCache ? Math.max(0, rawInput - cacheRead - cacheWrite) : rawInput,
+    output,
+    cacheWrite,
+    cacheRead,
+  };
+}
+
+/** The final primary (non-tagged) model call belonging to the snapshot's run —
+ *  the call the latest pre-invoke snapshot precedes. Filtering by `runId` prevents
+ *  a parallel run's later usage from being attributed to this snapshot; untagged
+ *  events (older lib / resume) match any run for back-compat. */
+function finalPrimaryCall(
+  events: ReadonlyArray<TTokenUsageEvent>,
+  runId?: string,
+): TTokenUsageEvent | undefined {
+  for (let i = events.length - 1; i >= 0; i--) {
+    const event = events[i];
+    if (event.usage_type != null) {
+      continue;
+    }
+    if (runId != null && event.runId != null && event.runId !== runId) {
+      continue;
+    }
+    return event;
+  }
+  return undefined;
+}
+
+/**
+ * Projects the latest live context snapshot into the blob persisted on
+ * `responseMessage.metadata.contextUsage`. Reconciles the calibrated estimate to
+ * the final call's ACTUAL prompt tokens (the SDK multiplier over-inflates
+ * `messageTokens`, badly so when a provider injects server-side content like web
+ * search), so a reloaded turn shows the real context — not a several×-too-high
+ * number. Trims zero-valued per-tool counts (privacy/size) and records the final
+ * call's output as `completedOutputTokens` so rehydration adds the same
+ * post-snapshot delta the live gauge did. The client re-anchors the blob to the
+ * response message id on load.
+ */
+export function buildPersistedContextUsage(
+  snapshot: TContextUsageEvent,
+  usageEvents: ReadonlyArray<TTokenUsageEvent> = [],
+): TContextUsageEvent {
+  const finalCall = finalPrimaryCall(usageEvents, snapshot.runId);
+  const completedOutputTokens = finalCall ? normalizeEventUnits(finalCall).output : 0;
+  const reconciled = finalCall
+    ? reconcileContextUsage(snapshot, promptTokensFromUsage(finalCall))
+    : snapshot;
+  const { breakdown } = reconciled;
+  let toolTokenCounts = breakdown.toolTokenCounts;
+  if (toolTokenCounts != null) {
+    const trimmed: Record<string, number> = {};
+    for (const [name, count] of Object.entries(toolTokenCounts)) {
+      if (count > 0) {
+        trimmed[name] = count;
+      }
+    }
+    toolTokenCounts = Object.keys(trimmed).length > 0 ? trimmed : undefined;
+  }
+  return {
+    ...reconciled,
+    breakdown: { ...breakdown, toolTokenCounts },
+    ...(completedOutputTokens > 0 && { completedOutputTokens }),
+  };
+}
+
+/**
+ * Sum of this response's output tokens already folded into a later snapshot's
+ * pre-invoke baseline that the response message's `tokenCount` ALSO carries — the
+ * overlap `computeSummaryUsedTokens` subtracts from the marker so the live-path
+ * client estimate (`summaryBaseline + responseTokenCount`) doesn't double-count:
+ *  - earlier tool-loop PRIMARY calls: a multi-call turn's first output sits in the
+ *    kept-message context of the next call's snapshot AND in `tokenCount`.
+ *  - the SUMMARIZATION call's generated summary: it sits in the snapshot baseline
+ *    as `summaryTokens` AND in `tokenCount` (`recordCollectedUsage` folds
+ *    summarization completion into the reported output total; subagent/sequential
+ *    are kept out of that total, so they are excluded here too).
+ *
+ * Both are matched by `runId` and bounded by `beforeIndex` to the calls that
+ * preceded the snapshot. The summarize detour inherits the graph run id
+ * (`traceConfig` spreads `config.metadata.run_id`), so it shares the snapshot's
+ * `runId`; a parallel sibling run's summary carries a DIFFERENT `runId` and must
+ * NOT be subtracted (its summary lives in the sibling's baseline, not this one).
+ * Untagged events (older lib / resume) match any run for back-compat.
+ *
+ * Only the live path (which builds `tokenCount` via `recordCollectedUsage`) calls
+ * this; the abort path subtracts nothing — see {@link buildAbortedResponseMetadata}.
+ */
+export function priorRunOutputTokens(
+  events: ReadonlyArray<TTokenUsageEvent>,
+  beforeIndex: number,
+  runId?: string,
+): number {
+  let total = 0;
+  const end = Math.min(beforeIndex, events.length);
+  for (let i = 0; i < end; i++) {
+    const event = events[i];
+    if (event.usage_type != null && event.usage_type !== 'summarization') {
+      continue;
+    }
+    if (runId != null && event.runId != null && event.runId !== runId) {
+      continue;
+    }
+    total += normalizeEventUnits(event).output;
+  }
+  return total;
+}
+
+/**
+ * Pre-invoke compacted context size for a summarized turn (instructions +
+ * summary + kept messages), or `undefined` when the turn did not summarize.
+ * Persisted as the lightweight `summaryUsedTokens` marker so the client estimate
+ * fallback caps the discarded pre-summary history instead of re-summing it (the
+ * gauge otherwise reads 100% in perpetuity after a compaction). Pre-invoke, so
+ * it carries none of the `completedOutputTokens` ambiguity that keeps the full
+ * snapshot off some save paths. `summaryTokens` is a SEPARATE breakdown field, so
+ * the non-`remainingContextTokens` fallback adds it explicitly.
+ *
+ * `priorOutputTokens` (this response's earlier tool-loop outputs, see
+ * {@link priorRunOutputTokens}) is subtracted: those tokens are inside the
+ * baseline's kept messages AND in the response message's `tokenCount` the client
+ * adds on top, so leaving them in the marker double-counts them on a tool-loop
+ * summarized turn. Single-call turns pass 0 and are unaffected.
+ */
+export function computeSummaryUsedTokens(
+  snapshot: TContextUsageEvent | null | undefined,
+  priorOutputTokens = 0,
+): number | undefined {
+  const summaryTokens = snapshot?.breakdown?.summaryTokens ?? 0;
+  if (!snapshot || summaryTokens <= 0) {
+    return undefined;
+  }
+  const maxTokens = snapshot.contextBudget ?? snapshot.breakdown.maxContextTokens ?? 0;
+  const baseUsed =
+    snapshot.remainingContextTokens != null
+      ? maxTokens - snapshot.remainingContextTokens
+      : (snapshot.effectiveInstructionTokens ?? snapshot.breakdown.instructionTokens ?? 0) +
+        summaryTokens +
+        (snapshot.breakdown.messageTokens ?? 0);
+  const adjusted = baseUsed - Math.max(0, priorOutputTokens);
+  return adjusted > 0 ? Math.round(adjusted) : undefined;
+}
+
+function parseUsageEvents(value?: string | null): TTokenUsageEvent[] {
+  if (typeof value !== 'string' || value.length === 0) {
+    return [];
+  }
+  try {
+    const parsed = JSON.parse(value);
+    return Array.isArray(parsed) ? (parsed as TTokenUsageEvent[]) : [];
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * Builds the response `metadata` for a STOPPED generation from the job's
+ * persisted emitted usage, so a stopped reply keeps its accurate cost rollup on
+ * reload (finding: stopped responses otherwise lose cost). Shared by every abort
+ * save path (agents abort route + legacy abort middleware).
+ *
+ * Deliberately omits the full `contextUsage`: unlike the live path, the abort
+ * path can't tell whether the FINAL call (the one the latest snapshot precedes)
+ * emitted usage — the job stores only the latest snapshot, not the snapshot
+ * count. If the final call emitted none, `completedOutputTokens` would reuse an
+ * earlier call's output the snapshot already counts → reload over-reports. So a
+ * stopped response falls back to the per-message gauge estimate on reload.
+ *
+ * It DOES persist the `summaryUsedTokens` marker when the stopped turn had
+ * summarized: that marker is pre-invoke (no `completedOutputTokens` ambiguity),
+ * and without it the fallback estimate re-sums the history the compaction
+ * discarded — leaving a stopped summarized turn pinned at 100%. Unlike the live
+ * path, the abort `tokenCount` comes from `countTokens(text)` (abortMiddleware) or
+ * is absent (agents abort route) — it does NOT fold in the summarization or
+ * earlier-call output the way `recordCollectedUsage` does. So the marker subtracts
+ * NOTHING: the full pre-invoke baseline is correct, and the client adds only the
+ * partial answer text on top (no overlap to cancel).
+ */
+export function buildAbortedResponseMetadata(
+  job: { tokenUsage?: string | null; contextUsage?: string | null } | null | undefined,
+): { usage?: TResponseUsage; summaryUsedTokens?: number } | undefined {
+  const events = parseUsageEvents(job?.tokenUsage);
+  const usage = aggregateEmittedUsage(events);
+
+  let snapshot: TContextUsageEvent | null = null;
+  if (typeof job?.contextUsage === 'string' && job.contextUsage.length > 0) {
+    try {
+      snapshot = JSON.parse(job.contextUsage) as TContextUsageEvent;
+    } catch {
+      snapshot = null;
+    }
+  }
+  /** Subtract nothing: the abort `tokenCount` (countTokens(text) or absent) does
+   *  not fold in summarization/earlier-call output, so the full baseline is the
+   *  marker and the client's partial-text addition has no overlap to cancel. */
+  const summaryUsedTokens = computeSummaryUsedTokens(snapshot);
+
+  const metadata: { usage?: TResponseUsage; summaryUsedTokens?: number } = {};
+  if (usage) {
+    metadata.usage = usage;
+  }
+  if (summaryUsedTokens != null) {
+    metadata.summaryUsedTokens = summaryUsedTokens;
+  }
+  return Object.keys(metadata).length > 0 ? metadata : undefined;
+}
+
+/**
+ * Resolves the endpoint token config for a usage item by its producing agent.
+ * Multi-endpoint graphs tag each call with `agentId`; that agent's resolved
+ * config is authoritative — including `undefined`, which means "no configured
+ * rates, use built-in pricing" (e.g. a non-custom agent in a custom-primary
+ * graph). Only an untagged or unknown agent falls back to `fallback` (the
+ * primary config), so single-endpoint graphs are unchanged. `byAgentId` must
+ * hold an entry for every known agent (value may be `undefined`) so `has`
+ * distinguishes "known, no rates" from "unknown".
+ */
+export function resolveAgentTokenConfig({
+  agentId,
+  byAgentId,
+  fallback,
+}: {
+  agentId?: string | null;
+  byAgentId?: Map<string, EndpointTokenConfig | undefined>;
+  fallback?: EndpointTokenConfig;
+}): EndpointTokenConfig | undefined {
+  if (agentId != null && byAgentId?.has(agentId)) {
+    return byAgentId.get(agentId);
+  }
+  return fallback;
+}
+
 export interface RecordUsageParams {
   user: string;
   conversationId: string;
@@ -133,6 +487,15 @@ export interface RecordUsageParams {
   balance?: Partial<TCustomConfig['balance']> | null;
   transactions?: Partial<TTransactionsConfig>;
   endpointTokenConfig?: EndpointTokenConfig;
+  /**
+   * Per-usage endpoint token config resolver for multi-endpoint graphs. Called
+   * with each usage item; when provided it is authoritative — its result prices
+   * that item, including `undefined` (built-in pricing for a known agent with no
+   * configured rates). It owns its own fallback to the primary config for
+   * untagged/unknown agents (see {@link resolveAgentTokenConfig}). Single-config
+   * callers (responses.js / openai.js) omit it and use `endpointTokenConfig`.
+   */
+  resolveEndpointTokenConfig?: (usage: UsageMetadata) => EndpointTokenConfig | undefined;
 }
 
 export interface RecordUsageResult {
@@ -160,6 +523,7 @@ export async function recordCollectedUsage(
     conversationId,
     collectedUsage,
     endpointTokenConfig,
+    resolveEndpointTokenConfig,
     context = 'message',
   } = params;
 
@@ -169,11 +533,23 @@ export async function recordCollectedUsage(
 
   const messageUsages: UsageMetadata[] = [];
   const summarizationUsages: UsageMetadata[] = [];
+  const subagentUsages: UsageMetadata[] = [];
+  /** Hidden sequential-agent calls: billed, but excluded from the reported
+   *  output total since their output never reaches the visible message */
+  const sequentialUsages: UsageMetadata[] = [];
   for (const usage of collectedUsage) {
     if (usage == null) {
       continue;
     }
-    (usage.usage_type === 'summarization' ? summarizationUsages : messageUsages).push(usage);
+    if (usage.usage_type === 'summarization') {
+      summarizationUsages.push(usage);
+    } else if (usage.usage_type === 'subagent') {
+      subagentUsages.push(usage);
+    } else if (usage.usage_type === 'sequential') {
+      sequentialUsages.push(usage);
+    } else {
+      messageUsages.push(usage);
+    }
   }
 
   const firstUsage = messageUsages[0];
@@ -188,6 +564,7 @@ export async function recordCollectedUsage(
     usages: UsageMetadata[],
     usageContext: string,
     docs: PreparedEntry[],
+    options?: { excludeFromOutputTotal?: boolean },
   ): void => {
     for (const usage of usages) {
       if (!usage) {
@@ -196,7 +573,9 @@ export async function recordCollectedUsage(
 
       const { inputOnly, cacheCreation, cacheRead, completion } = splitUsage(usage);
 
-      total_output_tokens += completion;
+      if (options?.excludeFromOutputTotal !== true) {
+        total_output_tokens += completion;
+      }
 
       const txMetadata: TxMetadata = {
         user,
@@ -204,7 +583,12 @@ export async function recordCollectedUsage(
         messageId,
         transactions,
         conversationId,
-        endpointTokenConfig,
+        /** Price with the producing agent's endpoint config when a resolver is
+         *  provided (multi-endpoint graphs); it owns the fallback to the primary
+         *  config, so `undefined` here means built-in pricing, not the batch one. */
+        endpointTokenConfig: resolveEndpointTokenConfig
+          ? resolveEndpointTokenConfig(usage)
+          : endpointTokenConfig,
         context: usageContext,
         model: usage.model ?? model,
       };
@@ -272,6 +656,15 @@ export async function recordCollectedUsage(
   const allDocs: PreparedEntry[] = [];
   processUsageGroup(messageUsages, context, allDocs);
   processUsageGroup(summarizationUsages, 'summarization', allDocs);
+  /**
+   * Subagent child-run usage is billed in full (transactions + balance) but
+   * excluded from the reported output total: the result's `output_tokens`
+   * becomes the parent response message's `tokenCount` (see BaseClient's
+   * `getStreamUsage` consumer), and child output the parent never saw would
+   * distort next-turn context accounting by orders of magnitude.
+   */
+  processUsageGroup(subagentUsages, 'subagent', allDocs, { excludeFromOutputTotal: true });
+  processUsageGroup(sequentialUsages, 'sequential', allDocs, { excludeFromOutputTotal: true });
   if (useBulk && allDocs.length > 0) {
     try {
       await bulkWriteTransactions({ user, docs: allDocs }, bulkWriteOps);
@@ -285,3 +678,66 @@ export async function recordCollectedUsage(
     output_tokens: total_output_tokens,
   };
 }
+
+/**
+ * Structural mirror of the agents SDK's `SubagentUsageEvent` (added after
+ * `@librechat/agents` 3.2.33). Defined locally so type-checking does not
+ * depend on the unreleased SDK — replace with
+ * `import type { SubagentUsageEvent } from '@librechat/agents'` once the
+ * dependency is bumped.
+ */
+export interface SubagentUsageEvent {
+  /** Usage metadata reported by the child's model call. */
+  usage: UsageMetadata;
+  /** Model that produced this usage (per-call, falls back to the child config's model). */
+  model?: string;
+  /** Provider enum value of the subagent's configured agent. */
+  provider?: string;
+  /** Subagent `type` identifier from the SubagentConfig. */
+  subagentType: string;
+  /** Child run ID (unique per subagent execution). */
+  subagentRunId: string;
+  /** Child agent ID assigned to this subagent execution. */
+  subagentAgentId: string;
+  /** Parent run ID under which the subagent was spawned. */
+  runId: string;
+}
+
+/**
+ * Builds the host-side `subagentUsageSink` for `Run.create`. Subagent child
+ * graphs execute outside the run's `streamEvents` loop, so their model calls
+ * never reach the `CHAT_MODEL_END` handler (`ModelEndHandler`) — the SDK
+ * reports them through this sink instead. Each event is tagged
+ * `usage_type: 'subagent'` with the child's model/provider and pushed onto
+ * the same `collectedUsage` array the handler fills, so
+ * {@link recordCollectedUsage} bills child calls (transactions + balance)
+ * alongside the parent's.
+ */
+export function createSubagentUsageSink(
+  collectedUsage: UsageMetadata[],
+  onUsage?: (usage: UsageMetadata) => void,
+): (event: SubagentUsageEvent) => void {
+  return (event) => {
+    if (event?.usage == null) {
+      return;
+    }
+    const usage: UsageMetadata = { ...event.usage, usage_type: 'subagent' };
+    if (event.model != null && event.model !== '') {
+      usage.model = event.model;
+    }
+    if (event.provider != null && event.provider !== '') {
+      usage.provider = event.provider;
+    }
+    /** Tag the child's agent id so the host can price this usage with the
+     *  subagent's own endpoint token config (its endpoint may differ from the
+     *  parent's). The same tagged object is pushed AND handed to `onUsage`. */
+    if (event.subagentAgentId != null && event.subagentAgentId !== '') {
+      usage.agentId = event.subagentAgentId;
+    }
+    collectedUsage.push(usage);
+    /** Lets the host stream the billed child usage to the client (tagged
+     *  `subagent`, so it folds into session cost/totals but not the live
+     *  gauge) — child runs never reach ModelEndHandler's emit path. */
+    onUsage?.(usage);
+  };
+}
diff --git a/packages/api/src/agents/validation.ts b/packages/api/src/agents/validation.ts
index 30b1da7d099..8fc63414e59 100644
--- a/packages/api/src/agents/validation.ts
+++ b/packages/api/src/agents/validation.ts
@@ -11,24 +11,212 @@ import type { Request, Response } from 'express';
 type LooseRequest = Request<unknown, unknown, unknown>;
 
 /** Avatar schema shared between create and update */
-export const agentAvatarSchema = z.object({
+export const agentAvatarSchema: z.ZodObject<
+  {
+    filepath: z.ZodString;
+    source: z.ZodString;
+  },
+  'strip'
+> = z.object({
   filepath: z.string(),
   source: z.string(),
 });
 
 /** Base resource schema for tool resources */
-export const agentBaseResourceSchema = z.object({
+export const agentBaseResourceSchema: z.ZodObject<
+  {
+    file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+    files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+  },
+  'strip'
+> = z.object({
   file_ids: z.array(z.string()).optional(),
-  files: z.array(z.any()).optional(), // Files are populated at runtime, not from user input
+  files: z.array(z.unknown()).optional(), // Files are populated at runtime, not from user input
 });
 
 /** File resource schema extends base with vector_store_ids */
-export const agentFileResourceSchema = agentBaseResourceSchema.extend({
+export const agentFileResourceSchema: z.ZodObject<
+  {
+    file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+    files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+  } & {
+    vector_store_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+  },
+  'strip'
+> = agentBaseResourceSchema.extend({
   vector_store_ids: z.array(z.string()).optional(),
 });
 
 /** Tool resources schema matching AgentToolResources interface */
-export const agentToolResourcesSchema = z
+export const agentToolResourcesSchema: z.ZodOptional<
+  z.ZodObject<
+    {
+      image_edit: z.ZodOptional<
+        z.ZodObject<
+          {
+            file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+            files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+          },
+          'strip',
+          z.ZodTypeAny,
+          {
+            file_ids?: string[] | undefined;
+            files?: unknown[] | undefined;
+          },
+          {
+            file_ids?: string[] | undefined;
+            files?: unknown[] | undefined;
+          }
+        >
+      >;
+      execute_code: z.ZodOptional<
+        z.ZodObject<
+          {
+            file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+            files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+          },
+          'strip',
+          z.ZodTypeAny,
+          {
+            file_ids?: string[] | undefined;
+            files?: unknown[] | undefined;
+          },
+          {
+            file_ids?: string[] | undefined;
+            files?: unknown[] | undefined;
+          }
+        >
+      >;
+      file_search: z.ZodOptional<
+        z.ZodObject<
+          {
+            file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+            files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+          } & {
+            vector_store_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+          },
+          'strip',
+          z.ZodTypeAny,
+          {
+            file_ids?: string[] | undefined;
+            files?: unknown[] | undefined;
+            vector_store_ids?: string[] | undefined;
+          },
+          {
+            file_ids?: string[] | undefined;
+            files?: unknown[] | undefined;
+            vector_store_ids?: string[] | undefined;
+          }
+        >
+      >;
+      context: z.ZodOptional<
+        z.ZodObject<
+          {
+            file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+            files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+          },
+          'strip',
+          z.ZodTypeAny,
+          {
+            file_ids?: string[] | undefined;
+            files?: unknown[] | undefined;
+          },
+          {
+            file_ids?: string[] | undefined;
+            files?: unknown[] | undefined;
+          }
+        >
+      >;
+      /** @deprecated Use context instead */
+      ocr: z.ZodOptional<
+        z.ZodObject<
+          {
+            file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+            files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+          },
+          'strip',
+          z.ZodTypeAny,
+          {
+            file_ids?: string[] | undefined;
+            files?: unknown[] | undefined;
+          },
+          {
+            file_ids?: string[] | undefined;
+            files?: unknown[] | undefined;
+          }
+        >
+      >;
+    },
+    'strip',
+    z.ZodTypeAny,
+    {
+      ocr?:
+        | {
+            file_ids?: string[] | undefined;
+            files?: unknown[] | undefined;
+          }
+        | undefined;
+      context?:
+        | {
+            file_ids?: string[] | undefined;
+            files?: unknown[] | undefined;
+          }
+        | undefined;
+      execute_code?:
+        | {
+            file_ids?: string[] | undefined;
+            files?: unknown[] | undefined;
+          }
+        | undefined;
+      file_search?:
+        | {
+            file_ids?: string[] | undefined;
+            files?: unknown[] | undefined;
+            vector_store_ids?: string[] | undefined;
+          }
+        | undefined;
+      image_edit?:
+        | {
+            file_ids?: string[] | undefined;
+            files?: unknown[] | undefined;
+          }
+        | undefined;
+    },
+    {
+      ocr?:
+        | {
+            file_ids?: string[] | undefined;
+            files?: unknown[] | undefined;
+          }
+        | undefined;
+      context?:
+        | {
+            file_ids?: string[] | undefined;
+            files?: unknown[] | undefined;
+          }
+        | undefined;
+      execute_code?:
+        | {
+            file_ids?: string[] | undefined;
+            files?: unknown[] | undefined;
+          }
+        | undefined;
+      file_search?:
+        | {
+            file_ids?: string[] | undefined;
+            files?: unknown[] | undefined;
+            vector_store_ids?: string[] | undefined;
+          }
+        | undefined;
+      image_edit?:
+        | {
+            file_ids?: string[] | undefined;
+            files?: unknown[] | undefined;
+          }
+        | undefined;
+    }
+  >
+> = z
   .object({
     image_edit: agentBaseResourceSchema.optional(),
     execute_code: agentBaseResourceSchema.optional(),
@@ -40,7 +228,24 @@ export const agentToolResourcesSchema = z
   .optional();
 
 /** Support contact schema for agent */
-export const agentSupportContactSchema = z
+export const agentSupportContactSchema: z.ZodOptional<
+  z.ZodObject<
+    {
+      name: z.ZodOptional<z.ZodString>;
+      email: z.ZodOptional<z.ZodUnion<[z.ZodLiteral<''>, z.ZodString]>>;
+    },
+    'strip',
+    z.ZodTypeAny,
+    {
+      name?: string | undefined;
+      email?: string | undefined;
+    },
+    {
+      name?: string | undefined;
+      email?: string | undefined;
+    }
+  >
+> = z
   .object({
     name: z.string().optional(),
     email: z.union([z.literal(''), z.string().email()]).optional(),
@@ -48,7 +253,24 @@ export const agentSupportContactSchema = z
   .optional();
 
 /** Graph edge schema for agent handoffs */
-export const graphEdgeSchema = z.object({
+export const graphEdgeSchema: z.ZodObject<
+  {
+    from: z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, 'many'>]>;
+    to: z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, 'many'>]>;
+    description: z.ZodEffects<z.ZodOptional<z.ZodString>, string | undefined, string | undefined>;
+    edgeType: z.ZodOptional<z.ZodEnum<['handoff', 'direct']>>;
+    prompt: z.ZodEffects<
+      z.ZodOptional<
+        z.ZodUnion<[z.ZodString, z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>]>
+      >,
+      string | ((...args: unknown[]) => unknown) | undefined,
+      string | ((...args: unknown[]) => unknown) | undefined
+    >;
+    excludeResults: z.ZodOptional<z.ZodBoolean>;
+    promptKey: z.ZodEffects<z.ZodOptional<z.ZodString>, string | undefined, string | undefined>;
+  },
+  'strip'
+> = z.object({
   from: z.union([z.string(), z.array(z.string())]),
   to: z.union([z.string(), z.array(z.string())]),
   description: z
@@ -68,13 +290,39 @@ export const graphEdgeSchema = z.object({
 });
 
 /** Per-tool options schema (defer_loading, allowed_callers) */
-export const toolOptionsSchema = z.object({
+export const toolOptionsSchema: z.ZodObject<
+  {
+    defer_loading: z.ZodOptional<z.ZodBoolean>;
+    allowed_callers: z.ZodOptional<z.ZodArray<z.ZodEnum<['direct', 'code_execution']>, 'many'>>;
+  },
+  'strip'
+> = z.object({
   defer_loading: z.boolean().optional(),
   allowed_callers: z.array(z.enum(['direct', 'code_execution'])).optional(),
 });
 
 /** Agent tool options - map of tool_id to tool options */
-export const agentToolOptionsSchema = z.record(z.string(), toolOptionsSchema).optional();
+export const agentToolOptionsSchema: z.ZodOptional<
+  z.ZodRecord<
+    z.ZodString,
+    z.ZodObject<
+      {
+        defer_loading: z.ZodOptional<z.ZodBoolean>;
+        allowed_callers: z.ZodOptional<z.ZodArray<z.ZodEnum<['direct', 'code_execution']>, 'many'>>;
+      },
+      'strip',
+      z.ZodTypeAny,
+      {
+        defer_loading?: boolean | undefined;
+        allowed_callers?: ('direct' | 'code_execution')[] | undefined;
+      },
+      {
+        defer_loading?: boolean | undefined;
+        allowed_callers?: ('direct' | 'code_execution')[] | undefined;
+      }
+    >
+  >
+> = z.record(z.string(), toolOptionsSchema).optional();
 
 /**
  * Subagent spawning configuration for an agent. `agent_ids` is capped at
@@ -82,7 +330,27 @@ export const agentToolOptionsSchema = z.record(z.string(), toolOptionsSchema).op
  * of `processAgent` calls (DB lookup + permission check + tool loading).
  * The UI enforces the same cap, so legitimate payloads never hit the bound.
  */
-export const agentSubagentsSchema = z
+export const agentSubagentsSchema: z.ZodOptional<
+  z.ZodObject<
+    {
+      enabled: z.ZodOptional<z.ZodBoolean>;
+      allowSelf: z.ZodOptional<z.ZodBoolean>;
+      agent_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+    },
+    'strip',
+    z.ZodTypeAny,
+    {
+      enabled?: boolean | undefined;
+      agent_ids?: string[] | undefined;
+      allowSelf?: boolean | undefined;
+    },
+    {
+      enabled?: boolean | undefined;
+      agent_ids?: string[] | undefined;
+      allowSelf?: boolean | undefined;
+    }
+  >
+> = z
   .object({
     enabled: z.boolean().optional(),
     allowSelf: z.boolean().optional(),
@@ -91,7 +359,327 @@ export const agentSubagentsSchema = z
   .optional();
 
 /** Base agent schema with all common fields */
-export const agentBaseSchema = z.object({
+export const agentBaseSchema: z.ZodObject<
+  {
+    name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    instructions: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    avatar: z.ZodOptional<
+      z.ZodNullable<
+        z.ZodObject<
+          {
+            filepath: z.ZodString;
+            source: z.ZodString;
+          },
+          'strip',
+          z.ZodTypeAny,
+          {
+            source: string;
+            filepath: string;
+          },
+          {
+            source: string;
+            filepath: string;
+          }
+        >
+      >
+    >;
+    model_parameters: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    tools: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+    skills: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+    skills_enabled: z.ZodOptional<z.ZodBoolean>;
+    /** @deprecated Use edges instead */
+    agent_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+    edges: z.ZodOptional<
+      z.ZodArray<
+        z.ZodObject<
+          {
+            from: z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, 'many'>]>;
+            to: z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, 'many'>]>;
+            description: z.ZodEffects<
+              z.ZodOptional<z.ZodString>,
+              string | undefined,
+              string | undefined
+            >;
+            edgeType: z.ZodOptional<z.ZodEnum<['handoff', 'direct']>>;
+            prompt: z.ZodEffects<
+              z.ZodOptional<
+                z.ZodUnion<[z.ZodString, z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>]>
+              >,
+              string | ((...args: unknown[]) => unknown) | undefined,
+              string | ((...args: unknown[]) => unknown) | undefined
+            >;
+            excludeResults: z.ZodOptional<z.ZodBoolean>;
+            promptKey: z.ZodEffects<
+              z.ZodOptional<z.ZodString>,
+              string | undefined,
+              string | undefined
+            >;
+          },
+          'strip',
+          z.ZodTypeAny,
+          {
+            from: string | string[];
+            to: string | string[];
+            description?: string | undefined;
+            prompt?: string | ((...args: unknown[]) => unknown) | undefined;
+            edgeType?: 'direct' | 'handoff' | undefined;
+            excludeResults?: boolean | undefined;
+            promptKey?: string | undefined;
+          },
+          {
+            from: string | string[];
+            to: string | string[];
+            description?: string | undefined;
+            prompt?: string | ((...args: unknown[]) => unknown) | undefined;
+            edgeType?: 'direct' | 'handoff' | undefined;
+            excludeResults?: boolean | undefined;
+            promptKey?: string | undefined;
+          }
+        >,
+        'many'
+      >
+    >;
+    end_after_tools: z.ZodOptional<z.ZodBoolean>;
+    hide_sequential_outputs: z.ZodOptional<z.ZodBoolean>;
+    artifacts: z.ZodOptional<z.ZodString>;
+    recursion_limit: z.ZodOptional<z.ZodNumber>;
+    conversation_starters: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+    tool_resources: z.ZodOptional<
+      z.ZodObject<
+        {
+          image_edit: z.ZodOptional<
+            z.ZodObject<
+              {
+                file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+                files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+              },
+              'strip',
+              z.ZodTypeAny,
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              },
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            >
+          >;
+          execute_code: z.ZodOptional<
+            z.ZodObject<
+              {
+                file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+                files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+              },
+              'strip',
+              z.ZodTypeAny,
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              },
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            >
+          >;
+          file_search: z.ZodOptional<
+            z.ZodObject<
+              {
+                file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+                files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+              } & {
+                vector_store_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+              },
+              'strip',
+              z.ZodTypeAny,
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+                vector_store_ids?: string[] | undefined;
+              },
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+                vector_store_ids?: string[] | undefined;
+              }
+            >
+          >;
+          context: z.ZodOptional<
+            z.ZodObject<
+              {
+                file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+                files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+              },
+              'strip',
+              z.ZodTypeAny,
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              },
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            >
+          >;
+          /** @deprecated Use context instead */
+          ocr: z.ZodOptional<
+            z.ZodObject<
+              {
+                file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+                files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+              },
+              'strip',
+              z.ZodTypeAny,
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              },
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            >
+          >;
+        },
+        'strip',
+        z.ZodTypeAny,
+        {
+          ocr?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+          context?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+          execute_code?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+          file_search?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+                vector_store_ids?: string[] | undefined;
+              }
+            | undefined;
+          image_edit?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+        },
+        {
+          ocr?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+          context?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+          execute_code?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+          file_search?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+                vector_store_ids?: string[] | undefined;
+              }
+            | undefined;
+          image_edit?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+        }
+      >
+    >;
+    tool_options: z.ZodOptional<
+      z.ZodRecord<
+        z.ZodString,
+        z.ZodObject<
+          {
+            defer_loading: z.ZodOptional<z.ZodBoolean>;
+            allowed_callers: z.ZodOptional<
+              z.ZodArray<z.ZodEnum<['direct', 'code_execution']>, 'many'>
+            >;
+          },
+          'strip',
+          z.ZodTypeAny,
+          {
+            defer_loading?: boolean | undefined;
+            allowed_callers?: ('direct' | 'code_execution')[] | undefined;
+          },
+          {
+            defer_loading?: boolean | undefined;
+            allowed_callers?: ('direct' | 'code_execution')[] | undefined;
+          }
+        >
+      >
+    >;
+    subagents: z.ZodOptional<
+      z.ZodObject<
+        {
+          enabled: z.ZodOptional<z.ZodBoolean>;
+          allowSelf: z.ZodOptional<z.ZodBoolean>;
+          agent_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+        },
+        'strip',
+        z.ZodTypeAny,
+        {
+          enabled?: boolean | undefined;
+          agent_ids?: string[] | undefined;
+          allowSelf?: boolean | undefined;
+        },
+        {
+          enabled?: boolean | undefined;
+          agent_ids?: string[] | undefined;
+          allowSelf?: boolean | undefined;
+        }
+      >
+    >;
+    support_contact: z.ZodOptional<
+      z.ZodObject<
+        {
+          name: z.ZodOptional<z.ZodString>;
+          email: z.ZodOptional<z.ZodUnion<[z.ZodLiteral<''>, z.ZodString]>>;
+        },
+        'strip',
+        z.ZodTypeAny,
+        {
+          name?: string | undefined;
+          email?: string | undefined;
+        },
+        {
+          name?: string | undefined;
+          email?: string | undefined;
+        }
+      >
+    >;
+    category: z.ZodOptional<z.ZodString>;
+  },
+  'strip'
+> = z.object({
   name: z.string().nullable().optional(),
   description: z.string().nullable().optional(),
   instructions: z.string().nullable().optional(),
@@ -116,14 +704,661 @@ export const agentBaseSchema = z.object({
 });
 
 /** Create schema extends base with required fields for creation */
-export const agentCreateSchema = agentBaseSchema.extend({
+export const agentCreateSchema: z.ZodObject<
+  {
+    name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    instructions: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    avatar: z.ZodOptional<
+      z.ZodNullable<
+        z.ZodObject<
+          {
+            filepath: z.ZodString;
+            source: z.ZodString;
+          },
+          'strip',
+          z.ZodTypeAny,
+          {
+            source: string;
+            filepath: string;
+          },
+          {
+            source: string;
+            filepath: string;
+          }
+        >
+      >
+    >;
+    model_parameters: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    skills: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+    skills_enabled: z.ZodOptional<z.ZodBoolean>;
+    agent_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+    edges: z.ZodOptional<
+      z.ZodArray<
+        z.ZodObject<
+          {
+            from: z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, 'many'>]>;
+            to: z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, 'many'>]>;
+            description: z.ZodEffects<
+              z.ZodOptional<z.ZodString>,
+              string | undefined,
+              string | undefined
+            >;
+            edgeType: z.ZodOptional<z.ZodEnum<['handoff', 'direct']>>;
+            prompt: z.ZodEffects<
+              z.ZodOptional<
+                z.ZodUnion<[z.ZodString, z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>]>
+              >,
+              string | ((...args: unknown[]) => unknown) | undefined,
+              string | ((...args: unknown[]) => unknown) | undefined
+            >;
+            excludeResults: z.ZodOptional<z.ZodBoolean>;
+            promptKey: z.ZodEffects<
+              z.ZodOptional<z.ZodString>,
+              string | undefined,
+              string | undefined
+            >;
+          },
+          'strip',
+          z.ZodTypeAny,
+          {
+            from: string | string[];
+            to: string | string[];
+            description?: string | undefined;
+            prompt?: string | ((...args: unknown[]) => unknown) | undefined;
+            edgeType?: 'direct' | 'handoff' | undefined;
+            excludeResults?: boolean | undefined;
+            promptKey?: string | undefined;
+          },
+          {
+            from: string | string[];
+            to: string | string[];
+            description?: string | undefined;
+            prompt?: string | ((...args: unknown[]) => unknown) | undefined;
+            edgeType?: 'direct' | 'handoff' | undefined;
+            excludeResults?: boolean | undefined;
+            promptKey?: string | undefined;
+          }
+        >,
+        'many'
+      >
+    >;
+    end_after_tools: z.ZodOptional<z.ZodBoolean>;
+    hide_sequential_outputs: z.ZodOptional<z.ZodBoolean>;
+    artifacts: z.ZodOptional<z.ZodString>;
+    recursion_limit: z.ZodOptional<z.ZodNumber>;
+    conversation_starters: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+    tool_resources: z.ZodOptional<
+      z.ZodObject<
+        {
+          image_edit: z.ZodOptional<
+            z.ZodObject<
+              {
+                file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+                files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+              },
+              'strip',
+              z.ZodTypeAny,
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              },
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            >
+          >;
+          execute_code: z.ZodOptional<
+            z.ZodObject<
+              {
+                file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+                files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+              },
+              'strip',
+              z.ZodTypeAny,
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              },
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            >
+          >;
+          file_search: z.ZodOptional<
+            z.ZodObject<
+              {
+                file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+                files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+              } & {
+                vector_store_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+              },
+              'strip',
+              z.ZodTypeAny,
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+                vector_store_ids?: string[] | undefined;
+              },
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+                vector_store_ids?: string[] | undefined;
+              }
+            >
+          >;
+          context: z.ZodOptional<
+            z.ZodObject<
+              {
+                file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+                files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+              },
+              'strip',
+              z.ZodTypeAny,
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              },
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            >
+          >;
+          /** @deprecated Use context instead */
+          ocr: z.ZodOptional<
+            z.ZodObject<
+              {
+                file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+                files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+              },
+              'strip',
+              z.ZodTypeAny,
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              },
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            >
+          >;
+        },
+        'strip',
+        z.ZodTypeAny,
+        {
+          ocr?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+          context?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+          execute_code?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+          file_search?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+                vector_store_ids?: string[] | undefined;
+              }
+            | undefined;
+          image_edit?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+        },
+        {
+          ocr?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+          context?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+          execute_code?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+          file_search?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+                vector_store_ids?: string[] | undefined;
+              }
+            | undefined;
+          image_edit?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+        }
+      >
+    >;
+    tool_options: z.ZodOptional<
+      z.ZodRecord<
+        z.ZodString,
+        z.ZodObject<
+          {
+            defer_loading: z.ZodOptional<z.ZodBoolean>;
+            allowed_callers: z.ZodOptional<
+              z.ZodArray<z.ZodEnum<['direct', 'code_execution']>, 'many'>
+            >;
+          },
+          'strip',
+          z.ZodTypeAny,
+          {
+            defer_loading?: boolean | undefined;
+            allowed_callers?: ('direct' | 'code_execution')[] | undefined;
+          },
+          {
+            defer_loading?: boolean | undefined;
+            allowed_callers?: ('direct' | 'code_execution')[] | undefined;
+          }
+        >
+      >
+    >;
+    subagents: z.ZodOptional<
+      z.ZodObject<
+        {
+          enabled: z.ZodOptional<z.ZodBoolean>;
+          allowSelf: z.ZodOptional<z.ZodBoolean>;
+          agent_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+        },
+        'strip',
+        z.ZodTypeAny,
+        {
+          enabled?: boolean | undefined;
+          agent_ids?: string[] | undefined;
+          allowSelf?: boolean | undefined;
+        },
+        {
+          enabled?: boolean | undefined;
+          agent_ids?: string[] | undefined;
+          allowSelf?: boolean | undefined;
+        }
+      >
+    >;
+    support_contact: z.ZodOptional<
+      z.ZodObject<
+        {
+          name: z.ZodOptional<z.ZodString>;
+          email: z.ZodOptional<z.ZodUnion<[z.ZodLiteral<''>, z.ZodString]>>;
+        },
+        'strip',
+        z.ZodTypeAny,
+        {
+          name?: string | undefined;
+          email?: string | undefined;
+        },
+        {
+          name?: string | undefined;
+          email?: string | undefined;
+        }
+      >
+    >;
+    category: z.ZodOptional<z.ZodString>;
+  } & {
+    provider: z.ZodString;
+    model: z.ZodNullable<z.ZodString>;
+    tools: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>>;
+  },
+  'strip'
+> = agentBaseSchema.extend({
   provider: z.string(),
   model: z.string().nullable(),
   tools: z.array(z.string()).optional().default([]),
 });
 
 /** Update schema extends base with all fields optional and additional update-only fields */
-export const agentUpdateSchema = agentBaseSchema.extend({
+export const agentUpdateSchema: z.ZodObject<
+  {
+    name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    instructions: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    model_parameters: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    tools: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+    skills: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+    skills_enabled: z.ZodOptional<z.ZodBoolean>;
+    agent_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+    edges: z.ZodOptional<
+      z.ZodArray<
+        z.ZodObject<
+          {
+            from: z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, 'many'>]>;
+            to: z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, 'many'>]>;
+            description: z.ZodEffects<
+              z.ZodOptional<z.ZodString>,
+              string | undefined,
+              string | undefined
+            >;
+            edgeType: z.ZodOptional<z.ZodEnum<['handoff', 'direct']>>;
+            prompt: z.ZodEffects<
+              z.ZodOptional<
+                z.ZodUnion<[z.ZodString, z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>]>
+              >,
+              string | ((...args: unknown[]) => unknown) | undefined,
+              string | ((...args: unknown[]) => unknown) | undefined
+            >;
+            excludeResults: z.ZodOptional<z.ZodBoolean>;
+            promptKey: z.ZodEffects<
+              z.ZodOptional<z.ZodString>,
+              string | undefined,
+              string | undefined
+            >;
+          },
+          'strip',
+          z.ZodTypeAny,
+          {
+            from: string | string[];
+            to: string | string[];
+            description?: string | undefined;
+            prompt?: string | ((...args: unknown[]) => unknown) | undefined;
+            edgeType?: 'direct' | 'handoff' | undefined;
+            excludeResults?: boolean | undefined;
+            promptKey?: string | undefined;
+          },
+          {
+            from: string | string[];
+            to: string | string[];
+            description?: string | undefined;
+            prompt?: string | ((...args: unknown[]) => unknown) | undefined;
+            edgeType?: 'direct' | 'handoff' | undefined;
+            excludeResults?: boolean | undefined;
+            promptKey?: string | undefined;
+          }
+        >,
+        'many'
+      >
+    >;
+    end_after_tools: z.ZodOptional<z.ZodBoolean>;
+    hide_sequential_outputs: z.ZodOptional<z.ZodBoolean>;
+    artifacts: z.ZodOptional<z.ZodString>;
+    recursion_limit: z.ZodOptional<z.ZodNumber>;
+    conversation_starters: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+    tool_resources: z.ZodOptional<
+      z.ZodObject<
+        {
+          image_edit: z.ZodOptional<
+            z.ZodObject<
+              {
+                file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+                files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+              },
+              'strip',
+              z.ZodTypeAny,
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              },
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            >
+          >;
+          execute_code: z.ZodOptional<
+            z.ZodObject<
+              {
+                file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+                files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+              },
+              'strip',
+              z.ZodTypeAny,
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              },
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            >
+          >;
+          file_search: z.ZodOptional<
+            z.ZodObject<
+              {
+                file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+                files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+              } & {
+                vector_store_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+              },
+              'strip',
+              z.ZodTypeAny,
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+                vector_store_ids?: string[] | undefined;
+              },
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+                vector_store_ids?: string[] | undefined;
+              }
+            >
+          >;
+          context: z.ZodOptional<
+            z.ZodObject<
+              {
+                file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+                files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+              },
+              'strip',
+              z.ZodTypeAny,
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              },
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            >
+          >;
+          /** @deprecated Use context instead */
+          ocr: z.ZodOptional<
+            z.ZodObject<
+              {
+                file_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+                files: z.ZodOptional<z.ZodArray<z.ZodUnknown, 'many'>>;
+              },
+              'strip',
+              z.ZodTypeAny,
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              },
+              {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            >
+          >;
+        },
+        'strip',
+        z.ZodTypeAny,
+        {
+          ocr?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+          context?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+          execute_code?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+          file_search?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+                vector_store_ids?: string[] | undefined;
+              }
+            | undefined;
+          image_edit?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+        },
+        {
+          ocr?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+          context?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+          execute_code?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+          file_search?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+                vector_store_ids?: string[] | undefined;
+              }
+            | undefined;
+          image_edit?:
+            | {
+                file_ids?: string[] | undefined;
+                files?: unknown[] | undefined;
+              }
+            | undefined;
+        }
+      >
+    >;
+    tool_options: z.ZodOptional<
+      z.ZodRecord<
+        z.ZodString,
+        z.ZodObject<
+          {
+            defer_loading: z.ZodOptional<z.ZodBoolean>;
+            allowed_callers: z.ZodOptional<
+              z.ZodArray<z.ZodEnum<['direct', 'code_execution']>, 'many'>
+            >;
+          },
+          'strip',
+          z.ZodTypeAny,
+          {
+            defer_loading?: boolean | undefined;
+            allowed_callers?: ('direct' | 'code_execution')[] | undefined;
+          },
+          {
+            defer_loading?: boolean | undefined;
+            allowed_callers?: ('direct' | 'code_execution')[] | undefined;
+          }
+        >
+      >
+    >;
+    subagents: z.ZodOptional<
+      z.ZodObject<
+        {
+          enabled: z.ZodOptional<z.ZodBoolean>;
+          allowSelf: z.ZodOptional<z.ZodBoolean>;
+          agent_ids: z.ZodOptional<z.ZodArray<z.ZodString, 'many'>>;
+        },
+        'strip',
+        z.ZodTypeAny,
+        {
+          enabled?: boolean | undefined;
+          agent_ids?: string[] | undefined;
+          allowSelf?: boolean | undefined;
+        },
+        {
+          enabled?: boolean | undefined;
+          agent_ids?: string[] | undefined;
+          allowSelf?: boolean | undefined;
+        }
+      >
+    >;
+    support_contact: z.ZodOptional<
+      z.ZodObject<
+        {
+          name: z.ZodOptional<z.ZodString>;
+          email: z.ZodOptional<z.ZodUnion<[z.ZodLiteral<''>, z.ZodString]>>;
+        },
+        'strip',
+        z.ZodTypeAny,
+        {
+          name?: string | undefined;
+          email?: string | undefined;
+        },
+        {
+          name?: string | undefined;
+          email?: string | undefined;
+        }
+      >
+    >;
+    category: z.ZodOptional<z.ZodString>;
+  } & {
+    avatar: z.ZodOptional<
+      z.ZodUnion<
+        [
+          z.ZodObject<
+            {
+              filepath: z.ZodString;
+              source: z.ZodString;
+            },
+            'strip',
+            z.ZodTypeAny,
+            {
+              source: string;
+              filepath: string;
+            },
+            {
+              source: string;
+              filepath: string;
+            }
+          >,
+          z.ZodNull,
+        ]
+      >
+    >;
+    provider: z.ZodOptional<z.ZodString>;
+    model: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  },
+  'strip'
+> = agentBaseSchema.extend({
   avatar: z.union([agentAvatarSchema, z.null()]).optional(),
   provider: z.string().optional(),
   model: z.string().nullable().optional(),
diff --git a/packages/api/src/apiKeys/handlers.ts b/packages/api/src/apiKeys/handlers.ts
index 61d23ccde9c..1e3b12a7d50 100644
--- a/packages/api/src/apiKeys/handlers.ts
+++ b/packages/api/src/apiKeys/handlers.ts
@@ -1,6 +1,6 @@
+import { logger } from '@librechat/data-schemas';
 import type { Request, Response } from 'express';
 import type { Types } from 'mongoose';
-import { logger } from '@librechat/data-schemas';
 
 export interface ApiKeyHandlerDependencies {
   createAgentApiKey: (params: {
@@ -49,8 +49,16 @@ interface AuthenticatedRequest extends Request {
   };
 }
 
-export function createApiKeyHandlers(deps: ApiKeyHandlerDependencies) {
-  async function createApiKey(req: AuthenticatedRequest, res: Response) {
+export function createApiKeyHandlers(deps: ApiKeyHandlerDependencies): {
+  createApiKey: (req: AuthenticatedRequest, res: Response) => Promise<Response | undefined>;
+  listApiKeys: (req: AuthenticatedRequest, res: Response) => Promise<void>;
+  getApiKey: (req: AuthenticatedRequest, res: Response) => Promise<Response | undefined>;
+  deleteApiKey: (req: AuthenticatedRequest, res: Response) => Promise<Response | undefined>;
+} {
+  async function createApiKey(
+    req: AuthenticatedRequest,
+    res: Response,
+  ): Promise<Response | undefined> {
     try {
       const { name, expiresAt } = req.body;
 
@@ -80,7 +88,7 @@ export function createApiKeyHandlers(deps: ApiKeyHandlerDependencies) {
     }
   }
 
-  async function listApiKeys(req: AuthenticatedRequest, res: Response) {
+  async function listApiKeys(req: AuthenticatedRequest, res: Response): Promise<void> {
     try {
       const keys = await deps.listAgentApiKeys(req.user?.id || '');
       res.status(200).json({ keys });
@@ -90,7 +98,10 @@ export function createApiKeyHandlers(deps: ApiKeyHandlerDependencies) {
     }
   }
 
-  async function getApiKey(req: AuthenticatedRequest, res: Response) {
+  async function getApiKey(
+    req: AuthenticatedRequest,
+    res: Response,
+  ): Promise<Response | undefined> {
     try {
       const key = await deps.getAgentApiKeyById(req.params.id, req.user?.id || '');
 
@@ -105,7 +116,10 @@ export function createApiKeyHandlers(deps: ApiKeyHandlerDependencies) {
     }
   }
 
-  async function deleteApiKey(req: AuthenticatedRequest, res: Response) {
+  async function deleteApiKey(
+    req: AuthenticatedRequest,
+    res: Response,
+  ): Promise<Response | undefined> {
     try {
       const deleted = await deps.deleteAgentApiKey(req.params.id, req.user?.id || '');
 
diff --git a/packages/api/src/apiKeys/middleware.ts b/packages/api/src/apiKeys/middleware.ts
index 2a503536483..626a8dd5dfd 100644
--- a/packages/api/src/apiKeys/middleware.ts
+++ b/packages/api/src/apiKeys/middleware.ts
@@ -36,7 +36,11 @@ export interface RemoteAgentAccessRequest extends ApiKeyAuthRequest {
 }
 
 export function createRequireApiKeyAuth(deps: ApiKeyAuthDependencies) {
-  return async (req: ApiKeyAuthRequest, res: Response, next: NextFunction) => {
+  return async (
+    req: ApiKeyAuthRequest,
+    res: Response,
+    next: NextFunction,
+  ): Promise<Response | undefined> => {
     const authHeader = req.headers.authorization;
 
     if (!authHeader || !authHeader.startsWith('Bearer ')) {
@@ -105,7 +109,11 @@ export function createRequireApiKeyAuth(deps: ApiKeyAuthDependencies) {
 }
 
 export function createCheckRemoteAgentAccess(deps: RemoteAgentAccessDependencies) {
-  return async (req: RemoteAgentAccessRequest, res: Response, next: NextFunction) => {
+  return async (
+    req: RemoteAgentAccessRequest,
+    res: Response,
+    next: NextFunction,
+  ): Promise<Response | undefined> => {
     const agentId = req.body?.model || req.params?.model;
 
     if (!agentId) {
diff --git a/packages/api/src/apiKeys/permissions.spec.ts b/packages/api/src/apiKeys/permissions.spec.ts
index 69441fa800b..bcf6f642f75 100644
--- a/packages/api/src/apiKeys/permissions.spec.ts
+++ b/packages/api/src/apiKeys/permissions.spec.ts
@@ -5,7 +5,7 @@ import {
   PermissionBits,
   AccessRoleIds,
 } from 'librechat-data-provider';
-import { permissionBitSupersets } from '@librechat/data-schemas';
+import { permissionBitSupersets, tenantStorage } from '@librechat/data-schemas';
 import { enrichRemoteAgentPrincipals } from './permissions';
 import type { EnricherDependencies, Principal } from './permissions';
 
@@ -57,8 +57,8 @@ describe('enrichRemoteAgentPrincipals', () => {
 
       await enrichRemoteAgentPrincipals(deps, resourceId, []);
 
-      const pipeline = aggregateAclEntries.mock.calls[0][0];
-      const matchStage = pipeline[0].$match;
+      const pipeline = aggregateAclEntries.mock.calls[0][0] as Record<string, unknown>[];
+      const matchStage = pipeline[0].$match as Record<string, unknown>;
       expect(matchStage.resourceType).toBe(ResourceType.AGENT);
       expect(matchStage.principalType).toBe(PrincipalType.USER);
       expect(matchStage.resourceId).toBeInstanceOf(Types.ObjectId);
@@ -100,6 +100,33 @@ describe('enrichRemoteAgentPrincipals', () => {
       expect(matchStage.resourceId).toBeInstanceOf(Types.ObjectId);
       expect((matchStage.resourceId as Types.ObjectId).toString()).toBe(hexId);
     });
+
+    test('keeps the user lookup in simple localField/foreignField form', async () => {
+      const aggregateAclEntries = jest.fn().mockResolvedValue([]);
+      const deps: EnricherDependencies = {
+        aggregateAclEntries,
+        bulkWriteAclEntries: jest.fn(),
+        findRoleByIdentifier: jest.fn(),
+        logger: { error: jest.fn() },
+      };
+
+      await enrichRemoteAgentPrincipals(deps, resourceId, []);
+
+      const pipeline = aggregateAclEntries.mock.calls[0][0] as Record<string, unknown>[];
+      const lookupStage = pipeline.find((stage) => '$lookup' in stage) as
+        | { $lookup: Record<string, unknown> }
+        | undefined;
+      expect(lookupStage).toMatchObject({
+        $lookup: {
+          from: 'users',
+          localField: 'principalId',
+          foreignField: '_id',
+          as: 'userInfo',
+        },
+      });
+      expect(lookupStage?.$lookup).not.toHaveProperty('let');
+      expect(lookupStage?.$lookup).not.toHaveProperty('pipeline');
+    });
   });
 
   describe('enrichment behavior', () => {
@@ -136,6 +163,25 @@ describe('enrichRemoteAgentPrincipals', () => {
       expect(result.entriesToBackfill).toHaveLength(0);
     });
 
+    test('skips joined userInfo outside the current request context', async () => {
+      const deps = makeDeps([
+        {
+          principalId: ownerUserId,
+          userInfo: makeUserInfo(ownerUserId, {
+            tenantId: 'tenant-b',
+            email: 'outside-user@example.com',
+          }),
+        },
+      ]);
+
+      const result = await tenantStorage.run({ tenantId: 'tenant-a' }, async () =>
+        enrichRemoteAgentPrincipals(deps, resourceId, []),
+      );
+
+      expect(result.principals).toHaveLength(0);
+      expect(result.entriesToBackfill).toHaveLength(0);
+    });
+
     test('does not duplicate a principal already present in the input list', async () => {
       const existing: Principal = {
         type: PrincipalType.USER,
diff --git a/packages/api/src/apiKeys/permissions.ts b/packages/api/src/apiKeys/permissions.ts
index 3d8a05b3b9d..a64a9f4a51b 100644
--- a/packages/api/src/apiKeys/permissions.ts
+++ b/packages/api/src/apiKeys/permissions.ts
@@ -5,7 +5,7 @@ import {
   PermissionBits,
   AccessRoleIds,
 } from 'librechat-data-provider';
-import { permissionBitSupersets } from '@librechat/data-schemas';
+import { SYSTEM_TENANT_ID, getTenantId, permissionBitSupersets } from '@librechat/data-schemas';
 import type { PipelineStage, AnyBulkWriteOperation } from 'mongoose';
 
 export interface Principal {
@@ -37,6 +37,13 @@ export interface EnrichResult {
   entriesToBackfill: Types.ObjectId[];
 }
 
+function matchesCurrentTenant(principal: Record<string, unknown>, tenantId?: string): boolean {
+  if (!tenantId || tenantId === SYSTEM_TENANT_ID) {
+    return true;
+  }
+  return principal.tenantId === tenantId;
+}
+
 /** Enriches REMOTE_AGENT principals with implicit AGENT owners */
 export async function enrichRemoteAgentPrincipals(
   deps: EnricherDependencies,
@@ -47,6 +54,7 @@ export async function enrichRemoteAgentPrincipals(
     typeof resourceId === 'string' && /^[a-f\d]{24}$/i.test(resourceId)
       ? Types.ObjectId.createFromHexString(resourceId)
       : resourceId;
+  const tenantId = getTenantId();
 
   /**
    * Filter `permBits` with `$in: permissionBitSupersets(SHARE)` instead of
@@ -87,6 +95,10 @@ export async function enrichRemoteAgentPrincipals(
     }
 
     const userInfo = entry.userInfo as Record<string, unknown>;
+    if (!matchesCurrentTenant(userInfo, tenantId)) {
+      continue;
+    }
+
     const principalId = entry.principalId as Types.ObjectId;
 
     const alreadyIncluded = enrichedPrincipals.some(
diff --git a/packages/api/src/apiKeys/service.ts b/packages/api/src/apiKeys/service.ts
index 30ae0afb53d..4038e510fb5 100644
--- a/packages/api/src/apiKeys/service.ts
+++ b/packages/api/src/apiKeys/service.ts
@@ -1,6 +1,11 @@
 import { createMethods } from '@librechat/data-schemas';
 import { ResourceType, PermissionBits, hasPermissions } from 'librechat-data-provider';
-import type { AllMethods, IUser } from '@librechat/data-schemas';
+import type {
+  AgentApiKeyListItem,
+  AgentApiKeyCreateResult,
+  AllMethods,
+  IUser,
+} from '@librechat/data-schemas';
 import type { Types } from 'mongoose';
 
 export interface ApiKeyServiceDependencies {
@@ -36,19 +41,25 @@ export class AgentApiKeyService {
     userId: string | Types.ObjectId;
     name: string;
     expiresAt?: Date | null;
-  }) {
+  }): Promise<AgentApiKeyCreateResult> {
     return this.deps.createAgentApiKey(params);
   }
 
-  async listApiKeys(userId: string | Types.ObjectId) {
+  async listApiKeys(userId: string | Types.ObjectId): Promise<AgentApiKeyListItem[]> {
     return this.deps.listAgentApiKeys(userId);
   }
 
-  async deleteApiKey(keyId: string | Types.ObjectId, userId: string | Types.ObjectId) {
+  async deleteApiKey(
+    keyId: string | Types.ObjectId,
+    userId: string | Types.ObjectId,
+  ): Promise<boolean> {
     return this.deps.deleteAgentApiKey(keyId, userId);
   }
 
-  async getApiKeyById(keyId: string | Types.ObjectId, userId: string | Types.ObjectId) {
+  async getApiKeyById(
+    keyId: string | Types.ObjectId,
+    userId: string | Types.ObjectId,
+  ): Promise<AgentApiKeyListItem | null> {
     return this.deps.getAgentApiKeyById(keyId, userId);
   }
 
diff --git a/packages/api/src/app/AppService.spec.ts b/packages/api/src/app/AppService.spec.ts
index 2c07460b849..7c06fcd40f6 100644
--- a/packages/api/src/app/AppService.spec.ts
+++ b/packages/api/src/app/AppService.spec.ts
@@ -9,6 +9,7 @@ import {
   defaultAgentCapabilities,
 } from 'librechat-data-provider';
 import type { TCustomConfig } from 'librechat-data-provider';
+import type { FunctionTool } from '@librechat/data-schemas';
 
 jest.mock('@librechat/data-schemas', () => ({
   ...jest.requireActual('@librechat/data-schemas'),
@@ -60,7 +61,7 @@ const azureGroups = [
 ];
 
 describe('AppService', () => {
-  const mockSystemTools = {
+  const mockSystemTools: Record<string, FunctionTool> = {
     ExampleTool: {
       type: 'function',
       function: {
@@ -598,9 +599,9 @@ describe('AppService', () => {
     );
 
     // Verify that optional fields are not set when not provided
-    expect(result.endpoints[EModelEndpoint.openAI].titlePrompt).toBeUndefined();
-    expect(result.endpoints[EModelEndpoint.openAI].titlePromptTemplate).toBeUndefined();
-    expect(result.endpoints[EModelEndpoint.openAI].titleMethod).toBeUndefined();
+    expect(result.endpoints![EModelEndpoint.openAI]!.titlePrompt).toBeUndefined();
+    expect(result.endpoints![EModelEndpoint.openAI]!.titlePromptTemplate).toBeUndefined();
+    expect(result.endpoints![EModelEndpoint.openAI]!.titleMethod).toBeUndefined();
   });
 
   it('should correctly configure titleEndpoint when specified', async () => {
@@ -859,7 +860,7 @@ describe('AppService updating app config and issuing warnings', () => {
     );
 
     // Verify excludedIds is undefined when not provided
-    expect(result.endpoints.assistants.excludedIds).toBeUndefined();
+    expect(result.endpoints!.assistants!.excludedIds).toBeUndefined();
   });
 
   it('should not parse environment variable references in OCR config', async () => {
diff --git a/packages/api/src/app/checks.ts b/packages/api/src/app/checks.ts
index 50312267acb..019d2a1f567 100644
--- a/packages/api/src/app/checks.ts
+++ b/packages/api/src/app/checks.ts
@@ -30,7 +30,10 @@ const deprecatedVariables = [
   },
 ];
 
-export const deprecatedAzureVariables = [
+export const deprecatedAzureVariables: {
+  key: string;
+  description: string;
+}[] = [
   /* "related to" precedes description text */
   { key: 'AZURE_OPENAI_DEFAULT_MODEL', description: 'setting a default model' },
   { key: 'AZURE_OPENAI_MODELS', description: 'setting models' },
@@ -59,7 +62,9 @@ export const deprecatedAzureVariables = [
   },
 ];
 
-export const conflictingAzureVariables = [
+export const conflictingAzureVariables: {
+  key: string;
+}[] = [
   {
     key: 'INSTANCE_NAME',
   },
@@ -100,7 +105,7 @@ function checkPasswordReset() {
  * @param {Function} options.isEnabled - Function to check if a feature is enabled
  * @param {Function} options.checkEmailConfig - Function to check email configuration
  */
-export function checkVariables() {
+export function checkVariables(): void {
   let hasDefaultSecrets = false;
   for (const [key, value] of Object.entries(secretDefaults)) {
     if (process.env[key] === value) {
@@ -134,7 +139,7 @@ export function checkVariables() {
  * Checks the health of auxiliary API's by attempting a fetch request to their respective `/health` endpoints.
  * Logs information or warning based on the API's availability and response.
  */
-export async function checkHealth() {
+export async function checkHealth(): Promise<void> {
   try {
     const response = await fetch(`${process.env.RAG_API_URL}/health`);
     if (response?.ok && response?.status === 200) {
@@ -169,7 +174,7 @@ function checkAzureVariables() {
   });
 }
 
-export function checkInterfaceConfig(appConfig: AppConfig) {
+export function checkInterfaceConfig(appConfig: AppConfig): void {
   const interfaceConfig = appConfig.interfaceConfig;
   let i = 0;
   const logSettings = () => {
@@ -220,7 +225,7 @@ export function checkInterfaceConfig(appConfig: AppConfig) {
  * This should be called during application startup before initializing services.
  * @param [appConfig] - The application configuration object.
  */
-export async function performStartupChecks(appConfig?: AppConfig) {
+export async function performStartupChecks(appConfig?: AppConfig): Promise<void> {
   checkVariables();
   if (appConfig?.endpoints?.azureOpenAI) {
     checkAzureVariables();
@@ -244,7 +249,7 @@ export async function performStartupChecks(appConfig?: AppConfig) {
  * Performs basic checks on the loaded config object.
  * @param config - The loaded custom configuration.
  */
-export function checkConfig(config: Partial<TCustomConfig>) {
+export function checkConfig(config: Partial<TCustomConfig>): void {
   if (config.version !== Constants.CONFIG_VERSION) {
     logger.info(
       `\nOutdated Config version: ${config.version}
@@ -263,7 +268,9 @@ Latest version: ${Constants.CONFIG_VERSION}
  * Logs debug information for properly configured environment variable references.
  * @param webSearchConfig - The loaded web search configuration object.
  */
-export function checkWebSearchConfig(webSearchConfig?: Partial<TCustomConfig['webSearch']> | null) {
+export function checkWebSearchConfig(
+  webSearchConfig?: Partial<TCustomConfig['webSearch']> | null,
+): void {
   if (!webSearchConfig) {
     return;
   }
diff --git a/packages/api/src/app/limits.ts b/packages/api/src/app/limits.ts
index a38a3c6310a..1f1ad583f52 100644
--- a/packages/api/src/app/limits.ts
+++ b/packages/api/src/app/limits.ts
@@ -5,7 +5,7 @@ import type { TCustomConfig } from 'librechat-data-provider';
  *
  * @param rateLimits
  */
-export const handleRateLimits = (rateLimits?: TCustomConfig['rateLimits']) => {
+export const handleRateLimits = (rateLimits?: TCustomConfig['rateLimits']): void => {
   if (!rateLimits) {
     return;
   }
diff --git a/packages/api/src/app/metrics.spec.ts b/packages/api/src/app/metrics.spec.ts
index 80984dcb8b9..ebb12675047 100644
--- a/packages/api/src/app/metrics.spec.ts
+++ b/packages/api/src/app/metrics.spec.ts
@@ -1,6 +1,7 @@
 /// <reference types="jest" />
-import { EventEmitter } from 'events';
 import express from 'express';
+import request from 'supertest';
+import { EventEmitter } from 'events';
 import type { Request, Response } from 'express';
 import {
   createMetrics,
@@ -10,11 +11,10 @@ import {
   recordGenerationStreamResumePendingEvents,
   recordGenerationStreamSubscription,
   recordOpenIDUserLookup,
+  recordRumProxyRequest,
   setGenerationJobsInFlight,
 } from './metrics';
 
-const request = require('supertest') as (app: express.Express) => any;
-
 describe('normalizePath', () => {
   it.each([
     // Known high-cardinality routes
@@ -272,6 +272,36 @@ describe('createMetrics', () => {
     expect(response.text).toMatch(/openid_user_lookup_duration_seconds_sum\{result="found"\} 0.2/);
   });
 
+  it('tracks RUM proxy request outcomes', async () => {
+    const app = express();
+    process.env.METRICS_SECRET = 'test-secret';
+    const { metricsRouter } = createMetrics();
+    app.use('/metrics', metricsRouter);
+
+    recordRumProxyRequest('traces', 'success');
+    recordRumProxyRequest('traces', 'auth_drop');
+    recordRumProxyRequest('logs', 'auth_error');
+    recordRumProxyRequest('logs', 'collector_5xx');
+
+    const response = await request(app)
+      .get('/metrics')
+      .set('Authorization', 'Bearer test-secret')
+      .expect(200);
+
+    expect(response.text).toMatch(
+      /rum_proxy_requests_total\{endpoint="traces",result="success"\} 1/,
+    );
+    expect(response.text).toMatch(
+      /rum_proxy_requests_total\{endpoint="traces",result="auth_drop"\} 1/,
+    );
+    expect(response.text).toMatch(
+      /rum_proxy_requests_total\{endpoint="logs",result="auth_error"\} 1/,
+    );
+    expect(response.text).toMatch(
+      /rum_proxy_requests_total\{endpoint="logs",result="collector_5xx"\} 1/,
+    );
+  });
+
   it('tracks mongoose query counts and latency by model and operation', async () => {
     class FakeQuery {
       model = { modelName: 'User' };
diff --git a/packages/api/src/app/metrics.ts b/packages/api/src/app/metrics.ts
index 4dd9fddac25..da2ce635d33 100644
--- a/packages/api/src/app/metrics.ts
+++ b/packages/api/src/app/metrics.ts
@@ -1,7 +1,7 @@
-import { timingSafeEqual } from 'crypto';
 import { Router } from 'express';
-import { Registry, collectDefaultMetrics, Counter, Gauge, Histogram } from 'prom-client';
+import { timingSafeEqual } from 'crypto';
 import { logger } from '@librechat/data-schemas';
+import { Registry, collectDefaultMetrics, Counter, Gauge, Histogram } from 'prom-client';
 import type { Request, Response, NextFunction, RequestHandler } from 'express';
 import type { Mongoose } from 'mongoose';
 
@@ -137,6 +137,17 @@ export type GenerationStreamSubscriptionResult =
   | 'error'
   | 'found'
   | 'missing';
+export type RumProxyEndpoint = 'traces' | 'logs' | 'unknown';
+export type RumProxyResult =
+  | 'success'
+  | 'auth_drop'
+  | 'auth_error'
+  | 'bad_request'
+  | 'not_configured'
+  | 'collector_4xx'
+  | 'collector_5xx'
+  | 'collector_error'
+  | 'collector_timeout';
 
 type OpenIDUserLookupMetrics = {
   recordLookup: (result: OpenIDUserLookupResult, durationSeconds: number) => void;
@@ -179,6 +190,14 @@ let generationJobMetrics: GenerationJobMetrics = {
   recordResumePendingEvents: () => undefined,
 };
 
+type RumProxyMetrics = {
+  recordRequest: (endpoint: RumProxyEndpoint, result: RumProxyResult) => void;
+};
+
+let rumProxyMetrics: RumProxyMetrics = {
+  recordRequest: () => undefined,
+};
+
 const resetMetricRecorders = (): void => {
   openIDUserLookupMetrics = {
     recordLookup: () => undefined,
@@ -192,6 +211,9 @@ const resetMetricRecorders = (): void => {
     recordSubscription: () => undefined,
     recordResumePendingEvents: () => undefined,
   };
+  rumProxyMetrics = {
+    recordRequest: () => undefined,
+  };
 };
 
 export function recordGenerationJob(store: GenerationJobStore, result: GenerationJobResult): void {
@@ -217,6 +239,10 @@ export function recordGenerationStreamResumePendingEvents(
   generationJobMetrics.recordResumePendingEvents(store, count);
 }
 
+export function recordRumProxyRequest(endpoint: RumProxyEndpoint, result: RumProxyResult): void {
+  rumProxyMetrics.recordRequest(endpoint, result);
+}
+
 const getElapsedSeconds = (startedAt: bigint): number =>
   Number(process.hrtime.bigint() - startedAt) / 1_000_000_000;
 
@@ -493,6 +519,13 @@ export function createMetrics(): PrometheusMetrics {
     registers: [registry],
   });
 
+  const rumProxyRequests = new Counter({
+    name: 'rum_proxy_requests_total',
+    help: 'RUM proxy requests by endpoint and result',
+    labelNames: ['endpoint', 'result'] as const,
+    registers: [registry],
+  });
+
   generationJobMetrics = {
     recordJob: (store, result) => generationJobs.inc({ store, result }),
     setJobsInFlight: (store, count) => generationJobsInFlight.set({ store }, count),
@@ -502,6 +535,10 @@ export function createMetrics(): PrometheusMetrics {
       generationStreamResumePendingEvents.inc({ store }, count),
   };
 
+  rumProxyMetrics = {
+    recordRequest: (endpoint, result) => rumProxyRequests.inc({ endpoint, result }),
+  };
+
   const metricsMiddleware = (req: Request, res: Response, next: NextFunction): void => {
     const end = httpDuration.startTimer();
     const labels = { method: req.method, path: normalizePath(req.path) };
diff --git a/packages/api/src/app/permissions.spec.ts b/packages/api/src/app/permissions.spec.ts
index 4cbb59dfe2b..b93efe64d3b 100644
--- a/packages/api/src/app/permissions.spec.ts
+++ b/packages/api/src/app/permissions.spec.ts
@@ -113,6 +113,11 @@ describe('updateInterfacePermissions - permissions', () => {
         [Permissions.SHARE]: false,
         [Permissions.SHARE_PUBLIC]: false,
       },
+      [PermissionTypes.SHARED_LINKS]: {
+        [Permissions.CREATE]: true,
+        [Permissions.SHARE]: true,
+        [Permissions.SHARE_PUBLIC]: true,
+      },
     };
 
     const expectedPermissionsForAdmin = {
@@ -167,6 +172,11 @@ describe('updateInterfacePermissions - permissions', () => {
         [Permissions.SHARE]: true,
         [Permissions.SHARE_PUBLIC]: true,
       },
+      [PermissionTypes.SHARED_LINKS]: {
+        [Permissions.CREATE]: true,
+        [Permissions.SHARE]: true,
+        [Permissions.SHARE_PUBLIC]: true,
+      },
     };
 
     expect(mockUpdateAccessPermissions).toHaveBeenCalledTimes(2);
@@ -285,6 +295,11 @@ describe('updateInterfacePermissions - permissions', () => {
         [Permissions.SHARE]: false,
         [Permissions.SHARE_PUBLIC]: false,
       },
+      [PermissionTypes.SHARED_LINKS]: {
+        [Permissions.CREATE]: true,
+        [Permissions.SHARE]: true,
+        [Permissions.SHARE_PUBLIC]: true,
+      },
     };
 
     const expectedPermissionsForAdmin = {
@@ -339,6 +354,11 @@ describe('updateInterfacePermissions - permissions', () => {
         [Permissions.SHARE]: true,
         [Permissions.SHARE_PUBLIC]: true,
       },
+      [PermissionTypes.SHARED_LINKS]: {
+        [Permissions.CREATE]: true,
+        [Permissions.SHARE]: true,
+        [Permissions.SHARE_PUBLIC]: true,
+      },
     };
 
     expect(mockUpdateAccessPermissions).toHaveBeenCalledTimes(2);
@@ -443,6 +463,11 @@ describe('updateInterfacePermissions - permissions', () => {
         [Permissions.SHARE]: false,
         [Permissions.SHARE_PUBLIC]: false,
       },
+      [PermissionTypes.SHARED_LINKS]: {
+        [Permissions.CREATE]: true,
+        [Permissions.SHARE]: true,
+        [Permissions.SHARE_PUBLIC]: true,
+      },
     };
 
     const expectedPermissionsForAdmin = {
@@ -497,6 +522,11 @@ describe('updateInterfacePermissions - permissions', () => {
         [Permissions.SHARE]: true,
         [Permissions.SHARE_PUBLIC]: true,
       },
+      [PermissionTypes.SHARED_LINKS]: {
+        [Permissions.CREATE]: true,
+        [Permissions.SHARE]: true,
+        [Permissions.SHARE_PUBLIC]: true,
+      },
     };
 
     expect(mockUpdateAccessPermissions).toHaveBeenCalledTimes(2);
@@ -614,6 +644,11 @@ describe('updateInterfacePermissions - permissions', () => {
         [Permissions.SHARE]: false,
         [Permissions.SHARE_PUBLIC]: false,
       },
+      [PermissionTypes.SHARED_LINKS]: {
+        [Permissions.CREATE]: true,
+        [Permissions.SHARE]: true,
+        [Permissions.SHARE_PUBLIC]: true,
+      },
     };
 
     const expectedPermissionsForAdmin = {
@@ -668,6 +703,11 @@ describe('updateInterfacePermissions - permissions', () => {
         [Permissions.SHARE]: true,
         [Permissions.SHARE_PUBLIC]: true,
       },
+      [PermissionTypes.SHARED_LINKS]: {
+        [Permissions.CREATE]: true,
+        [Permissions.SHARE]: true,
+        [Permissions.SHARE_PUBLIC]: true,
+      },
     };
 
     expect(mockUpdateAccessPermissions).toHaveBeenCalledTimes(2);
@@ -772,6 +812,11 @@ describe('updateInterfacePermissions - permissions', () => {
         [Permissions.SHARE]: false,
         [Permissions.SHARE_PUBLIC]: false,
       },
+      [PermissionTypes.SHARED_LINKS]: {
+        [Permissions.CREATE]: true,
+        [Permissions.SHARE]: true,
+        [Permissions.SHARE_PUBLIC]: true,
+      },
     };
 
     const expectedPermissionsForAdmin = {
@@ -826,6 +871,11 @@ describe('updateInterfacePermissions - permissions', () => {
         [Permissions.SHARE]: true,
         [Permissions.SHARE_PUBLIC]: true,
       },
+      [PermissionTypes.SHARED_LINKS]: {
+        [Permissions.CREATE]: true,
+        [Permissions.SHARE]: true,
+        [Permissions.SHARE_PUBLIC]: true,
+      },
     };
 
     expect(mockUpdateAccessPermissions).toHaveBeenCalledTimes(2);
@@ -935,6 +985,11 @@ describe('updateInterfacePermissions - permissions', () => {
         [Permissions.SHARE]: false,
         [Permissions.SHARE_PUBLIC]: false,
       },
+      [PermissionTypes.SHARED_LINKS]: {
+        [Permissions.CREATE]: true,
+        [Permissions.SHARE]: true,
+        [Permissions.SHARE_PUBLIC]: true,
+      },
     };
 
     const expectedPermissionsForAdmin = {
@@ -977,6 +1032,11 @@ describe('updateInterfacePermissions - permissions', () => {
         [Permissions.SHARE]: true,
         [Permissions.SHARE_PUBLIC]: true,
       },
+      [PermissionTypes.SHARED_LINKS]: {
+        [Permissions.CREATE]: true,
+        [Permissions.SHARE]: true,
+        [Permissions.SHARE_PUBLIC]: true,
+      },
     };
 
     expect(mockUpdateAccessPermissions).toHaveBeenCalledTimes(2);
@@ -1103,6 +1163,11 @@ describe('updateInterfacePermissions - permissions', () => {
         [Permissions.SHARE]: false,
         [Permissions.SHARE_PUBLIC]: false,
       },
+      [PermissionTypes.SHARED_LINKS]: {
+        [Permissions.CREATE]: true,
+        [Permissions.SHARE]: true,
+        [Permissions.SHARE_PUBLIC]: true,
+      },
     };
 
     const expectedPermissionsForAdmin = {
@@ -1149,6 +1214,11 @@ describe('updateInterfacePermissions - permissions', () => {
         [Permissions.SHARE]: true,
         [Permissions.SHARE_PUBLIC]: true,
       },
+      [PermissionTypes.SHARED_LINKS]: {
+        [Permissions.CREATE]: true,
+        [Permissions.SHARE]: true,
+        [Permissions.SHARE_PUBLIC]: true,
+      },
     };
 
     expect(mockUpdateAccessPermissions).toHaveBeenCalledTimes(2);
@@ -2698,4 +2768,78 @@ describe('updateInterfacePermissions - permissions', () => {
 
     expect(userCall[1][PermissionTypes.MCP_SERVERS][Permissions.CREATE]).toBe(true);
   });
+
+  it('should disable all SHARED_LINKS permissions when sharedLinks: false (boolean)', async () => {
+    mockGetRoleByName.mockResolvedValue({
+      permissions: {
+        [PermissionTypes.SHARED_LINKS]: {
+          [Permissions.CREATE]: true,
+          [Permissions.SHARE]: true,
+          [Permissions.SHARE_PUBLIC]: true,
+        },
+      },
+    });
+
+    const config = {
+      interface: {
+        sharedLinks: false,
+      },
+    };
+    const configDefaults = { interface: {} } as TConfigDefaults;
+    const interfaceConfig = await loadDefaultInterface({ config, configDefaults });
+    const appConfig = { config, interfaceConfig } as unknown as AppConfig;
+
+    await updateInterfacePermissions({
+      appConfig,
+      getRoleByName: mockGetRoleByName,
+      updateAccessPermissions: mockUpdateAccessPermissions,
+    });
+
+    const userCall = mockUpdateAccessPermissions.mock.calls.find(
+      (call) => call[0] === SystemRoles.USER,
+    );
+
+    expect(userCall[1][PermissionTypes.SHARED_LINKS]).toEqual({
+      [Permissions.CREATE]: false,
+      [Permissions.SHARE]: false,
+      [Permissions.SHARE_PUBLIC]: false,
+    });
+  });
+
+  it('should enable all SHARED_LINKS permissions when sharedLinks: true (boolean)', async () => {
+    mockGetRoleByName.mockResolvedValue({
+      permissions: {
+        [PermissionTypes.SHARED_LINKS]: {
+          [Permissions.CREATE]: false,
+          [Permissions.SHARE]: false,
+          [Permissions.SHARE_PUBLIC]: false,
+        },
+      },
+    });
+
+    const config = {
+      interface: {
+        sharedLinks: true,
+      },
+    };
+    const configDefaults = { interface: {} } as TConfigDefaults;
+    const interfaceConfig = await loadDefaultInterface({ config, configDefaults });
+    const appConfig = { config, interfaceConfig } as unknown as AppConfig;
+
+    await updateInterfacePermissions({
+      appConfig,
+      getRoleByName: mockGetRoleByName,
+      updateAccessPermissions: mockUpdateAccessPermissions,
+    });
+
+    const userCall = mockUpdateAccessPermissions.mock.calls.find(
+      (call) => call[0] === SystemRoles.USER,
+    );
+
+    expect(userCall[1][PermissionTypes.SHARED_LINKS]).toEqual({
+      [Permissions.CREATE]: true,
+      [Permissions.SHARE]: true,
+      [Permissions.SHARE_PUBLIC]: true,
+    });
+  });
 });
diff --git a/packages/api/src/app/permissions.ts b/packages/api/src/app/permissions.ts
index c72863d95e4..dcc626143ce 100644
--- a/packages/api/src/app/permissions.ts
+++ b/packages/api/src/app/permissions.ts
@@ -47,6 +47,8 @@ function hasExplicitConfig(
       return interfaceConfig?.remoteAgents !== undefined;
     case PermissionTypes.SKILLS:
       return interfaceConfig?.skills !== undefined;
+    case PermissionTypes.SHARED_LINKS:
+      return interfaceConfig?.sharedLinks !== undefined;
     default:
       return false;
   }
@@ -197,6 +199,12 @@ export async function updateInterfacePermissions({
       typeof defaults.agents === 'object' ? defaults.agents?.public : undefined;
     const skillsDefaultPublic =
       typeof defaults.skills === 'object' ? defaults.skills?.public : undefined;
+    const sharedLinksDefaultCreate =
+      typeof defaults.sharedLinks === 'boolean' ? undefined : defaults.sharedLinks?.create;
+    const sharedLinksDefaultShare =
+      typeof defaults.sharedLinks === 'object' ? defaults.sharedLinks?.share : undefined;
+    const sharedLinksDefaultPublic =
+      typeof defaults.sharedLinks === 'object' ? defaults.sharedLinks?.public : undefined;
 
     const allPermissions: Partial<Record<PermissionTypes, Record<string, boolean | undefined>>> = {
       [PermissionTypes.PROMPTS]: {
@@ -483,6 +491,43 @@ export async function updateInterfacePermissions({
             }
           : {}),
       },
+      [PermissionTypes.SHARED_LINKS]: {
+        ...(typeof interfaceConfig?.sharedLinks === 'boolean' ||
+        (typeof interfaceConfig?.sharedLinks === 'object' &&
+          'create' in interfaceConfig.sharedLinks) ||
+        !existingPermissions?.[PermissionTypes.SHARED_LINKS]
+          ? {
+              [Permissions.CREATE]: getPermissionValue(
+                typeof loadedInterface.sharedLinks === 'boolean'
+                  ? loadedInterface.sharedLinks
+                  : getConfigCreate(loadedInterface.sharedLinks),
+                defaultPerms[PermissionTypes.SHARED_LINKS]?.[Permissions.CREATE],
+                sharedLinksDefaultCreate ?? true,
+              ),
+            }
+          : {}),
+        ...(typeof interfaceConfig?.sharedLinks === 'boolean' ||
+        (typeof interfaceConfig?.sharedLinks === 'object' &&
+          ('share' in interfaceConfig.sharedLinks || 'public' in interfaceConfig.sharedLinks)) ||
+        !existingPermissions?.[PermissionTypes.SHARED_LINKS]
+          ? {
+              [Permissions.SHARE]: getPermissionValue(
+                typeof loadedInterface.sharedLinks === 'boolean'
+                  ? loadedInterface.sharedLinks
+                  : getConfigShare(loadedInterface.sharedLinks),
+                defaultPerms[PermissionTypes.SHARED_LINKS]?.[Permissions.SHARE],
+                sharedLinksDefaultShare,
+              ),
+              [Permissions.SHARE_PUBLIC]: getPermissionValue(
+                typeof loadedInterface.sharedLinks === 'boolean'
+                  ? loadedInterface.sharedLinks
+                  : getConfigPublic(loadedInterface.sharedLinks),
+                defaultPerms[PermissionTypes.SHARED_LINKS]?.[Permissions.SHARE_PUBLIC],
+                sharedLinksDefaultPublic,
+              ),
+            }
+          : {}),
+      },
     };
 
     // Check and add each permission type if needed
@@ -577,6 +622,21 @@ export async function updateInterfacePermissions({
           ),
         },
       ],
+      [
+        PermissionTypes.SHARED_LINKS,
+        {
+          [Permissions.SHARE]: getPermissionValue(
+            getConfigShare(loadedInterface.sharedLinks),
+            defaultPerms[PermissionTypes.SHARED_LINKS]?.[Permissions.SHARE],
+            sharedLinksDefaultShare,
+          ),
+          [Permissions.SHARE_PUBLIC]: getPermissionValue(
+            getConfigPublic(loadedInterface.sharedLinks),
+            defaultPerms[PermissionTypes.SHARED_LINKS]?.[Permissions.SHARE_PUBLIC],
+            sharedLinksDefaultPublic,
+          ),
+        },
+      ],
     ];
 
     for (const [permType, shareDefaults] of shareBackfill) {
diff --git a/packages/api/src/app/service.ts b/packages/api/src/app/service.ts
index 658056503fc..87556f25673 100644
--- a/packages/api/src/app/service.ts
+++ b/packages/api/src/app/service.ts
@@ -5,8 +5,8 @@ import {
   mergeConfigOverrides,
   BASE_CONFIG_PRINCIPAL_ID,
 } from '@librechat/data-schemas';
-import type { Types } from 'mongoose';
 import type { AppConfig, IConfig } from '@librechat/data-schemas';
+import type { Types } from 'mongoose';
 
 const BASE_CONFIG_KEY = '_BASE_';
 
@@ -91,7 +91,11 @@ function overrideCacheKey(role?: string, userId?: string, tenantId?: string): st
 
 // ── Service factory ──────────────────────────────────────────────────
 
-export function createAppConfigService(deps: AppConfigServiceDeps) {
+export function createAppConfigService(deps: AppConfigServiceDeps): {
+  getAppConfig: (options?: GetAppConfigOptions) => Promise<AppConfig>;
+  clearAppConfigCache: () => Promise<void>;
+  clearOverrideCache: (tenantId?: string) => Promise<void>;
+} {
   const {
     loadBaseConfig,
     setCachedTools,
diff --git a/packages/api/src/auth/exchange.ts b/packages/api/src/auth/exchange.ts
index 74d882bb099..53db548f68a 100644
--- a/packages/api/src/auth/exchange.ts
+++ b/packages/api/src/auth/exchange.ts
@@ -178,9 +178,9 @@ export async function exchangeAdminCode(
 }
 
 /** PKCE challenge cache TTL: 5 minutes (enough for user to authenticate with IdP) */
-export const PKCE_CHALLENGE_TTL = 5 * 60 * 1000;
+export const PKCE_CHALLENGE_TTL: number = 5 * 60 * 1000;
 /** Regex pattern for valid PKCE challenges: 64 hex characters (SHA-256 hex digest) */
-export const PKCE_CHALLENGE_PATTERN = /^[a-f0-9]{64}$/;
+export const PKCE_CHALLENGE_PATTERN: RegExp = /^[a-f0-9]{64}$/;
 
 const ADMIN_OAUTH_STRIPPED_QUERY_PARAMS = new Set(['code_challenge', 'redirect_uri', 'redirectTo']);
 
diff --git a/packages/api/src/auth/index.ts b/packages/api/src/auth/index.ts
index a2cbe4fc2f4..f51f5c40813 100644
--- a/packages/api/src/auth/index.ts
+++ b/packages/api/src/auth/index.ts
@@ -1,5 +1,6 @@
 export * from './domain';
 export * from './openid';
+export * from './proxy';
 export * from './exchange';
 export * from './refresh';
 export * from './agent';
diff --git a/packages/api/src/auth/proxy.ts b/packages/api/src/auth/proxy.ts
new file mode 100644
index 00000000000..4fb33c5fd02
--- /dev/null
+++ b/packages/api/src/auth/proxy.ts
@@ -0,0 +1 @@
+export { getOpenIdProxyDispatcher } from '~/utils/proxy';
diff --git a/packages/api/src/cache/__tests__/cacheFactory/limiterCache.cache_integration.spec.ts b/packages/api/src/cache/__tests__/cacheFactory/limiterCache.cache_integration.spec.ts
index 52cfee1f078..9ccc830a7bd 100644
--- a/packages/api/src/cache/__tests__/cacheFactory/limiterCache.cache_integration.spec.ts
+++ b/packages/api/src/cache/__tests__/cacheFactory/limiterCache.cache_integration.spec.ts
@@ -1,4 +1,5 @@
 import type { RedisStore } from 'rate-limit-redis';
+import { closeRedisClients } from '../redisClients.helper';
 
 describe('limiterCache', () => {
   let originalEnv: NodeJS.ProcessEnv;
@@ -20,6 +21,7 @@ describe('limiterCache', () => {
   });
 
   afterEach(async () => {
+    await closeRedisClients();
     process.env = originalEnv;
     jest.resetModules();
   });
diff --git a/packages/api/src/cache/__tests__/cacheFactory/sessionCache.cache_integration.spec.ts b/packages/api/src/cache/__tests__/cacheFactory/sessionCache.cache_integration.spec.ts
index 99c0d69b375..a16556f75d4 100644
--- a/packages/api/src/cache/__tests__/cacheFactory/sessionCache.cache_integration.spec.ts
+++ b/packages/api/src/cache/__tests__/cacheFactory/sessionCache.cache_integration.spec.ts
@@ -1,5 +1,6 @@
 import type { MemoryStore, SessionData } from 'express-session';
 import type { RedisStore as ConnectRedis } from 'connect-redis';
+import { closeRedisClients } from '../redisClients.helper';
 
 interface TestSessionData {
   [key: string]: unknown;
@@ -49,6 +50,7 @@ describe('sessionCache', () => {
   });
 
   afterEach(async () => {
+    await closeRedisClients();
     process.env = originalEnv;
     jest.resetModules();
   });
diff --git a/packages/api/src/cache/__tests__/cacheFactory/standardCache.cache_integration.spec.ts b/packages/api/src/cache/__tests__/cacheFactory/standardCache.cache_integration.spec.ts
index 563b52341a3..325bcd3e0fc 100644
--- a/packages/api/src/cache/__tests__/cacheFactory/standardCache.cache_integration.spec.ts
+++ b/packages/api/src/cache/__tests__/cacheFactory/standardCache.cache_integration.spec.ts
@@ -1,4 +1,5 @@
 import type { Keyv } from 'keyv';
+import { closeRedisClients } from '../redisClients.helper';
 
 // Mock GLOBAL_PREFIX_SEPARATOR from cacheConfig
 jest.mock('../../cacheConfig', () => {
@@ -79,6 +80,7 @@ describe('standardCache', () => {
       testCache = null;
     }
 
+    await closeRedisClients();
     process.env = originalEnv;
     jest.resetModules();
   });
diff --git a/packages/api/src/cache/__tests__/cacheFactory/violationCache.cache_integration.spec.ts b/packages/api/src/cache/__tests__/cacheFactory/violationCache.cache_integration.spec.ts
index 1978620c247..03254eb0b51 100644
--- a/packages/api/src/cache/__tests__/cacheFactory/violationCache.cache_integration.spec.ts
+++ b/packages/api/src/cache/__tests__/cacheFactory/violationCache.cache_integration.spec.ts
@@ -1,3 +1,5 @@
+import { closeRedisClients } from '../redisClients.helper';
+
 interface ViolationData {
   count?: number;
   timestamp?: number;
@@ -57,6 +59,7 @@ describe('violationCache', () => {
   });
 
   afterEach(async () => {
+    await closeRedisClients();
     process.env = originalEnv;
     jest.resetModules();
   });
diff --git a/packages/api/src/cache/__tests__/redisClients.cache_integration.spec.ts b/packages/api/src/cache/__tests__/redisClients.cache_integration.spec.ts
index 77e8c01436a..b3f1288117b 100644
--- a/packages/api/src/cache/__tests__/redisClients.cache_integration.spec.ts
+++ b/packages/api/src/cache/__tests__/redisClients.cache_integration.spec.ts
@@ -1,5 +1,7 @@
-import type { Redis, Cluster } from 'ioredis';
+/* eslint jest/expect-expect: ["warn", { "assertFunctionNames": ["expect", "testRedisOperations"] }] */
 import type { RedisClientType, RedisClusterType } from '@redis/client';
+import type { Redis, Cluster } from 'ioredis';
+import { closeRedisClients } from './redisClients.helper';
 
 type RedisClient = RedisClientType | RedisClusterType | Redis | Cluster;
 
@@ -64,27 +66,10 @@ describe('redisClients Integration Tests', () => {
       }
     }
 
-    // Cleanup Redis connections
-    if (ioredisClient) {
-      try {
-        if (ioredisClient.status === 'ready') {
-          ioredisClient.disconnect();
-        }
-      } catch (error) {
-        console.warn('Error disconnecting ioredis client:', (error as Error).message);
-      }
-      ioredisClient = null;
-    }
-
-    if (keyvRedisClient) {
-      try {
-        // Try to disconnect - keyv/redis client doesn't have an isReady property
-        await keyvRedisClient.disconnect();
-      } catch (error) {
-        console.warn('Error disconnecting keyv redis client:', (error as Error).message);
-      }
-      keyvRedisClient = null;
-    }
+    // Close BOTH clients created by the module import, not just the one the test exercised
+    await closeRedisClients();
+    ioredisClient = null;
+    keyvRedisClient = null;
 
     process.env = originalEnv;
     jest.resetModules();
diff --git a/packages/api/src/cache/__tests__/redisClients.helper.ts b/packages/api/src/cache/__tests__/redisClients.helper.ts
new file mode 100644
index 00000000000..d9bca706cc2
--- /dev/null
+++ b/packages/api/src/cache/__tests__/redisClients.helper.ts
@@ -0,0 +1,25 @@
+export type RedisClientsModule = typeof import('~/cache/redisClients');
+
+/**
+ * Closes the Redis clients owned by a `redisClients` module instance so the jest process can
+ * exit once the suite finishes. Importing `redisClients` constructs and connects both
+ * `ioredisClient` and `keyvRedisClient` as module side effects, so every instance created
+ * through `jest.resetModules()` + re-import must be closed or its sockets and timers keep the
+ * (in-band) test process alive after all tests pass.
+ *
+ * Pass the captured module object when `jest.resetModules()` already dropped the instance from
+ * the registry (e.g. closing a `beforeAll` instance from `afterAll`); otherwise the current
+ * registry instance is used.
+ */
+export async function closeRedisClients(clients?: RedisClientsModule): Promise<void> {
+  const { ioredisClient, keyvRedisClient, keyvRedisClientReady } =
+    clients ?? (await import('~/cache/redisClients'));
+
+  if (keyvRedisClientReady) {
+    await keyvRedisClientReady.catch(() => undefined);
+  }
+  if (keyvRedisClient?.isOpen) {
+    await keyvRedisClient.disconnect().catch(() => undefined);
+  }
+  ioredisClient?.disconnect();
+}
diff --git a/packages/api/src/cache/__tests__/redisUtils.cache_integration.spec.ts b/packages/api/src/cache/__tests__/redisUtils.cache_integration.spec.ts
index 659723c0c18..34e28a91e4c 100644
--- a/packages/api/src/cache/__tests__/redisUtils.cache_integration.spec.ts
+++ b/packages/api/src/cache/__tests__/redisUtils.cache_integration.spec.ts
@@ -1,4 +1,5 @@
 import { batchDeleteKeys, scanKeys } from '../redisUtils';
+import { closeRedisClients } from './redisClients.helper';
 
 describe('redisUtils Integration Tests', () => {
   let keyvRedisClient: Awaited<typeof import('../redisClients')>['keyvRedisClient'];
@@ -44,8 +45,8 @@ describe('redisUtils Integration Tests', () => {
   });
 
   afterAll(async () => {
-    // Close Redis connection
-    if (keyvRedisClient?.isOpen) await keyvRedisClient.disconnect();
+    // Close both Redis clients created by the module import
+    await closeRedisClients();
   });
 
   describe('batchDeleteKeys', () => {
diff --git a/packages/api/src/cache/cacheConfig.ts b/packages/api/src/cache/cacheConfig.ts
index cbccffbf591..21fe1e7d034 100644
--- a/packages/api/src/cache/cacheConfig.ts
+++ b/packages/api/src/cache/cacheConfig.ts
@@ -70,7 +70,77 @@ const getRedisCA = (): string | null => {
   }
 };
 
-const cacheConfig = {
+const cacheConfig: {
+  FORCED_IN_MEMORY_CACHE_NAMESPACES: string[];
+  USE_REDIS: boolean;
+  USE_REDIS_STREAMS: boolean;
+  REDIS_URI: string | undefined;
+  REDIS_USERNAME: string | undefined;
+  REDIS_PASSWORD: string | undefined;
+  REDIS_CA: string | null;
+  REDIS_KEY_PREFIX: string;
+  GLOBAL_PREFIX_SEPARATOR: string;
+  REDIS_MAX_LISTENERS: number;
+  REDIS_PING_INTERVAL: number;
+  /** Max delay between reconnection attempts in ms */
+  REDIS_RETRY_MAX_DELAY: number;
+  /** Max number of reconnection attempts (0 = infinite) */
+  REDIS_RETRY_MAX_ATTEMPTS: number;
+  /** Connection timeout in ms */
+  REDIS_CONNECT_TIMEOUT: number;
+  /** Queue commands when disconnected */
+  REDIS_ENABLE_OFFLINE_QUEUE: boolean;
+  /** flag to modify redis connection by adding dnsLookup this is required when connecting to elasticache for ioredis
+   * see "Special Note: Aws Elasticache Clusters with TLS" on this webpage:  https://www.npmjs.com/package/ioredis **/
+  REDIS_USE_ALTERNATIVE_DNS_LOOKUP: boolean;
+  /** Enable redis cluster without the need of multiple URIs */
+  USE_REDIS_CLUSTER: boolean;
+  /**
+   * Force cluster-safe (key-by-key) deletion even when connecting as a single-node Redis instance.
+   * Needed for managed services like ElastiCache Serverless that present a single endpoint
+   * but shard keys internally, causing CROSSSLOT errors on multi-key DEL commands.
+   * Has no effect when USE_REDIS_CLUSTER is already true.
+   */
+  REDIS_CLUSTER_SAFE_DELETE: boolean;
+  CI: boolean;
+  DEBUG_MEMORY_CACHE: boolean;
+  BAN_DURATION: number; // 2 hours
+  /**
+   * Number of keys to delete in each batch during Redis DEL operations.
+   * In cluster mode, keys are deleted individually in parallel chunks to avoid CROSSSLOT errors.
+   * In single-node mode, keys are deleted in batches using DEL with arrays.
+   * Lower values reduce memory usage but increase number of Redis calls.
+   * @default 1000
+   */
+  REDIS_DELETE_CHUNK_SIZE: number;
+  /**
+   * Number of keys to update in each batch during Redis SET operations.
+   * In cluster mode, keys are updated individually in parallel chunks to avoid CROSSSLOT errors.
+   * In single-node mode, keys are updated in batches using transactions (multi/exec).
+   * Lower values reduce memory usage but increase number of Redis calls.
+   * @default 1000
+   */
+  REDIS_UPDATE_CHUNK_SIZE: number;
+  /**
+   * COUNT hint for Redis SCAN operations when scanning keys by pattern.
+   * This is a hint to Redis about how many keys to scan in each iteration.
+   * Higher values can reduce round trips but increase memory usage and latency per call.
+   * Note: Redis may return more or fewer keys than this count depending on internal heuristics.
+   * @default 1000
+   */
+  REDIS_SCAN_COUNT: number;
+  /**
+   * TTL in milliseconds for MCP registry caches. Used by both:
+   * - `MCPServersRegistry` read-through caches (`readThroughCache`/`readThroughCacheAll`)
+   * - `ServerConfigsCacheRedisAggregateKey` local snapshot (avoids redundant Redis GETs)
+   *
+   * Both layers use this value, so the effective max cross-instance staleness is up
+   * to 2× this value in multi-instance deployments. Set to 0 to disable the local
+   * snapshot entirely (every `getAll()` hits Redis directly).
+   * @default 5000 (5 seconds)
+   */
+  MCP_REGISTRY_CACHE_TTL: number;
+} = {
   FORCED_IN_MEMORY_CACHE_NAMESPACES,
   USE_REDIS,
   USE_REDIS_STREAMS,
diff --git a/packages/api/src/cache/keyvFiles.ts b/packages/api/src/cache/keyvFiles.ts
index 94fe9b7cabe..5652df63146 100644
--- a/packages/api/src/cache/keyvFiles.ts
+++ b/packages/api/src/cache/keyvFiles.ts
@@ -1,6 +1,6 @@
 import { KeyvFile } from 'keyv-file';
 
-export const logFile = new KeyvFile({ filename: './data/logs.json' }).setMaxListeners(20);
-export const violationFile = new KeyvFile({ filename: './data/violations.json' }).setMaxListeners(
-  20,
-);
+export const logFile: KeyvFile = new KeyvFile({ filename: './data/logs.json' }).setMaxListeners(20);
+export const violationFile: KeyvFile = new KeyvFile({
+  filename: './data/violations.json',
+}).setMaxListeners(20);
diff --git a/packages/api/src/cache/keyvMongo.ts b/packages/api/src/cache/keyvMongo.ts
index 4c0a08bf639..d020cdedc4c 100644
--- a/packages/api/src/cache/keyvMongo.ts
+++ b/packages/api/src/cache/keyvMongo.ts
@@ -271,7 +271,7 @@ class KeyvMongoCustom extends EventEmitter {
   }
 }
 
-const keyvMongo = new KeyvMongoCustom({
+const keyvMongo: KeyvMongoCustom = new KeyvMongoCustom({
   collection: 'logs',
 });
 
diff --git a/packages/api/src/cache/redisClients.ts b/packages/api/src/cache/redisClients.ts
index fca4365f7f7..eef63689f53 100644
--- a/packages/api/src/cache/redisClients.ts
+++ b/packages/api/src/cache/redisClients.ts
@@ -1,9 +1,9 @@
 import IoRedis from 'ioredis';
-import type { Redis, Cluster } from 'ioredis';
 import { logger } from '@librechat/data-schemas';
 import { createClient, createCluster } from '@keyv/redis';
-import type { RedisClientType, RedisClusterType } from '@redis/client';
 import type { ScanCommandOptions } from '@redis/client/dist/lib/commands/SCAN';
+import type { RedisClientType, RedisClusterType } from '@redis/client';
+import type { Redis, Cluster } from 'ioredis';
 import { cacheConfig } from './cacheConfig';
 
 const urls = cacheConfig.REDIS_URI?.split(',').map((uri) => new URL(uri)) || [];
@@ -217,7 +217,6 @@ if (cacheConfig.USE_REDIS) {
 
   keyvRedisClientReady.catch((err): void => {
     logger.error('@keyv/redis initial connection failed:', err);
-    throw err;
   });
 }
 
diff --git a/packages/api/src/cdn/azure.ts b/packages/api/src/cdn/azure.ts
index 247530286ca..1a0f96e0e48 100644
--- a/packages/api/src/cdn/azure.ts
+++ b/packages/api/src/cdn/azure.ts
@@ -47,7 +47,7 @@ export const initializeAzureBlobService = async (): Promise<BlobServiceClient |
  * @returns The Azure ContainerClient.
  */
 export const getAzureContainerClient = async (
-  containerName = process.env.AZURE_CONTAINER_NAME || 'files',
+  containerName: string = process.env.AZURE_CONTAINER_NAME || 'files',
 ): Promise<ContainerClient | null> => {
   const serviceClient = await initializeAzureBlobService();
   return serviceClient ? serviceClient.getContainerClient(containerName) : null;
diff --git a/packages/api/src/cdn/cloudfront-cookies.ts b/packages/api/src/cdn/cloudfront-cookies.ts
index f6c62d0390b..eaa4e706b18 100644
--- a/packages/api/src/cdn/cloudfront-cookies.ts
+++ b/packages/api/src/cdn/cloudfront-cookies.ts
@@ -1,12 +1,10 @@
-import { getSignedCookies } from '@aws-sdk/cloudfront-signer';
 import { logger } from '@librechat/data-schemas';
-
+import { getSignedCookies } from '@aws-sdk/cloudfront-signer';
 import type { NextFunction, Response } from 'express';
-
 import { INLINE_AVATAR_PATH_PREFIX, INLINE_IMAGE_PATH_PREFIX } from '~/storage/constants';
 import { assertPathSegment } from '~/storage/validation';
-import { s3Config } from '~/storage/s3/s3Config';
 import { getCloudFrontConfig } from './cloudfront';
+import { s3Config } from '~/storage/s3/s3Config';
 
 const DEFAULT_COOKIE_EXPIRY = 1800;
 
@@ -147,11 +145,17 @@ function getConfiguredCookieExpiry(): number {
   return config?.cookieExpiry ?? DEFAULT_COOKIE_EXPIRY;
 }
 
-export function getCloudFrontCookieRefreshWindowSec(cookieExpiry = getConfiguredCookieExpiry()) {
+export function getCloudFrontCookieRefreshWindowSec(
+  cookieExpiry: number = getConfiguredCookieExpiry(),
+): number {
   return Math.min(300, Math.floor(cookieExpiry / 4));
 }
 
-export function getCloudFrontCookieTiming() {
+export function getCloudFrontCookieTiming(): {
+  expiresInSec: number;
+  refreshAfterSec: number;
+  refreshWindowSec: number;
+} {
   const expiresInSec = getConfiguredCookieExpiry();
   const refreshWindowSec = getCloudFrontCookieRefreshWindowSec(expiresInSec);
   return {
diff --git a/packages/api/src/cdn/firebase.ts b/packages/api/src/cdn/firebase.ts
index 30fca65b1b5..066f295c5da 100644
--- a/packages/api/src/cdn/firebase.ts
+++ b/packages/api/src/cdn/firebase.ts
@@ -7,7 +7,7 @@ import type { FirebaseApp } from 'firebase/app';
 let firebaseInitCount = 0;
 let firebaseApp: FirebaseApp | null = null;
 
-export const initializeFirebase = () => {
+export const initializeFirebase = (): firebase.FirebaseApp | null => {
   if (firebaseApp) {
     return firebaseApp;
   }
diff --git a/packages/api/src/cluster/LeaderElection.ts b/packages/api/src/cluster/LeaderElection.ts
index 726c56b1858..e40a95cde8b 100644
--- a/packages/api/src/cluster/LeaderElection.ts
+++ b/packages/api/src/cluster/LeaderElection.ts
@@ -1,7 +1,7 @@
-import { keyvRedisClient } from '~/cache/redisClients';
+import { logger } from '@librechat/data-schemas';
 import { cacheConfig as cache } from '~/cache/cacheConfig';
+import { keyvRedisClient } from '~/cache/redisClients';
 import { clusterConfig as cluster } from './config';
-import { logger } from '@librechat/data-schemas';
 
 /**
  * Distributed leader election implementation using Redis for coordination across multiple server instances.
@@ -21,7 +21,7 @@ import { logger } from '@librechat/data-schemas';
  */
 export class LeaderElection {
   // We can't use Keyv namespace here because we need direct Redis access for atomic operations
-  static readonly LEADER_KEY = `${cache.REDIS_KEY_PREFIX}${cache.GLOBAL_PREFIX_SEPARATOR}LeadingServerUUID`;
+  static readonly LEADER_KEY: string = `${cache.REDIS_KEY_PREFIX}${cache.GLOBAL_PREFIX_SEPARATOR}LeadingServerUUID`;
   private static _instance = new LeaderElection();
 
   readonly UUID: string = crypto.randomUUID();
diff --git a/packages/api/src/cluster/config.ts b/packages/api/src/cluster/config.ts
index d4a99b32170..44a0aa56f91 100644
--- a/packages/api/src/cluster/config.ts
+++ b/packages/api/src/cluster/config.ts
@@ -1,6 +1,15 @@
 import { math } from '~/utils';
 
-const clusterConfig = {
+const clusterConfig: {
+  /** Duration in seconds that the leader lease is valid before it expires */
+  LEADER_LEASE_DURATION: number;
+  /** Interval in seconds at which the leader renews its lease */
+  LEADER_RENEW_INTERVAL: number;
+  /** Maximum number of retry attempts when renewing the lease fails */
+  LEADER_RENEW_ATTEMPTS: number;
+  /** Delay in seconds between retry attempts when renewing the lease */
+  LEADER_RENEW_RETRY_DELAY: number;
+} = {
   /** Duration in seconds that the leader lease is valid before it expires */
   LEADER_LEASE_DURATION: math(process.env.LEADER_LEASE_DURATION, 25),
   /** Interval in seconds at which the leader renews its lease */
diff --git a/packages/api/src/db/utils.ts b/packages/api/src/db/utils.ts
index b53478d0455..aa7b802c91e 100644
--- a/packages/api/src/db/utils.ts
+++ b/packages/api/src/db/utils.ts
@@ -42,6 +42,7 @@ export async function ensureRequiredCollectionsExist(db: mongo.Db): Promise<void
     'agents', // Agents collection
     'promptgroups', // Prompt groups collection
     'projects', // Projects collection
+    'chatprojects', // Private chat organization projects
   ];
 
   logger.debug('Ensuring required collections exist for permission system');
diff --git a/packages/api/src/endpoints/anthropic/helpers.ts b/packages/api/src/endpoints/anthropic/helpers.ts
index 612d947a22b..33431b30e1d 100644
--- a/packages/api/src/endpoints/anthropic/helpers.ts
+++ b/packages/api/src/endpoints/anthropic/helpers.ts
@@ -5,6 +5,7 @@ import {
   ThinkingDisplay,
   AnthropicEffort,
   anthropicSettings,
+  isMythosClassModel,
   resolveThinkingDisplay,
   supportsAdaptiveThinking,
 } from 'librechat-data-provider';
@@ -49,7 +50,8 @@ function checkPromptCacheSupport(modelName: string): boolean {
     /claude-3-(?:sonnet|haiku|opus)?/.test(modelMatch) ||
     /claude-(?:sonnet|opus|haiku)-[4-9]/.test(modelMatch) ||
     /claude-[4-9]-(?:sonnet|opus|haiku)?/.test(modelMatch) ||
-    /claude-4(?:-(?:sonnet|opus|haiku))?/.test(modelMatch)
+    /claude-4(?:-(?:sonnet|opus|haiku))?/.test(modelMatch) ||
+    isMythosClassModel(modelMatch)
   );
 }
 
diff --git a/packages/api/src/endpoints/anthropic/initialize.spec.ts b/packages/api/src/endpoints/anthropic/initialize.spec.ts
new file mode 100644
index 00000000000..32e4e0d940b
--- /dev/null
+++ b/packages/api/src/endpoints/anthropic/initialize.spec.ts
@@ -0,0 +1,109 @@
+import { EModelEndpoint } from 'librechat-data-provider';
+import type { AnthropicClientOptions } from '@librechat/agents';
+import type { BaseInitializeParams, ServerRequest } from '~/types';
+import { FINE_GRAINED_TOOL_STREAMING_BETA } from './helpers';
+import { initializeAnthropic } from './initialize';
+
+const getDefaultHeaders = (llmConfig: unknown): Record<string, string> =>
+  ((llmConfig as AnthropicClientOptions).clientOptions?.defaultHeaders ?? {}) as Record<
+    string,
+    string
+  >;
+
+function createParams(
+  endpointsConfig: Record<string, unknown>,
+  env: Record<string, string | undefined> = {},
+): { params: BaseInitializeParams; restore: () => void } {
+  const savedEnv: Record<string, string | undefined> = {};
+  for (const key of Object.keys(env)) {
+    savedEnv[key] = process.env[key];
+  }
+  Object.assign(process.env, env);
+
+  const params: BaseInitializeParams = {
+    req: {
+      user: { id: 'user-42' },
+      body: { conversationId: 'convo-xyz' },
+      config: { endpoints: endpointsConfig },
+    } as unknown as ServerRequest,
+    endpoint: EModelEndpoint.anthropic,
+    model_parameters: { model: 'claude-sonnet-4-5' },
+    db: {
+      getUserKey: jest.fn(),
+      getUserKeyValues: jest.fn(),
+    },
+  };
+
+  const restore = () => {
+    for (const key of Object.keys(env)) {
+      if (savedEnv[key] === undefined) {
+        delete process.env[key];
+      } else {
+        process.env[key] = savedEnv[key];
+      }
+    }
+  };
+
+  return { params, restore };
+}
+
+describe('initializeAnthropic – custom headers', () => {
+  it('threads configured headers into clientOptions.defaultHeaders without resolving placeholders', async () => {
+    const { params, restore } = createParams(
+      {
+        [EModelEndpoint.anthropic]: {
+          headers: { 'X-Conversation-Id': '{{LIBRECHAT_BODY_CONVERSATIONID}}' },
+        },
+      },
+      { ANTHROPIC_API_KEY: 'sk-ant-test', ANTHROPIC_REVERSE_PROXY: 'https://gateway.example.com' },
+    );
+
+    try {
+      const result = await initializeAnthropic(params);
+      const defaultHeaders = getDefaultHeaders(result.llmConfig);
+      /** Placeholder kept intact — resolved at request time, not init time */
+      expect(defaultHeaders['X-Conversation-Id']).toBe('{{LIBRECHAT_BODY_CONVERSATIONID}}');
+      /** Provider-managed beta header preserved alongside the custom header */
+      expect(defaultHeaders['anthropic-beta']).toBe(FINE_GRAINED_TOOL_STREAMING_BETA);
+      /** Reverse proxy still wired through native Anthropic config */
+      expect(result.llmConfig).toHaveProperty('anthropicApiUrl', 'https://gateway.example.com');
+    } finally {
+      restore();
+    }
+  });
+
+  it('merges endpoints.all headers beneath endpoint-specific headers', async () => {
+    const { params, restore } = createParams(
+      {
+        all: { headers: { 'X-Common': 'all', 'X-Override': 'all' } },
+        [EModelEndpoint.anthropic]: { headers: { 'X-Override': 'anthropic' } },
+      },
+      { ANTHROPIC_API_KEY: 'sk-ant-test' },
+    );
+
+    try {
+      const result = await initializeAnthropic(params);
+      const defaultHeaders = getDefaultHeaders(result.llmConfig);
+      expect(defaultHeaders['X-Common']).toBe('all');
+      expect(defaultHeaders['X-Override']).toBe('anthropic');
+    } finally {
+      restore();
+    }
+  });
+
+  it('leaves defaultHeaders provider-managed when no custom headers are configured', async () => {
+    const { params, restore } = createParams(
+      { [EModelEndpoint.anthropic]: {} },
+      { ANTHROPIC_API_KEY: 'sk-ant-test' },
+    );
+
+    try {
+      const result = await initializeAnthropic(params);
+      expect(getDefaultHeaders(result.llmConfig)).toEqual({
+        'anthropic-beta': FINE_GRAINED_TOOL_STREAMING_BETA,
+      });
+    } finally {
+      restore();
+    }
+  });
+});
diff --git a/packages/api/src/endpoints/anthropic/initialize.ts b/packages/api/src/endpoints/anthropic/initialize.ts
index 8bebd8467b9..94a86294a22 100644
--- a/packages/api/src/endpoints/anthropic/initialize.ts
+++ b/packages/api/src/endpoints/anthropic/initialize.ts
@@ -1,7 +1,7 @@
 import { EModelEndpoint, AuthKeys } from 'librechat-data-provider';
 import type { BaseInitializeParams, InitializeResultBase, AnthropicConfigOptions } from '~/types';
-import { checkUserKeyExpiry, isEnabled } from '~/utils';
 import { loadAnthropicVertexCredentials, getVertexCredentialOptions } from './vertex';
+import { checkUserKeyExpiry, isEnabled, mergeHeaders } from '~/utils';
 import { getLLMConfig } from './llm';
 
 /**
@@ -64,6 +64,11 @@ export async function initializeAnthropic({
     credentials[AuthKeys.ANTHROPIC_API_KEY] = anthropicApiKey;
   }
 
+  const anthropicConfig = appConfig?.endpoints?.[EModelEndpoint.anthropic];
+  const allConfig = appConfig?.endpoints?.all;
+
+  const headers = mergeHeaders(allConfig?.headers, anthropicConfig?.headers);
+
   const clientOptions: AnthropicConfigOptions = {
     proxy: PROXY ?? undefined,
     reverseProxyUrl: ANTHROPIC_REVERSE_PROXY ?? undefined,
@@ -71,15 +76,13 @@ export async function initializeAnthropic({
       ...(model_parameters ?? {}),
       user: req.user?.id,
     },
+    ...(headers && { headers }),
     // Pass Vertex AI options if configured
     ...(vertexOptions && { vertexOptions }),
     // Pass full Vertex AI config including model mappings
     ...(vertexConfig && { vertexConfig }),
   };
 
-  const anthropicConfig = appConfig?.endpoints?.[EModelEndpoint.anthropic];
-  const allConfig = appConfig?.endpoints?.all;
-
   const result = getLLMConfig(credentials, clientOptions);
 
   if (anthropicConfig?.streamRate) {
diff --git a/packages/api/src/endpoints/anthropic/llm.spec.ts b/packages/api/src/endpoints/anthropic/llm.spec.ts
index 41fc898cff7..c48e6419718 100644
--- a/packages/api/src/endpoints/anthropic/llm.spec.ts
+++ b/packages/api/src/endpoints/anthropic/llm.spec.ts
@@ -1082,6 +1082,42 @@ describe('getLLMConfig', () => {
         expect(result.llmConfig).not.toHaveProperty('topK');
       });
 
+      it('should set adaptive thinking with summarized display for Fable 5', () => {
+        const result = getLLMConfig('test-key', {
+          modelOptions: { model: 'claude-fable-5', thinking: true },
+        });
+
+        const thinking = result.llmConfig.thinking as unknown as {
+          type: string;
+          display?: string;
+        };
+        expect(thinking.type).toBe('adaptive');
+        expect(thinking.display).toBe('summarized');
+      });
+
+      it('should default Fable 5 max output tokens to 128K', () => {
+        const result = getLLMConfig('test-key', {
+          modelOptions: { model: 'claude-fable-5', thinking: true },
+        });
+        expect(result.llmConfig.maxTokens).toBe(128000);
+      });
+
+      it('should omit sampling parameters for Fable 5', () => {
+        const result = getLLMConfig('test-key', {
+          modelOptions: {
+            model: 'claude-fable-5',
+            thinking: true,
+            temperature: 0.7,
+            topP: 0.9,
+            topK: 40,
+          },
+        });
+
+        expect(result.llmConfig).not.toHaveProperty('temperature');
+        expect(result.llmConfig).not.toHaveProperty('topP');
+        expect(result.llmConfig).not.toHaveProperty('topK');
+      });
+
       it('should NOT set thinking.display for pre-Opus-4.7 adaptive models', () => {
         const pre47Models = ['claude-opus-4-6', 'claude-sonnet-4-6'];
 
@@ -1825,4 +1861,55 @@ describe('getLLMConfig', () => {
       });
     });
   });
+
+  describe('custom headers', () => {
+    it('attaches admin-configured headers while preserving native Anthropic formatting', () => {
+      const result = getLLMConfig('test-key', {
+        modelOptions: { model: 'claude-sonnet-4-5' },
+        reverseProxyUrl: 'https://gateway.example.com',
+        headers: {
+          'cf-aig-metadata': '{"user_email":"{{LIBRECHAT_USER_EMAIL}}","app":"librechat"}',
+        },
+      });
+
+      const clientOptions = result.llmConfig.clientOptions;
+      /** Provider-managed beta header is preserved */
+      expect((clientOptions?.defaultHeaders as Record<string, string>)['anthropic-beta']).toBe(
+        FINE_GRAINED_TOOL_STREAMING_BETA,
+      );
+      /** Custom header is attached, placeholders kept intact for request-time resolution */
+      expect((clientOptions?.defaultHeaders as Record<string, string>)['cf-aig-metadata']).toBe(
+        '{"user_email":"{{LIBRECHAT_USER_EMAIL}}","app":"librechat"}',
+      );
+      /** Native request shaping is untouched */
+      expect(result.llmConfig).toHaveProperty('model', 'claude-sonnet-4-5');
+      expect(result.llmConfig).toHaveProperty('stream', true);
+      expect(result.llmConfig.invocationKwargs?.metadata).toEqual({ user_id: undefined });
+      expect(result.llmConfig).toHaveProperty('anthropicApiUrl', 'https://gateway.example.com');
+    });
+
+    it('does not let custom headers override the provider-managed anthropic-beta header', () => {
+      const result = getLLMConfig('test-key', {
+        modelOptions: { model: 'claude-3-5-sonnet' },
+        headers: { 'anthropic-beta': 'custom-beta' },
+      });
+
+      const beta = (result.llmConfig.clientOptions?.defaultHeaders as Record<string, string>)[
+        'anthropic-beta'
+      ];
+      /** Custom beta is unioned with managed betas rather than clobbering them */
+      expect(beta).toContain(FINE_GRAINED_TOOL_STREAMING_BETA);
+      expect(beta).toContain('custom-beta');
+    });
+
+    it('does not attach custom headers when clientOptions are dropped', () => {
+      const result = getLLMConfig('test-key', {
+        modelOptions: { model: 'claude-3-opus' },
+        dropParams: ['clientOptions'],
+        headers: { 'cf-aig-metadata': 'x' },
+      });
+
+      expect(result.llmConfig).not.toHaveProperty('clientOptions');
+    });
+  });
 });
diff --git a/packages/api/src/endpoints/anthropic/llm.ts b/packages/api/src/endpoints/anthropic/llm.ts
index 134fbcbd408..9b1063c49b2 100644
--- a/packages/api/src/endpoints/anthropic/llm.ts
+++ b/packages/api/src/endpoints/anthropic/llm.ts
@@ -1,4 +1,3 @@
-import { Dispatcher, ProxyAgent } from 'undici';
 import { logger } from '@librechat/data-schemas';
 import { AnthropicClientOptions } from '@librechat/agents';
 import {
@@ -8,6 +7,7 @@ import {
   ThinkingDisplay,
   AuthKeys,
 } from 'librechat-data-provider';
+import type { Dispatcher } from 'undici';
 import type {
   AnthropicLLMConfigResult,
   AnthropicConfigOptions,
@@ -26,6 +26,8 @@ import {
   isAnthropicVertexCredentials,
   getVertexDeploymentName,
 } from './vertex';
+import { getProxyDispatcher } from '~/utils/proxy';
+import { mergeHeaders } from '~/utils/headers';
 
 const WEB_SEARCH_BETA = 'web-search-2025-03-05';
 
@@ -52,7 +54,7 @@ function parseCredentials(
 }
 
 /** Known Anthropic parameters that map directly to the client config */
-export const knownAnthropicParams = new Set([
+export const knownAnthropicParams: Set<string> = new Set([
   'model',
   'temperature',
   'topP',
@@ -227,10 +229,10 @@ function getLLMConfig(
     requestOptions.clientOptions.defaultHeaders = headers;
   }
 
-  if (options.proxy && requestOptions.clientOptions) {
-    const proxyAgent = new ProxyAgent(options.proxy);
+  const proxyDispatcher = getProxyDispatcher(options.proxy);
+  if (proxyDispatcher && requestOptions.clientOptions) {
     requestOptions.clientOptions.fetchOptions = {
-      dispatcher: proxyAgent,
+      dispatcher: proxyDispatcher,
     };
   }
 
@@ -333,6 +335,21 @@ function getLLMConfig(
     );
   }
 
+  /**
+   * Attach admin-configured custom headers (e.g. AI-gateway metadata) beneath
+   * the provider-managed headers above, so beta/protocol headers always win.
+   * Placeholders are kept intact here and resolved at request time.
+   */
+  if (options.headers && Object.keys(options.headers).length > 0 && !shouldDropClientOptions) {
+    if (!requestOptions.clientOptions) {
+      requestOptions.clientOptions = {};
+    }
+    requestOptions.clientOptions.defaultHeaders = mergeHeaders(
+      options.headers,
+      requestOptions.clientOptions.defaultHeaders as Record<string, string> | undefined,
+    );
+  }
+
   return {
     tools,
     llmConfig: removeNullishValues(
diff --git a/packages/api/src/endpoints/bedrock/initialize.spec.ts b/packages/api/src/endpoints/bedrock/initialize.spec.ts
index 009776fd204..a07fd9195a3 100644
--- a/packages/api/src/endpoints/bedrock/initialize.spec.ts
+++ b/packages/api/src/endpoints/bedrock/initialize.spec.ts
@@ -1,12 +1,12 @@
+import { fromNodeProviderChain } from '@aws-sdk/credential-providers';
 import {
   AuthType,
   EModelEndpoint,
   BEDROCK_OUTPUT_128K_BETA,
   BEDROCK_FINE_GRAINED_TOOL_STREAMING_BETA,
 } from 'librechat-data-provider';
-import { fromNodeProviderChain } from '@aws-sdk/credential-providers';
-import { initializeBedrock } from './initialize';
 import type { BaseInitializeParams, BedrockLLMConfigResult } from '~/types';
+import { initializeBedrock } from './initialize';
 import { checkUserKeyExpiry } from '~/utils';
 
 jest.mock('https-proxy-agent', () => ({
@@ -80,6 +80,13 @@ describe('initializeBedrock', () => {
     delete process.env.BEDROCK_AWS_SESSION_TOKEN;
     delete process.env.BEDROCK_REVERSE_PROXY;
     delete process.env.PROXY;
+    delete process.env.proxy;
+    delete process.env.HTTP_PROXY;
+    delete process.env.HTTPS_PROXY;
+    delete process.env.NO_PROXY;
+    delete process.env.http_proxy;
+    delete process.env.https_proxy;
+    delete process.env.no_proxy;
     process.env.BEDROCK_AWS_ACCESS_KEY_ID = 'test-access-key';
     process.env.BEDROCK_AWS_SECRET_ACCESS_KEY = 'test-secret-key';
     process.env.BEDROCK_AWS_DEFAULT_REGION = 'us-east-1';
@@ -397,6 +404,17 @@ describe('initializeBedrock', () => {
       );
     });
 
+    it('should honor NO_PROXY for reverse proxy endpoints when PROXY is set', async () => {
+      process.env.PROXY = 'http://proxy:8080';
+      process.env.NO_PROXY = 'custom-bedrock-endpoint.com';
+      process.env.BEDROCK_REVERSE_PROXY = 'custom-bedrock-endpoint.com';
+      const params = createMockParams();
+      const result = (await initializeBedrock(params)) as BedrockLLMConfigResult;
+
+      expect(result.llmConfig).not.toHaveProperty('client');
+      expect(result.llmConfig).toHaveProperty('endpointHost', 'custom-bedrock-endpoint.com');
+    });
+
     it('should use AWS profile provider when PROXY is set and static credentials are unset', async () => {
       delete process.env.BEDROCK_AWS_ACCESS_KEY_ID;
       delete process.env.BEDROCK_AWS_SECRET_ACCESS_KEY;
diff --git a/packages/api/src/endpoints/bedrock/initialize.ts b/packages/api/src/endpoints/bedrock/initialize.ts
index c3e987f6c80..09307dfba06 100644
--- a/packages/api/src/endpoints/bedrock/initialize.ts
+++ b/packages/api/src/endpoints/bedrock/initialize.ts
@@ -1,8 +1,6 @@
-import { HttpsProxyAgent } from 'https-proxy-agent';
 import { NodeHttpHandler } from '@smithy/node-http-handler';
 import { fromNodeProviderChain } from '@aws-sdk/credential-providers';
 import { BedrockRuntimeClient } from '@aws-sdk/client-bedrock-runtime';
-import type { BedrockRuntimeClientConfig } from '@aws-sdk/client-bedrock-runtime';
 import {
   AuthType,
   EModelEndpoint,
@@ -11,6 +9,7 @@ import {
   bedrockOutputParser,
   removeNullishValues,
 } from 'librechat-data-provider';
+import type { BedrockRuntimeClientConfig } from '@aws-sdk/client-bedrock-runtime';
 import type {
   BaseInitializeParams,
   InitializeResultBase,
@@ -18,6 +17,7 @@ import type {
   GuardrailConfiguration,
   InferenceProfileConfig,
 } from '~/types';
+import { getHttpsProxyAgent } from '~/utils/proxy';
 import { checkUserKeyExpiry } from '~/utils';
 
 const BEDROCK_CREDENTIALS_ERROR = 'Bedrock credentials not provided. Please provide them again.';
@@ -28,6 +28,16 @@ type ParsedBedrockUserCredentials = Partial<Record<UserCredentialKey, UserCreden
   apiKey?: string;
 };
 
+function getBedrockProxyTarget(region?: string, reverseProxy?: string): string | undefined {
+  const trimmedReverseProxy = reverseProxy?.trim();
+  if (trimmedReverseProxy) return `https://${trimmedReverseProxy}`;
+
+  const trimmedRegion = region?.trim();
+  if (!trimmedRegion) return undefined;
+
+  return `https://bedrock-runtime.${trimmedRegion}.amazonaws.com`;
+}
+
 function isParsedBedrockUserCredentials(value: unknown): value is ParsedBedrockUserCredentials {
   return value != null && typeof value === 'object' && !Array.isArray(value);
 }
@@ -77,8 +87,8 @@ function getUserCredentialValue(
  * HTTP/HTTPS proxies and reverse proxies.
  *
  * Proxy Support:
- * - When the PROXY environment variable is set, creates a custom BedrockRuntimeClient
- *   with an HttpsProxyAgent to route all Bedrock API calls through the specified proxy
+ * - When proxy env vars are set, creates a custom BedrockRuntimeClient
+ *   with an HttpsProxyAgent to route Bedrock API calls through the resolved proxy
  * - The custom client is fully configured with credentials, region, and endpoint,
  *   and is passed directly to ChatBedrockConverse via the 'client' parameter
  *
@@ -117,7 +127,6 @@ export async function initializeBedrock({
     BEDROCK_AWS_BEARER_TOKEN,
     BEDROCK_REVERSE_PROXY,
     BEDROCK_AWS_DEFAULT_REGION,
-    PROXY,
   } = process.env;
 
   const { key: expiresAt } = req.body;
@@ -255,8 +264,11 @@ export async function initializeBedrock({
     credentials.secretAccessKey !== '';
   const hasBearerToken = typeof bearerToken === 'string' && bearerToken !== '';
 
-  if (PROXY || hasBearerToken) {
-    const proxyAgent = PROXY ? new HttpsProxyAgent(PROXY) : undefined;
+  const bedrockRegion = typeof llmConfig.region === 'string' ? llmConfig.region : undefined;
+  const proxyAgent = getHttpsProxyAgent(
+    getBedrockProxyTarget(bedrockRegion, BEDROCK_REVERSE_PROXY),
+  );
+  if (proxyAgent || hasBearerToken) {
     const credentialProvider =
       !hasCompleteCredentials && !hasBearerToken && BEDROCK_AWS_PROFILE
         ? fromNodeProviderChain({ profile: BEDROCK_AWS_PROFILE })
diff --git a/packages/api/src/endpoints/config/endpoints.ts b/packages/api/src/endpoints/config/endpoints.ts
index 4bdd999a132..32ec6769a54 100644
--- a/packages/api/src/endpoints/config/endpoints.ts
+++ b/packages/api/src/endpoints/config/endpoints.ts
@@ -5,8 +5,8 @@ import {
   orderEndpointsConfig,
   defaultAgentCapabilities,
 } from 'librechat-data-provider';
-import type { AppConfig } from '@librechat/data-schemas';
 import type { AgentCapabilities, TEndpointsConfig, TConfig } from 'librechat-data-provider';
+import type { AppConfig } from '@librechat/data-schemas';
 import type { ServerRequest, TCustomEndpointsConfig } from '~/types';
 import { loadCustomEndpointsConfig as defaultLoadCustomEndpoints } from '~/endpoints/custom';
 
@@ -24,7 +24,10 @@ export interface EndpointsConfigDeps {
   loadCustomEndpointsConfig?: (custom: unknown) => TCustomEndpointsConfig | undefined;
 }
 
-export function createEndpointsConfigService(deps: EndpointsConfigDeps) {
+export function createEndpointsConfigService(deps: EndpointsConfigDeps): {
+  getEndpointsConfig: (req: ServerRequest) => Promise<TEndpointsConfig>;
+  checkCapability: (req: ServerRequest, capability: AgentCapabilities) => Promise<boolean>;
+} {
   const {
     getAppConfig,
     loadDefaultEndpointsConfig,
diff --git a/packages/api/src/endpoints/config/models.spec.ts b/packages/api/src/endpoints/config/models.spec.ts
new file mode 100644
index 00000000000..6a3fce8aece
--- /dev/null
+++ b/packages/api/src/endpoints/config/models.spec.ts
@@ -0,0 +1,226 @@
+import { AuthType, EModelEndpoint } from 'librechat-data-provider';
+import type { ServerRequest } from '~/types';
+import { SCOPED_TOKEN_CONFIG_KEY_PREFIX } from '../keys';
+import { createLoadConfigModels } from './models';
+
+jest.mock('~/utils', () => {
+  const original = jest.requireActual('~/utils');
+  return {
+    ...original,
+    // Inline literal — jest.mock() factory may not reference imports.
+    isUserProvided: (val: string) => val === 'user_provided',
+  };
+});
+
+describe('createLoadConfigModels – user-provided baseURL header guard', () => {
+  const fetchModels = jest.fn().mockResolvedValue([]);
+
+  const buildAppConfig = (endpointOverrides: Record<string, unknown>) => ({
+    endpoints: {
+      [EModelEndpoint.custom]: [
+        {
+          name: 'TestProxy',
+          baseURL: AuthType.USER_PROVIDED,
+          apiKey: AuthType.USER_PROVIDED,
+          models: { fetch: true },
+          ...endpointOverrides,
+        },
+      ],
+    },
+  });
+
+  beforeEach(() => {
+    fetchModels.mockReset().mockResolvedValue([]);
+  });
+
+  it('does NOT forward configured headers when baseURL is user-provided', async () => {
+    const headers = {
+      Authorization: 'Bearer {{LIBRECHAT_OPENID_ID_TOKEN}}',
+      'X-User-Email': '{{LIBRECHAT_USER_EMAIL}}',
+    };
+
+    const loadConfigModels = createLoadConfigModels({
+      getAppConfig: jest.fn().mockResolvedValue(buildAppConfig({ headers })),
+      getUserKeyValues: jest.fn().mockResolvedValue({
+        apiKey: 'sk-user-key',
+        baseURL: 'https://user-controlled.example.com/v1',
+      }),
+      fetchModels,
+    });
+
+    const req = {
+      user: { id: 'user-1', email: 'user@example.com' },
+      config: undefined,
+    } as unknown as ServerRequest;
+
+    await loadConfigModels(req);
+
+    expect(fetchModels).toHaveBeenCalledTimes(1);
+    expect(fetchModels).toHaveBeenCalledWith(
+      expect.objectContaining({
+        name: 'TestProxy',
+        baseURL: 'https://user-controlled.example.com/v1',
+        headers: undefined,
+      }),
+    );
+  });
+
+  it('DOES forward configured headers when baseURL is admin-trusted (only apiKey is user-provided)', async () => {
+    const headers = {
+      Authorization: 'Bearer {{LIBRECHAT_OPENID_ID_TOKEN}}',
+    };
+
+    const loadConfigModels = createLoadConfigModels({
+      getAppConfig: jest.fn().mockResolvedValue({
+        endpoints: {
+          [EModelEndpoint.custom]: [
+            {
+              name: 'TrustedProxy',
+              baseURL: 'https://admin-trusted.example.com/v1',
+              apiKey: AuthType.USER_PROVIDED,
+              models: { fetch: true },
+              headers,
+            },
+          ],
+        },
+      }),
+      getUserKeyValues: jest.fn().mockResolvedValue({
+        apiKey: 'sk-user-key',
+        baseURL: undefined,
+      }),
+      fetchModels,
+    });
+
+    const req = {
+      user: { id: 'user-1' },
+      config: undefined,
+    } as unknown as ServerRequest;
+
+    await loadConfigModels(req);
+
+    expect(fetchModels).toHaveBeenCalledTimes(1);
+    expect(fetchModels).toHaveBeenCalledWith(
+      expect.objectContaining({
+        name: 'TrustedProxy',
+        baseURL: 'https://admin-trusted.example.com/v1',
+        headers,
+      }),
+    );
+  });
+
+  it('tenant-scopes the fetched token config cache key for system-defined endpoints', async () => {
+    const loadConfigModels = createLoadConfigModels({
+      getAppConfig: jest.fn().mockResolvedValue(
+        buildAppConfig({
+          baseURL: 'https://admin-trusted.example.com/v1',
+          apiKey: 'sk-system-key',
+        }),
+      ),
+      getUserKeyValues: jest.fn(),
+      fetchModels,
+    });
+
+    const req = {
+      user: { id: 'user-1', tenantId: 'tenant-a' },
+      config: undefined,
+    } as unknown as ServerRequest;
+
+    await loadConfigModels(req);
+
+    expect(fetchModels).toHaveBeenCalledTimes(1);
+    const tokenKey = fetchModels.mock.calls[0][0].tokenKey;
+    expect(fetchModels.mock.calls[0][0].name).toBe('TestProxy');
+    expect(tokenKey.startsWith(SCOPED_TOKEN_CONFIG_KEY_PREFIX)).toBe(true);
+    expect(tokenKey).not.toBe('tenant:tenant-a:TestProxy');
+    expect(tokenKey).not.toContain('tenant-a');
+    expect(tokenKey).not.toContain('TestProxy');
+  });
+});
+
+describe('createLoadConfigModels – in-request fetch coalescing', () => {
+  const fetchModels = jest.fn().mockResolvedValue([]);
+
+  beforeEach(() => {
+    fetchModels.mockReset().mockResolvedValue([]);
+  });
+
+  it('does NOT coalesce two endpoints with the same baseURL+apiKey but different headers', async () => {
+    const loadConfigModels = createLoadConfigModels({
+      getAppConfig: jest.fn().mockResolvedValue({
+        endpoints: {
+          [EModelEndpoint.custom]: [
+            {
+              name: 'TenantA',
+              baseURL: 'https://shared-proxy.example.com/v1',
+              apiKey: 'sk-shared',
+              models: { fetch: true },
+              headers: { 'X-Tenant': 'a' },
+            },
+            {
+              name: 'TenantB',
+              baseURL: 'https://shared-proxy.example.com/v1',
+              apiKey: 'sk-shared',
+              models: { fetch: true },
+              headers: { 'X-Tenant': 'b' },
+            },
+          ],
+        },
+      }),
+      getUserKeyValues: jest.fn(),
+      fetchModels,
+    });
+
+    const req = {
+      user: { id: 'user-1' },
+      config: undefined,
+    } as unknown as ServerRequest;
+
+    await loadConfigModels(req);
+
+    expect(fetchModels).toHaveBeenCalledTimes(2);
+    const headersByName = new Map<string, Record<string, string> | undefined>();
+    for (const call of fetchModels.mock.calls) {
+      headersByName.set(call[0].name, call[0].headers);
+    }
+    expect(headersByName.get('TenantA')).toEqual({ 'X-Tenant': 'a' });
+    expect(headersByName.get('TenantB')).toEqual({ 'X-Tenant': 'b' });
+  });
+
+  it('still coalesces two endpoints that share baseURL+apiKey AND identical headers', async () => {
+    const sharedHeaders = { Authorization: 'Bearer {{LIBRECHAT_OPENID_ID_TOKEN}}' };
+    const loadConfigModels = createLoadConfigModels({
+      getAppConfig: jest.fn().mockResolvedValue({
+        endpoints: {
+          [EModelEndpoint.custom]: [
+            {
+              name: 'AliasOne',
+              baseURL: 'https://shared-proxy.example.com/v1',
+              apiKey: 'sk-shared',
+              models: { fetch: true },
+              headers: sharedHeaders,
+            },
+            {
+              name: 'AliasTwo',
+              baseURL: 'https://shared-proxy.example.com/v1',
+              apiKey: 'sk-shared',
+              models: { fetch: true },
+              headers: sharedHeaders,
+            },
+          ],
+        },
+      }),
+      getUserKeyValues: jest.fn(),
+      fetchModels,
+    });
+
+    const req = {
+      user: { id: 'user-1' },
+      config: undefined,
+    } as unknown as ServerRequest;
+
+    await loadConfigModels(req);
+
+    // Same baseURL + apiKey + headers → one fetch shared across both endpoints.
+    expect(fetchModels).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/packages/api/src/endpoints/config/models.ts b/packages/api/src/endpoints/config/models.ts
index 22c5207b1d6..9680795fa4c 100644
--- a/packages/api/src/endpoints/config/models.ts
+++ b/packages/api/src/endpoints/config/models.ts
@@ -1,3 +1,4 @@
+import crypto from 'crypto';
 import { logger } from '@librechat/data-schemas';
 import {
   ErrorTypes,
@@ -10,8 +11,27 @@ import type { AppConfig } from '@librechat/data-schemas';
 import type { ServerRequest, GetUserKeyValuesFunction, UserKeyValues } from '~/types';
 import type { FetchModelsParams } from '~/endpoints/models';
 import { fetchModels as defaultFetchModels } from '~/endpoints/models';
+import { getTokenConfigKey } from '~/endpoints/custom/initialize';
+import { tokenConfigCache } from '~/cache';
 import { isUserProvided } from '~/utils';
 
+/**
+ * Stable fingerprint of a headers object, used to disambiguate the
+ * in-request fetch-coalescing key. Two endpoints that share the same
+ * baseURL+apiKey but configure different headers must NOT share a fetch
+ * promise, otherwise the first endpoint's filtered /models response would
+ * be reused for the other in the same request.
+ */
+function headersFingerprint(headers: Record<string, string> | undefined): string {
+  if (!headers || Object.keys(headers).length === 0) {
+    return '';
+  }
+  const ordered = Object.keys(headers)
+    .sort()
+    .map((k) => [k, headers[k]]);
+  return crypto.createHash('sha256').update(JSON.stringify(ordered)).digest('hex').slice(0, 16);
+}
+
 interface ResolvedEndpoint {
   name: string;
   endpoint: TEndpoint;
@@ -78,7 +98,11 @@ export function createLoadConfigModels(deps: LoadConfigModelsDeps) {
 
     const fetchPromisesMap: Record<string, Promise<string[]>> = {};
     const uniqueKeyToEndpointsMap: Record<string, string[]> = {};
+    /** tokenKey the deduped fetch cached its token config under, so siblings
+     *  sharing the fetch can be backfilled with the same config afterward */
+    const uniqueKeyToTokenKey: Record<string, string> = {};
     const endpointsMap: Record<string, TEndpoint> = {};
+    const tenantId = req.user?.tenantId;
 
     const resolved: ResolvedEndpoint[] = [];
     const userKeyEndpoints: ResolvedEndpoint[] = [];
@@ -149,12 +173,19 @@ export function createLoadConfigModels(deps: LoadConfigModelsDeps) {
       baseURLIsUserProvided,
     } of resolved) {
       const { models, headers: endpointHeaders } = endpoint;
-      const uniqueKey = `${BASE_URL}__${API_KEY}`;
+      // Include a fingerprint of the configured headers so two admin-trusted
+      // endpoints that happen to share the same baseURL+apiKey but configure
+      // different (potentially user-bound) headers don't reuse each other's
+      // fetched model list within the same request.
+      const uniqueKey = `${BASE_URL}__${API_KEY}__${headersFingerprint(endpointHeaders)}`;
 
       if (models?.fetch && !apiKeyIsUserProvided && !baseURLIsUserProvided) {
-        fetchPromisesMap[uniqueKey] =
-          fetchPromisesMap[uniqueKey] ||
-          fetchModels({
+        if (!fetchPromisesMap[uniqueKey]) {
+          /** User-scoped when configured headers resolve per user — the
+           *  derived token config must not be cached under the shared name */
+          const tokenKey = getTokenConfigKey(endpoint, name, req.user?.id ?? '', tenantId);
+          uniqueKeyToTokenKey[uniqueKey] = tokenKey;
+          fetchPromisesMap[uniqueKey] = fetchModels({
             name,
             apiKey: API_KEY,
             baseURL: BASE_URL,
@@ -163,7 +194,9 @@ export function createLoadConfigModels(deps: LoadConfigModelsDeps) {
             headers: endpointHeaders,
             direct: endpoint.directEndpoint,
             userIdQuery: models.userIdQuery,
+            tokenKey,
           });
+        }
         uniqueKeyToEndpointsMap[uniqueKey] = uniqueKeyToEndpointsMap[uniqueKey] || [];
         uniqueKeyToEndpointsMap[uniqueKey].push(name);
         continue;
@@ -184,10 +217,18 @@ export function createLoadConfigModels(deps: LoadConfigModelsDeps) {
               baseURL: resolvedBaseURL,
               user: req.user?.id,
               userObject: req.user,
-              headers: endpointHeaders,
+              // Do not forward header overrides when the base URL is
+              // user-supplied: configured templates such as
+              // {{LIBRECHAT_OPENID_ID_TOKEN}} would otherwise resolve and be
+              // sent to a destination the user controls, leaking the user's
+              // identity token. Header overrides are only safe for endpoints
+              // whose base URL is admin-trusted.
+              headers: baseURLIsUserProvided ? undefined : endpointHeaders,
               direct: endpoint.directEndpoint,
               userIdQuery: models.userIdQuery,
               skipCache: true,
+              /** Fetched with the user's key/URL — always user-scoped */
+              tokenKey: getTokenConfigKey(endpoint, name, req.user?.id ?? '', tenantId),
             });
           uniqueKeyToEndpointsMap[userFetchKey] = uniqueKeyToEndpointsMap[userFetchKey] || [];
           uniqueKeyToEndpointsMap[userFetchKey].push(name);
@@ -221,6 +262,28 @@ export function createLoadConfigModels(deps: LoadConfigModelsDeps) {
         );
         modelsConfig[name] = !modelData?.length ? defaults : modelData;
       }
+
+      /** A shared fetch caches token config under one endpoint's tokenKey;
+       *  copy it to the siblings so /token-config resolves each by its own
+       *  name (the query is staleTime:Infinity and won't recover otherwise) */
+      const winnerTokenKey = uniqueKeyToTokenKey[currentKey];
+      if (settled.status === 'fulfilled' && winnerTokenKey != null && associatedNames.length > 1) {
+        const cache = tokenConfigCache();
+        const config = await cache.get(winnerTokenKey);
+        if (config != null) {
+          for (const name of associatedNames) {
+            const siblingKey = getTokenConfigKey(
+              endpointsMap[name],
+              name,
+              req.user?.id ?? '',
+              tenantId,
+            );
+            if (siblingKey !== winnerTokenKey) {
+              await cache.set(siblingKey, config);
+            }
+          }
+        }
+      }
     }
 
     return modelsConfig;
diff --git a/packages/api/src/endpoints/config/providers.spec.ts b/packages/api/src/endpoints/config/providers.spec.ts
index 6045cde218d..ecd3bfa76a4 100644
--- a/packages/api/src/endpoints/config/providers.spec.ts
+++ b/packages/api/src/endpoints/config/providers.spec.ts
@@ -4,7 +4,7 @@ import type { AppConfig } from '@librechat/data-schemas';
 import { getProviderConfig, providerConfigMap, resolveTitleTiming } from './providers';
 
 const buildAppConfig = (
-  customEndpoints: Array<{ name: string; baseURL?: string; apiKey?: string }>,
+  customEndpoints: Array<{ name: string; baseURL?: string; apiKey?: string; provider?: string }>,
 ): AppConfig =>
   ({
     endpoints: {
@@ -96,6 +96,51 @@ describe('getProviderConfig', () => {
       getProviderConfig({ provider: 'openrouter', appConfig: buildAppConfig([]) }),
     ).toThrow('Provider openrouter not supported');
   });
+
+  it('routes a custom endpoint with provider:anthropic to the Anthropic client', () => {
+    const appConfig = buildAppConfig([
+      {
+        name: 'Claude-Compatible',
+        baseURL: 'https://gateway.example.com',
+        apiKey: 'sk-ant',
+        provider: EModelEndpoint.anthropic,
+      },
+    ]);
+
+    const result = getProviderConfig({ provider: 'Claude-Compatible', appConfig });
+
+    expect(result.overrideProvider).toBe(Providers.ANTHROPIC);
+    expect(result.customEndpointConfig?.provider).toBe(EModelEndpoint.anthropic);
+  });
+
+  it('defaults a custom endpoint without provider to the OpenAI-compatible client', () => {
+    const appConfig = buildAppConfig([
+      { name: 'My-LLM', baseURL: 'https://api.example.com/v1', apiKey: 'sk-test' },
+    ]);
+
+    const result = getProviderConfig({ provider: 'My-LLM', appConfig });
+
+    expect(result.overrideProvider).toBe(Providers.OPENAI);
+    expect(result.customEndpointConfig?.name).toBe('My-LLM');
+  });
+
+  it('applies provider:anthropic even when the endpoint name collides with a known custom provider', () => {
+    // `openrouter` resolves via `providerConfigMap` first (skipping the generic
+    // custom branch); the override must still be re-applied from the config so
+    // overrideProvider-derived values (token/context budget) use the Anthropic map.
+    const appConfig = buildAppConfig([
+      {
+        name: 'openrouter',
+        baseURL: 'https://gateway.example.com',
+        apiKey: 'sk-ant',
+        provider: EModelEndpoint.anthropic,
+      },
+    ]);
+
+    const result = getProviderConfig({ provider: 'openrouter', appConfig });
+
+    expect(result.overrideProvider).toBe(Providers.ANTHROPIC);
+  });
 });
 
 describe('resolveTitleTiming', () => {
diff --git a/packages/api/src/endpoints/config/providers.ts b/packages/api/src/endpoints/config/providers.ts
index deab8071d6f..b0d34abfe78 100644
--- a/packages/api/src/endpoints/config/providers.ts
+++ b/packages/api/src/endpoints/config/providers.ts
@@ -198,6 +198,18 @@ export function getProviderConfig({
     }
   }
 
+  /**
+   * Custom endpoints default to the OpenAI-compatible client. An explicit
+   * `provider: anthropic` routes them through the native Anthropic `/v1/messages`
+   * client (`initializeCustom` builds the right config). Applied here — after all
+   * `customEndpointConfig` resolution — so it also wins when the endpoint name
+   * collides with a known custom-provider (e.g. `openrouter`), ensuring
+   * `overrideProvider`-derived values (token/context budget) use the Anthropic map.
+   */
+  if (customEndpointConfig?.provider === EModelEndpoint.anthropic) {
+    overrideProvider = Providers.ANTHROPIC;
+  }
+
   return {
     getOptions,
     overrideProvider,
diff --git a/packages/api/src/endpoints/custom/config.spec.ts b/packages/api/src/endpoints/custom/config.spec.ts
new file mode 100644
index 00000000000..0b1b1eb20a6
--- /dev/null
+++ b/packages/api/src/endpoints/custom/config.spec.ts
@@ -0,0 +1,44 @@
+import { EModelEndpoint } from 'librechat-data-provider';
+import type { TCustomEndpoints } from 'librechat-data-provider';
+import { loadCustomEndpointsConfig } from './config';
+
+const baseEndpoint = {
+  apiKey: 'sk-test',
+  baseURL: 'https://gateway.example.com',
+  models: { default: ['claude-sonnet-4-5'] },
+};
+
+describe('loadCustomEndpointsConfig – native provider param set', () => {
+  it('synthesizes defaultParamsEndpoint from provider so the UI shows the right params', () => {
+    const config = loadCustomEndpointsConfig([
+      { ...baseEndpoint, name: 'Claude-Compatible', provider: EModelEndpoint.anthropic },
+    ] as unknown as TCustomEndpoints);
+
+    expect(config?.['Claude-Compatible']?.customParams?.defaultParamsEndpoint).toBe(
+      EModelEndpoint.anthropic,
+    );
+  });
+
+  it('does not set defaultParamsEndpoint for endpoints without a provider', () => {
+    const config = loadCustomEndpointsConfig([
+      { ...baseEndpoint, name: 'My-LLM' },
+    ] as unknown as TCustomEndpoints);
+
+    expect(config?.['My-LLM']?.customParams).toBeUndefined();
+  });
+
+  it('respects an explicit non-default defaultParamsEndpoint over the provider', () => {
+    const config = loadCustomEndpointsConfig([
+      {
+        ...baseEndpoint,
+        name: 'Claude-Compatible',
+        provider: EModelEndpoint.anthropic,
+        customParams: { defaultParamsEndpoint: EModelEndpoint.google },
+      },
+    ] as unknown as TCustomEndpoints);
+
+    expect(config?.['Claude-Compatible']?.customParams?.defaultParamsEndpoint).toBe(
+      EModelEndpoint.google,
+    );
+  });
+});
diff --git a/packages/api/src/endpoints/custom/config.ts b/packages/api/src/endpoints/custom/config.ts
index 5b3bd88ce2f..f8d2de47e5c 100644
--- a/packages/api/src/endpoints/custom/config.ts
+++ b/packages/api/src/endpoints/custom/config.ts
@@ -35,17 +35,31 @@ export function loadCustomEndpointsConfig(
         iconURL,
         modelDisplayLabel,
         customParams,
+        provider,
       } = endpoint;
       const name = normalizeEndpointName(configName);
 
       const resolvedApiKey = extractEnvVariable(apiKey ?? '');
       const resolvedBaseURL = extractEnvVariable(baseURL ?? '');
 
+      /**
+       * A native `provider` (e.g. anthropic) implies its parameter set. Surface it
+       * as `defaultParamsEndpoint` so the client param panel shows the right fields
+       * (e.g. `maxOutputTokens`/`thinking` for Anthropic, not OpenAI `max_tokens`),
+       * unless an admin explicitly chose a non-default `defaultParamsEndpoint`.
+       */
+      const resolvedCustomParams =
+        provider != null &&
+        (customParams?.defaultParamsEndpoint == null ||
+          customParams.defaultParamsEndpoint === EModelEndpoint.custom)
+          ? { ...customParams, defaultParamsEndpoint: provider }
+          : customParams;
+
       customEndpointsConfig[name] = {
         type: EModelEndpoint.custom,
         userProvide: isUserProvided(resolvedApiKey),
         userProvideURL: isUserProvided(resolvedBaseURL),
-        customParams,
+        customParams: resolvedCustomParams,
         modelDisplayLabel,
         iconURL,
       };
diff --git a/packages/api/src/endpoints/custom/initialize.spec.ts b/packages/api/src/endpoints/custom/initialize.spec.ts
index 3c384bf0361..544dfdeba59 100644
--- a/packages/api/src/endpoints/custom/initialize.spec.ts
+++ b/packages/api/src/endpoints/custom/initialize.spec.ts
@@ -33,7 +33,8 @@ jest.mock('~/app/config', () => ({
   getCustomEndpointConfig: (...args: unknown[]) => mockGetCustomEndpointConfig(...args),
 }));
 
-import { initializeCustom } from './initialize';
+import { getTokenConfigKey, initializeCustom } from './initialize';
+import { SCOPED_TOKEN_CONFIG_KEY_PREFIX } from '../keys';
 
 function createParams(overrides: {
   apiKey?: string;
@@ -210,3 +211,367 @@ describe('initializeCustom – SSRF guard wiring', () => {
     expect(mockGetOpenAIConfig).not.toHaveBeenCalled();
   });
 });
+
+describe('initializeCustom – token-config fetch header forwarding', () => {
+  const { fetchModels } = jest.requireMock('~/endpoints/models');
+
+  function createTokenConfigParams(overrides: {
+    apiKey?: string;
+    baseURL?: string;
+    userBaseURL?: string;
+    headers?: Record<string, string>;
+    tenantId?: string;
+  }): BaseInitializeParams {
+    const { apiKey = 'sk-test-key', baseURL = 'https://openrouter.ai/api/v1' } = overrides;
+
+    mockGetCustomEndpointConfig.mockReturnValue({
+      apiKey,
+      baseURL,
+      models: { fetch: true },
+      headers: overrides.headers,
+    });
+
+    const db = {
+      getUserKeyValues: jest.fn().mockResolvedValue({
+        apiKey: 'sk-user-key',
+        baseURL: overrides.userBaseURL ?? 'https://user-api.example.com/v1',
+      }),
+    } as unknown as BaseInitializeParams['db'];
+
+    return {
+      req: {
+        user: { id: 'user-1', email: 'user@example.com', tenantId: overrides.tenantId },
+        body: { key: '2099-01-01' },
+        config: {},
+      } as unknown as BaseInitializeParams['req'],
+      // openrouter is in FetchTokenConfig, so the fetchModels call is reached
+      endpoint: 'openrouter',
+      model_parameters: { model: 'gpt-4' },
+      db,
+    };
+  }
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    fetchModels.mockReset().mockResolvedValue([]);
+  });
+
+  it('forwards configured headers and user object to fetchModels for admin-trusted base URL', async () => {
+    const headers = {
+      Authorization: 'Bearer {{LIBRECHAT_OPENID_ID_TOKEN}}',
+      'X-User-Email': '{{LIBRECHAT_USER_EMAIL}}',
+    };
+    const params = createTokenConfigParams({
+      apiKey: 'sk-test-key',
+      baseURL: 'https://openrouter.ai/api/v1',
+      headers,
+    });
+
+    await initializeCustom(params);
+
+    expect(fetchModels).toHaveBeenCalledWith(
+      expect.objectContaining({
+        name: 'openrouter',
+        headers,
+        userObject: params.req.user,
+      }),
+    );
+  });
+
+  it('drops headers when base URL is user-provided (token leak guard)', async () => {
+    const headers = {
+      Authorization: 'Bearer {{LIBRECHAT_OPENID_ID_TOKEN}}',
+    };
+    const params = createTokenConfigParams({
+      apiKey: 'sk-test-key',
+      baseURL: AuthType.USER_PROVIDED,
+      userBaseURL: 'https://user-controlled.example.com/v1',
+      headers,
+    });
+
+    await initializeCustom(params);
+
+    expect(fetchModels).toHaveBeenCalledWith(
+      expect.objectContaining({
+        name: 'openrouter',
+        headers: undefined,
+        userObject: params.req.user,
+      }),
+    );
+  });
+
+  it('uses the unscoped endpoint tokenKey when no user-bound headers are configured', async () => {
+    const params = createTokenConfigParams({
+      apiKey: 'sk-test-key',
+      baseURL: 'https://openrouter.ai/api/v1',
+    });
+
+    await initializeCustom(params);
+
+    expect(fetchModels).toHaveBeenCalledWith(
+      expect.objectContaining({
+        name: 'openrouter',
+        tokenKey: 'openrouter',
+        headers: undefined,
+      }),
+    );
+  });
+
+  it('tenant-scopes the tokenKey when a tenant id is present', async () => {
+    const params = createTokenConfigParams({
+      apiKey: 'sk-test-key',
+      baseURL: 'https://openrouter.ai/api/v1',
+      tenantId: 'tenant-a',
+    });
+
+    await initializeCustom(params);
+
+    const tokenKey = fetchModels.mock.calls[0][0].tokenKey;
+    expect(fetchModels.mock.calls[0][0].name).toBe('openrouter');
+    expect(tokenKey.startsWith(SCOPED_TOKEN_CONFIG_KEY_PREFIX)).toBe(true);
+    expect(tokenKey).not.toBe('tenant:tenant-a:openrouter');
+  });
+
+  it('user-scopes the tokenKey when headers will be forwarded (admin-trusted base URL)', async () => {
+    const params = createTokenConfigParams({
+      apiKey: 'sk-test-key',
+      baseURL: 'https://openrouter.ai/api/v1',
+      headers: { Authorization: 'Bearer {{LIBRECHAT_OPENID_ID_TOKEN}}' },
+    });
+
+    await initializeCustom(params);
+
+    expect(fetchModels).toHaveBeenCalledWith(
+      expect.objectContaining({
+        tokenKey: 'openrouter:user-1',
+      }),
+    );
+  });
+
+  it('does NOT user-scope the tokenKey when headers are dropped (user-provided base URL)', async () => {
+    const params = createTokenConfigParams({
+      apiKey: 'sk-test-key',
+      baseURL: AuthType.USER_PROVIDED,
+      userBaseURL: 'https://user-controlled.example.com/v1',
+      headers: { Authorization: 'Bearer {{LIBRECHAT_OPENID_ID_TOKEN}}' },
+    });
+
+    await initializeCustom(params);
+
+    // baseURL is user-provided so tokenKey is already user-scoped via the
+    // existing rule, not via the new headers signal. Either way the value
+    // should be the user-scoped key.
+    expect(fetchModels).toHaveBeenCalledWith(
+      expect.objectContaining({
+        tokenKey: 'openrouter:user-1',
+        headers: undefined,
+      }),
+    );
+  });
+
+  it('uses a static tokenConfig for billing and skips the model fetch', async () => {
+    const tokenConfig = {
+      'gpt-4': { prompt: 1.5, completion: 4.5, context: 32000, cacheRead: 0.3, cacheWrite: 1.8 },
+    };
+    mockGetCustomEndpointConfig.mockReturnValue({
+      apiKey: 'sk-test-key',
+      baseURL: 'https://openrouter.ai/api/v1',
+      models: { fetch: true },
+      tokenConfig,
+    });
+
+    const params: BaseInitializeParams = {
+      req: {
+        user: { id: 'user-1', email: 'user@example.com' },
+        body: { key: '2099-01-01' },
+        config: {},
+      } as unknown as BaseInitializeParams['req'],
+      endpoint: 'openrouter',
+      model_parameters: { model: 'gpt-4' },
+      db: {
+        getUserKeyValues: jest.fn(),
+      } as unknown as BaseInitializeParams['db'],
+    };
+
+    const result = (await initializeCustom(params)) as {
+      endpointTokenConfig?: Record<string, Record<string, number>>;
+    };
+
+    expect(fetchModels).not.toHaveBeenCalled();
+    /** Original rates pass through, plus the billing-shape cache keys so
+     *  getCacheMultiplier (which reads `write`/`read`) finds them */
+    expect(result.endpointTokenConfig?.['gpt-4']).toEqual({
+      prompt: 1.5,
+      completion: 4.5,
+      context: 32000,
+      cacheRead: 0.3,
+      cacheWrite: 1.8,
+      write: 1.8,
+      read: 0.3,
+    });
+  });
+});
+
+describe('getTokenConfigKey – tenant fallback', () => {
+  const endpointConfig = {
+    apiKey: 'sk-test-key',
+    baseURL: 'https://openrouter.ai/api/v1',
+  };
+
+  it('keeps legacy shared keys when tenant context is unavailable or empty', () => {
+    const tenantIds = [undefined, null, '', '   '] as Array<string | null | undefined>;
+
+    for (const tenantId of tenantIds) {
+      expect(getTokenConfigKey(endpointConfig, 'openrouter', 'user-1', tenantId)).toBe(
+        'openrouter',
+      );
+    }
+  });
+
+  it('keeps legacy user-scoped keys when tenant context is unavailable or empty', () => {
+    const userScopedConfig = {
+      ...endpointConfig,
+      headers: { Authorization: 'Bearer {{LIBRECHAT_OPENID_ID_TOKEN}}' },
+    };
+    const tenantIds = [undefined, null, '', '   '] as Array<string | null | undefined>;
+
+    for (const tenantId of tenantIds) {
+      expect(getTokenConfigKey(userScopedConfig, 'openrouter', 'user-1', tenantId)).toBe(
+        'openrouter:user-1',
+      );
+    }
+  });
+
+  it('adds tenant scope only when tenant context is non-empty', () => {
+    const key = getTokenConfigKey(endpointConfig, 'openrouter', 'user-1', ' tenant-a ');
+
+    expect(key.startsWith(SCOPED_TOKEN_CONFIG_KEY_PREFIX)).toBe(true);
+    expect(key).not.toBe('tenant:tenant-a:openrouter');
+    expect(key).not.toContain('openrouter');
+    expect(key).not.toContain('tenant-a');
+    expect(key).toBe(getTokenConfigKey(endpointConfig, 'openrouter', 'user-1', 'tenant-a'));
+  });
+});
+
+describe('initializeCustom – native Anthropic provider', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  function createAnthropicParams(
+    config: Record<string, unknown>,
+    model_parameters: Record<string, unknown> = { model: 'claude-sonnet-4-5' },
+  ): BaseInitializeParams {
+    mockGetCustomEndpointConfig.mockReturnValue(config);
+    return {
+      req: {
+        user: { id: 'user-1', email: 'user@example.com' },
+        body: { conversationId: 'convo-1' },
+        config: {},
+      } as unknown as BaseInitializeParams['req'],
+      endpoint: 'Claude-Compatible',
+      model_parameters,
+      db: {
+        getUserKeyValues: jest.fn().mockResolvedValue({
+          apiKey: 'sk-user-key',
+          baseURL: 'https://user-controlled.example.com',
+        }),
+        getUserKey: jest.fn(),
+      } as unknown as BaseInitializeParams['db'],
+    };
+  }
+
+  it('builds a native Anthropic config pointed at the custom baseURL/apiKey', async () => {
+    const params = createAnthropicParams({
+      provider: 'anthropic',
+      apiKey: 'sk-ant-custom',
+      baseURL: 'https://gateway.example.com',
+      headers: { 'anthropic-version': '2023-06-01' },
+      models: { default: ['claude-sonnet-4-5'] },
+    });
+
+    const options = await initializeCustom(params);
+
+    /** Routed to the native Anthropic client, not the OpenAI-compatible one */
+    expect(mockGetOpenAIConfig).not.toHaveBeenCalled();
+    expect(options.provider).toBe('anthropic');
+    /** Custom baseURL/key wired into the native Anthropic config */
+    expect(options.llmConfig).toHaveProperty('anthropicApiUrl', 'https://gateway.example.com');
+    expect(options.llmConfig).toHaveProperty('apiKey', 'sk-ant-custom');
+    /** Configured header attached (kept unresolved for request-time resolution) */
+    const defaultHeaders = (
+      options.llmConfig as { clientOptions?: { defaultHeaders?: Record<string, string> } }
+    ).clientOptions?.defaultHeaders;
+    expect(defaultHeaders?.['anthropic-version']).toBe('2023-06-01');
+    /** Native Anthropic path must NOT use OpenAI legacy content formatting */
+    expect(options.useLegacyContent).toBeUndefined();
+  });
+
+  it('withholds configured headers when the user supplies the base URL', async () => {
+    const params = createAnthropicParams({
+      provider: 'anthropic',
+      apiKey: 'sk-ant-custom',
+      baseURL: AuthType.USER_PROVIDED,
+      headers: {
+        Authorization: 'Bearer ${GATEWAY_SECRET}',
+        'X-User-Email': '{{LIBRECHAT_USER_EMAIL}}',
+      },
+      models: { default: ['claude-sonnet-4-5'] },
+    });
+
+    const options = await initializeCustom(params);
+
+    expect(mockValidateEndpointURL).toHaveBeenCalledWith(
+      'https://user-controlled.example.com',
+      'Claude-Compatible',
+      undefined,
+    );
+    expect(options.llmConfig).toHaveProperty(
+      'anthropicApiUrl',
+      'https://user-controlled.example.com',
+    );
+    const defaultHeaders = (
+      options.llmConfig as { clientOptions?: { defaultHeaders?: Record<string, string> } }
+    ).clientOptions?.defaultHeaders;
+    expect(defaultHeaders?.Authorization).toBeUndefined();
+    expect(defaultHeaders?.['X-User-Email']).toBeUndefined();
+  });
+
+  it('applies customParams.paramDefinitions defaults on the native path', async () => {
+    const params = createAnthropicParams({
+      provider: 'anthropic',
+      apiKey: 'sk-ant-custom',
+      baseURL: 'https://gateway.example.com',
+      models: { default: ['claude-sonnet-4-5'] },
+      customParams: {
+        defaultParamsEndpoint: 'anthropic',
+        paramDefinitions: [{ key: 'web_search', default: true }],
+      },
+    });
+
+    const options = await initializeCustom(params);
+
+    /** `web_search: true` default flows through to the Anthropic web_search tool */
+    expect(options.tools).toEqual(
+      expect.arrayContaining([expect.objectContaining({ name: 'web_search' })]),
+    );
+  });
+
+  it('still uses the OpenAI-compatible client when no provider is set', async () => {
+    const params = createAnthropicParams({
+      apiKey: 'sk-test',
+      baseURL: 'https://api.example.com/v1',
+      models: { default: ['gpt-4o'] },
+    });
+
+    const options = await initializeCustom(params);
+
+    expect(mockGetOpenAIConfig).toHaveBeenCalledWith(
+      'sk-test',
+      expect.any(Object),
+      'Claude-Compatible',
+    );
+    expect(options.useLegacyContent).toBe(true);
+    expect(options.provider).toBeUndefined();
+  });
+});
diff --git a/packages/api/src/endpoints/custom/initialize.ts b/packages/api/src/endpoints/custom/initialize.ts
index cc5ab14a9f1..80dfc4e8c03 100644
--- a/packages/api/src/endpoints/custom/initialize.ts
+++ b/packages/api/src/endpoints/custom/initialize.ts
@@ -1,14 +1,24 @@
+import { Providers } from '@librechat/agents';
 import {
   ErrorTypes,
   envVarRegex,
+  EModelEndpoint,
   FetchTokenConfig,
   extractEnvVariable,
 } from 'librechat-data-provider';
 import type { TEndpoint } from 'librechat-data-provider';
 import type { AppConfig } from '@librechat/data-schemas';
-import type { BaseInitializeParams, InitializeResultBase, EndpointTokenConfig } from '~/types';
-import { getOpenAIConfig } from '~/endpoints/openai/config';
+import type {
+  BaseInitializeParams,
+  InitializeResultBase,
+  EndpointTokenConfig,
+  AnthropicModelOptions,
+} from '~/types';
+import { getLLMConfig as getAnthropicLLMConfig } from '~/endpoints/anthropic/llm';
+import { extractDefaultParams } from '~/endpoints/openai/llm';
 import { isUserProvided, checkUserKeyExpiry } from '~/utils';
+import { getOpenAIConfig } from '~/endpoints/openai/config';
+import { getScopedTokenConfigKey } from '~/endpoints/keys';
 import { getCustomEndpointConfig } from '~/app/config';
 import { fetchModels } from '~/endpoints/models';
 import { validateEndpointURL } from '~/auth';
@@ -16,6 +26,67 @@ import { tokenConfigCache } from '~/cache';
 
 const { PROXY } = process.env;
 
+function getTenantTokenScope(tenantId?: string | null): string {
+  const normalizedTenantId = typeof tenantId === 'string' ? tenantId.trim() : '';
+  return normalizedTenantId;
+}
+
+/**
+ * Cache key for an endpoint's fetched token config. User-scoped when the
+ * model fetch can resolve per-user: user-provided key/URL, or header
+ * templates forwarded against an admin-trusted base URL — making the
+ * response, and therefore the derived token config, user-specific. Otherwise
+ * tenant-scoped when a tenant id is available because custom endpoint config
+ * is resolved per tenant.
+ */
+export function getTokenConfigKey(
+  endpointConfig: Partial<TEndpoint>,
+  endpoint: string,
+  userId: string,
+  tenantId?: string | null,
+): string {
+  const hasTokenConfig = endpointConfig.tokenConfig != null;
+  if (hasTokenConfig) {
+    return endpoint;
+  }
+
+  const userProvidesKey = isUserProvided(extractEnvVariable(endpointConfig.apiKey ?? ''));
+  const userProvidesURL = isUserProvided(extractEnvVariable(endpointConfig.baseURL ?? ''));
+  const willForwardUserScopedHeaders = !!endpointConfig?.headers && !userProvidesURL;
+  const tenantScope = getTenantTokenScope(tenantId);
+
+  if (userProvidesKey || userProvidesURL || willForwardUserScopedHeaders) {
+    return tenantScope
+      ? getScopedTokenConfigKey('tenant-user', [tenantScope, endpoint, userId])
+      : `${endpoint}:${userId}`;
+  }
+
+  return tenantScope ? getScopedTokenConfigKey('tenant', [tenantScope, endpoint]) : endpoint;
+}
+
+/**
+ * Maps an admin-facing static `tokenConfig` to the billing shape: the UI uses
+ * `cacheWrite`/`cacheRead`, but `getCacheMultiplier` indexes `write`/`read`.
+ * Adds those keys (preserving the originals) so cache tokens bill at the
+ * configured rate instead of the prompt-rate fallback.
+ */
+function toBillingTokenConfig(
+  tokenConfig: Record<string, Record<string, number>>,
+): EndpointTokenConfig {
+  const result: EndpointTokenConfig = {};
+  for (const [model, rates] of Object.entries(tokenConfig)) {
+    const mapped = { ...rates } as Record<string, number>;
+    if (rates.cacheWrite != null) {
+      mapped.write = rates.cacheWrite;
+    }
+    if (rates.cacheRead != null) {
+      mapped.read = rates.cacheRead;
+    }
+    result[model] = mapped as EndpointTokenConfig[string];
+  }
+  return result;
+}
+
 /**
  * Builds custom options from endpoint configuration
  */
@@ -47,6 +118,44 @@ function buildCustomOptions(
   return customOptions;
 }
 
+/**
+ * Builds a native Anthropic (`/v1/messages`) config for a custom endpoint that
+ * declares `provider: anthropic`, pointing the Anthropic client at the custom
+ * `baseURL`/`apiKey`. Returns `provider: anthropic` so the agent uses the native
+ * Anthropic client instead of the OpenAI-compatible one. Headers stay unresolved
+ * here and resolve at request time via `resolveConfigHeaders`.
+ */
+function buildAnthropicCustomConfig({
+  apiKey,
+  baseURL,
+  modelOptions,
+  endpointConfig,
+  userProvidesURL,
+}: {
+  apiKey: string;
+  baseURL: string;
+  modelOptions: AnthropicModelOptions;
+  endpointConfig: Partial<TEndpoint>;
+  userProvidesURL: boolean;
+}): InitializeResultBase {
+  const result = getAnthropicLLMConfig(apiKey, {
+    modelOptions,
+    proxy: PROXY ?? undefined,
+    reverseProxyUrl: baseURL,
+    headers: userProvidesURL ? undefined : endpointConfig.headers,
+    addParams: endpointConfig.addParams,
+    dropParams: endpointConfig.dropParams,
+    /** Apply admin `customParams.paramDefinitions` defaults (e.g. promptCache,
+     *  web_search, thinking) the OpenAI-compatible path gets via `getOpenAIConfig`. */
+    defaultParams: extractDefaultParams(endpointConfig.customParams?.paramDefinitions),
+  });
+  return {
+    llmConfig: result.llmConfig as InitializeResultBase['llmConfig'],
+    tools: result.tools,
+    provider: Providers.ANTHROPIC,
+  };
+}
+
 /**
  * Initializes a custom endpoint client configuration.
  * This function handles custom endpoints defined in librechat.yaml, including
@@ -134,19 +243,26 @@ export async function initializeCustom({
   let endpointTokenConfig: EndpointTokenConfig | undefined;
 
   const userId = req.user?.id ?? '';
+  const tenantId = req.user?.tenantId;
 
   const cache = tokenConfigCache();
-  /** tokenConfig is an optional extended property on custom endpoints */
-  const hasTokenConfig = (endpointConfig as Record<string, unknown>).tokenConfig != null;
-  const tokenKey =
-    !hasTokenConfig && (userProvidesKey || userProvidesURL) ? `${endpoint}:${userId}` : endpoint;
-
-  const cachedConfig =
-    !hasTokenConfig &&
-    FetchTokenConfig[endpoint.toLowerCase() as keyof typeof FetchTokenConfig] &&
-    (await cache.get(tokenKey));
+  const hasTokenConfig = endpointConfig.tokenConfig != null;
+  const tokenKey = getTokenConfigKey(endpointConfig, endpoint, userId, tenantId);
 
-  endpointTokenConfig = (cachedConfig as EndpointTokenConfig) || undefined;
+  if (hasTokenConfig) {
+    /** A static override is authoritative — use it for the agent's billing
+     *  and balance checks, not just the advertised UI token config. Mirror
+     *  the admin-facing `cacheWrite`/`cacheRead` keys onto the `write`/`read`
+     *  keys the billing multiplier reads. */
+    endpointTokenConfig = toBillingTokenConfig(
+      endpointConfig.tokenConfig as Record<string, Record<string, number>>,
+    );
+  } else {
+    const cachedConfig =
+      FetchTokenConfig[endpoint.toLowerCase() as keyof typeof FetchTokenConfig] &&
+      (await cache.get(tokenKey));
+    endpointTokenConfig = (cachedConfig as EndpointTokenConfig) || undefined;
+  }
 
   if (
     FetchTokenConfig[endpoint.toLowerCase() as keyof typeof FetchTokenConfig] &&
@@ -154,7 +270,24 @@ export async function initializeCustom({
     endpointConfig.models?.fetch &&
     !endpointTokenConfig
   ) {
-    await fetchModels({ apiKey, baseURL, name: endpoint, user: userId, tokenKey });
+    await fetchModels({
+      apiKey,
+      baseURL,
+      name: endpoint,
+      user: userId,
+      tokenKey,
+      userObject: req.user,
+      // Mirror the security guard in `loadConfigModels`: never forward
+      // header overrides when the base URL is user-supplied — configured
+      // templates like {{LIBRECHAT_OPENID_ID_TOKEN}} would otherwise resolve
+      // and leak the user's identity token to a destination the user controls.
+      headers: userProvidesURL ? undefined : endpointConfig.headers,
+      // Note: when both `headers` and `userObject` are supplied below, the
+      // MODEL_QUERIES cache inside `fetchModels` is automatically skipped,
+      // which prevents a per-user filtered model list from leaking across
+      // users. The token-config cache key (`tokenKey`) is also user-scoped
+      // above when these headers will be forwarded.
+    });
     endpointTokenConfig = (await cache.get(tokenKey)) as EndpointTokenConfig | undefined;
   }
 
@@ -167,15 +300,30 @@ export async function initializeCustom({
   };
 
   const modelOptions = { ...(model_parameters ?? {}), user: userId };
-  const finalClientOptions = {
-    modelOptions,
-    ...clientOptions,
-  };
 
-  const options = getOpenAIConfig(apiKey, finalClientOptions, endpoint);
-  if (options != null) {
-    (options as InitializeResultBase).useLegacyContent = true;
-    (options as InitializeResultBase).endpointTokenConfig = endpointTokenConfig;
+  let options: InitializeResultBase;
+  if (endpointConfig.provider === EModelEndpoint.anthropic) {
+    /** Native Anthropic `/v1/messages` client against the custom baseURL/apiKey.
+     *  `useLegacyContent` is intentionally left unset (matches the built-in
+     *  Anthropic endpoint, which uses native content formatting). */
+    options = buildAnthropicCustomConfig({
+      apiKey,
+      baseURL,
+      modelOptions: modelOptions as AnthropicModelOptions,
+      endpointConfig,
+      userProvidesURL,
+    });
+    options.endpointTokenConfig = endpointTokenConfig;
+  } else {
+    const finalClientOptions = {
+      modelOptions,
+      ...clientOptions,
+    };
+    options = getOpenAIConfig(apiKey, finalClientOptions, endpoint);
+    if (options != null) {
+      options.useLegacyContent = true;
+      options.endpointTokenConfig = endpointTokenConfig;
+    }
   }
 
   const streamRate = clientOptions.streamRate as number | undefined;
diff --git a/packages/api/src/endpoints/google/initialize.spec.ts b/packages/api/src/endpoints/google/initialize.spec.ts
new file mode 100644
index 00000000000..a6239805efd
--- /dev/null
+++ b/packages/api/src/endpoints/google/initialize.spec.ts
@@ -0,0 +1,167 @@
+import { Providers } from '@librechat/agents';
+import { AuthKeys, EModelEndpoint } from 'librechat-data-provider';
+import type { EndpointDbMethods, ServerRequest } from '~/types';
+
+const mockGetGoogleConfig = jest.fn(
+  (_credentials?: unknown, _options?: unknown, _acceptRawApiKey?: unknown) => ({
+    provider: Providers.VERTEXAI,
+    llmConfig: { model: 'gemini-2.5-flash' },
+  }),
+);
+const mockIsEnabled = jest.fn();
+const mockLoadServiceKey = jest.fn();
+const mockCheckUserKeyExpiry = jest.fn();
+
+jest.mock('./llm', () => ({
+  getGoogleConfig: (credentials: unknown, options: unknown, acceptRawApiKey?: unknown) =>
+    mockGetGoogleConfig(credentials, options, acceptRawApiKey),
+}));
+
+jest.mock('~/utils', () => ({
+  ...jest.requireActual('~/utils'),
+  isEnabled: (value: unknown) => mockIsEnabled(value),
+  loadServiceKey: (keyPath: unknown) => mockLoadServiceKey(keyPath),
+  checkUserKeyExpiry: (expiresAt: unknown, endpoint: unknown) =>
+    mockCheckUserKeyExpiry(expiresAt, endpoint),
+}));
+
+import { initializeGoogle } from './initialize';
+
+function createDb(): EndpointDbMethods {
+  return {
+    getUserKey: jest.fn().mockResolvedValue('user-google-key'),
+    getUserKeyValues: jest.fn().mockResolvedValue({}),
+  };
+}
+
+function createReq(): ServerRequest {
+  return {
+    body: {},
+    config: {},
+    user: { id: 'user-1' },
+  } as ServerRequest;
+}
+
+function getGoogleConfigCall(): [Record<string, unknown>, Record<string, unknown>] {
+  expect(mockGetGoogleConfig).toHaveBeenCalled();
+  return mockGetGoogleConfig.mock.calls[0] as unknown as [
+    Record<string, unknown>,
+    Record<string, unknown>,
+  ];
+}
+
+describe('initializeGoogle', () => {
+  const originalEnv = process.env;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    process.env = { ...originalEnv };
+    delete process.env.GOOGLE_KEY;
+    delete process.env.GOOGLE_REVERSE_PROXY;
+    delete process.env.GOOGLE_AUTH_HEADER;
+    delete process.env.GOOGLE_SERVICE_KEY_FILE;
+    delete process.env.VERTEX_PROJECT_ID;
+    delete process.env.GOOGLE_CLOUD_PROJECT;
+    delete process.env.GCLOUD_PROJECT;
+    delete process.env.GOOGLE_PROJECT_ID;
+  });
+
+  afterAll(() => {
+    process.env = originalEnv;
+  });
+
+  it('forces Vertex AI ADC config and ignores GOOGLE_KEY for vertexai endpoint', async () => {
+    process.env.GOOGLE_KEY = 'test-api-key';
+    process.env.VERTEX_PROJECT_ID = 'fiery-catwalk-385918';
+    mockLoadServiceKey.mockResolvedValue(null);
+
+    const db = createDb();
+
+    await initializeGoogle({
+      req: createReq(),
+      endpoint: Providers.VERTEXAI,
+      model_parameters: { model: 'gemini-2.5-flash' },
+      db,
+    });
+
+    expect(mockLoadServiceKey).toHaveBeenCalledTimes(1);
+    expect(db.getUserKey).not.toHaveBeenCalled();
+    expect(mockCheckUserKeyExpiry).not.toHaveBeenCalled();
+
+    const [credentials, options] = getGoogleConfigCall();
+    expect(credentials).toEqual({
+      [AuthKeys.GOOGLE_SERVICE_KEY]: {},
+    });
+    expect(credentials).not.toHaveProperty(AuthKeys.GOOGLE_API_KEY);
+    expect(options).toEqual(
+      expect.objectContaining({
+        forceVertex: true,
+        projectId: 'fiery-catwalk-385918',
+        modelOptions: { model: 'gemini-2.5-flash' },
+      }),
+    );
+  });
+
+  it('keeps Google API-key config for the google endpoint', async () => {
+    process.env.GOOGLE_KEY = 'test-api-key';
+    process.env.VERTEX_PROJECT_ID = 'fiery-catwalk-385918';
+
+    await initializeGoogle({
+      req: createReq(),
+      endpoint: EModelEndpoint.google,
+      model_parameters: { model: 'gemini-2.5-flash' },
+      db: createDb(),
+    });
+
+    expect(mockLoadServiceKey).not.toHaveBeenCalled();
+
+    const [credentials, options] = getGoogleConfigCall();
+    expect(credentials).toEqual({
+      [AuthKeys.GOOGLE_SERVICE_KEY]: {},
+      [AuthKeys.GOOGLE_API_KEY]: 'test-api-key',
+    });
+    expect(options).toEqual(
+      expect.objectContaining({
+        forceVertex: false,
+        projectId: undefined,
+        modelOptions: { model: 'gemini-2.5-flash' },
+      }),
+    );
+  });
+
+  it('resolves configured headers at init (merged over endpoints.all) before getGoogleConfig', async () => {
+    process.env.GOOGLE_KEY = 'test-api-key';
+
+    const req = {
+      body: { conversationId: 'convo-9' },
+      user: { id: 'user-1' },
+      config: {
+        endpoints: {
+          all: { headers: { 'X-Common': 'all', 'X-Override': 'all' } },
+          [EModelEndpoint.google]: {
+            headers: {
+              'X-Override': 'google',
+              'X-Conversation-Id': '{{LIBRECHAT_BODY_CONVERSATIONID}}',
+              'X-User-Id': '{{LIBRECHAT_USER_ID}}',
+            },
+          },
+        },
+      },
+    } as unknown as ServerRequest;
+
+    await initializeGoogle({
+      req,
+      endpoint: EModelEndpoint.google,
+      model_parameters: { model: 'gemini-2.5-flash' },
+      db: createDb(),
+    });
+
+    const [, options] = getGoogleConfigCall();
+    expect(options.headers).toEqual({
+      'X-Common': 'all',
+      'X-Override': 'google',
+      'X-Conversation-Id': 'convo-9',
+      'X-User-Id': 'user-1',
+    });
+  });
+});
diff --git a/packages/api/src/endpoints/google/initialize.ts b/packages/api/src/endpoints/google/initialize.ts
index dcf750bb878..41c2f65298e 100644
--- a/packages/api/src/endpoints/google/initialize.ts
+++ b/packages/api/src/endpoints/google/initialize.ts
@@ -1,4 +1,5 @@
 import path from 'path';
+import { Providers } from '@librechat/agents';
 import { EModelEndpoint, AuthKeys } from 'librechat-data-provider';
 import type {
   BaseInitializeParams,
@@ -6,7 +7,13 @@ import type {
   GoogleConfigOptions,
   GoogleCredentials,
 } from '~/types';
-import { isEnabled, loadServiceKey, checkUserKeyExpiry } from '~/utils';
+import {
+  isEnabled,
+  loadServiceKey,
+  checkUserKeyExpiry,
+  mergeHeaders,
+  resolveHeaders,
+} from '~/utils';
 import { getGoogleConfig } from './llm';
 
 /**
@@ -23,14 +30,15 @@ export async function initializeGoogle({
   model_parameters,
   db,
 }: BaseInitializeParams): Promise<InitializeResultBase> {
-  void endpoint;
   const appConfig = req.config;
   const { GOOGLE_KEY, GOOGLE_REVERSE_PROXY, GOOGLE_AUTH_HEADER, PROXY } = process.env;
   const isUserProvided = GOOGLE_KEY === 'user_provided';
+  const isVertexEndpoint = endpoint === Providers.VERTEXAI;
+  const useUserProvidedGoogleKey = !isVertexEndpoint && isUserProvided;
   const { key: expiresAt } = req.body;
 
   let userKey = null;
-  if (expiresAt && isUserProvided) {
+  if (expiresAt && useUserProvidedGoogleKey) {
     checkUserKeyExpiry(expiresAt, EModelEndpoint.google);
     userKey = await db.getUserKey({ userId: req.user?.id ?? '', name: EModelEndpoint.google });
   }
@@ -39,9 +47,10 @@ export async function initializeGoogle({
 
   /** Check if GOOGLE_KEY is provided at all (including 'user_provided') */
   const isGoogleKeyProvided =
-    (GOOGLE_KEY && GOOGLE_KEY.trim() !== '') || (isUserProvided && userKey != null);
+    !isVertexEndpoint &&
+    ((GOOGLE_KEY && GOOGLE_KEY.trim() !== '') || (useUserProvidedGoogleKey && userKey != null));
 
-  if (!isGoogleKeyProvided && loadServiceKey) {
+  if ((isVertexEndpoint || !isGoogleKeyProvided) && loadServiceKey) {
     /** Only attempt to load service key if GOOGLE_KEY is not provided */
     try {
       const serviceKeyPath =
@@ -56,11 +65,11 @@ export async function initializeGoogle({
     }
   }
 
-  const credentials: GoogleCredentials = isUserProvided
+  const credentials: GoogleCredentials = useUserProvidedGoogleKey
     ? (userKey as GoogleCredentials)
     : {
         [AuthKeys.GOOGLE_SERVICE_KEY]: serviceKey,
-        [AuthKeys.GOOGLE_API_KEY]: GOOGLE_KEY,
+        ...(!isVertexEndpoint && { [AuthKeys.GOOGLE_API_KEY]: GOOGLE_KEY }),
       };
 
   let clientOptions: GoogleConfigOptions = {};
@@ -79,11 +88,34 @@ export async function initializeGoogle({
     clientOptions.streamRate = allConfig.streamRate;
   }
 
+  /**
+   * Resolve configured Google headers at init (not at request time): the native
+   * Google auth header (`GOOGLE_AUTH_HEADER`) is built from the API key in
+   * `getGoogleConfig` and lives in the same `customHeaders` map. Resolving the
+   * admin templates here — before that key-derived header is added — keeps the
+   * key out of placeholder/env expansion (a user-provided `${ENV}` key can't leak
+   * server env) while still resolving admin headers (env, user, conversationId).
+   * `req.body` lacks the assistant message id at init, so `{{LIBRECHAT_BODY_MESSAGEID}}`
+   * is the one body placeholder unavailable here.
+   */
+  const mergedHeaders = mergeHeaders(allConfig?.headers, googleConfig?.headers);
+  const headers = mergedHeaders
+    ? resolveHeaders({ headers: mergedHeaders, user: req.user, body: req.body })
+    : undefined;
+
   clientOptions = {
     reverseProxyUrl: GOOGLE_REVERSE_PROXY ?? undefined,
     authHeader: isEnabled(GOOGLE_AUTH_HEADER) ?? undefined,
     proxy: PROXY ?? undefined,
+    ...(headers && { headers }),
     modelOptions: model_parameters ?? {},
+    forceVertex: isVertexEndpoint,
+    projectId: isVertexEndpoint
+      ? (process.env.VERTEX_PROJECT_ID ??
+        process.env.GOOGLE_CLOUD_PROJECT ??
+        process.env.GCLOUD_PROJECT ??
+        process.env.GOOGLE_PROJECT_ID)
+      : undefined,
     ...clientOptions,
   };
 
diff --git a/packages/api/src/endpoints/google/llm.spec.ts b/packages/api/src/endpoints/google/llm.spec.ts
index 0a65ab7a802..66ef6f84e70 100644
--- a/packages/api/src/endpoints/google/llm.spec.ts
+++ b/packages/api/src/endpoints/google/llm.spec.ts
@@ -1,5 +1,6 @@
 import { Providers } from '@librechat/agents';
 import { AuthKeys, ThinkingLevel } from 'librechat-data-provider';
+import type { GoogleClientOptions } from '@librechat/agents';
 import type * as t from '~/types';
 import { getGoogleConfig, getSafetySettings, knownGoogleParams } from './llm';
 
@@ -64,6 +65,23 @@ describe('getGoogleConfig', () => {
       expect(result.llmConfig).toHaveProperty('apiKey', 'raw-api-key-string');
     });
 
+    it('should not let project id force Vertex AI without the force flag', () => {
+      const credentials = {
+        [AuthKeys.GOOGLE_API_KEY]: 'test-api-key',
+      };
+
+      const result = getGoogleConfig(credentials, {
+        projectId: 'fiery-catwalk-385918',
+        modelOptions: {
+          model: 'gemini-2.5-flash',
+        },
+      });
+
+      expect(result.provider).toBe(Providers.GOOGLE);
+      expect(result.llmConfig).toHaveProperty('apiKey', 'test-api-key');
+      expect(result.llmConfig).not.toHaveProperty('authOptions');
+    });
+
     it('should handle model options including temperature and topP/topK', () => {
       const credentials = {
         [AuthKeys.GOOGLE_API_KEY]: 'test-api-key',
@@ -318,6 +336,53 @@ describe('getGoogleConfig', () => {
       expect(result.llmConfig).toHaveProperty('location', 'us-central1');
     });
 
+    it('should force Vertex AI ADC config with a project id even when an API key is present', () => {
+      const credentials = {
+        [AuthKeys.GOOGLE_API_KEY]: 'test-api-key',
+      };
+
+      const result = getGoogleConfig(credentials, {
+        forceVertex: true,
+        projectId: 'fiery-catwalk-385918',
+        modelOptions: {
+          model: 'gemini-2.5-flash',
+        },
+      });
+
+      expect(result.provider).toBe(Providers.VERTEXAI);
+      expect(result.llmConfig).not.toHaveProperty('apiKey');
+      expect((result.llmConfig as Record<string, unknown>).authOptions).toEqual({
+        projectId: 'fiery-catwalk-385918',
+      });
+    });
+
+    it('should force Vertex AI service-account config when an API key is also present', () => {
+      const credentials = {
+        [AuthKeys.GOOGLE_API_KEY]: 'test-api-key',
+        [AuthKeys.GOOGLE_SERVICE_KEY]: {
+          project_id: 'test-project',
+          client_email: 'test@test-project.iam.gserviceaccount.com',
+          private_key: 'test-private-key',
+        },
+      };
+
+      const result = getGoogleConfig(credentials, {
+        forceVertex: true,
+        modelOptions: {
+          model: 'gemini-2.5-flash',
+        },
+      });
+
+      expect(result.provider).toBe(Providers.VERTEXAI);
+      expect(result.llmConfig).not.toHaveProperty('apiKey');
+      expect((result.llmConfig as Record<string, unknown>).authOptions).toMatchObject({
+        projectId: 'test-project',
+        credentials: expect.objectContaining({
+          project_id: 'test-project',
+        }),
+      });
+    });
+
     it('should use GOOGLE_LOC env variable for Vertex AI location', () => {
       process.env.GOOGLE_LOC = 'europe-west1';
 
@@ -1442,4 +1507,34 @@ describe('knownGoogleParams', () => {
     expect(knownGoogleParams.has('frequency_penalty')).toBe(false);
     expect(knownGoogleParams.has('presence_penalty')).toBe(false);
   });
+
+  describe('custom headers', () => {
+    const credentials = { [AuthKeys.GOOGLE_API_KEY]: 'test-api-key' };
+
+    it('attaches admin-configured headers to customHeaders, keeping placeholders intact', () => {
+      const result = getGoogleConfig(credentials, {
+        modelOptions: { model: 'gemini-1.5-flash' },
+        headers: {
+          'cf-aig-metadata': '{"user_email":"{{LIBRECHAT_USER_EMAIL}}"}',
+        },
+      });
+
+      expect((result.llmConfig as GoogleClientOptions).customHeaders).toEqual({
+        'cf-aig-metadata': '{"user_email":"{{LIBRECHAT_USER_EMAIL}}"}',
+      });
+    });
+
+    it('does not let custom headers override the provider-managed Authorization header', () => {
+      const result = getGoogleConfig(credentials, {
+        modelOptions: { model: 'gemini-1.5-flash' },
+        authHeader: true,
+        headers: { Authorization: 'Bearer attacker', 'X-Conversation-Id': 'cid' },
+      });
+
+      expect((result.llmConfig as GoogleClientOptions).customHeaders).toEqual({
+        Authorization: 'Bearer test-api-key',
+        'X-Conversation-Id': 'cid',
+      });
+    });
+  });
 });
diff --git a/packages/api/src/endpoints/google/llm.ts b/packages/api/src/endpoints/google/llm.ts
index 98802dcd158..b0d3f8cea5b 100644
--- a/packages/api/src/endpoints/google/llm.ts
+++ b/packages/api/src/endpoints/google/llm.ts
@@ -3,6 +3,7 @@ import { googleSettings, AuthKeys, removeNullishValues } from 'librechat-data-pr
 import type { GoogleClientOptions, VertexAIClientOptions } from '@librechat/agents';
 import type { GoogleAIToolType } from '@librechat/agents/langchain/google-common';
 import type * as t from '~/types';
+import { mergeHeaders } from '~/utils/headers';
 import { isEnabled } from '~/utils';
 
 type GoogleThinkingLevel = 'THINKING_LEVEL_UNSPECIFIED' | 'MINIMAL' | 'LOW' | 'MEDIUM' | 'HIGH';
@@ -52,7 +53,7 @@ type GoogleModelOptions = Partial<t.GoogleParameters> &
   Partial<Record<BlockedModelOptionParam, unknown>>;
 
 /** Known Google/Vertex AI parameters that map directly to the client config */
-export const knownGoogleParams = new Set([
+export const knownGoogleParams: Set<string> = new Set([
   'model',
   'modelName',
   'temperature',
@@ -264,6 +265,10 @@ function applyVertexMultiRegionEndpoint(config: VertexAIClientOptions & { endpoi
   }
 }
 
+function hasServiceKeyCredentials(serviceKey: Record<string, unknown>): boolean {
+  return Object.keys(serviceKey).length > 0;
+}
+
 export function getSafetySettings(
   model?: string,
 ): Array<{ category: string; threshold: string }> | undefined {
@@ -316,7 +321,14 @@ export function getGoogleConfig(
   credentials: string | t.GoogleCredentials | undefined,
   options: t.GoogleConfigOptions = {},
   acceptRawApiKey = false,
-) {
+): {
+  /** @type {GoogleAIToolType[]} */
+  tools: GoogleAIToolType[];
+  /** @type {Providers.GOOGLE | Providers.VERTEXAI} */
+  provider: Providers.VERTEXAI | Providers.GOOGLE;
+  /** @type {GoogleClientOptions | VertexAIClientOptions} */
+  llmConfig: VertexAIClientOptions | GoogleClientOptions;
+} {
   let creds: t.GoogleCredentials = {};
   if (acceptRawApiKey && typeof credentials === 'string') {
     creds[AuthKeys.GOOGLE_API_KEY] = credentials;
@@ -337,7 +349,12 @@ export function getGoogleConfig(
     typeof serviceKeyRaw === 'string' ? JSON.parse(serviceKeyRaw) : (serviceKeyRaw ?? {});
 
   const apiKey = creds[AuthKeys.GOOGLE_API_KEY] ?? null;
-  const project_id = !apiKey ? (serviceKey?.project_id ?? null) : null;
+  let project_id = null;
+  if (options.forceVertex === true) {
+    project_id = options.projectId ?? serviceKey?.project_id ?? null;
+  } else if (!apiKey) {
+    project_id = serviceKey?.project_id ?? null;
+  }
 
   const reverseProxyUrl = options.reverseProxyUrl;
   const authHeader = options.authHeader;
@@ -373,7 +390,7 @@ export function getGoogleConfig(
 
   let provider;
 
-  if (project_id) {
+  if (options.forceVertex === true || project_id) {
     provider = Providers.VERTEXAI;
   } else {
     provider = Providers.GOOGLE;
@@ -381,10 +398,13 @@ export function getGoogleConfig(
 
   // If we have a GCP project => Vertex AI
   if (provider === Providers.VERTEXAI) {
-    (llmConfig as VertexAIClientOptions).authOptions = {
-      credentials: { ...serviceKey },
-      projectId: project_id,
-    };
+    (llmConfig as VertexAIClientOptions).authOptions = removeNullishValues(
+      {
+        ...(hasServiceKeyCredentials(serviceKey) && { credentials: { ...serviceKey } }),
+        projectId: project_id,
+      },
+      true,
+    );
     const location = process.env.GOOGLE_LOC || 'us-central1';
     (llmConfig as VertexAIClientOptions).location = location;
   } else if (apiKey && provider === Providers.GOOGLE) {
@@ -470,6 +490,19 @@ export function getGoogleConfig(
     };
   }
 
+  /**
+   * Attach admin-configured custom headers (e.g. AI-gateway metadata) beneath
+   * the provider-managed `Authorization` header above, so auth always wins.
+   * `options.headers` are already resolved by `initializeGoogle`, keeping the
+   * key-derived `Authorization` out of placeholder/env expansion.
+   */
+  if (options.headers && Object.keys(options.headers).length > 0) {
+    (llmConfig as GoogleClientOptions).customHeaders = mergeHeaders(
+      options.headers,
+      (llmConfig as GoogleClientOptions).customHeaders as Record<string, string> | undefined,
+    );
+  }
+
   /** Handle defaultParams first - only process Google-native params if undefined */
   if (options.defaultParams && typeof options.defaultParams === 'object') {
     for (const [key, value] of Object.entries(options.defaultParams)) {
diff --git a/packages/api/src/endpoints/index.ts b/packages/api/src/endpoints/index.ts
index 208181168ec..4be03df1e38 100644
--- a/packages/api/src/endpoints/index.ts
+++ b/packages/api/src/endpoints/index.ts
@@ -5,3 +5,6 @@ export * from './custom';
 export * from './google';
 export * from './models';
 export * from './openai';
+export * from './pricing';
+export * from './projection';
+export * from './tokenConfig';
diff --git a/packages/api/src/endpoints/keys.ts b/packages/api/src/endpoints/keys.ts
new file mode 100644
index 00000000000..14075618cd3
--- /dev/null
+++ b/packages/api/src/endpoints/keys.ts
@@ -0,0 +1,19 @@
+import crypto from 'crypto';
+
+/** NUL-delimited scoped keys cannot collide with legacy endpoint-name keys. */
+export const SCOPED_TOKEN_CONFIG_KEY_PREFIX = '\u0000token-config:v2\u0000';
+
+type TokenConfigScope = 'tenant' | 'tenant-user';
+
+export function getScopedTokenConfigKey(scope: TokenConfigScope, parts: string[]): string {
+  const digest = crypto.createHash('sha256').update(JSON.stringify(parts)).digest('hex');
+  return `${SCOPED_TOKEN_CONFIG_KEY_PREFIX}${scope}\u0000${digest}`;
+}
+
+export function getModelCacheTokenConfigKey(cacheKey: string): string {
+  return `${SCOPED_TOKEN_CONFIG_KEY_PREFIX}models\u0000${cacheKey}`;
+}
+
+export function isScopedTokenConfigKey(tokenKey: string): boolean {
+  return tokenKey.startsWith(SCOPED_TOKEN_CONFIG_KEY_PREFIX);
+}
diff --git a/packages/api/src/endpoints/models.spec.ts b/packages/api/src/endpoints/models.spec.ts
index bb359968abe..c8292c8b10d 100644
--- a/packages/api/src/endpoints/models.spec.ts
+++ b/packages/api/src/endpoints/models.spec.ts
@@ -8,16 +8,23 @@ import {
   getBedrockModels,
   getAnthropicModels,
 } from './models';
+import { SCOPED_TOKEN_CONFIG_KEY_PREFIX } from './keys';
 
 jest.mock('axios');
 
 const mockCacheGet = jest.fn().mockResolvedValue(undefined);
 const mockCacheSet = jest.fn().mockResolvedValue(true);
+const mockTokenConfigGet = jest.fn().mockResolvedValue(undefined);
+const mockTokenConfigSet = jest.fn().mockResolvedValue(true);
 jest.mock('~/cache', () => ({
   standardCache: jest.fn().mockImplementation(() => ({
     get: mockCacheGet,
     set: mockCacheSet,
   })),
+  tokenConfigCache: jest.fn().mockImplementation(() => ({
+    get: mockTokenConfigGet,
+    set: mockTokenConfigSet,
+  })),
 }));
 
 jest.mock('~/utils', () => {
@@ -51,6 +58,8 @@ mockedAxios.get.mockResolvedValue({
 beforeEach(() => {
   mockCacheGet.mockReset().mockResolvedValue(undefined);
   mockCacheSet.mockReset().mockResolvedValue(true);
+  mockTokenConfigGet.mockReset().mockResolvedValue(undefined);
+  mockTokenConfigSet.mockReset().mockResolvedValue(true);
 });
 
 describe('fetchModels', () => {
@@ -149,6 +158,92 @@ describe('fetchModels', () => {
     );
   });
 
+  it('should resolve template variables in custom headers on the OpenAI-compatible path', async () => {
+    const customHeaders = {
+      Authorization: 'Bearer {{LIBRECHAT_OPENID_ID_TOKEN}}',
+      'X-User-Email': '{{LIBRECHAT_USER_EMAIL}}',
+    };
+    const userObject = { id: 'user123', email: 'user@example.com' };
+
+    (resolveHeaders as jest.Mock).mockReturnValueOnce({
+      Authorization: 'Bearer resolved-jwt',
+      'X-User-Email': 'user@example.com',
+    });
+
+    await fetchModels({
+      user: 'user123',
+      apiKey: 'testApiKey',
+      baseURL: 'https://api.test.com',
+      name: 'TestAPI',
+      headers: customHeaders,
+      userObject,
+    });
+
+    expect(resolveHeaders).toHaveBeenCalledWith({
+      headers: customHeaders,
+      user: userObject,
+    });
+    expect(mockedAxios.get).toHaveBeenCalledWith(
+      expect.stringContaining('https://api.test.com/models'),
+      expect.objectContaining({
+        headers: expect.objectContaining({
+          Authorization: 'Bearer resolved-jwt',
+          'X-User-Email': 'user@example.com',
+        }),
+      }),
+    );
+  });
+
+  it('should preserve a config-supplied Authorization header instead of overwriting with the apiKey default', async () => {
+    const customHeaders = {
+      Authorization: 'Bearer user-jwt-token',
+    };
+
+    await fetchModels({
+      user: 'user123',
+      apiKey: 'testApiKey',
+      baseURL: 'https://api.test.com',
+      name: 'TestAPI',
+      headers: customHeaders,
+    });
+
+    expect(mockedAxios.get).toHaveBeenCalledWith(
+      expect.stringContaining('https://api.test.com/models'),
+      expect.objectContaining({
+        headers: expect.objectContaining({
+          Authorization: 'Bearer user-jwt-token',
+        }),
+      }),
+    );
+    expect(mockedAxios.get).not.toHaveBeenCalledWith(
+      expect.any(String),
+      expect.objectContaining({
+        headers: expect.objectContaining({
+          Authorization: 'Bearer testApiKey',
+        }),
+      }),
+    );
+  });
+
+  it('should treat Authorization header case-insensitively when skipping the apiKey default', async () => {
+    const customHeaders = {
+      authorization: 'Bearer lower-case-user-jwt',
+    };
+
+    await fetchModels({
+      user: 'user123',
+      apiKey: 'testApiKey',
+      baseURL: 'https://api.test.com',
+      name: 'TestAPI',
+      headers: customHeaders,
+    });
+
+    const lastCall = mockedAxios.get.mock.calls[mockedAxios.get.mock.calls.length - 1];
+    const sentHeaders = lastCall[1]?.headers ?? {};
+    expect(sentHeaders.authorization).toBe('Bearer lower-case-user-jwt');
+    expect(sentHeaders.Authorization).toBeUndefined();
+  });
+
   afterEach(() => {
     jest.clearAllMocks();
   });
@@ -177,6 +272,7 @@ describe('fetchModels with createTokenConfig true', () => {
   };
 
   beforeEach(() => {
+    mockedAxios.get.mockClear();
     mockedAxios.get.mockResolvedValue({ data });
   });
 
@@ -192,6 +288,59 @@ describe('fetchModels with createTokenConfig true', () => {
     expect(processModelData).toHaveBeenCalled();
     expect(processModelData).toHaveBeenCalledWith(data);
   });
+
+  it('backfills requested token config when model cache hits', async () => {
+    const endpointTokenConfig = {
+      'model-1': { prompt: 2000, completion: 1000, context: 1024 },
+    };
+    mockCacheGet.mockResolvedValue(['model-1']);
+    mockTokenConfigGet.mockResolvedValue(endpointTokenConfig);
+
+    const models = await fetchModels({
+      apiKey: 'testApiKey',
+      baseURL: 'https://api.test.com',
+      name: 'TestAPI',
+      tokenKey: `${SCOPED_TOKEN_CONFIG_KEY_PREFIX}tenant\u0000abc123`,
+    });
+
+    expect(models).toEqual(['model-1']);
+    expect(mockedAxios.get).not.toHaveBeenCalled();
+    expect(
+      mockTokenConfigGet.mock.calls[0][0].startsWith(`${SCOPED_TOKEN_CONFIG_KEY_PREFIX}models`),
+    ).toBe(true);
+    expect(mockTokenConfigSet).toHaveBeenCalledWith(
+      `${SCOPED_TOKEN_CONFIG_KEY_PREFIX}tenant\u0000abc123`,
+      endpointTokenConfig,
+    );
+  });
+
+  it('fetches and writes token config when scoped token key is missing on model cache hit', async () => {
+    mockCacheGet.mockResolvedValue(['cached-model']);
+    mockTokenConfigGet.mockResolvedValue(undefined);
+
+    const models = await fetchModels({
+      apiKey: 'testApiKey',
+      baseURL: 'https://api.test.com',
+      name: 'TestAPI',
+      tokenKey: `${SCOPED_TOKEN_CONFIG_KEY_PREFIX}tenant\u0000def456`,
+    });
+
+    expect(models).toEqual(['model-1', 'model-2']);
+    expect(mockedAxios.get).toHaveBeenCalledWith(
+      expect.stringContaining('https://api.test.com/models'),
+      expect.any(Object),
+    );
+    expect(mockTokenConfigSet).toHaveBeenCalledWith(
+      `${SCOPED_TOKEN_CONFIG_KEY_PREFIX}tenant\u0000def456`,
+      expect.objectContaining({
+        'model-1': expect.objectContaining({ context: 1024 }),
+      }),
+    );
+    const sourceSetCall = mockTokenConfigSet.mock.calls.find(([key]) =>
+      key.startsWith(`${SCOPED_TOKEN_CONFIG_KEY_PREFIX}models`),
+    );
+    expect(sourceSetCall).toBeDefined();
+  });
 });
 
 describe('getOpenAIModels', () => {
@@ -209,7 +358,7 @@ describe('getOpenAIModels', () => {
 
   it('returns default models when no environment configurations are provided (and fetch fails)', async () => {
     const models = await getOpenAIModels({ user: 'user456' });
-    expect(models).toContain('gpt-4');
+    expect(models).toContain('gpt-5.5');
   });
 
   it('returns default models when OpenAI API key is user provided', async () => {
@@ -220,7 +369,7 @@ describe('getOpenAIModels', () => {
 
     expect(mockedAxios.get).not.toHaveBeenCalled();
     expect(models).not.toContain('should-not-appear');
-    expect(models).toContain('gpt-4');
+    expect(models).toContain('gpt-5.5');
   });
 
   it('fetches models when OpenAI API key is provided through options', async () => {
@@ -257,6 +406,24 @@ describe('getOpenAIModels', () => {
     expect(models).toEqual(['gpt-env-key']);
   });
 
+  it('forwards configured custom headers to the OpenAI model fetch', async () => {
+    mockedAxios.get.mockResolvedValue({ data: { data: [{ id: 'gpt-x' }] } });
+    process.env.OPENAI_API_KEY = 'sk-env';
+
+    await getOpenAIModels({
+      user: 'user456',
+      headers: { 'cf-aig-token': 'tok' },
+      userObject: { id: 'user456' },
+    });
+
+    expect(mockedAxios.get).toHaveBeenCalledWith(
+      expect.stringContaining('https://api.openai.com/v1/models'),
+      expect.objectContaining({
+        headers: expect.objectContaining({ 'cf-aig-token': 'tok' }),
+      }),
+    );
+  });
+
   it('returns `AZURE_OPENAI_MODELS` with `azure` flag (and fetch fails)', async () => {
     process.env.AZURE_OPENAI_MODELS = 'azure-model,azure-model-2';
     const models = await getOpenAIModels({ azure: true });
@@ -335,6 +502,26 @@ describe('getOpenAIModels sorting behavior', () => {
     ];
     expect(models).toEqual(expectedOrder);
   });
+
+  it('keeps chat-latest when filtering official OpenAI results', async () => {
+    mockedAxios.get.mockResolvedValue({
+      data: {
+        data: [
+          { id: 'chat-latest' },
+          { id: 'gpt-5.5' },
+          { id: 'dall-e-3' },
+          { id: 'gpt-realtime-2' },
+        ],
+      },
+    });
+
+    const models = await getOpenAIModels({ user: 'user456' });
+
+    expect(models).toContain('chat-latest');
+    expect(models).toContain('gpt-5.5');
+    expect(models).not.toContain('dall-e-3');
+    expect(models).not.toContain('gpt-realtime-2');
+  });
 });
 
 describe('fetchModels with Ollama specific logic', () => {
@@ -631,7 +818,7 @@ describe('getAnthropicModels', () => {
     );
   });
 
-  it('should pass custom headers for Anthropic endpoint', async () => {
+  it('forwards custom headers for the Anthropic endpoint alongside managed auth', async () => {
     const customHeaders = {
       'X-Custom-Header': 'custom-value',
     };
@@ -654,12 +841,32 @@ describe('getAnthropicModels', () => {
       expect.any(String),
       expect.objectContaining({
         headers: {
+          'X-Custom-Header': 'custom-value',
           'x-api-key': 'test-anthropic-key',
           'anthropic-version': expect.any(String),
         },
       }),
     );
   });
+
+  it('threads configured headers through getAnthropicModels to the fetch', async () => {
+    delete process.env.ANTHROPIC_MODELS;
+    process.env.ANTHROPIC_API_KEY = 'test-anthropic-key';
+    mockedAxios.get.mockResolvedValue({ data: { data: [{ id: 'claude-3' }] } });
+
+    await getAnthropicModels({
+      user: 'user123',
+      headers: { 'cf-aig-token': 'tok' },
+      userObject: { id: 'user123' },
+    });
+
+    expect(mockedAxios.get).toHaveBeenCalledWith(
+      expect.any(String),
+      expect.objectContaining({
+        headers: expect.objectContaining({ 'cf-aig-token': 'tok' }),
+      }),
+    );
+  });
 });
 
 describe('getGoogleModels', () => {
@@ -778,4 +985,41 @@ describe('fetchModels caching behavior', () => {
       expect.any(Number),
     );
   });
+
+  it('skips MODEL_QUERIES cache when both headers and userObject are supplied (user-scoped response)', async () => {
+    await fetchModels({
+      apiKey: 'key',
+      baseURL: 'https://api.test.com',
+      name: 'TestAPI',
+      headers: { Authorization: 'Bearer some-user-token' },
+      userObject: { id: 'user-1' },
+    });
+
+    expect(mockCacheGet).not.toHaveBeenCalled();
+    expect(mockCacheSet).not.toHaveBeenCalled();
+  });
+
+  it('still uses cache when headers are supplied without a userObject (no per-user resolution)', async () => {
+    await fetchModels({
+      apiKey: 'key',
+      baseURL: 'https://api.test.com',
+      name: 'TestAPI',
+      headers: { 'X-Static-Header': 'static-value' },
+    });
+
+    expect(mockCacheGet).toHaveBeenCalled();
+    expect(mockCacheSet).toHaveBeenCalled();
+  });
+
+  it('still uses cache when userObject is supplied without headers', async () => {
+    await fetchModels({
+      apiKey: 'key',
+      baseURL: 'https://api.test.com',
+      name: 'TestAPI',
+      userObject: { id: 'user-1' },
+    });
+
+    expect(mockCacheGet).toHaveBeenCalled();
+    expect(mockCacheSet).toHaveBeenCalled();
+  });
 });
diff --git a/packages/api/src/endpoints/models.ts b/packages/api/src/endpoints/models.ts
index aac168ad7a9..239dd4b8d32 100644
--- a/packages/api/src/endpoints/models.ts
+++ b/packages/api/src/endpoints/models.ts
@@ -1,7 +1,6 @@
-import crypto from 'crypto';
 import axios from 'axios';
+import crypto from 'crypto';
 import { logger } from '@librechat/data-schemas';
-import { HttpsProxyAgent } from 'https-proxy-agent';
 import {
   Time,
   CacheKeys,
@@ -10,6 +9,7 @@ import {
   defaultModels,
 } from 'librechat-data-provider';
 import type { IUser } from '@librechat/data-schemas';
+import type { AxiosRequestConfig } from 'axios';
 import {
   processModelData,
   extractBaseURL,
@@ -18,7 +18,9 @@ import {
   deriveBaseURL,
   logAxiosError,
   inputSchema,
+  applyAxiosProxyConfig,
 } from '~/utils';
+import { getModelCacheTokenConfigKey, isScopedTokenConfigKey } from '~/endpoints/keys';
 import { standardCache, tokenConfigCache } from '~/cache';
 
 export interface FetchModelsParams {
@@ -80,6 +82,19 @@ async function fetchOllamaModels(
   return response.data.models.map((tag) => tag.name);
 }
 
+async function backfillTokenConfigFromModelCache(
+  cacheKey: string,
+  tokenKey: string,
+): Promise<boolean> {
+  const cachedTokenConfig = await tokenConfigCache().get(getModelCacheTokenConfigKey(cacheKey));
+  if (cachedTokenConfig == null) {
+    return false;
+  }
+
+  await tokenConfigCache().set(tokenKey, cachedTokenConfig);
+  return true;
+}
+
 /**
  * Splits a string by commas and trims each resulting value.
  * @param input - The input string to split.
@@ -126,13 +141,31 @@ export async function fetchModels({
     return models;
   }
 
-  const shouldCache = !skipCache && !(userIdQuery && user);
+  // The MODEL_QUERIES cache is keyed by baseURL+apiKey only. That's safe
+  // when the response is identical for every caller, but fails when callers
+  // forward header templates that resolve to a user-bound value (e.g.
+  // `Authorization: Bearer {{LIBRECHAT_OPENID_ID_TOKEN}}`): one user's
+  // filtered list could otherwise be served to the next request that
+  // shares the same baseURL+apiKey. Skip the cache whenever both `headers`
+  // and `userObject` are supplied, since that's the signal the caller is
+  // resolving headers against a specific user's identity.
+  const hasUserScopedHeaders = !!headers && Object.keys(headers).length > 0 && !!userObject;
+  const shouldCache = !skipCache && !(userIdQuery && user) && !hasUserScopedHeaders;
   const cacheKey = shouldCache ? modelsCacheKey(baseURL ?? '', apiKey) : '';
   const modelsCache = shouldCache ? standardCache(CacheKeys.MODEL_QUERIES) : null;
   if (modelsCache && cacheKey) {
     const cachedModels = await modelsCache.get(cacheKey);
     if (cachedModels) {
-      return cachedModels as string[];
+      if (createTokenConfig && tokenKey) {
+        const tokenConfigBackfilled = await backfillTokenConfigFromModelCache(cacheKey, tokenKey);
+        if (!tokenConfigBackfilled && isScopedTokenConfigKey(tokenKey)) {
+          models = cachedModels as string[];
+        } else {
+          return cachedModels as string[];
+        }
+      } else {
+        return cachedModels as string[];
+      }
     }
   }
 
@@ -156,28 +189,43 @@ export async function fetchModels({
   }
 
   try {
-    const options: {
+    // Resolve template variables (e.g. {{LIBRECHAT_OPENID_ID_TOKEN}}) in the
+    // configured headers, mirroring fetchOllamaModels above. Without this,
+    // placeholder strings are forwarded literally on the model-fetch path.
+    const resolvedHeaders = resolveHeaders({
+      headers: headers ?? undefined,
+      user: userObject,
+    });
+
+    const options: AxiosRequestConfig & {
       headers: Record<string, string>;
       timeout: number;
-      httpsAgent?: HttpsProxyAgent<string>;
     } = {
       headers: {
-        ...(headers ?? {}),
+        ...resolvedHeaders,
       },
       timeout: 5000,
     };
 
     if (name === EModelEndpoint.anthropic) {
+      // Keep configured custom headers (e.g. gateway metadata) while the
+      // provider-managed auth/version headers stay authoritative.
       options.headers = {
+        ...resolvedHeaders,
         'x-api-key': apiKey,
         'anthropic-version': process.env.ANTHROPIC_VERSION || '2023-06-01',
       };
     } else {
-      options.headers.Authorization = `Bearer ${apiKey}`;
-    }
-
-    if (process.env.PROXY) {
-      options.httpsAgent = new HttpsProxyAgent(process.env.PROXY);
+      // Only fall back to the apiKey-based Bearer when the configured
+      // headers did not already supply an Authorization. This lets
+      // auth-aware proxies (e.g. LiteLLM with JWT auth) receive the user's
+      // token on /v1/models so they can return a per-user filtered list.
+      const hasAuthHeader = Object.keys(options.headers).some(
+        (k) => k.toLowerCase() === 'authorization',
+      );
+      if (!hasAuthHeader) {
+        options.headers.Authorization = `Bearer ${apiKey}`;
+      }
     }
 
     if (process.env.OPENAI_ORGANIZATION && baseURL?.includes('openai')) {
@@ -188,6 +236,7 @@ export async function fetchModels({
     if (user && userIdQuery) {
       url.searchParams.append('user', user);
     }
+    applyAxiosProxyConfig(options, url);
     const res = await axios.get(url.toString(), options);
 
     const input = res.data;
@@ -195,7 +244,11 @@ export async function fetchModels({
     const validationResult = inputSchema.safeParse(input);
     if (validationResult.success && createTokenConfig) {
       const endpointTokenConfig = processModelData(input);
-      await tokenConfigCache().set(tokenKey ?? name, endpointTokenConfig);
+      const cache = tokenConfigCache();
+      await cache.set(tokenKey ?? name, endpointTokenConfig);
+      if (modelsCache && cacheKey) {
+        await cache.set(getModelCacheTokenConfigKey(cacheKey), endpointTokenConfig);
+      }
     }
     models = input.data.map((item: { id: string }) => item.id);
   } catch (error) {
@@ -226,6 +279,10 @@ export interface GetOpenAIModelsOptions {
   openAIApiKey?: string;
   /** Skip MODEL_QUERIES cache (e.g., for user-provided keys) */
   skipCache?: boolean;
+  /** Configured custom headers forwarded to the (gateway-fronted) provider */
+  headers?: Record<string, string> | null;
+  /** User object for resolving header placeholders */
+  userObject?: Partial<IUser>;
 }
 
 function resolveOpenAIApiKey(opts: GetOpenAIModelsOptions): string | undefined {
@@ -266,6 +323,8 @@ export async function fetchOpenAIModels(
       user: opts.user,
       name: EModelEndpoint.openAI,
       skipCache: opts.skipCache,
+      headers: opts.headers,
+      userObject: opts.userObject,
     });
   }
 
@@ -274,7 +333,7 @@ export async function fetchOpenAIModels(
   }
 
   if (baseURL === openaiBaseURL) {
-    const regex = /(text-davinci-003|gpt-|o\d+)/;
+    const regex = /(text-davinci-003|gpt-|o\d+|chat-latest)/;
     const excludeRegex = /audio|realtime/;
     models = models.filter((model) => regex.test(model) && !excludeRegex.test(model));
     const instructModels = models.filter((model) => model.includes('instruct'));
@@ -326,7 +385,12 @@ export async function getOpenAIModels(opts: GetOpenAIModelsOptions = {}): Promis
  * @returns Promise resolving to array of model IDs
  */
 export async function fetchAnthropicModels(
-  opts: { user?: string; skipCache?: boolean } = {},
+  opts: {
+    user?: string;
+    skipCache?: boolean;
+    headers?: Record<string, string> | null;
+    userObject?: Partial<IUser>;
+  } = {},
   _models: string[] = [],
 ): Promise<string[]> {
   let models = _models.slice() ?? [];
@@ -351,6 +415,8 @@ export async function fetchAnthropicModels(
       name: EModelEndpoint.anthropic,
       tokenKey: EModelEndpoint.anthropic,
       skipCache: opts.skipCache,
+      headers: opts.headers,
+      userObject: opts.userObject,
     });
   }
 
@@ -367,7 +433,12 @@ export async function fetchAnthropicModels(
  * @returns Promise resolving to array of model IDs
  */
 export async function getAnthropicModels(
-  opts: { user?: string; vertexModels?: string[] } = {},
+  opts: {
+    user?: string;
+    vertexModels?: string[];
+    headers?: Record<string, string> | null;
+    userObject?: Partial<IUser>;
+  } = {},
 ): Promise<string[]> {
   const models = defaultModels[EModelEndpoint.anthropic];
 
diff --git a/packages/api/src/endpoints/openai/config.ts b/packages/api/src/endpoints/openai/config.ts
index 3cc1c68cc13..521590c7827 100644
--- a/packages/api/src/endpoints/openai/config.ts
+++ b/packages/api/src/endpoints/openai/config.ts
@@ -1,4 +1,3 @@
-import { ProxyAgent } from 'undici';
 import { Providers } from '@librechat/agents';
 import { KnownEndpoints, EModelEndpoint, ReasoningParameterFormat } from 'librechat-data-provider';
 import type * as t from '~/types';
@@ -6,8 +5,10 @@ import { getLLMConfig as getAnthropicLLMConfig } from '~/endpoints/anthropic/llm
 import { getOpenAILLMConfig, extractDefaultParams } from './llm';
 import { getGoogleConfig } from '~/endpoints/google/llm';
 import { transformToOpenAIConfig } from './transform';
+import { getProxyDispatcher } from '~/utils/proxy';
 import { constructAzureURL } from '~/utils/azure';
 import { createFetch } from '~/utils/generators';
+import { mergeHeaders } from '~/utils/headers';
 
 type Fetch = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
 
@@ -50,26 +51,6 @@ function getReasoningFormat({
   return undefined;
 }
 
-function mergeHeadersPreservingAnthropicBeta(
-  headers: Record<string, string> | undefined,
-  defaultHeaders: Record<string, string>,
-): Record<string, string> {
-  const mergedHeaders = Object.assign({}, headers ?? {}, defaultHeaders);
-  const existingBetaHeader = headers?.['anthropic-beta'];
-  const defaultBetaHeader = defaultHeaders['anthropic-beta'];
-
-  if (existingBetaHeader && defaultBetaHeader) {
-    const betaValues = [existingBetaHeader, defaultBetaHeader]
-      .flatMap((value) => value.split(','))
-      .map((value) => value.trim())
-      .filter(Boolean);
-
-    mergedHeaders['anthropic-beta'] = Array.from(new Set(betaValues)).join(',');
-  }
-
-  return mergedHeaders;
-}
-
 /**
  * Generates configuration options for creating a language model (LLM) instance.
  * @param apiKey - The API key for authentication.
@@ -134,7 +115,7 @@ export function getOpenAIConfig(
     llmConfig = transformed.llmConfig;
     tools = anthropicResult.tools;
     if (transformed.configOptions?.defaultHeaders) {
-      headers = mergeHeadersPreservingAnthropicBeta(
+      headers = mergeHeaders(
         headers,
         transformed.configOptions.defaultHeaders as Record<string, string>,
       );
@@ -207,10 +188,10 @@ export function getOpenAIConfig(
     configOptions.defaultQuery = defaultQuery;
   }
 
-  if (proxy) {
-    const proxyAgent = new ProxyAgent(proxy);
+  const proxyDispatcher = getProxyDispatcher(proxy);
+  if (proxyDispatcher) {
     configOptions.fetchOptions = {
-      dispatcher: proxyAgent,
+      dispatcher: proxyDispatcher,
     };
   }
 
diff --git a/packages/api/src/endpoints/openai/initialize.spec.ts b/packages/api/src/endpoints/openai/initialize.spec.ts
index 85c8c1e8965..93111ae52f8 100644
--- a/packages/api/src/endpoints/openai/initialize.spec.ts
+++ b/packages/api/src/endpoints/openai/initialize.spec.ts
@@ -15,12 +15,14 @@ jest.mock('./config', () => ({
 }));
 
 jest.mock('~/utils', () => ({
+  ...jest.requireActual('~/utils'),
   getAzureCredentials: jest.fn(),
   resolveHeaders: jest.fn(() => ({})),
   isUserProvided: (val: string) => val === 'user_provided',
   checkUserKeyExpiry: jest.fn(),
 }));
 
+import { getAzureCredentials } from '~/utils';
 import { initializeOpenAI } from './initialize';
 
 function createParams(env: Record<string, string | undefined>): BaseInitializeParams {
@@ -134,3 +136,83 @@ describe('initializeOpenAI – SSRF guard wiring', () => {
     expect(mockGetOpenAIConfig).not.toHaveBeenCalled();
   });
 });
+
+describe('initializeOpenAI – custom headers', () => {
+  afterEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('forwards configured endpoint headers (merged over endpoints.all) to getOpenAIConfig', async () => {
+    const params = createParams({ OPENAI_API_KEY: 'sk-test' });
+    (params.req.config as { endpoints: Record<string, unknown> }).endpoints = {
+      all: { headers: { 'X-Common': 'all', 'X-Override': 'all' } },
+      [EModelEndpoint.openAI]: {
+        headers: { 'X-Override': 'openai', 'cf-aig-metadata': '{{LIBRECHAT_BODY_CONVERSATIONID}}' },
+      },
+    };
+
+    try {
+      await initializeOpenAI(params);
+    } finally {
+      (params as unknown as { _restore: () => void })._restore();
+    }
+
+    const options = mockGetOpenAIConfig.mock.calls[0][1] as { headers?: Record<string, string> };
+    expect(options.headers).toEqual({
+      'X-Common': 'all',
+      'X-Override': 'openai',
+      'cf-aig-metadata': '{{LIBRECHAT_BODY_CONVERSATIONID}}',
+    });
+  });
+
+  it('does not set headers when none are configured', async () => {
+    const params = createParams({ OPENAI_API_KEY: 'sk-test' });
+
+    try {
+      await initializeOpenAI(params);
+    } finally {
+      (params as unknown as { _restore: () => void })._restore();
+    }
+
+    const options = mockGetOpenAIConfig.mock.calls[0][1] as { headers?: Record<string, string> };
+    expect(options.headers).toBeUndefined();
+  });
+
+  it('withholds configured headers when the user supplies the base URL', async () => {
+    const params = createParams({
+      OPENAI_API_KEY: 'sk-test',
+      OPENAI_REVERSE_PROXY: AuthType.USER_PROVIDED,
+    });
+    (params.req.config as { endpoints: Record<string, unknown> }).endpoints = {
+      [EModelEndpoint.openAI]: { headers: { 'X-Secret': '${GATEWAY_SECRET}' } },
+    };
+
+    try {
+      await initializeOpenAI(params);
+    } finally {
+      (params as unknown as { _restore: () => void })._restore();
+    }
+
+    const options = mockGetOpenAIConfig.mock.calls[0][1] as { headers?: Record<string, string> };
+    expect(options.headers).toBeUndefined();
+  });
+
+  it('applies endpoints.all headers to the env-based Azure path, unresolved at init', async () => {
+    (getAzureCredentials as jest.Mock).mockReturnValueOnce({ azureOpenAIApiKey: 'az-key' });
+    const params = createParams({ AZURE_API_KEY: 'az-key' });
+    params.endpoint = EModelEndpoint.azureOpenAI;
+    (params.req.config as { endpoints: Record<string, unknown> }).endpoints = {
+      all: { headers: { 'X-Global': '{{LIBRECHAT_USER_ID}}' } },
+    };
+
+    try {
+      await initializeOpenAI(params);
+    } finally {
+      (params as unknown as { _restore: () => void })._restore();
+    }
+
+    const options = mockGetOpenAIConfig.mock.calls[0][1] as { headers?: Record<string, string> };
+    // Left unresolved here; request-time resolveConfigHeaders resolves it once
+    expect(options.headers).toEqual({ 'X-Global': '{{LIBRECHAT_USER_ID}}' });
+  });
+});
diff --git a/packages/api/src/endpoints/openai/initialize.ts b/packages/api/src/endpoints/openai/initialize.ts
index 1b852deb1fa..b0c76b2aad7 100644
--- a/packages/api/src/endpoints/openai/initialize.ts
+++ b/packages/api/src/endpoints/openai/initialize.ts
@@ -5,7 +5,13 @@ import type {
   OpenAIConfigOptions,
   UserKeyValues,
 } from '~/types';
-import { getAzureCredentials, resolveHeaders, isUserProvided, checkUserKeyExpiry } from '~/utils';
+import {
+  mergeHeaders,
+  resolveHeaders,
+  isUserProvided,
+  checkUserKeyExpiry,
+  getAzureCredentials,
+} from '~/utils';
 import { validateEndpointURL } from '~/auth';
 import { getOpenAIConfig } from './config';
 
@@ -24,6 +30,8 @@ export async function initializeOpenAI({
   db,
 }: BaseInitializeParams): Promise<InitializeResultBase> {
   const appConfig = req.config;
+  const openAIConfig = appConfig?.endpoints?.[EModelEndpoint.openAI];
+  const allConfig = appConfig?.endpoints?.all;
   const { PROXY, OPENAI_API_KEY, AZURE_API_KEY, OPENAI_REVERSE_PROXY, AZURE_OPENAI_BASEURL } =
     process.env;
 
@@ -66,6 +74,18 @@ export async function initializeOpenAI({
     streaming: true,
   };
 
+  /**
+   * Custom headers are forwarded only when the destination URL is admin-trusted.
+   * When the user supplies the base URL, withhold them — they may carry
+   * `${SECRET}` gateway values or user/OpenID token placeholders resolved later
+   * by `resolveConfigHeaders`, which must not reach a user-controlled endpoint.
+   */
+  const trustedURL = !userProvidesURL;
+  const globalHeaders = trustedURL ? allConfig?.headers : undefined;
+  const openAIHeaders = trustedURL
+    ? mergeHeaders(allConfig?.headers, openAIConfig?.headers)
+    : undefined;
+
   const isAzureOpenAI = endpoint === EModelEndpoint.azureOpenAI;
   const azureConfig = isAzureOpenAI && appConfig?.endpoints?.[EModelEndpoint.azureOpenAI];
   let isServerless = false;
@@ -89,6 +109,13 @@ export async function initializeOpenAI({
       headers: { ...headers, ...(clientOptions.headers ?? {}) },
       user: req.user,
     });
+    /** `endpoints.all` headers apply globally, but stay unresolved here — they are
+     *  resolved once at request time by `resolveConfigHeaders`. Resolving them now
+     *  (in addition) would re-expand already-substituted user values, violating the
+     *  env-before-user invariant. Azure-managed headers stay authoritative. */
+    if (globalHeaders) {
+      clientOptions.headers = mergeHeaders(globalHeaders, clientOptions.headers);
+    }
 
     const groupName = modelGroupMap[modelName || '']?.group;
     if (groupName && groupMap[groupName]) {
@@ -113,6 +140,19 @@ export async function initializeOpenAI({
     clientOptions.azure =
       userProvidesKey && userValues?.apiKey ? JSON.parse(userValues.apiKey) : getAzureCredentials();
     apiKey = clientOptions.azure ? clientOptions.azure.azureOpenAIApiKey : undefined;
+    /** Env-var Azure path has no per-model headers; still honor global `all` headers. */
+    if (globalHeaders) {
+      clientOptions.headers = { ...globalHeaders };
+    }
+  } else {
+    /**
+     * Attach admin-configured custom headers for the built-in OpenAI endpoint
+     * (endpoint over global `all`). Kept unresolved here so request-body
+     * placeholders resolve at request time via `resolveConfigHeaders`.
+     */
+    if (openAIHeaders) {
+      clientOptions.headers = openAIHeaders;
+    }
   }
 
   if (userProvidesKey && !apiKey) {
@@ -145,8 +185,6 @@ export async function initializeOpenAI({
     (options as InitializeResultBase).useLegacyContent = true;
   }
 
-  const openAIConfig = appConfig?.endpoints?.[EModelEndpoint.openAI];
-  const allConfig = appConfig?.endpoints?.all;
   const azureRate = modelName?.includes('gpt-4') ? 30 : 17;
 
   let streamRate: number | undefined;
diff --git a/packages/api/src/endpoints/openai/llm.ts b/packages/api/src/endpoints/openai/llm.ts
index 94dc412fa57..2894c5a853d 100644
--- a/packages/api/src/endpoints/openai/llm.ts
+++ b/packages/api/src/endpoints/openai/llm.ts
@@ -18,7 +18,7 @@ type OpenAILLMConfig = Omit<Partial<t.OAIClientOptions>, 'verbosity'> &
     verbosity?: string | null;
   };
 
-export const knownOpenAIParams = new Set([
+export const knownOpenAIParams: Set<string> = new Set([
   // Constructor/Instance Parameters
   'model',
   'modelName',
@@ -407,7 +407,7 @@ export function extractDefaultParams(
 export function applyDefaultParams(
   target: Record<string, unknown>,
   defaults: Record<string, unknown>,
-) {
+): void {
   for (const [key, value] of Object.entries(defaults)) {
     if (target[key] === undefined) {
       target[key] = value;
diff --git a/packages/api/src/endpoints/pricing.spec.ts b/packages/api/src/endpoints/pricing.spec.ts
new file mode 100644
index 00000000000..388b71a5090
--- /dev/null
+++ b/packages/api/src/endpoints/pricing.spec.ts
@@ -0,0 +1,119 @@
+import mongoose from 'mongoose';
+import { EModelEndpoint } from 'librechat-data-provider';
+import { createTxMethods } from '@librechat/data-schemas';
+import type { EndpointTokenConfig } from '~/types';
+import { matchModelName, findMatchingPattern } from '~/utils';
+import { buildTokenConfigMap } from './pricing';
+
+/** Adapters: TxDeps types are looser than the utils signatures (string endpoint, undefined miss) */
+const { getValueKey, getMultiplier, getCacheMultiplier } = createTxMethods(mongoose, {
+  matchModelName: (model, endpoint) => matchModelName(model, endpoint as EModelEndpoint),
+  findMatchingPattern: (model, values) =>
+    findMatchingPattern(model, values as Record<string, number>) ?? undefined,
+});
+
+const deps = { getValueKey, getMultiplier, getCacheMultiplier };
+
+describe('buildTokenConfigMap', () => {
+  it('resolves context windows without pricing by default', () => {
+    const map = buildTokenConfigMap(
+      {
+        modelsConfig: {
+          [EModelEndpoint.openAI]: ['gpt-4o'],
+          [EModelEndpoint.anthropic]: ['claude-3-5-sonnet-20241022'],
+        },
+      },
+      deps,
+    );
+
+    expect(map[EModelEndpoint.openAI]['gpt-4o'].context).toBeGreaterThan(100000);
+    expect(map[EModelEndpoint.anthropic]['claude-3-5-sonnet-20241022'].context).toBe(200000);
+    expect(map[EModelEndpoint.openAI]['gpt-4o'].prompt).toBeUndefined();
+    expect(map[EModelEndpoint.openAI]['gpt-4o'].completion).toBeUndefined();
+  });
+
+  it('includes pattern-matched pricing when enabled', () => {
+    const map = buildTokenConfigMap(
+      {
+        modelsConfig: {
+          [EModelEndpoint.anthropic]: ['claude-3-5-sonnet-20241022'],
+        },
+        includePricing: true,
+      },
+      deps,
+    );
+
+    const tokenomics = map[EModelEndpoint.anthropic]['claude-3-5-sonnet-20241022'];
+    expect(tokenomics.prompt).toBe(3);
+    expect(tokenomics.completion).toBe(15);
+    expect(tokenomics.cacheWrite).toBe(3.75);
+    expect(tokenomics.cacheRead).toBe(0.3);
+  });
+
+  it('treats unknown endpoints as custom for context lookups', () => {
+    const map = buildTokenConfigMap(
+      {
+        modelsConfig: { MyProxy: ['gpt-4o-mini'] },
+      },
+      deps,
+    );
+
+    expect(map.MyProxy['gpt-4o-mini'].context).toBeGreaterThan(0);
+  });
+
+  it('prefers endpoint token config overrides for context and rates', () => {
+    const override: EndpointTokenConfig = {
+      'custom-model': { prompt: 1.5, completion: 4.5, context: 32000 },
+    };
+    const map = buildTokenConfigMap(
+      {
+        modelsConfig: { MyProxy: ['custom-model', 'gpt-4o-mini'] },
+        endpointTokenConfigs: { MyProxy: override },
+        includePricing: true,
+      },
+      deps,
+    );
+
+    expect(map.MyProxy['custom-model']).toEqual({
+      context: 32000,
+      prompt: 1.5,
+      completion: 4.5,
+    });
+    /** Models absent from the override fall back to static tables */
+    expect(map.MyProxy['gpt-4o-mini'].context).toBeGreaterThan(0);
+    expect(map.MyProxy['gpt-4o-mini'].prompt).toBeGreaterThan(0);
+  });
+
+  it('carries static cache rates from the override', () => {
+    const override: EndpointTokenConfig = {
+      'cached-model': {
+        prompt: 3,
+        completion: 15,
+        context: 200000,
+        cacheRead: 0.3,
+        cacheWrite: 3.75,
+      } as EndpointTokenConfig[string],
+    };
+    const map = buildTokenConfigMap(
+      {
+        modelsConfig: { MyProxy: ['cached-model'] },
+        endpointTokenConfigs: { MyProxy: override },
+        includePricing: true,
+      },
+      deps,
+    );
+
+    expect(map.MyProxy['cached-model']).toEqual({
+      context: 200000,
+      prompt: 3,
+      completion: 15,
+      cacheRead: 0.3,
+      cacheWrite: 3.75,
+    });
+  });
+
+  it('skips endpoints with empty model lists', () => {
+    const map = buildTokenConfigMap({ modelsConfig: { [EModelEndpoint.agents]: [] } }, deps);
+    expect(map[EModelEndpoint.agents]).toBeUndefined();
+  });
+});
diff --git a/packages/api/src/endpoints/pricing.ts b/packages/api/src/endpoints/pricing.ts
new file mode 100644
index 00000000000..6bf2aa6b4a4
--- /dev/null
+++ b/packages/api/src/endpoints/pricing.ts
@@ -0,0 +1,106 @@
+import { EModelEndpoint } from 'librechat-data-provider';
+import type { TModelsConfig, TTokenConfigMap, TModelTokenomics } from 'librechat-data-provider';
+import type { TxMethods } from '@librechat/data-schemas';
+import type { EndpointTokenConfig } from '~/types';
+import { getModelMaxTokens, maxTokensMap } from '~/utils';
+
+export interface TokenomicsDeps {
+  getValueKey: TxMethods['getValueKey'];
+  getMultiplier: TxMethods['getMultiplier'];
+  getCacheMultiplier: TxMethods['getCacheMultiplier'];
+}
+
+export interface TokenConfigParams {
+  /** endpoint → model list, from the resolved models config */
+  modelsConfig: TModelsConfig;
+  /** Per-endpoint overrides: fetched (e.g. OpenRouter) or yaml `tokenConfig` */
+  endpointTokenConfigs?: Record<string, EndpointTokenConfig | undefined>;
+  /** Include USD-per-1M rates; gated by `interface.contextCost` */
+  includePricing?: boolean;
+}
+
+/**
+ * Resolves context windows (and optionally pricing) for every configured
+ * model, server-side, so the client never reimplements pattern matching.
+ */
+export function buildTokenConfigMap(
+  params: TokenConfigParams,
+  deps: TokenomicsDeps,
+): TTokenConfigMap {
+  const { modelsConfig, endpointTokenConfigs, includePricing = false } = params;
+  const map: TTokenConfigMap = {};
+
+  for (const [endpoint, models] of Object.entries(modelsConfig)) {
+    if (!Array.isArray(models) || models.length === 0) {
+      continue;
+    }
+    const override = endpointTokenConfigs?.[endpoint];
+    const endpointKey = (
+      maxTokensMap[endpoint] != null ? endpoint : EModelEndpoint.custom
+    ) as EModelEndpoint;
+
+    const entry: Record<string, TModelTokenomics> = {};
+    for (const model of models) {
+      const tokenomics: TModelTokenomics = {};
+      /** getModelMaxTokens falls back to the built-in map for models absent
+       *  from a partial override, so a single call covers both cases. */
+      const context = getModelMaxTokens(model, endpointKey, override);
+      if (context != null) {
+        tokenomics.context = context;
+      }
+
+      if (includePricing) {
+        const overrideRates = override?.[model];
+        if (overrideRates?.prompt != null || overrideRates?.completion != null) {
+          tokenomics.prompt = overrideRates.prompt;
+          tokenomics.completion = overrideRates.completion;
+          /** Carry admin-configured cache rates; client falls back to the
+           *  prompt rate for whichever cache rate is absent */
+          if (overrideRates.cacheWrite != null) {
+            tokenomics.cacheWrite = overrideRates.cacheWrite;
+          }
+          if (overrideRates.cacheRead != null) {
+            tokenomics.cacheRead = overrideRates.cacheRead;
+          }
+        } else {
+          const valueKey = deps.getValueKey(model, endpoint);
+          tokenomics.prompt = deps.getMultiplier({
+            valueKey,
+            model,
+            endpoint,
+            tokenType: 'prompt',
+          });
+          tokenomics.completion = deps.getMultiplier({
+            valueKey,
+            model,
+            endpoint,
+            tokenType: 'completion',
+          });
+          const cacheWrite = deps.getCacheMultiplier({
+            valueKey,
+            model,
+            endpoint,
+            cacheType: 'write',
+          });
+          const cacheRead = deps.getCacheMultiplier({
+            valueKey,
+            model,
+            endpoint,
+            cacheType: 'read',
+          });
+          if (cacheWrite != null) {
+            tokenomics.cacheWrite = cacheWrite;
+          }
+          if (cacheRead != null) {
+            tokenomics.cacheRead = cacheRead;
+          }
+        }
+      }
+
+      entry[model] = tokenomics;
+    }
+    map[endpoint] = entry;
+  }
+
+  return map;
+}
diff --git a/packages/api/src/endpoints/projection.ts b/packages/api/src/endpoints/projection.ts
new file mode 100644
index 00000000000..62bc40dfedf
--- /dev/null
+++ b/packages/api/src/endpoints/projection.ts
@@ -0,0 +1,145 @@
+import { HumanMessage, AIMessage } from '@langchain/core/messages';
+import { Providers, createTokenCounter, projectAgentContextUsage } from '@librechat/agents';
+import type { TContextProjectionRequest, TContextUsageEvent } from 'librechat-data-provider';
+import type { BaseMessage } from '@langchain/core/messages';
+
+interface ProjectionMessage {
+  messageId: string;
+  parentMessageId?: string | null;
+  tokenCount?: number;
+  isCreatedByUser?: boolean;
+  text?: string;
+  /** Compaction marker written by the live path (`agents/usage.ts`); its
+   *  presence means the next call sends the summary + tail, not this raw chain. */
+  metadata?: { summaryUsedTokens?: number };
+}
+
+export interface ContextProjectionDeps {
+  /** Authenticated requester — branch lookups are scoped to this user. */
+  userId?: string;
+  getMessages: (
+    filter: { conversationId: string; user?: string },
+    select?: string,
+  ) => Promise<ProjectionMessage[]>;
+}
+
+/**
+ * Walks the parent chain from `tailId` to root and returns the branch messages
+ * oldest→newest. The visited set guards against cycles / self-referential links.
+ */
+function resolveBranch(messages: ProjectionMessage[], tailId: string): ProjectionMessage[] {
+  const byId = new Map<string, ProjectionMessage>();
+  for (const message of messages) {
+    byId.set(message.messageId, message);
+  }
+  const branch: ProjectionMessage[] = [];
+  const seen = new Set<string>();
+  let currentId: string | null | undefined = tailId;
+  while (currentId != null && !seen.has(currentId)) {
+    const message = byId.get(currentId);
+    if (message == null) {
+      break;
+    }
+    seen.add(currentId);
+    branch.push(message);
+    currentId = message.parentMessageId;
+  }
+  return branch.reverse();
+}
+
+/** Maps an endpoint/provider string to the agents `Providers` enum. */
+function resolveProvider(value?: string): Providers {
+  if (value == null || value === '') {
+    return Providers.OPENAI;
+  }
+  const lower = value.toLowerCase();
+  for (const provider of Object.values(Providers)) {
+    if (provider.toLowerCase() === lower) {
+      return provider;
+    }
+  }
+  if (lower.includes('anthropic') || lower.includes('claude')) {
+    return Providers.ANTHROPIC;
+  }
+  if (lower.includes('google') || lower.includes('gemini') || lower.includes('vertex')) {
+    return Providers.GOOGLE;
+  }
+  if (lower.includes('bedrock')) {
+    return Providers.BEDROCK;
+  }
+  return Providers.OPENAI;
+}
+
+/**
+ * Server-side context-usage projection: reconstructs the viewed branch and asks
+ * the agents SDK what the next call's context would be, WITHOUT invoking the
+ * model. Provider/model/window come from the (client-resolved) request — no
+ * agent or model-spec config is loaded here, so there is no cross-user config
+ * exposure. Reuses LibreChat's already-calibrated per-message `tokenCount`s (no
+ * re-tokenizing). Returns null when there is no resolvable context window.
+ * NOTE: this first cut targets message-windowing accuracy — instruction and
+ * tool-schema tokens (agent instructions, `promptPrefix`, model-spec presets,
+ * tool schemas) are NOT yet included; a follow-up will reuse the full
+ * `initializeAgent`/send path for exact overhead and proper access control.
+ */
+export async function resolveContextProjection(
+  deps: ContextProjectionDeps,
+  params: TContextProjectionRequest,
+): Promise<TContextUsageEvent | null> {
+  const maxContextTokens = params.maxContextTokens;
+  if (maxContextTokens == null || maxContextTokens <= 0) {
+    return null;
+  }
+
+  const stored = await deps.getMessages(
+    { conversationId: params.conversationId, user: deps.userId },
+    'messageId parentMessageId tokenCount isCreatedByUser text metadata',
+  );
+  const branch = resolveBranch(stored, params.messageId);
+  if (branch.length === 0) {
+    return null;
+  }
+
+  /** A summarized/compacted branch's next call sends the saved summary + the
+   *  post-summary tail, NOT this raw parent chain — projecting from the full
+   *  history would prune/count the wrong context and omit the summary. Detect it
+   *  via the live path's `metadata.summaryUsedTokens` marker and fall back (null)
+   *  so the client's summary-baseline-aware estimate handles these branches until
+   *  a follow-up replays the summary boundary. */
+  if (branch.some((message) => (message.metadata?.summaryUsedTokens ?? 0) > 0)) {
+    return null;
+  }
+
+  const model = params.model;
+  const encoding = (model ?? '').toLowerCase().includes('claude') ? 'claude' : 'o200k_base';
+  const tokenCounter = await createTokenCounter(encoding);
+
+  const messages: BaseMessage[] = [];
+  const indexTokenCountMap: Record<string, number> = {};
+  for (let i = 0; i < branch.length; i++) {
+    const message = branch[i];
+    const text = message.text ?? '';
+    const lcMessage =
+      message.isCreatedByUser === true ? new HumanMessage(text) : new AIMessage(text);
+    messages.push(lcMessage);
+    /** Recount messages with no stored count (imported / pre-feature) rather
+     *  than charging 0 — a real 0 and "unknown" must not collapse, or the
+     *  snapshot-less histories this endpoint targets would under-report. */
+    indexTokenCountMap[String(i)] =
+      message.tokenCount != null && message.tokenCount > 0
+        ? message.tokenCount
+        : tokenCounter(lcMessage);
+  }
+
+  return projectAgentContextUsage({
+    agent: {
+      agentId: params.agentId ?? 'projection',
+      provider: resolveProvider(params.endpoint),
+      maxContextTokens,
+    },
+    messages,
+    tokenCounter,
+    indexTokenCountMap,
+    calibrationRatio: params.calibrationRatio,
+  });
+}
diff --git a/packages/api/src/endpoints/tokenConfig.spec.ts b/packages/api/src/endpoints/tokenConfig.spec.ts
new file mode 100644
index 00000000000..76ffebeac02
--- /dev/null
+++ b/packages/api/src/endpoints/tokenConfig.spec.ts
@@ -0,0 +1,134 @@
+import { EModelEndpoint } from 'librechat-data-provider';
+import type { AppConfig } from '@librechat/data-schemas';
+import type { TokenomicsDeps } from './pricing';
+
+const mockCacheGet = jest.fn();
+jest.mock('~/cache', () => ({
+  tokenConfigCache: jest.fn(() => ({ get: (key: string) => mockCacheGet(key) })),
+}));
+
+import { resolveTokenConfigMap } from './tokenConfig';
+import { SCOPED_TOKEN_CONFIG_KEY_PREFIX } from './keys';
+
+const deps: TokenomicsDeps = {
+  getValueKey: () => 'value-key',
+  getMultiplier: ({ tokenType }) => (tokenType === 'prompt' ? 5 : 15),
+  getCacheMultiplier: () => null,
+};
+
+function appConfigWith(custom: unknown[], contextCost = true): AppConfig {
+  return {
+    interfaceConfig: { contextCost },
+    endpoints: { [EModelEndpoint.custom]: custom },
+  } as unknown as AppConfig;
+}
+
+describe('resolveTokenConfigMap', () => {
+  beforeEach(() => mockCacheGet.mockReset().mockResolvedValue(null));
+
+  it('uses a static tokenConfig override without consulting the cache', async () => {
+    const appConfig = appConfigWith([
+      {
+        name: 'MyProxy',
+        tokenConfig: { 'custom-model': { prompt: 1.5, completion: 4.5, context: 32000 } },
+      },
+    ]);
+
+    const map = await resolveTokenConfigMap(
+      { appConfig, modelsConfig: { MyProxy: ['custom-model'] }, userId: 'user-1' },
+      deps,
+    );
+
+    expect(map.MyProxy['custom-model']).toEqual({ context: 32000, prompt: 1.5, completion: 4.5 });
+    expect(mockCacheGet).not.toHaveBeenCalled();
+  });
+
+  it('falls back to the cached fetched config when no static override exists', async () => {
+    mockCacheGet.mockResolvedValue({ 'custom-model': { prompt: 2, completion: 6, context: 8000 } });
+    const appConfig = appConfigWith([{ name: 'MyProxy', models: { fetch: true } }]);
+
+    const map = await resolveTokenConfigMap(
+      { appConfig, modelsConfig: { MyProxy: ['custom-model'] }, userId: 'user-1' },
+      deps,
+    );
+
+    expect(mockCacheGet).toHaveBeenCalled();
+    expect(map.MyProxy['custom-model'].context).toBe(8000);
+    expect(map.MyProxy['custom-model'].prompt).toBe(2);
+  });
+
+  it('uses a tenant-scoped cache key for fetched custom endpoint token config', async () => {
+    mockCacheGet.mockImplementation(async (key: string) => {
+      if (key.startsWith(SCOPED_TOKEN_CONFIG_KEY_PREFIX)) {
+        return { 'custom-model': { prompt: 2, completion: 6, context: 16000 } };
+      }
+      if (key === 'MyProxy') {
+        return { 'custom-model': { prompt: 12, completion: 24, context: 111111 } };
+      }
+      return null;
+    });
+    const appConfig = appConfigWith([{ name: 'MyProxy', models: { fetch: true } }]);
+
+    const map = await resolveTokenConfigMap(
+      {
+        appConfig,
+        modelsConfig: { MyProxy: ['custom-model'] },
+        userId: 'user-2',
+        tenantId: 'tenant-b',
+      },
+      deps,
+    );
+
+    const tokenKey = mockCacheGet.mock.calls[0][0];
+    expect(tokenKey.startsWith(SCOPED_TOKEN_CONFIG_KEY_PREFIX)).toBe(true);
+    expect(tokenKey).not.toBe('tenant:tenant-b:MyProxy');
+    expect(tokenKey).not.toContain('tenant-b');
+    expect(tokenKey).not.toContain('MyProxy');
+    expect(map.MyProxy['custom-model'].context).toBe(16000);
+    expect(map.MyProxy['custom-model'].prompt).toBe(2);
+  });
+
+  it('uses the legacy cache key when tenant context is unavailable or empty', async () => {
+    mockCacheGet.mockResolvedValue({ 'custom-model': { prompt: 2, completion: 6, context: 8000 } });
+    const appConfig = appConfigWith([{ name: 'MyProxy', models: { fetch: true } }]);
+    const tenantIds = [undefined, null, '', '   '] as Array<string | null | undefined>;
+
+    for (const tenantId of tenantIds) {
+      mockCacheGet.mockClear();
+      const map = await resolveTokenConfigMap(
+        {
+          appConfig,
+          modelsConfig: { MyProxy: ['custom-model'] },
+          userId: 'user-1',
+          tenantId,
+        },
+        deps,
+      );
+
+      expect(mockCacheGet).toHaveBeenCalledWith('MyProxy');
+      expect(mockCacheGet.mock.calls.every(([key]) => key === 'MyProxy')).toBe(true);
+      expect(map.MyProxy['custom-model'].context).toBe(8000);
+    }
+  });
+
+  it('omits pricing when contextCost is disabled', async () => {
+    const appConfig = appConfigWith(
+      [
+        {
+          name: 'MyProxy',
+          tokenConfig: { 'custom-model': { prompt: 1.5, completion: 4.5, context: 32000 } },
+        },
+      ],
+      false,
+    );
+
+    const map = await resolveTokenConfigMap(
+      { appConfig, modelsConfig: { MyProxy: ['custom-model'] }, userId: 'user-1' },
+      deps,
+    );
+
+    expect(map.MyProxy['custom-model'].context).toBe(32000);
+    expect(map.MyProxy['custom-model'].prompt).toBeUndefined();
+    expect(map.MyProxy['custom-model'].completion).toBeUndefined();
+  });
+});
diff --git a/packages/api/src/endpoints/tokenConfig.ts b/packages/api/src/endpoints/tokenConfig.ts
new file mode 100644
index 00000000000..60ffd752b50
--- /dev/null
+++ b/packages/api/src/endpoints/tokenConfig.ts
@@ -0,0 +1,53 @@
+import { EModelEndpoint, normalizeEndpointName } from 'librechat-data-provider';
+import type { TModelsConfig, TTokenConfigMap, TEndpoint } from 'librechat-data-provider';
+import type { AppConfig } from '@librechat/data-schemas';
+import type { EndpointTokenConfig } from '~/types';
+import { buildTokenConfigMap, type TokenomicsDeps } from '~/endpoints/pricing';
+import { getTokenConfigKey } from '~/endpoints/custom/initialize';
+import { tokenConfigCache } from '~/cache';
+
+export interface ResolveTokenConfigParams {
+  appConfig?: AppConfig;
+  /** endpoint → model list, from the resolved models config */
+  modelsConfig: TModelsConfig;
+  userId: string;
+  tenantId?: string | null;
+}
+
+/**
+ * Server-side token-config resolution for the `/endpoints/token-config`
+ * route. Gathers each custom endpoint's override — a static yaml `tokenConfig`
+ * or the cached fetched config — then resolves context windows (and pricing,
+ * when `interface.contextCost` is enabled) via {@link buildTokenConfigMap}.
+ * Lives in TypeScript so the `/api` controller stays a thin wrapper.
+ */
+export async function resolveTokenConfigMap(
+  { appConfig, modelsConfig, userId, tenantId }: ResolveTokenConfigParams,
+  deps: TokenomicsDeps,
+): Promise<TTokenConfigMap> {
+  const includePricing = appConfig?.interfaceConfig?.contextCost === true;
+  const customEndpoints = (appConfig?.endpoints?.[EModelEndpoint.custom] ?? []) as TEndpoint[];
+  const cache = tokenConfigCache();
+  const endpointTokenConfigs: Record<string, EndpointTokenConfig | undefined> = {};
+
+  for (const endpointConfig of customEndpoints) {
+    /** Models config and the token-config cache key by the normalized name */
+    const name = normalizeEndpointName(endpointConfig?.name);
+    if (!name) {
+      continue;
+    }
+    if (endpointConfig.tokenConfig != null) {
+      endpointTokenConfigs[name] = endpointConfig.tokenConfig as EndpointTokenConfig;
+      continue;
+    }
+    /** Model fetches and chat initialization both store under this key —
+     *  user-scoped whenever the fetched config can be user-specific */
+    const tokenKey = getTokenConfigKey(endpointConfig, name, userId, tenantId);
+    const cached = (await cache.get(tokenKey)) as EndpointTokenConfig | undefined;
+    if (cached) {
+      endpointTokenConfigs[name] = cached;
+    }
+  }
+
+  return buildTokenConfigMap({ modelsConfig, endpointTokenConfigs, includePricing }, deps);
+}
diff --git a/packages/api/src/files/code/extract.spec.ts b/packages/api/src/files/code/extract.spec.ts
index 1baa2490f1b..1c8975a37b6 100644
--- a/packages/api/src/files/code/extract.spec.ts
+++ b/packages/api/src/files/code/extract.spec.ts
@@ -421,11 +421,12 @@ describe('extractCodeArtifactText', () => {
       ['deck', 'application/vnd.openxmlformats-officedocument.presentationml.presentation'],
     ])('routes extensionless office files by MIME alone (%s, %s)', async (name, mime) => {
       mockOfficeHtml.mockResolvedValueOnce('<!DOCTYPE html><body>x</body></html>');
-      const category = mime.includes('presentation')
-        ? 'pptx'
-        : mime.startsWith('text/')
-          ? 'utf8-text'
-          : 'document';
+      let category: 'pptx' | 'utf8-text' | 'document' = 'document';
+      if (mime.includes('presentation')) {
+        category = 'pptx';
+      } else if (mime.startsWith('text/')) {
+        category = 'utf8-text';
+      }
       const text = await extractCodeArtifactText(Buffer.from('PK'), name, mime, category);
       expect(mockOfficeHtml).toHaveBeenCalledWith(expect.any(Buffer), name, mime);
       expect(text).toContain('<body>');
diff --git a/packages/api/src/files/code/extract.ts b/packages/api/src/files/code/extract.ts
index e49ad61ad67..8d6ee04e7c9 100644
--- a/packages/api/src/files/code/extract.ts
+++ b/packages/api/src/files/code/extract.ts
@@ -4,13 +4,13 @@ import * as fs from 'fs/promises';
 import { randomUUID } from 'crypto';
 import { logger } from '@librechat/data-schemas';
 import type { CodeArtifactCategory } from './classify';
-import { parseDocument } from '~/files/documents/crud';
 import { bufferToOfficeHtml, officeHtmlBucket } from '~/files/documents/html';
-import { isBinaryBuffer } from '~/skills/binary';
 import { createConcurrencyLimiter, withTimeout } from '~/utils/promise';
+import { parseDocument } from '~/files/documents/crud';
+import { isBinaryBuffer } from '~/skills/binary';
 
-export const MAX_TEXT_CACHE_BYTES = 512 * 1024;
-export const MAX_TEXT_EXTRACT_BYTES = 1024 * 1024;
+export const MAX_TEXT_CACHE_BYTES: number = 512 * 1024;
+export const MAX_TEXT_EXTRACT_BYTES: number = 1024 * 1024;
 const DOCUMENT_PARSE_TIMEOUT_MS = 8_000;
 const OFFICE_HTML_TIMEOUT_MS = 12_000;
 const TRUNCATION_MARKER = '\n\n…[truncated]';
diff --git a/packages/api/src/files/documents/html.ts b/packages/api/src/files/documents/html.ts
index 7bac37804c2..96e41d91077 100644
--- a/packages/api/src/files/documents/html.ts
+++ b/packages/api/src/files/documents/html.ts
@@ -987,12 +987,12 @@ function renderPptxSlidesBody(slides: PptxSlide[]): string {
       const titleHtml = slide.title
         ? `<h2 class="lc-pptx-slide-title">${escapeHtml(slide.title)}</h2>`
         : '';
-      const bodyHtml =
-        slide.body.length > 0
-          ? `<ul class="lc-pptx-slide-body">${slide.body.map((line) => `<li>${escapeHtml(line)}</li>`).join('')}</ul>`
-          : !slide.title
-            ? '<p class="lc-pptx-slide-empty">(empty slide)</p>'
-            : '';
+      let bodyHtml = '';
+      if (slide.body.length > 0) {
+        bodyHtml = `<ul class="lc-pptx-slide-body">${slide.body.map((line) => `<li>${escapeHtml(line)}</li>`).join('')}</ul>`;
+      } else if (!slide.title) {
+        bodyHtml = '<p class="lc-pptx-slide-empty">(empty slide)</p>';
+      }
       return `<li class="lc-pptx-slide">
   <span class="lc-pptx-slide-number">Slide ${slide.number}</span>
   ${titleHtml}
@@ -1479,7 +1479,14 @@ async function pptxToSlideListHtmlInternal(buffer: Buffer): Promise<string> {
  * padded fixtures. Not part of the public API — callers in production
  * code should always go through `wordDocToHtml` / `pptxToHtml`.
  */
-export const _internal = {
+export const _internal: {
+  wordDocToHtmlViaCdn: typeof wordDocToHtmlViaCdn;
+  wordDocToHtmlViaMammoth: typeof wordDocToHtmlViaMammoth;
+  MAX_DOCX_CDN_BINARY_BYTES: number;
+  OFFICE_HTML_OUTPUT_CAP: number;
+  pptxToHtmlViaCdn: typeof pptxToHtmlViaCdn;
+  MAX_PPTX_CDN_BINARY_BYTES: number;
+} = {
   wordDocToHtmlViaCdn,
   wordDocToHtmlViaMammoth,
   MAX_DOCX_CDN_BINARY_BYTES,
diff --git a/packages/api/src/files/documents/libreoffice.ts b/packages/api/src/files/documents/libreoffice.ts
index aedbf624d1d..fff4f62ad75 100644
--- a/packages/api/src/files/documents/libreoffice.ts
+++ b/packages/api/src/files/documents/libreoffice.ts
@@ -1,7 +1,7 @@
-import { spawn } from 'child_process';
-import { mkdtemp, readFile, rm, writeFile } from 'fs/promises';
 import { tmpdir } from 'os';
 import { join } from 'path';
+import { spawn } from 'child_process';
+import { mkdtemp, readFile, rm, writeFile } from 'fs/promises';
 
 /**
  * LibreOffice-backed office preview pipeline.
@@ -196,7 +196,7 @@ export function _resetLibreOfficeProbeCache(): void {
 export const LIBREOFFICE_TIMEOUT_MS = 30_000;
 
 /** Maximum PDF output size; refuse anything larger so a runaway doc can't fill the disk. */
-export const MAX_LIBREOFFICE_PDF_BYTES = 50 * 1024 * 1024;
+export const MAX_LIBREOFFICE_PDF_BYTES: number = 50 * 1024 * 1024;
 
 /** Tag-distinct error so callers can distinguish "binary missing" from "conversion failed". */
 export class LibreOfficeUnavailableError extends Error {
diff --git a/packages/api/src/files/mistral/crud.spec.ts b/packages/api/src/files/mistral/crud.spec.ts
index 9556781063d..b401a852fad 100644
--- a/packages/api/src/files/mistral/crud.spec.ts
+++ b/packages/api/src/files/mistral/crud.spec.ts
@@ -1721,10 +1721,16 @@ describe('MistralOCR Service', () => {
 
   describe('Proxy Configuration', () => {
     const originalProxy = process.env.PROXY;
+    const originalHttpProxy = process.env.HTTP_PROXY;
+    const originalHttpsProxy = process.env.HTTPS_PROXY;
+    const originalNoProxy = process.env.NO_PROXY;
 
     beforeEach(() => {
       // Reset the HttpsProxyAgent mock to its default implementation
       (HttpsProxyAgent as unknown as jest.Mock).mockImplementation((url) => ({ proxyUrl: url }));
+      delete process.env.HTTP_PROXY;
+      delete process.env.HTTPS_PROXY;
+      delete process.env.NO_PROXY;
       // Clear any previous axios mock calls
       mockAxios.post!.mockClear();
       mockAxios.get!.mockClear();
@@ -1737,6 +1743,21 @@ describe('MistralOCR Service', () => {
       } else {
         delete process.env.PROXY;
       }
+      if (originalHttpProxy) {
+        process.env.HTTP_PROXY = originalHttpProxy;
+      } else {
+        delete process.env.HTTP_PROXY;
+      }
+      if (originalHttpsProxy) {
+        process.env.HTTPS_PROXY = originalHttpsProxy;
+      } else {
+        delete process.env.HTTPS_PROXY;
+      }
+      if (originalNoProxy) {
+        process.env.NO_PROXY = originalNoProxy;
+      } else {
+        delete process.env.NO_PROXY;
+      }
       // Clear mocks after each test to prevent leaking
       mockAxios.post!.mockClear();
       mockAxios.get!.mockClear();
diff --git a/packages/api/src/files/mistral/crud.ts b/packages/api/src/files/mistral/crud.ts
index c818fab8b88..db08cde9aa6 100644
--- a/packages/api/src/files/mistral/crud.ts
+++ b/packages/api/src/files/mistral/crud.ts
@@ -2,7 +2,6 @@ import * as fs from 'fs';
 import * as path from 'path';
 import FormData from 'form-data';
 import { logger } from '@librechat/data-schemas';
-import { HttpsProxyAgent } from 'https-proxy-agent';
 import {
   FileSources,
   envVarRegex,
@@ -22,6 +21,7 @@ import type {
   OCRImage,
 } from '~/types';
 import { logAxiosError, createAxiosInstance } from '~/utils/axios';
+import { applyAxiosProxyConfig } from '~/utils/proxy';
 import { readFileAsBuffer } from '~/utils/files';
 import { loadServiceKey } from '~/utils/key';
 
@@ -88,9 +88,7 @@ export async function uploadDocumentToMistral({
     maxContentLength: Infinity,
   };
 
-  if (process.env.PROXY) {
-    config.httpsAgent = new HttpsProxyAgent(process.env.PROXY);
-  }
+  applyAxiosProxyConfig(config, `${baseURL}/files`);
 
   return axios
     .post(`${baseURL}/files`, form, config)
@@ -117,9 +115,7 @@ export async function getSignedUrl({
     },
   };
 
-  if (process.env.PROXY) {
-    config.httpsAgent = new HttpsProxyAgent(process.env.PROXY);
-  }
+  applyAxiosProxyConfig(config, `${baseURL}/files/${fileId}/url?expiry=${expiry}`);
 
   return axios
     .get(`${baseURL}/files/${fileId}/url?expiry=${expiry}`, config)
@@ -161,11 +157,8 @@ export async function performOCR({
     },
   };
 
-  if (process.env.PROXY) {
-    config.httpsAgent = new HttpsProxyAgent(process.env.PROXY);
-  }
-
   const ocrURL = baseURL.endsWith('/ocr') ? baseURL : `${baseURL}/ocr`;
+  applyAxiosProxyConfig(config, ocrURL);
 
   return axios
     .post(
@@ -211,9 +204,7 @@ export async function deleteMistralFile({
     },
   };
 
-  if (process.env.PROXY) {
-    config.httpsAgent = new HttpsProxyAgent(process.env.PROXY);
-  }
+  applyAxiosProxyConfig(config, `${baseURL}/files/${fileId}`);
 
   try {
     const result = await axios.delete(`${baseURL}/files/${fileId}`, config);
@@ -580,9 +571,7 @@ async function exchangeJWTForAccessToken(jwt: string): Promise<string> {
     },
   };
 
-  if (process.env.PROXY) {
-    config.httpsAgent = new HttpsProxyAgent(process.env.PROXY);
-  }
+  applyAxiosProxyConfig(config, 'https://oauth2.googleapis.com/token');
 
   const response = await axios.post(
     'https://oauth2.googleapis.com/token',
@@ -653,9 +642,7 @@ async function performGoogleVertexOCR({
     },
   };
 
-  if (process.env.PROXY) {
-    config.httpsAgent = new HttpsProxyAgent(process.env.PROXY);
-  }
+  applyAxiosProxyConfig(config, baseURL);
 
   return axios
     .post(baseURL, requestBody, config)
diff --git a/packages/api/src/files/parse.ts b/packages/api/src/files/parse.ts
index f782f7e5e77..f931ec81e21 100644
--- a/packages/api/src/files/parse.ts
+++ b/packages/api/src/files/parse.ts
@@ -10,7 +10,7 @@ const imageExtensionRegex = /\.(jpg|jpeg|png|gif|bmp|tiff|svg|webp)$/i;
  * @returns The basename of the image file from the URL.
  * Returns an empty string if the URL does not contain a valid image basename.
  */
-export function getImageBasename(urlString: string) {
+export function getImageBasename(urlString: string): string {
   try {
     const url = new URL(urlString);
     const basename = path.basename(url.pathname);
@@ -29,7 +29,7 @@ export function getImageBasename(urlString: string) {
  * @returns The basename of the file from the URL.
  * Returns an empty string if the URL parsing fails.
  */
-export function getFileBasename(urlString: string) {
+export function getFileBasename(urlString: string): string {
   try {
     const url = new URL(urlString);
     return path.basename(url.pathname);
diff --git a/packages/api/src/files/retention.ts b/packages/api/src/files/retention.ts
index 58ba0df0995..884f56fb2ef 100644
--- a/packages/api/src/files/retention.ts
+++ b/packages/api/src/files/retention.ts
@@ -76,7 +76,7 @@ export const getConversationExpirationDate = (
   return Number.isNaN(expiredAt.getTime()) ? null : expiredAt;
 };
 
-export const isActiveExpirationDate = (expiredAt: Date, now = new Date()): boolean =>
+export const isActiveExpirationDate = (expiredAt: Date, now: Date = new Date()): boolean =>
   expiredAt > now;
 
 const createRetentionExpiry = (
diff --git a/packages/api/src/files/sweep.ts b/packages/api/src/files/sweep.ts
index 29562ffac55..4128fe3aa47 100644
--- a/packages/api/src/files/sweep.ts
+++ b/packages/api/src/files/sweep.ts
@@ -73,7 +73,7 @@ export type ExpiredFileSweepResult = {
 };
 
 export function getFileRetentionSweepInterval(
-  interval = process.env.FILE_RETENTION_SWEEP_INTERVAL_MS,
+  interval: string | undefined = process.env.FILE_RETENTION_SWEEP_INTERVAL_MS,
 ): number {
   if (interval == null || interval.trim() === '') {
     return DEFAULT_FILE_RETENTION_SWEEP_INTERVAL_MS;
@@ -90,7 +90,10 @@ export function getExpiredFileEndpoint(source?: string): string {
   return source === FileSources.azure ? EModelEndpoint.azureAssistants : EModelEndpoint.assistants;
 }
 
-export function hasExpiredFileEndpointConfig(appConfig: AppConfig | undefined, source?: string) {
+export function hasExpiredFileEndpointConfig(
+  appConfig: AppConfig | undefined,
+  source?: string,
+): boolean {
   if (source === FileSources.azure) {
     return Boolean(appConfig?.endpoints?.[EModelEndpoint.azureOpenAI]?.assistants);
   }
@@ -201,7 +204,7 @@ export async function resolveExpiredFileSweepConfig({
 }
 
 export async function sweepExpiredFiles(
-  { appConfig, limit = 100, loadAppConfig }: ExpiredFileSweepOptions = {},
+  { appConfig, limit = 100, loadAppConfig }: ExpiredFileSweepOptions | undefined = {},
   { getExpiredFiles, processDeleteRequest, logger }: SweepDependencies,
 ): Promise<ExpiredFileSweepResult> {
   const files = (await getExpiredFiles(limit)) ?? [];
@@ -254,7 +257,7 @@ export async function sweepExpiredFiles(
 }
 
 export function startExpiredFileSweep(
-  options: ExpiredFileSweepOptions = {},
+  options: ExpiredFileSweepOptions | undefined = {},
   { sweepExpiredFiles, runAsSystem, logger }: StartSweepDependencies,
 ): NodeJS.Timeout | null {
   const intervalMs = getFileRetentionSweepInterval();
diff --git a/packages/api/src/flow/manager.test.ts b/packages/api/src/flow/manager.test.ts
index b34dcbafab9..d955f98f4e3 100644
--- a/packages/api/src/flow/manager.test.ts
+++ b/packages/api/src/flow/manager.test.ts
@@ -1,5 +1,5 @@
 import { Keyv } from 'keyv';
-import { FlowStateManager } from './manager';
+import { FlowStateManager, PENDING_STALE_MS } from './manager';
 import { FlowState } from './types';
 
 jest.mock('@librechat/data-schemas', () => ({
@@ -71,6 +71,24 @@ describe('FlowStateManager', () => {
       expect(result2).toBe('result');
     });
 
+    it('should return the externally completed result when handler loses completion race', async () => {
+      const flowId = 'race-flow';
+      const type = 'test-type';
+
+      const result = await flowManager.createFlowWithHandler(flowId, type, async () => {
+        await flowManager.completeFlow(flowId, type, 'fresh-result');
+        return 'stale-result';
+      });
+
+      expect(result).toBe('fresh-result');
+      await expect(flowManager.getFlowState(flowId, type)).resolves.toEqual(
+        expect.objectContaining({
+          status: 'COMPLETED',
+          result: 'fresh-result',
+        }),
+      );
+    });
+
     it('should handle flow timeout correctly', async () => {
       const flowId = 'timeout-flow';
       const type = 'test-type';
@@ -157,6 +175,25 @@ describe('FlowStateManager', () => {
 
       await expect(flowPromise).rejects.toThrow('failure');
     }, 15000);
+
+    it('should not overwrite a completed flow with a late failure', async () => {
+      const flowId = 'completed-race-flow';
+      const type = 'test-type';
+      const flowKey = `${type}:${flowId}`;
+
+      await flowManager.initFlow(flowId, type);
+      await flowManager.completeFlow(flowId, type, 'success');
+
+      const result = await flowManager.failFlow(flowId, type, new Error('late failure'));
+      const state = await store.get(flowKey);
+
+      expect(result).toBe(true);
+      expect(state).toMatchObject({
+        status: 'COMPLETED',
+        result: 'success',
+      });
+      expect(state?.error).toBeUndefined();
+    });
   });
 
   describe('initFlow', () => {
@@ -965,21 +1002,21 @@ describe('FlowStateManager', () => {
       expect(result2.isStale).toBe(false);
     });
 
-    it('uses default threshold of 2 minutes when not specified', async () => {
-      const timestamp = Date.now() - 3 * 60 * 1000; // 3 minutes ago
+    it('uses the default PENDING_STALE_MS threshold when not specified', async () => {
+      const timestamp = Date.now() - (PENDING_STALE_MS + 60 * 1000); // just past the default
       await store.set(flowKey, {
         type,
         status: 'COMPLETED',
         metadata: {},
-        createdAt: Date.now() - 5 * 60 * 1000,
+        createdAt: Date.now() - (PENDING_STALE_MS + 3 * 60 * 1000),
         completedAt: timestamp,
       });
 
-      // Should use default 2 minute threshold
+      // Should use the default PENDING_STALE_MS threshold
       const result = await flowManager.isFlowStale(flowId, type);
 
       expect(result.isStale).toBe(true);
-      expect(result.age).toBeGreaterThan(2 * 60 * 1000);
+      expect(result.age).toBeGreaterThan(PENDING_STALE_MS);
     });
 
     it('falls back to createdAt when completedAt/failedAt are not present', async () => {
diff --git a/packages/api/src/flow/manager.ts b/packages/api/src/flow/manager.ts
index f775222282c..bbf335fd97e 100644
--- a/packages/api/src/flow/manager.ts
+++ b/packages/api/src/flow/manager.ts
@@ -3,8 +3,17 @@ import { logger } from '@librechat/data-schemas';
 import type { StoredDataNoRaw } from 'keyv';
 import type { FlowState, FlowMetadata, FlowManagerOptions } from './types';
 import { registerShutdownTask } from '../app/shutdown';
+import { math } from '~/utils/math';
 
-export const PENDING_STALE_MS = 2 * 60 * 1000;
+/**
+ * Lifetime of a PENDING OAuth flow: how long the auth button stays valid and an
+ * in-flight flow can be reused before it is replaced. Mirrors
+ * `mcpConfig.OAUTH_HANDLING_TIMEOUT` (`MCP_OAUTH_HANDLING_TIMEOUT`) so the reuse
+ * window matches the wait the server grants the user. Default: 10 minutes.
+ */
+export const PENDING_STALE_MS: number = math(
+  process.env.MCP_OAUTH_HANDLING_TIMEOUT ?? 10 * 60 * 1000,
+);
 
 const SECONDS_THRESHOLD = 1e10;
 
@@ -345,6 +354,17 @@ export class FlowStateManager<T = unknown> {
       return false;
     }
 
+    if (flowState.status === 'COMPLETED') {
+      logger.debug(
+        '[FlowStateManager] Flow already completed, skipping failure to prevent overwrite',
+        {
+          flowId,
+          type,
+        },
+      );
+      return true;
+    }
+
     const updatedState: FlowState = {
       ...flowState,
       status: 'FAILED',
@@ -404,6 +424,10 @@ export class FlowStateManager<T = unknown> {
     try {
       const result = await handler();
       await this.completeFlow(flowId, type, result);
+      const completedState = (await this.keyv.get(flowKey)) as FlowState<T> | undefined;
+      if (completedState?.status === 'COMPLETED' && completedState.result !== undefined) {
+        return completedState.result;
+      }
       return result;
     } catch (error) {
       await this.failFlow(flowId, type, error instanceof Error ? error : new Error(String(error)));
diff --git a/packages/api/src/html/devtools.spec.ts b/packages/api/src/html/devtools.spec.ts
new file mode 100644
index 00000000000..307bf52b47c
--- /dev/null
+++ b/packages/api/src/html/devtools.spec.ts
@@ -0,0 +1,34 @@
+import type { QueryDevtoolsRequest } from './devtools';
+import {
+  QUERY_DEVTOOLS_HEADER,
+  maybeInjectQueryDevtoolsBootstrap,
+  shouldEnableQueryDevtools,
+} from './devtools';
+
+const createReq = (value?: string): QueryDevtoolsRequest => ({
+  get: (header) => (header === QUERY_DEVTOOLS_HEADER ? value : undefined),
+});
+
+describe('query devtools HTML bootstrap', () => {
+  const html =
+    '<!DOCTYPE html><html lang="en-US"><head><title>LibreChat</title></head><body></body></html>';
+
+  it('uses the documented debug header value as the opt-in signal', () => {
+    expect(shouldEnableQueryDevtools(createReq('1'))).toBe(true);
+    expect(shouldEnableQueryDevtools(createReq('true'))).toBe(false);
+    expect(shouldEnableQueryDevtools(createReq())).toBe(false);
+  });
+
+  it('does not inject the production devtools flag by default', () => {
+    expect(maybeInjectQueryDevtoolsBootstrap(html, createReq())).toBe(html);
+  });
+
+  it('injects a server-to-client flag when the debug header is present', () => {
+    const updatedHtml = maybeInjectQueryDevtoolsBootstrap(html, createReq('1'));
+
+    expect(updatedHtml).toContain('window.__LIBRECHAT_CONFIG__');
+    expect(updatedHtml).toContain('data-librechat-query-devtools="true"');
+    expect(updatedHtml).toContain('"enableQueryDevtools":true');
+    expect(updatedHtml.indexOf('enableQueryDevtools')).toBeLessThan(updatedHtml.indexOf('</head>'));
+  });
+});
diff --git a/packages/api/src/html/devtools.ts b/packages/api/src/html/devtools.ts
new file mode 100644
index 00000000000..db1dad8b374
--- /dev/null
+++ b/packages/api/src/html/devtools.ts
@@ -0,0 +1,34 @@
+export const QUERY_DEVTOOLS_HEADER = 'x-librechat-enable-query-devtools';
+
+const QUERY_DEVTOOLS_SENTINEL = 'data-librechat-query-devtools="true"';
+const QUERY_DEVTOOLS_BOOTSTRAP = `<script ${QUERY_DEVTOOLS_SENTINEL}>window.__LIBRECHAT_CONFIG__=Object.assign({},window.__LIBRECHAT_CONFIG__,{"enableQueryDevtools":true});</script>`;
+
+export interface QueryDevtoolsRequest {
+  get(header: string): string | undefined;
+}
+
+export const shouldEnableQueryDevtools = (req: QueryDevtoolsRequest): boolean =>
+  req.get(QUERY_DEVTOOLS_HEADER) === '1';
+
+const injectQueryDevtoolsBootstrap = (html: string): string => {
+  if (html.includes(QUERY_DEVTOOLS_SENTINEL)) {
+    return html;
+  }
+
+  if (html.includes('</head>')) {
+    return html.replace('</head>', `${QUERY_DEVTOOLS_BOOTSTRAP}</head>`);
+  }
+
+  return html.replace(/<body([^>]*)>/i, `<body$1>${QUERY_DEVTOOLS_BOOTSTRAP}`);
+};
+
+export const maybeInjectQueryDevtoolsBootstrap = (
+  html: string,
+  req: QueryDevtoolsRequest,
+): string => {
+  if (!shouldEnableQueryDevtools(req)) {
+    return html;
+  }
+
+  return injectQueryDevtoolsBootstrap(html);
+};
diff --git a/packages/api/src/html/index.ts b/packages/api/src/html/index.ts
new file mode 100644
index 00000000000..9ea3e000b10
--- /dev/null
+++ b/packages/api/src/html/index.ts
@@ -0,0 +1 @@
+export * from './devtools';
diff --git a/packages/api/src/index.ts b/packages/api/src/index.ts
index 8be6526c7a9..0e4db579e09 100644
--- a/packages/api/src/index.ts
+++ b/packages/api/src/index.ts
@@ -9,6 +9,7 @@ export * from './auth';
 /* API Keys */
 export * from './apiKeys';
 /* MCP */
+export * from './mcp/mcpConfig';
 export * from './mcp/registry/MCPServersRegistry';
 export * from './mcp/MCPManager';
 export * from './mcp/connection';
@@ -18,12 +19,15 @@ export * from './mcp/zod';
 export * from './mcp/errors';
 export * from './mcp/cache';
 export * from './mcp/tools';
+export * from './mcp/request';
 /* Utilities */
 export * from './mcp/utils';
 export * from './utils';
 export { default as Tokenizer, countTokens } from './utils/tokenizer';
 export type { EncodingName } from './utils/tokenizer';
 export * from './db/utils';
+/* HTML */
+export * from './html';
 /* OAuth */
 export * from './oauth';
 export * from './mcp/oauth/OAuthReconnectionManager';
@@ -39,8 +43,12 @@ export * from './memory';
 export * from './modelSpecs';
 /* Agents */
 export * from './agents';
+/* Actions */
+export * from './actions';
 /* Prompts */
 export * from './prompts';
+/* Projects */
+export * from './projects';
 /* Skills */
 export * from './skills';
 /* Endpoints */
@@ -53,8 +61,13 @@ export * from './storage';
 export * from './tools';
 /* web search */
 export * from './web';
+/* Langfuse */
+export * from './langfuse';
 /* Cache */
 export * from './cache';
+/* Shared Links */
+export * from './shared-links/access';
+export * from './shared-links/service';
 /* Stream */
 export * from './stream';
 /* Diagnostics */
diff --git a/packages/api/src/langfuse/feedback.spec.ts b/packages/api/src/langfuse/feedback.spec.ts
new file mode 100644
index 00000000000..3de2f727a4e
--- /dev/null
+++ b/packages/api/src/langfuse/feedback.spec.ts
@@ -0,0 +1,146 @@
+jest.mock(
+  '@librechat/data-schemas',
+  () => ({
+    logger: {
+      debug: jest.fn(),
+    },
+  }),
+  { virtual: true },
+);
+
+const langfuseEnvKeys = [
+  'LANGFUSE_PUBLIC_KEY',
+  'LANGFUSE_SECRET_KEY',
+  'LANGFUSE_BASE_URL',
+  'LANGFUSE_HOST',
+  'LANGFUSE_BASEURL',
+  'LANGFUSE_TRACING_ENABLED',
+  'LANGFUSE_SAMPLE_RATE',
+  'LANGFUSE_TRACING_ENVIRONMENT',
+];
+let fetchMock: jest.SpiedFunction<typeof fetch>;
+
+function clearLangfuseEnv() {
+  for (const key of langfuseEnvKeys) {
+    delete process.env[key];
+  }
+}
+
+function setLangfuseCredentials() {
+  process.env.LANGFUSE_PUBLIC_KEY = 'public-key';
+  process.env.LANGFUSE_SECRET_KEY = 'secret-key';
+}
+
+async function loadFeedback(): Promise<typeof import('./feedback')> {
+  jest.resetModules();
+  return import('./feedback');
+}
+
+function getFetchMock(): jest.SpiedFunction<typeof fetch> {
+  return fetchMock;
+}
+
+describe('Langfuse feedback scores', () => {
+  beforeEach(() => {
+    clearLangfuseEnv();
+    setLangfuseCredentials();
+    fetchMock = jest.spyOn(global, 'fetch').mockResolvedValue(new Response(null, { status: 200 }));
+  });
+
+  afterEach(() => {
+    clearLangfuseEnv();
+    fetchMock.mockRestore();
+    jest.clearAllMocks();
+  });
+
+  it('posts feedback scores when Langfuse tracing is enabled by default', async () => {
+    const { sendFeedbackScore } = await loadFeedback();
+
+    await sendFeedbackScore({
+      traceId: 'trace-id',
+      feedback: { rating: 'thumbsUp', tag: 'helpful', text: 'nice' },
+      metadata: {
+        messageId: 'message-id',
+        conversationId: 'conversation-id',
+        sessionId: 'conversation-id',
+        userId: 'user-id',
+        endpoint: 'agents',
+        empty: '',
+        missing: undefined,
+      },
+      observationId: 'observation-id',
+    });
+
+    expect(getFetchMock()).toHaveBeenCalledWith(
+      'https://cloud.langfuse.com/api/public/scores',
+      expect.objectContaining({
+        method: 'POST',
+        headers: expect.objectContaining({
+          Authorization: `Basic ${Buffer.from('public-key:secret-key').toString('base64')}`,
+          'Content-Type': 'application/json',
+        }),
+        body: expect.any(String),
+      }),
+    );
+    const [, init] = getFetchMock().mock.calls[0];
+    expect(JSON.parse(init?.body as string)).toMatchObject({
+      id: 'feedback-trace-id',
+      traceId: 'trace-id',
+      name: 'user-feedback',
+      value: 1,
+      dataType: 'BOOLEAN',
+      comment: 'helpful — nice',
+      observationId: 'observation-id',
+      metadata: {
+        rating: 'thumbsUp',
+        tag: 'helpful',
+        messageId: 'message-id',
+        conversationId: 'conversation-id',
+        sessionId: 'conversation-id',
+        userId: 'user-id',
+        endpoint: 'agents',
+      },
+    });
+    expect(JSON.parse(init?.body as string).metadata).not.toHaveProperty('empty');
+    expect(JSON.parse(init?.body as string).metadata).not.toHaveProperty('missing');
+  });
+
+  it('posts feedback scores to the configured Langfuse host', async () => {
+    process.env.LANGFUSE_HOST = 'http://langfuse-server:3000';
+    const { sendFeedbackScore } = await loadFeedback();
+
+    await sendFeedbackScore({
+      traceId: 'trace-id',
+      feedback: { rating: 'thumbsUp' },
+    });
+
+    expect(getFetchMock()).toHaveBeenCalledWith(
+      'http://langfuse-server:3000/api/public/scores',
+      expect.objectContaining({ method: 'POST' }),
+    );
+  });
+
+  it('skips scores when Langfuse tracing is disabled', async () => {
+    process.env.LANGFUSE_TRACING_ENABLED = 'false';
+    const { sendFeedbackScore } = await loadFeedback();
+
+    await sendFeedbackScore({
+      traceId: 'trace-id',
+      feedback: { rating: 'thumbsDown' },
+    });
+
+    expect(getFetchMock()).not.toHaveBeenCalled();
+  });
+
+  it('skips scores when Langfuse sampling is set to zero', async () => {
+    process.env.LANGFUSE_SAMPLE_RATE = '0';
+    const { sendFeedbackScore } = await loadFeedback();
+
+    await sendFeedbackScore({
+      traceId: 'trace-id',
+      feedback: { rating: 'thumbsUp' },
+    });
+
+    expect(getFetchMock()).not.toHaveBeenCalled();
+  });
+});
diff --git a/packages/api/src/langfuse/feedback.ts b/packages/api/src/langfuse/feedback.ts
new file mode 100644
index 00000000000..14d80df048e
--- /dev/null
+++ b/packages/api/src/langfuse/feedback.ts
@@ -0,0 +1,108 @@
+import { logger } from '@librechat/data-schemas';
+
+export type LangfuseFeedback = {
+  rating?: 'thumbsUp' | 'thumbsDown';
+  tag?: string;
+  text?: string;
+};
+
+export type LangfuseFeedbackMetadata = Record<string, string | number | boolean | null | undefined>;
+
+export type SendFeedbackScoreParams = {
+  traceId: string;
+  feedback?: LangfuseFeedback | null;
+  metadata?: LangfuseFeedbackMetadata;
+  observationId?: string;
+};
+
+const DEFAULT_BASE_URL = 'https://cloud.langfuse.com';
+const BASE =
+  process.env.LANGFUSE_BASE_URL ??
+  process.env.LANGFUSE_HOST ??
+  process.env.LANGFUSE_BASEURL ??
+  DEFAULT_BASE_URL;
+
+function isFalseEnv(value?: string): boolean {
+  return value != null && ['0', 'false', 'no', 'off'].includes(value.trim().toLowerCase());
+}
+
+function isSampleRateEnabled(value?: string): boolean {
+  if (value == null || value.trim() === '') {
+    return true;
+  }
+  const parsed = Number(value);
+  return !Number.isFinite(parsed) || parsed !== 0;
+}
+
+const ENABLED =
+  Boolean(process.env.LANGFUSE_PUBLIC_KEY && process.env.LANGFUSE_SECRET_KEY) &&
+  !isFalseEnv(process.env.LANGFUSE_TRACING_ENABLED) &&
+  isSampleRateEnabled(process.env.LANGFUSE_SAMPLE_RATE);
+const AUTHORIZATION = ENABLED
+  ? 'Basic ' +
+    Buffer.from(`${process.env.LANGFUSE_PUBLIC_KEY}:${process.env.LANGFUSE_SECRET_KEY}`).toString(
+      'base64',
+    )
+  : undefined;
+const ENVIRONMENT = process.env.LANGFUSE_TRACING_ENVIRONMENT;
+
+function cleanMetadata(
+  metadata: LangfuseFeedbackMetadata,
+): Record<string, string | number | boolean> {
+  return Object.entries(metadata).reduce<Record<string, string | number | boolean>>(
+    (result, [key, value]) => {
+      if (value == null || (typeof value === 'string' && value.trim() === '')) {
+        return result;
+      }
+      result[key] = value;
+      return result;
+    },
+    {},
+  );
+}
+
+export async function sendFeedbackScore({
+  traceId,
+  feedback,
+  metadata = {},
+  observationId,
+}: SendFeedbackScoreParams): Promise<void> {
+  if (!ENABLED || !AUTHORIZATION || !traceId) {
+    return;
+  }
+
+  const scoreId = `feedback-${traceId}`;
+
+  if (!feedback?.rating) {
+    const res = await fetch(`${BASE}/api/public/scores/${encodeURIComponent(scoreId)}`, {
+      method: 'DELETE',
+      headers: { Authorization: AUTHORIZATION },
+    });
+    if (!res.ok && res.status !== 404) {
+      throw new Error(`langfuse score delete ${res.status}: ${await res.text()}`);
+    }
+    return;
+  }
+
+  const body = {
+    id: scoreId,
+    traceId,
+    name: 'user-feedback',
+    value: feedback.rating === 'thumbsUp' ? 1 : 0,
+    dataType: 'BOOLEAN',
+    comment: [feedback.tag, feedback.text].filter(Boolean).join(' — ') || undefined,
+    metadata: cleanMetadata({ ...metadata, rating: feedback.rating, tag: feedback.tag }),
+    ...(observationId ? { observationId } : {}),
+    ...(ENVIRONMENT ? { environment: ENVIRONMENT } : {}),
+  };
+
+  const res = await fetch(`${BASE}/api/public/scores`, {
+    method: 'POST',
+    headers: { Authorization: AUTHORIZATION, 'Content-Type': 'application/json' },
+    body: JSON.stringify(body),
+  });
+  if (!res.ok) {
+    throw new Error(`langfuse score create ${res.status}: ${await res.text()}`);
+  }
+  logger.debug(`[langfuse] feedback score sent for trace ${traceId} (${feedback.rating})`);
+}
diff --git a/packages/api/src/langfuse/index.ts b/packages/api/src/langfuse/index.ts
new file mode 100644
index 00000000000..b22dba46982
--- /dev/null
+++ b/packages/api/src/langfuse/index.ts
@@ -0,0 +1,2 @@
+export * from './feedback';
+export * from './trace';
diff --git a/packages/api/src/langfuse/trace.ts b/packages/api/src/langfuse/trace.ts
new file mode 100644
index 00000000000..0bc80633c87
--- /dev/null
+++ b/packages/api/src/langfuse/trace.ts
@@ -0,0 +1,5 @@
+import { createHash } from 'crypto';
+
+export function traceIdForMessage(messageId: string): string {
+  return createHash('sha256').update(messageId, 'utf8').digest('hex').slice(0, 32);
+}
diff --git a/packages/api/src/mcp/ConnectionsRepository.ts b/packages/api/src/mcp/ConnectionsRepository.ts
index a6e3e07a677..7dd2695467d 100644
--- a/packages/api/src/mcp/ConnectionsRepository.ts
+++ b/packages/api/src/mcp/ConnectionsRepository.ts
@@ -1,8 +1,8 @@
 import { logger } from '@librechat/data-schemas';
 import type * as t from './types';
 import { MCPServersRegistry } from '~/mcp/registry/MCPServersRegistry';
-import { MCPConnectionFactory } from '~/mcp/MCPConnectionFactory';
 import { isUserSourced, requiresUserScopedConnection } from './utils';
+import { MCPConnectionFactory } from '~/mcp/MCPConnectionFactory';
 import { MCPConnection } from './connection';
 
 const CONNECT_CONCURRENCY = 3;
@@ -78,14 +78,16 @@ export class ConnectionsRepository {
       }
     }
     const registry = MCPServersRegistry.getInstance();
+    const { allowedDomains, allowedAddresses, useSSRFProtection } =
+      await registry.resolveAllowlists({ userId: this.ownerId });
     const connection = await MCPConnectionFactory.create(
       {
         serverName,
         serverConfig,
         dbSourced: isUserSourced(serverConfig as t.ParsedServerConfig),
-        useSSRFProtection: registry.shouldEnableSSRFProtection(),
-        allowedDomains: registry.getAllowedDomains(),
-        allowedAddresses: registry.getAllowedAddresses(),
+        useSSRFProtection,
+        allowedDomains,
+        allowedAddresses,
       },
       this.oauthOpts,
     );
diff --git a/packages/api/src/mcp/MCPConnectionFactory.ts b/packages/api/src/mcp/MCPConnectionFactory.ts
index 47474d482f3..a7808feaab9 100644
--- a/packages/api/src/mcp/MCPConnectionFactory.ts
+++ b/packages/api/src/mcp/MCPConnectionFactory.ts
@@ -1,8 +1,13 @@
-import { logger, getTenantId } from '@librechat/data-schemas';
+import { logger, getTenantId, tenantStorage } from '@librechat/data-schemas';
 import type { OAuthClientInformation } from '@modelcontextprotocol/sdk/shared/auth.js';
+import type { TokenMethods, TenantContext } from '@librechat/data-schemas';
 import type { Tool } from '@modelcontextprotocol/sdk/types.js';
-import type { TokenMethods } from '@librechat/data-schemas';
-import type { MCPOAuthTokens, OAuthMetadata, MCPOAuthFlowMetadata } from '~/mcp/oauth';
+import type {
+  MCPOAuthTokens,
+  OAuthMetadata,
+  MCPOAuthFlowMetadata,
+  OAuthProtectedResourceMetadata,
+} from '~/mcp/oauth';
 import type { OboTokenResolver, OboTrustChecker } from '~/mcp/oauth/obo';
 import type { FlowStateManager } from '~/flow/manager';
 import type * as t from './types';
@@ -13,11 +18,13 @@ import {
   ReauthenticationRequiredError,
   resolveOboToken,
 } from '~/mcp/oauth';
-import { PENDING_STALE_MS, normalizeExpiresAt } from '~/flow/manager';
 import { sanitizeUrlForLogging, isClientRejectionMessage, isOAuthServer } from './utils';
+import { PENDING_STALE_MS, normalizeExpiresAt } from '~/flow/manager';
+import { preProcessGraphTokens } from '~/utils/graph';
 import { withTimeout } from '~/utils/promise';
 import { MCPConnection } from './connection';
 import { processMCPEnv } from '~/utils';
+import { mcpConfig } from './mcpConfig';
 
 export interface ToolDiscoveryResult {
   tools: Tool[] | null;
@@ -26,6 +33,14 @@ export interface ToolDiscoveryResult {
   oauthUrl: string | null;
 }
 
+type OAuthRequiredEvent = {
+  serverUrl?: string;
+  error?: unknown;
+  status?: number;
+  statusCode?: number;
+  skipSilentRefresh?: boolean;
+};
+
 /**
  * Factory for creating MCP connections with optional OAuth authentication.
  * Handles OAuth flows, token management, and connection retry logic.
@@ -39,29 +54,71 @@ export class MCPConnectionFactory {
   protected readonly useSSRFProtection: boolean;
   protected readonly allowedDomains?: string[] | null;
   protected readonly allowedAddresses?: string[] | null;
+  protected readonly ephemeralConnection: boolean;
 
   // OAuth-related properties (only set when useOAuth is true)
   protected readonly userId?: string;
   protected readonly user?: t.OAuthConnectionOptions['user'];
   protected readonly flowManager?: FlowStateManager<MCPOAuthTokens | null>;
   protected readonly tokenMethods?: TokenMethods;
-  protected readonly signal?: AbortSignal;
-  protected readonly oauthStart?: (authURL: string) => Promise<void>;
-  protected readonly oauthEnd?: () => Promise<void>;
-  protected readonly returnOnOAuth?: boolean;
+  protected signal?: AbortSignal;
+  protected oauthStart?: t.OAuthStartHandler;
+  protected oauthEnd?: () => Promise<void>;
+  protected returnOnOAuth?: boolean;
   protected readonly connectionTimeout?: number;
   protected readonly oboTokenResolver?: OboTokenResolver;
   protected readonly oboTrustChecker?: OboTrustChecker;
+  private connectionReady = false;
+  /**
+   * Snapshot of the tenant context at factory construction time. Captured eagerly
+   * because the OAuth handler runs later inside an EventEmitter callback,
+   * outside the original request's async context - `getTenantId()` called
+   * from the listener would return the wrong tenant (or none at all).
+   */
+  protected readonly tenantId?: string;
+  protected readonly tenantContext?: TenantContext;
+
+  /**
+   * Process-local in-flight silent refresh promises, keyed by
+   * `tenantId:userId:serverName`. Coalesces concurrent `attemptSilentTokenRefresh`
+   * calls within this process so a single refresh-token redemption serves every
+   * waiter in the same tenant — important when multiple connections (or repeated
+   * 401s) race the same refresh and the OAuth provider rotates refresh tokens.
+   * The map only holds in-flight promises (no result caching), so each new 401
+   * after the previous attempt resolves triggers a fresh redemption.
+   *
+   * NOTE: this is a single-process lock. Across multiple worker processes the
+   * race with `getOAuthTokens()`'s `mcp_get_tokens` flow remains; that's an
+   * inherent limitation of process-local coalescing and tracked separately.
+   */
+  private static inflightSilentRefreshes = new Map<string, Promise<MCPOAuthTokens | null>>();
+
+  /**
+   * Silent refresh is a best-effort optimization before interactive OAuth.
+   * Keep the cap short so a stalled refresh still leaves most of the factory
+   * connect budget for OAuth discovery, registration, and `oauthStart`.
+   */
+  private static readonly SILENT_REFRESH_TIMEOUT_MS = 5_000;
+  private static readonly SILENT_REFRESH_ABORT_GRACE_MS = 1_000;
 
   /** Creates a new MCP connection with optional OAuth support */
   static async create(
     basic: t.BasicConnectionOptions,
     oauth?: t.OAuthConnectionOptions | t.UserConnectionContext,
   ): Promise<MCPConnection> {
-    const factory = new this(basic, oauth);
+    const factory = new this(await this.prepareBasicConnectionOptions(basic, oauth), oauth);
     return factory.createConnection();
   }
 
+  static attachRequestOAuthHandler(
+    basic: t.BasicConnectionOptions,
+    oauth: t.OAuthConnectionOptions,
+    connection: MCPConnection,
+  ): () => void {
+    const factory = new this(basic, oauth);
+    return factory.handleOAuthEvents(connection, 'oauthReauthenticationRequired');
+  }
+
   /**
    * Discovers tools from an MCP server, even when OAuth is required.
    * Per MCP spec, tool listing should be possible without authentication.
@@ -71,14 +128,37 @@ export class MCPConnectionFactory {
     basic: t.BasicConnectionOptions,
     options?: Omit<t.OAuthConnectionOptions, 'returnOnOAuth'> | t.UserConnectionContext,
   ): Promise<ToolDiscoveryResult> {
+    const preparedBasic = await this.prepareBasicConnectionOptions(basic, options);
     if (options != null && 'useOAuth' in options) {
-      const factory = new this(basic, { ...options, returnOnOAuth: true });
+      const factory = new this(preparedBasic, { ...options, returnOnOAuth: true });
       return factory.discoverToolsInternal();
     }
-    const factory = new this(basic, options);
+    const factory = new this(preparedBasic, options);
     return factory.discoverToolsInternal();
   }
 
+  /**
+   * Together with the constructor's processMCPEnv pass, this mirrors
+   * UserConnectionManager.resolveRuntimeConfig — keep them in sync so the
+   * config validated there matches the one connected with here.
+   */
+  private static async prepareBasicConnectionOptions(
+    basic: t.BasicConnectionOptions,
+    options?: t.OAuthConnectionOptions | t.UserConnectionContext,
+  ): Promise<t.BasicConnectionOptions> {
+    if (basic.dbSourced || !options?.graphTokenResolver) {
+      return basic;
+    }
+
+    const serverConfig = await preProcessGraphTokens(basic.serverConfig, {
+      user: options.user,
+      graphTokenResolver: options.graphTokenResolver,
+      scopes: process.env.GRAPH_API_SCOPES,
+    });
+
+    return serverConfig === basic.serverConfig ? basic : { ...basic, serverConfig };
+  }
+
   protected async discoverToolsInternal(): Promise<ToolDiscoveryResult> {
     const oauthUrl: string | null = null;
     let oauthRequired = false;
@@ -96,6 +176,7 @@ export class MCPConnectionFactory {
       oauthTokens,
       useSSRFProtection: this.useSSRFProtection,
       allowedAddresses: this.allowedAddresses,
+      ephemeralConnection: this.ephemeralConnection,
     });
 
     const oauthHandler = () => {
@@ -169,6 +250,7 @@ export class MCPConnectionFactory {
       oauthTokens: null,
       useSSRFProtection: this.useSSRFProtection,
       allowedAddresses: this.allowedAddresses,
+      ephemeralConnection: this.ephemeralConnection,
     });
 
     unauthConnection.on('oauthRequired', () => {
@@ -207,18 +289,23 @@ export class MCPConnectionFactory {
     basic: t.BasicConnectionOptions,
     options?: t.OAuthConnectionOptions | t.UserConnectionContext,
   ) {
-    this.serverConfig = processMCPEnv({
-      user: options?.user,
-      body: options?.requestBody,
-      dbSourced: basic.dbSourced,
-      options: basic.serverConfig,
-      customUserVars: options?.customUserVars,
-    });
+    this.serverConfig = basic.skipEnvProcessing
+      ? basic.serverConfig
+      : processMCPEnv({
+          user: options?.user,
+          body: options?.requestBody,
+          dbSourced: basic.dbSourced,
+          options: basic.serverConfig,
+          customUserVars: options?.customUserVars,
+        });
     this.serverName = basic.serverName;
     this.useSSRFProtection = basic.useSSRFProtection === true;
     this.allowedDomains = basic.allowedDomains;
     this.allowedAddresses = basic.allowedAddresses;
+    this.ephemeralConnection = basic.ephemeralConnection === true;
     this.connectionTimeout = options?.connectionTimeout;
+    this.tenantContext = tenantStorage?.getStore?.();
+    this.tenantId = this.tenantContext?.tenantId ?? getTenantId();
     this.logPrefix = options?.user
       ? `[MCP][${basic.serverName}][${options.user.id}]`
       : `[MCP][${basic.serverName}]`;
@@ -313,6 +400,7 @@ export class MCPConnectionFactory {
       oauthTokens,
       useSSRFProtection: this.useSSRFProtection,
       allowedAddresses: this.allowedAddresses,
+      ephemeralConnection: this.ephemeralConnection,
     });
 
     let cleanupOAuthHandlers: (() => void) | null = null;
@@ -336,9 +424,10 @@ export class MCPConnectionFactory {
         await this.initiateOAuthBeforeConnect(connection);
       }
       await this.attemptToConnect(connection);
-      if (cleanupOAuthHandlers) {
-        cleanupOAuthHandlers();
-      }
+      this.connectionReady = true;
+      // Keep the `oauthRequired` listener for cached-connection 401 recovery,
+      // but drop response/tool-call callbacks from the completed request.
+      this.releaseRequestScopedOAuthState();
       return connection;
     } catch (error) {
       if (cleanupOAuthHandlers) {
@@ -355,6 +444,13 @@ export class MCPConnectionFactory {
     return isOAuthServer(this.serverConfig);
   }
 
+  protected releaseRequestScopedOAuthState(): void {
+    this.signal = undefined;
+    this.oauthStart = undefined;
+    this.oauthEnd = undefined;
+    this.returnOnOAuth = false;
+  }
+
   private getServerUrl(): string | undefined {
     return 'url' in this.serverConfig ? this.serverConfig.url : undefined;
   }
@@ -365,7 +461,7 @@ export class MCPConnectionFactory {
       throw new Error(`${this.logPrefix} OAuth required but server URL is missing from config`);
     }
 
-    const oauthTimeout = this.connectionTimeout ?? 60000 * 2;
+    const oauthTimeout = mcpConfig.OAUTH_HANDLING_TIMEOUT;
     logger.info(
       `${this.logPrefix} No stored tokens, proactively triggering OAuth flow before connecting (timeout: ${oauthTimeout}ms)`,
     );
@@ -410,6 +506,8 @@ export class MCPConnectionFactory {
         error: new Error('OAuth tokens missing before connection'),
         serverUrl,
         userId: this.userId,
+        /** `getOAuthTokens` just exhausted the stored-token/refresh path; go straight to interactive OAuth */
+        skipSilentRefresh: true,
       });
 
       if (!emitted) {
@@ -419,25 +517,58 @@ export class MCPConnectionFactory {
     });
   }
 
+  private async runWithCapturedTenant<T>(fn: () => Promise<T>): Promise<T> {
+    const context = this.tenantContext ?? (this.tenantId ? { tenantId: this.tenantId } : undefined);
+    if (!context || !tenantStorage?.run) {
+      return fn();
+    }
+    return tenantStorage.run(context, fn);
+  }
+
+  private getConnectionOAuthTimeoutMs(): number {
+    const factoryConnectTimeout = this.connectionTimeout ?? this.serverConfig.initTimeout ?? 30000;
+    const connectionOAuthTimeout = this.serverConfig.initTimeout ?? 60000 * 2;
+    return Math.min(factoryConnectTimeout, connectionOAuthTimeout);
+  }
+
+  private getSilentRefreshTimeoutMs(): number {
+    const oauthTimeout = this.getConnectionOAuthTimeoutMs();
+    const silentRefreshBudgetMs = Math.floor(oauthTimeout * 0.4);
+    return Math.max(
+      1,
+      Math.min(MCPConnectionFactory.SILENT_REFRESH_TIMEOUT_MS, silentRefreshBudgetMs),
+    );
+  }
+
+  private getBaseFlowId(): string {
+    return MCPOAuthHandler.generateFlowId(this.userId!, this.serverName, this.tenantId);
+  }
+
+  private getTokenFlowId(): string {
+    return MCPOAuthHandler.generateTokenFlowId(this.userId!, this.serverName, this.tenantId);
+  }
+
   /** Retrieves existing OAuth tokens from storage or returns null */
   protected async getOAuthTokens(): Promise<MCPOAuthTokens | null> {
     if (!this.tokenMethods?.findToken) return null;
 
     try {
-      const flowId = MCPOAuthHandler.generateFlowId(this.userId!, this.serverName);
+      const flowId = this.getTokenFlowId();
       const tokens = await this.flowManager!.createFlowWithHandler(
         flowId,
         'mcp_get_tokens',
         async () => {
-          return await MCPTokenStorage.getTokens({
-            userId: this.userId!,
-            serverName: this.serverName,
-            findToken: this.tokenMethods!.findToken!,
-            createToken: this.tokenMethods!.createToken,
-            updateToken: this.tokenMethods!.updateToken,
-            deleteTokens: this.tokenMethods!.deleteTokens,
-            refreshTokens: this.createRefreshTokensFunction(),
-          });
+          return await this.runWithCapturedTenant(async () =>
+            MCPTokenStorage.getTokens({
+              userId: this.userId!,
+              serverName: this.serverName,
+              findToken: this.tokenMethods!.findToken!,
+              createToken: this.tokenMethods!.createToken,
+              updateToken: this.tokenMethods!.updateToken,
+              deleteTokens: this.tokenMethods!.deleteTokens,
+              refreshTokens: this.createRefreshTokensFunction(),
+            }),
+          );
         },
         this.signal,
       );
@@ -464,9 +595,11 @@ export class MCPConnectionFactory {
       clientInfo?: OAuthClientInformation;
       storedTokenEndpoint?: string;
       storedAuthMethods?: string[];
+      resource?: string;
     },
+    signal?: AbortSignal,
   ) => Promise<MCPOAuthTokens> {
-    return async (refreshToken, metadata) => {
+    return async (refreshToken, metadata, signal) => {
       return await MCPOAuthHandler.refreshOAuthTokens(
         refreshToken,
         {
@@ -475,24 +608,321 @@ export class MCPConnectionFactory {
           clientInfo: metadata.clientInfo,
           storedTokenEndpoint: metadata.storedTokenEndpoint,
           storedAuthMethods: metadata.storedAuthMethods,
+          resource: metadata.resource,
         },
         this.serverConfig.oauth_headers ?? {},
         this.serverConfig.oauth,
         this.allowedDomains,
         this.allowedAddresses,
+        signal,
       );
     };
   }
 
+  /**
+   * Attempts to silently refresh OAuth tokens using the stored refresh token,
+   * bypassing the local `expires_at` check. Use this when the server has
+   * signaled token invalidity (a 401 emitted as `oauthRequired`) to avoid
+   * forcing the user through an interactive OAuth flow when the refresh token
+   * is still valid.
+   *
+   * Coalesces via `inflightSilentRefreshes` rather than `FlowStateManager` —
+   * the latter caches the completed result for the new token's TTL, which
+   * would hand back stale tokens on a subsequent 401 (e.g. when the freshly
+   * minted token is revoked before its local expiry). Caching only the
+   * in-flight promise means every fresh 401 after settlement triggers a
+   * fresh redemption.
+   */
+  protected async attemptSilentTokenRefresh(): Promise<MCPOAuthTokens | null> {
+    if (!this.tokenMethods?.findToken || !this.tokenMethods?.createToken) {
+      return null;
+    }
+
+    // Scope the lock by tenant so two tenants that share the same `userId`
+    // and `serverName` (common with username-based IDs in multi-tenant setups)
+    // can never join each other's refresh and have those tokens applied to the
+    // wrong connection.
+    const lockKey = `${this.tenantId ?? ''}:${this.userId ?? ''}:${this.serverName}`;
+    const inflight = MCPConnectionFactory.inflightSilentRefreshes.get(lockKey);
+    if (inflight) {
+      logger.debug(`${this.logPrefix} Joining in-flight silent refresh attempt`);
+      return inflight;
+    }
+
+    const timeoutMs = this.getSilentRefreshTimeoutMs();
+    const abortController = new AbortController();
+    let timeoutId: ReturnType<typeof setTimeout> | null = null;
+    let abortGraceTimeoutId: ReturnType<typeof setTimeout> | null = null;
+    const refreshPromise = this.runSilentRefresh(abortController.signal);
+    const promise = new Promise<MCPOAuthTokens | null>((resolve) => {
+      timeoutId = setTimeout(() => {
+        abortController.abort();
+        abortGraceTimeoutId = setTimeout(
+          releaseLock,
+          MCPConnectionFactory.SILENT_REFRESH_ABORT_GRACE_MS,
+        );
+        logger.info(
+          `${this.logPrefix} Silent token refresh timed out after ${timeoutMs}ms, falling back to interactive OAuth`,
+        );
+        resolve(null);
+      }, timeoutMs);
+
+      refreshPromise.then(resolve, (error: unknown) => {
+        logger.info(
+          `${this.logPrefix} Silent token refresh failed, falling back to interactive OAuth`,
+          error,
+        );
+        resolve(null);
+      });
+    }).finally(() => {
+      if (timeoutId) {
+        clearTimeout(timeoutId);
+      }
+    });
+    function releaseLock() {
+      if (abortGraceTimeoutId) {
+        clearTimeout(abortGraceTimeoutId);
+        abortGraceTimeoutId = null;
+      }
+      if (MCPConnectionFactory.inflightSilentRefreshes.get(lockKey) === promise) {
+        MCPConnectionFactory.inflightSilentRefreshes.delete(lockKey);
+      }
+    }
+    MCPConnectionFactory.inflightSilentRefreshes.set(lockKey, promise);
+    void refreshPromise.then(releaseLock, releaseLock);
+    return await promise;
+  }
+
+  /**
+   * Executes a single force-refresh attempt against the OAuth provider and
+   * persists the new tokens. Called by `attemptSilentTokenRefresh` under the
+   * `inflightSilentRefreshes` coalescing lock.
+   */
+  private async runSilentRefresh(signal: AbortSignal): Promise<MCPOAuthTokens | null> {
+    try {
+      const tokens = await this.runWithCapturedTenant(async () =>
+        MCPTokenStorage.forceRefreshTokens({
+          userId: this.userId!,
+          serverName: this.serverName,
+          findToken: this.tokenMethods!.findToken!,
+          createToken: this.tokenMethods!.createToken,
+          updateToken: this.tokenMethods!.updateToken,
+          deleteTokens: this.tokenMethods!.deleteTokens,
+          refreshTokens: this.createRefreshTokensFunction(),
+          signal,
+        }),
+      );
+
+      if (tokens) {
+        // Drop any previously cached `mcp_get_tokens` result so the next call
+        // to `getOAuthTokens` reads the freshly persisted tokens from the
+        // token store rather than the now-stale flow-cached value.
+        await this.invalidateGetTokensFlow(tokens);
+      }
+
+      if (tokens) {
+        logger.info(`${this.logPrefix} Silent token refresh succeeded`);
+      } else {
+        logger.info(`${this.logPrefix} Silent token refresh returned no tokens`);
+      }
+      return tokens;
+    } catch (error) {
+      if (error instanceof ReauthenticationRequiredError) {
+        logger.info(`${this.logPrefix} ${error.message}, falling back to interactive OAuth`);
+      } else {
+        logger.info(
+          `${this.logPrefix} Silent token refresh failed, falling back to interactive OAuth`,
+          error,
+        );
+      }
+      return null;
+    }
+  }
+
+  /**
+   * Clears stale token-fetch cache after fresh credentials are known. COMPLETED
+   * entries are deleted; PENDING entries are completed with fresh tokens so
+   * concurrent waiters do not fail or later publish server-rejected tokens.
+   */
+  protected async invalidateGetTokensFlow(freshTokens?: MCPOAuthTokens): Promise<void> {
+    if (!this.flowManager || !this.userId) {
+      return;
+    }
+    const flowId = this.getTokenFlowId();
+    try {
+      const state = await this.flowManager.getFlowState(flowId, 'mcp_get_tokens');
+      if (!state) {
+        return;
+      }
+      if (state.status === 'PENDING' && freshTokens) {
+        await this.flowManager.completeFlow(flowId, 'mcp_get_tokens', freshTokens);
+        return;
+      }
+      if (state.status !== 'COMPLETED') {
+        return;
+      }
+      await this.flowManager.deleteFlow(flowId, 'mcp_get_tokens');
+    } catch (err) {
+      logger.debug(`${this.logPrefix} Failed to invalidate mcp_get_tokens cache`, err);
+    }
+  }
+
+  /**
+   * Drops any cached COMPLETED `mcp_oauth` flow state so that
+   * `handleOAuthRequired`'s recent-completion fast path can't re-serve the
+   * tokens that the resource server just rejected.
+   */
+  protected async invalidateCompletedOAuthFlow(): Promise<void> {
+    if (!this.flowManager || !this.userId) {
+      return;
+    }
+    const flowId = this.getBaseFlowId();
+    try {
+      const existing = await this.flowManager.getFlowState(flowId, 'mcp_oauth');
+      if (!existing || existing.status !== 'COMPLETED') {
+        return;
+      }
+      const meta = existing.metadata as MCPOAuthFlowMetadata | undefined;
+      if (!this.isCurrentTenantOAuthFlow(meta)) {
+        logger.debug(
+          `${this.logPrefix} Skipping completed mcp_oauth invalidation for a different tenant`,
+        );
+        return;
+      }
+      const oldState = meta?.state;
+      await this.flowManager.deleteFlow(flowId, 'mcp_oauth');
+      if (oldState) {
+        await MCPOAuthHandler.deleteStateMapping(oldState, this.flowManager);
+      }
+    } catch (err) {
+      logger.debug(`${this.logPrefix} Failed to invalidate completed mcp_oauth cache`, err);
+    }
+  }
+
+  private isCurrentTenantOAuthFlow(meta: MCPOAuthFlowMetadata | undefined): boolean {
+    const flowTenantId = meta?.tenantId;
+    if (!this.tenantId) {
+      return !flowTenantId;
+    }
+    return flowTenantId === this.tenantId;
+  }
+
+  private getOAuthRequiredStatusCode(data: OAuthRequiredEvent): number | undefined {
+    if (typeof data.status === 'number') {
+      return data.status;
+    }
+    if (typeof data.statusCode === 'number') {
+      return data.statusCode;
+    }
+
+    const error = data.error;
+    if (!error || typeof error !== 'object') {
+      return undefined;
+    }
+
+    const errorLike = error as {
+      code?: unknown;
+      status?: unknown;
+      statusCode?: unknown;
+      message?: unknown;
+    };
+    for (const value of [errorLike.code, errorLike.status, errorLike.statusCode]) {
+      if (typeof value === 'number' && Number.isInteger(value)) {
+        return value;
+      }
+    }
+
+    if (typeof errorLike.message === 'string') {
+      const statusMatch = errorLike.message.match(/\b(4\d{2}|5\d{2})\b/);
+      if (statusMatch) {
+        return Number.parseInt(statusMatch[1], 10);
+      }
+    }
+
+    return undefined;
+  }
+
+  private shouldAttemptSilentTokenRefresh(data: OAuthRequiredEvent): boolean {
+    const statusCode = this.getOAuthRequiredStatusCode(data);
+    if (statusCode === 403) {
+      logger.info(
+        `${this.logPrefix} OAuth server returned 403; skipping silent refresh and starting interactive OAuth`,
+      );
+      return false;
+    }
+
+    const error = data.error;
+    if (error && typeof error === 'object' && 'message' in error) {
+      const message = (error as { message?: unknown }).message;
+      if (typeof message === 'string') {
+        const normalized = message.toLowerCase();
+        if (
+          normalized.includes('insufficient_scope') ||
+          normalized.includes('insufficient scope')
+        ) {
+          logger.info(
+            `${this.logPrefix} OAuth server reported insufficient scope; skipping silent refresh`,
+          );
+          return false;
+        }
+      }
+    }
+
+    return true;
+  }
+
+  private getOAuthReplayExpiresAt(createdAt?: number): number | undefined {
+    if (!createdAt) {
+      return undefined;
+    }
+
+    const expiresAt = createdAt + PENDING_STALE_MS;
+    return expiresAt > Date.now() ? expiresAt : undefined;
+  }
+
   /** Sets up OAuth event handlers for the connection */
-  protected handleOAuthEvents(connection: MCPConnection): () => void {
-    const oauthHandler = async (data: { serverUrl?: string }) => {
+  protected handleOAuthEvents(
+    connection: MCPConnection,
+    eventName: 'oauthRequired' | 'oauthReauthenticationRequired' = 'oauthRequired',
+  ): () => void {
+    const oauthHandler = async (data: OAuthRequiredEvent) => {
       logger.info(`${this.logPrefix} oauthRequired event received`);
 
+      if (!data.skipSilentRefresh && this.shouldAttemptSilentTokenRefresh(data)) {
+        const refreshedTokens = await this.attemptSilentTokenRefresh();
+        if (refreshedTokens) {
+          connection.setOAuthTokens(refreshedTokens);
+          connection.emit('oauthHandled');
+          return;
+        }
+      }
+
+      // Silent refresh failed and we're about to fall through to interactive
+      // OAuth. Invalidate any COMPLETED `mcp_oauth` flow first so
+      // `handleOAuthRequired`'s recent-completion fast path can't re-serve the
+      // tokens the resource server just rejected (see the `PENDING_STALE_MS`
+      // window in `handleOAuthRequired`).
+      await this.invalidateCompletedOAuthFlow();
+
+      if (this.connectionReady) {
+        const emitted = connection.emit('oauthReauthenticationRequired', {
+          ...data,
+          skipSilentRefresh: true,
+        });
+        if (emitted) {
+          return;
+        }
+        logger.info(
+          `${this.logPrefix} Silent refresh did not recover cached connection; requiring fresh OAuth prompt`,
+        );
+        connection.emit('oauthFailed', new Error('OAuth reauthentication required'));
+        return;
+      }
+
       if (this.returnOnOAuth) {
         try {
           const config = this.serverConfig;
-          const flowId = MCPOAuthHandler.generateFlowId(this.userId!, this.serverName);
+          const flowId = this.getBaseFlowId();
           const existingFlow = await this.flowManager!.getFlowState(flowId, 'mcp_oauth');
 
           if (existingFlow?.status === 'PENDING') {
@@ -504,7 +934,24 @@ export class MCPConnectionFactory {
               logger.debug(
                 `${this.logPrefix} Recent PENDING OAuth flow exists (${Math.round(pendingAge / 1000)}s old), skipping new initiation`,
               );
-              connection.emit('oauthFailed', new Error('OAuth flow initiated - return early'));
+              const flowMeta = existingFlow.metadata as MCPOAuthFlowMetadata | undefined;
+              const storedAuthUrl = flowMeta?.authorizationUrl;
+              if (storedAuthUrl && typeof this.oauthStart === 'function') {
+                const expiresAt = this.getOAuthReplayExpiresAt(existingFlow.createdAt);
+                if (!expiresAt) {
+                  logger.debug(`${this.logPrefix} PENDING OAuth flow expired before replay`);
+                  connection.emit(
+                    'oauthFailed',
+                    new Error('Pending OAuth flow expired before replay'),
+                  );
+                  return;
+                }
+                logger.info(
+                  `${this.logPrefix} Re-issuing stored authorization URL while reusing PENDING flow`,
+                );
+                await this.oauthStart(storedAuthUrl, { expiresAt });
+              }
+              connection.emit('oauthFailed', new Error('Pending OAuth flow reused - return early'));
               return;
             }
 
@@ -517,29 +964,32 @@ export class MCPConnectionFactory {
             authorizationUrl,
             flowId: newFlowId,
             flowMetadata,
-          } = await MCPOAuthHandler.initiateOAuthFlow(
-            this.serverName,
-            data.serverUrl || '',
-            this.userId!,
-            config?.oauth_headers ?? {},
-            config?.oauth,
-            this.allowedDomains,
-            // Only reuse stored client when deleteTokens is available for stale-client cleanup
-            this.tokenMethods?.deleteTokens ? this.tokenMethods.findToken : undefined,
-            this.allowedAddresses,
+          } = await this.runWithCapturedTenant(() =>
+            MCPOAuthHandler.initiateOAuthFlow(
+              this.serverName,
+              data.serverUrl || '',
+              this.userId!,
+              config?.oauth_headers ?? {},
+              config?.oauth,
+              this.allowedDomains,
+              // Only reuse stored client when deleteTokens is available for stale-client cleanup
+              this.tokenMethods?.deleteTokens ? this.tokenMethods.findToken : undefined,
+              this.allowedAddresses,
+              this.tenantId,
+            ),
           );
 
           if (existingFlow) {
             const oldMeta = existingFlow.metadata as MCPOAuthFlowMetadata | undefined;
             const oldState = oldMeta?.state;
-            await this.flowManager!.deleteFlow(newFlowId, 'mcp_oauth');
+            await this.flowManager!.deleteFlow(flowId, 'mcp_oauth');
             if (oldState) {
               await MCPOAuthHandler.deleteStateMapping(oldState, this.flowManager!);
             }
           }
 
           // Store flow state BEFORE redirecting so the callback can find it
-          const metadataWithUrl = { ...flowMetadata, authorizationUrl, tenantId: getTenantId() };
+          const metadataWithUrl = { ...flowMetadata, authorizationUrl, tenantId: this.tenantId };
           await this.flowManager!.initFlow(newFlowId, 'mcp_oauth', metadataWithUrl);
           await MCPOAuthHandler.storeStateMapping(flowMetadata.state, newFlowId, this.flowManager!);
 
@@ -570,18 +1020,29 @@ export class MCPConnectionFactory {
       const result = await this.handleOAuthRequired();
 
       if (result?.tokens && this.tokenMethods?.createToken) {
+        const { tokens } = result;
         try {
-          connection.setOAuthTokens(result.tokens);
-          await MCPTokenStorage.storeTokens({
-            userId: this.userId!,
-            serverName: this.serverName,
-            tokens: result.tokens,
-            createToken: this.tokenMethods.createToken,
-            updateToken: this.tokenMethods.updateToken,
-            findToken: this.tokenMethods.findToken,
-            clientInfo: result.clientInfo,
-            metadata: result.metadata,
-          });
+          connection.setOAuthTokens(tokens);
+          await this.runWithCapturedTenant(() =>
+            MCPTokenStorage.storeTokens({
+              userId: this.userId!,
+              serverName: this.serverName,
+              tokens,
+              createToken: this.tokenMethods!.createToken,
+              updateToken: this.tokenMethods!.updateToken,
+              findToken: this.tokenMethods!.findToken,
+              clientInfo: result.clientInfo,
+              metadata: MCPOAuthHandler.buildStoredClientMetadata(
+                result.metadata,
+                result.resourceMetadata,
+              ),
+            }),
+          );
+          // Same rationale as the silent-refresh success path: invalidate the
+          // `mcp_get_tokens` cache so the next `getOAuthTokens` reads the
+          // freshly stored tokens rather than the just-rejected ones the
+          // interactive flow replaced.
+          await this.invalidateGetTokensFlow(tokens);
           logger.info(`${this.logPrefix} OAuth tokens saved to storage`);
         } catch (error) {
           logger.error(`${this.logPrefix} Failed to save OAuth tokens to storage`, error);
@@ -598,16 +1059,25 @@ export class MCPConnectionFactory {
       }
     };
 
-    connection.on('oauthRequired', oauthHandler);
+    connection.on(eventName, oauthHandler);
 
     return () => {
-      connection.removeListener('oauthRequired', oauthHandler);
+      connection.removeListener(eventName, oauthHandler);
     };
   }
 
   /** Attempts to establish connection with timeout handling */
   protected async attemptToConnect(connection: MCPConnection): Promise<void> {
-    const connectTimeout = this.connectionTimeout ?? this.serverConfig.initTimeout ?? 30000;
+    const baseTimeout = this.connectionTimeout ?? this.serverConfig.initTimeout ?? 30000;
+    // OAuth servers may pause mid-connect to wait for the user to authorize in the browser.
+    // The transport connect itself is still bounded by initTimeout inside connection.connect(),
+    // so this floor only extends the window for an active OAuth wait, not ordinary failures.
+    // The grace covers the reconnect after `oauthHandled` (retry backoff + transport connect),
+    // which happens *after* the handling wait, so a user who authorizes near the deadline still
+    // gets a connection instead of a timeout.
+    const connectTimeout = this.useOAuth
+      ? Math.max(baseTimeout, mcpConfig.OAUTH_HANDLING_TIMEOUT + 60000)
+      : baseTimeout;
     await withTimeout(
       this.connectTo(connection),
       connectTimeout,
@@ -657,11 +1127,13 @@ export class MCPConnectionFactory {
     if (!MCPConnectionFactory.isClientRejection(error)) {
       return;
     }
-    await MCPTokenStorage.deleteClientRegistration({
-      userId: this.userId!,
-      serverName: this.serverName,
-      deleteTokens: this.tokenMethods.deleteTokens,
-    }).catch((err) => {
+    await this.runWithCapturedTenant(() =>
+      MCPTokenStorage.deleteClientRegistration({
+        userId: this.userId!,
+        serverName: this.serverName,
+        deleteTokens: this.tokenMethods!.deleteTokens,
+      }),
+    ).catch((err) => {
       logger.warn(`${this.logPrefix} Failed to clear stale client registration`, err);
     });
   }
@@ -729,6 +1201,7 @@ export class MCPConnectionFactory {
     tokens: MCPOAuthTokens | null;
     clientInfo?: OAuthClientInformation;
     metadata?: OAuthMetadata;
+    resourceMetadata?: OAuthProtectedResourceMetadata;
     reusedStoredClient?: boolean;
     error?: unknown;
   } | null> {
@@ -751,7 +1224,7 @@ export class MCPConnectionFactory {
       logger.debug(`${this.logPrefix} Checking for existing OAuth flow for ${this.serverName}...`);
 
       /** Flow ID to check if a flow already exists */
-      const flowId = MCPOAuthHandler.generateFlowId(this.userId!, this.serverName);
+      const flowId = this.getBaseFlowId();
 
       /** Check if there's already an ongoing OAuth flow for this flowId */
       const existingFlow = await this.flowManager.getFlowState(flowId, 'mcp_oauth');
@@ -771,10 +1244,14 @@ export class MCPConnectionFactory {
 
             const storedAuthUrl = flowMeta?.authorizationUrl;
             if (storedAuthUrl && typeof this.oauthStart === 'function') {
+              const expiresAt = this.getOAuthReplayExpiresAt(existingFlow.createdAt);
+              if (!expiresAt) {
+                throw new Error('Pending OAuth flow expired before replay');
+              }
               logger.info(
                 `${this.logPrefix} Re-issuing stored authorization URL to caller while joining PENDING flow`,
               );
-              await this.oauthStart(storedAuthUrl);
+              await this.oauthStart(storedAuthUrl, { expiresAt });
             }
 
             reusedStoredClient = flowMeta?.reusedStoredClient === true;
@@ -789,6 +1266,7 @@ export class MCPConnectionFactory {
               tokens,
               clientInfo: flowMeta?.clientInfo,
               metadata: flowMeta?.metadata,
+              resourceMetadata: flowMeta?.resourceMetadata,
               reusedStoredClient,
             };
           }
@@ -815,6 +1293,7 @@ export class MCPConnectionFactory {
               tokens: cachedTokens,
               clientInfo: flowMeta?.clientInfo,
               metadata: flowMeta?.metadata,
+              resourceMetadata: flowMeta?.resourceMetadata,
             };
           }
         }
@@ -838,21 +1317,24 @@ export class MCPConnectionFactory {
         authorizationUrl,
         flowId: newFlowId,
         flowMetadata,
-      } = await MCPOAuthHandler.initiateOAuthFlow(
-        this.serverName,
-        serverUrl,
-        this.userId!,
-        this.serverConfig.oauth_headers ?? {},
-        this.serverConfig.oauth,
-        this.allowedDomains,
-        this.tokenMethods?.deleteTokens ? this.tokenMethods.findToken : undefined,
-        this.allowedAddresses,
+      } = await this.runWithCapturedTenant(() =>
+        MCPOAuthHandler.initiateOAuthFlow(
+          this.serverName,
+          serverUrl,
+          this.userId!,
+          this.serverConfig.oauth_headers ?? {},
+          this.serverConfig.oauth,
+          this.allowedDomains,
+          this.tokenMethods?.deleteTokens ? this.tokenMethods.findToken : undefined,
+          this.allowedAddresses,
+          this.tenantId,
+        ),
       );
 
       reusedStoredClient = flowMetadata.reusedStoredClient === true;
 
       // Store flow state BEFORE redirecting so the callback can find it
-      const metadataWithUrl = { ...flowMetadata, authorizationUrl, tenantId: getTenantId() };
+      const metadataWithUrl = { ...flowMetadata, authorizationUrl, tenantId: this.tenantId };
       await this.flowManager.initFlow(newFlowId, 'mcp_oauth', metadataWithUrl);
       await MCPOAuthHandler.storeStateMapping(flowMetadata.state, newFlowId, this.flowManager);
 
@@ -877,6 +1359,7 @@ export class MCPConnectionFactory {
         tokens,
         clientInfo: flowMetadata.clientInfo,
         metadata: flowMetadata.metadata,
+        resourceMetadata: flowMetadata.resourceMetadata,
         reusedStoredClient,
       };
     } catch (error) {
diff --git a/packages/api/src/mcp/MCPManager.ts b/packages/api/src/mcp/MCPManager.ts
index 1830375ae5b..0269937e5bb 100644
--- a/packages/api/src/mcp/MCPManager.ts
+++ b/packages/api/src/mcp/MCPManager.ts
@@ -10,18 +10,25 @@ import type { FlowStateManager } from '~/flow/manager';
 import type { MCPOAuthTokens } from './oauth';
 import type { RequestBody } from '~/types';
 import type * as t from './types';
+import {
+  getMissingRuntimeBodyPlaceholderFields,
+  isOAuthServer,
+  isUserSourced,
+  requiresEphemeralUserConnection,
+  requiresOAuthMachinery,
+  requiresUserScopedConnection,
+} from './utils';
 import { MCPServersInitializer } from './registry/MCPServersInitializer';
+import { OboTokenResolutionError, resolveOboToken } from '~/mcp/oauth';
 import { MCPServerInspector } from './registry/MCPServerInspector';
 import { MCPServersRegistry } from './registry/MCPServersRegistry';
 import { UserConnectionManager } from './UserConnectionManager';
 import { ConnectionsRepository } from './ConnectionsRepository';
 import { MCPConnectionFactory } from './MCPConnectionFactory';
-import { OboTokenResolutionError, resolveOboToken } from '~/mcp/oauth';
 import { preProcessGraphTokens } from '~/utils/graph';
 import { formatToolContent } from './parsers';
 import { MCPConnection } from './connection';
 import { processMCPEnv } from '~/utils/env';
-import { isUserSourced, requiresOAuthMachinery, requiresUserScopedConnection } from './utils';
 
 function createOboToolCallErrorMessage(
   logPrefix: string,
@@ -61,7 +68,7 @@ export class MCPManager extends UserConnectionManager {
   }
 
   /** Initializes the MCPManager by setting up server registry and app connections */
-  public async initialize(configs: t.MCPServers) {
+  public async initialize(configs: t.MCPServers): Promise<void> {
     await MCPServersInitializer.initialize(configs);
     this.appConnections = new ConnectionsRepository(undefined);
   }
@@ -138,12 +145,32 @@ export class MCPManager extends UserConnectionManager {
       return { tools: null, oauthRequired: false, oauthUrl: null };
     }
 
-    const useOAuth = requiresOAuthMachinery(serverConfig);
+    const missingBodyFields = getMissingRuntimeBodyPlaceholderFields(
+      serverConfig,
+      args.requestBody,
+    );
+    if (missingBodyFields.length > 0) {
+      logger.warn(
+        `${logPrefix} [Discovery] Request body field(s) required to resolve runtime MCP placeholders: ${missingBodyFields.join(', ')}`,
+      );
+      return { tools: null, oauthRequired: false, oauthUrl: null };
+    }
 
     const registry = MCPServersRegistry.getInstance();
-    const useSSRFProtection = registry.shouldEnableSSRFProtection();
-    const allowedDomains = registry.getAllowedDomains();
-    const allowedAddresses = registry.getAllowedAddresses();
+    const { allowedDomains, allowedAddresses, useSSRFProtection } =
+      await registry.resolveAllowlists({ userId: user?.id, role: user?.role });
+    await this.assertResolvedRuntimeConfigAllowed({
+      config: serverConfig,
+      user,
+      customUserVars: args.customUserVars,
+      requestBody: args.requestBody,
+      graphTokenResolver: args.graphTokenResolver,
+      allowedDomains,
+      allowedAddresses,
+      logPrefix: `${logPrefix} [Discovery]`,
+    });
+
+    const useOAuth = requiresOAuthMachinery(serverConfig);
     const dbSourced = isUserSourced(serverConfig);
     const basic: t.BasicConnectionOptions = {
       dbSourced,
@@ -154,18 +181,32 @@ export class MCPManager extends UserConnectionManager {
       allowedAddresses,
     };
 
+    const finalizeDiscoveryResult = async (
+      result: Awaited<ReturnType<typeof MCPConnectionFactory.discoverTools>>,
+    ): Promise<t.ToolDiscoveryResult> => {
+      if (result.connection) {
+        try {
+          await result.connection.disconnect();
+        } catch (error) {
+          logger.warn(`${logPrefix} [Discovery] Failed to disconnect discovery connection`, error);
+        }
+      }
+      return {
+        tools: result.tools,
+        oauthRequired: result.oauthRequired,
+        oauthUrl: result.oauthUrl,
+      };
+    };
+
     if (!useOAuth) {
       const result = await MCPConnectionFactory.discoverTools(basic, {
         user: args.user,
         customUserVars: args.customUserVars,
         requestBody: args.requestBody,
+        graphTokenResolver: args.graphTokenResolver,
         connectionTimeout: args.connectionTimeout,
       });
-      return {
-        tools: result.tools,
-        oauthRequired: result.oauthRequired,
-        oauthUrl: result.oauthUrl,
-      };
+      return finalizeDiscoveryResult(result);
     }
 
     if (!user || !args.flowManager) {
@@ -182,12 +223,13 @@ export class MCPManager extends UserConnectionManager {
       oauthStart: args.oauthStart,
       customUserVars: args.customUserVars,
       requestBody: args.requestBody,
+      graphTokenResolver: args.graphTokenResolver,
       connectionTimeout: args.connectionTimeout,
       oboTokenResolver: args.oboTokenResolver,
       oboTrustChecker: args.oboTrustChecker,
     });
 
-    return { tools: result.tools, oauthRequired: result.oauthRequired, oauthUrl: result.oauthUrl };
+    return finalizeDiscoveryResult(result);
   }
 
   /** Returns all available tool functions from app-level connections */
@@ -307,6 +349,7 @@ Please follow these instructions when using tools from the respective MCP server
     options,
     tokenMethods,
     requestBody,
+    requestScopedConnections,
     flowManager,
     oauthStart,
     oauthEnd,
@@ -324,10 +367,11 @@ Please follow these instructions when using tools from the respective MCP server
     toolArguments?: Record<string, unknown>;
     options?: RequestOptions;
     requestBody?: RequestBody;
+    requestScopedConnections?: t.RequestScopedMCPConnectionStore;
     tokenMethods?: TokenMethods;
     customUserVars?: Record<string, string>;
     flowManager: FlowStateManager<MCPOAuthTokens | null>;
-    oauthStart?: (authURL: string) => Promise<void>;
+    oauthStart?: t.OAuthStartHandler;
     oauthEnd?: () => Promise<void>;
     graphTokenResolver?: GraphTokenResolver;
     oboTokenResolver?: OboTokenResolver;
@@ -335,6 +379,8 @@ Please follow these instructions when using tools from the respective MCP server
   }): Promise<t.FormattedToolResponse> {
     /** User-specific connection */
     let connection: MCPConnection | undefined;
+    let cleanupRequestOAuthHandler: (() => void) | undefined;
+    let disconnectAfterCall = false;
     const userId = user?.id;
     const logPrefix = userId ? `[MCP][User: ${userId}][${serverName}]` : `[MCP][${serverName}]`;
 
@@ -350,9 +396,11 @@ Please follow these instructions when using tools from the respective MCP server
         oauthEnd,
         oboTokenResolver,
         oboTrustChecker,
+        graphTokenResolver,
         signal: options?.signal,
         customUserVars,
         requestBody,
+        requestScopedConnections,
         serverConfig: providedConfig,
       });
 
@@ -364,9 +412,8 @@ Please follow these instructions when using tools from the respective MCP server
         );
       }
 
-      const rawConfig =
-        providedConfig ??
-        (await MCPServersRegistry.getInstance().getServerConfig(serverName, userId));
+      const registry = MCPServersRegistry.getInstance();
+      const rawConfig = providedConfig ?? (await registry.getServerConfig(serverName, userId));
       if (!rawConfig) {
         throw new McpError(
           ErrorCode.InvalidRequest,
@@ -374,6 +421,8 @@ Please follow these instructions when using tools from the respective MCP server
         );
       }
       const isDbSourced = isUserSourced(rawConfig);
+      disconnectAfterCall =
+        !!userId && requiresEphemeralUserConnection(rawConfig) && !requestScopedConnections;
 
       /** Pre-process Graph token placeholders (async) before the synchronous processMCPEnv pass */
       const graphProcessedConfig = isDbSourced
@@ -434,6 +483,33 @@ Please follow these instructions when using tools from the respective MCP server
         }
         resolvedHeaders['Authorization'] = `Bearer ${oboTokens.access_token}`;
       }
+      if (userId && user && oauthStart && flowManager && isOAuthServer(currentOptions)) {
+        const { allowedDomains, allowedAddresses, useSSRFProtection } =
+          await registry.resolveAllowlists({ userId, role: user?.role });
+        cleanupRequestOAuthHandler = MCPConnectionFactory.attachRequestOAuthHandler(
+          {
+            serverName,
+            serverConfig: currentOptions,
+            dbSourced: isDbSourced,
+            skipEnvProcessing: true,
+            useSSRFProtection,
+            allowedDomains,
+            allowedAddresses,
+          },
+          {
+            useOAuth: true,
+            user,
+            flowManager,
+            tokenMethods,
+            signal: options?.signal,
+            oauthStart,
+            oauthEnd,
+            customUserVars,
+            requestBody,
+          },
+          connection,
+        );
+      }
 
       connection.setRequestHeaders(resolvedHeaders);
 
@@ -462,6 +538,20 @@ Please follow these instructions when using tools from the respective MCP server
       logger.error(`${logPrefix}[${toolName}] Tool call failed`, error);
       // Rethrowing allows the caller (createMCPTool) to handle the final user message
       throw error;
+    } finally {
+      cleanupRequestOAuthHandler?.();
+      // Ephemeral connections are never stored in userConnections, so disconnecting
+      // is the only cleanup needed; removing the map entry here could orphan a
+      // still-connected cached connection from before a config change.
+      if (disconnectAfterCall && connection) {
+        try {
+          await connection.disconnect();
+        } catch (disconnectError) {
+          logger.warn(`${logPrefix}[${toolName}] Failed to disconnect ephemeral connection`, {
+            error: disconnectError,
+          });
+        }
+      }
     }
   }
 }
diff --git a/packages/api/src/mcp/UserConnectionManager.ts b/packages/api/src/mcp/UserConnectionManager.ts
index a295b4b0b8b..c083d799791 100644
--- a/packages/api/src/mcp/UserConnectionManager.ts
+++ b/packages/api/src/mcp/UserConnectionManager.ts
@@ -1,13 +1,43 @@
-import { logger } from '@librechat/data-schemas';
+import { logger, getTenantId } from '@librechat/data-schemas';
 import { ErrorCode, McpError } from '@modelcontextprotocol/sdk/types.js';
+import type { MCPOAuthFlowMetadata } from '~/mcp/oauth';
+import type { FlowState } from '~/flow/types';
 import type * as t from './types';
+import {
+  getMissingRuntimeBodyPlaceholderFields,
+  hasRuntimeUrlPlaceholders,
+  isUserSourced,
+  requiresEphemeralUserConnection,
+  requiresOAuthMachinery,
+} from './utils';
 import { MCPServersRegistry } from '~/mcp/registry/MCPServersRegistry';
+import { detectOAuthRequirement, MCPOAuthHandler } from '~/mcp/oauth';
 import { ConnectionsRepository } from '~/mcp/ConnectionsRepository';
 import { MCPConnectionFactory } from '~/mcp/MCPConnectionFactory';
-import { isUserSourced, requiresOAuthMachinery } from './utils';
+import { preProcessGraphTokens } from '~/utils/graph';
+import { isMCPDomainAllowed } from '~/auth/domain';
+import { PENDING_STALE_MS } from '~/flow/manager';
 import { MCPConnection } from './connection';
+import { processMCPEnv } from '~/utils/env';
 import { mcpConfig } from './mcpConfig';
 
+type PendingOAuthStart = {
+  authURL: string;
+  options?: t.OAuthStartOptions;
+};
+
+type PendingOAuthState = {
+  oauthStarts: Set<t.OAuthStartHandler>;
+  emittedAuthUrls: WeakMap<t.OAuthStartHandler, string>;
+  primaryOAuthStart?: t.OAuthStartHandler;
+  lastOAuthStart?: PendingOAuthStart;
+};
+
+type PendingConnection = {
+  promise: Promise<MCPConnection>;
+  oauth: PendingOAuthState;
+};
+
 /**
  * Abstract base class for managing user-specific MCP connections with lifecycle management.
  * Only meant to be extended by MCPManager.
@@ -23,7 +53,7 @@ export abstract class UserConnectionManager {
   /** Last activity timestamp for users (not per server) */
   protected userLastActivity: Map<string, number> = new Map();
   /** In-flight connection promises keyed by `userId:serverName` — coalesces concurrent attempts */
-  protected pendingConnections: Map<string, Promise<MCPConnection>> = new Map();
+  protected pendingConnections: Map<string, PendingConnection> = new Map();
 
   /** Updates the last activity timestamp for a user */
   protected updateUserLastActivity(userId: string): void {
@@ -42,31 +72,292 @@ export abstract class UserConnectionManager {
       throw new McpError(ErrorCode.InvalidRequest, `[MCP] User object missing id property`);
     }
 
+    const config =
+      opts.serverConfig ??
+      (await MCPServersRegistry.getInstance().getServerConfig(serverName, userId));
+    const missingBodyFields = config
+      ? getMissingRuntimeBodyPlaceholderFields(config, opts.requestBody)
+      : [];
+    if (missingBodyFields.length > 0) {
+      throw new McpError(
+        ErrorCode.InvalidRequest,
+        `[MCP][User: ${userId}][${serverName}] Request body field(s) required to resolve runtime MCP placeholders: ${missingBodyFields.join(', ')}.`,
+      );
+    }
+    const ephemeralConnection = config ? requiresEphemeralUserConnection(config) : false;
+    const requestScopedConnections = ephemeralConnection
+      ? opts.requestScopedConnections
+      : undefined;
+    if (requestScopedConnections) {
+      const requestConnectionKey = `${userId}:${serverName}`;
+      const existing = requestScopedConnections.connections.get(requestConnectionKey) as
+        | MCPConnection
+        | undefined;
+      if (existing) {
+        if (!config || (config.updatedAt && existing.isStale(config.updatedAt))) {
+          await existing.disconnect().catch((error) => {
+            logger.warn(
+              `[MCP][User: ${userId}][${serverName}] Failed to disconnect stale request-scoped connection`,
+              error,
+            );
+          });
+          requestScopedConnections.connections.delete(requestConnectionKey);
+        } else if (await existing.isConnected()) {
+          logger.debug(`[MCP][User: ${userId}][${serverName}] Reusing request-scoped connection`);
+          this.updateUserLastActivity(userId);
+          return existing;
+        } else {
+          requestScopedConnections.connections.delete(requestConnectionKey);
+        }
+      }
+
+      const pending = requestScopedConnections.pending.get(requestConnectionKey) as
+        | Promise<MCPConnection>
+        | undefined;
+      if (pending) {
+        logger.debug(
+          `[MCP][User: ${userId}][${serverName}] Joining in-flight request-scoped connection attempt`,
+        );
+        return pending;
+      }
+
+      const pendingOAuth = this.createPendingOAuthState(opts.oauthStart);
+      const connectionPromise = this.createUserConnectionInternal(
+        {
+          ...opts,
+          forceNew: true,
+          ephemeralConnection: true,
+          serverConfig: config,
+          oauthStart: this.createPendingOAuthStart(serverName, userId, pendingOAuth),
+        },
+        userId,
+        forceNew === true,
+      ).then((connection) => {
+        requestScopedConnections.connections.set(requestConnectionKey, connection);
+        return connection;
+      });
+
+      requestScopedConnections.pending.set(
+        requestConnectionKey,
+        connectionPromise as Promise<unknown>,
+      );
+
+      try {
+        return await connectionPromise;
+      } finally {
+        if (requestScopedConnections.pending.get(requestConnectionKey) === connectionPromise) {
+          requestScopedConnections.pending.delete(requestConnectionKey);
+        }
+      }
+    }
+
+    const forceNewConnection = forceNew || ephemeralConnection;
+    const clearCooldown = forceNew === true;
+
     const lockKey = `${userId}:${serverName}`;
 
-    if (!forceNew) {
+    if (!forceNewConnection) {
       const pending = this.pendingConnections.get(lockKey);
       if (pending) {
         logger.debug(`[MCP][User: ${userId}][${serverName}] Joining in-flight connection attempt`);
-        return pending;
+        await this.addPendingOAuthStart(pending.oauth, opts, userId);
+        return pending.promise;
       }
     }
 
-    const connectionPromise = this.createUserConnectionInternal(opts, userId);
+    const pendingOAuth = this.createPendingOAuthState(opts.oauthStart);
+    const connectionPromise = this.createUserConnectionInternal(
+      {
+        ...opts,
+        forceNew: forceNewConnection,
+        ephemeralConnection,
+        serverConfig: config,
+        oauthStart: this.createPendingOAuthStart(serverName, userId, pendingOAuth),
+      },
+      userId,
+      clearCooldown,
+    );
 
-    if (!forceNew) {
-      this.pendingConnections.set(lockKey, connectionPromise);
+    if (!forceNewConnection) {
+      this.pendingConnections.set(lockKey, { promise: connectionPromise, oauth: pendingOAuth });
     }
 
     try {
       return await connectionPromise;
     } finally {
-      if (!forceNew && this.pendingConnections.get(lockKey) === connectionPromise) {
+      if (
+        !forceNewConnection &&
+        this.pendingConnections.get(lockKey)?.promise === connectionPromise
+      ) {
         this.pendingConnections.delete(lockKey);
       }
     }
   }
 
+  private createPendingOAuthState(oauthStart?: t.OAuthStartHandler): PendingOAuthState {
+    return {
+      oauthStarts: oauthStart ? new Set([oauthStart]) : new Set(),
+      emittedAuthUrls: new WeakMap<t.OAuthStartHandler, string>(),
+      primaryOAuthStart: oauthStart,
+    };
+  }
+
+  private createPendingOAuthStart(
+    serverName: string,
+    userId: string,
+    pendingOAuth: PendingOAuthState,
+  ): t.OAuthStartHandler {
+    return async (authURL, options) => {
+      pendingOAuth.lastOAuthStart = { authURL, options };
+
+      let primaryError: unknown;
+      const oauthStarts = Array.from(pendingOAuth.oauthStarts);
+      for (const oauthStart of oauthStarts) {
+        try {
+          await this.emitPendingOAuthStart(pendingOAuth, oauthStart, authURL, options);
+        } catch (error) {
+          if (oauthStart === pendingOAuth.primaryOAuthStart) {
+            primaryError = error;
+          } else {
+            logger.warn(
+              `[MCP][User: ${userId}][${serverName}] Failed to notify joined OAuth listener`,
+              error,
+            );
+          }
+        }
+      }
+
+      if (primaryError) {
+        throw primaryError;
+      }
+    };
+  }
+
+  private async addPendingOAuthStart(
+    pendingOAuth: PendingOAuthState,
+    opts: t.UserMCPConnectionOptions,
+    userId: string,
+  ): Promise<void> {
+    const { oauthStart, serverName } = opts;
+    if (typeof oauthStart !== 'function') {
+      return;
+    }
+
+    pendingOAuth.oauthStarts.add(oauthStart);
+    const lastOAuthStart = pendingOAuth.lastOAuthStart;
+    if (lastOAuthStart) {
+      try {
+        const pendingOAuthStart =
+          lastOAuthStart.options?.expiresAt == null
+            ? await this.getFlowPendingOAuthStart(opts, userId)
+            : undefined;
+        const replayOAuthStart =
+          pendingOAuthStart?.authURL === lastOAuthStart.authURL
+            ? pendingOAuthStart
+            : lastOAuthStart;
+        await this.emitPendingOAuthStart(
+          pendingOAuth,
+          oauthStart,
+          replayOAuthStart.authURL,
+          replayOAuthStart.options,
+        );
+      } catch (error) {
+        logger.warn(
+          `[MCP][User: ${userId}][${serverName}] Failed to re-issue pending OAuth URL`,
+          error,
+        );
+      }
+      return;
+    }
+
+    await this.reissuePendingOAuthStart(opts, userId, pendingOAuth);
+  }
+
+  private async emitPendingOAuthStart(
+    pendingOAuth: PendingOAuthState,
+    oauthStart: t.OAuthStartHandler,
+    authURL: string,
+    options?: t.OAuthStartOptions,
+  ): Promise<void> {
+    if (pendingOAuth.emittedAuthUrls.get(oauthStart) === authURL) {
+      return;
+    }
+    pendingOAuth.emittedAuthUrls.set(oauthStart, authURL);
+    await oauthStart(authURL, options);
+  }
+
+  private getPendingOAuthStart(flow: FlowState | null | undefined): PendingOAuthStart | undefined {
+    if (flow?.status !== 'PENDING') {
+      return undefined;
+    }
+
+    const expiresAt = flow.createdAt + PENDING_STALE_MS;
+    if (expiresAt <= Date.now()) {
+      return undefined;
+    }
+
+    const metadata = flow.metadata as MCPOAuthFlowMetadata | undefined;
+    const authorizationUrl = metadata?.authorizationUrl;
+    if (!authorizationUrl) {
+      return undefined;
+    }
+
+    return { authURL: authorizationUrl, options: { expiresAt } };
+  }
+
+  private async getFlowPendingOAuthStart(
+    { flowManager, serverName }: Pick<t.UserMCPConnectionOptions, 'flowManager' | 'serverName'>,
+    userId: string,
+  ): Promise<PendingOAuthStart | undefined> {
+    if (!flowManager) {
+      return undefined;
+    }
+
+    const flowId = MCPOAuthHandler.generateFlowId(userId, serverName, getTenantId());
+    const existingFlow = await flowManager.getFlowState(flowId, 'mcp_oauth');
+    return this.getPendingOAuthStart(existingFlow);
+  }
+
+  private async reissuePendingOAuthStart(
+    { flowManager, oauthStart, serverName }: t.UserMCPConnectionOptions,
+    userId: string,
+    pendingOAuth?: PendingOAuthState,
+  ): Promise<void> {
+    if (!flowManager || typeof oauthStart !== 'function') {
+      return;
+    }
+
+    try {
+      const pendingOAuthStart = await this.getFlowPendingOAuthStart(
+        { flowManager, serverName },
+        userId,
+      );
+      if (!pendingOAuthStart) {
+        return;
+      }
+
+      logger.info(
+        `[MCP][User: ${userId}][${serverName}] Re-issuing stored authorization URL while joining in-flight connection`,
+      );
+      if (pendingOAuth) {
+        pendingOAuth.lastOAuthStart = pendingOAuthStart;
+        await this.emitPendingOAuthStart(
+          pendingOAuth,
+          oauthStart,
+          pendingOAuthStart.authURL,
+          pendingOAuthStart.options,
+        );
+      } else {
+        await oauthStart(pendingOAuthStart.authURL, pendingOAuthStart.options);
+      }
+    } catch (error) {
+      logger.warn(
+        `[MCP][User: ${userId}][${serverName}] Failed to re-issue pending OAuth URL`,
+        error,
+      );
+    }
+  }
+
   private async createUserConnectionInternal(
     {
       serverName,
@@ -83,9 +374,12 @@ export abstract class UserConnectionManager {
       signal,
       returnOnOAuth = false,
       connectionTimeout,
+      graphTokenResolver,
+      ephemeralConnection = false,
       serverConfig: providedConfig,
     }: t.UserMCPConnectionOptions,
     userId: string,
+    clearCooldown: boolean,
   ): Promise<MCPConnection> {
     if (await this.appConnections!.has(serverName)) {
       throw new McpError(
@@ -100,7 +394,7 @@ export abstract class UserConnectionManager {
 
     const userServerMap = this.userConnections.get(userId);
     let connection = forceNew ? undefined : userServerMap?.get(serverName);
-    if (forceNew) {
+    if (clearCooldown) {
       MCPConnection.clearCooldown(serverName);
     }
     const now = Date.now();
@@ -151,17 +445,37 @@ export abstract class UserConnectionManager {
     logger.info(`[MCP][User: ${userId}][${serverName}] Establishing new connection`);
 
     try {
+      const runtimeConfig = await this.applyRuntimeOAuthDetection({
+        config,
+        user,
+        customUserVars,
+        requestBody,
+        graphTokenResolver,
+      });
       const registry = MCPServersRegistry.getInstance();
+      const { allowedDomains, allowedAddresses, useSSRFProtection } =
+        await registry.resolveAllowlists({ userId: user?.id, role: user?.role });
+      await this.assertResolvedRuntimeConfigAllowed({
+        config: runtimeConfig,
+        user,
+        customUserVars,
+        requestBody,
+        graphTokenResolver,
+        allowedDomains,
+        allowedAddresses,
+        logPrefix: `[MCP][User: ${userId}][${serverName}]`,
+      });
       const basic: t.BasicConnectionOptions = {
-        serverConfig: config,
+        serverConfig: runtimeConfig,
         serverName: serverName,
-        dbSourced: isUserSourced(config),
-        useSSRFProtection: registry.shouldEnableSSRFProtection(),
-        allowedDomains: registry.getAllowedDomains(),
-        allowedAddresses: registry.getAllowedAddresses(),
+        dbSourced: isUserSourced(runtimeConfig),
+        useSSRFProtection,
+        allowedDomains,
+        allowedAddresses,
+        ephemeralConnection,
       };
 
-      const useOAuth = requiresOAuthMachinery(config);
+      const useOAuth = requiresOAuthMachinery(runtimeConfig);
       let connectionOptions: t.OAuthConnectionOptions | t.UserConnectionContext;
       if (useOAuth) {
         if (!flowManager) {
@@ -182,6 +496,7 @@ export abstract class UserConnectionManager {
           oauthEnd: oauthEnd,
           oboTokenResolver: oboTokenResolver,
           oboTrustChecker: oboTrustChecker,
+          graphTokenResolver,
           returnOnOAuth: returnOnOAuth,
           requestBody: requestBody,
           connectionTimeout: connectionTimeout,
@@ -191,6 +506,7 @@ export abstract class UserConnectionManager {
           user,
           customUserVars,
           requestBody,
+          graphTokenResolver,
           connectionTimeout,
         };
       }
@@ -201,10 +517,12 @@ export abstract class UserConnectionManager {
         throw new Error('Failed to establish connection after initialization attempt.');
       }
 
-      if (!this.userConnections.has(userId)) {
-        this.userConnections.set(userId, new Map());
+      if (!ephemeralConnection) {
+        if (!this.userConnections.has(userId)) {
+          this.userConnections.set(userId, new Map());
+        }
+        this.userConnections.get(userId)?.set(serverName, connection);
       }
-      this.userConnections.get(userId)?.set(serverName, connection);
 
       logger.info(`[MCP][User: ${userId}][${serverName}] Connection successfully established`);
       // Update timestamp on creation
@@ -225,8 +543,155 @@ export abstract class UserConnectionManager {
     }
   }
 
+  /**
+   * Mirrors the resolution MCPConnectionFactory performs internally
+   * (preProcessGraphTokens + processMCPEnv). Both must stay in sync so the
+   * config validated here matches the one the factory actually connects with.
+   */
+  protected async resolveRuntimeConfig({
+    config,
+    user,
+    customUserVars,
+    requestBody,
+    graphTokenResolver,
+  }: {
+    config: t.ParsedServerConfig;
+    user?: t.UserMCPConnectionOptions['user'];
+    customUserVars?: Record<string, string>;
+    requestBody?: t.UserMCPConnectionOptions['requestBody'];
+    graphTokenResolver?: t.UserMCPConnectionOptions['graphTokenResolver'];
+  }): Promise<t.ParsedServerConfig> {
+    const dbSourced = isUserSourced(config);
+    const graphProcessedConfig = dbSourced
+      ? config
+      : await preProcessGraphTokens(config, {
+          user,
+          graphTokenResolver,
+          scopes: process.env.GRAPH_API_SCOPES,
+        });
+
+    return processMCPEnv({
+      user,
+      body: requestBody,
+      dbSourced,
+      options: graphProcessedConfig,
+      customUserVars,
+    }) as t.ParsedServerConfig;
+  }
+
+  protected async assertResolvedRuntimeConfigAllowed({
+    config,
+    user,
+    customUserVars,
+    requestBody,
+    graphTokenResolver,
+    allowedDomains,
+    allowedAddresses,
+    logPrefix,
+  }: {
+    config: t.ParsedServerConfig;
+    user?: t.UserMCPConnectionOptions['user'];
+    customUserVars?: Record<string, string>;
+    requestBody?: t.UserMCPConnectionOptions['requestBody'];
+    graphTokenResolver?: t.UserMCPConnectionOptions['graphTokenResolver'];
+    allowedDomains?: string[] | null;
+    allowedAddresses?: string[] | null;
+    logPrefix: string;
+  }): Promise<t.ParsedServerConfig> {
+    const resolvedConfig = await this.resolveRuntimeConfig({
+      config,
+      user,
+      customUserVars,
+      requestBody,
+      graphTokenResolver,
+    });
+
+    if (!resolvedConfig.url) {
+      return resolvedConfig;
+    }
+
+    if (hasRuntimeUrlPlaceholders(resolvedConfig)) {
+      throw new McpError(
+        ErrorCode.InvalidRequest,
+        `${logPrefix} Runtime URL still contains unresolved MCP placeholders after resolution.`,
+      );
+    }
+
+    const allowed = await isMCPDomainAllowed(resolvedConfig, allowedDomains, allowedAddresses);
+    if (!allowed) {
+      throw new McpError(
+        ErrorCode.InvalidRequest,
+        `${logPrefix} Resolved MCP server URL is not allowed by the configured domain policy.`,
+      );
+    }
+
+    return resolvedConfig;
+  }
+
+  private async applyRuntimeOAuthDetection({
+    config,
+    user,
+    customUserVars,
+    requestBody,
+    graphTokenResolver,
+  }: {
+    config: t.ParsedServerConfig;
+    user?: t.UserMCPConnectionOptions['user'];
+    customUserVars?: Record<string, string>;
+    requestBody?: t.UserMCPConnectionOptions['requestBody'];
+    graphTokenResolver?: t.UserMCPConnectionOptions['graphTokenResolver'];
+  }): Promise<t.ParsedServerConfig> {
+    if (
+      config.requiresOAuth != null ||
+      config.apiKey?.source === 'admin' ||
+      !hasRuntimeUrlPlaceholders(config)
+    ) {
+      return config;
+    }
+
+    const resolvedConfig = await this.resolveRuntimeConfig({
+      config,
+      user,
+      customUserVars,
+      requestBody,
+      graphTokenResolver,
+    });
+
+    if (!resolvedConfig.url || hasRuntimeUrlPlaceholders(resolvedConfig)) {
+      logger.warn(
+        `[MCP][User: ${user?.id}][${config.url}] Runtime URL still contains placeholders after resolution; skipping OAuth detection`,
+      );
+      return config;
+    }
+
+    const registry = MCPServersRegistry.getInstance();
+    const { allowedDomains, allowedAddresses } = await registry.resolveAllowlists({
+      userId: user?.id,
+      role: user?.role,
+    });
+    const allowed = await isMCPDomainAllowed(resolvedConfig, allowedDomains, allowedAddresses);
+    if (!allowed) {
+      throw new McpError(
+        ErrorCode.InvalidRequest,
+        `[MCP][User: ${user?.id}][${config.url}] Resolved MCP server URL is not allowed by the configured domain policy.`,
+      );
+    }
+
+    const result = await detectOAuthRequirement(
+      resolvedConfig.url,
+      allowedDomains,
+      allowedAddresses,
+    );
+
+    return {
+      ...config,
+      requiresOAuth: result.requiresOAuth,
+      oauthMetadata: result.metadata,
+    };
+  }
+
   /** Returns all connections for a specific user */
-  public getUserConnections(userId: string) {
+  public getUserConnections(userId: string): Map<string, MCPConnection> | undefined {
     return this.userConnections.get(userId);
   }
 
diff --git a/packages/api/src/mcp/__tests__/ConnectionsRepository.test.ts b/packages/api/src/mcp/__tests__/ConnectionsRepository.test.ts
index bd525377785..73b88587deb 100644
--- a/packages/api/src/mcp/__tests__/ConnectionsRepository.test.ts
+++ b/packages/api/src/mcp/__tests__/ConnectionsRepository.test.ts
@@ -21,12 +21,20 @@ jest.mock('../MCPConnectionFactory', () => ({
 jest.mock('../connection');
 
 // Mock the registry
+const mockShouldEnableSSRFProtection = jest.fn().mockReturnValue(false);
+const mockGetAllowedDomains = jest.fn().mockReturnValue(null);
+const mockGetAllowedAddresses = jest.fn().mockReturnValue(null);
 const mockRegistryInstance = {
   getServerConfig: jest.fn(),
   getAllServerConfigs: jest.fn(),
-  shouldEnableSSRFProtection: jest.fn().mockReturnValue(false),
-  getAllowedDomains: jest.fn().mockReturnValue(null),
-  getAllowedAddresses: jest.fn().mockReturnValue(null),
+  shouldEnableSSRFProtection: mockShouldEnableSSRFProtection,
+  getAllowedDomains: mockGetAllowedDomains,
+  getAllowedAddresses: mockGetAllowedAddresses,
+  resolveAllowlists: jest.fn(async () => ({
+    allowedDomains: mockGetAllowedDomains(),
+    allowedAddresses: mockGetAllowedAddresses(),
+    useSSRFProtection: mockShouldEnableSSRFProtection(),
+  })),
 };
 
 jest.mock('../registry/MCPServersRegistry', () => ({
diff --git a/packages/api/src/mcp/__tests__/MCPConnectionFactory.oauthSdk.integration.test.ts b/packages/api/src/mcp/__tests__/MCPConnectionFactory.oauthSdk.integration.test.ts
new file mode 100644
index 00000000000..618bcbf02e3
--- /dev/null
+++ b/packages/api/src/mcp/__tests__/MCPConnectionFactory.oauthSdk.integration.test.ts
@@ -0,0 +1,270 @@
+import { Keyv } from 'keyv';
+import type { IUser } from '@librechat/data-schemas';
+import type {
+  OAuthClientInformation,
+  OAuthStoredClientMetadata,
+  MCPOAuthTokens,
+} from '~/mcp/oauth';
+import {
+  MockKeyv,
+  InMemoryTokenStore,
+  createOAuthMCPServer,
+  type OAuthTestServer,
+} from './helpers/oauthTestServer';
+import { MCPConnectionFactory } from '~/mcp/MCPConnectionFactory';
+import { FlowStateManager } from '~/flow/manager';
+import { MCPConnection } from '~/mcp/connection';
+import { MCPTokenStorage } from '~/mcp/oauth';
+
+jest.mock('@librechat/data-schemas', () => ({
+  logger: {
+    info: jest.fn(),
+    warn: jest.fn(),
+    error: jest.fn(),
+    debug: jest.fn(),
+  },
+  getTenantId: jest.fn(),
+  tenantStorage: {
+    getStore: jest.fn(),
+    run: jest.fn((_context, fn: () => Promise<unknown>) => fn()),
+  },
+  encryptV2: jest.fn(async (val: string) => `enc:${val}`),
+  decryptV2: jest.fn(async (val: string) => val.replace(/^enc:/, '')),
+}));
+
+jest.mock('~/auth', () => ({
+  createSSRFSafeUndiciConnect: jest.fn(() => undefined),
+  isOAuthUrlAllowed: jest.fn(() => false),
+  isSSRFTarget: jest.fn(() => false),
+  resolveHostnameSSRF: jest.fn(async () => false),
+}));
+
+jest.mock('~/mcp/mcpConfig', () => ({
+  mcpConfig: { CONNECTION_CHECK_TTL: 0, USER_CONNECTION_IDLE_TIMEOUT: 30 * 60 * 1000 },
+}));
+
+const SERVER_NAME = 'sdk-oauth-server';
+const USER_ID = 'sdk-user';
+const CLIENT_ID = 'librechat-sdk-test-client';
+
+async function safeDisconnect(conn: MCPConnection | null): Promise<void> {
+  if (!conn) {
+    return;
+  }
+  (conn as unknown as { shouldStopReconnecting: boolean }).shouldStopReconnecting = true;
+  conn.removeAllListeners();
+  await conn.disconnect().catch(() => undefined);
+}
+
+function createFlowManager(): FlowStateManager<MCPOAuthTokens | null> {
+  return new FlowStateManager(new MockKeyv<MCPOAuthTokens | null>() as unknown as Keyv, {
+    ttl: 30000,
+    ci: true,
+  });
+}
+
+async function issueTokens(server: OAuthTestServer, scope = 'read'): Promise<MCPOAuthTokens> {
+  const authUrl = new URL('authorize', server.url);
+  authUrl.searchParams.set('redirect_uri', 'http://localhost');
+  authUrl.searchParams.set('state', 'sdk-test');
+  authUrl.searchParams.set('client_id', CLIENT_ID);
+  authUrl.searchParams.set('scope', scope);
+  authUrl.searchParams.set('resource', server.resourceUrl);
+
+  const authRes = await fetch(authUrl, { redirect: 'manual' });
+  const location = authRes.headers.get('location');
+  if (!location) {
+    throw new Error(`Authorization failed with ${authRes.status}`);
+  }
+  const code = new URL(location).searchParams.get('code');
+  if (!code) {
+    throw new Error('Authorization response did not include a code');
+  }
+
+  const body = new URLSearchParams({
+    grant_type: 'authorization_code',
+    code,
+    client_id: CLIENT_ID,
+    resource: server.resourceUrl,
+  });
+  const tokenRes = await fetch(new URL('token', server.url), {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    body,
+  });
+  if (!tokenRes.ok) {
+    throw new Error(`Token exchange failed: ${tokenRes.status} ${await tokenRes.text()}`);
+  }
+  const tokens = (await tokenRes.json()) as {
+    access_token: string;
+    token_type: string;
+    expires_in: number;
+    refresh_token?: string;
+    scope?: string;
+  };
+  return {
+    ...tokens,
+    obtained_at: Date.now(),
+    expires_at: Date.now() + tokens.expires_in * 1000,
+  };
+}
+
+async function storeTokens(
+  tokenStore: InMemoryTokenStore,
+  server: OAuthTestServer,
+  tokens: MCPOAuthTokens,
+  scope = 'read',
+): Promise<void> {
+  const clientInfo: OAuthClientInformation = {
+    client_id: CLIENT_ID,
+    redirect_uris: ['http://localhost'],
+    grant_types: ['authorization_code', 'refresh_token'],
+    response_types: ['code'],
+    token_endpoint_auth_method: 'none',
+    scope,
+  };
+  const metadata: OAuthStoredClientMetadata = {
+    issuer: server.url.replace(/\/$/, ''),
+    authorization_endpoint: new URL('authorize', server.url).href,
+    token_endpoint: new URL('token', server.url).href,
+    response_types_supported: ['code'],
+    grant_types_supported: ['authorization_code', 'refresh_token'],
+    token_endpoint_auth_methods_supported: ['none'],
+    scopes_supported: scope.split(/\s+/).filter(Boolean),
+    resource: server.resourceUrl,
+  };
+
+  await MCPTokenStorage.storeTokens({
+    userId: USER_ID,
+    serverName: SERVER_NAME,
+    tokens,
+    createToken: tokenStore.createToken,
+    updateToken: tokenStore.updateToken,
+    findToken: tokenStore.findToken,
+    clientInfo,
+    metadata,
+  });
+}
+
+describe('MCPConnectionFactory OAuth against real SDK Streamable HTTP server', () => {
+  let server: OAuthTestServer;
+  let connection: MCPConnection | null;
+  let tokenStore: InMemoryTokenStore;
+
+  beforeEach(() => {
+    MCPConnection.clearCooldown(SERVER_NAME);
+    connection = null;
+    tokenStore = new InMemoryTokenStore();
+  });
+
+  afterEach(async () => {
+    await safeDisconnect(connection);
+    if (server) {
+      await server.close();
+    }
+    jest.clearAllMocks();
+  });
+
+  it('silently refreshes a server-rejected token and reconnects with the MCP resource parameter', async () => {
+    server = await createOAuthMCPServer({
+      issueRefreshTokens: true,
+      requireResourceParameter: true,
+      tokenScopes: ['read'],
+      scopesSupported: ['read'],
+    });
+    const initialTokens = await issueTokens(server);
+    await storeTokens(tokenStore, server, initialTokens);
+
+    server.issuedTokens.delete(initialTokens.access_token);
+
+    connection = await MCPConnectionFactory.create(
+      {
+        serverName: SERVER_NAME,
+        serverConfig: {
+          type: 'streamable-http',
+          url: server.url,
+          initTimeout: 15000,
+        },
+      },
+      {
+        useOAuth: true,
+        user: { id: USER_ID } as IUser,
+        flowManager: createFlowManager(),
+        tokenMethods: {
+          findToken: tokenStore.findToken,
+          createToken: tokenStore.createToken,
+          updateToken: tokenStore.updateToken,
+          deleteTokens: tokenStore.deleteTokens,
+        },
+      },
+    );
+
+    expect(await connection.isConnected()).toBe(true);
+    const tools = await connection.fetchTools();
+    expect(tools.some((tool) => tool.name === 'echo')).toBe(true);
+
+    const refreshRequest = server.tokenRequests.find(
+      (request) => request.grantType === 'refresh_token',
+    );
+    expect(refreshRequest).toEqual(
+      expect.objectContaining({
+        resource: server.resourceUrl,
+        clientId: CLIENT_ID,
+      }),
+    );
+
+    const storedAccessToken = await tokenStore.findToken({
+      userId: USER_ID,
+      type: 'mcp_oauth',
+      identifier: `mcp:${SERVER_NAME}`,
+    });
+    expect(storedAccessToken?.token).not.toBe(`enc:${initialTokens.access_token}`);
+  });
+
+  it('does not silently refresh an SDK insufficient_scope challenge before starting OAuth', async () => {
+    server = await createOAuthMCPServer({
+      issueRefreshTokens: true,
+      requireResourceParameter: true,
+      tokenScopes: ['read'],
+      requiredScopes: ['write'],
+      scopesSupported: ['write'],
+    });
+    const initialTokens = await issueTokens(server);
+    await storeTokens(tokenStore, server, initialTokens);
+
+    const oauthStart = jest.fn(async (_authorizationUrl: string): Promise<void> => undefined);
+    await expect(
+      MCPConnectionFactory.create(
+        {
+          serverName: SERVER_NAME,
+          serverConfig: {
+            type: 'streamable-http',
+            url: server.url,
+            initTimeout: 15000,
+          },
+        },
+        {
+          useOAuth: true,
+          user: { id: USER_ID } as IUser,
+          flowManager: createFlowManager(),
+          tokenMethods: {
+            findToken: tokenStore.findToken,
+            createToken: tokenStore.createToken,
+            updateToken: tokenStore.updateToken,
+            deleteTokens: tokenStore.deleteTokens,
+          },
+          returnOnOAuth: true,
+          oauthStart,
+        },
+      ),
+    ).rejects.toThrow();
+
+    expect(
+      server.tokenRequests.filter((request) => request.grantType === 'refresh_token'),
+    ).toHaveLength(0);
+    expect(oauthStart).toHaveBeenCalledTimes(1);
+    const authorizationUrl = new URL(oauthStart.mock.calls[0][0]);
+    expect(authorizationUrl.searchParams.get('resource')).toBe(server.resourceUrl);
+    expect(authorizationUrl.searchParams.get('scope')).toBe('write');
+  });
+});
diff --git a/packages/api/src/mcp/__tests__/MCPConnectionFactory.test.ts b/packages/api/src/mcp/__tests__/MCPConnectionFactory.test.ts
index 8018ec0a6f4..73048c7ab39 100644
--- a/packages/api/src/mcp/__tests__/MCPConnectionFactory.test.ts
+++ b/packages/api/src/mcp/__tests__/MCPConnectionFactory.test.ts
@@ -1,15 +1,21 @@
-import { logger, getTenantId } from '@librechat/data-schemas';
+import { logger, getTenantId, tenantStorage } from '@librechat/data-schemas';
 import type { TokenMethods, IUser } from '@librechat/data-schemas';
 import type { FlowStateManager } from '~/flow/manager';
 import type { MCPOAuthTokens } from '~/mcp/oauth';
 import type * as t from '~/mcp/types';
 import { MCPConnectionFactory } from '~/mcp/MCPConnectionFactory';
-import { MCPConnection } from '~/mcp/connection';
 import { MCPOAuthHandler, MCPTokenStorage } from '~/mcp/oauth';
+import { preProcessGraphTokens } from '~/utils/graph';
+import { PENDING_STALE_MS } from '~/flow/manager';
+import { MCPConnection } from '~/mcp/connection';
 import { processMCPEnv } from '~/utils';
 
 jest.mock('~/mcp/connection');
 jest.mock('~/mcp/oauth');
+jest.mock('~/utils/graph', () => ({
+  ...jest.requireActual('~/utils/graph'),
+  preProcessGraphTokens: jest.fn(async (options) => options),
+}));
 jest.mock('~/utils');
 jest.mock('@librechat/data-schemas', () => ({
   logger: {
@@ -19,14 +25,52 @@ jest.mock('@librechat/data-schemas', () => ({
     debug: jest.fn(),
   },
   getTenantId: jest.fn(),
+  tenantStorage: {
+    getStore: jest.fn(),
+    run: jest.fn((_context, fn: () => Promise<unknown>) => fn()),
+  },
 }));
 
 const mockLogger = logger as jest.Mocked<typeof logger>;
+const mockTenantStorage = tenantStorage as unknown as {
+  getStore: jest.Mock;
+  run: jest.Mock;
+};
 const mockProcessMCPEnv = processMCPEnv as jest.MockedFunction<typeof processMCPEnv>;
+const mockPreProcessGraphTokens = preProcessGraphTokens as jest.MockedFunction<
+  typeof preProcessGraphTokens
+>;
 const mockMCPConnection = MCPConnection as jest.MockedClass<typeof MCPConnection>;
 const mockMCPOAuthHandler = MCPOAuthHandler as jest.Mocked<typeof MCPOAuthHandler>;
 const mockMCPTokenStorage = MCPTokenStorage as jest.Mocked<typeof MCPTokenStorage>;
 
+class InspectableMCPConnectionFactory extends MCPConnectionFactory {
+  public constructor(
+    basic: t.BasicConnectionOptions,
+    options?: t.OAuthConnectionOptions | t.UserConnectionContext,
+  ) {
+    super(basic, options);
+  }
+
+  public async createConnectionForTest(): Promise<MCPConnection> {
+    return await this.createConnection();
+  }
+
+  public getRequestScopedOAuthState(): {
+    signal?: AbortSignal;
+    oauthStart?: (authURL: string) => Promise<void>;
+    oauthEnd?: () => Promise<void>;
+    returnOnOAuth?: boolean;
+  } {
+    return {
+      signal: this.signal,
+      oauthStart: this.oauthStart,
+      oauthEnd: this.oauthEnd,
+      returnOnOAuth: this.returnOnOAuth,
+    };
+  }
+}
+
 describe('MCPConnectionFactory', () => {
   let mockUser: IUser | undefined;
   let mockServerConfig: t.MCPOptions;
@@ -35,6 +79,12 @@ describe('MCPConnectionFactory', () => {
 
   beforeEach(() => {
     jest.clearAllMocks();
+    // Clear process-local silent-refresh in-flight map so a leftover entry
+    // from a prior test (e.g. one that errored before its `finally` ran)
+    // cannot cause a later test to join a stale promise.
+    (
+      MCPConnectionFactory as unknown as { inflightSilentRefreshes: Map<string, unknown> }
+    ).inflightSilentRefreshes.clear();
     mockUser = {
       id: 'user123',
       email: 'test@example.com',
@@ -51,6 +101,7 @@ describe('MCPConnectionFactory', () => {
       createFlow: jest.fn(),
       createFlowWithHandler: jest.fn(),
       getFlowState: jest.fn(),
+      completeFlow: jest.fn().mockResolvedValue(true),
       deleteFlow: jest.fn().mockResolvedValue(true),
     } as unknown as jest.Mocked<FlowStateManager<MCPOAuthTokens | null>>;
 
@@ -66,7 +117,32 @@ describe('MCPConnectionFactory', () => {
     } as unknown as jest.Mocked<MCPConnection>;
 
     mockMCPConnection.mockImplementation(() => mockConnectionInstance);
+    mockPreProcessGraphTokens.mockImplementation(async (options) => options);
     mockProcessMCPEnv.mockReturnValue(mockServerConfig);
+    mockMCPOAuthHandler.generateFlowId.mockImplementation(
+      (userId: string, serverName: string, tenantId?: string) => {
+        const flowId = `${userId}:${serverName}`;
+        return tenantId ? `tenant:${encodeURIComponent(tenantId)}:${flowId}` : flowId;
+      },
+    );
+    mockMCPOAuthHandler.generateTokenFlowId.mockImplementation(
+      (userId: string, serverName: string, tenantId?: string) => {
+        const flowId = mockMCPOAuthHandler.generateFlowId(userId, serverName);
+        return tenantId ? `tenant:${encodeURIComponent(tenantId)}:${flowId}` : flowId;
+      },
+    );
+    mockMCPOAuthHandler.buildStoredClientMetadata.mockImplementation(
+      (metadata, resourceMetadata) =>
+        metadata
+          ? {
+              ...metadata,
+              ...(resourceMetadata?.resource && { resource: resourceMetadata.resource }),
+            }
+          : undefined,
+    );
+    mockTenantStorage.getStore.mockReturnValue(undefined);
+    mockTenantStorage.run.mockImplementation((_context, fn: () => Promise<unknown>) => fn());
+    (getTenantId as jest.Mock).mockReturnValue(undefined);
   });
 
   describe('static create method', () => {
@@ -91,10 +167,55 @@ describe('MCPConnectionFactory', () => {
         userId: undefined,
         oauthTokens: null,
         useSSRFProtection: false,
+        allowedAddresses: undefined,
+        ephemeralConnection: false,
       });
       expect(mockConnectionInstance.connect).toHaveBeenCalled();
     });
 
+    it('should pre-process Graph placeholders before connection config resolution', async () => {
+      const graphTokenResolver = jest.fn();
+      const serverConfig: t.MCPOptions = {
+        type: 'streamable-http',
+        url: 'https://api.example.com/mcp?token={{LIBRECHAT_GRAPH_ACCESS_TOKEN}}',
+      };
+      const graphProcessedConfig: t.MCPOptions = {
+        ...serverConfig,
+        url: 'https://api.example.com/mcp?token=resolved-graph-token',
+      };
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig,
+      };
+
+      mockPreProcessGraphTokens.mockResolvedValue(graphProcessedConfig);
+      mockProcessMCPEnv.mockReturnValue(graphProcessedConfig);
+      mockConnectionInstance.isConnected.mockResolvedValue(true);
+
+      await MCPConnectionFactory.create(basicOptions, {
+        user: mockUser,
+        graphTokenResolver,
+      });
+
+      expect(mockPreProcessGraphTokens).toHaveBeenCalledWith(
+        serverConfig,
+        expect.objectContaining({
+          user: mockUser,
+          graphTokenResolver,
+        }),
+      );
+      expect(mockProcessMCPEnv).toHaveBeenCalledWith(
+        expect.objectContaining({
+          options: graphProcessedConfig,
+        }),
+      );
+      expect(mockMCPConnection).toHaveBeenCalledWith(
+        expect.objectContaining({
+          serverConfig: graphProcessedConfig,
+        }),
+      );
+    });
+
     it('should register fallback oauthRequired handler for non-OAuth connections', async () => {
       const basicOptions = {
         serverName: 'test-server',
@@ -117,7 +238,9 @@ describe('MCPConnectionFactory', () => {
         'oauthFailed',
         expect.objectContaining({ message: 'Server does not use OAuth' }),
       );
-      expect(mockConnectionInstance.removeListener).toHaveBeenCalledWith(
+      // The fallback `oauthRequired` listener is intentionally kept attached
+      // for the connection's lifetime so mid-session 401s are still handled.
+      expect(mockConnectionInstance.removeListener).not.toHaveBeenCalledWith(
         'oauthRequired',
         expect.any(Function),
       );
@@ -165,8 +288,44 @@ describe('MCPConnectionFactory', () => {
         userId: 'user123',
         oauthTokens: mockTokens,
         useSSRFProtection: false,
+        allowedAddresses: undefined,
+        ephemeralConnection: false,
       });
     });
+
+    it('should tenant-scope mcp_get_tokens flow locks', async () => {
+      mockTenantStorage.getStore.mockReturnValueOnce({ tenantId: 'tenant-a' });
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow123');
+
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: mockServerConfig,
+      };
+
+      const oauthOptions = {
+        useOAuth: true as const,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      };
+
+      mockFlowManager.createFlowWithHandler.mockResolvedValue(null);
+      mockConnectionInstance.isConnected.mockResolvedValue(true);
+
+      await MCPConnectionFactory.create(basicOptions, oauthOptions);
+
+      expect(mockFlowManager.createFlowWithHandler).toHaveBeenCalledWith(
+        'tenant:tenant-a:flow123',
+        'mcp_get_tokens',
+        expect.any(Function),
+        undefined,
+      );
+    });
   });
 
   describe('OAuth token handling', () => {
@@ -225,6 +384,8 @@ describe('MCPConnectionFactory', () => {
         userId: 'user123',
         oauthTokens: null,
         useSSRFProtection: false,
+        allowedAddresses: undefined,
+        ephemeralConnection: false,
       });
       expect(mockLogger.debug).toHaveBeenCalledWith(
         expect.stringContaining('No existing tokens found or error loading tokens'),
@@ -293,6 +454,7 @@ describe('MCPConnectionFactory', () => {
 
       expect(oauthRequiredHandler!).toBeDefined();
 
+      (getTenantId as jest.Mock).mockReturnValue(undefined);
       await oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
 
       expect(mockMCPOAuthHandler.initiateOAuthFlow).toHaveBeenCalledWith(
@@ -304,6 +466,7 @@ describe('MCPConnectionFactory', () => {
         undefined,
         oauthOptions.tokenMethods.findToken,
         undefined,
+        'test-tenant',
       );
 
       // initFlow must be awaited BEFORE the redirect to guarantee state is stored
@@ -398,7 +561,7 @@ describe('MCPConnectionFactory', () => {
       );
     });
 
-    it('should skip new OAuth flow initiation when a PENDING flow already exists (returnOnOAuth)', async () => {
+    it('should re-issue the stored OAuth URL when a PENDING flow already exists (returnOnOAuth)', async () => {
       const basicOptions = {
         serverName: 'test-server',
         serverConfig: mockServerConfig,
@@ -416,7 +579,10 @@ describe('MCPConnectionFactory', () => {
       mockFlowManager.getFlowState.mockResolvedValue({
         status: 'PENDING',
         type: 'mcp_oauth',
-        metadata: { codeVerifier: 'existing-verifier' },
+        metadata: {
+          codeVerifier: 'existing-verifier',
+          authorizationUrl: 'https://auth.example.com/existing',
+        },
         createdAt: Date.now(),
       });
       mockConnectionInstance.isConnected.mockResolvedValue(false);
@@ -438,10 +604,73 @@ describe('MCPConnectionFactory', () => {
       await oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
 
       expect(mockMCPOAuthHandler.initiateOAuthFlow).not.toHaveBeenCalled();
+      expect(oauthOptions.oauthStart).toHaveBeenCalledWith(
+        'https://auth.example.com/existing',
+        expect.objectContaining({ expiresAt: expect.any(Number) }),
+      );
       expect(mockFlowManager.deleteFlow).not.toHaveBeenCalled();
       expect(mockConnectionInstance.emit).toHaveBeenCalledWith(
         'oauthFailed',
-        expect.objectContaining({ message: 'OAuth flow initiated - return early' }),
+        expect.objectContaining({ message: 'Pending OAuth flow reused - return early' }),
+      );
+    });
+
+    it('should emit oauthFailed when a PENDING flow expires before replay (returnOnOAuth)', async () => {
+      const createdAt = 1000;
+      const firstNow = createdAt + PENDING_STALE_MS - 1;
+      const expiredNow = createdAt + PENDING_STALE_MS;
+      jest
+        .spyOn(Date, 'now')
+        .mockReturnValueOnce(firstNow)
+        .mockReturnValueOnce(expiredNow)
+        .mockReturnValue(expiredNow);
+
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: mockServerConfig,
+        user: mockUser,
+      };
+
+      const oauthOptions: t.OAuthConnectionOptions = {
+        user: mockUser,
+        useOAuth: true,
+        returnOnOAuth: true,
+        oauthStart: jest.fn(),
+        flowManager: mockFlowManager,
+      };
+
+      mockFlowManager.getFlowState.mockResolvedValue({
+        status: 'PENDING',
+        type: 'mcp_oauth',
+        metadata: {
+          codeVerifier: 'existing-verifier',
+          authorizationUrl: 'https://auth.example.com/existing',
+        },
+        createdAt,
+      });
+      mockConnectionInstance.isConnected.mockResolvedValue(false);
+
+      let oauthRequiredHandler: (data: Record<string, unknown>) => Promise<void>;
+      mockConnectionInstance.on.mockImplementation((event, handler) => {
+        if (event === 'oauthRequired') {
+          oauthRequiredHandler = handler as (data: Record<string, unknown>) => Promise<void>;
+        }
+        return mockConnectionInstance;
+      });
+
+      try {
+        await MCPConnectionFactory.create(basicOptions, oauthOptions);
+      } catch {
+        // Expected to fail
+      }
+
+      await oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
+
+      expect(oauthOptions.oauthStart).not.toHaveBeenCalled();
+      expect(mockMCPOAuthHandler.initiateOAuthFlow).not.toHaveBeenCalled();
+      expect(mockConnectionInstance.emit).toHaveBeenCalledWith(
+        'oauthFailed',
+        expect.objectContaining({ message: 'Pending OAuth flow expired before replay' }),
       );
     });
 
@@ -631,6 +860,7 @@ describe('MCPConnectionFactory', () => {
 
       // processMCPEnv must return config with url so handleOAuthRequired proceeds
       mockProcessMCPEnv.mockReturnValue(sseConfig);
+      (getTenantId as jest.Mock).mockReturnValue('test-tenant');
       mockMCPOAuthHandler.initiateOAuthFlow.mockResolvedValue(mockFlowData);
       mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow123');
       mockFlowManager.getFlowState.mockResolvedValue(null);
@@ -651,13 +881,14 @@ describe('MCPConnectionFactory', () => {
         // Expected to fail
       }
 
+      (getTenantId as jest.Mock).mockReturnValue(undefined);
       await oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
 
       // initFlow must be called BEFORE oauthStart and createFlow
       expect(mockFlowManager.initFlow).toHaveBeenCalledWith(
         'flow123',
         'mcp_oauth',
-        expect.objectContaining(mockFlowData.flowMetadata),
+        expect.objectContaining({ ...mockFlowData.flowMetadata, tenantId: 'test-tenant' }),
       );
       const initCallOrder = mockFlowManager.initFlow.mock.invocationCallOrder[0];
       const oauthStartCallOrder = (oauthOptions.oauthStart as jest.Mock).mock
@@ -762,6 +993,1784 @@ describe('MCPConnectionFactory', () => {
         undefined,
       );
     });
+
+    it('should silently refresh tokens on oauthRequired without invoking interactive flow', async () => {
+      const sseConfig = {
+        ...mockServerConfig,
+        url: 'https://api.example.com',
+        type: 'sse' as const,
+      } as t.SSEOptions;
+
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: sseConfig,
+      };
+
+      const oauthOptions = {
+        useOAuth: true as const,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        oauthStart: jest.fn(),
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      };
+
+      const refreshedTokens: MCPOAuthTokens = {
+        access_token: 'refreshed-access',
+        refresh_token: 'refresh123',
+        token_type: 'Bearer',
+        obtained_at: Date.now(),
+      };
+
+      mockProcessMCPEnv.mockReturnValue(sseConfig);
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow123');
+      // The silent refresh path: createFlowWithHandler executes the handler
+      // (which calls forceRefreshTokens) and returns the refreshed tokens.
+      mockFlowManager.createFlowWithHandler.mockImplementation(async (_flowId, type, handler) => {
+        if (type === 'mcp_get_tokens') {
+          return handler();
+        }
+        return null;
+      });
+      mockMCPTokenStorage.forceRefreshTokens.mockResolvedValueOnce(refreshedTokens);
+      mockConnectionInstance.isConnected.mockResolvedValue(false);
+
+      let oauthRequiredHandler: (data: Record<string, unknown>) => Promise<void>;
+      mockConnectionInstance.on.mockImplementation((event, handler) => {
+        if (event === 'oauthRequired') {
+          oauthRequiredHandler = handler as (data: Record<string, unknown>) => Promise<void>;
+        }
+        return mockConnectionInstance;
+      });
+
+      try {
+        await MCPConnectionFactory.create(basicOptions, oauthOptions);
+      } catch {
+        // Expected to fail because connection itself is mocked as not connected
+      }
+
+      await oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
+
+      expect(mockMCPTokenStorage.forceRefreshTokens).toHaveBeenCalledWith(
+        expect.objectContaining({
+          userId: 'user123',
+          serverName: 'test-server',
+          findToken: oauthOptions.tokenMethods.findToken,
+          createToken: oauthOptions.tokenMethods.createToken,
+        }),
+      );
+      expect(mockConnectionInstance.setOAuthTokens).toHaveBeenCalledWith(refreshedTokens);
+      expect(mockConnectionInstance.emit).toHaveBeenCalledWith('oauthHandled');
+      // Silent refresh succeeded — interactive flow must NOT be initiated.
+      expect(mockMCPOAuthHandler.initiateOAuthFlow).not.toHaveBeenCalled();
+    });
+
+    it('should fall back to interactive OAuth when silent refresh returns null', async () => {
+      const sseConfig = {
+        ...mockServerConfig,
+        url: 'https://api.example.com',
+        type: 'sse' as const,
+      } as t.SSEOptions;
+
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: sseConfig,
+      };
+
+      const oauthOptions = {
+        useOAuth: true as const,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        oauthStart: jest.fn(),
+        oauthEnd: jest.fn(),
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      };
+
+      const mockFlowData = {
+        authorizationUrl: 'https://auth.example.com',
+        flowId: 'flow123',
+        flowMetadata: {
+          serverName: 'test-server',
+          userId: 'user123',
+          serverUrl: 'https://api.example.com',
+          state: 'random-state',
+        },
+      };
+
+      const interactiveTokens: MCPOAuthTokens = {
+        access_token: 'interactive-access',
+        token_type: 'Bearer',
+        obtained_at: Date.now(),
+      };
+
+      mockProcessMCPEnv.mockReturnValue(sseConfig);
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow123');
+      // Silent refresh attempt returns null (no refresh token / refresh failed).
+      mockFlowManager.createFlowWithHandler.mockImplementation(async (_flowId, type, handler) => {
+        if (type === 'mcp_get_tokens') {
+          return handler();
+        }
+        return null;
+      });
+      mockMCPTokenStorage.forceRefreshTokens.mockResolvedValueOnce(null);
+      mockMCPOAuthHandler.initiateOAuthFlow.mockResolvedValue(mockFlowData);
+      mockFlowManager.getFlowState.mockResolvedValue(null);
+      mockFlowManager.createFlow.mockResolvedValue(interactiveTokens);
+      mockConnectionInstance.isConnected.mockResolvedValue(false);
+
+      let oauthRequiredHandler: (data: Record<string, unknown>) => Promise<void>;
+      mockConnectionInstance.on.mockImplementation((event, handler) => {
+        if (event === 'oauthRequired') {
+          oauthRequiredHandler = handler as (data: Record<string, unknown>) => Promise<void>;
+        }
+        return mockConnectionInstance;
+      });
+
+      try {
+        await MCPConnectionFactory.create(basicOptions, oauthOptions);
+      } catch {
+        // Expected to fail
+      }
+
+      await oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
+
+      // Silent refresh was attempted, but yielded no tokens.
+      expect(mockMCPTokenStorage.forceRefreshTokens).toHaveBeenCalled();
+      // Fall-through behavior: interactive flow runs.
+      expect(mockMCPOAuthHandler.initiateOAuthFlow).toHaveBeenCalled();
+      expect(mockConnectionInstance.setOAuthTokens).toHaveBeenCalledWith(interactiveTokens);
+    });
+
+    it('should silently refresh tokens for returnOnOAuth path without redirecting', async () => {
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: {
+          ...mockServerConfig,
+          url: 'https://api.example.com',
+          type: 'sse' as const,
+        } as t.SSEOptions,
+      };
+
+      const oauthOptions = {
+        useOAuth: true as const,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        returnOnOAuth: true,
+        oauthStart: jest.fn(),
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      };
+
+      const refreshedTokens: MCPOAuthTokens = {
+        access_token: 'refreshed-access',
+        refresh_token: 'refresh123',
+        token_type: 'Bearer',
+        obtained_at: Date.now(),
+      };
+
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow123');
+      mockFlowManager.createFlowWithHandler.mockImplementation(async (_flowId, type, handler) => {
+        if (type === 'mcp_get_tokens') {
+          return handler();
+        }
+        return null;
+      });
+      mockMCPTokenStorage.forceRefreshTokens.mockResolvedValueOnce(refreshedTokens);
+      mockConnectionInstance.isConnected.mockResolvedValue(false);
+
+      let oauthRequiredHandler: (data: Record<string, unknown>) => Promise<void>;
+      mockConnectionInstance.on.mockImplementation((event, handler) => {
+        if (event === 'oauthRequired') {
+          oauthRequiredHandler = handler as (data: Record<string, unknown>) => Promise<void>;
+        }
+        return mockConnectionInstance;
+      });
+
+      try {
+        await MCPConnectionFactory.create(basicOptions, oauthOptions);
+      } catch {
+        // Expected
+      }
+
+      await oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
+
+      expect(mockConnectionInstance.setOAuthTokens).toHaveBeenCalledWith(refreshedTokens);
+      expect(mockConnectionInstance.emit).toHaveBeenCalledWith('oauthHandled');
+      // returnOnOAuth interactive path must NOT trigger when silent refresh succeeds.
+      expect(mockMCPOAuthHandler.initiateOAuthFlow).not.toHaveBeenCalled();
+      expect(oauthOptions.oauthStart).not.toHaveBeenCalled();
+    });
+
+    it('should fall back to interactive OAuth when silent refresh throws unexpectedly', async () => {
+      const sseConfig = {
+        ...mockServerConfig,
+        url: 'https://api.example.com',
+        type: 'sse' as const,
+      } as t.SSEOptions;
+
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: sseConfig,
+      };
+
+      const oauthOptions = {
+        useOAuth: true as const,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        oauthStart: jest.fn(),
+        oauthEnd: jest.fn(),
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      };
+
+      const mockFlowData = {
+        authorizationUrl: 'https://auth.example.com',
+        flowId: 'flow123',
+        flowMetadata: {
+          serverName: 'test-server',
+          userId: 'user123',
+          serverUrl: 'https://api.example.com',
+          state: 'random-state',
+        },
+      };
+
+      mockProcessMCPEnv.mockReturnValue(sseConfig);
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow123');
+      // Silent refresh path throws — must be swallowed and interactive runs.
+      mockMCPTokenStorage.forceRefreshTokens.mockRejectedValueOnce(new Error('refresh boom'));
+      mockMCPOAuthHandler.initiateOAuthFlow.mockResolvedValue(mockFlowData);
+      mockFlowManager.getFlowState.mockResolvedValue(null);
+      mockFlowManager.createFlow.mockResolvedValue({
+        access_token: 'fallback-access',
+        token_type: 'Bearer',
+        obtained_at: Date.now(),
+      } as MCPOAuthTokens);
+      mockConnectionInstance.isConnected.mockResolvedValue(false);
+
+      let oauthRequiredHandler: (data: Record<string, unknown>) => Promise<void>;
+      mockConnectionInstance.on.mockImplementation((event, handler) => {
+        if (event === 'oauthRequired') {
+          oauthRequiredHandler = handler as (data: Record<string, unknown>) => Promise<void>;
+        }
+        return mockConnectionInstance;
+      });
+
+      try {
+        await MCPConnectionFactory.create(basicOptions, oauthOptions);
+      } catch {
+        // Expected
+      }
+
+      await oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
+
+      // The thrown silent refresh error must be swallowed and the interactive
+      // flow used as a fallback so the user is never stuck.
+      expect(mockMCPOAuthHandler.initiateOAuthFlow).toHaveBeenCalled();
+    });
+
+    it('should bypass any flow cache on silent refresh and invalidate mcp_get_tokens cache (regression for stale cached token reuse)', async () => {
+      // Reproduces the cache-collision flagged by Codex on PR #13369: when an
+      // earlier `getOAuthTokens` call cached its (now server-rejected) tokens
+      // under the `mcp_get_tokens` flow, the silent refresh must NOT share or
+      // reuse that cache. The fix bypasses `FlowStateManager` entirely for the
+      // force-refresh, calls `MCPTokenStorage.forceRefreshTokens` directly,
+      // and invalidates the `mcp_get_tokens` cache afterwards so the next
+      // `getOAuthTokens` reads the freshly persisted tokens.
+      const sseConfig = {
+        ...mockServerConfig,
+        url: 'https://api.example.com',
+        type: 'sse' as const,
+      } as t.SSEOptions;
+
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: sseConfig,
+      };
+
+      const oauthOptions = {
+        useOAuth: true as const,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        oauthStart: jest.fn(),
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      };
+
+      const staleCachedTokens: MCPOAuthTokens = {
+        access_token: 'stale-cached-access',
+        refresh_token: 'refresh123',
+        token_type: 'Bearer',
+        obtained_at: Date.now(),
+      };
+
+      const freshlyRefreshedTokens: MCPOAuthTokens = {
+        access_token: 'freshly-refreshed-access',
+        refresh_token: 'refresh456',
+        token_type: 'Bearer',
+        obtained_at: Date.now(),
+      };
+
+      mockProcessMCPEnv.mockReturnValue(sseConfig);
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow123');
+      // Simulate the real FlowStateManager cache behavior for `mcp_get_tokens`:
+      // a prior call cached `staleCachedTokens` and the cache is still
+      // non-expired, so `getOAuthTokens` returns it without re-running the
+      // handler. Silent refresh must NOT route through this cached flow.
+      mockFlowManager.createFlowWithHandler.mockImplementation(async (_flowId, type, _handler) => {
+        if (type === 'mcp_get_tokens') {
+          return staleCachedTokens;
+        }
+        return null;
+      });
+      // `invalidateGetTokensFlow` only deletes COMPLETED states (to avoid
+      // breaking concurrent PENDING joiners), so reflect that here.
+      mockFlowManager.getFlowState.mockResolvedValue({
+        status: 'COMPLETED' as const,
+        type: 'mcp_get_tokens',
+        metadata: {},
+        createdAt: Date.now(),
+        completedAt: Date.now(),
+        result: staleCachedTokens,
+      });
+      mockMCPTokenStorage.forceRefreshTokens.mockResolvedValueOnce(freshlyRefreshedTokens);
+      mockConnectionInstance.isConnected.mockResolvedValue(false);
+
+      let oauthRequiredHandler: (data: Record<string, unknown>) => Promise<void>;
+      mockConnectionInstance.on.mockImplementation((event, handler) => {
+        if (event === 'oauthRequired') {
+          oauthRequiredHandler = handler as (data: Record<string, unknown>) => Promise<void>;
+        }
+        return mockConnectionInstance;
+      });
+
+      try {
+        await MCPConnectionFactory.create(basicOptions, oauthOptions);
+      } catch {
+        // Expected
+      }
+
+      await oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
+
+      // The refresh runs against the token storage directly — not through any
+      // `createFlowWithHandler` flow that could return a stale cached value.
+      expect(mockMCPTokenStorage.forceRefreshTokens).toHaveBeenCalled();
+      expect(mockFlowManager.createFlowWithHandler).not.toHaveBeenCalledWith(
+        expect.anything(),
+        'mcp_force_refresh_tokens',
+        expect.anything(),
+        expect.anything(),
+      );
+      // The connection receives the FRESHLY refreshed tokens, NOT the stale
+      // cached ones — that's the whole point of the fix.
+      expect(mockConnectionInstance.setOAuthTokens).toHaveBeenCalledWith(freshlyRefreshedTokens);
+      expect(mockConnectionInstance.setOAuthTokens).not.toHaveBeenCalledWith(staleCachedTokens);
+      expect(mockConnectionInstance.emit).toHaveBeenCalledWith('oauthHandled');
+      // The cached `mcp_get_tokens` flow state is dropped so the next
+      // `getOAuthTokens` call reads the freshly persisted tokens from storage.
+      expect(mockFlowManager.deleteFlow).toHaveBeenCalledWith('flow123', 'mcp_get_tokens');
+    });
+
+    it('should coalesce concurrent silent refresh attempts into a single redemption', async () => {
+      // Reproduces the concurrent-redemption race flagged by Codex on PR #13369:
+      // if two 401s for the same user/server race the silent refresh, they
+      // must share one in-flight refresh-token redemption — providers that
+      // rotate refresh tokens reject the second redemption, otherwise causing
+      // an unnecessary interactive OAuth fallback.
+      const sseConfig = {
+        ...mockServerConfig,
+        url: 'https://api.example.com',
+        type: 'sse' as const,
+      } as t.SSEOptions;
+
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: sseConfig,
+      };
+
+      const oauthOptions = {
+        useOAuth: true as const,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        oauthStart: jest.fn(),
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      };
+
+      const refreshedTokens: MCPOAuthTokens = {
+        access_token: 'refreshed-access',
+        refresh_token: 'refresh456',
+        token_type: 'Bearer',
+        obtained_at: Date.now(),
+      };
+
+      mockProcessMCPEnv.mockReturnValue(sseConfig);
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow123');
+      // Hold a single in-flight refresh open until both concurrent callers
+      // have joined the lock. `mockImplementationOnce` (rather than the
+      // persistent `mockImplementation`) ensures this never-resolving promise
+      // does not leak into later tests' default mock behavior.
+      let resolveRefresh: ((tokens: MCPOAuthTokens) => void) | undefined;
+      mockMCPTokenStorage.forceRefreshTokens.mockImplementationOnce(
+        () =>
+          new Promise<MCPOAuthTokens>((res) => {
+            resolveRefresh = res;
+          }),
+      );
+      mockConnectionInstance.isConnected.mockResolvedValue(false);
+
+      let oauthRequiredHandler: (data: Record<string, unknown>) => Promise<void>;
+      mockConnectionInstance.on.mockImplementation((event, handler) => {
+        if (event === 'oauthRequired') {
+          oauthRequiredHandler = handler as (data: Record<string, unknown>) => Promise<void>;
+        }
+        return mockConnectionInstance;
+      });
+
+      try {
+        await MCPConnectionFactory.create(basicOptions, oauthOptions);
+      } catch {
+        // Expected
+      }
+
+      // Fire two concurrent oauthRequired events; both must share the same
+      // in-flight refresh attempt.
+      const first = oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
+      const second = oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
+
+      // Let the in-flight lock register, then resolve the single redemption.
+      await Promise.resolve();
+      resolveRefresh!(refreshedTokens);
+      await Promise.all([first, second]);
+
+      // Exactly one refresh-token redemption was issued.
+      expect(mockMCPTokenStorage.forceRefreshTokens).toHaveBeenCalledTimes(1);
+      // Both callers set the connection's tokens with the same refreshed value.
+      expect(mockConnectionInstance.setOAuthTokens).toHaveBeenCalledWith(refreshedTokens);
+    });
+
+    it('should keep the in-flight silent-refresh lock until the aborted refresh settles', async () => {
+      // A timed-out caller should fall back to interactive OAuth immediately,
+      // but the shared lock must remain briefly while the underlying abortable
+      // refresh settles so another 401 cannot immediately redeem the same
+      // rotating refresh token.
+      const sseConfig = {
+        ...mockServerConfig,
+        url: 'https://api.example.com',
+        type: 'sse' as const,
+      } as t.SSEOptions;
+
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: sseConfig,
+      };
+
+      const oauthOptions = {
+        useOAuth: true as const,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        oauthStart: jest.fn(),
+        oauthEnd: jest.fn(),
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      };
+
+      mockProcessMCPEnv.mockReturnValue(sseConfig);
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow123');
+      const refreshedTokens: MCPOAuthTokens = {
+        access_token: 'late-refresh',
+        refresh_token: 'refresh456',
+        token_type: 'Bearer',
+        obtained_at: Date.now(),
+      };
+      let refreshSignal: AbortSignal | undefined;
+      let resolveRefresh: ((tokens: MCPOAuthTokens) => void) | undefined;
+      mockMCPTokenStorage.forceRefreshTokens.mockImplementationOnce((params) => {
+        refreshSignal = params.signal;
+        return new Promise<MCPOAuthTokens>((resolve) => {
+          resolveRefresh = resolve;
+        });
+      });
+      // Provide a no-op interactive fallback so the handler can complete.
+      mockMCPOAuthHandler.initiateOAuthFlow.mockResolvedValue({
+        authorizationUrl: 'https://auth.example.com',
+        flowId: 'flow123',
+        flowMetadata: {
+          serverName: 'test-server',
+          userId: 'user123',
+          serverUrl: 'https://api.example.com',
+          state: 'state-x',
+        },
+      });
+      mockFlowManager.getFlowState.mockResolvedValue(null);
+      mockFlowManager.createFlow.mockResolvedValue(null);
+      mockConnectionInstance.connect.mockRejectedValue(new Error('OAuth authentication required'));
+      mockConnectionInstance.isConnected.mockResolvedValue(false);
+
+      let oauthRequiredHandler: (data: Record<string, unknown>) => Promise<void>;
+      mockConnectionInstance.on.mockImplementation((event, handler) => {
+        if (event === 'oauthRequired') {
+          oauthRequiredHandler = handler as (data: Record<string, unknown>) => Promise<void>;
+        }
+        return mockConnectionInstance;
+      });
+
+      try {
+        await MCPConnectionFactory.create(basicOptions, oauthOptions);
+      } catch {
+        // Expected — initial connection mocked to fail.
+      }
+
+      // Switch to fake timers only for the silent-refresh attempt so we can
+      // fast-forward past its timeout without slowing the test suite.
+      jest.useFakeTimers();
+      try {
+        const firstAttempt = oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
+        await jest.advanceTimersByTimeAsync(2_001);
+        await firstAttempt;
+
+        const inflightMap = (
+          MCPConnectionFactory as unknown as {
+            inflightSilentRefreshes: Map<string, unknown>;
+          }
+        ).inflightSilentRefreshes;
+        expect(inflightMap.size).toBe(1);
+        expect(refreshSignal?.aborted).toBe(true);
+        expect(mockMCPOAuthHandler.initiateOAuthFlow).toHaveBeenCalled();
+
+        const secondAttempt = oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
+        await secondAttempt;
+        expect(mockMCPTokenStorage.forceRefreshTokens).toHaveBeenCalledTimes(1);
+
+        resolveRefresh!(refreshedTokens);
+        for (let i = 0; i < 10; i += 1) {
+          await Promise.resolve();
+        }
+        expect(inflightMap.size).toBe(0);
+      } finally {
+        jest.useRealTimers();
+      }
+    });
+
+    it('should drop timed-out silent-refresh locks after abort grace if refresh stays hung', async () => {
+      const sseConfig = {
+        ...mockServerConfig,
+        url: 'https://api.example.com',
+        type: 'sse' as const,
+      } as t.SSEOptions;
+
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: sseConfig,
+      };
+
+      const oauthOptions = {
+        useOAuth: true as const,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        oauthStart: jest.fn(),
+        oauthEnd: jest.fn(),
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      };
+
+      mockProcessMCPEnv.mockReturnValue(sseConfig);
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow123');
+      let firstRefreshSignal: AbortSignal | undefined;
+      let secondRefreshSignal: AbortSignal | undefined;
+      mockMCPTokenStorage.forceRefreshTokens
+        .mockImplementationOnce((params) => {
+          firstRefreshSignal = params.signal;
+          return new Promise<MCPOAuthTokens>(() => {});
+        })
+        .mockImplementationOnce((params) => {
+          secondRefreshSignal = params.signal;
+          return Promise.resolve(null as unknown as MCPOAuthTokens);
+        });
+      mockMCPOAuthHandler.initiateOAuthFlow.mockResolvedValue({
+        authorizationUrl: 'https://auth.example.com',
+        flowId: 'flow123',
+        flowMetadata: {
+          serverName: 'test-server',
+          userId: 'user123',
+          serverUrl: 'https://api.example.com',
+          state: 'state-x',
+        },
+      });
+      mockFlowManager.getFlowState.mockResolvedValue(null);
+      mockFlowManager.createFlow.mockResolvedValue(null);
+      mockConnectionInstance.connect.mockRejectedValue(new Error('OAuth authentication required'));
+      mockConnectionInstance.isConnected.mockResolvedValue(false);
+
+      let oauthRequiredHandler: (data: Record<string, unknown>) => Promise<void>;
+      mockConnectionInstance.on.mockImplementation((event, handler) => {
+        if (event === 'oauthRequired') {
+          oauthRequiredHandler = handler as (data: Record<string, unknown>) => Promise<void>;
+        }
+        return mockConnectionInstance;
+      });
+
+      try {
+        await MCPConnectionFactory.create(basicOptions, oauthOptions);
+      } catch {
+        // Expected
+      }
+
+      jest.useFakeTimers();
+      try {
+        const firstAttempt = oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
+        await jest.advanceTimersByTimeAsync(2_001);
+        await firstAttempt;
+
+        const inflightMap = (
+          MCPConnectionFactory as unknown as {
+            inflightSilentRefreshes: Map<string, unknown>;
+          }
+        ).inflightSilentRefreshes;
+        expect(inflightMap.size).toBe(1);
+        expect(firstRefreshSignal?.aborted).toBe(true);
+
+        await jest.advanceTimersByTimeAsync(1_001);
+        expect(inflightMap.size).toBe(0);
+
+        const secondAttempt = oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
+        await secondAttempt;
+
+        expect(mockMCPTokenStorage.forceRefreshTokens).toHaveBeenCalledTimes(2);
+        expect(secondRefreshSignal).toBeDefined();
+      } finally {
+        jest.useRealTimers();
+      }
+    });
+
+    it('should reserve interactive OAuth fallback time when initTimeout is omitted', async () => {
+      const sseConfig = {
+        url: 'https://api.example.com',
+        type: 'sse' as const,
+      } as t.SSEOptions;
+
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: sseConfig,
+      };
+
+      const oauthOptions = {
+        useOAuth: true as const,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        oauthStart: jest.fn(),
+        oauthEnd: jest.fn(),
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      };
+
+      mockProcessMCPEnv.mockReturnValue(sseConfig);
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow123');
+      let refreshSignal: AbortSignal | undefined;
+      mockMCPTokenStorage.forceRefreshTokens.mockImplementationOnce((params) => {
+        refreshSignal = params.signal;
+        return new Promise<MCPOAuthTokens>(() => {});
+      });
+      mockMCPOAuthHandler.initiateOAuthFlow.mockResolvedValue({
+        authorizationUrl: 'https://auth.example.com',
+        flowId: 'flow123',
+        flowMetadata: {
+          serverName: 'test-server',
+          userId: 'user123',
+          serverUrl: 'https://api.example.com',
+          state: 'state-x',
+        },
+      });
+      mockFlowManager.getFlowState.mockResolvedValue(null);
+      mockFlowManager.createFlow.mockResolvedValue(null);
+      mockConnectionInstance.connect.mockRejectedValue(new Error('OAuth authentication required'));
+      mockConnectionInstance.isConnected.mockResolvedValue(false);
+
+      let oauthRequiredHandler: (data: Record<string, unknown>) => Promise<void>;
+      mockConnectionInstance.on.mockImplementation((event, handler) => {
+        if (event === 'oauthRequired') {
+          oauthRequiredHandler = handler as (data: Record<string, unknown>) => Promise<void>;
+        }
+        return mockConnectionInstance;
+      });
+
+      try {
+        await MCPConnectionFactory.create(basicOptions, oauthOptions);
+      } catch {
+        // Expected
+      }
+
+      jest.useFakeTimers();
+      try {
+        const attempt = oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
+        await jest.advanceTimersByTimeAsync(5_001);
+        await attempt;
+
+        expect(refreshSignal?.aborted).toBe(true);
+        expect(mockMCPOAuthHandler.initiateOAuthFlow).toHaveBeenCalled();
+      } finally {
+        jest.useRealTimers();
+      }
+    });
+
+    it('should cap silent refresh below half of a small connection timeout', async () => {
+      const sseConfig = {
+        ...mockServerConfig,
+        url: 'https://api.example.com',
+        type: 'sse' as const,
+        initTimeout: 5000,
+      } as t.SSEOptions;
+
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: sseConfig,
+      };
+
+      const oauthOptions = {
+        useOAuth: true as const,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        oauthStart: jest.fn(),
+        oauthEnd: jest.fn(),
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      };
+
+      mockProcessMCPEnv.mockReturnValue(sseConfig);
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow123');
+      let refreshSignal: AbortSignal | undefined;
+      mockMCPTokenStorage.forceRefreshTokens.mockImplementationOnce((params) => {
+        refreshSignal = params.signal;
+        return new Promise<MCPOAuthTokens>(() => {});
+      });
+      mockMCPOAuthHandler.initiateOAuthFlow.mockResolvedValue({
+        authorizationUrl: 'https://auth.example.com',
+        flowId: 'flow123',
+        flowMetadata: {
+          serverName: 'test-server',
+          userId: 'user123',
+          serverUrl: 'https://api.example.com',
+          state: 'state-x',
+        },
+      });
+      mockFlowManager.getFlowState.mockResolvedValue(null);
+      mockFlowManager.createFlow.mockResolvedValue(null);
+      mockConnectionInstance.connect.mockRejectedValue(new Error('OAuth authentication required'));
+      mockConnectionInstance.isConnected.mockResolvedValue(false);
+
+      let oauthRequiredHandler: (data: Record<string, unknown>) => Promise<void>;
+      mockConnectionInstance.on.mockImplementation((event, handler) => {
+        if (event === 'oauthRequired') {
+          oauthRequiredHandler = handler as (data: Record<string, unknown>) => Promise<void>;
+        }
+        return mockConnectionInstance;
+      });
+
+      try {
+        await MCPConnectionFactory.create(basicOptions, oauthOptions);
+      } catch {
+        // Expected
+      }
+
+      jest.useFakeTimers();
+      try {
+        const attempt = oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
+        await jest.advanceTimersByTimeAsync(1_999);
+        expect(refreshSignal?.aborted).not.toBe(true);
+        expect(mockMCPOAuthHandler.initiateOAuthFlow).not.toHaveBeenCalled();
+
+        await jest.advanceTimersByTimeAsync(2);
+        await attempt;
+
+        expect(refreshSignal?.aborted).toBe(true);
+        expect(mockMCPOAuthHandler.initiateOAuthFlow).toHaveBeenCalled();
+      } finally {
+        jest.useRealTimers();
+      }
+    });
+
+    it('should skip silent refresh for 403 OAuth reauthorization failures', async () => {
+      const sseConfig = {
+        ...mockServerConfig,
+        url: 'https://api.example.com',
+        type: 'sse' as const,
+      } as t.SSEOptions;
+
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: sseConfig,
+      };
+
+      const oauthOptions = {
+        useOAuth: true as const,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        oauthStart: jest.fn(),
+        oauthEnd: jest.fn(),
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      };
+
+      mockProcessMCPEnv.mockReturnValue(sseConfig);
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow123');
+      mockMCPOAuthHandler.initiateOAuthFlow.mockResolvedValue({
+        authorizationUrl: 'https://auth.example.com',
+        flowId: 'flow123',
+        flowMetadata: {
+          serverName: 'test-server',
+          userId: 'user123',
+          serverUrl: 'https://api.example.com',
+          state: 'state-x',
+        },
+      });
+      mockFlowManager.getFlowState.mockResolvedValue(null);
+      mockFlowManager.createFlow.mockResolvedValue(null);
+      mockConnectionInstance.isConnected.mockResolvedValue(false);
+
+      let oauthRequiredHandler: (data: Record<string, unknown>) => Promise<void>;
+      mockConnectionInstance.on.mockImplementation((event, handler) => {
+        if (event === 'oauthRequired') {
+          oauthRequiredHandler = handler as (data: Record<string, unknown>) => Promise<void>;
+        }
+        return mockConnectionInstance;
+      });
+
+      try {
+        await MCPConnectionFactory.create(basicOptions, oauthOptions);
+      } catch {
+        // Expected
+      }
+
+      const forbiddenError = Object.assign(new Error('Non-200 status code (403)'), { code: 403 });
+      await oauthRequiredHandler!({
+        serverUrl: 'https://api.example.com',
+        error: forbiddenError,
+      });
+
+      expect(mockMCPTokenStorage.forceRefreshTokens).not.toHaveBeenCalled();
+      expect(mockConnectionInstance.setOAuthTokens).not.toHaveBeenCalled();
+      expect(mockMCPOAuthHandler.initiateOAuthFlow).toHaveBeenCalled();
+    });
+
+    it('should not process already resolved configs for request OAuth handlers', () => {
+      const sseConfig = {
+        ...mockServerConfig,
+        url: 'https://api.example.com/${SHOULD_NOT_EXPAND}',
+        type: 'sse' as const,
+      } as t.SSEOptions;
+      mockProcessMCPEnv.mockClear();
+
+      const cleanup = MCPConnectionFactory.attachRequestOAuthHandler(
+        {
+          serverName: 'test-server',
+          serverConfig: sseConfig,
+          skipEnvProcessing: true,
+        },
+        {
+          useOAuth: true,
+          user: mockUser,
+          flowManager: mockFlowManager,
+          oauthStart: jest.fn(),
+        },
+        mockConnectionInstance,
+      );
+
+      expect(mockProcessMCPEnv).not.toHaveBeenCalled();
+      expect(mockConnectionInstance.on).toHaveBeenCalledWith(
+        'oauthReauthenticationRequired',
+        expect.any(Function),
+      );
+
+      cleanup();
+    });
+
+    it('should not reuse request-scoped OAuth callbacks after connection is cached', async () => {
+      const sseConfig = {
+        ...mockServerConfig,
+        url: 'https://api.example.com',
+        type: 'sse' as const,
+      } as t.SSEOptions;
+
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: sseConfig,
+      };
+
+      const oauthStart = jest.fn();
+      const oauthEnd = jest.fn();
+      const requestAbortController = new AbortController();
+      const initialTokens: MCPOAuthTokens = {
+        access_token: 'initial-access',
+        refresh_token: 'initial-refresh',
+        token_type: 'Bearer',
+        obtained_at: Date.now(),
+      };
+
+      const oauthOptions = {
+        useOAuth: true as const,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        oauthStart,
+        oauthEnd,
+        signal: requestAbortController.signal,
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      };
+
+      mockProcessMCPEnv.mockReturnValue(sseConfig);
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow123');
+      mockFlowManager.createFlowWithHandler.mockResolvedValue(initialTokens);
+      mockConnectionInstance.connect.mockResolvedValue(undefined);
+      mockConnectionInstance.isConnected.mockResolvedValue(true);
+
+      let oauthRequiredHandler: (data: Record<string, unknown>) => Promise<void>;
+      mockConnectionInstance.on.mockImplementation((event, handler) => {
+        if (event === 'oauthRequired') {
+          oauthRequiredHandler = handler as (data: Record<string, unknown>) => Promise<void>;
+        }
+        return mockConnectionInstance;
+      });
+
+      await MCPConnectionFactory.create(basicOptions, oauthOptions);
+
+      requestAbortController.abort();
+      mockFlowManager.getFlowState.mockResolvedValue(null);
+      mockMCPTokenStorage.forceRefreshTokens.mockResolvedValueOnce(null);
+
+      await oauthRequiredHandler!({
+        serverUrl: 'https://api.example.com',
+        error: new Error('Non-200 status code (401)'),
+      });
+
+      expect(mockMCPOAuthHandler.initiateOAuthFlow).not.toHaveBeenCalled();
+      expect(mockFlowManager.initFlow).not.toHaveBeenCalled();
+      expect(mockFlowManager.createFlow).not.toHaveBeenCalled();
+      expect(oauthStart).not.toHaveBeenCalled();
+      expect(oauthEnd).not.toHaveBeenCalled();
+      expect(mockConnectionInstance.emit).toHaveBeenCalledWith(
+        'oauthFailed',
+        expect.objectContaining({ message: 'OAuth reauthentication required' }),
+      );
+    });
+
+    it('should clear request-scoped OAuth callbacks after successful connection', async () => {
+      const sseConfig = {
+        ...mockServerConfig,
+        url: 'https://api.example.com',
+        type: 'sse' as const,
+      } as t.SSEOptions;
+      const initialTokens: MCPOAuthTokens = {
+        access_token: 'initial-access',
+        refresh_token: 'initial-refresh',
+        token_type: 'Bearer',
+        obtained_at: Date.now(),
+      };
+      const oauthStart = jest.fn();
+      const oauthEnd = jest.fn();
+      const requestAbortController = new AbortController();
+      const factory = new InspectableMCPConnectionFactory(
+        {
+          serverName: 'test-server',
+          serverConfig: sseConfig,
+        },
+        {
+          useOAuth: true,
+          user: mockUser,
+          flowManager: mockFlowManager,
+          oauthStart,
+          oauthEnd,
+          signal: requestAbortController.signal,
+          returnOnOAuth: true,
+          tokenMethods: {
+            findToken: jest.fn(),
+            createToken: jest.fn(),
+            updateToken: jest.fn(),
+            deleteTokens: jest.fn(),
+          },
+        },
+      );
+
+      mockProcessMCPEnv.mockReturnValue(sseConfig);
+      mockFlowManager.createFlowWithHandler.mockResolvedValue(initialTokens);
+      mockConnectionInstance.connect.mockResolvedValue(undefined);
+      mockConnectionInstance.isConnected.mockResolvedValue(true);
+
+      await factory.createConnectionForTest();
+
+      expect(mockConnectionInstance.on).toHaveBeenCalledWith('oauthRequired', expect.any(Function));
+      expect(factory.getRequestScopedOAuthState()).toEqual({
+        signal: undefined,
+        oauthStart: undefined,
+        oauthEnd: undefined,
+        returnOnOAuth: false,
+      });
+    });
+
+    it('should let a live request handle cached-connection reauthentication with fresh callbacks', async () => {
+      const sseConfig = {
+        ...mockServerConfig,
+        url: 'https://api.example.com',
+        type: 'sse' as const,
+      } as t.SSEOptions;
+
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: sseConfig,
+      };
+
+      const staleOAuthStart = jest.fn();
+      const liveOAuthStart = jest.fn();
+      const initialTokens: MCPOAuthTokens = {
+        access_token: 'initial-access',
+        refresh_token: 'initial-refresh',
+        token_type: 'Bearer',
+        obtained_at: Date.now(),
+      };
+      const callbackTokens: MCPOAuthTokens = {
+        access_token: 'callback-access',
+        token_type: 'Bearer',
+        obtained_at: Date.now(),
+      };
+
+      mockProcessMCPEnv.mockReturnValue(sseConfig);
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow123');
+      mockFlowManager.createFlowWithHandler.mockResolvedValue(initialTokens);
+      mockFlowManager.createFlow.mockResolvedValue(callbackTokens);
+      mockFlowManager.getFlowState.mockResolvedValue(null);
+      mockMCPOAuthHandler.initiateOAuthFlow.mockResolvedValue({
+        authorizationUrl: 'https://auth.example.com',
+        flowId: 'flow123',
+        flowMetadata: {
+          serverName: 'test-server',
+          userId: 'user123',
+          serverUrl: 'https://api.example.com',
+          state: 'state-live',
+          clientInfo: { client_id: 'client-live' },
+        },
+      });
+      mockConnectionInstance.connect.mockResolvedValue(undefined);
+      mockConnectionInstance.isConnected.mockResolvedValue(true);
+      type Listener = (...args: unknown[]) => void;
+      const handlers: Record<string, Listener[]> = {};
+      mockConnectionInstance.on.mockImplementation((event, handler) => {
+        const key = typeof event === 'symbol' ? event.toString() : event;
+        (handlers[key] ??= []).push(handler as Listener);
+        return mockConnectionInstance;
+      });
+      mockConnectionInstance.removeListener.mockImplementation((event, handler) => {
+        const key = typeof event === 'symbol' ? event.toString() : event;
+        const list = handlers[key];
+        const index = list?.indexOf(handler as Listener) ?? -1;
+        if (list && index !== -1) {
+          list.splice(index, 1);
+        }
+        return mockConnectionInstance;
+      });
+      mockConnectionInstance.emit.mockImplementation((event, ...args) => {
+        const key = typeof event === 'symbol' ? event.toString() : event;
+        const list = handlers[key];
+        if (!list?.length) {
+          return false;
+        }
+        for (const fn of [...list]) {
+          fn(...args);
+        }
+        return true;
+      });
+
+      await MCPConnectionFactory.create(basicOptions, {
+        useOAuth: true,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        oauthStart: staleOAuthStart,
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      });
+
+      const liveStarted = new Promise<void>((resolve) => {
+        liveOAuthStart.mockImplementation(async () => {
+          resolve();
+        });
+      });
+      const cleanup = MCPConnectionFactory.attachRequestOAuthHandler(
+        basicOptions,
+        {
+          useOAuth: true,
+          user: mockUser,
+          flowManager: mockFlowManager,
+          oauthStart: liveOAuthStart,
+          tokenMethods: {
+            findToken: jest.fn(),
+            createToken: jest.fn(),
+            updateToken: jest.fn(),
+            deleteTokens: jest.fn(),
+          },
+        },
+        mockConnectionInstance,
+      );
+      mockMCPTokenStorage.forceRefreshTokens.mockResolvedValueOnce(null);
+
+      mockConnectionInstance.emit('oauthRequired', {
+        serverUrl: 'https://api.example.com',
+        error: new Error('Non-200 status code (401)'),
+      });
+
+      await liveStarted;
+
+      expect(staleOAuthStart).not.toHaveBeenCalled();
+      expect(liveOAuthStart).toHaveBeenCalledWith('https://auth.example.com');
+      expect(handlers.oauthReauthenticationRequired.length).toBe(1);
+
+      cleanup();
+
+      expect(handlers.oauthReauthenticationRequired.length).toBe(0);
+    });
+
+    it('should invalidate completed mcp_oauth cache before falling through to interactive OAuth', async () => {
+      // Regression for the Codex finding "Bypass completed OAuth cache after a
+      // rejected token": when silent refresh returns null and the handler
+      // falls through to interactive OAuth, any recently COMPLETED mcp_oauth
+      // flow must be cleared so the fast-reuse path in `handleOAuthRequired`
+      // can't hand back the very tokens the resource server just rejected.
+      const sseConfig = {
+        ...mockServerConfig,
+        url: 'https://api.example.com',
+        type: 'sse' as const,
+      } as t.SSEOptions;
+
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: sseConfig,
+      };
+
+      const oauthOptions = {
+        useOAuth: true as const,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        oauthStart: jest.fn(),
+        oauthEnd: jest.fn(),
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      };
+
+      const completedFlowState = {
+        status: 'COMPLETED' as const,
+        type: 'mcp_oauth',
+        metadata: { state: 'old-csrf-state' },
+        createdAt: Date.now(),
+        completedAt: Date.now(),
+        result: {
+          access_token: 'just-rejected',
+          token_type: 'Bearer',
+          obtained_at: Date.now(),
+        } as MCPOAuthTokens,
+      };
+
+      mockProcessMCPEnv.mockReturnValue(sseConfig);
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow123');
+      mockMCPTokenStorage.forceRefreshTokens.mockResolvedValueOnce(null);
+      // First lookup (from invalidateCompletedOAuthFlow) sees the stale
+      // COMPLETED state with the just-rejected tokens; the second lookup
+      // (inside handleOAuthRequired, after deletion) sees nothing and goes
+      // straight to a fresh interactive OAuth flow.
+      mockFlowManager.getFlowState
+        .mockResolvedValueOnce(completedFlowState)
+        .mockResolvedValue(null);
+      mockMCPOAuthHandler.initiateOAuthFlow.mockResolvedValue({
+        authorizationUrl: 'https://auth.example.com',
+        flowId: 'flow123',
+        flowMetadata: {
+          serverName: 'test-server',
+          userId: 'user123',
+          serverUrl: 'https://api.example.com',
+          state: 'fresh-csrf-state',
+        },
+      });
+      mockFlowManager.createFlow.mockResolvedValue({
+        access_token: 'freshly-issued',
+        token_type: 'Bearer',
+        obtained_at: Date.now(),
+      } as MCPOAuthTokens);
+      mockConnectionInstance.isConnected.mockResolvedValue(false);
+
+      let oauthRequiredHandler: (data: Record<string, unknown>) => Promise<void>;
+      mockConnectionInstance.on.mockImplementation((event, handler) => {
+        if (event === 'oauthRequired') {
+          oauthRequiredHandler = handler as (data: Record<string, unknown>) => Promise<void>;
+        }
+        return mockConnectionInstance;
+      });
+
+      try {
+        await MCPConnectionFactory.create(basicOptions, oauthOptions);
+      } catch {
+        // Expected
+      }
+
+      await oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
+
+      // Completed `mcp_oauth` flow was deleted before the interactive path ran.
+      expect(mockFlowManager.deleteFlow).toHaveBeenCalledWith('flow123', 'mcp_oauth');
+      // And the old CSRF state mapping was cleaned up alongside it.
+      expect(mockMCPOAuthHandler.deleteStateMapping).toHaveBeenCalledWith(
+        'old-csrf-state',
+        mockFlowManager,
+      );
+    });
+
+    it('should not invalidate a completed mcp_oauth flow from another tenant', async () => {
+      const sseConfig = {
+        ...mockServerConfig,
+        url: 'https://api.example.com',
+        type: 'sse' as const,
+      } as t.SSEOptions;
+
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: sseConfig,
+      };
+
+      const oauthOptions = {
+        useOAuth: true as const,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        oauthStart: jest.fn(),
+        oauthEnd: jest.fn(),
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      };
+
+      const tenantBCompletedFlow = {
+        status: 'COMPLETED' as const,
+        type: 'mcp_oauth',
+        metadata: { state: 'tenant-b-state', tenantId: 'tenant-b' },
+        createdAt: Date.now(),
+        completedAt: Date.now(),
+        result: {
+          access_token: 'tenant-b-token',
+          token_type: 'Bearer',
+          obtained_at: Date.now(),
+        } as MCPOAuthTokens,
+      };
+
+      (getTenantId as jest.Mock).mockReturnValue('tenant-a');
+      mockProcessMCPEnv.mockReturnValue(sseConfig);
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow123');
+      mockMCPTokenStorage.forceRefreshTokens.mockResolvedValueOnce(null);
+      mockFlowManager.getFlowState
+        .mockResolvedValueOnce(tenantBCompletedFlow)
+        .mockResolvedValue(null);
+      mockMCPOAuthHandler.initiateOAuthFlow.mockResolvedValue({
+        authorizationUrl: 'https://auth.example.com',
+        flowId: 'flow123',
+        flowMetadata: {
+          serverName: 'test-server',
+          userId: 'user123',
+          serverUrl: 'https://api.example.com',
+          state: 'tenant-a-state',
+        },
+      });
+      mockFlowManager.createFlow.mockResolvedValue(null);
+      mockConnectionInstance.isConnected.mockResolvedValue(false);
+
+      let oauthRequiredHandler: (data: Record<string, unknown>) => Promise<void>;
+      mockConnectionInstance.on.mockImplementation((event, handler) => {
+        if (event === 'oauthRequired') {
+          oauthRequiredHandler = handler as (data: Record<string, unknown>) => Promise<void>;
+        }
+        return mockConnectionInstance;
+      });
+
+      try {
+        await MCPConnectionFactory.create(basicOptions, oauthOptions);
+      } catch {
+        // Expected
+      }
+
+      await oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
+
+      expect(mockFlowManager.getFlowState).toHaveBeenCalledWith('flow123', 'mcp_oauth');
+      expect(mockFlowManager.deleteFlow).not.toHaveBeenCalledWith('flow123', 'mcp_oauth');
+      expect(mockMCPOAuthHandler.deleteStateMapping).not.toHaveBeenCalledWith(
+        'tenant-b-state',
+        mockFlowManager,
+      );
+      expect(mockFlowManager.initFlow).toHaveBeenCalledWith(
+        'flow123',
+        'mcp_oauth',
+        expect.objectContaining({ tenantId: 'tenant-a' }),
+      );
+    });
+
+    it('should tenant-scope mcp_oauth flow lookup before completed-flow reuse', async () => {
+      const sseConfig = {
+        ...mockServerConfig,
+        url: 'https://api.example.com',
+        type: 'sse' as const,
+      } as t.SSEOptions;
+
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: sseConfig,
+      };
+
+      const oauthOptions = {
+        useOAuth: true as const,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        oauthStart: jest.fn(),
+        oauthEnd: jest.fn(),
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      };
+
+      const tenantFlowId = 'tenant:tenant-a:user123:test-server';
+
+      (getTenantId as jest.Mock).mockReturnValue('tenant-a');
+      mockProcessMCPEnv.mockReturnValue(sseConfig);
+      mockMCPTokenStorage.forceRefreshTokens.mockResolvedValueOnce(null);
+      mockFlowManager.getFlowState.mockResolvedValue(null);
+      mockMCPOAuthHandler.initiateOAuthFlow.mockResolvedValue({
+        authorizationUrl: 'https://auth.example.com',
+        flowId: tenantFlowId,
+        flowMetadata: {
+          serverName: 'test-server',
+          userId: 'user123',
+          serverUrl: 'https://api.example.com',
+          state: 'tenant-a-state',
+          tenantId: 'tenant-a',
+        },
+      });
+      mockFlowManager.createFlow.mockResolvedValue(null);
+      mockConnectionInstance.isConnected.mockResolvedValue(false);
+
+      let oauthRequiredHandler: (data: Record<string, unknown>) => Promise<void>;
+      mockConnectionInstance.on.mockImplementation((event, handler) => {
+        if (event === 'oauthRequired') {
+          oauthRequiredHandler = handler as (data: Record<string, unknown>) => Promise<void>;
+        }
+        return mockConnectionInstance;
+      });
+
+      try {
+        await MCPConnectionFactory.create(basicOptions, oauthOptions);
+      } catch {
+        // Expected
+      }
+
+      await oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
+
+      expect(mockFlowManager.getFlowState).toHaveBeenCalledWith(tenantFlowId, 'mcp_oauth');
+      expect(mockFlowManager.getFlowState).not.toHaveBeenCalledWith(
+        'user123:test-server',
+        'mcp_oauth',
+      );
+      expect(mockFlowManager.initFlow).toHaveBeenCalledWith(
+        tenantFlowId,
+        'mcp_oauth',
+        expect.objectContaining({ tenantId: 'tenant-a' }),
+      );
+    });
+
+    it('should scope the silent-refresh in-flight lock by tenant', async () => {
+      // Regression for the Codex finding "Scope silent refresh lock by
+      // tenant": two tenants that share the same `userId` and `serverName`
+      // (e.g. when IDs are username-based) must not join each other's
+      // in-flight refresh; otherwise tokens minted under tenant A's
+      // refresh-token would be applied to a tenant-B connection.
+      const tenantMock = getTenantId as jest.MockedFunction<typeof getTenantId>;
+
+      const sseConfig = {
+        ...mockServerConfig,
+        url: 'https://api.example.com',
+        type: 'sse' as const,
+      } as t.SSEOptions;
+
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: sseConfig,
+      };
+
+      const oauthOptions = {
+        useOAuth: true as const,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        oauthStart: jest.fn(),
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      };
+
+      const tenantATokens: MCPOAuthTokens = {
+        access_token: 'tenant-a-access',
+        refresh_token: 'tenant-a-refresh',
+        token_type: 'Bearer',
+        obtained_at: Date.now(),
+      };
+      const tenantBTokens: MCPOAuthTokens = {
+        access_token: 'tenant-b-access',
+        refresh_token: 'tenant-b-refresh',
+        token_type: 'Bearer',
+        obtained_at: Date.now(),
+      };
+
+      mockProcessMCPEnv.mockReturnValue(sseConfig);
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow123');
+      mockConnectionInstance.isConnected.mockResolvedValue(false);
+
+      let oauthRequiredHandler: (data: Record<string, unknown>) => Promise<void>;
+      mockConnectionInstance.on.mockImplementation((event, handler) => {
+        if (event === 'oauthRequired') {
+          oauthRequiredHandler = handler as (data: Record<string, unknown>) => Promise<void>;
+        }
+        return mockConnectionInstance;
+      });
+
+      // Build a factory whose tenantId was captured as "tenant-a", trigger a
+      // refresh, then build a second factory under "tenant-b" with the same
+      // userId and serverName. Each refresh must call `forceRefreshTokens`
+      // independently and apply its own tokens.
+      tenantMock.mockReturnValue('tenant-a');
+      mockMCPTokenStorage.forceRefreshTokens.mockResolvedValueOnce(tenantATokens);
+
+      try {
+        await MCPConnectionFactory.create(basicOptions, oauthOptions);
+      } catch {
+        // Expected
+      }
+      const tenantAHandler = oauthRequiredHandler!;
+
+      // Reset oauthRequiredHandler capture for the second factory.
+      tenantMock.mockReturnValue('tenant-b');
+      mockMCPTokenStorage.forceRefreshTokens.mockResolvedValueOnce(tenantBTokens);
+
+      try {
+        await MCPConnectionFactory.create(basicOptions, oauthOptions);
+      } catch {
+        // Expected
+      }
+      const tenantBHandler = oauthRequiredHandler!;
+
+      await Promise.all([
+        tenantAHandler({ serverUrl: 'https://api.example.com' }),
+        tenantBHandler({ serverUrl: 'https://api.example.com' }),
+      ]);
+
+      // Each tenant ran its own refresh and applied its own tokens — no
+      // cross-tenant coalescing.
+      expect(mockMCPTokenStorage.forceRefreshTokens).toHaveBeenCalledTimes(2);
+      expect(mockConnectionInstance.setOAuthTokens).toHaveBeenCalledWith(tenantATokens);
+      expect(mockConnectionInstance.setOAuthTokens).toHaveBeenCalledWith(tenantBTokens);
+    });
+
+    it('should restore captured tenant context while silently refreshing tokens', async () => {
+      const capturedContext = {
+        tenantId: 'tenant-a',
+        userId: 'user123',
+        requestId: 'req-123',
+      };
+      mockTenantStorage.getStore.mockReturnValueOnce(capturedContext);
+
+      const sseConfig = {
+        ...mockServerConfig,
+        url: 'https://api.example.com',
+        type: 'sse' as const,
+      } as t.SSEOptions;
+
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: sseConfig,
+      };
+
+      const oauthOptions = {
+        useOAuth: true as const,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        oauthStart: jest.fn(),
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      };
+
+      const refreshedTokens: MCPOAuthTokens = {
+        access_token: 'tenant-access',
+        refresh_token: 'tenant-refresh',
+        token_type: 'Bearer',
+        obtained_at: Date.now(),
+      };
+
+      mockProcessMCPEnv.mockReturnValue(sseConfig);
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow123');
+      mockMCPTokenStorage.forceRefreshTokens.mockResolvedValueOnce(refreshedTokens);
+      mockConnectionInstance.isConnected.mockResolvedValue(false);
+
+      let oauthRequiredHandler: (data: Record<string, unknown>) => Promise<void>;
+      mockConnectionInstance.on.mockImplementation((event, handler) => {
+        if (event === 'oauthRequired') {
+          oauthRequiredHandler = handler as (data: Record<string, unknown>) => Promise<void>;
+        }
+        return mockConnectionInstance;
+      });
+
+      try {
+        await MCPConnectionFactory.create(basicOptions, oauthOptions);
+      } catch {
+        // Expected
+      }
+
+      await oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
+
+      expect(mockTenantStorage.run).toHaveBeenCalledWith(capturedContext, expect.any(Function));
+      expect(mockMCPTokenStorage.forceRefreshTokens).toHaveBeenCalled();
+      expect(mockConnectionInstance.setOAuthTokens).toHaveBeenCalledWith(refreshedTokens);
+    });
+
+    it('should NOT delete a PENDING mcp_get_tokens flow after silent refresh', async () => {
+      // Regression for the Codex findings around active token-fetch flows:
+      // concurrent `getOAuthTokens` callers may be joined to a PENDING
+      // `mcp_get_tokens` flow via `monitorFlow`. Deleting it under them makes
+      // waiters fail; leaving it alone lets a stale handler publish rejected
+      // tokens later. Completing the flow with the fresh tokens solves both.
+      const sseConfig = {
+        ...mockServerConfig,
+        url: 'https://api.example.com',
+        type: 'sse' as const,
+      } as t.SSEOptions;
+
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: sseConfig,
+      };
+
+      const oauthOptions = {
+        useOAuth: true as const,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        oauthStart: jest.fn(),
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      };
+
+      const refreshedTokens: MCPOAuthTokens = {
+        access_token: 'refreshed-access',
+        refresh_token: 'refresh789',
+        token_type: 'Bearer',
+        obtained_at: Date.now(),
+      };
+
+      (getTenantId as jest.Mock).mockReturnValue('tenant-a');
+      mockProcessMCPEnv.mockReturnValue(sseConfig);
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow123');
+      mockMCPTokenStorage.forceRefreshTokens.mockResolvedValueOnce(refreshedTokens);
+      // A concurrent `getOAuthTokens` for this user/server is currently
+      // PENDING — joiners are monitoring it via `monitorFlow`.
+      mockFlowManager.getFlowState.mockResolvedValue({
+        status: 'PENDING' as const,
+        type: 'mcp_get_tokens',
+        metadata: {},
+        createdAt: Date.now(),
+      });
+      mockConnectionInstance.isConnected.mockResolvedValue(false);
+
+      let oauthRequiredHandler: (data: Record<string, unknown>) => Promise<void>;
+      mockConnectionInstance.on.mockImplementation((event, handler) => {
+        if (event === 'oauthRequired') {
+          oauthRequiredHandler = handler as (data: Record<string, unknown>) => Promise<void>;
+        }
+        return mockConnectionInstance;
+      });
+
+      try {
+        await MCPConnectionFactory.create(basicOptions, oauthOptions);
+      } catch {
+        // Expected
+      }
+
+      await oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
+
+      expect(mockMCPTokenStorage.forceRefreshTokens).toHaveBeenCalled();
+      expect(mockFlowManager.getFlowState).toHaveBeenCalledWith(
+        'tenant:tenant-a:flow123',
+        'mcp_get_tokens',
+      );
+      expect(mockFlowManager.completeFlow).toHaveBeenCalledWith(
+        'tenant:tenant-a:flow123',
+        'mcp_get_tokens',
+        refreshedTokens,
+      );
+      expect(mockFlowManager.deleteFlow).not.toHaveBeenCalledWith(
+        'tenant:tenant-a:flow123',
+        'mcp_get_tokens',
+      );
+    });
+
+    it('should invalidate mcp_get_tokens cache after interactive OAuth stores fresh tokens', async () => {
+      // Regression for the Codex finding "Invalidate token cache after
+      // interactive fallback": when silent refresh fails but interactive OAuth
+      // succeeds, the old `mcp_get_tokens` flow cache could otherwise re-serve
+      // stale tokens to the next `getOAuthTokens` call.
+      const sseConfig = {
+        ...mockServerConfig,
+        url: 'https://api.example.com',
+        type: 'sse' as const,
+      } as t.SSEOptions;
+
+      const basicOptions = {
+        serverName: 'test-server',
+        serverConfig: sseConfig,
+      };
+
+      const oauthOptions = {
+        useOAuth: true as const,
+        user: mockUser,
+        flowManager: mockFlowManager,
+        oauthStart: jest.fn(),
+        oauthEnd: jest.fn(),
+        tokenMethods: {
+          findToken: jest.fn(),
+          createToken: jest.fn(),
+          updateToken: jest.fn(),
+          deleteTokens: jest.fn(),
+        },
+      };
+
+      const interactiveTokens: MCPOAuthTokens = {
+        access_token: 'interactive-access',
+        token_type: 'Bearer',
+        obtained_at: Date.now(),
+      };
+
+      mockProcessMCPEnv.mockReturnValue(sseConfig);
+      mockMCPOAuthHandler.generateFlowId.mockReturnValue('flow123');
+      mockMCPTokenStorage.forceRefreshTokens.mockResolvedValueOnce(null);
+      mockMCPOAuthHandler.initiateOAuthFlow.mockResolvedValue({
+        authorizationUrl: 'https://auth.example.com',
+        flowId: 'flow123',
+        flowMetadata: {
+          serverName: 'test-server',
+          userId: 'user123',
+          serverUrl: 'https://api.example.com',
+          state: 'fresh-csrf-state',
+        },
+      });
+      // First `getFlowState` (from `invalidateCompletedOAuthFlow`): no
+      // completed mcp_oauth flow → no-op. Second (from `handleOAuthRequired`):
+      // no existing flow either. Final (from `invalidateGetTokensFlow` after
+      // interactive store): a COMPLETED `mcp_get_tokens` cache exists and
+      // must be cleared so the next `getOAuthTokens` reads fresh tokens.
+      mockFlowManager.getFlowState
+        .mockResolvedValueOnce(null)
+        .mockResolvedValueOnce(null)
+        .mockResolvedValueOnce({
+          status: 'COMPLETED' as const,
+          type: 'mcp_get_tokens',
+          metadata: {},
+          createdAt: Date.now(),
+          completedAt: Date.now(),
+          result: {
+            access_token: 'old-stale',
+            token_type: 'Bearer',
+            obtained_at: Date.now(),
+          } as MCPOAuthTokens,
+        });
+      mockFlowManager.createFlow.mockResolvedValue(interactiveTokens);
+      mockConnectionInstance.isConnected.mockResolvedValue(false);
+
+      let oauthRequiredHandler: (data: Record<string, unknown>) => Promise<void>;
+      mockConnectionInstance.on.mockImplementation((event, handler) => {
+        if (event === 'oauthRequired') {
+          oauthRequiredHandler = handler as (data: Record<string, unknown>) => Promise<void>;
+        }
+        return mockConnectionInstance;
+      });
+
+      try {
+        await MCPConnectionFactory.create(basicOptions, oauthOptions);
+      } catch {
+        // Expected
+      }
+
+      await oauthRequiredHandler!({ serverUrl: 'https://api.example.com' });
+
+      expect(mockConnectionInstance.setOAuthTokens).toHaveBeenCalledWith(interactiveTokens);
+      // The stale `mcp_get_tokens` cache is cleared so the next
+      // `getOAuthTokens` reads the freshly persisted interactive tokens.
+      expect(mockFlowManager.deleteFlow).toHaveBeenCalledWith('flow123', 'mcp_get_tokens');
+    });
   });
 
   describe('connection retry logic', () => {
diff --git a/packages/api/src/mcp/__tests__/MCPManager.test.ts b/packages/api/src/mcp/__tests__/MCPManager.test.ts
index b8792fb8ef7..865de69eb4e 100644
--- a/packages/api/src/mcp/__tests__/MCPManager.test.ts
+++ b/packages/api/src/mcp/__tests__/MCPManager.test.ts
@@ -2,14 +2,16 @@ import { logger } from '@librechat/data-schemas';
 import type { IUser } from '@librechat/data-schemas';
 import type { GraphTokenResolver } from '~/utils/graph';
 import type * as t from '~/mcp/types';
+import { OboTokenResolutionError, detectOAuthRequirement, resolveOboToken } from '~/mcp/oauth';
 import { MCPServersInitializer } from '~/mcp/registry/MCPServersInitializer';
 import { MCPServerInspector } from '~/mcp/registry/MCPServerInspector';
-import { MCPConnectionFactory } from '~/mcp/MCPConnectionFactory';
 import { ConnectionsRepository } from '~/mcp/ConnectionsRepository';
+import { MCPConnectionFactory } from '~/mcp/MCPConnectionFactory';
+import { isMCPDomainAllowed } from '~/auth/domain';
 import { MCPConnection } from '~/mcp/connection';
 import { MCPManager } from '~/mcp/MCPManager';
-import { OboTokenResolutionError, resolveOboToken } from '~/mcp/oauth';
 import * as graphUtils from '~/utils/graph';
+import { processMCPEnv } from '~/utils/env';
 
 // Mock external dependencies
 jest.mock('@librechat/data-schemas', () => ({
@@ -28,6 +30,7 @@ jest.mock('~/utils/graph', () => ({
 
 jest.mock('~/mcp/oauth', () => ({
   ...jest.requireActual('~/mcp/oauth'),
+  detectOAuthRequirement: jest.fn(),
   resolveOboToken: jest.fn(),
 }));
 
@@ -35,13 +38,27 @@ jest.mock('~/utils/env', () => ({
   processMCPEnv: jest.fn((params) => params.options),
 }));
 
+jest.mock('~/auth/domain', () => ({
+  isMCPDomainAllowed: jest.fn().mockResolvedValue(true),
+}));
+
+const mockShouldEnableSSRFProtection = jest.fn().mockReturnValue(false);
+const mockGetAllowedDomains = jest.fn().mockReturnValue(null);
+const mockGetAllowedAddresses = jest.fn().mockReturnValue(null);
 const mockRegistryInstance = {
   getServerConfig: jest.fn(),
   getAllServerConfigs: jest.fn(),
   getOAuthServers: jest.fn(),
-  shouldEnableSSRFProtection: jest.fn().mockReturnValue(false),
-  getAllowedDomains: jest.fn().mockReturnValue(null),
-  getAllowedAddresses: jest.fn().mockReturnValue(null),
+  shouldEnableSSRFProtection: mockShouldEnableSSRFProtection,
+  getAllowedDomains: mockGetAllowedDomains,
+  getAllowedAddresses: mockGetAllowedAddresses,
+  // Mirrors the real per-request resolver by reading the base-allowlist mocks above, so
+  // existing tests that override getAllowedDomains/shouldEnableSSRFProtection still apply.
+  resolveAllowlists: jest.fn(async () => ({
+    allowedDomains: mockGetAllowedDomains(),
+    allowedAddresses: mockGetAllowedAddresses(),
+    useSSRFProtection: mockShouldEnableSSRFProtection(),
+  })),
 };
 
 jest.mock('~/mcp/registry/MCPServersRegistry', () => ({
@@ -62,6 +79,11 @@ jest.mock('~/mcp/MCPConnectionFactory');
 
 const mockLogger = logger as jest.Mocked<typeof logger>;
 const mockResolveOboToken = resolveOboToken as jest.MockedFunction<typeof resolveOboToken>;
+const mockDetectOAuthRequirement = detectOAuthRequirement as jest.MockedFunction<
+  typeof detectOAuthRequirement
+>;
+const mockProcessMCPEnv = processMCPEnv as jest.MockedFunction<typeof processMCPEnv>;
+const mockIsMCPDomainAllowed = isMCPDomainAllowed as jest.MockedFunction<typeof isMCPDomainAllowed>;
 
 describe('MCPManager', () => {
   const userId = 'test-user-123';
@@ -75,6 +97,15 @@ describe('MCPManager', () => {
     // Set up default mock implementations
     (MCPServersInitializer.initialize as jest.Mock).mockResolvedValue(undefined);
     (mockRegistryInstance.getAllServerConfigs as jest.Mock).mockResolvedValue({});
+    (mockRegistryInstance.shouldEnableSSRFProtection as jest.Mock).mockReturnValue(false);
+    (mockRegistryInstance.getAllowedDomains as jest.Mock).mockReturnValue(null);
+    (mockRegistryInstance.getAllowedAddresses as jest.Mock).mockReturnValue(null);
+    mockProcessMCPEnv.mockImplementation((params) => params.options);
+    mockIsMCPDomainAllowed.mockResolvedValue(true);
+    mockDetectOAuthRequirement.mockResolvedValue({
+      requiresOAuth: false,
+      method: 'no-metadata-found',
+    });
   });
 
   function mockAppConnections(
@@ -478,6 +509,7 @@ describe('MCPManager', () => {
           return options;
         },
       );
+      (MCPConnectionFactory.create as jest.Mock).mockResolvedValue(mockConnection);
     });
 
     it('should call preProcessGraphTokens with graphTokenResolver when provided', async () => {
@@ -541,6 +573,104 @@ describe('MCPManager', () => {
       );
     });
 
+    it('should attach request OAuth handler without reprocessing resolved config', async () => {
+      const rawServerConfig = {
+        type: 'sse',
+        url: 'https://api.example.com/{{LIBRECHAT_USER_ID}}',
+        headers: {
+          Authorization: 'Bearer {{USER_TOKEN}}',
+        },
+        requiresOAuth: true,
+        oauth: {
+          authorization_url: 'https://auth.example.com/authorize',
+        },
+      } as t.ParsedServerConfig;
+      const processedServerConfig = {
+        ...rawServerConfig,
+        url: 'https://api.example.com/user-123',
+        headers: {
+          Authorization: 'Bearer ${SHOULD_NOT_EXPAND}',
+        },
+      };
+      const cleanupOAuthHandler = jest.fn();
+
+      mockProcessMCPEnv.mockReturnValue(processedServerConfig);
+      (MCPConnectionFactory.attachRequestOAuthHandler as jest.Mock).mockReturnValue(
+        cleanupOAuthHandler,
+      );
+      mockAppConnections({
+        get: jest.fn().mockResolvedValue(mockConnection),
+      });
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue(rawServerConfig);
+
+      const manager = await MCPManager.createInstance(newMCPServersConfig());
+      const oauthStart = jest.fn();
+
+      await manager.callTool({
+        user: mockUser as IUser,
+        serverName,
+        toolName: 'test_tool',
+        provider: 'openai',
+        oauthStart,
+        flowManager: mockFlowManager as unknown as Parameters<
+          typeof manager.callTool
+        >[0]['flowManager'],
+      });
+
+      /** One pass from user-connection runtime resolution, one from callTool — none from the handler attach */
+      expect(mockProcessMCPEnv).toHaveBeenCalledTimes(2);
+      expect(MCPConnectionFactory.attachRequestOAuthHandler).toHaveBeenCalledWith(
+        expect.objectContaining({
+          serverConfig: processedServerConfig,
+          skipEnvProcessing: true,
+        }),
+        expect.objectContaining({
+          oauthStart,
+          user: mockUser,
+        }),
+        mockConnection,
+      );
+      expect(cleanupOAuthHandler).toHaveBeenCalled();
+    });
+
+    it('should leave graph token placeholders sandboxed for user-sourced configs', async () => {
+      const serverConfig: t.ParsedServerConfig = {
+        type: 'sse',
+        url: 'https://api.example.com',
+        headers: {
+          Authorization: 'Bearer {{LIBRECHAT_GRAPH_ACCESS_TOKEN}}',
+        },
+        source: 'user',
+        dbId: 'user-server-id',
+      };
+
+      mockAppConnections({
+        get: jest.fn().mockResolvedValue(mockConnection),
+      });
+
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue(serverConfig);
+
+      const manager = await MCPManager.createInstance(newMCPServersConfig());
+
+      await manager.callTool({
+        user: mockUser as IUser,
+        serverName,
+        toolName: 'test_tool',
+        provider: 'openai',
+        flowManager: mockFlowManager as unknown as Parameters<
+          typeof manager.callTool
+        >[0]['flowManager'],
+        graphTokenResolver: mockGraphTokenResolver,
+      });
+
+      expect(graphUtils.preProcessGraphTokens).not.toHaveBeenCalled();
+      expect(mockConnection.setRequestHeaders).toHaveBeenCalledWith(
+        expect.objectContaining({
+          Authorization: 'Bearer {{LIBRECHAT_GRAPH_ACCESS_TOKEN}}',
+        }),
+      );
+    });
+
     it('should pass options unchanged when no graphTokenResolver is provided', async () => {
       const serverConfig: t.SSEOptions = {
         type: 'sse',
@@ -1088,6 +1218,49 @@ describe('MCPManager', () => {
       expect(appConnections.get).toHaveBeenCalledWith(serverName);
       expect(getUserConnectionSpy).not.toHaveBeenCalled();
     });
+
+    it('should use user-scoped connections for trusted runtime context placeholders', async () => {
+      const appConnection = {
+        isConnected: jest.fn().mockResolvedValue(true),
+      } as unknown as MCPConnection;
+      const userConnection = {
+        isConnected: jest.fn().mockResolvedValue(true),
+      } as unknown as MCPConnection;
+      const appConnections = {
+        get: jest.fn().mockResolvedValue(appConnection),
+      };
+      const runtimeHeaderConfig: t.ParsedServerConfig = {
+        type: 'streamable-http',
+        url: 'https://api.example.com/mcp',
+        source: 'yaml',
+        headers: {
+          'X-LibreChat-User-Email': '{{LIBRECHAT_USER_EMAIL}}',
+        },
+      };
+
+      mockAppConnections(appConnections);
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue(runtimeHeaderConfig);
+
+      const manager = await MCPManager.createInstance(newMCPServersConfig());
+      const getUserConnectionSpy = jest
+        .spyOn(manager, 'getUserConnection')
+        .mockResolvedValue(userConnection);
+
+      const connection = await manager.getConnection({
+        serverName,
+        user: mockUser as IUser,
+      });
+
+      expect(connection).toBe(userConnection);
+      expect(appConnections.get).not.toHaveBeenCalled();
+      expect(getUserConnectionSpy).toHaveBeenCalledWith(
+        expect.objectContaining({
+          serverName,
+          serverConfig: runtimeHeaderConfig,
+          user: mockUser,
+        }),
+      );
+    });
   });
 
   describe('discoverServerTools', () => {
@@ -1099,6 +1272,7 @@ describe('MCPManager', () => {
     const mockConnection = {
       isConnected: jest.fn().mockResolvedValue(true),
       fetchTools: jest.fn().mockResolvedValue(mockTools),
+      disconnect: jest.fn().mockResolvedValue(undefined),
     } as unknown as MCPConnection;
 
     beforeEach(() => {
@@ -1120,6 +1294,9 @@ describe('MCPManager', () => {
     });
 
     it('should use MCPConnectionFactory.discoverTools when no app connection available', async () => {
+      const discoveryConnection = {
+        disconnect: jest.fn().mockResolvedValue(undefined),
+      } as unknown as MCPConnection;
       mockAppConnections({
         get: jest.fn().mockResolvedValue(null),
       });
@@ -1132,7 +1309,7 @@ describe('MCPManager', () => {
 
       (MCPConnectionFactory.discoverTools as jest.Mock).mockResolvedValue({
         tools: mockTools,
-        connection: null,
+        connection: discoveryConnection,
         oauthRequired: false,
         oauthUrl: null,
       });
@@ -1143,11 +1320,13 @@ describe('MCPManager', () => {
       expect(result.tools).toEqual(mockTools);
       expect(result.oauthRequired).toBe(false);
       expect(MCPConnectionFactory.discoverTools).toHaveBeenCalled();
+      expect(discoveryConnection.disconnect).toHaveBeenCalledTimes(1);
     });
 
-    it('should forward user, customUserVars, requestBody, and connectionTimeout to discoverTools in the non-OAuth path', async () => {
+    it('should forward runtime context to discoverTools in the non-OAuth path', async () => {
       const mockUser = { id: 'user123', email: 'test@example.com' } as unknown as IUser;
       const customUserVars = { MY_CUSTOM_KEY: 'c527bd0abc123' };
+      const graphTokenResolver = jest.fn();
 
       mockAppConnections({
         get: jest.fn().mockResolvedValue(null),
@@ -1171,20 +1350,49 @@ describe('MCPManager', () => {
         user: mockUser,
         customUserVars,
         requestBody: { conversationId: 'conv-123' } as t.ToolDiscoveryOptions['requestBody'],
+        graphTokenResolver,
         connectionTimeout: 10000,
       });
 
       expect(MCPConnectionFactory.discoverTools).toHaveBeenCalledWith(
-        expect.objectContaining({ serverName }),
+        expect.objectContaining({
+          serverName,
+          serverConfig: expect.objectContaining({
+            url: 'https://my-mcp.server.com?key={{MY_CUSTOM_KEY}}',
+          }),
+        }),
         expect.objectContaining({
           user: mockUser,
           customUserVars,
           requestBody: { conversationId: 'conv-123' },
+          graphTokenResolver,
           connectionTimeout: 10000,
         }),
       );
     });
 
+    it('should not discover BODY-scoped servers without request body context', async () => {
+      mockAppConnections({
+        get: jest.fn().mockResolvedValue(null),
+      });
+
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue({
+        type: 'streamable-http',
+        url: 'https://api.example.com/messages/{{LIBRECHAT_BODY_MESSAGEID}}/mcp',
+        source: 'yaml',
+      });
+
+      const manager = await MCPManager.createInstance(newMCPServersConfig());
+      const result = await manager.discoverServerTools({ serverName });
+
+      expect(result).toEqual({ tools: null, oauthRequired: false, oauthUrl: null });
+      expect(MCPConnectionFactory.discoverTools).not.toHaveBeenCalled();
+      expect(mockLogger.warn).toHaveBeenCalledWith(
+        expect.stringContaining('Request body field(s) required'),
+      );
+      expect(mockLogger.warn).toHaveBeenCalledWith(expect.stringContaining('messageId'));
+    });
+
     it('should return null tools when server config not found', async () => {
       mockAppConnections({
         get: jest.fn().mockResolvedValue(null),
@@ -1275,6 +1483,7 @@ describe('MCPManager', () => {
         serverName,
         user: mockUser,
         flowManager: mockFlowManager as unknown as t.ToolDiscoveryOptions['flowManager'],
+        graphTokenResolver: jest.fn(),
       });
 
       expect(result.tools).toEqual(mockTools);
@@ -1282,7 +1491,11 @@ describe('MCPManager', () => {
       expect(result.oauthUrl).toBe('https://auth.example.com/authorize');
       expect(MCPConnectionFactory.discoverTools).toHaveBeenCalledWith(
         expect.objectContaining({ serverName }),
-        expect.objectContaining({ user: mockUser, useOAuth: true }),
+        expect.objectContaining({
+          user: mockUser,
+          useOAuth: true,
+          graphTokenResolver: expect.any(Function),
+        }),
       );
     });
   });
@@ -1358,6 +1571,422 @@ describe('MCPManager', () => {
       );
     });
 
+    it('should detect OAuth after resolving trusted runtime URL placeholders', async () => {
+      const runtimeUrlConfig: t.ParsedServerConfig = {
+        type: 'streamable-http',
+        url: 'https://api.example.com/users/{{LIBRECHAT_USER_ID}}/mcp',
+        source: 'yaml',
+      };
+      mockAppConnections({
+        has: jest.fn().mockResolvedValue(false),
+      });
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue(runtimeUrlConfig);
+      mockProcessMCPEnv.mockImplementation(({ options, user }) => ({
+        ...options,
+        ...('url' in options && {
+          url: options.url?.replace('{{LIBRECHAT_USER_ID}}', user?.id ?? ''),
+        }),
+      }));
+      mockDetectOAuthRequirement.mockResolvedValue({
+        requiresOAuth: true,
+        method: 'protected-resource-metadata',
+      });
+      (MCPConnectionFactory.create as jest.Mock).mockResolvedValue(mockConnection);
+
+      const manager = await MCPManager.createInstance(newMCPServersConfig());
+      await manager.getUserConnection({
+        serverName,
+        user: mockUser,
+        flowManager: mockFlowManager as unknown as t.UserMCPConnectionOptions['flowManager'],
+      });
+
+      expect(mockDetectOAuthRequirement).toHaveBeenCalledWith(
+        'https://api.example.com/users/test-user-123/mcp',
+        null,
+        null,
+      );
+      expect(MCPConnectionFactory.create).toHaveBeenCalledWith(
+        expect.objectContaining({
+          serverConfig: expect.objectContaining({
+            requiresOAuth: true,
+          }),
+        }),
+        expect.objectContaining({ useOAuth: true }),
+      );
+    });
+
+    it('should reject disallowed runtime URLs before OAuth detection probes them', async () => {
+      const runtimeUrlConfig: t.ParsedServerConfig = {
+        type: 'streamable-http',
+        url: 'https://{{LIBRECHAT_BODY_CONVERSATIONID}}.example.com/mcp',
+        source: 'yaml',
+      };
+      mockAppConnections({
+        has: jest.fn().mockResolvedValue(false),
+      });
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue(runtimeUrlConfig);
+      (mockRegistryInstance.getAllowedDomains as jest.Mock).mockReturnValue(['*.example.com']);
+      mockProcessMCPEnv.mockImplementation(({ options, body }) => ({
+        ...options,
+        ...('url' in options && {
+          url: options.url?.replace(
+            '{{LIBRECHAT_BODY_CONVERSATIONID}}',
+            body?.conversationId ?? '',
+          ),
+        }),
+      }));
+      mockIsMCPDomainAllowed.mockResolvedValue(false);
+
+      const manager = await MCPManager.createInstance(newMCPServersConfig());
+      await expect(
+        manager.getUserConnection({
+          serverName,
+          user: mockUser,
+          requestBody: { conversationId: 'evil.com/path' },
+          flowManager: mockFlowManager as unknown as t.UserMCPConnectionOptions['flowManager'],
+        }),
+      ).rejects.toThrow('not allowed by the configured domain policy');
+
+      expect(mockDetectOAuthRequirement).not.toHaveBeenCalled();
+      expect(MCPConnectionFactory.create).not.toHaveBeenCalled();
+    });
+
+    it('should reject resolved runtime URLs that fail MCP domain policy', async () => {
+      const runtimeUrlConfig: t.ParsedServerConfig = {
+        type: 'streamable-http',
+        url: 'https://{{LIBRECHAT_BODY_CONVERSATIONID}}.example.com/mcp',
+        source: 'yaml',
+        requiresOAuth: false,
+      };
+      mockAppConnections({
+        has: jest.fn().mockResolvedValue(false),
+      });
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue(runtimeUrlConfig);
+      (mockRegistryInstance.getAllowedDomains as jest.Mock).mockReturnValue(['*.example.com']);
+      mockProcessMCPEnv.mockImplementation(({ options, body }) => ({
+        ...options,
+        ...('url' in options && {
+          url: options.url?.replace(
+            '{{LIBRECHAT_BODY_CONVERSATIONID}}',
+            body?.conversationId ?? '',
+          ),
+        }),
+      }));
+      mockIsMCPDomainAllowed.mockResolvedValue(false);
+
+      const manager = await MCPManager.createInstance(newMCPServersConfig());
+      await expect(
+        manager.getUserConnection({
+          serverName,
+          user: mockUser,
+          requestBody: { conversationId: 'evil.com/path' },
+        }),
+      ).rejects.toThrow('not allowed by the configured domain policy');
+
+      expect(mockIsMCPDomainAllowed).toHaveBeenCalledWith(
+        expect.objectContaining({
+          url: 'https://evil.com/path.example.com/mcp',
+        }),
+        ['*.example.com'],
+        null,
+      );
+      expect(MCPConnectionFactory.create).not.toHaveBeenCalled();
+    });
+
+    it('should validate resolved runtime URLs without passing resolved configs to the factory', async () => {
+      const runtimeUrlConfig: t.ParsedServerConfig = {
+        type: 'streamable-http',
+        url: 'https://{{LIBRECHAT_BODY_CONVERSATIONID}}.example.com/mcp',
+        source: 'yaml',
+        requiresOAuth: false,
+      };
+      mockAppConnections({
+        has: jest.fn().mockResolvedValue(false),
+      });
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue(runtimeUrlConfig);
+      (mockRegistryInstance.getAllowedDomains as jest.Mock).mockReturnValue(['*.example.com']);
+      mockProcessMCPEnv.mockImplementation(({ options, body }) => ({
+        ...options,
+        ...('url' in options && {
+          url: options.url?.replace(
+            '{{LIBRECHAT_BODY_CONVERSATIONID}}',
+            body?.conversationId ?? '',
+          ),
+        }),
+      }));
+      mockIsMCPDomainAllowed.mockResolvedValue(true);
+      (MCPConnectionFactory.create as jest.Mock).mockResolvedValue(mockConnection);
+
+      const manager = await MCPManager.createInstance(newMCPServersConfig());
+      await manager.getUserConnection({
+        serverName,
+        user: mockUser,
+        requestBody: { conversationId: 'tenant-a' },
+      });
+
+      expect(mockIsMCPDomainAllowed).toHaveBeenCalledWith(
+        expect.objectContaining({
+          url: 'https://tenant-a.example.com/mcp',
+        }),
+        ['*.example.com'],
+        null,
+      );
+      expect(MCPConnectionFactory.create).toHaveBeenCalledWith(
+        expect.objectContaining({
+          serverConfig: expect.objectContaining({
+            url: 'https://{{LIBRECHAT_BODY_CONVERSATIONID}}.example.com/mcp',
+          }),
+        }),
+        expect.objectContaining({
+          requestBody: { conversationId: 'tenant-a' },
+        }),
+      );
+    });
+
+    it('should keep graph placeholders unresolved for user-sourced connection configs', async () => {
+      const graphConfig: t.ParsedServerConfig = {
+        type: 'streamable-http',
+        url: 'https://api.example.com/mcp',
+        source: 'user',
+        dbId: 'user-server-id',
+        requiresOAuth: false,
+        headers: {
+          Authorization: 'Bearer {{LIBRECHAT_GRAPH_ACCESS_TOKEN}}',
+        },
+      };
+      mockAppConnections({
+        has: jest.fn().mockResolvedValue(false),
+      });
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue(graphConfig);
+      (MCPConnectionFactory.create as jest.Mock).mockResolvedValue(mockConnection);
+
+      const manager = await MCPManager.createInstance(newMCPServersConfig());
+      await manager.getUserConnection({
+        serverName,
+        user: mockUser,
+        graphTokenResolver: jest.fn(),
+      });
+
+      expect(graphUtils.preProcessGraphTokens).not.toHaveBeenCalled();
+      expect(MCPConnectionFactory.create).toHaveBeenCalledWith(
+        expect.objectContaining({
+          serverConfig: expect.objectContaining({
+            headers: {
+              Authorization: 'Bearer {{LIBRECHAT_GRAPH_ACCESS_TOKEN}}',
+            },
+          }),
+        }),
+        expect.any(Object),
+      );
+    });
+
+    it('should not cache connections when request body placeholders affect the URL', async () => {
+      const bodyUrlConfig: t.ParsedServerConfig = {
+        type: 'streamable-http',
+        url: 'https://api.example.com/messages/{{LIBRECHAT_BODY_MESSAGEID}}/mcp',
+        source: 'yaml',
+        requiresOAuth: false,
+      };
+      const firstConnection = {
+        isConnected: jest.fn().mockResolvedValue(true),
+      } as unknown as MCPConnection;
+      const secondConnection = {
+        isConnected: jest.fn().mockResolvedValue(true),
+      } as unknown as MCPConnection;
+
+      mockAppConnections({
+        has: jest.fn().mockResolvedValue(false),
+      });
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue(bodyUrlConfig);
+      mockProcessMCPEnv.mockImplementation(({ options, body }) => ({
+        ...options,
+        ...('url' in options && {
+          url: options.url?.replace('{{LIBRECHAT_BODY_MESSAGEID}}', body?.messageId ?? ''),
+        }),
+      }));
+      (MCPConnectionFactory.create as jest.Mock)
+        .mockResolvedValueOnce(firstConnection)
+        .mockResolvedValueOnce(secondConnection);
+
+      const manager = await MCPManager.createInstance(newMCPServersConfig());
+      const first = await manager.getUserConnection({
+        serverName,
+        user: mockUser,
+        requestBody: { messageId: 'message-1' },
+      });
+      const second = await manager.getUserConnection({
+        serverName,
+        user: mockUser,
+        requestBody: { messageId: 'message-2' },
+      });
+
+      expect(first).toBe(firstConnection);
+      expect(second).toBe(secondConnection);
+      expect(MCPConnectionFactory.create).toHaveBeenCalledTimes(2);
+    });
+
+    it('should reuse BODY-scoped connections within a request-scoped connection store', async () => {
+      const bodyUrlConfig: t.ParsedServerConfig = {
+        type: 'streamable-http',
+        url: 'https://api.example.com/messages/{{LIBRECHAT_BODY_MESSAGEID}}/mcp',
+        source: 'yaml',
+        requiresOAuth: false,
+      };
+      const requestScopedConnection = {
+        isConnected: jest.fn().mockResolvedValue(true),
+      } as unknown as MCPConnection;
+      const requestScopedConnections: t.RequestScopedMCPConnectionStore = {
+        connections: new Map(),
+        pending: new Map(),
+      };
+
+      mockAppConnections({
+        has: jest.fn().mockResolvedValue(false),
+      });
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue(bodyUrlConfig);
+      mockProcessMCPEnv.mockImplementation(({ options, body }) => ({
+        ...options,
+        ...('url' in options && {
+          url: options.url?.replace('{{LIBRECHAT_BODY_MESSAGEID}}', body?.messageId ?? ''),
+        }),
+      }));
+      (MCPConnectionFactory.create as jest.Mock).mockResolvedValue(requestScopedConnection);
+
+      const manager = await MCPManager.createInstance(newMCPServersConfig());
+      const first = await manager.getUserConnection({
+        serverName,
+        user: mockUser,
+        requestBody: { messageId: 'message-1' },
+        requestScopedConnections,
+      });
+      const second = await manager.getUserConnection({
+        serverName,
+        user: mockUser,
+        requestBody: { messageId: 'message-1' },
+        requestScopedConnections,
+      });
+
+      expect(first).toBe(requestScopedConnection);
+      expect(second).toBe(requestScopedConnection);
+      expect(MCPConnectionFactory.create).toHaveBeenCalledTimes(1);
+      expect(requestScopedConnections.connections.get(`${mockUser.id}:${serverName}`)).toBe(
+        requestScopedConnection,
+      );
+    });
+
+    it('should not clear server cooldowns for ephemeral runtime connections', async () => {
+      const bodyUrlConfig: t.ParsedServerConfig = {
+        type: 'streamable-http',
+        url: 'https://api.example.com/messages/{{LIBRECHAT_BODY_MESSAGEID}}/mcp',
+        source: 'yaml',
+        requiresOAuth: false,
+      };
+      const clearCooldownSpy = jest.spyOn(MCPConnection, 'clearCooldown');
+
+      mockAppConnections({
+        has: jest.fn().mockResolvedValue(false),
+      });
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue(bodyUrlConfig);
+      mockProcessMCPEnv.mockImplementation(({ options, body }) => ({
+        ...options,
+        ...('url' in options && {
+          url: options.url?.replace('{{LIBRECHAT_BODY_MESSAGEID}}', body?.messageId ?? ''),
+        }),
+      }));
+      (MCPConnectionFactory.create as jest.Mock).mockResolvedValue(mockConnection);
+
+      try {
+        const manager = await MCPManager.createInstance(newMCPServersConfig());
+        await manager.getUserConnection({
+          serverName,
+          user: mockUser,
+          requestBody: { messageId: 'message-1' },
+        });
+
+        expect(clearCooldownSpy).not.toHaveBeenCalled();
+      } finally {
+        clearCooldownSpy.mockRestore();
+      }
+    });
+
+    it('should still clear server cooldowns for explicit forceNew connections', async () => {
+      const staticConfig: t.ParsedServerConfig = {
+        type: 'streamable-http',
+        url: 'https://api.example.com/mcp',
+        source: 'yaml',
+        requiresOAuth: false,
+      };
+      const clearCooldownSpy = jest.spyOn(MCPConnection, 'clearCooldown');
+
+      mockAppConnections({
+        has: jest.fn().mockResolvedValue(false),
+      });
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue(staticConfig);
+      (MCPConnectionFactory.create as jest.Mock).mockResolvedValue(mockConnection);
+
+      try {
+        const manager = await MCPManager.createInstance(newMCPServersConfig());
+        await manager.getUserConnection({
+          serverName,
+          user: mockUser,
+          forceNew: true,
+        });
+
+        expect(clearCooldownSpy).toHaveBeenCalledWith(serverName);
+      } finally {
+        clearCooldownSpy.mockRestore();
+      }
+    });
+
+    it('should reject BODY-scoped connections without request body context', async () => {
+      const bodyUrlConfig: t.ParsedServerConfig = {
+        type: 'streamable-http',
+        url: 'https://api.example.com/messages/{{LIBRECHAT_BODY_MESSAGEID}}/mcp',
+        source: 'yaml',
+        requiresOAuth: false,
+      };
+
+      mockAppConnections({
+        has: jest.fn().mockResolvedValue(false),
+      });
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue(bodyUrlConfig);
+
+      const manager = await MCPManager.createInstance(newMCPServersConfig());
+      await expect(
+        manager.getUserConnection({
+          serverName,
+          user: mockUser,
+        }),
+      ).rejects.toThrow('Request body field(s) required');
+
+      expect(MCPConnectionFactory.create).not.toHaveBeenCalled();
+    });
+
+    it('should reject BODY-scoped connections when a referenced body field is missing', async () => {
+      const bodyUrlConfig: t.ParsedServerConfig = {
+        type: 'streamable-http',
+        url: 'https://api.example.com/messages/{{LIBRECHAT_BODY_MESSAGEID}}/mcp',
+        source: 'yaml',
+        requiresOAuth: false,
+      };
+
+      mockAppConnections({
+        has: jest.fn().mockResolvedValue(false),
+      });
+      (mockRegistryInstance.getServerConfig as jest.Mock).mockResolvedValue(bodyUrlConfig);
+
+      const manager = await MCPManager.createInstance(newMCPServersConfig());
+      await expect(
+        manager.getUserConnection({
+          serverName,
+          user: mockUser,
+          requestBody: { conversationId: 'conv-123' },
+        }),
+      ).rejects.toThrow('messageId');
+
+      expect(MCPConnectionFactory.create).not.toHaveBeenCalled();
+    });
+
     it('should throw when OAuth server lacks flowManager', async () => {
       mockAppConnections({
         has: jest.fn().mockResolvedValue(false),
diff --git a/packages/api/src/mcp/__tests__/MCPOAuthConnectionEvents.test.ts b/packages/api/src/mcp/__tests__/MCPOAuthConnectionEvents.test.ts
index 08b28dd817e..dcacd2b18ec 100644
--- a/packages/api/src/mcp/__tests__/MCPOAuthConnectionEvents.test.ts
+++ b/packages/api/src/mcp/__tests__/MCPOAuthConnectionEvents.test.ts
@@ -5,12 +5,12 @@
  * oauthFailed rejection, timeout behavior, and token expiry mid-session.
  */
 
-import { MCPConnection } from '~/mcp/connection';
-import { MCPConnectionFactory } from '~/mcp/MCPConnectionFactory';
-import { createOAuthMCPServer } from './helpers/oauthTestServer';
 import type { OAuthTestServer } from './helpers/oauthTestServer';
 import type { StreamableHTTPOptions } from '~/mcp/types';
 import type { MCPOAuthTokens } from '~/mcp/oauth';
+import { MCPConnectionFactory } from '~/mcp/MCPConnectionFactory';
+import { createOAuthMCPServer } from './helpers/oauthTestServer';
+import { MCPConnection } from '~/mcp/connection';
 
 jest.mock('@librechat/data-schemas', () => ({
   logger: {
@@ -21,6 +21,7 @@ jest.mock('@librechat/data-schemas', () => ({
   },
   encryptV2: jest.fn(async (val: string) => `enc:${val}`),
   decryptV2: jest.fn(async (val: string) => val.replace(/^enc:/, '')),
+  getTenantId: jest.fn(),
 }));
 
 jest.mock('~/auth', () => ({
diff --git a/packages/api/src/mcp/__tests__/MCPOAuthRaceCondition.test.ts b/packages/api/src/mcp/__tests__/MCPOAuthRaceCondition.test.ts
index ae3d055ba3b..fbb682c3cf5 100644
--- a/packages/api/src/mcp/__tests__/MCPOAuthRaceCondition.test.ts
+++ b/packages/api/src/mcp/__tests__/MCPOAuthRaceCondition.test.ts
@@ -36,6 +36,10 @@ jest.mock('~/auth', () => ({
   resolveHostnameSSRF: jest.fn(async () => false),
 }));
 
+jest.mock('~/auth/domain', () => ({
+  isMCPDomainAllowed: jest.fn().mockResolvedValue(true),
+}));
+
 jest.mock('~/mcp/mcpConfig', () => ({
   mcpConfig: { CONNECTION_CHECK_TTL: 0, USER_CONNECTION_IDLE_TIMEOUT: 30 * 60 * 1000 },
 }));
@@ -45,6 +49,7 @@ const mockLogger = logger as jest.Mocked<typeof logger>;
 describe('MCP OAuth Race Condition Fixes', () => {
   afterEach(() => {
     jest.clearAllMocks();
+    jest.restoreAllMocks();
   });
 
   describe('Fix 1: Connection mutex coalesces concurrent attempts', () => {
@@ -77,7 +82,7 @@ describe('MCP OAuth Race Condition Fixes', () => {
         dbId: undefined,
       };
 
-      jest
+      const registrySpy = jest
         .spyOn(
           // eslint-disable-next-line @typescript-eslint/no-require-imports
           require('~/mcp/registry/MCPServersRegistry').MCPServersRegistry,
@@ -88,6 +93,11 @@ describe('MCP OAuth Race Condition Fixes', () => {
           shouldEnableSSRFProtection: jest.fn().mockReturnValue(false),
           getAllowedDomains: jest.fn().mockReturnValue(null),
           getAllowedAddresses: jest.fn().mockReturnValue(null),
+          resolveAllowlists: jest.fn().mockResolvedValue({
+            allowedDomains: null,
+            allowedAddresses: null,
+            useSSRFProtection: false,
+          }),
         });
 
       const { MCPConnectionFactory } = await import('~/mcp/MCPConnectionFactory');
@@ -97,27 +107,223 @@ describe('MCP OAuth Race Condition Fixes', () => {
         return mockConnection as never;
       });
 
-      const store = new MockKeyv();
-      const flowManager = new FlowStateManager(store as unknown as Keyv, { ttl: 30000, ci: true });
-      const user = { id: 'user-1' };
-      const opts = {
-        serverName: 'test-server',
-        user: user as never,
-        flowManager: flowManager as never,
+      try {
+        const store = new MockKeyv();
+        const flowManager = new FlowStateManager(store as unknown as Keyv, {
+          ttl: 30000,
+          ci: true,
+        });
+        const user = { id: 'user-1' };
+        const opts = {
+          serverName: 'test-server',
+          user: user as never,
+          flowManager: flowManager as never,
+        };
+
+        const [conn1, conn2, conn3] = await Promise.all([
+          manager.getUserConnection(opts),
+          manager.getUserConnection(opts),
+          manager.getUserConnection(opts),
+        ]);
+
+        expect(conn1).toBe(conn2);
+        expect(conn2).toBe(conn3);
+        expect(createSpy).toHaveBeenCalledTimes(1);
+        expect(manager.createCallCount).toBe(1);
+      } finally {
+        createSpy.mockRestore();
+        registrySpy.mockRestore();
+      }
+    });
+
+    it('should re-issue the pending OAuth URL when joining an in-flight connection', async () => {
+      const { UserConnectionManager } = await import('~/mcp/UserConnectionManager');
+
+      class TestManager extends UserConnectionManager {}
+
+      const manager = new TestManager();
+
+      const mockConnection = {
+        isConnected: jest.fn().mockResolvedValue(true),
+        disconnect: jest.fn().mockResolvedValue(undefined),
+        isStale: jest.fn().mockReturnValue(false),
+      };
+
+      const mockAppConnections = { has: jest.fn().mockResolvedValue(false) };
+      manager.appConnections = mockAppConnections as never;
+
+      const mockConfig = {
+        type: 'streamable-http',
+        url: 'http://localhost:9999/',
+        updatedAt: undefined,
+        dbId: undefined,
+      };
+
+      const registrySpy = jest
+        .spyOn(
+          // eslint-disable-next-line @typescript-eslint/no-require-imports
+          require('~/mcp/registry/MCPServersRegistry').MCPServersRegistry,
+          'getInstance',
+        )
+        .mockReturnValue({
+          getServerConfig: jest.fn().mockResolvedValue(mockConfig),
+          shouldEnableSSRFProtection: jest.fn().mockReturnValue(false),
+          getAllowedDomains: jest.fn().mockReturnValue(null),
+          getAllowedAddresses: jest.fn().mockReturnValue(null),
+          resolveAllowlists: jest.fn().mockResolvedValue({
+            allowedDomains: null,
+            allowedAddresses: null,
+            useSSRFProtection: false,
+          }),
+        });
+
+      const { MCPConnectionFactory } = await import('~/mcp/MCPConnectionFactory');
+      const createSpy = jest.spyOn(MCPConnectionFactory, 'create').mockImplementation(async () => {
+        await new Promise((r) => setTimeout(r, 100));
+        return mockConnection as never;
+      });
+
+      try {
+        const store = new MockKeyv();
+        const flowManager = new FlowStateManager(store as unknown as Keyv, {
+          ttl: 30000,
+          ci: true,
+        });
+        const user = { id: 'user-oauth' };
+        const serverName = 'test-server';
+        const authorizationUrl = 'https://auth.example.com/existing';
+        await flowManager.initFlow(`${user.id}:${serverName}`, 'mcp_oauth', { authorizationUrl });
+
+        const firstConnection = manager.getUserConnection({
+          serverName,
+          user: user as never,
+          flowManager: flowManager as never,
+        });
+        const oauthStart = jest.fn().mockResolvedValue(undefined);
+        const joinedConnection = manager.getUserConnection({
+          serverName,
+          user: user as never,
+          flowManager: flowManager as never,
+          oauthStart,
+        });
+
+        const [conn1, conn2] = await Promise.all([firstConnection, joinedConnection]);
+
+        expect(conn1).toBe(conn2);
+        expect(oauthStart).toHaveBeenCalledWith(
+          authorizationUrl,
+          expect.objectContaining({ expiresAt: expect.any(Number) }),
+        );
+        expect(createSpy).toHaveBeenCalledTimes(1);
+      } finally {
+        createSpy.mockRestore();
+        registrySpy.mockRestore();
+      }
+    });
+
+    it('should preserve pending OAuth expiry when joining after the prompt was emitted', async () => {
+      const { UserConnectionManager } = await import('~/mcp/UserConnectionManager');
+
+      class TestManager extends UserConnectionManager {}
+
+      const manager = new TestManager();
+
+      const mockConnection = {
+        isConnected: jest.fn().mockResolvedValue(true),
+        disconnect: jest.fn().mockResolvedValue(undefined),
+        isStale: jest.fn().mockReturnValue(false),
       };
 
-      const [conn1, conn2, conn3] = await Promise.all([
-        manager.getUserConnection(opts),
-        manager.getUserConnection(opts),
-        manager.getUserConnection(opts),
-      ]);
+      const mockAppConnections = { has: jest.fn().mockResolvedValue(false) };
+      manager.appConnections = mockAppConnections as never;
 
-      expect(conn1).toBe(conn2);
-      expect(conn2).toBe(conn3);
-      expect(createSpy).toHaveBeenCalledTimes(1);
-      expect(manager.createCallCount).toBe(1);
+      const mockConfig = {
+        type: 'streamable-http',
+        url: 'http://localhost:9999/',
+        requiresOAuth: true,
+        updatedAt: undefined,
+        dbId: undefined,
+      };
 
-      createSpy.mockRestore();
+      const registrySpy = jest
+        .spyOn(
+          // eslint-disable-next-line @typescript-eslint/no-require-imports
+          require('~/mcp/registry/MCPServersRegistry').MCPServersRegistry,
+          'getInstance',
+        )
+        .mockReturnValue({
+          getServerConfig: jest.fn().mockResolvedValue(mockConfig),
+          shouldEnableSSRFProtection: jest.fn().mockReturnValue(false),
+          getAllowedDomains: jest.fn().mockReturnValue(null),
+          getAllowedAddresses: jest.fn().mockReturnValue(null),
+          resolveAllowlists: jest.fn().mockResolvedValue({
+            allowedDomains: null,
+            allowedAddresses: null,
+            useSSRFProtection: false,
+          }),
+        });
+
+      let releaseConnection: () => void = () => undefined;
+      const connectionReleased = new Promise<void>((resolve) => {
+        releaseConnection = resolve;
+      });
+
+      const { MCPConnectionFactory } = await import('~/mcp/MCPConnectionFactory');
+      const authorizationUrl = 'https://auth.example.com/current';
+      const createSpy = jest
+        .spyOn(MCPConnectionFactory, 'create')
+        .mockImplementation(async (_basicOptions, oauthOptions) => {
+          if (oauthOptions && 'oauthStart' in oauthOptions) {
+            await oauthOptions.oauthStart?.(authorizationUrl);
+          }
+          await connectionReleased;
+          return mockConnection as never;
+        });
+
+      try {
+        const store = new MockKeyv();
+        const flowManager = new FlowStateManager(store as unknown as Keyv, {
+          ttl: 30000,
+          ci: true,
+        });
+        const user = { id: 'user-oauth-emitted' };
+        const serverName = 'test-server';
+        await flowManager.initFlow(`${user.id}:${serverName}`, 'mcp_oauth', { authorizationUrl });
+
+        const firstOAuthStart = jest.fn().mockResolvedValue(undefined);
+        const firstConnection = manager.getUserConnection({
+          serverName,
+          user: user as never,
+          flowManager: flowManager as never,
+          oauthStart: firstOAuthStart,
+        });
+        for (let i = 0; i < 20 && firstOAuthStart.mock.calls.length === 0; i++) {
+          await new Promise((resolve) => setTimeout(resolve, 5));
+        }
+        expect(firstOAuthStart).toHaveBeenCalledWith(authorizationUrl, undefined);
+
+        const joinedOAuthStart = jest.fn().mockResolvedValue(undefined);
+        const joinedConnection = manager.getUserConnection({
+          serverName,
+          user: user as never,
+          flowManager: flowManager as never,
+          oauthStart: joinedOAuthStart,
+        });
+
+        releaseConnection();
+        const [conn1, conn2] = await Promise.all([firstConnection, joinedConnection]);
+
+        expect(conn1).toBe(conn2);
+        expect(joinedOAuthStart).toHaveBeenCalledWith(
+          authorizationUrl,
+          expect.objectContaining({ expiresAt: expect.any(Number) }),
+        );
+        expect(createSpy).toHaveBeenCalledTimes(1);
+      } finally {
+        releaseConnection();
+        createSpy.mockRestore();
+        registrySpy.mockRestore();
+      }
     });
 
     it('should not coalesce when forceNew is true', async () => {
@@ -144,7 +350,7 @@ describe('MCP OAuth Race Condition Fixes', () => {
         dbId: undefined,
       };
 
-      jest
+      const registrySpy = jest
         .spyOn(
           // eslint-disable-next-line @typescript-eslint/no-require-imports
           require('~/mcp/registry/MCPServersRegistry').MCPServersRegistry,
@@ -155,36 +361,49 @@ describe('MCP OAuth Race Condition Fixes', () => {
           shouldEnableSSRFProtection: jest.fn().mockReturnValue(false),
           getAllowedDomains: jest.fn().mockReturnValue(null),
           getAllowedAddresses: jest.fn().mockReturnValue(null),
+          resolveAllowlists: jest.fn().mockResolvedValue({
+            allowedDomains: null,
+            allowedAddresses: null,
+            useSSRFProtection: false,
+          }),
         });
 
       const { MCPConnectionFactory } = await import('~/mcp/MCPConnectionFactory');
-      jest.spyOn(MCPConnectionFactory, 'create').mockImplementation(async () => {
+      const createSpy = jest.spyOn(MCPConnectionFactory, 'create').mockImplementation(async () => {
         callCount++;
         await new Promise((r) => setTimeout(r, 50));
         return makeConnection() as never;
       });
 
-      const store = new MockKeyv();
-      const flowManager = new FlowStateManager(store as unknown as Keyv, { ttl: 30000, ci: true });
-      const user = { id: 'user-2' };
-
-      const [conn1, conn2] = await Promise.all([
-        manager.getUserConnection({
-          serverName: 'test-server',
-          forceNew: true,
-          user: user as never,
-          flowManager: flowManager as never,
-        }),
-        manager.getUserConnection({
-          serverName: 'test-server',
-          forceNew: true,
-          user: user as never,
-          flowManager: flowManager as never,
-        }),
-      ]);
-
-      expect(callCount).toBe(2);
-      expect(conn1).not.toBe(conn2);
+      try {
+        const store = new MockKeyv();
+        const flowManager = new FlowStateManager(store as unknown as Keyv, {
+          ttl: 30000,
+          ci: true,
+        });
+        const user = { id: 'user-2' };
+
+        const [conn1, conn2] = await Promise.all([
+          manager.getUserConnection({
+            serverName: 'test-server',
+            forceNew: true,
+            user: user as never,
+            flowManager: flowManager as never,
+          }),
+          manager.getUserConnection({
+            serverName: 'test-server',
+            forceNew: true,
+            user: user as never,
+            flowManager: flowManager as never,
+          }),
+        ]);
+
+        expect(callCount).toBe(2);
+        expect(conn1).not.toBe(conn2);
+      } finally {
+        createSpy.mockRestore();
+        registrySpy.mockRestore();
+      }
     });
   });
 
diff --git a/packages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts b/packages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts
index b5cbc869a8b..dad34d31bef 100644
--- a/packages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts
+++ b/packages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts
@@ -13,11 +13,11 @@
 
 import { Keyv } from 'keyv';
 import { logger } from '@librechat/data-schemas';
-import { FlowStateManager, PENDING_STALE_MS } from '~/flow/manager';
-import { MCPTokenStorage, ReauthenticationRequiredError } from '~/mcp/oauth';
-import { MockKeyv, InMemoryTokenStore, createOAuthMCPServer } from './helpers/oauthTestServer';
 import type { OAuthTestServer } from './helpers/oauthTestServer';
 import type { MCPOAuthTokens } from '~/mcp/oauth';
+import { MockKeyv, InMemoryTokenStore, createOAuthMCPServer } from './helpers/oauthTestServer';
+import { MCPTokenStorage, ReauthenticationRequiredError } from '~/mcp/oauth';
+import { FlowStateManager, PENDING_STALE_MS } from '~/flow/manager';
 
 jest.mock('@librechat/data-schemas', () => ({
   logger: {
@@ -613,10 +613,10 @@ describe('MCP OAuth Token Expiry Scenarios', () => {
         authorizationUrl: 'https://example.com/auth',
       });
 
-      // Manually age the flow to 3 minutes
+      // Manually age the flow past the staleness window
       const state = await flowManager.getFlowState(flowId, 'mcp_oauth');
       if (state) {
-        state.createdAt = Date.now() - 3 * 60 * 1000;
+        state.createdAt = Date.now() - PENDING_STALE_MS - 60 * 1000;
         await (flowStore as unknown as { set: (k: string, v: unknown) => Promise<void> }).set(
           `mcp_oauth:${flowId}`,
           state,
@@ -627,7 +627,7 @@ describe('MCP OAuth Token Expiry Scenarios', () => {
       expect(agedState?.status).toBe('PENDING');
 
       const age = agedState?.createdAt ? Date.now() - agedState.createdAt : 0;
-      expect(age).toBeGreaterThan(2 * 60 * 1000);
+      expect(age).toBeGreaterThan(PENDING_STALE_MS);
 
       // A new flow should be created (the stale one would be deleted + recreated)
       // This verifies our staleness check threshold
diff --git a/packages/api/src/mcp/__tests__/MCPOAuthTokenStorage.test.ts b/packages/api/src/mcp/__tests__/MCPOAuthTokenStorage.test.ts
index a1db56f95db..674350f2b07 100644
--- a/packages/api/src/mcp/__tests__/MCPOAuthTokenStorage.test.ts
+++ b/packages/api/src/mcp/__tests__/MCPOAuthTokenStorage.test.ts
@@ -348,6 +348,7 @@ describe('MCPTokenStorage', () => {
       expect(refreshTokens).toHaveBeenCalledWith(
         'rt',
         expect.objectContaining({ userId: 'u1', serverName: 'srv1' }),
+        undefined,
       );
     });
 
@@ -475,6 +476,7 @@ describe('MCPTokenStorage', () => {
         expect.objectContaining({
           clientInfo: expect.objectContaining({ client_id: 'cid' }),
         }),
+        undefined,
       );
     });
 
@@ -716,6 +718,153 @@ describe('MCPTokenStorage', () => {
     });
   });
 
+  describe('forceRefreshTokens', () => {
+    it('should refresh and store tokens even when access token is not locally expired', async () => {
+      // Access token still has time on the clock (1 hour), but the server has
+      // invalidated it (we simulate a mid-session 401 by calling forceRefreshTokens
+      // directly). The local `expires_at` must be ignored — the 401 is the signal.
+      await store.createToken({
+        userId: 'u1',
+        type: 'mcp_oauth',
+        identifier: 'mcp:srv1',
+        token: 'enc:stale-access-token',
+        expiresIn: 3600,
+      });
+      await store.createToken({
+        userId: 'u1',
+        type: 'mcp_oauth_refresh',
+        identifier: 'mcp:srv1:refresh',
+        token: 'enc:rt',
+        expiresIn: 86400,
+      });
+
+      const refreshTokens = jest.fn().mockResolvedValue({
+        access_token: 'new-access-token',
+        refresh_token: 'new-rt',
+        token_type: 'Bearer',
+        expires_in: 3600,
+        obtained_at: Date.now(),
+      });
+
+      const result = await MCPTokenStorage.forceRefreshTokens({
+        userId: 'u1',
+        serverName: 'srv1',
+        findToken: store.findToken,
+        createToken: store.createToken,
+        updateToken: store.updateToken,
+        deleteTokens: store.deleteTokens,
+        refreshTokens,
+      });
+
+      expect(result).not.toBeNull();
+      expect(result!.access_token).toBe('new-access-token');
+      expect(refreshTokens).toHaveBeenCalledWith(
+        'rt',
+        expect.objectContaining({
+          userId: 'u1',
+          serverName: 'srv1',
+          identifier: 'mcp:srv1',
+        }),
+        undefined,
+      );
+
+      // The new access token is persisted, replacing the stale one.
+      const saved = await store.findToken({
+        userId: 'u1',
+        type: 'mcp_oauth',
+        identifier: 'mcp:srv1',
+      });
+      expect(saved!.token).toBe('enc:new-access-token');
+    });
+
+    it('should return null when no refresh token is stored', async () => {
+      // Access token exists locally, but no refresh token. Silent refresh is
+      // not possible — the caller must fall back to interactive OAuth.
+      await store.createToken({
+        userId: 'u1',
+        type: 'mcp_oauth',
+        identifier: 'mcp:srv1',
+        token: 'enc:any',
+        expiresIn: 3600,
+      });
+
+      const refreshTokens = jest.fn();
+
+      const result = await MCPTokenStorage.forceRefreshTokens({
+        userId: 'u1',
+        serverName: 'srv1',
+        findToken: store.findToken,
+        createToken: store.createToken,
+        refreshTokens,
+      });
+
+      expect(result).toBeNull();
+      expect(refreshTokens).not.toHaveBeenCalled();
+    });
+
+    it('should return null when refresh callback throws non-client-rejection error', async () => {
+      await store.createToken({
+        userId: 'u1',
+        type: 'mcp_oauth_refresh',
+        identifier: 'mcp:srv1:refresh',
+        token: 'enc:rt',
+        expiresIn: 86400,
+      });
+
+      const refreshTokens = jest.fn().mockRejectedValue(new Error('network blew up'));
+
+      const result = await MCPTokenStorage.forceRefreshTokens({
+        userId: 'u1',
+        serverName: 'srv1',
+        findToken: store.findToken,
+        createToken: store.createToken,
+        refreshTokens,
+      });
+
+      expect(result).toBeNull();
+    });
+
+    it('should throw ReauthenticationRequiredError when refresh fails with invalid_client', async () => {
+      // Mirrors the contract that getTokens has on stale client registration —
+      // forceRefreshTokens cleans up the stale state and signals re-auth.
+      await store.createToken({
+        userId: 'u1',
+        type: 'mcp_oauth_refresh',
+        identifier: 'mcp:srv1:refresh',
+        token: 'enc:rt',
+        expiresIn: 86400,
+      });
+      await store.createToken({
+        userId: 'u1',
+        type: 'mcp_oauth_client',
+        identifier: 'mcp:srv1:client',
+        token: 'enc:{"client_id":"cid"}',
+        expiresIn: 86400,
+      });
+
+      const refreshTokens = jest.fn().mockRejectedValue(new Error('invalid_client'));
+
+      await expect(
+        MCPTokenStorage.forceRefreshTokens({
+          userId: 'u1',
+          serverName: 'srv1',
+          findToken: store.findToken,
+          createToken: store.createToken,
+          deleteTokens: store.deleteTokens,
+          refreshTokens,
+        }),
+      ).rejects.toThrow(ReauthenticationRequiredError);
+
+      expect(
+        await store.findToken({
+          userId: 'u1',
+          type: 'mcp_oauth_refresh',
+          identifier: 'mcp:srv1:refresh',
+        }),
+      ).toBeNull();
+    });
+  });
+
   describe('storeTokens + getTokens round-trip', () => {
     it('should store and retrieve tokens with full encrypt/decrypt cycle', async () => {
       await MCPTokenStorage.storeTokens({
diff --git a/packages/api/src/mcp/__tests__/handler.test.ts b/packages/api/src/mcp/__tests__/handler.test.ts
index f285ecfea2c..34c32bfbbbc 100644
--- a/packages/api/src/mcp/__tests__/handler.test.ts
+++ b/packages/api/src/mcp/__tests__/handler.test.ts
@@ -1,6 +1,6 @@
 import { TokenExchangeMethodEnum } from 'librechat-data-provider';
-import type { MCPOptions } from 'librechat-data-provider';
 import type { AuthorizationServerMetadata } from '@modelcontextprotocol/sdk/shared/auth.js';
+import type { MCPOptions } from 'librechat-data-provider';
 import { MCPOAuthFlowMetadata, MCPOAuthHandler, MCPOAuthTokens } from '~/mcp/oauth';
 
 jest.mock('@librechat/data-schemas', () => ({
@@ -83,6 +83,26 @@ describe('MCPOAuthHandler - Configurable OAuth Metadata', () => {
     delete process.env.DOMAIN_SERVER;
   });
 
+  describe('Flow IDs', () => {
+    it('should tenant-scope OAuth flow IDs and parse the owning user', () => {
+      const flowId = MCPOAuthHandler.generateFlowId('user-123', 'test-server', 'tenant/a');
+
+      expect(flowId).toBe('tenant:tenant%2Fa:user-123:test-server');
+      expect(MCPOAuthHandler.parseFlowId(flowId)).toEqual({
+        tenantId: 'tenant/a',
+        userId: 'user-123',
+        serverName: 'test-server',
+      });
+    });
+
+    it('should parse legacy unscoped OAuth flow IDs', () => {
+      expect(MCPOAuthHandler.parseFlowId('user-123:test-server')).toEqual({
+        userId: 'user-123',
+        serverName: 'test-server',
+      });
+    });
+  });
+
   describe('Pre-configured OAuth Metadata Fields', () => {
     const baseConfig: MCPOptions['oauth'] = {
       authorization_url: 'https://auth.example.com/oauth/authorize',
@@ -455,6 +475,79 @@ describe('MCPOAuthHandler - Configurable OAuth Metadata', () => {
         });
       });
 
+      it('should reuse the stored OAuth resource indicator on refresh', async () => {
+        const metadata = {
+          serverName: 'test-server',
+          userId: 'user-123',
+          serverUrl: 'https://api.example.com/mcp',
+          resource: 'https://api.example.com/',
+          clientInfo: {
+            client_id: 'test-client-id',
+            grant_types: ['authorization_code', 'refresh_token'],
+          },
+        };
+
+        mockDiscoverAuthorizationServerMetadata.mockResolvedValueOnce({
+          issuer: 'https://auth.example.com',
+          authorization_endpoint: 'https://auth.example.com/oauth/authorize',
+          token_endpoint: 'https://auth.example.com/oauth/token',
+          token_endpoint_auth_methods_supported: ['none'],
+          response_types_supported: ['code'],
+          jwks_uri: 'https://auth.example.com/.well-known/jwks.json',
+          subject_types_supported: ['public'],
+          id_token_signing_alg_values_supported: ['RS256'],
+        } as AuthorizationServerMetadata);
+
+        mockFetch.mockResolvedValueOnce({
+          ok: true,
+          json: async () => ({
+            access_token: 'new-access-token',
+            expires_in: 3600,
+          }),
+        } as Response);
+
+        await MCPOAuthHandler.refreshOAuthTokens(mockRefreshToken, metadata, {}, {});
+
+        const body = mockFetch.mock.calls[0][1]?.body as URLSearchParams;
+        expect(body.get('resource')).toBe('https://api.example.com/');
+      });
+
+      it('should not invent an OAuth resource indicator when the original flow had none', async () => {
+        const metadata = {
+          serverName: 'test-server',
+          userId: 'user-123',
+          serverUrl: 'https://api.example.com/mcp',
+          clientInfo: {
+            client_id: 'test-client-id',
+            grant_types: ['authorization_code', 'refresh_token'],
+          },
+        };
+
+        mockDiscoverAuthorizationServerMetadata.mockResolvedValueOnce({
+          issuer: 'https://auth.example.com',
+          authorization_endpoint: 'https://auth.example.com/oauth/authorize',
+          token_endpoint: 'https://auth.example.com/oauth/token',
+          token_endpoint_auth_methods_supported: ['none'],
+          response_types_supported: ['code'],
+          jwks_uri: 'https://auth.example.com/.well-known/jwks.json',
+          subject_types_supported: ['public'],
+          id_token_signing_alg_values_supported: ['RS256'],
+        } as AuthorizationServerMetadata);
+
+        mockFetch.mockResolvedValueOnce({
+          ok: true,
+          json: async () => ({
+            access_token: 'new-access-token',
+            expires_in: 3600,
+          }),
+        } as Response);
+
+        await MCPOAuthHandler.refreshOAuthTokens(mockRefreshToken, metadata, {}, {});
+
+        const body = mockFetch.mock.calls[0][1]?.body as URLSearchParams;
+        expect(body.has('resource')).toBe(false);
+      });
+
       it('should use client_secret_basic when server only supports that method', async () => {
         const metadata = {
           serverName: 'test-server',
diff --git a/packages/api/src/mcp/__tests__/helpers/oauthTestServer.ts b/packages/api/src/mcp/__tests__/helpers/oauthTestServer.ts
index 34f968d4e27..453c3600dd1 100644
--- a/packages/api/src/mcp/__tests__/helpers/oauthTestServer.ts
+++ b/packages/api/src/mcp/__tests__/helpers/oauthTestServer.ts
@@ -1,11 +1,12 @@
-import * as http from 'http';
+import { z } from 'zod';
 import * as net from 'net';
+import * as http from 'http';
 import { randomUUID, createHash } from 'crypto';
-import { z } from 'zod';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
-import type { FlowState } from '~/flow/types';
+import type { TokenMethods } from '@librechat/data-schemas';
 import type { Socket } from 'net';
+import type { FlowState } from '~/flow/types';
 
 export class MockKeyv<T = unknown> {
   private store: Map<string, FlowState<T>>;
@@ -61,10 +62,26 @@ export interface OAuthTestServerOptions {
   rotateRefreshTokens?: boolean;
   /** When true, /token validates client_id against the registered client that initiated /authorize */
   enforceClientId?: boolean;
+  /** Scopes attached to newly issued tokens unless the authorization request asks for a scope. */
+  tokenScopes?: string[];
+  /** Scopes required by the protected MCP resource. Missing scopes produce a 403 insufficient_scope challenge. */
+  requiredScopes?: string[];
+  /** Scopes advertised by OAuth Protected Resource Metadata and authorization server metadata. */
+  scopesSupported?: string[];
+  /** When true, /authorize and /token reject requests that omit the MCP resource parameter. */
+  requireResourceParameter?: boolean;
+}
+
+export interface OAuthTokenRequestRecord {
+  grantType: string | null;
+  resource: string | null;
+  scope: string | null;
+  clientId: string | null;
 }
 
 export interface OAuthTestServer {
   url: string;
+  resourceUrl: string;
   port: number;
   close: () => Promise<void>;
   issuedTokens: Set<string>;
@@ -72,6 +89,7 @@ export interface OAuthTestServer {
   tokenIssueTimes: Map<string, number>;
   issuedRefreshTokens: Map<string, string>;
   registeredClients: Map<string, { client_id: string; client_secret: string }>;
+  tokenRequests: OAuthTokenRequestRecord[];
   getAuthCode: () => Promise<string>;
 }
 
@@ -114,20 +132,97 @@ export async function createOAuthMCPServer(
     refreshTokenTTLMs = 365 * 24 * 60 * 60 * 1000,
     rotateRefreshTokens = false,
     enforceClientId = false,
+    tokenScopes = [],
+    requiredScopes = [],
+    scopesSupported = [...new Set([...tokenScopes, ...requiredScopes])],
+    requireResourceParameter = false,
   } = options;
 
   const sessions = new Map<string, StreamableHTTPServerTransport>();
   const issuedTokens = new Set<string>();
   const tokenIssueTimes = new Map<string, number>();
+  const accessTokenScopes = new Map<string, string[]>();
   const issuedRefreshTokens = new Map<string, string>();
   const refreshTokenIssueTimes = new Map<string, number>();
+  const refreshTokenScopes = new Map<string, string[]>();
+  const tokenRequests: OAuthTokenRequestRecord[] = [];
   const authCodes = new Map<
     string,
-    { codeChallenge?: string; codeChallengeMethod?: string; clientId?: string }
+    {
+      codeChallenge?: string;
+      codeChallengeMethod?: string;
+      clientId?: string;
+      resource?: string;
+      scope?: string;
+    }
   >();
   const registeredClients = new Map<string, { client_id: string; client_secret: string }>();
 
   let port = 0;
+  const getBaseUrl = () => `http://127.0.0.1:${port}`;
+  const getResourceUrl = () => `${getBaseUrl()}/`;
+  const getResourceMetadataUrl = () => `${getBaseUrl()}/.well-known/oauth-protected-resource`;
+
+  const parseScopes = (scope: string | null | undefined): string[] => {
+    if (!scope) {
+      return tokenScopes;
+    }
+    return scope.split(/\s+/).filter(Boolean);
+  };
+
+  const writeJson = (res: http.ServerResponse, status: number, payload: unknown): void => {
+    res.writeHead(status, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(payload));
+  };
+
+  const writeBearerChallenge = (
+    res: http.ServerResponse,
+    status: number,
+    error: 'invalid_token' | 'insufficient_scope',
+    description: string,
+  ): void => {
+    let authenticate = `Bearer error="${error}", error_description="${description}", resource_metadata="${getResourceMetadataUrl()}"`;
+    if (requiredScopes.length > 0) {
+      authenticate += `, scope="${requiredScopes.join(' ')}"`;
+    }
+    res.writeHead(status, {
+      'Content-Type': 'application/json',
+      'WWW-Authenticate': authenticate,
+    });
+    res.end(JSON.stringify({ error, error_description: description }));
+  };
+
+  const requireValidResourceParameter = (
+    res: http.ServerResponse,
+    params: URLSearchParams,
+  ): boolean => {
+    if (!requireResourceParameter) {
+      return true;
+    }
+    if (params.get('resource') === getResourceUrl()) {
+      return true;
+    }
+    writeJson(res, 400, {
+      error: 'invalid_target',
+      error_description: 'resource parameter is required for this MCP resource',
+    });
+    return false;
+  };
+
+  const makeTokenResponse = (
+    accessToken: string,
+    scopes: string[],
+  ): Record<string, string | number> => {
+    const tokenResponse: Record<string, string | number> = {
+      access_token: accessToken,
+      token_type: 'Bearer',
+      expires_in: Math.ceil(tokenTTLMs / 1000),
+    };
+    if (scopes.length > 0) {
+      tokenResponse.scope = scopes.join(' ');
+    }
+    return tokenResponse;
+  };
 
   const httpServer = http.createServer(async (req, res) => {
     const url = new URL(req.url ?? '/', `http://${req.headers.host}`);
@@ -136,10 +231,11 @@ export async function createOAuthMCPServer(
       res.writeHead(200, { 'Content-Type': 'application/json' });
       res.end(
         JSON.stringify({
-          issuer: `http://127.0.0.1:${port}`,
-          authorization_endpoint: `http://127.0.0.1:${port}/authorize`,
-          token_endpoint: `http://127.0.0.1:${port}/token`,
-          registration_endpoint: `http://127.0.0.1:${port}/register`,
+          issuer: getBaseUrl(),
+          authorization_endpoint: `${getBaseUrl()}/authorize`,
+          token_endpoint: `${getBaseUrl()}/token`,
+          registration_endpoint: `${getBaseUrl()}/register`,
+          scopes_supported: scopesSupported,
           response_types_supported: ['code'],
           grant_types_supported: issueRefreshTokens
             ? ['authorization_code', 'refresh_token']
@@ -151,6 +247,19 @@ export async function createOAuthMCPServer(
       return;
     }
 
+    if (url.pathname === '/.well-known/oauth-protected-resource' && req.method === 'GET') {
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(
+        JSON.stringify({
+          resource: getResourceUrl(),
+          authorization_servers: [getBaseUrl()],
+          scopes_supported: scopesSupported,
+          bearer_methods_supported: ['header'],
+        }),
+      );
+      return;
+    }
+
     if (url.pathname === '/register' && req.method === 'POST') {
       const body = await readRequestBody(req);
       const data = JSON.parse(body) as { redirect_uris?: string[] };
@@ -169,11 +278,20 @@ export async function createOAuthMCPServer(
     }
 
     if (url.pathname === '/authorize') {
+      if (requireResourceParameter && url.searchParams.get('resource') !== getResourceUrl()) {
+        writeJson(res, 400, {
+          error: 'invalid_target',
+          error_description: 'resource parameter is required for this MCP resource',
+        });
+        return;
+      }
       const code = randomUUID();
       const codeChallenge = url.searchParams.get('code_challenge') ?? undefined;
       const codeChallengeMethod = url.searchParams.get('code_challenge_method') ?? undefined;
       const clientId = url.searchParams.get('client_id') ?? undefined;
-      authCodes.set(code, { codeChallenge, codeChallengeMethod, clientId });
+      const resource = url.searchParams.get('resource') ?? undefined;
+      const scope = url.searchParams.get('scope') ?? undefined;
+      authCodes.set(code, { codeChallenge, codeChallengeMethod, clientId, resource, scope });
       const redirectUri = url.searchParams.get('redirect_uri') ?? '';
       const state = url.searchParams.get('state') ?? '';
       res.writeHead(302, {
@@ -193,6 +311,17 @@ export async function createOAuthMCPServer(
       }
 
       const grantType = params.get('grant_type');
+      tokenRequests.push({
+        grantType,
+        resource: params.get('resource'),
+        scope: params.get('scope'),
+        clientId:
+          params.get('client_id') ?? parseBasicAuth(req.headers.authorization)?.clientId ?? null,
+      });
+
+      if (!requireValidResourceParameter(res, params)) {
+        return;
+      }
 
       if (grantType === 'authorization_code') {
         const code = params.get('code');
@@ -240,19 +369,18 @@ export async function createOAuthMCPServer(
         authCodes.delete(code);
 
         const accessToken = randomUUID();
+        const scopes = parseScopes(codeData.scope);
         issuedTokens.add(accessToken);
         tokenIssueTimes.set(accessToken, Date.now());
+        accessTokenScopes.set(accessToken, scopes);
 
-        const tokenResponse: Record<string, string | number> = {
-          access_token: accessToken,
-          token_type: 'Bearer',
-          expires_in: Math.ceil(tokenTTLMs / 1000),
-        };
+        const tokenResponse = makeTokenResponse(accessToken, scopes);
 
         if (issueRefreshTokens) {
           const refreshToken = randomUUID();
           issuedRefreshTokens.set(refreshToken, accessToken);
           refreshTokenIssueTimes.set(refreshToken, Date.now());
+          refreshTokenScopes.set(refreshToken, scopes);
           tokenResponse.refresh_token = refreshToken;
         }
 
@@ -279,21 +407,23 @@ export async function createOAuthMCPServer(
         }
 
         const newAccessToken = randomUUID();
+        const scopes = params.has('scope')
+          ? parseScopes(params.get('scope'))
+          : (refreshTokenScopes.get(refreshToken) ?? tokenScopes);
         issuedTokens.add(newAccessToken);
         tokenIssueTimes.set(newAccessToken, Date.now());
+        accessTokenScopes.set(newAccessToken, scopes);
 
-        const tokenResponse: Record<string, string | number> = {
-          access_token: newAccessToken,
-          token_type: 'Bearer',
-          expires_in: Math.ceil(tokenTTLMs / 1000),
-        };
+        const tokenResponse = makeTokenResponse(newAccessToken, scopes);
 
         if (rotateRefreshTokens) {
           issuedRefreshTokens.delete(refreshToken);
           refreshTokenIssueTimes.delete(refreshToken);
+          refreshTokenScopes.delete(refreshToken);
           const newRefreshToken = randomUUID();
           issuedRefreshTokens.set(newRefreshToken, newAccessToken);
           refreshTokenIssueTimes.set(newRefreshToken, Date.now());
+          refreshTokenScopes.set(newRefreshToken, scopes);
           tokenResponse.refresh_token = newRefreshToken;
         }
 
@@ -310,15 +440,13 @@ export async function createOAuthMCPServer(
     // All other paths require Bearer token auth
     const authHeader = req.headers.authorization;
     if (!authHeader || !authHeader.startsWith('Bearer ')) {
-      res.writeHead(401, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify({ error: 'invalid_token' }));
+      writeBearerChallenge(res, 401, 'invalid_token', 'Missing Authorization header');
       return;
     }
 
     const token = authHeader.slice(7);
     if (!issuedTokens.has(token)) {
-      res.writeHead(401, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify({ error: 'invalid_token' }));
+      writeBearerChallenge(res, 401, 'invalid_token', 'Token is invalid');
       return;
     }
 
@@ -326,8 +454,15 @@ export async function createOAuthMCPServer(
     if (Date.now() - issueTime > tokenTTLMs) {
       issuedTokens.delete(token);
       tokenIssueTimes.delete(token);
-      res.writeHead(401, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify({ error: 'invalid_token' }));
+      accessTokenScopes.delete(token);
+      writeBearerChallenge(res, 401, 'invalid_token', 'Token has expired');
+      return;
+    }
+
+    const scopes = accessTokenScopes.get(token) ?? [];
+    const hasRequiredScopes = requiredScopes.every((scope) => scopes.includes(scope));
+    if (!hasRequiredScopes) {
+      writeBearerChallenge(res, 403, 'insufficient_scope', 'Insufficient scope');
       return;
     }
 
@@ -360,17 +495,22 @@ export async function createOAuthMCPServer(
 
   return {
     url: `http://127.0.0.1:${port}/`,
+    resourceUrl: `http://127.0.0.1:${port}/`,
     port,
     issuedTokens,
     tokenTTL: tokenTTLMs,
     tokenIssueTimes,
     issuedRefreshTokens,
     registeredClients,
+    tokenRequests,
     getAuthCode: async () => {
-      const authRes = await fetch(
-        `http://127.0.0.1:${port}/authorize?redirect_uri=http://localhost&state=test`,
-        { redirect: 'manual' },
-      );
+      const authUrl = new URL(`${getBaseUrl()}/authorize`);
+      authUrl.searchParams.set('redirect_uri', 'http://localhost');
+      authUrl.searchParams.set('state', 'test');
+      if (requireResourceParameter) {
+        authUrl.searchParams.set('resource', getResourceUrl());
+      }
+      const authRes = await fetch(authUrl, { redirect: 'manual' });
       const location = authRes.headers.get('location') ?? '';
       return new URL(location).searchParams.get('code') ?? '';
     },
@@ -400,7 +540,7 @@ export class InMemoryTokenStore {
     return `${filter.userId}:${filter.type}:${filter.identifier}`;
   }
 
-  findToken = async (filter: {
+  findToken = (async (filter: {
     userId?: string;
     type?: string;
     identifier?: string;
@@ -414,9 +554,9 @@ export class InMemoryTokenStore {
       }
     }
     return null;
-  };
+  }) as unknown as TokenMethods['findToken'];
 
-  createToken = async (data: {
+  createToken = (async (data: {
     userId: string;
     type: string;
     identifier: string;
@@ -436,9 +576,9 @@ export class InMemoryTokenStore {
     };
     this.tokens.set(this.key(data), token);
     return token;
-  };
+  }) as unknown as TokenMethods['createToken'];
 
-  updateToken = async (
+  updateToken = (async (
     filter: { userId?: string; type?: string; identifier?: string },
     data: {
       userId?: string;
@@ -449,7 +589,7 @@ export class InMemoryTokenStore {
       metadata?: Record<string, unknown>;
     },
   ): Promise<InMemoryToken> => {
-    const existing = await this.findToken(filter);
+    const existing = (await this.findToken(filter)) as InMemoryToken | null;
     if (!existing) {
       throw new Error(`Token not found for filter: ${JSON.stringify(filter)}`);
     }
@@ -464,7 +604,7 @@ export class InMemoryTokenStore {
     };
     this.tokens.set(existingKey, updated);
     return updated;
-  };
+  }) as unknown as TokenMethods['updateToken'];
 
   deleteToken = async (filter: {
     userId: string;
@@ -474,7 +614,7 @@ export class InMemoryTokenStore {
     this.tokens.delete(this.key(filter));
   };
 
-  deleteTokens = async (query: {
+  deleteTokens = (async (query: {
     userId?: string;
     type?: string;
     identifier?: string;
@@ -491,7 +631,7 @@ export class InMemoryTokenStore {
       }
     }
     return { acknowledged: true, deletedCount };
-  };
+  }) as unknown as TokenMethods['deleteTokens'];
 
   getAll(): InMemoryToken[] {
     return [...this.tokens.values()];
diff --git a/packages/api/src/mcp/__tests__/mcp.spec.ts b/packages/api/src/mcp/__tests__/mcp.spec.ts
index de2839371da..539c04f6b94 100644
--- a/packages/api/src/mcp/__tests__/mcp.spec.ts
+++ b/packages/api/src/mcp/__tests__/mcp.spec.ts
@@ -1027,6 +1027,44 @@ describe('Environment Variable Extraction (MCP)', () => {
       ]);
     });
 
+    it('should resolve graph tokens in args and oauth fields before processMCPEnv', async () => {
+      const user = createTestUser({
+        id: 'user-args-oauth',
+        provider: 'openid',
+      }) as unknown as IUser;
+
+      const options: MCPOptions = {
+        type: 'stdio',
+        command: 'node',
+        args: ['server.js', '--graph-token={{LIBRECHAT_GRAPH_ACCESS_TOKEN}}'],
+        oauth: {
+          client_id: 'client-id',
+          client_secret: '{{LIBRECHAT_GRAPH_ACCESS_TOKEN}}',
+          scope: 'profile {{LIBRECHAT_GRAPH_ACCESS_TOKEN}}',
+        },
+      };
+
+      const graphProcessedConfig = await preProcessGraphTokens(options, {
+        user,
+        graphTokenResolver: mockGraphTokenResolver,
+      });
+
+      const finalConfig = processMCPEnv({
+        options: graphProcessedConfig,
+        user,
+      });
+
+      expect('args' in finalConfig && finalConfig.args).toEqual([
+        'server.js',
+        '--graph-token=resolved-graph-api-token',
+      ]);
+      expect(finalConfig.oauth).toEqual({
+        client_id: 'client-id',
+        client_secret: 'resolved-graph-api-token',
+        scope: 'profile resolved-graph-api-token',
+      });
+    });
+
     it('should resolve graph tokens in URL alongside other placeholders', async () => {
       const user = createTestUser({
         id: 'user-789',
diff --git a/packages/api/src/mcp/__tests__/request.test.ts b/packages/api/src/mcp/__tests__/request.test.ts
new file mode 100644
index 00000000000..218c69f011a
--- /dev/null
+++ b/packages/api/src/mcp/__tests__/request.test.ts
@@ -0,0 +1,82 @@
+import { EventEmitter } from 'events';
+
+import { getMCPRequestContext, cleanupMCPRequestContextForReq } from '~/mcp/request';
+
+jest.mock('@librechat/data-schemas', () => ({
+  logger: {
+    warn: jest.fn(),
+  },
+}));
+
+function createResponse({ ended = false } = {}): EventEmitter & {
+  writableEnded: boolean;
+  finished: boolean;
+  destroyed: boolean;
+} {
+  const res = new EventEmitter() as EventEmitter & {
+    writableEnded: boolean;
+    finished: boolean;
+    destroyed: boolean;
+  };
+  res.writableEnded = ended;
+  res.finished = ended;
+  res.destroyed = false;
+  return res;
+}
+
+function nextTick(): Promise<void> {
+  return new Promise((resolve) => setImmediate(resolve));
+}
+
+describe('MCP request context', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('does not create a response-scoped context after the response has finished', () => {
+    const req = {};
+    const res = createResponse({ ended: true });
+
+    expect(getMCPRequestContext(req, res)).toBeUndefined();
+  });
+
+  it('keeps job-scoped contexts alive after response finish until explicit cleanup', async () => {
+    const req = {};
+    const res = createResponse();
+    const context = getMCPRequestContext(req, undefined, { cleanupOnResponse: false });
+    const disconnect = jest.fn().mockResolvedValue(undefined);
+    context?.connections.set('server', { disconnect });
+
+    expect(getMCPRequestContext(req, res)).toBe(context);
+
+    res.emit('finish');
+    await nextTick();
+
+    expect(disconnect).not.toHaveBeenCalled();
+
+    await cleanupMCPRequestContextForReq(req);
+
+    expect(disconnect).toHaveBeenCalledTimes(1);
+    expect(context?.connections.size).toBe(0);
+    expect(context?.pending.size).toBe(0);
+  });
+
+  it('cleans response-scoped contexts when the response finishes', async () => {
+    const req = {};
+    const res = createResponse();
+    const context = getMCPRequestContext(req, res);
+    const disconnect = jest.fn().mockResolvedValue(undefined);
+    const pendingDisconnect = jest.fn().mockResolvedValue(undefined);
+
+    context?.connections.set('server', { disconnect });
+    context?.pending.set('pending-server', Promise.resolve({ disconnect: pendingDisconnect }));
+
+    res.emit('finish');
+    await nextTick();
+
+    expect(disconnect).toHaveBeenCalledTimes(1);
+    expect(pendingDisconnect).toHaveBeenCalledTimes(1);
+    expect(context?.connections.size).toBe(0);
+    expect(context?.pending.size).toBe(0);
+  });
+});
diff --git a/packages/api/src/mcp/__tests__/utils.test.ts b/packages/api/src/mcp/__tests__/utils.test.ts
index c40273440d3..cbed141d0f4 100644
--- a/packages/api/src/mcp/__tests__/utils.test.ts
+++ b/packages/api/src/mcp/__tests__/utils.test.ts
@@ -1,3 +1,4 @@
+import type { ParsedServerConfig } from '~/mcp/types';
 import {
   buildOAuthToolCallName,
   normalizeServerName,
@@ -8,9 +9,14 @@ import {
   isClientRejectionMessage,
   getMissingCustomUserVars,
   hasCustomUserVars,
+  hasRuntimeUrlPlaceholders,
+  hasRuntimeBodyPlaceholders,
+  hasRuntimeContextPlaceholders,
+  getRuntimeBodyPlaceholderFields,
+  getMissingRuntimeBodyPlaceholderFields,
   isUserSourced,
+  requiresEphemeralUserConnection,
 } from '~/mcp/utils';
-import type { ParsedServerConfig } from '~/mcp/types';
 
 describe('normalizeServerName', () => {
   it('should not modify server names that already match the pattern', () => {
@@ -230,13 +236,93 @@ describe('redactServerSecrets', () => {
     expect(redacted.customUserVars).toEqual(config.customUserVars);
   });
 
-  it('should pass URLs through unchanged', () => {
+  it('should pass URLs through unchanged when caller has edit authority', () => {
+    const config: ParsedServerConfig = {
+      type: 'sse',
+      url: 'https://infra.internal/mcp',
+      source: 'config',
+    };
+    const redacted = redactServerSecrets(config, { canEdit: true });
+    expect(redacted.url).toBe('https://infra.internal/mcp');
+  });
+
+  it('should strip url and oauth flow URLs for non-user-sourced configs without edit authority', () => {
+    const config: ParsedServerConfig = {
+      type: 'sse',
+      url: 'https://infra.internal/mcp',
+      source: 'config',
+      oauth: {
+        client_id: 'cid',
+        authorization_url: 'https://infra.internal/oauth/authorize',
+        token_url: 'https://infra.internal/oauth/token',
+        revocation_endpoint: 'https://infra.internal/oauth/revoke',
+        scope: 'read',
+      },
+    };
+    const redacted = redactServerSecrets(config);
+    expect(redacted.url).toBeUndefined();
+    expect(redacted.oauth?.authorization_url).toBeUndefined();
+    expect(redacted.oauth?.token_url).toBeUndefined();
+    expect(redacted.oauth?.revocation_endpoint).toBeUndefined();
+    expect(redacted.oauth?.client_id).toBe('cid');
+    expect(redacted.oauth?.scope).toBe('read');
+  });
+
+  it('should strip url for a VIEW-shared user-sourced config when caller lacks edit', () => {
+    const config: ParsedServerConfig = {
+      type: 'sse',
+      url: 'https://owner-private.example.com/mcp',
+      source: 'user',
+      dbId: 'abc123',
+      oauth: {
+        client_id: 'cid',
+        authorization_url: 'https://owner-private.example.com/oauth/authorize',
+        token_url: 'https://owner-private.example.com/oauth/token',
+      },
+    };
+    const redacted = redactServerSecrets(config);
+    expect(redacted.url).toBeUndefined();
+    expect(redacted.oauth?.authorization_url).toBeUndefined();
+    expect(redacted.oauth?.token_url).toBeUndefined();
+    expect(redacted.oauth?.client_id).toBe('cid');
+  });
+
+  it('should retain non-sensitive oauth fields when stripping oauth flow URLs', () => {
     const config: ParsedServerConfig = {
       type: 'sse',
-      url: 'https://mcp.example.com/sse?param=value',
+      url: 'https://infra.internal/mcp',
+      source: 'config',
+      oauth: {
+        client_id: 'cid',
+        client_secret: 'csecret',
+        authorization_url: 'https://infra.internal/oauth/authorize',
+        token_url: 'https://infra.internal/oauth/token',
+        scope: 'read',
+        redirect_uri: 'https://app.example.com/callback',
+      },
     };
     const redacted = redactServerSecrets(config);
-    expect(redacted.url).toBe('https://mcp.example.com/sse?param=value');
+    expect(redacted.oauth?.client_secret).toBeUndefined();
+    expect(redacted.oauth?.authorization_url).toBeUndefined();
+    expect(redacted.oauth?.token_url).toBeUndefined();
+    expect(redacted.oauth?.client_id).toBe('cid');
+    expect(redacted.oauth?.scope).toBe('read');
+    expect(redacted.oauth?.redirect_uri).toBe('https://app.example.com/callback');
+  });
+
+  it('should preserve customUserVars metadata for non-user-sourced configs without edit authority', () => {
+    const config: ParsedServerConfig = {
+      type: 'sse',
+      url: 'https://infra.internal/mcp',
+      source: 'config',
+      customUserVars: {
+        API_KEY: { title: 'API Key', description: 'Your key', sensitive: true },
+      },
+    };
+    const redacted = redactServerSecrets(config);
+    expect(redacted.customUserVars).toEqual({
+      API_KEY: { title: 'API Key', description: 'Your key', sensitive: true },
+    });
   });
 
   it('should only include explicitly allowlisted fields', () => {
@@ -289,6 +375,55 @@ describe('redactAllServerSecrets', () => {
     expect(redacted['server-b'].oauth?.client_id).toBe('cid-b');
     expect((redacted['server-c'] as Record<string, unknown>).command).toBeUndefined();
   });
+
+  it('should pass canEdit through per-server via canEditByServer map', () => {
+    const configs: Record<string, ParsedServerConfig> = {
+      'config-server': {
+        type: 'sse',
+        url: 'https://infra.internal/mcp',
+        source: 'config',
+        oauth: {
+          client_id: 'cid',
+          authorization_url: 'https://infra.internal/oauth/authorize',
+        },
+      },
+      'user-server-owner': {
+        type: 'sse',
+        url: 'https://owner.example.com/mcp',
+        source: 'user',
+        dbId: 'owner-id',
+      },
+      'user-server-shared': {
+        type: 'sse',
+        url: 'https://shared.example.com/mcp',
+        source: 'user',
+        dbId: 'shared-id',
+      },
+    };
+    const canEditByServer = new Map<string, boolean>([
+      ['config-server', false],
+      ['user-server-owner', true],
+      ['user-server-shared', false],
+    ]);
+    const redacted = redactAllServerSecrets(configs, { canEditByServer });
+    expect(redacted['config-server'].url).toBeUndefined();
+    expect(redacted['config-server'].oauth?.authorization_url).toBeUndefined();
+    expect(redacted['user-server-owner'].url).toBe('https://owner.example.com/mcp');
+    expect(redacted['user-server-shared'].url).toBeUndefined();
+  });
+
+  it('should expose URL for non-user-sourced configs when canEditByServer is true', () => {
+    const configs: Record<string, ParsedServerConfig> = {
+      'config-server': {
+        type: 'sse',
+        url: 'https://infra.internal/mcp',
+        source: 'config',
+      },
+    };
+    const canEditByServer = new Map<string, boolean>([['config-server', true]]);
+    const redacted = redactAllServerSecrets(configs, { canEditByServer });
+    expect(redacted['config-server'].url).toBe('https://infra.internal/mcp');
+  });
 });
 
 describe('isInvalidClientMessage', () => {
@@ -378,6 +513,29 @@ describe('requiresUserScopedConnection', () => {
     ).toBe(true);
   });
 
+  it('returns true for trusted config with runtime user placeholders', () => {
+    expect(
+      requiresUserScopedConnection({
+        source: 'yaml',
+        headers: {
+          'X-LibreChat-User-Email': '{{LIBRECHAT_USER_EMAIL}}',
+        },
+      }),
+    ).toBe(true);
+  });
+
+  it('returns false for user-sourced config with runtime user placeholders', () => {
+    expect(
+      requiresUserScopedConnection({
+        source: 'user',
+        dbId: 'server-123',
+        headers: {
+          'X-LibreChat-User-Email': '{{LIBRECHAT_USER_EMAIL}}',
+        },
+      }),
+    ).toBe(false);
+  });
+
   it('returns false for app-shareable servers', () => {
     expect(
       requiresUserScopedConnection({
@@ -388,6 +546,208 @@ describe('requiresUserScopedConnection', () => {
   });
 });
 
+describe('hasRuntimeContextPlaceholders', () => {
+  it('detects trusted runtime placeholders across connection fields', () => {
+    expect(
+      hasRuntimeContextPlaceholders({
+        source: 'config',
+        url: 'https://example.com/{{LIBRECHAT_BODY_MESSAGEID}}/mcp',
+        headers: {
+          Authorization: 'Bearer {{LIBRECHAT_OPENID_ID_TOKEN}}',
+          'X-Graph-Access-Token': '{{LIBRECHAT_GRAPH_ACCESS_TOKEN}}',
+        },
+      }),
+    ).toBe(true);
+  });
+
+  it('detects trusted runtime placeholders in oauth_headers', () => {
+    expect(
+      hasRuntimeContextPlaceholders({
+        source: 'yaml',
+        url: 'https://example.com/mcp',
+        oauth_headers: {
+          'X-User': '{{LIBRECHAT_USER_ID}}',
+        },
+      }),
+    ).toBe(true);
+  });
+
+  it('ignores custom user variable placeholders', () => {
+    expect(
+      hasRuntimeContextPlaceholders({
+        source: 'yaml',
+        headers: {
+          Authorization: 'Bearer {{MCP_API_KEY}}',
+        },
+      }),
+    ).toBe(false);
+  });
+
+  it('ignores runtime placeholders in user-sourced configs', () => {
+    expect(
+      hasRuntimeContextPlaceholders({
+        source: 'user',
+        dbId: 'server-123',
+        headers: {
+          Authorization: 'Bearer {{LIBRECHAT_OPENID_ID_TOKEN}}',
+        },
+      }),
+    ).toBe(false);
+  });
+});
+
+describe('hasRuntimeUrlPlaceholders', () => {
+  it('detects trusted runtime placeholders in the server URL', () => {
+    expect(
+      hasRuntimeUrlPlaceholders({
+        source: 'yaml',
+        url: 'https://example.com/users/{{LIBRECHAT_USER_USERNAME}}/mcp',
+      }),
+    ).toBe(true);
+  });
+
+  it('ignores runtime URL placeholders in user-sourced configs', () => {
+    expect(
+      hasRuntimeUrlPlaceholders({
+        source: 'user',
+        dbId: 'server-123',
+        url: 'https://example.com/users/{{LIBRECHAT_USER_USERNAME}}/mcp',
+      }),
+    ).toBe(false);
+  });
+});
+
+describe('hasRuntimeBodyPlaceholders', () => {
+  it('detects trusted runtime BODY placeholders across connection fields', () => {
+    expect(
+      hasRuntimeBodyPlaceholders({
+        source: 'yaml',
+        url: 'https://example.com/conversations/{{LIBRECHAT_BODY_CONVERSATIONID}}/mcp',
+      }),
+    ).toBe(true);
+
+    expect(
+      hasRuntimeBodyPlaceholders({
+        source: 'config',
+        headers: {
+          'X-Message': '{{LIBRECHAT_BODY_MESSAGEID}}',
+        },
+      }),
+    ).toBe(true);
+  });
+
+  it('ignores BODY placeholders in user-sourced configs', () => {
+    expect(
+      hasRuntimeBodyPlaceholders({
+        source: 'user',
+        dbId: 'server-123',
+        url: 'https://example.com/{{LIBRECHAT_BODY_MESSAGEID}}/mcp',
+      }),
+    ).toBe(false);
+  });
+});
+
+describe('getMissingRuntimeBodyPlaceholderFields', () => {
+  const config = {
+    source: 'yaml',
+    url: 'https://example.com/conversations/{{LIBRECHAT_BODY_CONVERSATIONID}}/mcp',
+    headers: {
+      'X-Message': '{{LIBRECHAT_BODY_MESSAGEID}}',
+      'X-Parent': '{{LIBRECHAT_BODY_PARENTMESSAGEID}}',
+    },
+  } as const;
+
+  it('returns the request body fields required by trusted runtime placeholders', () => {
+    expect(getRuntimeBodyPlaceholderFields(config)).toEqual([
+      'messageId',
+      'parentMessageId',
+      'conversationId',
+    ]);
+  });
+
+  it('returns missing or blank request body fields', () => {
+    expect(
+      getMissingRuntimeBodyPlaceholderFields(config, {
+        conversationId: 'conv-123',
+        messageId: ' ',
+      }),
+    ).toEqual(['messageId', 'parentMessageId']);
+  });
+
+  it('ignores BODY placeholders in user-sourced configs', () => {
+    expect(
+      getMissingRuntimeBodyPlaceholderFields({
+        source: 'user',
+        dbId: 'server-123',
+        url: 'https://example.com/{{LIBRECHAT_BODY_MESSAGEID}}/mcp',
+      }),
+    ).toEqual([]);
+  });
+});
+
+describe('requiresEphemeralUserConnection', () => {
+  it('returns true when BODY placeholders affect oauth_headers', () => {
+    expect(
+      requiresEphemeralUserConnection({
+        source: 'yaml',
+        url: 'https://example.com/mcp',
+        oauth_headers: {
+          'X-Message': '{{LIBRECHAT_BODY_MESSAGEID}}',
+        },
+      }),
+    ).toBe(true);
+  });
+
+  it('returns true when BODY placeholders affect connection fields', () => {
+    expect(
+      requiresEphemeralUserConnection({
+        source: 'yaml',
+        url: 'https://example.com/messages/{{LIBRECHAT_BODY_MESSAGEID}}/mcp',
+      }),
+    ).toBe(true);
+  });
+
+  it('does not treat Graph placeholders as request-scoped by themselves', () => {
+    expect(
+      requiresEphemeralUserConnection({
+        source: 'config',
+        env: {
+          GRAPH_TOKEN: '{{LIBRECHAT_GRAPH_ACCESS_TOKEN}}',
+        },
+      }),
+    ).toBe(false);
+  });
+
+  it('does not treat OpenID token placeholders as request-scoped by themselves', () => {
+    expect(
+      requiresEphemeralUserConnection({
+        source: 'yaml',
+        args: ['--id-token={{LIBRECHAT_OPENID_ID_TOKEN}}'],
+      }),
+    ).toBe(false);
+
+    expect(
+      requiresEphemeralUserConnection({
+        source: 'yaml',
+        headers: {
+          Authorization: 'Bearer {{LIBRECHAT_OPENID_ACCESS_TOKEN}}',
+        },
+      }),
+    ).toBe(false);
+  });
+
+  it('returns true when BODY placeholders affect remote transport headers', () => {
+    expect(
+      requiresEphemeralUserConnection({
+        source: 'yaml',
+        headers: {
+          'X-Message': '{{LIBRECHAT_BODY_MESSAGEID}}',
+        },
+      }),
+    ).toBe(true);
+  });
+});
+
 describe('getMissingCustomUserVars', () => {
   const configWithVars = (keys: string[]): Pick<ParsedServerConfig, 'customUserVars'> => ({
     customUserVars: Object.fromEntries(
diff --git a/packages/api/src/mcp/__tests__/zod.spec.ts b/packages/api/src/mcp/__tests__/zod.spec.ts
index 684b6de975b..5c948c388dd 100644
--- a/packages/api/src/mcp/__tests__/zod.spec.ts
+++ b/packages/api/src/mcp/__tests__/zod.spec.ts
@@ -7,6 +7,7 @@ import {
   convertJsonSchemaToZod,
   resolveJsonSchemaRefs,
   normalizeJsonSchema,
+  sanitizeGeminiSchema,
 } from '../zod';
 
 describe('convertJsonSchemaToZod', () => {
@@ -2361,3 +2362,352 @@ describe('normalizeJsonSchema', () => {
     expect(result.properties.origin).toEqual({ type: 'string', description: 'Starting address' });
   });
 });
+
+describe('sanitizeGeminiSchema', () => {
+  it('collapses a multi-member anyOf to its first member', () => {
+    const schema = {
+      anyOf: [
+        { type: 'string', description: 'a string' },
+        { type: 'number', description: 'a number' },
+      ],
+    } as any;
+
+    const result = sanitizeGeminiSchema(schema);
+    expect(result).toEqual({ type: 'string', description: 'a string' });
+    expect(result).not.toHaveProperty('anyOf');
+  });
+
+  it('collapses oneOf the same way as anyOf', () => {
+    const schema = {
+      oneOf: [{ type: 'integer' }, { type: 'boolean' }],
+    } as any;
+
+    expect(sanitizeGeminiSchema(schema)).toEqual({ type: 'integer' });
+  });
+
+  it('preserves sibling keys and lets the chosen member override them', () => {
+    const schema = {
+      title: 'field',
+      description: 'parent description',
+      anyOf: [
+        {
+          type: 'object',
+          description: 'member description',
+          properties: { id: { type: 'string' } },
+        },
+        { type: 'string' },
+      ],
+    } as any;
+
+    expect(sanitizeGeminiSchema(schema)).toEqual({
+      title: 'field',
+      description: 'member description',
+      type: 'object',
+      properties: { id: { type: 'string' } },
+    });
+  });
+
+  it('marks the field nullable when a null member is dropped from a union', () => {
+    const schema = {
+      anyOf: [{ type: 'string' }, { type: 'null' }],
+    } as any;
+
+    expect(sanitizeGeminiSchema(schema)).toEqual({ type: 'string', nullable: true });
+  });
+
+  it('handles a 3-member union that includes null (google-common would throw on this)', () => {
+    const schema = {
+      anyOf: [{ type: 'string' }, { type: 'number' }, { type: 'null' }],
+    } as any;
+
+    expect(sanitizeGeminiSchema(schema)).toEqual({ type: 'string', nullable: true });
+  });
+
+  it('collapses a nested union introduced by the chosen member', () => {
+    const schema = {
+      anyOf: [{ anyOf: [{ type: 'string' }, { type: 'number' }] }, { type: 'boolean' }],
+    } as any;
+
+    expect(sanitizeGeminiSchema(schema)).toEqual({ type: 'string' });
+  });
+
+  it('collapses multi-entry type arrays', () => {
+    expect(sanitizeGeminiSchema({ type: ['string', 'number'] } as any)).toEqual({
+      type: 'string',
+    });
+  });
+
+  it('collapses a nullable type array to a single type plus nullable', () => {
+    expect(sanitizeGeminiSchema({ type: ['string', 'null'] } as any)).toEqual({
+      type: 'string',
+      nullable: true,
+    });
+  });
+
+  it('flattens unions nested inside object properties and array items', () => {
+    const schema = {
+      type: 'object',
+      properties: {
+        owner: { anyOf: [{ type: 'string' }, { type: 'object', properties: {} }] },
+        labels: {
+          type: 'array',
+          items: { oneOf: [{ type: 'string' }, { type: 'object' }] },
+        },
+        plain: { type: 'string', description: 'untouched' },
+      },
+      required: ['owner'],
+    } as any;
+
+    const result = sanitizeGeminiSchema(schema);
+    expect(result.properties.owner).toEqual({ type: 'string' });
+    expect(result.properties.labels.items).toEqual({ type: 'string' });
+    expect(result.properties.plain).toEqual({ type: 'string', description: 'untouched' });
+    expect(result.required).toEqual(['owner']);
+  });
+
+  it('flattens a discriminated-union MCP tool schema (GitHub issue_write pattern)', () => {
+    const schema = {
+      type: 'object',
+      properties: {
+        method: {
+          anyOf: [
+            {
+              type: 'object',
+              properties: { action: { const: 'create' }, title: { type: 'string' } },
+              required: ['action', 'title'],
+            },
+            {
+              type: 'object',
+              properties: { action: { const: 'update' }, issue_number: { type: 'number' } },
+              required: ['action', 'issue_number'],
+            },
+          ],
+        },
+      },
+    } as any;
+
+    const result = sanitizeGeminiSchema(schema);
+    expect(result.properties.method).toEqual({
+      type: 'object',
+      properties: { action: { type: 'string', enum: ['create'] }, title: { type: 'string' } },
+      required: ['action', 'title'],
+    });
+    expect(result.properties.method).not.toHaveProperty('anyOf');
+  });
+
+  it('is a no-op for schemas without unions', () => {
+    const schema = {
+      type: 'object',
+      properties: {
+        name: { type: 'string', description: 'Name' },
+        age: { type: 'number' },
+        tags: { type: 'array', items: { type: 'string' } },
+      },
+      required: ['name'],
+    } as any;
+
+    expect(sanitizeGeminiSchema(schema)).toEqual(schema);
+  });
+
+  it('handles null, undefined, and primitive inputs safely', () => {
+    expect(sanitizeGeminiSchema(null as any)).toBeNull();
+    expect(sanitizeGeminiSchema(undefined as any)).toBeUndefined();
+    expect(sanitizeGeminiSchema('string' as any)).toBe('string');
+    expect(sanitizeGeminiSchema(42 as any)).toBe(42);
+  });
+
+  it('leaves no anyOf/oneOf/multi-type keys for google-common to reject', () => {
+    const schema = {
+      type: 'object',
+      properties: {
+        a: { anyOf: [{ type: 'string' }, { type: 'number' }] },
+        b: { type: ['boolean', 'null'] },
+        c: { oneOf: [{ type: 'object', properties: { x: { type: 'string' } } }, { type: 'null' }] },
+      },
+    } as any;
+
+    const json = JSON.stringify(sanitizeGeminiSchema(schema));
+    expect(json).not.toContain('"anyOf"');
+    expect(json).not.toContain('"oneOf"');
+    expect(sanitizeGeminiSchema(schema).properties.b).toEqual({
+      type: 'boolean',
+      nullable: true,
+    });
+  });
+
+  it('preserves parent properties and required outside the union when collapsing', () => {
+    const schema = {
+      type: 'object',
+      properties: { repo: { type: 'string' } },
+      required: ['repo'],
+      anyOf: [
+        { properties: { title: { type: 'string' } }, required: ['title'] },
+        { properties: { body: { type: 'string' } }, required: ['body'] },
+      ],
+    } as any;
+
+    const result = sanitizeGeminiSchema(schema);
+    expect(result.type).toBe('object');
+    expect(result.properties).toEqual({
+      repo: { type: 'string' },
+      title: { type: 'string' },
+    });
+    expect([...result.required].sort()).toEqual(['repo', 'title']);
+    expect(result).not.toHaveProperty('anyOf');
+  });
+
+  it('merges nested object properties from parent and chosen branch', () => {
+    const schema = {
+      type: 'object',
+      properties: { owner: { type: 'string' } },
+      oneOf: [
+        { type: 'object', properties: { sha: { type: 'string' } } },
+        { type: 'object', properties: { ref: { type: 'string' } } },
+      ],
+    } as any;
+
+    expect(sanitizeGeminiSchema(schema).properties).toEqual({
+      owner: { type: 'string' },
+      sha: { type: 'string' },
+    });
+  });
+
+  it('strips the dropped null from enum when a type array is nullable', () => {
+    const schema = { type: ['string', 'null'], enum: ['open', 'closed', null] } as any;
+    expect(sanitizeGeminiSchema(schema)).toEqual({
+      type: 'string',
+      nullable: true,
+      enum: ['open', 'closed'],
+    });
+  });
+
+  it('strips null from enum when nullability comes from a union member', () => {
+    const schema = {
+      anyOf: [{ type: 'string', enum: ['a', 'b', null] }, { type: 'null' }],
+    } as any;
+
+    const result = sanitizeGeminiSchema(schema);
+    expect(result.type).toBe('string');
+    expect(result.nullable).toBe(true);
+    expect(result.enum).toEqual(['a', 'b']);
+  });
+
+  it('keeps enum untouched when the field is not nullable', () => {
+    const schema = { type: ['string', 'number'], enum: ['a', 'b'] } as any;
+    expect(sanitizeGeminiSchema(schema)).toEqual({ type: 'string', enum: ['a', 'b'] });
+  });
+
+  it('drops a boolean enum that Gemini rejects (the reported 400), keeping the type', () => {
+    const schema = { type: 'boolean', enum: [true, false] } as any;
+    expect(sanitizeGeminiSchema(schema)).toEqual({ type: 'boolean' });
+  });
+
+  it('drops a boolean enum produced by normalizeJsonSchema const→enum', () => {
+    // normalizeJsonSchema turns `const: true` into `enum: [true]`; Gemini rejects it.
+    const schema = normalizeJsonSchema({ type: 'boolean', const: true } as any);
+    expect(sanitizeGeminiSchema(schema as any)).toEqual({ type: 'boolean' });
+  });
+
+  it('resolves the reported failing shape: boolean enum inside array→items→object', () => {
+    // tools[0].function_declarations[N].parameters.properties[k].items.properties[0].enum[0] = true
+    const schema = {
+      type: 'object',
+      properties: {
+        rows: {
+          type: 'array',
+          items: {
+            type: 'object',
+            properties: {
+              active: { type: 'boolean', enum: [true, false] },
+              name: { type: 'string' },
+            },
+          },
+        },
+      },
+    } as any;
+
+    const result = sanitizeGeminiSchema(schema);
+    expect(result.properties.rows.items.properties.active).toEqual({ type: 'boolean' });
+    expect(JSON.stringify(result)).not.toContain('"enum"');
+  });
+
+  it('filters non-string members out of a mixed string enum', () => {
+    const schema = { type: 'string', enum: ['a', 1, true, 'b', null] } as any;
+    expect(sanitizeGeminiSchema(schema)).toEqual({ type: 'string', enum: ['a', 'b'] });
+  });
+
+  it('strips unsupported keywords (additionalProperties, default, $schema)', () => {
+    const schema = {
+      $schema: 'http://json-schema.org/draft-07/schema#',
+      type: 'object',
+      additionalProperties: { type: 'string' },
+      properties: {
+        name: { type: 'string', default: 'anon' },
+      },
+    } as any;
+
+    const result = sanitizeGeminiSchema(schema);
+    expect(result).not.toHaveProperty('$schema');
+    expect(result).not.toHaveProperty('additionalProperties');
+    expect(result.properties.name).toEqual({ type: 'string' });
+  });
+
+  it('folds exclusive bounds into inclusive minimum/maximum', () => {
+    const schema = { type: 'number', exclusiveMinimum: 0, exclusiveMaximum: 100 } as any;
+    expect(sanitizeGeminiSchema(schema)).toEqual({ type: 'number', minimum: 0, maximum: 100 });
+  });
+
+  it('does not overwrite an existing minimum with an exclusive bound', () => {
+    const schema = { type: 'number', minimum: 5, exclusiveMinimum: 0 } as any;
+    expect(sanitizeGeminiSchema(schema)).toEqual({ type: 'number', minimum: 5 });
+  });
+
+  it('merges allOf intersections into a single object', () => {
+    const schema = {
+      allOf: [
+        { type: 'object', properties: { a: { type: 'string' } }, required: ['a'] },
+        { type: 'object', properties: { b: { type: 'number' } }, required: ['b'] },
+      ],
+    } as any;
+
+    const result = sanitizeGeminiSchema(schema);
+    expect(result.type).toBe('object');
+    expect(result.properties).toEqual({ a: { type: 'string' }, b: { type: 'number' } });
+    expect([...result.required].sort()).toEqual(['a', 'b']);
+    expect(result).not.toHaveProperty('allOf');
+  });
+
+  it('leaves a clean Gemini-ready schema unchanged', () => {
+    const schema = {
+      type: 'object',
+      properties: {
+        owner: { type: 'string', description: 'Repo owner' },
+        side: { type: 'string', enum: ['LEFT', 'RIGHT'] },
+        line: { type: 'number' },
+      },
+      required: ['owner'],
+    } as any;
+
+    expect(sanitizeGeminiSchema(schema)).toEqual(schema);
+  });
+
+  it('drops the enum when a mixed type array collapses to a non-string type', () => {
+    const schema = { type: ['integer', 'string'], enum: [1, 'auto'] } as any;
+    expect(sanitizeGeminiSchema(schema)).toEqual({ type: 'integer' });
+  });
+
+  it('keeps the enum when a mixed type array collapses to string', () => {
+    const schema = { type: ['string', 'integer'], enum: ['auto', 1] } as any;
+    expect(sanitizeGeminiSchema(schema)).toEqual({ type: 'string', enum: ['auto'] });
+  });
+
+  it('makes a typeless surviving enum a string type (Gemini enum requires Type.STRING)', () => {
+    const schema = { enum: ['a', 'b'] } as any;
+    expect(sanitizeGeminiSchema(schema)).toEqual({ type: 'string', enum: ['a', 'b'] });
+  });
+
+  it('drops a number enum on an integer field', () => {
+    const schema = { type: 'integer', enum: [1, 2, 3] } as any;
+    expect(sanitizeGeminiSchema(schema)).toEqual({ type: 'integer' });
+  });
+});
diff --git a/packages/api/src/mcp/auth.ts b/packages/api/src/mcp/auth.ts
index e10c16b4b8f..b25e0ce8ee2 100644
--- a/packages/api/src/mcp/auth.ts
+++ b/packages/api/src/mcp/auth.ts
@@ -16,7 +16,7 @@ export async function getUserMCPAuthMap({
   servers?: (string | undefined)[];
   toolInstances?: (GenericTool | null)[];
   findPluginAuthsByKeys: PluginAuthMethods['findPluginAuthsByKeys'];
-}) {
+}): Promise<Record<string, Record<string, string>>> {
   let allMcpCustomUserVars: Record<string, Record<string, string>> = {};
   let mcpPluginKeysToFetch: string[] = [];
   try {
diff --git a/packages/api/src/mcp/connection.ts b/packages/api/src/mcp/connection.ts
index 3ccdb432d07..23661816840 100644
--- a/packages/api/src/mcp/connection.ts
+++ b/packages/api/src/mcp/connection.ts
@@ -2,27 +2,27 @@ import { isIP } from 'node:net';
 import { EventEmitter } from 'events';
 import { logger } from '@librechat/data-schemas';
 import { fetch as undiciFetch, Agent, ProxyAgent } from 'undici';
-import {
-  StdioClientTransport,
-  getDefaultEnvironment,
-} from '@modelcontextprotocol/sdk/client/stdio.js';
 import { Client } from '@modelcontextprotocol/sdk/client/index.js';
 import { SSEClientTransport } from '@modelcontextprotocol/sdk/client/sse.js';
 import { WebSocketClientTransport } from '@modelcontextprotocol/sdk/client/websocket.js';
 import { ResourceListChangedNotificationSchema } from '@modelcontextprotocol/sdk/types.js';
 import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
-import type { Transport } from '@modelcontextprotocol/sdk/shared/transport.js';
+import {
+  StdioClientTransport,
+  getDefaultEnvironment,
+} from '@modelcontextprotocol/sdk/client/stdio.js';
 import type {
   RequestInit as UndiciRequestInit,
   RequestInfo as UndiciRequestInfo,
   Response as UndiciResponse,
   Dispatcher,
 } from 'undici';
+import type { Transport } from '@modelcontextprotocol/sdk/shared/transport.js';
 import type { MCPOAuthTokens } from './oauth/types';
 import type * as t from './types';
 import { createSSRFSafeUndiciConnect, isSSRFTarget, resolveHostnameSSRF } from '~/auth';
-import { isAddressAllowed } from '~/auth/domain';
 import { runOutsideTracing } from '~/utils/tracing';
+import { isAddressAllowed } from '~/auth/domain';
 import { sanitizeUrlForLogging } from './utils';
 import { withTimeout } from '~/utils/promise';
 import { mcpConfig } from './mcpConfig';
@@ -1092,6 +1092,7 @@ interface MCPConnectionParams {
   oauthTokens?: MCPOAuthTokens | null;
   useSSRFProtection?: boolean;
   allowedAddresses?: string[] | null;
+  ephemeralConnection?: boolean;
 }
 
 export class MCPConnection extends EventEmitter {
@@ -1116,6 +1117,7 @@ export class MCPConnection extends EventEmitter {
   private oauthRecovery = false;
   private readonly useSSRFProtection: boolean;
   private readonly allowedAddresses?: string[] | null;
+  private readonly ephemeralConnection: boolean;
   private readonly proxyConfig?: MCPProxyConfig;
   iconPath?: string;
   timeout?: number;
@@ -1232,6 +1234,7 @@ export class MCPConnection extends EventEmitter {
     this.userId = params.userId;
     this.useSSRFProtection = params.useSSRFProtection === true;
     this.allowedAddresses = params.allowedAddresses ?? null;
+    this.ephemeralConnection = params.ephemeralConnection === true;
     this.proxyConfig = getMCPProxyConfig(params.serverConfig);
     this.iconPath = params.serverConfig.iconPath;
     this.timeout = params.serverConfig.timeout;
@@ -1905,7 +1908,7 @@ export class MCPConnection extends EventEmitter {
             `${this.getLogPrefix()} Server URL for OAuth: ${serverUrl ? sanitizeUrlForLogging(serverUrl) : 'undefined'}`,
           );
 
-          const oauthTimeout = this.options.initTimeout ?? 60000 * 2;
+          const oauthTimeout = mcpConfig.OAUTH_HANDLING_TIMEOUT;
           /** Promise that will resolve when OAuth is handled */
           const oauthHandledPromise = new Promise<void>((resolve, reject) => {
             let timeoutId: NodeJS.Timeout | null = null;
@@ -2026,8 +2029,13 @@ export class MCPConnection extends EventEmitter {
 
   async connect(): Promise<void> {
     try {
-      // preserve cycle tracking across reconnects so the circuit breaker can detect rapid cycling
-      await this.disconnect(false);
+      /**
+       * Persistent connections preserve cycle tracking across reconnects so the
+       * circuit breaker can detect storms. Request-scoped connections are
+       * intentionally short-lived per tool call, so their clean lifecycle should
+       * not consume the reconnect-storm cycle budget.
+       */
+      await this.disconnect(this.ephemeralConnection);
       await this.connectClient();
       if (!(await this.isConnected())) {
         throw new Error('Connection not established');
@@ -2183,7 +2191,50 @@ export class MCPConnection extends EventEmitter {
     }
   }
 
-  async fetchTools() {
+  async fetchTools(): Promise<
+    {
+      inputSchema: {
+        [x: string]: unknown;
+        type: 'object';
+        properties?: Record<string, object> | undefined;
+        required?: string[] | undefined;
+      };
+      name: string;
+      description?: string | undefined;
+      outputSchema?:
+        | {
+            [x: string]: unknown;
+            type: 'object';
+            properties?: Record<string, object> | undefined;
+            required?: string[] | undefined;
+          }
+        | undefined;
+      annotations?:
+        | {
+            title?: string | undefined;
+            readOnlyHint?: boolean | undefined;
+            destructiveHint?: boolean | undefined;
+            idempotentHint?: boolean | undefined;
+            openWorldHint?: boolean | undefined;
+          }
+        | undefined;
+      execution?:
+        | {
+            taskSupport?: 'optional' | 'required' | 'forbidden' | undefined;
+          }
+        | undefined;
+      _meta?: Record<string, unknown> | undefined;
+      icons?:
+        | {
+            src: string;
+            mimeType?: string | undefined;
+            sizes?: string[] | undefined;
+            theme?: 'light' | 'dark' | undefined;
+          }[]
+        | undefined;
+      title?: string | undefined;
+    }[]
+  > {
     try {
       const { tools } = await this.client.listTools();
       return tools;
diff --git a/packages/api/src/mcp/errors.ts b/packages/api/src/mcp/errors.ts
index 21b249db307..9ac7568313a 100644
--- a/packages/api/src/mcp/errors.ts
+++ b/packages/api/src/mcp/errors.ts
@@ -14,7 +14,7 @@ export type MCPErrorCode = (typeof MCPErrorCodes)[keyof typeof MCPErrorCodes];
  * Thrown when a user attempts to connect to an MCP server whose domain is not in the allowlist.
  */
 export class MCPDomainNotAllowedError extends Error {
-  public readonly code = MCPErrorCodes.DOMAIN_NOT_ALLOWED;
+  public readonly code: 'MCP_DOMAIN_NOT_ALLOWED' = MCPErrorCodes.DOMAIN_NOT_ALLOWED;
   public readonly statusCode = 403;
   public readonly domain: string;
 
@@ -31,7 +31,7 @@ export class MCPDomainNotAllowedError extends Error {
  * Thrown when attempting to connect/inspect an MCP server fails.
  */
 export class MCPInspectionFailedError extends Error {
-  public readonly code = MCPErrorCodes.INSPECTION_FAILED;
+  public readonly code: 'MCP_INSPECTION_FAILED' = MCPErrorCodes.INSPECTION_FAILED;
   public readonly statusCode = 400;
   public readonly serverName: string;
 
diff --git a/packages/api/src/mcp/mcpConfig.ts b/packages/api/src/mcp/mcpConfig.ts
index a81752e909e..68e22a81c28 100644
--- a/packages/api/src/mcp/mcpConfig.ts
+++ b/packages/api/src/mcp/mcpConfig.ts
@@ -1,12 +1,51 @@
 import { math, isEnabled } from '~/utils';
 
+const oauthHandlingTimeout = math(process.env.MCP_OAUTH_HANDLING_TIMEOUT ?? 10 * 60 * 1000);
+/** Grace so flow state outlives the handling wait rather than expiring at the same instant —
+ * covers callback processing, the monitor poll interval, and multi-replica clock skew. */
+const OAUTH_FLOW_TTL_GRACE_MS = 60 * 1000;
+/** Flow state must outlive the handling wait, otherwise a callback arriving near the
+ * deadline cannot find its flow. Clamp the configured TTL above the handling timeout. */
+const oauthFlowTtl = Math.max(
+  math(process.env.MCP_OAUTH_FLOW_TTL ?? 15 * 60 * 1000),
+  oauthHandlingTimeout + OAUTH_FLOW_TTL_GRACE_MS,
+);
+
 /**
  * Centralized configuration for MCP-related environment variables.
  * Provides typed access to MCP settings with default values.
  */
-export const mcpConfig = {
+export const mcpConfig: {
+  OAUTH_ON_AUTH_ERROR: boolean;
+  OAUTH_DETECTION_TIMEOUT: number;
+  /** How long (ms) to wait for the user to complete an OAuth flow before timing out. Default: 10 minutes */
+  OAUTH_HANDLING_TIMEOUT: number;
+  /** TTL (ms) for OAuth flow state. Must outlive OAUTH_HANDLING_TIMEOUT so the state survives the wait. Default: 15 minutes */
+  OAUTH_FLOW_TTL: number;
+  CONNECTION_CHECK_TTL: number;
+  /** Idle timeout (ms) after which user connections are disconnected. Default: 15 minutes */
+  USER_CONNECTION_IDLE_TIMEOUT: number;
+  /** Max connect/disconnect cycles before the circuit breaker trips. Default: 7 */
+  CB_MAX_CYCLES: number;
+  /** Sliding window (ms) for counting cycles. Default: 45s */
+  CB_CYCLE_WINDOW_MS: number;
+  /** Cooldown (ms) after the cycle breaker trips. Default: 15s */
+  CB_CYCLE_COOLDOWN_MS: number;
+  /** Max consecutive failed connection rounds before backoff. Default: 3 */
+  CB_MAX_FAILED_ROUNDS: number;
+  /** Sliding window (ms) for counting failed rounds. Default: 120s */
+  CB_FAILED_WINDOW_MS: number;
+  /** Base backoff (ms) after failed round threshold is reached. Default: 30s */
+  CB_BASE_BACKOFF_MS: number;
+  /** Max backoff cap (ms) for exponential backoff. Default: 300s */
+  CB_MAX_BACKOFF_MS: number;
+} = {
   OAUTH_ON_AUTH_ERROR: isEnabled(process.env.MCP_OAUTH_ON_AUTH_ERROR ?? true),
   OAUTH_DETECTION_TIMEOUT: math(process.env.MCP_OAUTH_DETECTION_TIMEOUT ?? 5000),
+  /** How long (ms) to wait for the user to complete an OAuth flow before timing out. Default: 10 minutes */
+  OAUTH_HANDLING_TIMEOUT: oauthHandlingTimeout,
+  /** TTL (ms) for OAuth flow state. Clamped to never fall below OAUTH_HANDLING_TIMEOUT. Default: 15 minutes */
+  OAUTH_FLOW_TTL: oauthFlowTtl,
   CONNECTION_CHECK_TTL: math(process.env.MCP_CONNECTION_CHECK_TTL ?? 60000),
   /** Idle timeout (ms) after which user connections are disconnected. Default: 15 minutes */
   USER_CONNECTION_IDLE_TIMEOUT: math(
diff --git a/packages/api/src/mcp/oauth/OAuthReconnectionManager.test.ts b/packages/api/src/mcp/oauth/OAuthReconnectionManager.test.ts
index 23a32787974..c4c0544b968 100644
--- a/packages/api/src/mcp/oauth/OAuthReconnectionManager.test.ts
+++ b/packages/api/src/mcp/oauth/OAuthReconnectionManager.test.ts
@@ -1,8 +1,9 @@
 import { logger, TokenMethods } from '@librechat/data-schemas';
-import { FlowStateManager, MCPConnection, MCPOAuthTokens, MCPOptions } from '../..';
-import { MCPManager } from '../MCPManager';
+import type { IToken } from '@librechat/data-schemas';
 import { OAuthReconnectionManager } from './OAuthReconnectionManager';
 import { OAuthReconnectionTracker } from './OAuthReconnectionTracker';
+import { FlowStateManager, MCPConnection, MCPOptions } from '../..';
+import { MCPManager } from '../MCPManager';
 
 jest.mock('@librechat/data-schemas', () => ({
   logger: {
@@ -183,7 +184,7 @@ describe('OAuthReconnectionManager', () => {
             userId,
             identifier,
             expiresAt: new Date(Date.now() + 3600000), // 1 hour from now
-          } as unknown as MCPOAuthTokens;
+          } as unknown as IToken;
         }
         return null;
       });
@@ -234,7 +235,7 @@ describe('OAuthReconnectionManager', () => {
         userId,
         identifier: 'mcp:server1',
         expiresAt: new Date(Date.now() + 3600000),
-      } as unknown as MCPOAuthTokens);
+      } as unknown as IToken);
 
       // Mock failed connection
       mockMCPManager.getUserConnection.mockRejectedValue(new Error('Connection failed'));
@@ -264,7 +265,7 @@ describe('OAuthReconnectionManager', () => {
             userId,
             identifier,
             expiresAt: new Date(Date.now() - 3600000),
-          } as unknown as MCPOAuthTokens;
+          } as unknown as IToken;
         }
         return null;
       });
@@ -287,13 +288,13 @@ describe('OAuthReconnectionManager', () => {
             userId,
             identifier,
             expiresAt: new Date(Date.now() - 3600000),
-          } as unknown as MCPOAuthTokens;
+          } as unknown as IToken;
         }
         if (identifier === 'mcp:server1:refresh') {
           return {
             userId,
             identifier,
-          } as unknown as MCPOAuthTokens;
+          } as unknown as IToken;
         }
         return null;
       });
@@ -330,7 +331,7 @@ describe('OAuthReconnectionManager', () => {
           return {
             userId,
             identifier,
-          } as unknown as MCPOAuthTokens;
+          } as unknown as IToken;
         }
         return null;
       });
@@ -366,7 +367,7 @@ describe('OAuthReconnectionManager', () => {
         userId,
         identifier: 'mcp:server1',
         expiresAt: new Date(Date.now() + 3600000),
-      } as unknown as MCPOAuthTokens);
+      } as unknown as IToken);
 
       // Mock connection that returns but is not connected
       const mockConnection = {
@@ -512,7 +513,7 @@ describe('OAuthReconnectionManager', () => {
           userId,
           identifier,
           expiresAt: new Date(Date.now() + 3600000),
-        } as unknown as MCPOAuthTokens;
+        } as unknown as IToken;
       });
 
       const mockNewConnection = {
@@ -576,7 +577,7 @@ describe('OAuthReconnectionManager', () => {
         userId,
         identifier: 'mcp:server1',
         expiresAt: new Date(Date.now() + 3600000),
-      } as unknown as MCPOAuthTokens);
+      } as unknown as IToken);
 
       const boom = new Error('boom');
       (mockRegistryInstance.getServerConfig as jest.Mock).mockRejectedValue(boom);
@@ -650,7 +651,7 @@ describe('OAuthReconnectionManager', () => {
             userId,
             identifier,
             expiresAt: new Date(Date.now() + 3600000),
-          } as unknown as MCPOAuthTokens;
+          } as unknown as IToken;
         }
         return null;
       });
@@ -699,7 +700,7 @@ describe('OAuthReconnectionManager', () => {
         userId,
         identifier: `mcp:${serverName}`,
         expiresAt: new Date(Date.now() + 3600000),
-      } as unknown as MCPOAuthTokens);
+      } as unknown as IToken);
 
       // First reconnect attempt - will fail
       mockMCPManager.getUserConnection.mockRejectedValueOnce(new Error('Connection failed'));
diff --git a/packages/api/src/mcp/oauth/OAuthReconnectionManager.ts b/packages/api/src/mcp/oauth/OAuthReconnectionManager.ts
index e0e30d7e14b..1adb9b4be0c 100644
--- a/packages/api/src/mcp/oauth/OAuthReconnectionManager.ts
+++ b/packages/api/src/mcp/oauth/OAuthReconnectionManager.ts
@@ -1,10 +1,10 @@
 import { logger } from '@librechat/data-schemas';
 import type { TokenMethods, IUser } from '@librechat/data-schemas';
 import type { MCPOAuthTokens } from './types';
+import { MCPServersRegistry } from '~/mcp/registry/MCPServersRegistry';
 import { OAuthReconnectionTracker } from './OAuthReconnectionTracker';
 import { FlowStateManager } from '~/flow/manager';
 import { MCPManager } from '~/mcp/MCPManager';
-import { MCPServersRegistry } from '~/mcp/registry/MCPServersRegistry';
 
 const DEFAULT_CONNECTION_TIMEOUT_MS = 10_000; // ms
 const RECONNECT_STAGGER_MS = 500; // ms between each server reconnection
@@ -62,7 +62,7 @@ export class OAuthReconnectionManager {
     return this.reconnectionsTracker.isStillReconnecting(userId, serverName);
   }
 
-  public async reconnectServers(userId: string) {
+  public async reconnectServers(userId: string): Promise<void> {
     // Check if MCPManager is available
     if (this.mcpManager == null) {
       logger.warn(
@@ -138,7 +138,7 @@ export class OAuthReconnectionManager {
     }
   }
 
-  public clearReconnection(userId: string, serverName: string) {
+  public clearReconnection(userId: string, serverName: string): void {
     this.reconnectionsTracker.removeFailed(userId, serverName);
     this.reconnectionsTracker.removeActive(userId, serverName);
   }
@@ -183,7 +183,11 @@ export class OAuthReconnectionManager {
     }
   }
 
-  public getTrackerStats() {
+  public getTrackerStats(): {
+    usersWithFailedServers: number;
+    usersWithActiveReconnections: number;
+    activeTimestamps: number;
+  } {
     return this.reconnectionsTracker.getStats();
   }
 
diff --git a/packages/api/src/mcp/oauth/events.ts b/packages/api/src/mcp/oauth/events.ts
new file mode 100644
index 00000000000..4aec0db7ea6
--- /dev/null
+++ b/packages/api/src/mcp/oauth/events.ts
@@ -0,0 +1,161 @@
+import { Constants, Time } from 'librechat-data-provider';
+import { GraphEvents, StepTypes } from '@librechat/agents';
+import type * as t from '~/types';
+import { buildOAuthToolCallName } from '~/mcp/utils';
+
+export type OAuthPromptOptions = {
+  expiresAt?: number;
+};
+
+export type OAuthToolCall = {
+  id?: string;
+  name: string;
+  type: 'tool_call' | 'tool_call_chunk';
+  args?: string;
+  output?: string;
+};
+
+export function getOAuthPromptExpiresAt(
+  options?: OAuthPromptOptions,
+  now: number = Date.now(),
+): number {
+  return typeof options?.expiresAt === 'number' && Number.isFinite(options.expiresAt)
+    ? options.expiresAt
+    : now + Time.TWO_MINUTES;
+}
+
+export function getMCPServerNamesFromTools(tools?: unknown[] | null): Set<string> {
+  const serverNames = new Set<string>();
+
+  for (const tool of tools ?? []) {
+    if (typeof tool !== 'string') {
+      continue;
+    }
+
+    const delimiterIndex = tool.indexOf(Constants.mcp_delimiter);
+    if (delimiterIndex === -1) {
+      continue;
+    }
+
+    serverNames.add(tool.slice(delimiterIndex + Constants.mcp_delimiter.length));
+  }
+
+  return serverNames;
+}
+
+export function buildMCPAuthStepId(serverName: string): string {
+  return `step_oauth_login_${serverName}`;
+}
+
+export function buildMCPAuthToolCall({
+  id,
+  args,
+  output,
+  serverName,
+  type = 'tool_call_chunk',
+}: {
+  id?: string;
+  args?: string;
+  output?: string;
+  serverName: string;
+  type?: OAuthToolCall['type'];
+}): OAuthToolCall {
+  return {
+    ...(id != null ? { id } : {}),
+    name: buildOAuthToolCallName(serverName),
+    ...(args != null ? { args } : {}),
+    ...(output != null ? { output } : {}),
+    type,
+  };
+}
+
+export function buildMCPAuthRunStepEvent({
+  runId = Constants.USE_PRELIM_RESPONSE_MESSAGE_ID,
+  stepId,
+  toolCall,
+  index = 0,
+}: {
+  runId?: string | null;
+  stepId: string;
+  toolCall: OAuthToolCall;
+  index?: number;
+}): t.ServerSentEvent {
+  return {
+    event: GraphEvents.ON_RUN_STEP,
+    data: {
+      runId,
+      id: stepId,
+      type: StepTypes.TOOL_CALLS,
+      index,
+      stepDetails: {
+        type: StepTypes.TOOL_CALLS,
+        tool_calls: [toolCall],
+      },
+    },
+  };
+}
+
+export function buildMCPAuthRunStepDeltaEvent({
+  authURL,
+  stepId,
+  toolCall,
+  options,
+}: {
+  authURL: string;
+  stepId: string;
+  toolCall: OAuthToolCall;
+  options?: OAuthPromptOptions;
+}): t.ServerSentEvent {
+  return {
+    event: GraphEvents.ON_RUN_STEP_DELTA,
+    data: {
+      id: stepId,
+      delta: {
+        type: StepTypes.TOOL_CALLS,
+        tool_calls: [{ ...toolCall, args: '' }],
+        auth: authURL,
+        expires_at: getOAuthPromptExpiresAt(options),
+      },
+    },
+  };
+}
+
+export function buildMCPAuthRunStepEndDeltaEvent({
+  stepId,
+  toolCall,
+}: {
+  stepId: string;
+  toolCall: OAuthToolCall;
+}): t.ServerSentEvent {
+  return {
+    event: GraphEvents.ON_RUN_STEP_DELTA,
+    data: {
+      id: stepId,
+      delta: {
+        type: StepTypes.TOOL_CALLS,
+        tool_calls: [{ ...toolCall }],
+      },
+    },
+  };
+}
+
+export function buildMCPAuthRunStepCompletedEvent({
+  stepId,
+  toolCall,
+  index = 0,
+}: {
+  stepId: string;
+  toolCall: OAuthToolCall;
+  index?: number;
+}): t.ServerSentEvent {
+  return {
+    event: GraphEvents.ON_RUN_STEP_COMPLETED,
+    data: {
+      result: {
+        id: stepId,
+        index,
+        tool_call: toolCall,
+      },
+    },
+  };
+}
diff --git a/packages/api/src/mcp/oauth/handler.ts b/packages/api/src/mcp/oauth/handler.ts
index be503ae97e4..30d497b6d38 100644
--- a/packages/api/src/mcp/oauth/handler.ts
+++ b/packages/api/src/mcp/oauth/handler.ts
@@ -1,7 +1,7 @@
 import { randomBytes } from 'crypto';
 import { logger } from '@librechat/data-schemas';
-import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport';
 import { OAuthMetadataSchema } from '@modelcontextprotocol/sdk/shared/auth.js';
+import { TokenExchangeMethodEnum, type MCPOptions } from 'librechat-data-provider';
 import {
   checkResourceAllowed,
   resourceUrlFromServerUrl,
@@ -13,16 +13,17 @@ import {
   discoverAuthorizationServerMetadata,
   discoverOAuthProtectedResourceMetadata,
 } from '@modelcontextprotocol/sdk/client/auth.js';
-import { TokenExchangeMethodEnum, type MCPOptions } from 'librechat-data-provider';
+import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport';
 import type { TokenMethods } from '@librechat/data-schemas';
-import type { FlowStateManager } from '~/flow/manager';
 import type {
   OAuthClientInformation,
   OAuthProtectedResourceMetadata,
+  OAuthStoredClientMetadata,
   MCPOAuthFlowMetadata,
   MCPOAuthTokens,
   OAuthMetadata,
 } from './types';
+import type { FlowStateManager } from '~/flow/manager';
 import {
   resolveTokenEndpointAuthMethod,
   getForcedTokenEndpointAuthMethod,
@@ -31,17 +32,16 @@ import {
 } from './methods';
 import { isSSRFTarget, resolveHostnameSSRF, isOAuthUrlAllowed } from '~/auth';
 import { probeResourceMetadataHint } from './resourceHint';
-import { MCPTokenStorage } from './tokens';
 import { createHardenedOAuthFetch } from './hardenedFetch';
-import { getOAuthUrlPort } from './url';
 import { sanitizeUrlForLogging } from '~/mcp/utils';
+import { MCPTokenStorage } from './tokens';
+import { getOAuthUrlPort } from './url';
 
 /** Type for the OAuth metadata from the SDK */
 type SDKOAuthMetadata = Parameters<typeof registerClient>[1]['metadata'];
 
 export class MCPOAuthHandler {
   private static readonly FLOW_TYPE = 'mcp_oauth';
-  private static readonly FLOW_TTL = 10 * 60 * 1000; // 10 minutes
 
   /**
    * Creates a fetch function with custom headers injected
@@ -51,6 +51,7 @@ export class MCPOAuthHandler {
     clientInfo?: OAuthClientInformation,
     allowedDomains?: string[] | null,
     allowedAddresses?: string[] | null,
+    signal?: AbortSignal,
   ): FetchLike {
     const hardenedFetch = createHardenedOAuthFetch({ allowedDomains, allowedAddresses });
 
@@ -121,11 +122,13 @@ export class MCPOAuthHandler {
           ...init,
           body: params.toString(),
           headers: newHeaders,
+          signal: init?.signal ?? signal,
         });
       }
       return hardenedFetch(url, {
         ...init,
         headers: newHeaders,
+        signal: init?.signal ?? signal,
       });
     };
   }
@@ -358,6 +361,27 @@ export class MCPOAuthHandler {
     );
   }
 
+  public static buildStoredClientMetadata(
+    metadata?: OAuthMetadata,
+    resourceMetadata?: OAuthProtectedResourceMetadata,
+  ): OAuthStoredClientMetadata | undefined {
+    if (!metadata) {
+      return undefined;
+    }
+    const storedMetadata: OAuthStoredClientMetadata = { ...metadata };
+    if (resourceMetadata?.resource) {
+      storedMetadata.resource = new URL(resourceMetadata.resource).href;
+    }
+    return storedMetadata;
+  }
+
+  private static appendResourceParameter(body: URLSearchParams, resource?: string): void {
+    if (!resource) {
+      return;
+    }
+    body.set('resource', resource);
+  }
+
   private static assertNoUnpinnedClientSecret(config?: MCPOptions['oauth']): void {
     if (config?.client_secret && !config.client_id) {
       throw new Error('[MCPOAuth] OAuth client_secret requires oauth.client_id.');
@@ -479,12 +503,13 @@ export class MCPOAuthHandler {
     allowedDomains?: string[] | null,
     findToken?: TokenMethods['findToken'],
     allowedAddresses?: string[] | null,
+    tenantId?: string,
   ): Promise<{ authorizationUrl: string; flowId: string; flowMetadata: MCPOAuthFlowMetadata }> {
     logger.debug(
       `[MCPOAuth] initiateOAuthFlow called for ${serverName} with URL: ${sanitizeUrlForLogging(serverUrl)}`,
     );
 
-    const flowId = this.generateFlowId(userId, serverName);
+    const flowId = this.generateFlowId(userId, serverName, tenantId);
     const state = this.generateState();
 
     logger.debug(`[MCPOAuth] Generated flowId: ${flowId}, state: ${state}`);
@@ -598,6 +623,7 @@ export class MCPOAuthHandler {
           ...(allowedDomains !== undefined && { allowedDomains }),
           ...(allowedAddresses !== undefined && { allowedAddresses }),
           ...(Object.keys(oauthHeaders).length > 0 && { oauthHeaders }),
+          ...(tenantId && { tenantId }),
         };
 
         logger.debug(
@@ -779,6 +805,7 @@ export class MCPOAuthHandler {
         ...(allowedAddresses !== undefined && { allowedAddresses }),
         ...(Object.keys(oauthHeaders).length > 0 && { oauthHeaders }),
         ...(reusedStoredClient && { reusedStoredClient }),
+        ...(tenantId && { tenantId }),
       };
 
       logger.debug(
@@ -836,7 +863,7 @@ export class MCPOAuthHandler {
       if (metadata.resourceMetadata) {
         /**
          * Defense-in-depth: re-assert the RFC 9728 §3.3 binding against the flow's stored
-         * server URL. Flow state has a 10-minute TTL, so a flow initiated under older
+         * server URL. Flow state has a bounded TTL, so a flow initiated under older
          * (pre-fix) code could still be in-flight at upgrade time carrying unvalidated
          * resource metadata. Re-validating here closes that window without requiring ops
          * teams to flush flow state on deploy (GHSA-gvpj-vm2f-2m23).
@@ -907,8 +934,55 @@ export class MCPOAuthHandler {
    * Generates a flow ID for the OAuth flow
    * @returns Consistent ID so concurrent requests share the same flow
    */
-  public static generateFlowId(userId: string, serverName: string): string {
-    return `${userId}:${serverName}`;
+  public static generateFlowId(userId: string, serverName: string, tenantId?: string): string {
+    const flowId = `${userId}:${serverName}`;
+    if (!tenantId) {
+      return flowId;
+    }
+    return `tenant:${encodeURIComponent(tenantId)}:${flowId}`;
+  }
+
+  public static parseFlowId(
+    flowId: string,
+  ): { userId: string; serverName: string; tenantId?: string } | null {
+    const parts = flowId.split(':');
+    if (parts[0] === 'tenant') {
+      if (parts.length < 4 || !parts[1] || !parts[2]) {
+        return null;
+      }
+      let tenantId: string;
+      try {
+        tenantId = decodeURIComponent(parts[1]);
+      } catch {
+        return null;
+      }
+      const serverName = parts.slice(3).join(':');
+      if (!serverName) {
+        return null;
+      }
+      return {
+        tenantId,
+        userId: parts[2],
+        serverName,
+      };
+    }
+
+    if (parts.length < 2 || !parts[0]) {
+      return null;
+    }
+    const serverName = parts.slice(1).join(':');
+    if (!serverName) {
+      return null;
+    }
+    return {
+      userId: parts[0],
+      serverName,
+    };
+  }
+
+  /** Same shape as `generateFlowId`; kept distinct so token-fetch flows can diverge from OAuth flows */
+  public static generateTokenFlowId(userId: string, serverName: string, tenantId?: string): string {
+    return this.generateFlowId(userId, serverName, tenantId);
   }
 
   /**
@@ -1105,8 +1179,9 @@ export class MCPOAuthHandler {
     headers: HeadersInit,
     body: URLSearchParams,
     serverName: string,
+    signal?: AbortSignal,
   ): Promise<Response> {
-    const response = await oauthFetch(tokenUrl, { method: 'POST', headers, body });
+    const response = await oauthFetch(tokenUrl, { method: 'POST', headers, body, signal });
     if (response.ok || !body.has('scope')) {
       return response;
     }
@@ -1123,7 +1198,7 @@ export class MCPOAuthHandler {
       `[MCPOAuth] ${serverName} rejected the scope parameter on token refresh (HTTP ${response.status}); retrying without scope per RFC 6749 §6`,
     );
     body.delete('scope');
-    return oauthFetch(tokenUrl, { method: 'POST', headers, body });
+    return oauthFetch(tokenUrl, { method: 'POST', headers, body, signal });
   }
 
   /**
@@ -1159,11 +1234,13 @@ export class MCPOAuthHandler {
       clientInfo?: OAuthClientInformation;
       storedTokenEndpoint?: string;
       storedAuthMethods?: string[];
+      resource?: string;
     },
     oauthHeaders: Record<string, string>,
     config?: MCPOptions['oauth'],
     allowedDomains?: string[] | null,
     allowedAddresses?: string[] | null,
+    signal?: AbortSignal,
   ): Promise<MCPOAuthTokens> {
     logger.debug(`[MCPOAuth] Refreshing tokens for ${metadata.serverName}`);
 
@@ -1217,6 +1294,7 @@ export class MCPOAuthHandler {
             undefined,
             allowedDomains,
             allowedAddresses,
+            signal,
           );
           const oauthMetadata = await this.discoverWithOriginFallback(serverUrl, fetchFn);
 
@@ -1251,6 +1329,7 @@ export class MCPOAuthHandler {
         if (metadata.clientInfo.scope) {
           body.append('scope', metadata.clientInfo.scope);
         }
+        this.appendResourceParameter(body, metadata.resource);
 
         /**
          * Forward Auth0-style `audience` on refresh by default — Auth0 strips the
@@ -1322,6 +1401,7 @@ export class MCPOAuthHandler {
           headers,
           body,
           metadata.serverName,
+          signal,
         );
 
         if (!response.ok) {
@@ -1354,6 +1434,7 @@ export class MCPOAuthHandler {
         if (config.scope) {
           body.append('scope', config.scope);
         }
+        this.appendResourceParameter(body, metadata.resource);
 
         const headers: HeadersInit = {
           Accept: 'application/json',
@@ -1408,6 +1489,7 @@ export class MCPOAuthHandler {
           headers,
           body,
           metadata.serverName,
+          signal,
         );
 
         if (!response.ok) {
@@ -1433,6 +1515,7 @@ export class MCPOAuthHandler {
         undefined,
         allowedDomains,
         allowedAddresses,
+        signal,
       );
       const oauthMetadata = await this.discoverWithOriginFallback(serverUrl, fetchFn);
 
@@ -1456,6 +1539,7 @@ export class MCPOAuthHandler {
         grant_type: 'refresh_token',
         refresh_token: refreshToken,
       });
+      this.appendResourceParameter(body, metadata.resource);
 
       const headers: HeadersInit = {
         Accept: 'application/json',
@@ -1468,6 +1552,7 @@ export class MCPOAuthHandler {
         method: 'POST',
         headers,
         body,
+        signal,
       });
 
       if (!response.ok) {
diff --git a/packages/api/src/mcp/oauth/index.ts b/packages/api/src/mcp/oauth/index.ts
index 12fd25f56ca..7e48d8a5c01 100644
--- a/packages/api/src/mcp/oauth/index.ts
+++ b/packages/api/src/mcp/oauth/index.ts
@@ -4,3 +4,5 @@ export * from './tokens';
 export * from './detectOAuth';
 export * from './methods';
 export * from './obo';
+export * from './pending';
+export * from './events';
diff --git a/packages/api/src/mcp/oauth/pending.ts b/packages/api/src/mcp/oauth/pending.ts
new file mode 100644
index 00000000000..76935ca7efb
--- /dev/null
+++ b/packages/api/src/mcp/oauth/pending.ts
@@ -0,0 +1,70 @@
+import { logger, getTenantId } from '@librechat/data-schemas';
+
+import type { MCPOAuthFlowMetadata, MCPOAuthTokens } from './types';
+import type { FlowStateManager } from '~/flow/manager';
+import type { FlowState } from '~/flow/types';
+import type * as t from '~/mcp/types';
+
+import { PENDING_STALE_MS } from '~/flow/manager';
+import { MCPOAuthHandler } from './handler';
+
+const MCP_OAUTH_FLOW_TYPE = 'mcp_oauth';
+
+type PendingOAuthFlowState = Pick<
+  FlowState<MCPOAuthTokens | null>,
+  'createdAt' | 'metadata' | 'status'
+>;
+
+type PendingOAuthFlowManager = Pick<FlowStateManager<MCPOAuthTokens | null>, 'getFlowState'>;
+
+export type PendingOAuthStart = {
+  authURL: string;
+  options?: t.OAuthStartOptions;
+};
+
+export type ReplayablePendingMCPOAuthStartOptions = {
+  flowManager?: PendingOAuthFlowManager | null;
+  userId: string;
+  serverName: string;
+};
+
+export function getReplayablePendingMCPOAuthStartFromFlow(
+  flow: PendingOAuthFlowState | null | undefined,
+  now: number = Date.now(),
+): PendingOAuthStart | undefined {
+  if (flow?.status !== 'PENDING') {
+    return undefined;
+  }
+
+  const expiresAt = flow.createdAt + PENDING_STALE_MS;
+  if (expiresAt <= now) {
+    return undefined;
+  }
+
+  const metadata = flow.metadata as Partial<MCPOAuthFlowMetadata>;
+  const authorizationUrl = metadata.authorizationUrl;
+  if (!authorizationUrl) {
+    return undefined;
+  }
+
+  return { authURL: authorizationUrl, options: { expiresAt } };
+}
+
+export async function getReplayablePendingMCPOAuthStart({
+  flowManager,
+  userId,
+  serverName,
+}: ReplayablePendingMCPOAuthStartOptions): Promise<PendingOAuthStart | undefined> {
+  if (!flowManager || typeof flowManager.getFlowState !== 'function') {
+    return undefined;
+  }
+
+  try {
+    const flowId = MCPOAuthHandler.generateFlowId(userId, serverName, getTenantId());
+    const flowState = await flowManager.getFlowState(flowId, MCP_OAUTH_FLOW_TYPE);
+    return getReplayablePendingMCPOAuthStartFromFlow(flowState);
+  } catch (error) {
+    logger.warn(`[MCP OAuth] Failed to inspect pending flow for ${serverName}:`, error);
+    return undefined;
+  }
+}
diff --git a/packages/api/src/mcp/oauth/tokens.ts b/packages/api/src/mcp/oauth/tokens.ts
index ae15268c8fa..65c686e7ef3 100644
--- a/packages/api/src/mcp/oauth/tokens.ts
+++ b/packages/api/src/mcp/oauth/tokens.ts
@@ -2,7 +2,7 @@ import jwt from 'jsonwebtoken';
 import { logger, encryptV2, decryptV2 } from '@librechat/data-schemas';
 import type { OAuthTokens, OAuthClientInformation } from '@modelcontextprotocol/sdk/shared/auth.js';
 import type { TokenMethods, IToken } from '@librechat/data-schemas';
-import type { MCPOAuthTokens, ExtendedOAuthTokens, OAuthMetadata } from './types';
+import type { MCPOAuthTokens, ExtendedOAuthTokens, OAuthStoredClientMetadata } from './types';
 import { isInvalidClientMessage } from '~/mcp/utils';
 import { isSystemUserId } from '~/mcp/enum';
 
@@ -25,7 +25,7 @@ interface StoreTokensParams {
   updateToken?: TokenMethods['updateToken'];
   findToken?: TokenMethods['findToken'];
   clientInfo?: OAuthClientInformation;
-  metadata?: OAuthMetadata;
+  metadata?: Partial<OAuthStoredClientMetadata>;
   /** Optional: Pass existing token state to avoid duplicate DB calls */
   existingTokens?: {
     accessToken?: IToken | null;
@@ -47,12 +47,15 @@ interface GetTokensParams {
       clientInfo?: OAuthClientInformation;
       storedTokenEndpoint?: string;
       storedAuthMethods?: string[];
+      resource?: string;
     },
+    signal?: AbortSignal,
   ) => Promise<MCPOAuthTokens>;
   createToken?: TokenMethods['createToken'];
   updateToken?: TokenMethods['updateToken'];
   /** Enables cleanup of stale client registration and refresh token on invalid_client errors during refresh. */
   deleteTokens?: TokenMethods['deleteTokens'];
+  signal?: AbortSignal;
 }
 
 /**
@@ -253,7 +256,7 @@ export class MCPTokenStorage {
           identifier: `${identifier}:client`,
           token: encryptedClientInfo,
           expiresIn: 365 * 24 * 60 * 60,
-          metadata,
+          metadata: metadata ? { ...metadata } : undefined,
         };
 
         // Check if client info already exists and update if it does
@@ -292,6 +295,183 @@ export class MCPTokenStorage {
     }
   }
 
+  /**
+   * Forces a refresh of OAuth tokens using the stored refresh token, regardless
+   * of whether the access token appears locally expired. Use this when the
+   * server has signaled token invalidity (e.g. a 401 mid-session) — the 401 is
+   * the authoritative signal, not the local `expires_at`.
+   *
+   * Returns the new tokens, or `null` when refresh is not possible (no refresh
+   * token stored, no refresh callback, etc.). Throws `ReauthenticationRequiredError`
+   * when the refresh server response indicates the client registration is stale.
+   */
+  static async forceRefreshTokens({
+    userId,
+    serverName,
+    findToken,
+    createToken,
+    updateToken,
+    deleteTokens,
+    refreshTokens,
+    existingAccessToken,
+    existingRefreshToken,
+    signal,
+  }: GetTokensParams & {
+    existingAccessToken?: IToken | null;
+    existingRefreshToken?: IToken | null;
+  }): Promise<MCPOAuthTokens | null> {
+    const logPrefix = this.getLogPrefix(userId, serverName);
+    const identifier = `mcp:${serverName}`;
+
+    const refreshTokenData =
+      existingRefreshToken !== undefined
+        ? existingRefreshToken
+        : await findToken({
+            userId,
+            type: 'mcp_oauth_refresh',
+            identifier: `${identifier}:refresh`,
+          });
+
+    if (!refreshTokenData) {
+      logger.debug(`${logPrefix} No refresh token in storage`);
+      return null;
+    }
+
+    if (!refreshTokens) {
+      logger.warn(`${logPrefix} Refresh token available but no \`refreshTokens\` provided`);
+      return null;
+    }
+
+    if (!createToken) {
+      logger.warn(`${logPrefix} Refresh token available but no \`createToken\` function provided`);
+      return null;
+    }
+
+    try {
+      logger.info(`${logPrefix} Attempting to refresh token`);
+      const decryptedRefreshToken = await decryptV2(refreshTokenData.token);
+
+      let clientInfo;
+      let clientInfoData;
+      let storedClientMetadata: Partial<OAuthStoredClientMetadata> | undefined;
+      let storedTokenEndpoint: string | undefined;
+      let storedAuthMethods: string[] | undefined;
+      let resource: string | undefined;
+      try {
+        clientInfoData = await findToken({
+          userId,
+          type: 'mcp_oauth_client',
+          identifier: `${identifier}:client`,
+        });
+        if (clientInfoData) {
+          const decryptedClientInfo = await decryptV2(clientInfoData.token);
+          clientInfo = JSON.parse(decryptedClientInfo);
+          logger.debug(`${logPrefix} Retrieved client info:`, {
+            client_id: clientInfo.client_id,
+            has_client_secret: !!clientInfo.client_secret,
+          });
+
+          if (clientInfoData.metadata) {
+            const raw =
+              clientInfoData.metadata instanceof Map
+                ? Object.fromEntries(clientInfoData.metadata)
+                : (clientInfoData.metadata as Record<string, unknown>);
+            storedClientMetadata = raw as Partial<OAuthStoredClientMetadata>;
+            if (typeof raw.token_endpoint === 'string') {
+              storedTokenEndpoint = raw.token_endpoint;
+            }
+            if (Array.isArray(raw.token_endpoint_auth_methods_supported)) {
+              storedAuthMethods = raw.token_endpoint_auth_methods_supported as string[];
+            }
+            if (typeof raw.resource === 'string') {
+              resource = raw.resource;
+            }
+          }
+        }
+      } catch {
+        logger.debug(`${logPrefix} No client info found`);
+      }
+
+      const metadata = {
+        userId,
+        serverName,
+        identifier,
+        clientInfo,
+        storedTokenEndpoint,
+        storedAuthMethods,
+        resource,
+      };
+
+      const newTokens = await refreshTokens(decryptedRefreshToken, metadata, signal);
+
+      if (signal?.aborted) {
+        throw new Error('Token refresh aborted');
+      }
+
+      logger.debug(`${logPrefix} Refresh completed`, {
+        has_new_access_token: !!newTokens.access_token,
+        has_new_refresh_token: !!newTokens.refresh_token,
+        refresh_token_will_be_rotated: !!newTokens.refresh_token,
+        expires_at: newTokens.expires_at,
+      });
+
+      // Store the refreshed tokens (handles both create and update)
+      // Pass existing token state to avoid duplicate DB calls
+      await this.storeTokens({
+        userId,
+        serverName,
+        tokens: newTokens,
+        createToken,
+        updateToken,
+        findToken,
+        clientInfo,
+        existingTokens: {
+          accessToken: existingAccessToken,
+          refreshToken: refreshTokenData,
+          clientInfoToken: clientInfoData,
+        },
+        metadata: storedClientMetadata,
+      });
+
+      logger.info(`${logPrefix} Successfully refreshed and stored OAuth tokens`);
+      return newTokens;
+    } catch (refreshError) {
+      logger.error(`${logPrefix} Failed to refresh tokens`, refreshError);
+      // Check if it's an unauthorized_client error (refresh not supported)
+      const errorMessage =
+        refreshError instanceof Error ? refreshError.message : String(refreshError);
+      if (errorMessage.toLowerCase().includes('unauthorized_client')) {
+        logger.info(
+          `${logPrefix} Server does not support refresh tokens for this client. New authentication required.`,
+        );
+      } else if (isInvalidClientMessage(errorMessage)) {
+        if (deleteTokens) {
+          logger.info(
+            `${logPrefix} Client registration rejected during token refresh, attempting to clear stale registration and refresh token`,
+          );
+          const results = await Promise.allSettled([
+            MCPTokenStorage.deleteClientRegistration({ userId, serverName, deleteTokens }),
+            deleteTokens({
+              userId,
+              type: 'mcp_oauth_refresh',
+              identifier: `${identifier}:refresh`,
+            }),
+          ]);
+          for (const r of results) {
+            if (r.status === 'rejected') {
+              logger.warn(`${logPrefix} Failed to clear stale token data`, r.reason);
+            }
+          }
+          throw new ReauthenticationRequiredError(serverName, 'invalid_client');
+        }
+        logger.warn(
+          `${logPrefix} Client registration rejected during token refresh but deleteTokens not available — stale registration cannot be cleared`,
+        );
+      }
+      return null;
+    }
+  }
+
   /**
    * Retrieves OAuth tokens for an MCP server
    */
@@ -323,7 +503,8 @@ export class MCPTokenStorage {
       if (isMissing || isExpired) {
         logger.info(`${logPrefix} Access token ${isMissing ? 'missing' : 'expired'}`);
 
-        /** Refresh data if we have a refresh token and refresh function */
+        /** Probe for a refresh token first so we can throw `ReauthenticationRequiredError`
+         *  when none exists, matching the prior contract. */
         const refreshTokenData = await findToken({
           userId,
           type: 'mcp_oauth_refresh',
@@ -338,131 +519,17 @@ export class MCPTokenStorage {
           throw new ReauthenticationRequiredError(serverName, reason);
         }
 
-        if (!refreshTokens) {
-          logger.warn(
-            `${logPrefix} Access token ${isMissing ? 'missing' : 'expired'}, refresh token available but no \`refreshTokens\` provided`,
-          );
-          return null;
-        }
-
-        if (!createToken) {
-          logger.warn(
-            `${logPrefix} Access token ${isMissing ? 'missing' : 'expired'}, refresh token available but no \`createToken\` function provided`,
-          );
-          return null;
-        }
-
-        try {
-          logger.info(`${logPrefix} Attempting to refresh token`);
-          const decryptedRefreshToken = await decryptV2(refreshTokenData.token);
-
-          let clientInfo;
-          let clientInfoData;
-          let storedTokenEndpoint: string | undefined;
-          let storedAuthMethods: string[] | undefined;
-          try {
-            clientInfoData = await findToken({
-              userId,
-              type: 'mcp_oauth_client',
-              identifier: `${identifier}:client`,
-            });
-            if (clientInfoData) {
-              const decryptedClientInfo = await decryptV2(clientInfoData.token);
-              clientInfo = JSON.parse(decryptedClientInfo);
-              logger.debug(`${logPrefix} Retrieved client info:`, {
-                client_id: clientInfo.client_id,
-                has_client_secret: !!clientInfo.client_secret,
-              });
-
-              if (clientInfoData.metadata) {
-                const raw =
-                  clientInfoData.metadata instanceof Map
-                    ? Object.fromEntries(clientInfoData.metadata)
-                    : (clientInfoData.metadata as Record<string, unknown>);
-                if (typeof raw.token_endpoint === 'string') {
-                  storedTokenEndpoint = raw.token_endpoint;
-                }
-                if (Array.isArray(raw.token_endpoint_auth_methods_supported)) {
-                  storedAuthMethods = raw.token_endpoint_auth_methods_supported as string[];
-                }
-              }
-            }
-          } catch {
-            logger.debug(`${logPrefix} No client info found`);
-          }
-
-          const metadata = {
-            userId,
-            serverName,
-            identifier,
-            clientInfo,
-            storedTokenEndpoint,
-            storedAuthMethods,
-          };
-
-          const newTokens = await refreshTokens(decryptedRefreshToken, metadata);
-
-          logger.debug(`${logPrefix} Refresh completed`, {
-            has_new_access_token: !!newTokens.access_token,
-            has_new_refresh_token: !!newTokens.refresh_token,
-            refresh_token_will_be_rotated: !!newTokens.refresh_token,
-            expires_at: newTokens.expires_at,
-          });
-
-          // Store the refreshed tokens (handles both create and update)
-          // Pass existing token state to avoid duplicate DB calls
-          await this.storeTokens({
-            userId,
-            serverName,
-            tokens: newTokens,
-            createToken,
-            updateToken,
-            findToken,
-            clientInfo,
-            existingTokens: {
-              accessToken: accessTokenData, // We know this is expired/missing
-              refreshToken: refreshTokenData, // We already have this
-              clientInfoToken: clientInfoData, // We already looked this up
-            },
-          });
-
-          logger.info(`${logPrefix} Successfully refreshed and stored OAuth tokens`);
-          return newTokens;
-        } catch (refreshError) {
-          logger.error(`${logPrefix} Failed to refresh tokens`, refreshError);
-          // Check if it's an unauthorized_client error (refresh not supported)
-          const errorMessage =
-            refreshError instanceof Error ? refreshError.message : String(refreshError);
-          if (errorMessage.toLowerCase().includes('unauthorized_client')) {
-            logger.info(
-              `${logPrefix} Server does not support refresh tokens for this client. New authentication required.`,
-            );
-          } else if (isInvalidClientMessage(errorMessage)) {
-            if (deleteTokens) {
-              logger.info(
-                `${logPrefix} Client registration rejected during token refresh, attempting to clear stale registration and refresh token`,
-              );
-              const results = await Promise.allSettled([
-                MCPTokenStorage.deleteClientRegistration({ userId, serverName, deleteTokens }),
-                deleteTokens({
-                  userId,
-                  type: 'mcp_oauth_refresh',
-                  identifier: `${identifier}:refresh`,
-                }),
-              ]);
-              for (const r of results) {
-                if (r.status === 'rejected') {
-                  logger.warn(`${logPrefix} Failed to clear stale token data`, r.reason);
-                }
-              }
-              throw new ReauthenticationRequiredError(serverName, 'invalid_client');
-            }
-            logger.warn(
-              `${logPrefix} Client registration rejected during token refresh but deleteTokens not available — stale registration cannot be cleared`,
-            );
-          }
-          return null;
-        }
+        return await this.forceRefreshTokens({
+          userId,
+          serverName,
+          findToken,
+          createToken,
+          updateToken,
+          deleteTokens,
+          refreshTokens,
+          existingAccessToken: accessTokenData,
+          existingRefreshToken: refreshTokenData,
+        });
       }
 
       // If we reach here, access token should exist and be valid
diff --git a/packages/api/src/mcp/oauth/types.ts b/packages/api/src/mcp/oauth/types.ts
index 7e9d2d24b22..fea8b6a1c5b 100644
--- a/packages/api/src/mcp/oauth/types.ts
+++ b/packages/api/src/mcp/oauth/types.ts
@@ -26,6 +26,11 @@ export interface OAuthMetadata {
   revocation_endpoint_auth_methods_supported?: string[];
 }
 
+export interface OAuthStoredClientMetadata extends OAuthMetadata {
+  /** Canonical OAuth resource indicator used when the authorization code was exchanged. */
+  resource?: string;
+}
+
 export interface OAuthProtectedResourceMetadata {
   /** Resource identifier */
   resource: string;
diff --git a/packages/api/src/mcp/parsers.ts b/packages/api/src/mcp/parsers.ts
index 04065f62ad8..2a653314959 100644
--- a/packages/api/src/mcp/parsers.ts
+++ b/packages/api/src/mcp/parsers.ts
@@ -3,7 +3,7 @@ import { Tools } from 'librechat-data-provider';
 import type { UIResource } from 'librechat-data-provider';
 import type * as t from './types';
 
-export const DEFAULT_MCP_IMAGE_DATA_MAX_BYTES = 10 * 1024 * 1024;
+export const DEFAULT_MCP_IMAGE_DATA_MAX_BYTES: number = 10 * 1024 * 1024;
 
 function generateResourceId(text: string): string {
   return crypto.createHash('sha256').update(text).digest('hex').substring(0, 10);
diff --git a/packages/api/src/mcp/registry/MCPServerInspector.ts b/packages/api/src/mcp/registry/MCPServerInspector.ts
index 2ec4723085b..2f41678d981 100644
--- a/packages/api/src/mcp/registry/MCPServerInspector.ts
+++ b/packages/api/src/mcp/registry/MCPServerInspector.ts
@@ -1,10 +1,16 @@
+import { logger } from '@librechat/data-schemas';
 import { Constants } from 'librechat-data-provider';
 import type { JsonSchemaType } from '@librechat/data-schemas';
 import type { MCPConnection } from '~/mcp/connection';
 import type * as t from '~/mcp/types';
+import {
+  hasCustomUserVars,
+  hasRuntimeContextPlaceholders,
+  hasRuntimeUrlPlaceholders,
+  isUserSourced,
+} from '~/mcp/utils';
 import { isMCPDomainAllowed, extractMCPServerDomain } from '~/auth/domain';
 import { MCPConnectionFactory } from '~/mcp/MCPConnectionFactory';
-import { hasCustomUserVars, isUserSourced } from '~/mcp/utils';
 import { MCPDomainNotAllowedError } from '~/mcp/errors';
 import { detectOAuthRequirement } from '~/mcp/oauth';
 import { isEnabled } from '~/utils';
@@ -63,12 +69,14 @@ export class MCPServerInspector {
   }
 
   private async inspectServer(): Promise<void> {
+    this.warnOnUnrestrictedRuntimeUrl();
     await this.detectOAuth();
 
     if (
       this.config.startup !== false &&
       !this.config.requiresOAuth &&
       !hasCustomUserVars(this.config) &&
+      !hasRuntimeContextPlaceholders(this.config) &&
       !this.config.obo
     ) {
       let tempConnection = false;
@@ -94,8 +102,25 @@ export class MCPServerInspector {
     }
   }
 
+  /**
+   * Runtime placeholders in the URL make the resolved connection target partially
+   * user/request-controlled. The resolved URL is validated against the domain
+   * allowlist at request time, but without one only private-range SSRF protection
+   * limits where it can point.
+   */
+  private warnOnUnrestrictedRuntimeUrl(): void {
+    if (!hasRuntimeUrlPlaceholders(this.config)) return;
+    if (Array.isArray(this.allowedDomains) && this.allowedDomains.length > 0) return;
+
+    logger.warn(
+      `[MCP][${this.serverName}] Server URL contains runtime placeholders but no domain allowlist is configured; ` +
+        'the resolved URL is partially user/request-controlled. Set mcpSettings.allowedDomains to restrict targets.',
+    );
+  }
+
   private async detectOAuth(): Promise<void> {
     if (this.config.requiresOAuth != null) return;
+    if (hasRuntimeUrlPlaceholders(this.config)) return;
     if (this.config.url == null || this.config.startup === false) {
       this.config.requiresOAuth = false;
       return;
diff --git a/packages/api/src/mcp/registry/MCPServersRegistry.ts b/packages/api/src/mcp/registry/MCPServersRegistry.ts
index 6c0e95b6ad2..fa0bdb4e13c 100644
--- a/packages/api/src/mcp/registry/MCPServersRegistry.ts
+++ b/packages/api/src/mcp/registry/MCPServersRegistry.ts
@@ -82,6 +82,28 @@ const CONFIG_SERVER_INIT_TIMEOUT_MS = (() => {
   return Number.isFinite(parsed) && parsed > 0 ? parsed : 30_000;
 })();
 
+/** Request context for resolving the effective MCP allowlists. */
+export interface MCPAllowlistContext {
+  userId?: string;
+  role?: string;
+}
+
+/**
+ * Resolves the effective `mcpSettings` allowlists for a request. Injected from the app
+ * layer (where the merged, tenant-scoped config lives) so the registry keeps no app-config
+ * dependency. Reads the ALS tenant context internally; pass the acting user to also pick up
+ * user/role-scoped overrides.
+ */
+export type MCPAllowlistResolver = (
+  ctx?: MCPAllowlistContext,
+) => Promise<{ allowedDomains?: string[] | null; allowedAddresses?: string[] | null }>;
+
+/** Effective allowlists resolved for a request. */
+interface ResolvedMCPAllowlists {
+  allowedDomains?: string[] | null;
+  allowedAddresses?: string[] | null;
+}
+
 /**
  * Central registry for managing MCP server configurations.
  * Authoritative source of truth for all MCP servers provided by LibreChat.
@@ -99,8 +121,11 @@ export class MCPServersRegistry {
   private readonly dbConfigsRepo: ServerConfigsDB;
   private readonly cacheConfigsRepo: IServerConfigsRepositoryInterface;
   private readonly configCacheRepo: IServerConfigsRepositoryInterface;
+  /** YAML-derived base allowlists; used at boot and as the fallback when no resolver is set. */
   private readonly allowedDomains?: string[] | null;
   private readonly allowedAddresses?: string[] | null;
+  /** Resolves the per-request (tenant-scoped) merged allowlists; falls back to the base above. */
+  private readonly allowlistResolver?: MCPAllowlistResolver;
   private readonly readThroughCache: Keyv<t.ParsedServerConfig>;
   private readonly readThroughCacheAll: Keyv<Record<string, t.ParsedServerConfig>>;
   private readonly pendingGetAllPromises = new Map<
@@ -122,12 +147,14 @@ export class MCPServersRegistry {
     mongoose: typeof import('mongoose'),
     allowedDomains?: string[] | null,
     allowedAddresses?: string[] | null,
+    allowlistResolver?: MCPAllowlistResolver,
   ) {
     this.dbConfigsRepo = new ServerConfigsDB(mongoose);
     this.cacheConfigsRepo = ServerConfigsCacheFactory.create(APP_CACHE_NAMESPACE, false);
     this.configCacheRepo = ServerConfigsCacheFactory.create(CONFIG_CACHE_NAMESPACE, false);
     this.allowedDomains = allowedDomains;
     this.allowedAddresses = allowedAddresses;
+    this.allowlistResolver = allowlistResolver;
 
     const ttl = cacheConfig.MCP_REGISTRY_CACHE_TTL;
 
@@ -147,6 +174,7 @@ export class MCPServersRegistry {
     mongoose: typeof import('mongoose'),
     allowedDomains?: string[] | null,
     allowedAddresses?: string[] | null,
+    allowlistResolver?: MCPAllowlistResolver,
   ): MCPServersRegistry {
     if (!mongoose) {
       throw new Error(
@@ -163,6 +191,7 @@ export class MCPServersRegistry {
       mongoose,
       allowedDomains,
       allowedAddresses,
+      allowlistResolver,
     );
     return MCPServersRegistry.instance;
   }
@@ -175,10 +204,12 @@ export class MCPServersRegistry {
     return MCPServersRegistry.instance;
   }
 
+  /** YAML base allowlist (boot/fallback). For request-time decisions use {@link resolveAllowlists}. */
   public getAllowedDomains(): string[] | null | undefined {
     return this.allowedDomains;
   }
 
+  /** YAML base allowlist (boot/fallback). For request-time decisions use {@link resolveAllowlists}. */
   public getAllowedAddresses(): string[] | null | undefined {
     return this.allowedAddresses;
   }
@@ -188,6 +219,43 @@ export class MCPServersRegistry {
     return !Array.isArray(this.allowedDomains) || this.allowedDomains.length === 0;
   }
 
+  /**
+   * Resolves the effective domain/address allowlists for the current request.
+   *
+   * MCP allowlists live in `mcpSettings`, which is tenant/principal-scoped admin config, so
+   * they must be read per-request from the merged config — not from a process-global value
+   * that would leak across tenants. The injected resolver reads the ALS tenant context; pass
+   * the acting user so user/role-scoped overrides resolve too (config-source inspection has no
+   * user and resolves at tenant scope). Falls back to the YAML base allowlists when no resolver
+   * is injected or the resolver fails, so a transient lookup error fails to the operator's
+   * baseline rather than disabling the allowlist.
+   */
+  public async resolveAllowlists(ctx?: MCPAllowlistContext): Promise<{
+    allowedDomains?: string[] | null;
+    allowedAddresses?: string[] | null;
+    useSSRFProtection: boolean;
+  }> {
+    let allowedDomains = this.allowedDomains;
+    let allowedAddresses = this.allowedAddresses;
+    if (this.allowlistResolver) {
+      try {
+        const resolved = await this.allowlistResolver(ctx);
+        allowedDomains = resolved.allowedDomains;
+        allowedAddresses = resolved.allowedAddresses;
+      } catch (error) {
+        logger.warn(
+          '[MCPServersRegistry] Allowlist resolver failed; falling back to YAML base allowlists',
+          error,
+        );
+      }
+    }
+    return {
+      allowedDomains,
+      allowedAddresses,
+      useSSRFProtection: !Array.isArray(allowedDomains) || allowedDomains.length === 0,
+    };
+  }
+
   /**
    * Returns the config for a single server, mirroring the precedence used by
    * getAllServerConfigs so list views and single-server lookups agree on
@@ -339,14 +407,17 @@ export class MCPServersRegistry {
     reservedServerNames?: Iterable<string>,
   ): Promise<t.AddServerResult> {
     const configRepo = this.getConfigRepository(storageLocation);
+    const source = (storageLocation === 'CACHE' ? 'yaml' : 'user') as t.MCPServerSource;
+    const configForInspection = { ...config, source } as t.ParsedServerConfig;
+    const { allowedDomains, allowedAddresses } = await this.resolveAllowlists({ userId });
     let parsedConfig: t.ParsedServerConfig;
     try {
       parsedConfig = await MCPServerInspector.inspect(
         serverName,
-        config,
+        configForInspection,
         undefined,
-        this.allowedDomains,
-        this.allowedAddresses,
+        allowedDomains,
+        allowedAddresses,
       );
     } catch (error) {
       logger.error(`[MCPServersRegistry] Failed to inspect server "${serverName}":`, error);
@@ -357,7 +428,7 @@ export class MCPServersRegistry {
     }
     const tagged = {
       ...parsedConfig,
-      source: (storageLocation === 'CACHE' ? 'yaml' : 'user') as t.MCPServerSource,
+      source,
     };
     const result =
       storageLocation === 'DB'
@@ -396,14 +467,15 @@ export class MCPServersRegistry {
     }
 
     const { inspectionFailed: _, ...configForInspection } = existing;
+    const { allowedDomains, allowedAddresses } = await this.resolveAllowlists({ userId });
     let parsedConfig: t.ParsedServerConfig;
     try {
       parsedConfig = await MCPServerInspector.inspect(
         serverName,
         configForInspection,
         undefined,
-        this.allowedDomains,
-        this.allowedAddresses,
+        allowedDomains,
+        allowedAddresses,
       );
     } catch (error) {
       logger.error(`[MCPServersRegistry] Reinspection failed for server "${serverName}":`, error);
@@ -426,6 +498,7 @@ export class MCPServersRegistry {
     userId?: string,
   ): Promise<t.ParsedServerConfig> {
     const configRepo = this.getConfigRepository(storageLocation);
+    const source = (storageLocation === 'CACHE' ? 'yaml' : 'user') as t.MCPServerSource;
 
     // Merge existing admin API key if not provided in update (needed for inspection)
     let configForInspection = { ...config };
@@ -442,14 +515,15 @@ export class MCPServersRegistry {
       }
     }
 
+    const { allowedDomains, allowedAddresses } = await this.resolveAllowlists({ userId });
     let parsedConfig: t.ParsedServerConfig;
     try {
       parsedConfig = await MCPServerInspector.inspect(
         serverName,
-        configForInspection,
+        { ...configForInspection, source } as t.ParsedServerConfig,
         undefined,
-        this.allowedDomains,
-        this.allowedAddresses,
+        allowedDomains,
+        allowedAddresses,
       );
     } catch (error) {
       logger.error(`[MCPServersRegistry] Failed to inspect server "${serverName}":`, error);
@@ -480,6 +554,12 @@ export class MCPServersRegistry {
 
     const result: Record<string, t.ParsedServerConfig> = {};
 
+    // Config-source servers are admin-defined with no acting user; resolve the effective
+    // allowlists once at tenant scope and fold them into each config-cache key so a tenant
+    // whose allowlist rejects a URL cannot poison the shared key for a tenant that allows it.
+    const { allowedDomains, allowedAddresses } = await this.resolveAllowlists();
+    const allowlists: ResolvedMCPAllowlists = { allowedDomains, allowedAddresses };
+
     /** Single snapshot of the YAML cache for the whole pass: in the Redis aggregate-key backend, every per-name get() reads and deserializes the full map, so N concurrent per-server lookups would issue N full-map reads. The snapshot also keeps the unchanged-YAML comparison consistent against one view of YAML across all entries. */
     const yamlSnapshot = await this.cacheConfigsRepo.getAll();
 
@@ -488,7 +568,7 @@ export class MCPServersRegistry {
         if (this.isUnmodifiedYamlServer(yamlSnapshot, serverName, rawConfig)) {
           return;
         }
-        const parsed = await this.ensureSingleConfigServer(serverName, rawConfig);
+        const parsed = await this.ensureSingleConfigServer(serverName, rawConfig, allowlists);
         if (parsed) {
           result[serverName] = parsed;
         }
@@ -537,8 +617,9 @@ export class MCPServersRegistry {
   private async ensureSingleConfigServer(
     serverName: string,
     rawConfig: t.MCPOptions,
+    allowlists: ResolvedMCPAllowlists,
   ): Promise<t.ParsedServerConfig | undefined> {
-    const cacheKey = this.configCacheKey(serverName, rawConfig);
+    const cacheKey = this.configCacheKey(serverName, rawConfig, allowlists);
 
     const cached = await this.configCacheRepo.get(cacheKey);
     if (cached) {
@@ -555,7 +636,7 @@ export class MCPServersRegistry {
       return pending;
     }
 
-    const initPromise = this.lazyInitConfigServer(cacheKey, serverName, rawConfig);
+    const initPromise = this.lazyInitConfigServer(cacheKey, serverName, rawConfig, allowlists);
     this.pendingConfigInits.set(cacheKey, initPromise);
 
     try {
@@ -573,18 +654,24 @@ export class MCPServersRegistry {
     cacheKey: string,
     serverName: string,
     rawConfig: t.MCPOptions,
+    allowlists: ResolvedMCPAllowlists,
   ): Promise<t.ParsedServerConfig | undefined> {
     const prefix = `[MCP][config][${serverName}]`;
     logger.info(`${prefix} Lazy-initializing config-source server`);
 
     try {
+      const configForInspection = {
+        ...rawConfig,
+        source: 'config' as const,
+      } as t.ParsedServerConfig;
+      const { allowedDomains, allowedAddresses } = allowlists;
       const inspected = await withTimeout(
         MCPServerInspector.inspect(
           serverName,
-          rawConfig,
+          configForInspection,
           undefined,
-          this.allowedDomains,
-          this.allowedAddresses,
+          allowedDomains,
+          allowedAddresses,
         ),
         CONFIG_SERVER_INIT_TIMEOUT_MS,
         `${prefix} Server initialization timed out`,
@@ -780,12 +867,24 @@ export class MCPServersRegistry {
   }
 
   /**
-   * Produces a config-cache key scoped by server name AND a hash of the raw config.
-   * Prevents cross-tenant cache poisoning when two tenants define the same server name
-   * with different configurations.
+   * Produces a config-cache key scoped by server name AND a hash of the raw config plus the
+   * effective allowlists. Hashing the raw config prevents cross-tenant poisoning when two
+   * tenants define the same server name with different configurations; hashing the allowlists
+   * prevents poisoning when the same config resolves differently because tenants have different
+   * `mcpSettings.allowedDomains` / `allowedAddresses` (so one tenant's inspection result — e.g.
+   * an `inspectionFailed` stub from a rejected domain — never satisfies another tenant's lookup).
    */
-  private configCacheKey(serverName: string, rawConfig: t.MCPOptions): string {
-    const sorted = JSON.stringify(rawConfig, (_key, value: unknown) => {
+  private configCacheKey(
+    serverName: string,
+    rawConfig: t.MCPOptions,
+    allowlists?: ResolvedMCPAllowlists,
+  ): string {
+    const payload = {
+      rawConfig,
+      allowedDomains: allowlists?.allowedDomains ?? null,
+      allowedAddresses: allowlists?.allowedAddresses ?? null,
+    };
+    const sorted = JSON.stringify(payload, (_key, value: unknown) => {
       if (value !== null && typeof value === 'object' && !Array.isArray(value)) {
         return Object.fromEntries(
           Object.entries(value as Record<string, unknown>).sort(([a], [b]) => a.localeCompare(b)),
diff --git a/packages/api/src/mcp/registry/__tests__/MCPServerInspector.test.ts b/packages/api/src/mcp/registry/__tests__/MCPServerInspector.test.ts
index 3937d700f06..dd64c3e5bd0 100644
--- a/packages/api/src/mcp/registry/__tests__/MCPServerInspector.test.ts
+++ b/packages/api/src/mcp/registry/__tests__/MCPServerInspector.test.ts
@@ -148,6 +148,52 @@ describe('MCPServerInspector', () => {
       expect(result.toolFunctions).toBeUndefined();
     });
 
+    it('should skip capabilities fetch when trusted config needs runtime user context', async () => {
+      mockDetectOAuthRequirement.mockResolvedValue({
+        requiresOAuth: false,
+        method: 'no-metadata-found',
+      });
+
+      const rawConfig: t.MCPOptions = {
+        type: 'streamable-http',
+        url: 'https://mcp-server.example.com/mcp',
+        headers: {
+          'X-LibreChat-User-Email': '{{LIBRECHAT_USER_EMAIL}}',
+        },
+      };
+
+      const result = await MCPServerInspector.inspect('test_server', rawConfig);
+
+      expect(result).toEqual({
+        type: 'streamable-http',
+        url: 'https://mcp-server.example.com/mcp',
+        headers: {
+          'X-LibreChat-User-Email': '{{LIBRECHAT_USER_EMAIL}}',
+        },
+        requiresOAuth: false,
+        oauthMetadata: undefined,
+        initDuration: expect.any(Number),
+      });
+      expect(MCPConnectionFactory.create).not.toHaveBeenCalled();
+    });
+
+    it('should skip OAuth detection when trusted URL needs runtime user context', async () => {
+      const rawConfig: t.MCPOptions = {
+        type: 'streamable-http',
+        url: 'https://mcp-server.example.com/users/{{LIBRECHAT_USER_USERNAME}}/mcp',
+      };
+
+      const result = await MCPServerInspector.inspect('test_server', rawConfig);
+
+      expect(result).toEqual({
+        type: 'streamable-http',
+        url: 'https://mcp-server.example.com/users/{{LIBRECHAT_USER_USERNAME}}/mcp',
+        initDuration: expect.any(Number),
+      });
+      expect(mockDetectOAuthRequirement).not.toHaveBeenCalled();
+      expect(MCPConnectionFactory.create).not.toHaveBeenCalled();
+    });
+
     it('should skip capabilities fetch when obo is configured', async () => {
       // OBO servers mint per-user delegated tokens at tool-call time; an
       // unauthenticated probe at inspection has no valid bearer to attach,
diff --git a/packages/api/src/mcp/registry/__tests__/MCPServersInitializer.cache_integration.spec.ts b/packages/api/src/mcp/registry/__tests__/MCPServersInitializer.cache_integration.spec.ts
index 12d2c9091fc..11b7d0cbb96 100644
--- a/packages/api/src/mcp/registry/__tests__/MCPServersInitializer.cache_integration.spec.ts
+++ b/packages/api/src/mcp/registry/__tests__/MCPServersInitializer.cache_integration.spec.ts
@@ -1,6 +1,8 @@
-import type * as t from '~/mcp/types';
-import type { MCPConnection } from '~/mcp/connection';
 import type { MCPServersRegistry as MCPServersRegistryType } from '../MCPServersRegistry';
+import type { RedisClientsModule } from '~/cache/__tests__/redisClients.helper';
+import type { MCPConnection } from '~/mcp/connection';
+import type * as t from '~/mcp/types';
+import { closeRedisClients } from '~/cache/__tests__/redisClients.helper';
 
 // Mock isLeader to always return true to avoid lock contention during parallel operations
 jest.mock('~/cluster', () => ({
@@ -28,6 +30,7 @@ describe('MCPServersInitializer Redis Integration Tests', () => {
   let MCPServerInspector: typeof import('../MCPServerInspector').MCPServerInspector;
   let MCPConnectionFactory: typeof import('~/mcp/MCPConnectionFactory').MCPConnectionFactory;
   let keyvRedisClient: Awaited<typeof import('~/cache/redisClients')>['keyvRedisClient'];
+  let redisClientsModule: RedisClientsModule;
   let LeaderElection: typeof import('~/cluster/LeaderElection').LeaderElection;
   let leaderInstance: InstanceType<typeof import('~/cluster/LeaderElection').LeaderElection>;
 
@@ -146,6 +149,7 @@ describe('MCPServersInitializer Redis Integration Tests', () => {
     MCPServerInspector = inspectorModule.MCPServerInspector;
     MCPConnectionFactory = connectionFactoryModule.MCPConnectionFactory;
     keyvRedisClient = redisClients.keyvRedisClient;
+    redisClientsModule = redisClients;
     LeaderElection = leaderElectionModule.LeaderElection;
 
     // Reset singleton and create new instance with mongoose
@@ -232,8 +236,9 @@ describe('MCPServersInitializer Redis Integration Tests', () => {
     // Resign as leader
     if (leaderInstance) await leaderInstance.resign();
 
-    // Close Redis connection
-    if (keyvRedisClient?.isOpen) await keyvRedisClient.disconnect();
+    // Close both Redis clients; pass the captured module since
+    // `jest.resetModules()` in beforeEach dropped it from the registry
+    await closeRedisClients(redisClientsModule);
   });
 
   describe('initialize()', () => {
diff --git a/packages/api/src/mcp/registry/__tests__/MCPServersInitializer.test.ts b/packages/api/src/mcp/registry/__tests__/MCPServersInitializer.test.ts
index 1e705cb79b7..8964c15c194 100644
--- a/packages/api/src/mcp/registry/__tests__/MCPServersInitializer.test.ts
+++ b/packages/api/src/mcp/registry/__tests__/MCPServersInitializer.test.ts
@@ -1,12 +1,12 @@
 import { logger } from '@librechat/data-schemas';
-import * as t from '~/mcp/types';
-import { isLeader } from '~/cluster';
 import { registryStatusCache } from '~/mcp/registry/cache/RegistryStatusCache';
 import { MCPServersInitializer } from '~/mcp/registry/MCPServersInitializer';
 import { MCPServerInspector } from '~/mcp/registry/MCPServerInspector';
 import { MCPServersRegistry } from '~/mcp/registry/MCPServersRegistry';
 import { MCPConnectionFactory } from '~/mcp/MCPConnectionFactory';
 import { MCPConnection } from '~/mcp/connection';
+import { isLeader } from '~/cluster';
+import * as t from '~/mcp/types';
 
 const FIXED_TIME = 1699564800000;
 const originalDateNow = Date.now;
@@ -367,35 +367,35 @@ describe('MCPServersInitializer', () => {
       expect(mockInspect).toHaveBeenCalledTimes(5);
       expect(mockInspect).toHaveBeenCalledWith(
         'disabled_server',
-        testConfigs.disabled_server,
+        { ...testConfigs.disabled_server, source: 'yaml' },
         undefined,
         undefined,
         undefined,
       );
       expect(mockInspect).toHaveBeenCalledWith(
         'oauth_server',
-        testConfigs.oauth_server,
+        { ...testConfigs.oauth_server, source: 'yaml' },
         undefined,
         undefined,
         undefined,
       );
       expect(mockInspect).toHaveBeenCalledWith(
         'file_tools_server',
-        testConfigs.file_tools_server,
+        { ...testConfigs.file_tools_server, source: 'yaml' },
         undefined,
         undefined,
         undefined,
       );
       expect(mockInspect).toHaveBeenCalledWith(
         'search_tools_server',
-        testConfigs.search_tools_server,
+        { ...testConfigs.search_tools_server, source: 'yaml' },
         undefined,
         undefined,
         undefined,
       );
       expect(mockInspect).toHaveBeenCalledWith(
         'remote_no_oauth_server',
-        testConfigs.remote_no_oauth_server,
+        { ...testConfigs.remote_no_oauth_server, source: 'yaml' },
         undefined,
         undefined,
         undefined,
diff --git a/packages/api/src/mcp/registry/__tests__/MCPServersRegistry.cache_integration.spec.ts b/packages/api/src/mcp/registry/__tests__/MCPServersRegistry.cache_integration.spec.ts
index 7752ff57d22..7b77a064b89 100644
--- a/packages/api/src/mcp/registry/__tests__/MCPServersRegistry.cache_integration.spec.ts
+++ b/packages/api/src/mcp/registry/__tests__/MCPServersRegistry.cache_integration.spec.ts
@@ -1,6 +1,7 @@
 import { expect } from '@playwright/test';
-import type * as t from '~/mcp/types';
 import type { MCPServersRegistry as MCPServersRegistryType } from '../MCPServersRegistry';
+import type * as t from '~/mcp/types';
+import { closeRedisClients } from '~/cache/__tests__/redisClients.helper';
 
 // Mock ServerConfigsDB to avoid needing MongoDB for cache integration tests
 jest.mock('../db/ServerConfigsDB', () => ({
@@ -137,8 +138,8 @@ describe('MCPServersRegistry Redis Integration Tests', () => {
     // Resign as leader
     if (leaderInstance) await leaderInstance.resign();
 
-    // Close Redis connection
-    if (keyvRedisClient?.isOpen) await keyvRedisClient.disconnect();
+    // Close both Redis clients created by the module import
+    await closeRedisClients();
   });
 
   // Tests for the old privateServersCache API have been removed
diff --git a/packages/api/src/mcp/registry/__tests__/MCPServersRegistry.test.ts b/packages/api/src/mcp/registry/__tests__/MCPServersRegistry.test.ts
index b1a86864b0f..cf0b18a7392 100644
--- a/packages/api/src/mcp/registry/__tests__/MCPServersRegistry.test.ts
+++ b/packages/api/src/mcp/registry/__tests__/MCPServersRegistry.test.ts
@@ -1,5 +1,5 @@
-import type * as t from '~/mcp/types';
 import { logger } from '@librechat/data-schemas';
+import type * as t from '~/mcp/types';
 import { MCPServersRegistry } from '~/mcp/registry/MCPServersRegistry';
 import { MCPServerInspector } from '~/mcp/registry/MCPServerInspector';
 
@@ -164,6 +164,36 @@ describe('MCPServersRegistry', () => {
   });
 
   describe('addServer', () => {
+    it('should pass user source to inspector before storing DB servers', async () => {
+      const inspectSpy = jest.spyOn(MCPServerInspector, 'inspect');
+
+      await registry.addServer(
+        'user_runtime_server',
+        {
+          type: 'streamable-http',
+          url: 'https://api.example.com/mcp',
+          headers: {
+            'X-LibreChat-User-Email': '{{LIBRECHAT_USER_EMAIL}}',
+          },
+        },
+        'DB',
+        'user-1',
+      );
+
+      expect(inspectSpy).toHaveBeenCalledWith(
+        'user_runtime_server',
+        expect.objectContaining({
+          source: 'user',
+          headers: {
+            'X-LibreChat-User-Email': '{{LIBRECHAT_USER_EMAIL}}',
+          },
+        }),
+        undefined,
+        undefined,
+        undefined,
+      );
+    });
+
     it('should reserve YAML and current config server names when creating DB servers', async () => {
       await registry.addServer('slack', { ...testParsedConfig, title: 'Slack' }, 'CACHE');
       await registry['configCacheRepo'].upsert('other_tenant:hash', {
@@ -190,6 +220,114 @@ describe('MCPServersRegistry', () => {
     });
   });
 
+  describe('resolveAllowlists (per-request, tenant-scoped)', () => {
+    const createWith = (
+      allowedDomains?: string[] | null,
+      allowedAddresses?: string[] | null,
+      resolver?: (ctx?: { userId?: string; role?: string }) => Promise<{
+        allowedDomains?: string[] | null;
+        allowedAddresses?: string[] | null;
+      }>,
+    ): MCPServersRegistry => {
+      (MCPServersRegistry as unknown as { instance: undefined }).instance = undefined;
+      MCPServersRegistry.createInstance(mockMongoose, allowedDomains, allowedAddresses, resolver);
+      return MCPServersRegistry.getInstance();
+    };
+
+    it('returns the YAML base allowlists when no resolver is injected', async () => {
+      const reg = createWith(['yaml.com'], ['10.0.0.0/8']);
+      await expect(reg.resolveAllowlists()).resolves.toEqual({
+        allowedDomains: ['yaml.com'],
+        allowedAddresses: ['10.0.0.0/8'],
+        useSSRFProtection: false,
+      });
+    });
+
+    it('enables SSRF protection when the effective allowlist is empty', async () => {
+      const reg = createWith(undefined, undefined);
+      await expect(reg.resolveAllowlists()).resolves.toEqual({
+        allowedDomains: undefined,
+        allowedAddresses: undefined,
+        useSSRFProtection: true,
+      });
+    });
+
+    it('returns the resolver-provided merged allowlists and forwards the context', async () => {
+      const resolver = jest.fn().mockResolvedValue({
+        allowedDomains: ['admin-added.com'],
+        allowedAddresses: ['172.16.0.0/12'],
+      });
+      const reg = createWith(['yaml.com'], null, resolver);
+
+      const result = await reg.resolveAllowlists({ userId: 'u1', role: 'ADMIN' });
+
+      expect(resolver).toHaveBeenCalledWith({ userId: 'u1', role: 'ADMIN' });
+      expect(result).toEqual({
+        allowedDomains: ['admin-added.com'],
+        allowedAddresses: ['172.16.0.0/12'],
+        useSSRFProtection: false,
+      });
+    });
+
+    it('falls back to the YAML base allowlists when the resolver throws', async () => {
+      const resolver = jest.fn().mockRejectedValue(new Error('DB down'));
+      const reg = createWith(['yaml.com'], null, resolver);
+
+      await expect(reg.resolveAllowlists()).resolves.toEqual({
+        allowedDomains: ['yaml.com'],
+        allowedAddresses: null,
+        useSSRFProtection: false,
+      });
+    });
+
+    it('inspects against the resolved (admin-panel) allowlist, not the YAML base', async () => {
+      const resolver = jest.fn().mockResolvedValue({
+        allowedDomains: ['admin-added.com'],
+        allowedAddresses: ['10.0.0.0/8'],
+      });
+      const reg = createWith(['yaml-only.com'], null, resolver);
+      const inspectSpy = jest.spyOn(MCPServerInspector, 'inspect');
+      await reg.reset();
+
+      await reg.addServer(
+        'admin_panel_server',
+        { type: 'streamable-http', url: 'https://admin-added.com/mcp' },
+        'DB',
+        'user-1',
+      );
+
+      expect(resolver).toHaveBeenCalledWith({ userId: 'user-1' });
+      expect(inspectSpy).toHaveBeenCalledWith(
+        'admin_panel_server',
+        expect.objectContaining({ url: 'https://admin-added.com/mcp' }),
+        undefined,
+        ['admin-added.com'],
+        ['10.0.0.0/8'],
+      );
+    });
+
+    it('scopes the config-source cache key by the resolved allowlist (no cross-tenant poison)', async () => {
+      const resolver = jest
+        .fn()
+        .mockResolvedValueOnce({ allowedDomains: ['a.com'], allowedAddresses: null })
+        .mockResolvedValueOnce({ allowedDomains: ['b.com'], allowedAddresses: null });
+      const reg = createWith(null, null, resolver);
+      const inspectSpy = jest.spyOn(MCPServerInspector, 'inspect');
+      await reg.reset();
+      inspectSpy.mockClear();
+
+      const cfg = {
+        srv: { type: 'streamable-http' as const, url: 'https://srv.example.com/mcp' },
+      };
+      await reg.ensureConfigServers(cfg); // resolver call 1 → allowlist A
+      await reg.ensureConfigServers(cfg); // resolver call 2 → allowlist B (distinct key)
+
+      // Different resolved allowlists ⇒ different cache keys ⇒ the second pass re-inspects
+      // instead of reusing the first allowlist's cached entry.
+      expect(inspectSpy).toHaveBeenCalledTimes(2);
+    });
+  });
+
   describe('reset', () => {
     it('should clear all servers from cache repository', async () => {
       // Add servers to cache using the new API
@@ -488,7 +626,10 @@ describe('MCPServersRegistry', () => {
       expect(inspectSpy).toHaveBeenCalledTimes(1);
       expect(inspectSpy).toHaveBeenCalledWith(
         'config-only-server',
-        configOnlyRawConfig,
+        {
+          ...configOnlyRawConfig,
+          source: 'config',
+        },
         undefined,
         undefined,
         undefined,
diff --git a/packages/api/src/mcp/registry/__tests__/ensureConfigServers.test.ts b/packages/api/src/mcp/registry/__tests__/ensureConfigServers.test.ts
index 5db4218a27d..933ff7cec2a 100644
--- a/packages/api/src/mcp/registry/__tests__/ensureConfigServers.test.ts
+++ b/packages/api/src/mcp/registry/__tests__/ensureConfigServers.test.ts
@@ -102,7 +102,7 @@ describe('MCPServersRegistry — ensureConfigServers', () => {
     expect(inspectSpy).toHaveBeenCalledTimes(1);
     expect(inspectSpy).toHaveBeenCalledWith(
       'config_server',
-      sseConfig,
+      { ...sseConfig, source: 'config' },
       undefined,
       undefined,
       undefined,
@@ -195,7 +195,7 @@ describe('MCPServersRegistry — ensureConfigServers', () => {
     expect(inspectSpy).toHaveBeenCalledTimes(1);
     expect(inspectSpy).toHaveBeenCalledWith(
       'my_server',
-      sseConfig,
+      { ...sseConfig, source: 'config' },
       undefined,
       undefined,
       undefined,
diff --git a/packages/api/src/mcp/registry/cache/RegistryStatusCache.ts b/packages/api/src/mcp/registry/cache/RegistryStatusCache.ts
index 41e35ae99e8..87d54fc3621 100644
--- a/packages/api/src/mcp/registry/cache/RegistryStatusCache.ts
+++ b/packages/api/src/mcp/registry/cache/RegistryStatusCache.ts
@@ -1,5 +1,6 @@
-import { standardCache } from '~/cache';
+import Keyv from 'keyv';
 import { BaseRegistryCache } from './BaseRegistryCache';
+import { standardCache } from '~/cache';
 
 // Status keys
 const INITIALIZED = 'INITIALIZED';
@@ -19,7 +20,7 @@ type StatusSetOptions = {
  * This cache is only meant to be used internally by registry management components.
  */
 class RegistryStatusCache extends BaseRegistryCache {
-  protected readonly cache = standardCache(`${this.PREFIX}::Status`);
+  protected readonly cache: Keyv = standardCache(`${this.PREFIX}::Status`);
 
   public async isInitialized(): Promise<boolean> {
     return (await this.get(INITIALIZED)) === true;
@@ -65,4 +66,4 @@ class RegistryStatusCache extends BaseRegistryCache {
   }
 }
 
-export const registryStatusCache = new RegistryStatusCache();
+export const registryStatusCache: RegistryStatusCache = new RegistryStatusCache();
diff --git a/packages/api/src/mcp/registry/cache/__tests__/RegistryStatusCache.cache_integration.spec.ts b/packages/api/src/mcp/registry/cache/__tests__/RegistryStatusCache.cache_integration.spec.ts
index 3cfd7f35786..2530e9a0f0e 100644
--- a/packages/api/src/mcp/registry/cache/__tests__/RegistryStatusCache.cache_integration.spec.ts
+++ b/packages/api/src/mcp/registry/cache/__tests__/RegistryStatusCache.cache_integration.spec.ts
@@ -1,4 +1,5 @@
 import { expect } from '@playwright/test';
+import { closeRedisClients } from '~/cache/__tests__/redisClients.helper';
 
 describe('RegistryStatusCache Integration Tests', () => {
   let registryStatusCache: typeof import('../RegistryStatusCache').registryStatusCache;
@@ -56,8 +57,8 @@ describe('RegistryStatusCache Integration Tests', () => {
     // Resign as leader
     if (leaderInstance) await leaderInstance.resign();
 
-    // Close Redis connection
-    if (keyvRedisClient?.isOpen) await keyvRedisClient.disconnect();
+    // Close both Redis clients created by the module import
+    await closeRedisClients();
   });
 
   describe('Initialization status tracking', () => {
diff --git a/packages/api/src/mcp/registry/cache/__tests__/ServerConfigsCacheRedis.cache_integration.spec.ts b/packages/api/src/mcp/registry/cache/__tests__/ServerConfigsCacheRedis.cache_integration.spec.ts
index 4e563ab4aa0..c853becb18c 100644
--- a/packages/api/src/mcp/registry/cache/__tests__/ServerConfigsCacheRedis.cache_integration.spec.ts
+++ b/packages/api/src/mcp/registry/cache/__tests__/ServerConfigsCacheRedis.cache_integration.spec.ts
@@ -1,9 +1,12 @@
 import { expect } from '@playwright/test';
+import type { RedisClientsModule } from '~/cache/__tests__/redisClients.helper';
+import { closeRedisClients } from '~/cache/__tests__/redisClients.helper';
 import { ParsedServerConfig } from '~/mcp/types';
 
 describe('ServerConfigsCacheRedis Integration Tests', () => {
   let ServerConfigsCacheRedis: typeof import('../ServerConfigsCacheRedis').ServerConfigsCacheRedis;
   let keyvRedisClient: Awaited<typeof import('~/cache/redisClients')>['keyvRedisClient'];
+  let redisClientsModule: RedisClientsModule;
 
   let cache: InstanceType<typeof import('../ServerConfigsCacheRedis').ServerConfigsCacheRedis>;
 
@@ -43,6 +46,7 @@ describe('ServerConfigsCacheRedis Integration Tests', () => {
 
     ServerConfigsCacheRedis = cacheModule.ServerConfigsCacheRedis;
     keyvRedisClient = redisClients.keyvRedisClient;
+    redisClientsModule = redisClients;
 
     // Ensure Redis is connected
     if (!keyvRedisClient) throw new Error('Redis client is not initialized');
@@ -75,8 +79,9 @@ describe('ServerConfigsCacheRedis Integration Tests', () => {
   });
 
   afterAll(async () => {
-    // Close Redis connection
-    if (keyvRedisClient?.isOpen) await keyvRedisClient.disconnect();
+    // Close both Redis clients; pass the captured module since
+    // `jest.resetModules()` in beforeEach dropped it from the registry
+    await closeRedisClients(redisClientsModule);
   });
 
   describe('add and get operations', () => {
diff --git a/packages/api/src/mcp/registry/cache/__tests__/ServerConfigsCacheRedisAggregateKey.cache_integration.spec.ts b/packages/api/src/mcp/registry/cache/__tests__/ServerConfigsCacheRedisAggregateKey.cache_integration.spec.ts
index 4ec30187a28..2cc7f159eda 100644
--- a/packages/api/src/mcp/registry/cache/__tests__/ServerConfigsCacheRedisAggregateKey.cache_integration.spec.ts
+++ b/packages/api/src/mcp/registry/cache/__tests__/ServerConfigsCacheRedisAggregateKey.cache_integration.spec.ts
@@ -1,5 +1,6 @@
 import { expect } from '@playwright/test';
 import type { ParsedServerConfig } from '~/mcp/types';
+import { closeRedisClients } from '~/cache/__tests__/redisClients.helper';
 
 describe('ServerConfigsCacheRedisAggregateKey Integration Tests', () => {
   let ServerConfigsCacheRedisAggregateKey: typeof import('../ServerConfigsCacheRedisAggregateKey').ServerConfigsCacheRedisAggregateKey;
@@ -56,7 +57,7 @@ describe('ServerConfigsCacheRedisAggregateKey Integration Tests', () => {
   });
 
   afterAll(async () => {
-    if (keyvRedisClient?.isOpen) await keyvRedisClient.disconnect();
+    await closeRedisClients();
   });
 
   describe('add and get operations', () => {
@@ -253,8 +254,7 @@ describe('ServerConfigsCacheRedisAggregateKey Integration Tests', () => {
       await cache.getAll();
 
       // Spy on the underlying Keyv cache to count Redis calls
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      const cacheGetSpy = jest.spyOn((cache as any).cache, 'get');
+      const cacheGetSpy = jest.spyOn(cache['cache'], 'get');
 
       await cache.getAll();
       await cache.getAll();
@@ -324,11 +324,9 @@ describe('ServerConfigsCacheRedisAggregateKey Integration Tests', () => {
       await cache.getAll(); // prime snapshot
 
       // Force-expire the snapshot without sleeping
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      (cache as any).localSnapshotExpiry = Date.now() - 1;
+      cache['localSnapshotExpiry'] = Date.now() - 1;
 
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      const cacheGetSpy = jest.spyOn((cache as any).cache, 'get');
+      const cacheGetSpy = jest.spyOn(cache['cache'], 'get');
       const result = await cache.getAll();
       expect(cacheGetSpy.mock.calls).toHaveLength(1);
       expect(Object.keys(result).length).toBe(1);
diff --git a/packages/api/src/mcp/request.ts b/packages/api/src/mcp/request.ts
new file mode 100644
index 00000000000..834283a01be
--- /dev/null
+++ b/packages/api/src/mcp/request.ts
@@ -0,0 +1,163 @@
+import { logger } from '@librechat/data-schemas';
+
+import type { RequestScopedMCPConnectionStore } from './types';
+
+export interface MCPRequestContext extends RequestScopedMCPConnectionStore {
+  cleanupStarted: boolean;
+  cleanupOnResponse: boolean;
+  responseCleanupAttached: boolean;
+}
+
+export interface MCPRequestContextOptions {
+  cleanupOnResponse?: boolean;
+}
+
+interface MCPResponseLike {
+  writableEnded?: boolean;
+  finished?: boolean;
+  destroyed?: boolean;
+  once?: (event: 'finish' | 'close', listener: () => void) => unknown;
+}
+
+interface Disconnectable {
+  disconnect: () => Promise<unknown> | unknown;
+}
+
+const contexts = new WeakMap<object, MCPRequestContext>();
+
+export function createMCPRequestContext(): MCPRequestContext {
+  return {
+    connections: new Map<string, unknown>(),
+    pending: new Map<string, Promise<unknown>>(),
+    cleanupStarted: false,
+    cleanupOnResponse: true,
+    responseCleanupAttached: false,
+  };
+}
+
+function isDisconnectable(value: unknown): value is Disconnectable {
+  return (
+    value != null &&
+    typeof value === 'object' &&
+    'disconnect' in value &&
+    typeof value.disconnect === 'function'
+  );
+}
+
+export async function cleanupMCPRequestContext(context?: MCPRequestContext): Promise<void> {
+  if (!context || context.cleanupStarted) {
+    return;
+  }
+  context.cleanupStarted = true;
+
+  const connections = new Set<Disconnectable>();
+  for (const connection of context.connections.values()) {
+    if (isDisconnectable(connection)) {
+      connections.add(connection);
+    }
+  }
+
+  const pending = Array.from(context.pending.values());
+  if (pending.length > 0) {
+    const settled = await Promise.allSettled(pending);
+    for (const result of settled) {
+      if (result.status === 'fulfilled' && isDisconnectable(result.value)) {
+        connections.add(result.value);
+      }
+    }
+  }
+
+  await Promise.allSettled(
+    Array.from(connections).map(async (connection) => {
+      try {
+        await connection.disconnect();
+      } catch (error) {
+        logger.warn('[MCP Request Context] Failed to disconnect request-scoped connection', error);
+      }
+    }),
+  );
+
+  context.connections.clear();
+  context.pending.clear();
+}
+
+function isResponseFinished(res?: MCPResponseLike): boolean {
+  return Boolean(res?.writableEnded || res?.finished || res?.destroyed);
+}
+
+function runCleanup(context: MCPRequestContext): void {
+  cleanupMCPRequestContext(context).catch((error) => {
+    logger.warn('[MCP Request Context] Cleanup failed', error);
+  });
+}
+
+function attachResponseCleanup(context: MCPRequestContext, res?: MCPResponseLike): void {
+  if (!res || context.responseCleanupAttached || context.cleanupOnResponse === false) {
+    return;
+  }
+
+  const cleanup = () => runCleanup(context);
+  if (isResponseFinished(res)) {
+    cleanup();
+    return;
+  }
+
+  if (typeof res.once !== 'function') {
+    return;
+  }
+
+  context.responseCleanupAttached = true;
+  res.once('finish', cleanup);
+  res.once('close', cleanup);
+
+  if (isResponseFinished(res)) {
+    cleanup();
+  }
+}
+
+export function getMCPRequestContext(
+  req?: object,
+  res?: MCPResponseLike,
+  options: MCPRequestContextOptions = {},
+): MCPRequestContext | undefined {
+  if (!req) {
+    return undefined;
+  }
+
+  const cleanupOnResponse = options.cleanupOnResponse !== false;
+  let context = contexts.get(req);
+  if (!context) {
+    if (cleanupOnResponse && isResponseFinished(res)) {
+      return undefined;
+    }
+
+    context = createMCPRequestContext();
+    context.cleanupOnResponse = cleanupOnResponse;
+    contexts.set(req, context);
+  } else if (!cleanupOnResponse) {
+    context.cleanupOnResponse = false;
+  }
+
+  if (cleanupOnResponse) {
+    attachResponseCleanup(context, res);
+  }
+
+  return context.cleanupStarted ? undefined : context;
+}
+
+export async function cleanupMCPRequestContextForReq(req?: object): Promise<void> {
+  if (!req) {
+    return;
+  }
+
+  const context = contexts.get(req);
+  if (!context) {
+    return;
+  }
+
+  try {
+    await cleanupMCPRequestContext(context);
+  } finally {
+    contexts.delete(req);
+  }
+}
diff --git a/packages/api/src/mcp/tools.spec.ts b/packages/api/src/mcp/tools.spec.ts
index 2a5d201df8c..f1a630487a4 100644
--- a/packages/api/src/mcp/tools.spec.ts
+++ b/packages/api/src/mcp/tools.spec.ts
@@ -1,12 +1,25 @@
 import { Constants } from 'librechat-data-provider';
-import { createMCPToolCacheService } from './tools';
-import type { LCAvailableTools } from './types';
+import type { LCAvailableTools, ParsedServerConfig } from './types';
 import type { MCPToolInput, MCPToolCacheDeps } from './tools';
+import { createMCPToolCacheService } from './tools';
+
+const requestScopedConfig: ParsedServerConfig = {
+  type: 'streamable-http',
+  url: 'https://mcp.example.com/{{LIBRECHAT_BODY_CONVERSATIONID}}/mcp',
+  source: 'yaml',
+};
+
+const cacheableConfig: ParsedServerConfig = {
+  type: 'streamable-http',
+  url: 'https://mcp.example.com/mcp',
+  source: 'yaml',
+};
 
 function createMockDeps(overrides: Partial<MCPToolCacheDeps> = {}): MCPToolCacheDeps {
   return {
     getCachedTools: jest.fn().mockResolvedValue(null),
     setCachedTools: jest.fn().mockResolvedValue(true),
+    getServerConfig: jest.fn().mockResolvedValue(undefined),
     ...overrides,
   };
 }
@@ -57,6 +70,59 @@ describe('createMCPToolCacheService', () => {
       });
     });
 
+    it('builds tool names without caching when the resolved config is request-scoped', async () => {
+      const deps = createMockDeps({
+        getServerConfig: jest.fn().mockResolvedValue(requestScopedConfig),
+      });
+      const { updateMCPServerTools } = createMCPToolCacheService(deps);
+      const tools: MCPToolInput[] = [
+        {
+          name: 'search',
+          description: 'Search request-scoped docs',
+          inputSchema: { type: 'object', properties: {} },
+        },
+      ];
+
+      const result = await updateMCPServerTools({
+        userId: 'u1',
+        serverName: 'body-scoped',
+        tools,
+      });
+
+      const expectedKey = `search${Constants.mcp_delimiter}body-scoped`;
+      expect(result[expectedKey]).toBeDefined();
+      expect(deps.getServerConfig).toHaveBeenCalledWith('body-scoped', 'u1');
+      expect(deps.setCachedTools).not.toHaveBeenCalled();
+    });
+
+    it('uses a provided serverConfig without calling the resolver', async () => {
+      const deps = createMockDeps();
+      const { updateMCPServerTools } = createMCPToolCacheService(deps);
+      const tools: MCPToolInput[] = [{ name: 'search' }];
+
+      await updateMCPServerTools({
+        userId: 'u1',
+        serverName: 'body-scoped',
+        tools,
+        serverConfig: requestScopedConfig,
+      });
+
+      expect(deps.getServerConfig).not.toHaveBeenCalled();
+      expect(deps.setCachedTools).not.toHaveBeenCalled();
+    });
+
+    it('fails open and caches when config resolution throws', async () => {
+      const deps = createMockDeps({
+        getServerConfig: jest.fn().mockRejectedValue(new Error('registry not initialized')),
+      });
+      const { updateMCPServerTools } = createMCPToolCacheService(deps);
+      const tools: MCPToolInput[] = [{ name: 'search' }];
+
+      await updateMCPServerTools({ userId: 'u1', serverName: 'srv', tools });
+
+      expect(deps.setCachedTools).toHaveBeenCalled();
+    });
+
     it('propagates setCachedTools errors', async () => {
       const deps = createMockDeps({
         setCachedTools: jest.fn().mockRejectedValue(new Error('Redis down')),
@@ -155,6 +221,17 @@ describe('createMCPToolCacheService', () => {
   });
 
   describe('cacheMCPServerTools', () => {
+    const serverTools: LCAvailableTools = {
+      tool: {
+        type: 'function',
+        ['function']: {
+          name: 'tool',
+          description: '',
+          parameters: { type: 'object', properties: {} },
+        },
+      },
+    };
+
     it('no-ops when serverTools is empty', async () => {
       const deps = createMockDeps();
       const { cacheMCPServerTools } = createMCPToolCacheService(deps);
@@ -167,16 +244,6 @@ describe('createMCPToolCacheService', () => {
     it('caches server tools with userId and serverName', async () => {
       const deps = createMockDeps();
       const { cacheMCPServerTools } = createMCPToolCacheService(deps);
-      const serverTools: LCAvailableTools = {
-        tool: {
-          type: 'function',
-          ['function']: {
-            name: 'tool',
-            description: '',
-            parameters: { type: 'object', properties: {} },
-          },
-        },
-      };
 
       await cacheMCPServerTools({ userId: 'u1', serverName: 'brave', serverTools });
 
@@ -186,6 +253,17 @@ describe('createMCPToolCacheService', () => {
       });
     });
 
+    it('skips caching for request-scoped servers', async () => {
+      const deps = createMockDeps({
+        getServerConfig: jest.fn().mockResolvedValue(requestScopedConfig),
+      });
+      const { cacheMCPServerTools } = createMCPToolCacheService(deps);
+
+      await cacheMCPServerTools({ userId: 'u1', serverName: 'body-scoped', serverTools });
+
+      expect(deps.setCachedTools).not.toHaveBeenCalled();
+    });
+
     it('propagates setCachedTools errors', async () => {
       const deps = createMockDeps({
         setCachedTools: jest.fn().mockRejectedValue(new Error('write failed')),
@@ -193,21 +271,80 @@ describe('createMCPToolCacheService', () => {
       const { cacheMCPServerTools } = createMCPToolCacheService(deps);
 
       await expect(
-        cacheMCPServerTools({
-          userId: 'u1',
-          serverName: 'srv',
-          serverTools: {
-            t: {
-              type: 'function',
-              ['function']: {
-                name: 't',
-                description: '',
-                parameters: { type: 'object', properties: {} },
-              },
-            },
-          },
-        }),
+        cacheMCPServerTools({ userId: 'u1', serverName: 'srv', serverTools }),
       ).rejects.toThrow('write failed');
     });
   });
+
+  describe('getMCPServerTools', () => {
+    const cachedTools: LCAvailableTools = {
+      tool: {
+        type: 'function',
+        ['function']: {
+          name: 'tool',
+          description: '',
+          parameters: { type: 'object', properties: {} },
+        },
+      },
+    };
+
+    it('returns cached tools for cacheable servers', async () => {
+      const deps = createMockDeps({
+        getCachedTools: jest.fn().mockResolvedValue(cachedTools),
+        getServerConfig: jest.fn().mockResolvedValue(cacheableConfig),
+      });
+      const { getMCPServerTools } = createMCPToolCacheService(deps);
+
+      const result = await getMCPServerTools('u1', 'brave');
+
+      expect(result).toEqual(cachedTools);
+      expect(deps.getCachedTools).toHaveBeenCalledWith({ userId: 'u1', serverName: 'brave' });
+    });
+
+    it('returns null for request-scoped servers without reading the cache', async () => {
+      const deps = createMockDeps({
+        getCachedTools: jest.fn().mockResolvedValue(cachedTools),
+        getServerConfig: jest.fn().mockResolvedValue(requestScopedConfig),
+      });
+      const { getMCPServerTools } = createMCPToolCacheService(deps);
+
+      const result = await getMCPServerTools('u1', 'body-scoped');
+
+      expect(result).toBeNull();
+      expect(deps.getCachedTools).not.toHaveBeenCalled();
+    });
+
+    it('uses a provided serverConfig without calling the resolver', async () => {
+      const deps = createMockDeps({
+        getCachedTools: jest.fn().mockResolvedValue(cachedTools),
+      });
+      const { getMCPServerTools } = createMCPToolCacheService(deps);
+
+      const result = await getMCPServerTools('u1', 'body-scoped', requestScopedConfig);
+
+      expect(result).toBeNull();
+      expect(deps.getServerConfig).not.toHaveBeenCalled();
+      expect(deps.getCachedTools).not.toHaveBeenCalled();
+    });
+
+    it('returns null when the cache is empty', async () => {
+      const deps = createMockDeps();
+      const { getMCPServerTools } = createMCPToolCacheService(deps);
+
+      const result = await getMCPServerTools('u1', 'brave');
+
+      expect(result).toBeNull();
+    });
+
+    it('returns null instead of throwing when the cache read fails', async () => {
+      const deps = createMockDeps({
+        getCachedTools: jest.fn().mockRejectedValue(new Error('cache unavailable')),
+      });
+      const { getMCPServerTools } = createMCPToolCacheService(deps);
+
+      const result = await getMCPServerTools('u1', 'brave');
+
+      expect(result).toBeNull();
+    });
+  });
 });
diff --git a/packages/api/src/mcp/tools.ts b/packages/api/src/mcp/tools.ts
index d539cc5bd0c..1326bb99f31 100644
--- a/packages/api/src/mcp/tools.ts
+++ b/packages/api/src/mcp/tools.ts
@@ -1,7 +1,8 @@
 import { logger } from '@librechat/data-schemas';
 import { Constants } from 'librechat-data-provider';
 import type { JsonSchemaType } from '@librechat/agents';
-import type { LCAvailableTools, LCFunctionTool } from './types';
+import type { LCAvailableTools, LCFunctionTool, ParsedServerConfig } from './types';
+import { requiresEphemeralUserConnection } from './utils';
 
 export interface MCPToolInput {
   name: string;
@@ -18,17 +19,66 @@ export interface MCPToolCacheDeps {
     tools: LCAvailableTools,
     options?: { userId?: string; serverName?: string },
   ) => Promise<boolean>;
+  getServerConfig: (serverName: string, userId?: string) => Promise<ParsedServerConfig | undefined>;
 }
 
-export function createMCPToolCacheService(deps: MCPToolCacheDeps) {
-  const { getCachedTools, setCachedTools } = deps;
+export interface MCPToolCacheService {
+  updateMCPServerTools: (params: {
+    userId: string;
+    serverName: string;
+    tools: MCPToolInput[] | null;
+    serverConfig?: ParsedServerConfig;
+  }) => Promise<LCAvailableTools>;
+  mergeAppTools: (appTools: LCAvailableTools) => Promise<void>;
+  cacheMCPServerTools: (params: {
+    userId: string;
+    serverName: string;
+    serverTools: LCAvailableTools;
+    serverConfig?: ParsedServerConfig;
+  }) => Promise<void>;
+  getMCPServerTools: (
+    userId: string,
+    serverName: string,
+    serverConfig?: ParsedServerConfig,
+  ) => Promise<LCAvailableTools | null>;
+}
+
+export function createMCPToolCacheService(deps: MCPToolCacheDeps): MCPToolCacheService {
+  const { getCachedTools, setCachedTools, getServerConfig } = deps;
+
+  /**
+   * Request-scoped servers resolve runtime user/request placeholders per
+   * connection, so their definitions must never enter the persistent tool
+   * cache. Fails open: an unresolvable config is treated as cacheable,
+   * preserving pre-gating behavior for servers the registry cannot see.
+   * The resolver sees only base registry configs — callers holding merged
+   * Config-overlay configs must pass them. All writers do, so an entry that
+   * predates gating or an overlay change survives at most one cache TTL.
+   */
+  async function isRequestScoped(
+    userId: string,
+    serverName: string,
+    serverConfig?: ParsedServerConfig,
+  ): Promise<boolean> {
+    try {
+      const config = serverConfig ?? (await getServerConfig(serverName, userId));
+      return config ? requiresEphemeralUserConnection(config) : false;
+    } catch (error) {
+      logger.debug(
+        `[MCP Cache] Could not resolve config for ${serverName} (user: ${userId}), treating as cacheable:`,
+        error,
+      );
+      return false;
+    }
+  }
 
   async function updateMCPServerTools(params: {
     userId: string;
     serverName: string;
     tools: MCPToolInput[] | null;
+    serverConfig?: ParsedServerConfig;
   }): Promise<LCAvailableTools> {
-    const { userId, serverName, tools } = params;
+    const { userId, serverName, tools, serverConfig } = params;
     try {
       const serverTools: LCAvailableTools = {};
       const mcpDelimiter = Constants.mcp_delimiter;
@@ -51,6 +101,13 @@ export function createMCPToolCacheService(deps: MCPToolCacheDeps) {
         serverTools[name] = entry;
       }
 
+      if (await isRequestScoped(userId, serverName, serverConfig)) {
+        logger.debug(
+          `[MCP Cache] Built ${tools.length} tools for request-scoped server ${serverName} (user: ${userId}) without caching`,
+        );
+        return serverTools;
+      }
+
       await setCachedTools(serverTools, { userId, serverName });
       logger.debug(
         `[MCP Cache] Updated ${tools.length} tools for server ${serverName} (user: ${userId})`,
@@ -85,13 +142,20 @@ export function createMCPToolCacheService(deps: MCPToolCacheDeps) {
     userId: string;
     serverName: string;
     serverTools: LCAvailableTools;
+    serverConfig?: ParsedServerConfig;
   }): Promise<void> {
-    const { userId, serverName, serverTools } = params;
+    const { userId, serverName, serverTools, serverConfig } = params;
     try {
       const count = Object.keys(serverTools).length;
       if (!count) {
         return;
       }
+      if (await isRequestScoped(userId, serverName, serverConfig)) {
+        logger.debug(
+          `[MCP Cache] Skipped caching ${count} tools for request-scoped server ${serverName} (user: ${userId})`,
+        );
+        return;
+      }
       await setCachedTools(serverTools, { userId, serverName });
       logger.debug(`Cached ${count} MCP server tools for ${serverName} (user: ${userId})`);
     } catch (error) {
@@ -100,5 +164,21 @@ export function createMCPToolCacheService(deps: MCPToolCacheDeps) {
     }
   }
 
-  return { updateMCPServerTools, mergeAppTools, cacheMCPServerTools };
+  async function getMCPServerTools(
+    userId: string,
+    serverName: string,
+    serverConfig?: ParsedServerConfig,
+  ): Promise<LCAvailableTools | null> {
+    if (await isRequestScoped(userId, serverName, serverConfig)) {
+      return null;
+    }
+    try {
+      return (await getCachedTools({ userId, serverName })) ?? null;
+    } catch (error) {
+      logger.error(`[getMCPServerTools] Error fetching cached tools for ${serverName}:`, error);
+      return null;
+    }
+  }
+
+  return { updateMCPServerTools, mergeAppTools, cacheMCPServerTools, getMCPServerTools };
 }
diff --git a/packages/api/src/mcp/types/index.ts b/packages/api/src/mcp/types/index.ts
index 25b9d7f2442..852dc0b8373 100644
--- a/packages/api/src/mcp/types/index.ts
+++ b/packages/api/src/mcp/types/index.ts
@@ -19,10 +19,11 @@ import type {
 import type { SearchResultData, UIResource, TPlugin } from 'librechat-data-provider';
 import type { TokenMethods, IUser } from '@librechat/data-schemas';
 import type { LCTool } from '@librechat/agents';
+import type { OboTokenResolver, OboTrustChecker } from '~/mcp/oauth/obo';
+import type { GraphTokenResolver } from '~/utils/graph';
 import type { FlowStateManager } from '~/flow/manager';
 import type { RequestBody } from '~/types/http';
 import type * as o from '~/mcp/oauth/types';
-import type { OboTokenResolver, OboTrustChecker } from '~/mcp/oauth/obo';
 
 export type StdioOptions = z.infer<typeof StdioOptionsSchema>;
 export type WebSocketOptions = z.infer<typeof WebSocketOptionsSchema>;
@@ -191,6 +192,10 @@ export interface BasicConnectionOptions {
   allowedAddresses?: string[] | null;
   /** When true, only resolve customUserVars in processMCPEnv (for DB-stored servers) */
   dbSourced?: boolean;
+  /** When true, serverConfig has already gone through processMCPEnv for this request */
+  skipEnvProcessing?: boolean;
+  /** When true, the connection is intentionally short-lived for a single request/tool call */
+  ephemeralConnection?: boolean;
 }
 
 /** User context for placeholder resolution in MCP connections (non-OAuth and OAuth alike) */
@@ -198,15 +203,28 @@ export interface UserConnectionContext {
   user?: IUser;
   customUserVars?: Record<string, string>;
   requestBody?: RequestBody;
+  requestScopedConnections?: RequestScopedMCPConnectionStore;
+  graphTokenResolver?: GraphTokenResolver;
   connectionTimeout?: number;
 }
 
+export interface RequestScopedMCPConnectionStore {
+  connections: Map<string, unknown>;
+  pending: Map<string, Promise<unknown>>;
+}
+
+export interface OAuthStartOptions {
+  expiresAt?: number;
+}
+
+export type OAuthStartHandler = (authURL: string, options?: OAuthStartOptions) => Promise<void>;
+
 export interface OAuthConnectionOptions extends UserConnectionContext {
   useOAuth: true;
   flowManager: FlowStateManager<o.MCPOAuthTokens | null>;
   tokenMethods?: TokenMethods;
   signal?: AbortSignal;
-  oauthStart?: (authURL: string) => Promise<void>;
+  oauthStart?: OAuthStartHandler;
   oauthEnd?: () => Promise<void>;
   returnOnOAuth?: boolean;
   oboTokenResolver?: OboTokenResolver;
@@ -217,11 +235,12 @@ export interface OAuthConnectionOptions extends UserConnectionContext {
 export interface UserMCPConnectionOptions extends UserConnectionContext {
   serverName: string;
   forceNew?: boolean;
+  ephemeralConnection?: boolean;
   serverConfig?: ParsedServerConfig;
   flowManager?: FlowStateManager<o.MCPOAuthTokens | null>;
   tokenMethods?: TokenMethods;
   signal?: AbortSignal;
-  oauthStart?: (authURL: string) => Promise<void>;
+  oauthStart?: OAuthStartHandler;
   oauthEnd?: () => Promise<void>;
   returnOnOAuth?: boolean;
   oboTokenResolver?: OboTokenResolver;
@@ -234,9 +253,10 @@ export interface ToolDiscoveryOptions {
   flowManager?: FlowStateManager<o.MCPOAuthTokens | null>;
   tokenMethods?: TokenMethods;
   signal?: AbortSignal;
-  oauthStart?: (authURL: string) => Promise<void>;
+  oauthStart?: OAuthStartHandler;
   customUserVars?: Record<string, string>;
   requestBody?: RequestBody;
+  graphTokenResolver?: GraphTokenResolver;
   connectionTimeout?: number;
   /** Pre-resolved config-source servers for tenant-scoped lookup */
   configServers?: Record<string, ParsedServerConfig>;
diff --git a/packages/api/src/mcp/utils.ts b/packages/api/src/mcp/utils.ts
index 86efcc919cb..ab79f691d3d 100644
--- a/packages/api/src/mcp/utils.ts
+++ b/packages/api/src/mcp/utils.ts
@@ -1,7 +1,47 @@
 import { Constants } from 'librechat-data-provider';
 import type { ParsedServerConfig } from '~/mcp/types';
+import type { RequestBody } from '~/types';
 
-export const mcpToolPattern = new RegExp(`^.+${Constants.mcp_delimiter}.+$`);
+export const mcpToolPattern: RegExp = new RegExp(`^.+${Constants.mcp_delimiter}.+$`);
+
+const RUNTIME_CONTEXT_PLACEHOLDER_PATTERN = /\{\{LIBRECHAT_(?:USER|OPENID|GRAPH|BODY)_[^}]+\}\}/;
+const RUNTIME_BODY_PLACEHOLDER_PATTERN = /\{\{LIBRECHAT_BODY_[^}]+\}\}/;
+const RUNTIME_BODY_PLACEHOLDER_CAPTURE_PATTERN = /\{\{LIBRECHAT_BODY_([^}]+)\}\}/g;
+
+const BODY_PLACEHOLDER_FIELDS: Record<string, keyof RequestBody> = {
+  CONVERSATIONID: 'conversationId',
+  PARENTMESSAGEID: 'parentMessageId',
+  MESSAGEID: 'messageId',
+};
+
+type PlaceholderValue =
+  | string
+  | number
+  | boolean
+  | null
+  | undefined
+  | readonly PlaceholderValue[]
+  | { readonly [key: string]: PlaceholderValue };
+
+type UserScopedConnectionConfig = Pick<ParsedServerConfig, 'requiresOAuth' | 'source' | 'dbId'> & {
+  args?: string[];
+  /** Loosened from the parsed shapes so raw (pre-inspection) configs qualify;
+   *  scoping predicates only check key presence */
+  obo?: { scopes?: string } | null;
+  customUserVars?: Record<
+    string,
+    { description?: string; title?: string; sensitive?: boolean } | undefined
+  >;
+  env?: Record<string, string | undefined>;
+  headers?: Record<string, string | undefined>;
+  oauth?: PlaceholderValue;
+  oauth_headers?: Record<string, string | undefined>;
+  url?: string;
+};
+
+function placeholderBearingFields(config: UserScopedConnectionConfig): PlaceholderValue[] {
+  return [config.args, config.env, config.headers, config.oauth, config.oauth_headers, config.url];
+}
 
 /** Whether a server should use MCP OAuth handling. */
 export function isOAuthServer(
@@ -31,18 +71,144 @@ export function requiresOAuthMachinery(
 }
 
 /** Checks that `customUserVars` is present AND non-empty (guards against truthy `{}`) */
-export function hasCustomUserVars(config: Pick<ParsedServerConfig, 'customUserVars'>): boolean {
+export function hasCustomUserVars(
+  config: Pick<UserScopedConnectionConfig, 'customUserVars'>,
+): boolean {
   return !!config.customUserVars && Object.keys(config.customUserVars).length > 0;
 }
 
+function hasRuntimeContextPlaceholder(value: PlaceholderValue): boolean {
+  return hasPlaceholder(value, RUNTIME_CONTEXT_PLACEHOLDER_PATTERN);
+}
+
+function hasPlaceholder(value: PlaceholderValue, pattern: RegExp): boolean {
+  if (typeof value === 'string') {
+    return pattern.test(value);
+  }
+  if (Array.isArray(value)) {
+    return value.some((item) => hasPlaceholder(item, pattern));
+  }
+
+  if (value == null || typeof value !== 'object') {
+    return false;
+  }
+
+  return Object.values(value).some((item) => hasPlaceholder(item, pattern));
+}
+
+function addRuntimeBodyPlaceholderFields(value: PlaceholderValue, fields: Set<string>): void {
+  if (typeof value === 'string') {
+    for (const match of value.matchAll(RUNTIME_BODY_PLACEHOLDER_CAPTURE_PATTERN)) {
+      const placeholderKey = match[1];
+      if (placeholderKey) {
+        fields.add(BODY_PLACEHOLDER_FIELDS[placeholderKey] ?? placeholderKey);
+      }
+    }
+    return;
+  }
+
+  if (Array.isArray(value)) {
+    for (const item of value) {
+      addRuntimeBodyPlaceholderFields(item, fields);
+    }
+    return;
+  }
+
+  if (value == null || typeof value !== 'object') {
+    return;
+  }
+
+  for (const item of Object.values(value)) {
+    addRuntimeBodyPlaceholderFields(item, fields);
+  }
+}
+
+/**
+ * Trusted YAML/config servers may use per-user/request placeholders that can
+ * only be resolved once a real request context exists. User-sourced DB servers
+ * deliberately stay sandboxed and only resolve customUserVars.
+ */
+export function hasRuntimeContextPlaceholders(config: UserScopedConnectionConfig): boolean {
+  if (isUserSourced(config)) {
+    return false;
+  }
+
+  return placeholderBearingFields(config).some(hasRuntimeContextPlaceholder);
+}
+
+export function hasRuntimeUrlPlaceholders(config: UserScopedConnectionConfig): boolean {
+  if (isUserSourced(config)) {
+    return false;
+  }
+
+  return hasRuntimeContextPlaceholder(config.url);
+}
+
+export function hasRuntimeBodyPlaceholders(config: UserScopedConnectionConfig): boolean {
+  if (isUserSourced(config)) {
+    return false;
+  }
+
+  return placeholderBearingFields(config).some((value) =>
+    hasPlaceholder(value, RUNTIME_BODY_PLACEHOLDER_PATTERN),
+  );
+}
+
+export function getRuntimeBodyPlaceholderFields(config: UserScopedConnectionConfig): string[] {
+  if (isUserSourced(config)) {
+    return [];
+  }
+
+  const fields = new Set<string>();
+  for (const value of placeholderBearingFields(config)) {
+    addRuntimeBodyPlaceholderFields(value, fields);
+  }
+  return Array.from(fields);
+}
+
+export function getMissingRuntimeBodyPlaceholderFields(
+  config: UserScopedConnectionConfig,
+  requestBody?: RequestBody,
+): string[] {
+  return getRuntimeBodyPlaceholderFields(config).filter((field) => {
+    const value = requestBody?.[field as keyof RequestBody];
+    return value == null || (typeof value === 'string' && value.trim() === '');
+  });
+}
+
+/**
+ * `BODY` placeholders vary by chat request, so the normal userId:serverName
+ * cache would reuse a connection built with stale request context.
+ *
+ * Ephemeral connections are created and torn down per tool call — configs using
+ * these placeholders pay a full connect + initialize on every invocation.
+ *
+ * User/OpenID/Graph placeholders still require user-scoped connections, but they
+ * are not request-scoped by themselves. HTTP transports refresh resolved headers
+ * before each tool call, so token/user headers can remain on the cached user
+ * connection without forcing a reconnect for every invocation.
+ */
+export function requiresEphemeralUserConnection(config: UserScopedConnectionConfig): boolean {
+  if (isUserSourced(config)) {
+    return false;
+  }
+
+  return placeholderBearingFields(config).some((value) =>
+    hasPlaceholder(value, RUNTIME_BODY_PLACEHOLDER_PATTERN),
+  );
+}
+
 /**
  * Returns true when a server requires a per-user connection instead of an
  * app-shared connection.
  */
-export function requiresUserScopedConnection(
-  config: Pick<ParsedServerConfig, 'requiresOAuth' | 'customUserVars' | 'obo'>,
-): boolean {
-  return config.requiresOAuth === true || config.obo != null || hasCustomUserVars(config);
+export function requiresUserScopedConnection(config: UserScopedConnectionConfig): boolean {
+  return (
+    config.requiresOAuth === true ||
+    config.obo != null ||
+    hasCustomUserVars(config) ||
+    hasRuntimeContextPlaceholders(config)
+  );
 }
 
 /**
@@ -81,11 +247,19 @@ export function isUserSourced(config: Pick<ParsedServerConfig, 'source' | 'dbId'
  * Allowlist-based sanitization for API responses. Only explicitly listed fields are included;
  * new fields added to ParsedServerConfig are excluded by default until allowlisted here.
  *
- * URLs are returned as-is: DB-stored configs reject ${VAR} patterns at validation time
- * (MCPServerUserInputSchema), and YAML configs are admin-managed. Env variable resolution
- * is handled at the schema/input boundary, not the output boundary.
+ * `url` and the oauth flow URLs (`authorization_url`, `token_url`, `revocation_endpoint`) can
+ * encode internal infrastructure, so they are stripped unless `canEdit` is set: the same
+ * disclosure threshold the PATCH route enforces. Callers derive `canEdit` per server (operator
+ * YAML/config-tier servers from the MANAGE_MCP_SERVERS capability, user-sourced servers from
+ * per-resource ACL EDIT), so a user-sourced config shared view-only does not disclose its URL
+ * to the viewer.
+ * DB-stored configs reject ${VAR} patterns at validation time (MCPServerUserInputSchema);
+ * env variable resolution is handled at the schema/input boundary.
  */
-export function redactServerSecrets(config: ParsedServerConfig): Partial<ParsedServerConfig> {
+export function redactServerSecrets(
+  config: ParsedServerConfig,
+  options?: { canEdit?: boolean },
+): Partial<ParsedServerConfig> {
   const safe: Partial<ParsedServerConfig> = {
     type: config.type,
     url: config.url,
@@ -125,6 +299,19 @@ export function redactServerSecrets(config: ParsedServerConfig): Partial<ParsedS
     safe.obo = config.obo;
   }
 
+  if (!options?.canEdit) {
+    delete safe.url;
+    if (safe.oauth) {
+      const {
+        authorization_url: _au,
+        token_url: _tu,
+        revocation_endpoint: _re,
+        ...restOAuth
+      } = safe.oauth;
+      safe.oauth = restOAuth;
+    }
+  }
+
   return Object.fromEntries(
     Object.entries(safe).filter(([, v]) => v !== undefined),
   ) as Partial<ParsedServerConfig>;
@@ -133,10 +320,12 @@ export function redactServerSecrets(config: ParsedServerConfig): Partial<ParsedS
 /** Applies allowlist-based sanitization to a map of server configs. */
 export function redactAllServerSecrets(
   configs: Record<string, ParsedServerConfig>,
+  options?: { canEditByServer?: ReadonlyMap<string, boolean> },
 ): Record<string, Partial<ParsedServerConfig>> {
   const result: Record<string, Partial<ParsedServerConfig>> = {};
   for (const [key, config] of Object.entries(configs)) {
-    result[key] = redactServerSecrets(config);
+    const canEdit = options?.canEditByServer?.get(key) ?? false;
+    result[key] = redactServerSecrets(config, { canEdit });
   }
   return result;
 }
diff --git a/packages/api/src/mcp/zod.ts b/packages/api/src/mcp/zod.ts
index 53cb6e71a8a..c6df45b6a08 100644
--- a/packages/api/src/mcp/zod.ts
+++ b/packages/api/src/mcp/zod.ts
@@ -182,7 +182,7 @@ function convertToZodUnion(
 export function resolveJsonSchemaRefs<T extends Record<string, unknown>>(
   schema: T,
   definitions?: Record<string, unknown>,
-  visited = new Set<string>(),
+  visited: Set<string> = new Set<string>(),
 ): T {
   // Handle null, undefined, or non-object values first
   if (!schema || typeof schema !== 'object') {
@@ -322,6 +322,268 @@ export function normalizeJsonSchema<T extends Record<string, unknown>>(schema: T
   return result as T;
 }
 
+function isNullSchema(member: unknown): boolean {
+  return (
+    member != null &&
+    typeof member === 'object' &&
+    (member as Record<string, unknown>).type === 'null'
+  );
+}
+
+function mergeProperties(a: unknown, b: unknown): Record<string, unknown> | undefined {
+  const objA =
+    a && typeof a === 'object' && !Array.isArray(a) ? (a as Record<string, unknown>) : undefined;
+  const objB =
+    b && typeof b === 'object' && !Array.isArray(b) ? (b as Record<string, unknown>) : undefined;
+  if (!objA && !objB) {
+    return undefined;
+  }
+  return { ...(objA ?? {}), ...(objB ?? {}) };
+}
+
+function mergeRequired(a: unknown, b: unknown): string[] | undefined {
+  const arrA = Array.isArray(a) ? (a as string[]) : [];
+  const arrB = Array.isArray(b) ? (b as string[]) : [];
+  if (arrA.length === 0 && arrB.length === 0) {
+    return undefined;
+  }
+  return Array.from(new Set([...arrA, ...arrB]));
+}
+
+/**
+ * JSON Schema keywords absent from Gemini's function-calling Schema subset
+ * (https://ai.google.dev/api/caching#Schema); they trigger 400s and are stripped.
+ */
+const GEMINI_UNSUPPORTED_KEYS = new Set(['additionalProperties', 'default', '$schema', '$id']);
+
+/**
+ * Merges the members of an `allOf` (schema intersection) into the parent: combines
+ * `properties`/`required` and fills any scalar keyword the parent doesn't already set.
+ */
+function mergeAllOf(schema: Record<string, unknown>): Record<string, unknown> {
+  const members = (schema.allOf as unknown[]).filter(
+    (member): member is Record<string, unknown> => member != null && typeof member === 'object',
+  );
+  const result = { ...schema };
+  delete result.allOf;
+  let properties = mergeProperties(result.properties, undefined);
+  let required = mergeRequired(result.required, undefined);
+  for (const member of members) {
+    properties = mergeProperties(properties, member.properties);
+    required = mergeRequired(required, member.required);
+    for (const [key, value] of Object.entries(member)) {
+      if (key !== 'properties' && key !== 'required' && !(key in result)) {
+        result[key] = value;
+      }
+    }
+  }
+  if (properties) {
+    result.properties = properties;
+  }
+  if (required) {
+    result.required = required;
+  }
+  return result;
+}
+
+/**
+ * Collapses a single `anyOf`/`oneOf` level into its parent by keeping the first
+ * non-null member, marking the field nullable when a `null` member was present.
+ * Parent and branch `properties`/`required` are merged so fields declared outside
+ * the union (e.g. always-required args) survive the collapse. Loops to fully strip
+ * union keys that the chosen member re-introduces.
+ */
+function collapseSchemaUnion(schema: Record<string, unknown>): Record<string, unknown> {
+  let current = schema;
+  let guard = 0;
+
+  while (guard < 200) {
+    guard += 1;
+    if (Array.isArray(current.allOf)) {
+      current = mergeAllOf(current);
+      continue;
+    }
+    let unionKey: 'anyOf' | 'oneOf' | null = null;
+    if (Array.isArray(current.anyOf)) {
+      unionKey = 'anyOf';
+    } else if (Array.isArray(current.oneOf)) {
+      unionKey = 'oneOf';
+    }
+    if (!unionKey) {
+      break;
+    }
+
+    const members = (current[unionKey] as unknown[]).filter(
+      (member): member is Record<string, unknown> => member != null && typeof member === 'object',
+    );
+    const nonNull = members.filter((member) => !isNullSchema(member));
+    const hadNull = nonNull.length !== members.length;
+    const chosen = nonNull[0] ?? {};
+
+    const rest = { ...current };
+    delete rest[unionKey];
+
+    const mergedProperties = mergeProperties(rest.properties, chosen.properties);
+    const mergedRequired = mergeRequired(rest.required, chosen.required);
+
+    current = { ...rest, ...chosen };
+    if (mergedProperties) {
+      current.properties = mergedProperties;
+    }
+    if (mergedRequired) {
+      current.required = mergedRequired;
+    }
+    if (hadNull) {
+      current.nullable = true;
+    }
+  }
+
+  return current;
+}
+
+/**
+ * Collapses a multi-entry `type` array (e.g. `['string', 'null']`) into a single
+ * type, reporting whether a `null` entry made the field nullable.
+ */
+function collapseTypeArray(types: unknown[]): { type?: string; nullable: boolean } {
+  const nonNull = types.filter((type) => type !== 'null');
+  const first = nonNull[0];
+  return {
+    type: typeof first === 'string' ? first : undefined,
+    nullable: nonNull.length !== types.length,
+  };
+}
+
+/**
+ * Sanitizes a JSON schema to Gemini/Vertex AI's function-calling Schema subset
+ * (https://ai.google.dev/api/caching#Schema), recursively. Gemini accepts only a
+ * restricted slice of JSON Schema, and `@langchain/google-common`'s
+ * `zod_to_gemini_parameters` additionally throws on any union — so MCP tools that
+ * ship richer schemas crash on the Google endpoint while working on OpenAI/Claude.
+ *
+ * Transforms (all lossy and Gemini-specific — gate on the Google/Vertex provider,
+ * run after `normalizeJsonSchema`):
+ * - Collapses `anyOf`/`oneOf` to the first non-null member (merging parent + branch
+ *   `properties`/`required`), and merges `allOf` intersections.
+ * - Collapses multi-entry `type` arrays to a single type, tracking `nullable`.
+ * - Keeps only string `enum` values — Gemini's `enum` is `Type.STRING`-only — and
+ *   drops the keyword entirely for non-string types (e.g. a boolean `const`
+ *   normalized to `enum: [true]`).
+ * - Folds `exclusiveMinimum`/`exclusiveMaximum` into `minimum`/`maximum`.
+ * - Strips unsupported keywords (`additionalProperties`, `default`, `const`, `$schema`, `$id`).
+ *
+ * @param schema - The JSON schema to sanitize
+ * @returns The Gemini-compatible schema
+ */
+export function sanitizeGeminiSchema<T extends Record<string, unknown>>(schema: T): T {
+  if (!schema || typeof schema !== 'object') {
+    return schema;
+  }
+
+  if (Array.isArray(schema)) {
+    return schema.map((item) =>
+      item && typeof item === 'object' ? sanitizeGeminiSchema(item) : item,
+    ) as unknown as T;
+  }
+
+  const collapsed = collapseSchemaUnion(schema);
+  const typeHasNull =
+    Array.isArray(collapsed.type) && (collapsed.type as unknown[]).includes('null');
+  const nullable = collapsed.nullable === true || typeHasNull;
+
+  let effectiveType: string | undefined;
+  if (Array.isArray(collapsed.type)) {
+    effectiveType = collapseTypeArray(collapsed.type as unknown[]).type;
+  } else if (typeof collapsed.type === 'string') {
+    effectiveType = collapsed.type;
+  }
+
+  const result: Record<string, unknown> = {};
+
+  for (const [key, value] of Object.entries(collapsed)) {
+    if (GEMINI_UNSUPPORTED_KEYS.has(key)) {
+      continue;
+    }
+
+    if (key === 'type' && Array.isArray(value)) {
+      if (effectiveType !== undefined) {
+        result['type'] = effectiveType;
+      }
+      continue;
+    }
+
+    // Re-emitted once below so type-array and union sources don't double up.
+    if (key === 'nullable') {
+      continue;
+    }
+
+    // Gemini has no `const`; a string const becomes a single-value (string) enum,
+    // a non-string const is dropped (Gemini enum is string-only).
+    if (key === 'const') {
+      if (typeof value === 'string' && !('enum' in collapsed)) {
+        result['enum'] = [value];
+      }
+      continue;
+    }
+
+    // Gemini has no exclusive bounds; fold them into the inclusive ones it accepts.
+    if (key === 'exclusiveMinimum') {
+      if (typeof value === 'number' && !('minimum' in collapsed)) {
+        result['minimum'] = value;
+      }
+      continue;
+    }
+    if (key === 'exclusiveMaximum') {
+      if (typeof value === 'number' && !('maximum' in collapsed)) {
+        result['maximum'] = value;
+      }
+      continue;
+    }
+
+    // Gemini `enum` is Type.STRING-only: keep string values only when the effective
+    // (collapsed) type is string or unset; drop the keyword entirely for non-string
+    // types (e.g. boolean/number), which also covers null-stripping for string enums.
+    if (key === 'enum' && Array.isArray(value)) {
+      const enumAllowed = effectiveType === undefined || effectiveType === 'string';
+      const stringValues = enumAllowed ? value.filter((entry) => typeof entry === 'string') : [];
+      if (stringValues.length > 0) {
+        result['enum'] = stringValues;
+      }
+      continue;
+    }
+
+    if (key === 'properties' && value && typeof value === 'object' && !Array.isArray(value)) {
+      const newProps: Record<string, unknown> = {};
+      for (const [propKey, propValue] of Object.entries(value as Record<string, unknown>)) {
+        newProps[propKey] =
+          propValue && typeof propValue === 'object'
+            ? sanitizeGeminiSchema(propValue as Record<string, unknown>)
+            : propValue;
+      }
+      result[key] = newProps;
+      continue;
+    }
+
+    if (value && typeof value === 'object') {
+      result[key] = sanitizeGeminiSchema(value as Record<string, unknown>);
+      continue;
+    }
+
+    result[key] = value;
+  }
+
+  // A surviving enum implies a string field; Gemini's enum requires Type.STRING.
+  if ('enum' in result && !('type' in result)) {
+    result['type'] = 'string';
+  }
+
+  if (nullable) {
+    result['nullable'] = true;
+  }
+
+  return result as T;
+}
+
 /**
  * Converts a JSON Schema to a Zod schema.
  *
@@ -568,7 +830,7 @@ export function convertJsonSchemaToZod(
 export function convertWithResolvedRefs(
   schema: JsonSchemaType & Record<string, unknown>,
   options?: ConvertJsonSchemaToZodOptions,
-) {
+): z.ZodType | undefined {
   const resolved = resolveJsonSchemaRefs(schema);
   return convertJsonSchemaToZod(resolved, options);
 }
diff --git a/packages/api/src/memory/config.spec.ts b/packages/api/src/memory/config.spec.ts
index 4a836cefa01..3cadc07ed6c 100644
--- a/packages/api/src/memory/config.spec.ts
+++ b/packages/api/src/memory/config.spec.ts
@@ -1,4 +1,5 @@
 import { logger } from '@librechat/data-schemas';
+import { DEFAULT_MEMORY_MAX_INPUT_TOKENS } from 'librechat-data-provider';
 
 import type { TCustomConfig } from 'librechat-data-provider';
 
@@ -14,6 +15,7 @@ describe('memory config', () => {
 
     expect(isMemoryEnabled(loaded)).toBe(true);
     expect(isMemoryAgentEnabled(loaded)).toBe(false);
+    expect(loaded?.maxInputTokens).toBe(DEFAULT_MEMORY_MAX_INPUT_TOKENS);
   });
 
   it('requires explicit memory agent enablement before enabling the automatic agent flow', () => {
diff --git a/packages/api/src/middleware/admin.ts b/packages/api/src/middleware/admin.ts
index d770adfd85a..07bbd392183 100644
--- a/packages/api/src/middleware/admin.ts
+++ b/packages/api/src/middleware/admin.ts
@@ -7,7 +7,11 @@ import type { ServerRequest } from '~/types/http';
  * Middleware to check if authenticated user has admin role.
  * Should be used AFTER authentication middleware (requireJwtAuth, requireLocalAuth, etc.)
  */
-export const requireAdmin = (req: ServerRequest, res: Response, next: NextFunction) => {
+export const requireAdmin = (
+  req: ServerRequest,
+  res: Response,
+  next: NextFunction,
+): Response | undefined => {
   if (!req.user) {
     logger.warn('[requireAdmin] No user found in request');
     return res.status(401).json({
diff --git a/packages/api/src/middleware/auth.spec.ts b/packages/api/src/middleware/auth.spec.ts
new file mode 100644
index 00000000000..1c39b387df3
--- /dev/null
+++ b/packages/api/src/middleware/auth.spec.ts
@@ -0,0 +1,206 @@
+import {
+  buildSafeAuthLogContext,
+  formatAuthLogMessage,
+  getAuthFailureErrorName,
+  getAuthFailureReason,
+} from './auth';
+import type { AuthLogRequest, AuthLogState } from './auth';
+
+function createRequest(overrides: Partial<AuthLogRequest> = {}): AuthLogRequest {
+  return {
+    headers: {},
+    method: 'GET',
+    path: '/api/messages',
+    originalUrl: '/api/messages',
+    ...overrides,
+  };
+}
+
+function createAuthState(overrides: Partial<AuthLogState> = {}): AuthLogState {
+  return {
+    tokenProvider: 'openid',
+    openidReuseEnabled: true,
+    openidJwtAvailable: true,
+    hasOpenIdReuseUserId: true,
+    ...overrides,
+  };
+}
+
+describe('auth middleware logging helpers', () => {
+  it('builds safe auth log context without raw query strings or user identifiers', () => {
+    const log = buildSafeAuthLogContext(
+      createRequest({
+        id: 'request-id',
+        path: undefined,
+        originalUrl: '/api/ask?access_token=secret-token',
+      }),
+      createAuthState(),
+      {
+        attempted_strategies: ['openidJwt', 'jwt'],
+        fallback_attempted: true,
+        fallback_succeeded: false,
+        reason: 'jwt expired',
+        error_name: 'TokenExpiredError',
+        status: 401,
+      },
+    );
+
+    expect(log).toEqual({
+      request_id: 'request-id',
+      method: 'GET',
+      path: '/api/ask',
+      token_provider: 'openid',
+      openid_reuse_enabled: true,
+      openid_jwt_available: true,
+      has_openid_reuse_user_id: true,
+      attempted_strategies: ['openidJwt', 'jwt'],
+      fallback_attempted: true,
+      fallback_succeeded: false,
+      reason: 'jwt expired',
+      error_name: 'TokenExpiredError',
+      status: 401,
+    });
+    expect(JSON.stringify(log)).not.toContain('secret-token');
+  });
+
+  it('uses request headers when request ids are not directly set', () => {
+    const log = buildSafeAuthLogContext(
+      createRequest({
+        headers: {
+          'x-request-id': ['header-request-id'],
+        },
+      }),
+      createAuthState({
+        tokenProvider: null,
+        openidReuseEnabled: false,
+        openidJwtAvailable: false,
+        hasOpenIdReuseUserId: false,
+      }),
+    );
+
+    expect(log).toEqual({
+      request_id: 'header-request-id',
+      method: 'GET',
+      path: '/api/messages',
+      openid_reuse_enabled: false,
+      openid_jwt_available: false,
+      has_openid_reuse_user_id: false,
+    });
+  });
+
+  it('buckets unknown token providers to keep auth logs low-cardinality', () => {
+    const log = buildSafeAuthLogContext(
+      createRequest(),
+      createAuthState({
+        tokenProvider: 'attacker-controlled-provider',
+      }),
+    );
+
+    expect(log.token_provider).toBe('other');
+  });
+
+  it('prefers route buckets over concrete dynamic request paths', () => {
+    const log = buildSafeAuthLogContext(
+      createRequest({
+        baseUrl: '/api/messages',
+        path: '/conversation-123/message-456',
+        originalUrl: '/api/messages/conversation-123/message-456?access_token=secret-token',
+      }),
+      createAuthState(),
+    );
+
+    expect(log.path).toBe('/api/messages');
+    expect(JSON.stringify(log)).not.toContain('conversation-123');
+    expect(JSON.stringify(log)).not.toContain('message-456');
+    expect(JSON.stringify(log)).not.toContain('secret-token');
+  });
+
+  it('logs route templates when Express exposes them', () => {
+    const log = buildSafeAuthLogContext(
+      createRequest({
+        baseUrl: '/api/share',
+        path: '/link/conversation-123',
+        route: { path: '/link/:conversationId' },
+      }),
+      createAuthState(),
+    );
+
+    expect(log.path).toBe('/api/share/link/:conversationId');
+  });
+
+  it('drops unsupported extra values and keeps safe arrays primitive', () => {
+    const log = buildSafeAuthLogContext(createRequest({ id: 'request-id' }), createAuthState(), {
+      attempted_strategies: ['openidJwt', '', { strategy: 'jwt' }, 'jwt'],
+      fallback_attempted: true,
+      path: { unsafe: true },
+      request_id: { unsafe: true },
+      status: Number.NaN,
+      unsafe_object: { token: 'secret-token' },
+      reason: '  jwt expired  ',
+    });
+
+    expect(log).toEqual({
+      request_id: 'request-id',
+      method: 'GET',
+      path: '/api/messages',
+      token_provider: 'openid',
+      openid_reuse_enabled: true,
+      openid_jwt_available: true,
+      has_openid_reuse_user_id: true,
+      attempted_strategies: ['openidJwt', 'jwt'],
+      fallback_attempted: true,
+      reason: 'jwt expired',
+    });
+    expect(JSON.stringify(log)).not.toContain('secret-token');
+  });
+
+  it('formats auth log messages with serialized safe context for stdout collectors', () => {
+    const log = buildSafeAuthLogContext(createRequest({ id: 'request-id' }), createAuthState(), {
+      fallback_attempted: true,
+      reason: 'jwt expired',
+      error_name: 'TokenExpiredError',
+      status: 401,
+    });
+
+    expect(
+      formatAuthLogMessage('[requireJwtAuth] OpenID JWT auth failed; trying fallback', log),
+    ).toBe(
+      '[requireJwtAuth] OpenID JWT auth failed; trying fallback {"fallback_attempted":true,"reason":"jwt expired","error_name":"TokenExpiredError","status":401,"request_id":"request-id","method":"GET","path":"/api/messages","token_provider":"openid","openid_reuse_enabled":true,"openid_jwt_available":true,"has_openid_reuse_user_id":true}',
+    );
+  });
+
+  it('prefers Passport info fields for auth failure reason and error name', () => {
+    const err = Object.assign(new Error('outer failure'), { name: 'OuterError' });
+    const info = { message: 'jwt expired', name: 'TokenExpiredError' };
+
+    expect(getAuthFailureReason(err, info)).toBe('jwt expired');
+    expect(getAuthFailureErrorName(err, info)).toBe('TokenExpiredError');
+  });
+
+  it('falls back to Error fields when Passport info is absent', () => {
+    const err = Object.assign(new Error('invalid signature'), { name: 'JsonWebTokenError' });
+
+    expect(getAuthFailureReason(err, undefined)).toBe('invalid signature');
+    expect(getAuthFailureErrorName(err, undefined)).toBe('JsonWebTokenError');
+  });
+
+  it('does not throw when Passport failure objects expose throwing getters', () => {
+    const err = Object.assign(new Error('invalid signature'), { name: 'JsonWebTokenError' });
+    const info = {};
+    Object.defineProperties(info, {
+      message: {
+        get() {
+          throw new TypeError('message getter failed');
+        },
+      },
+      name: {
+        get() {
+          throw new TypeError('name getter failed');
+        },
+      },
+    });
+
+    expect(getAuthFailureReason(err, info)).toBe('invalid signature');
+    expect(getAuthFailureErrorName(err, info)).toBe('JsonWebTokenError');
+  });
+});
diff --git a/packages/api/src/middleware/auth.ts b/packages/api/src/middleware/auth.ts
new file mode 100644
index 00000000000..2ae429f6a05
--- /dev/null
+++ b/packages/api/src/middleware/auth.ts
@@ -0,0 +1,228 @@
+type AuthFailureLike = {
+  message?: unknown;
+  name?: unknown;
+};
+
+type AuthLogValue = string | number | boolean | readonly string[];
+type AuthLogHeaderValue = string | string[] | undefined;
+type AuthRoutePath = string | RegExp | readonly (string | RegExp)[];
+
+export type AuthLogRequest = {
+  headers?: Record<string, AuthLogHeaderValue>;
+  method?: string;
+  path?: string;
+  originalUrl?: string;
+  url?: string;
+  baseUrl?: string;
+  route?: {
+    path?: AuthRoutePath;
+  };
+  id?: string;
+  requestId?: string;
+};
+
+export type AuthLogState = {
+  tokenProvider?: string | null;
+  openidReuseEnabled: boolean;
+  openidJwtAvailable: boolean;
+  hasOpenIdReuseUserId: boolean;
+};
+
+export type AuthLogContext = Record<string, AuthLogValue>;
+
+function normalizeAuthLogValue(value: unknown): string | undefined {
+  if (value == null) {
+    return undefined;
+  }
+
+  if (Array.isArray(value)) {
+    for (const entry of value) {
+      const normalized = normalizeAuthLogValue(entry);
+      if (normalized) {
+        return normalized;
+      }
+    }
+    return undefined;
+  }
+
+  if (typeof value === 'string') {
+    const trimmed = value.trim();
+    return trimmed || undefined;
+  }
+
+  if (typeof value === 'number' || typeof value === 'boolean') {
+    return String(value);
+  }
+
+  return undefined;
+}
+
+function normalizeAuthLogContextValue(value: unknown): AuthLogValue | undefined {
+  if (value == null) {
+    return undefined;
+  }
+
+  if (Array.isArray(value)) {
+    const values = value
+      .map((entry) => normalizeAuthLogValue(entry))
+      .filter((entry): entry is string => entry !== undefined);
+    return values.length > 0 ? values : undefined;
+  }
+
+  if (typeof value === 'string') {
+    return normalizeAuthLogValue(value);
+  }
+
+  if (typeof value === 'number') {
+    return Number.isFinite(value) ? value : undefined;
+  }
+
+  if (typeof value === 'boolean') {
+    return value;
+  }
+
+  return undefined;
+}
+
+function getRequestId(req: AuthLogRequest): string | undefined {
+  return (
+    normalizeAuthLogValue(req.requestId) ??
+    normalizeAuthLogValue(req.id) ??
+    normalizeAuthLogValue(req.headers?.['x-request-id']) ??
+    normalizeAuthLogValue(req.headers?.['x-correlation-id'])
+  );
+}
+
+function normalizeRoutePath(path: AuthRoutePath | undefined): string | undefined {
+  if (typeof path === 'string') {
+    return normalizeAuthLogValue(path);
+  }
+
+  if (Array.isArray(path)) {
+    for (const entry of path) {
+      const normalized = normalizeRoutePath(entry);
+      if (normalized) {
+        return normalized;
+      }
+    }
+  }
+
+  return undefined;
+}
+
+function joinRoutePath(baseUrl: string | undefined, routePath: string): string {
+  const normalizedRoute = routePath === '/' ? '' : routePath;
+  if (!baseUrl) {
+    return normalizedRoute || '/';
+  }
+  if (!normalizedRoute) {
+    return baseUrl;
+  }
+  return `${baseUrl.replace(/\/$/, '')}/${normalizedRoute.replace(/^\//, '')}`;
+}
+
+function bucketConcretePath(path: string | undefined): string | undefined {
+  const queryless = path?.split('?')[0];
+  if (!queryless) {
+    return undefined;
+  }
+
+  const segments = queryless.split('/').filter(Boolean);
+  if (segments.length === 0) {
+    return '/';
+  }
+  if (segments[0] === 'api' && segments[1]) {
+    return `/${segments.slice(0, 2).join('/')}`;
+  }
+  return `/${segments[0]}`;
+}
+
+function getRequestPath(req: AuthLogRequest): string | undefined {
+  const baseUrl = normalizeAuthLogValue(req.baseUrl);
+  const routePath = normalizeRoutePath(req.route?.path);
+  if (routePath) {
+    return joinRoutePath(baseUrl, routePath);
+  }
+  if (baseUrl) {
+    return baseUrl;
+  }
+
+  const path = normalizeAuthLogValue(req.path) ?? normalizeAuthLogValue(req.originalUrl ?? req.url);
+  return bucketConcretePath(path);
+}
+
+function getAuthFailureField(source: unknown, field: keyof AuthFailureLike): unknown {
+  if (!source) {
+    return undefined;
+  }
+  if (typeof source === 'string') {
+    return field === 'message' ? source : undefined;
+  }
+  if (typeof source === 'object') {
+    try {
+      return (source as AuthFailureLike)[field];
+    } catch {
+      return undefined;
+    }
+  }
+  return undefined;
+}
+
+function compactAuthLogContext(log: Record<string, unknown>): AuthLogContext {
+  const compacted: Partial<AuthLogContext> = {};
+  for (const key of Object.keys(log)) {
+    const value = normalizeAuthLogContextValue(log[key]);
+    if (value !== undefined) {
+      Object.assign(compacted, { [key]: value });
+    }
+  }
+  return compacted as AuthLogContext;
+}
+
+export function getAuthFailureReason(
+  err: unknown,
+  info: unknown,
+  fallback = 'Unauthorized',
+): string {
+  return (
+    normalizeAuthLogValue(getAuthFailureField(info, 'message')) ??
+    normalizeAuthLogValue(getAuthFailureField(err, 'message')) ??
+    fallback
+  );
+}
+
+export function getAuthFailureErrorName(err: unknown, info: unknown): string | undefined {
+  return (
+    normalizeAuthLogValue(getAuthFailureField(info, 'name')) ??
+    normalizeAuthLogValue(getAuthFailureField(err, 'name'))
+  );
+}
+
+function getSafeTokenProvider(tokenProvider: unknown): string | undefined {
+  const normalized = normalizeAuthLogValue(tokenProvider);
+  if (!normalized) {
+    return undefined;
+  }
+  return normalized === 'openid' || normalized === 'librechat' ? normalized : 'other';
+}
+
+export function buildSafeAuthLogContext(
+  req: AuthLogRequest,
+  authState: AuthLogState,
+  extra: Record<string, unknown> = {},
+): AuthLogContext {
+  return compactAuthLogContext({
+    ...extra,
+    request_id: getRequestId(req),
+    method: normalizeAuthLogValue(req.method),
+    path: getRequestPath(req),
+    token_provider: getSafeTokenProvider(authState.tokenProvider),
+    openid_reuse_enabled: authState.openidReuseEnabled,
+    openid_jwt_available: authState.openidJwtAvailable,
+    has_openid_reuse_user_id: authState.hasOpenIdReuseUserId,
+  });
+}
+
+export function formatAuthLogMessage(message: string, context: AuthLogContext): string {
+  return `${message} ${JSON.stringify(context)}`;
+}
diff --git a/packages/api/src/middleware/capabilities.ts b/packages/api/src/middleware/capabilities.ts
index 01a531106fd..6fc9419dbda 100644
--- a/packages/api/src/middleware/capabilities.ts
+++ b/packages/api/src/middleware/capabilities.ts
@@ -62,7 +62,8 @@ export type HasConfigCapabilityFn = (
  * Outside a request context (background jobs, tests), the store is undefined
  * and every check falls through to the database — correct behavior.
  */
-export const capabilityStore = new AsyncLocalStorage<CapabilityStore>();
+export const capabilityStore: AsyncLocalStorage<CapabilityStore> =
+  new AsyncLocalStorage<CapabilityStore>();
 
 export function capabilityContextMiddleware(
   _req: ServerRequest,
diff --git a/packages/api/src/middleware/index.ts b/packages/api/src/middleware/index.ts
index cac5d637b97..fbefaac54bc 100644
--- a/packages/api/src/middleware/index.ts
+++ b/packages/api/src/middleware/index.ts
@@ -5,6 +5,7 @@ export * from './notFound';
 export * from './balance';
 export * from './json';
 export * from './capabilities';
+export * from './auth';
 export {
   tenantContextMiddleware,
   restoreTenantContextFromReq,
@@ -15,3 +16,4 @@ export * from './concurrency';
 export * from './checkBalance';
 export * from './remoteAgentAuth';
 export * from './share';
+export * from './messageFilterPii';
diff --git a/packages/api/src/middleware/messageFilterPii.spec.ts b/packages/api/src/middleware/messageFilterPii.spec.ts
new file mode 100644
index 00000000000..e9428865361
--- /dev/null
+++ b/packages/api/src/middleware/messageFilterPii.spec.ts
@@ -0,0 +1,235 @@
+import type { MessageFilterPiiConfig } from 'librechat-data-provider';
+import type { Request, Response, NextFunction } from 'express';
+
+jest.mock('@librechat/data-schemas', () => ({
+  logger: { warn: jest.fn(), error: jest.fn(), info: jest.fn(), debug: jest.fn() },
+}));
+import { createMessageFilterPii, findPiiMatchInMessages } from './messageFilterPii';
+
+type CapturedResponse = { status?: number; body?: unknown };
+
+function runMiddleware(
+  config: MessageFilterPiiConfig | undefined,
+  body: unknown,
+): { capturedRes: CapturedResponse; nextCalls: number } {
+  const captured: CapturedResponse = {};
+  let nextCalls = 0;
+  const mw = createMessageFilterPii({ getConfig: () => config });
+  const req = { body } as unknown as Request;
+  const res = {
+    status(code: number) {
+      captured.status = code;
+      return this;
+    },
+    json(payload: unknown) {
+      captured.body = payload;
+      return this;
+    },
+  } as unknown as Response;
+  const next: NextFunction = () => {
+    nextCalls++;
+  };
+  mw(req, res, next);
+  return { capturedRes: captured, nextCalls };
+}
+
+describe('messageFilterPii middleware', () => {
+  it('passes through when no config is provided', () => {
+    const { capturedRes, nextCalls } = runMiddleware(undefined, {
+      text: 'my key is sk-proj-FAKE1234567890ABCDEF',
+    });
+    expect(nextCalls).toBe(1);
+    expect(capturedRes.status).toBeUndefined();
+  });
+
+  it('passes through when req.body.text is missing', () => {
+    const { capturedRes, nextCalls } = runMiddleware({}, {});
+    expect(nextCalls).toBe(1);
+    expect(capturedRes.status).toBeUndefined();
+  });
+
+  it('passes through when req.body.text is the empty string', () => {
+    const { capturedRes, nextCalls } = runMiddleware({}, { text: '' });
+    expect(nextCalls).toBe(1);
+    expect(capturedRes.status).toBeUndefined();
+  });
+
+  it('passes through plain text that matches no pattern', () => {
+    const { capturedRes, nextCalls } = runMiddleware({}, { text: 'hello world' });
+    expect(nextCalls).toBe(1);
+    expect(capturedRes.status).toBeUndefined();
+  });
+
+  it('rejects with 400 when an sk- token is present (default starters)', () => {
+    const { capturedRes, nextCalls } = runMiddleware(
+      {},
+      { text: 'my key is sk-proj-FAKE1234567890ABCDEF please' },
+    );
+    expect(nextCalls).toBe(0);
+    expect(capturedRes.status).toBe(400);
+    expect(capturedRes.body).toEqual({
+      error: 'message_filter_pii_block',
+      message: 'Message contains a sk- prefix token. Remove it and try again.',
+    });
+  });
+
+  it('rejects with 400 when a Bearer header is present', () => {
+    const { capturedRes, nextCalls } = runMiddleware(
+      {},
+      { text: 'Authorization: Bearer eyJabc.def-ghi' },
+    );
+    expect(nextCalls).toBe(0);
+    expect(capturedRes.status).toBe(400);
+    expect(capturedRes.body).toMatchObject({ error: 'message_filter_pii_block' });
+  });
+
+  it('rejects with 400 when an api-key header is present', () => {
+    const { capturedRes, nextCalls } = runMiddleware({}, { text: 'api-key: foo123bar' });
+    expect(nextCalls).toBe(0);
+    expect(capturedRes.status).toBe(400);
+  });
+
+  it('honors a starterPatterns subset (sk passes when only bearer is enabled)', () => {
+    const { capturedRes, nextCalls } = runMiddleware(
+      { starterPatterns: ['bearer_header'] },
+      { text: 'my key is sk-proj-FAKE1234567890ABCDEF please' },
+    );
+    expect(nextCalls).toBe(1);
+    expect(capturedRes.status).toBeUndefined();
+  });
+
+  it('treats starterPatterns: [] as disabling all starters', () => {
+    const { capturedRes, nextCalls } = runMiddleware(
+      { starterPatterns: [] },
+      { text: 'my key is sk-proj-FAKE1234567890ABCDEF please' },
+    );
+    expect(nextCalls).toBe(1);
+    expect(capturedRes.status).toBeUndefined();
+  });
+
+  it('rejects on a customPatterns match with the operator-supplied label', () => {
+    const { capturedRes, nextCalls } = runMiddleware(
+      {
+        starterPatterns: [],
+        customPatterns: [{ id: 'org', label: 'Org token', regex: '\\bORG-[A-Z0-9]{6,}' }],
+      },
+      { text: 'token ORG-DEADBEEF here' },
+    );
+    expect(nextCalls).toBe(0);
+    expect(capturedRes.status).toBe(400);
+    expect(capturedRes.body).toEqual({
+      error: 'message_filter_pii_block',
+      message: 'Message contains a Org token. Remove it and try again.',
+    });
+  });
+
+  it('layers customPatterns on top of starters', () => {
+    const { capturedRes, nextCalls } = runMiddleware(
+      {
+        customPatterns: [{ id: 'org', label: 'Org token', regex: '\\bORG-[A-Z0-9]{6,}' }],
+      },
+      { text: 'token ORG-DEADBEEF here' },
+    );
+    expect(nextCalls).toBe(0);
+    expect(capturedRes.status).toBe(400);
+  });
+
+  it('returns the same compiled pattern array for repeat calls with the same config (memoization)', () => {
+    const config: MessageFilterPiiConfig = {
+      customPatterns: [{ id: 'org', label: 'Org token', regex: '\\bORG-[A-Z0-9]{6,}' }],
+    };
+    const a = runMiddleware(config, { text: 'plain' });
+    const b = runMiddleware(config, { text: 'plain' });
+    expect(a.nextCalls).toBe(1);
+    expect(b.nextCalls).toBe(1);
+  });
+
+  it('drops an invalid customPattern regex without throwing and keeps other patterns active', () => {
+    const config = {
+      starterPatterns: [],
+      customPatterns: [
+        { id: 'broken', label: 'Broken', regex: '(' },
+        { id: 'org', label: 'Org token', regex: '\\bORG-[A-Z0-9]{6,}' },
+      ],
+    } as unknown as MessageFilterPiiConfig;
+    const benign = runMiddleware(config, { text: 'plain text' });
+    expect(benign.nextCalls).toBe(1);
+    expect(benign.capturedRes.status).toBeUndefined();
+    const matching = runMiddleware(config, { text: 'token ORG-DEADBEEF here' });
+    expect(matching.nextCalls).toBe(0);
+    expect(matching.capturedRes.status).toBe(400);
+  });
+});
+
+describe('findPiiMatchInMessages', () => {
+  it('returns null for missing or empty messages', () => {
+    expect(findPiiMatchInMessages(undefined, {})).toBeNull();
+    expect(findPiiMatchInMessages([], {})).toBeNull();
+  });
+
+  it('returns null when no config is provided', () => {
+    expect(
+      findPiiMatchInMessages([{ role: 'user', content: 'sk-proj-FAKE123' }], undefined),
+    ).toBeNull();
+  });
+
+  it('matches a system-role message (remote APIs accept caller-supplied system roles)', () => {
+    const hit = findPiiMatchInMessages(
+      [{ role: 'system', content: 'system primer with sk-proj-FAKE1234567890ABCDEF embedded' }],
+      {},
+    );
+    expect(hit).toEqual({ id: 'sk_prefix', label: 'sk- prefix token' });
+  });
+
+  it('matches an assistant-role message (callers can include attacker-controlled history)', () => {
+    const hit = findPiiMatchInMessages(
+      [{ role: 'assistant', content: 'sk-proj-FAKE1234567890ABCDEF' }],
+      {},
+    );
+    expect(hit).toEqual({ id: 'sk_prefix', label: 'sk- prefix token' });
+  });
+
+  it('matches a tool-role message', () => {
+    const hit = findPiiMatchInMessages(
+      [{ role: 'tool', content: 'tool reply leaking sk-proj-FAKE1234567890ABCDEF' }],
+      {},
+    );
+    expect(hit).toEqual({ id: 'sk_prefix', label: 'sk- prefix token' });
+  });
+
+  it('matches a string-content user message', () => {
+    const hit = findPiiMatchInMessages(
+      [{ role: 'user', content: 'my key is sk-proj-FAKE1234567890ABCDEF' }],
+      {},
+    );
+    expect(hit).toEqual({ id: 'sk_prefix', label: 'sk- prefix token' });
+  });
+
+  it('matches a content-parts user message (text part)', () => {
+    const hit = findPiiMatchInMessages(
+      [
+        {
+          role: 'user',
+          content: [
+            { type: 'image_url', image_url: { url: 'data:...' } },
+            { type: 'text', text: 'Authorization: Bearer abc.def.ghi' },
+          ],
+        },
+      ],
+      {},
+    );
+    expect(hit).toEqual({ id: 'bearer_header', label: 'Bearer token' });
+  });
+
+  it('returns null when no user message matches', () => {
+    expect(findPiiMatchInMessages([{ role: 'user', content: 'hello world' }], {})).toBeNull();
+  });
+
+  it('honors customPatterns from config', () => {
+    const hit = findPiiMatchInMessages([{ role: 'user', content: 'token ORG-DEADBEEF here' }], {
+      starterPatterns: [],
+      customPatterns: [{ id: 'org', label: 'Org token', regex: '\\bORG-[A-Z0-9]{6,}' }],
+    });
+    expect(hit).toEqual({ id: 'org', label: 'Org token' });
+  });
+});
diff --git a/packages/api/src/middleware/messageFilterPii.ts b/packages/api/src/middleware/messageFilterPii.ts
new file mode 100644
index 00000000000..91c8e6ba668
--- /dev/null
+++ b/packages/api/src/middleware/messageFilterPii.ts
@@ -0,0 +1,145 @@
+import { logger } from '@librechat/data-schemas';
+import type {
+  NextFunction,
+  RequestHandler,
+  Request as ServerRequest,
+  Response as ServerResponse,
+} from 'express';
+import type { MessageFilterPiiConfig } from 'librechat-data-provider';
+
+type CompiledPattern = { id: string; label: string; pattern: RegExp };
+
+const STARTER_PATTERNS: CompiledPattern[] = [
+  { id: 'sk_prefix', label: 'sk- prefix token', pattern: /\b(sk-)[a-zA-Z0-9_-]+/g },
+  { id: 'bearer_header', label: 'Bearer token', pattern: /\b(Bearer )[^\s"']+/gi },
+  { id: 'api_key_header', label: 'api-key header', pattern: /\b(api-key:?\s+)[^\s"']+/gi },
+];
+
+const STARTER_BY_ID = new Map(STARTER_PATTERNS.map((p) => [p.id, p]));
+
+function selectStarter(ids?: string[]): CompiledPattern[] {
+  if (ids == null) {
+    return STARTER_PATTERNS;
+  }
+  const out: CompiledPattern[] = [];
+  for (const id of ids) {
+    const entry = STARTER_BY_ID.get(id);
+    if (entry != null) {
+      out.push(entry);
+    }
+  }
+  return out;
+}
+
+const COMPILE_CACHE = new WeakMap<object, CompiledPattern[]>();
+
+function compile(config: MessageFilterPiiConfig): CompiledPattern[] {
+  const cached = COMPILE_CACHE.get(config);
+  if (cached != null) {
+    return cached;
+  }
+  const starter = selectStarter(config.starterPatterns);
+  const custom: CompiledPattern[] = [];
+  for (const p of config.customPatterns ?? []) {
+    try {
+      custom.push({ id: p.id, label: p.label, pattern: new RegExp(p.regex, 'g') });
+    } catch (err) {
+      logger.warn(
+        `[messageFilter.pii] dropping invalid customPattern ${JSON.stringify(p.id)}: ${(err as Error).message}`,
+      );
+    }
+  }
+  const result = [...starter, ...custom];
+  COMPILE_CACHE.set(config, result);
+  return result;
+}
+
+function findMatch(text: string, patterns: CompiledPattern[]): CompiledPattern | null {
+  for (const p of patterns) {
+    p.pattern.lastIndex = 0;
+    if (p.pattern.test(text)) {
+      return p;
+    }
+  }
+  return null;
+}
+
+export interface PiiMatch {
+  id: string;
+  label: string;
+}
+
+type ContentPart = { type?: string; text?: string; [key: string]: unknown };
+type ChatLikeMessage = {
+  role?: string;
+  content?: string | ContentPart[];
+};
+
+export function findPiiMatchInMessages(
+  messages: ChatLikeMessage[] | undefined,
+  config: MessageFilterPiiConfig | undefined,
+): PiiMatch | null {
+  if (config == null || !Array.isArray(messages) || messages.length === 0) {
+    return null;
+  }
+  const patterns = compile(config);
+  if (patterns.length === 0) {
+    return null;
+  }
+  for (const msg of messages) {
+    if (msg == null) {
+      continue;
+    }
+    if (typeof msg.content === 'string') {
+      const hit = findMatch(msg.content, patterns);
+      if (hit != null) {
+        return { id: hit.id, label: hit.label };
+      }
+      continue;
+    }
+    if (Array.isArray(msg.content)) {
+      for (const part of msg.content) {
+        if (part != null && typeof part.text === 'string') {
+          const hit = findMatch(part.text, patterns);
+          if (hit != null) {
+            return { id: hit.id, label: hit.label };
+          }
+        }
+      }
+    }
+  }
+  return null;
+}
+
+export interface CreateMessageFilterPiiOptions {
+  getConfig: (req: ServerRequest) => MessageFilterPiiConfig | undefined;
+}
+
+export function createMessageFilterPii(options: CreateMessageFilterPiiOptions): RequestHandler {
+  return function messageFilterPii(req: ServerRequest, res: ServerResponse, next: NextFunction) {
+    const config = options.getConfig(req);
+    if (config == null) {
+      next();
+      return;
+    }
+    const text = req.body?.text;
+    if (typeof text !== 'string' || text.length === 0) {
+      next();
+      return;
+    }
+    const patterns = compile(config);
+    if (patterns.length === 0) {
+      next();
+      return;
+    }
+    const match = findMatch(text, patterns);
+    if (match == null) {
+      next();
+      return;
+    }
+    res.status(400).json({
+      error: 'message_filter_pii_block',
+      message: `Message contains a ${match.label}. Remove it and try again.`,
+    });
+  };
+}
diff --git a/packages/api/src/middleware/remoteAgentAuth.spec.ts b/packages/api/src/middleware/remoteAgentAuth.spec.ts
index f7c7c96db00..3e873789154 100644
--- a/packages/api/src/middleware/remoteAgentAuth.spec.ts
+++ b/packages/api/src/middleware/remoteAgentAuth.spec.ts
@@ -3,6 +3,7 @@ import type { TAgentsEndpoint } from 'librechat-data-provider';
 import type { JwtPayload, VerifyOptions } from 'jsonwebtoken';
 import type { Request, Response } from 'express';
 import type { RequestInit } from 'undici';
+import type { RemoteAgentAuthDeps } from './remoteAgentAuth';
 
 jest.mock('@librechat/data-schemas', () => {
   const actual = jest.requireActual('@librechat/data-schemas');
@@ -22,6 +23,11 @@ jest.mock('~/utils', () => ({
   math: jest.fn(() => 60000),
 }));
 
+jest.mock('~/utils/proxy', () => ({
+  getEnvProxyDispatcher: jest.fn(),
+  getHttpsProxyAgent: jest.fn(),
+}));
+
 const mockGetSigningKey = jest.fn();
 const mockGetSigningKeys = jest.fn();
 
@@ -31,7 +37,6 @@ jest.mock('jwks-rsa', () =>
 
 jest.mock('undici', () => ({
   fetch: jest.fn(),
-  ProxyAgent: jest.fn((proxy: string) => ({ proxy })),
 }));
 
 jest.mock('jsonwebtoken', () => ({
@@ -47,16 +52,18 @@ jest.mock('../auth/openid', () => {
 import jwt from 'jsonwebtoken';
 import jwksRsa from 'jwks-rsa';
 import { SystemRoles } from 'librechat-data-provider';
-import { ProxyAgent, fetch as undiciFetch } from 'undici';
+import { fetch as undiciFetch } from 'undici';
 import { logger, tenantStorage } from '@librechat/data-schemas';
 import { clearRemoteAgentAuthCache, createRemoteAgentAuth } from './remoteAgentAuth';
 import { findOpenIDUser, getOpenIdEmail } from '../auth/openid';
 import { isEnabled, math } from '~/utils';
+import { getEnvProxyDispatcher, getHttpsProxyAgent } from '~/utils/proxy';
 
 const mockFetch = undiciFetch as jest.Mock;
-const mockProxyAgent = ProxyAgent as unknown as jest.Mock;
 const mockMath = math as jest.Mock;
 const mockIsEnabled = isEnabled as jest.Mock;
+const mockGetEnvProxyDispatcher = getEnvProxyDispatcher as jest.Mock;
+const mockGetHttpsProxyAgent = getHttpsProxyAgent as jest.Mock;
 const realFindOpenIDUser =
   jest.requireActual<typeof import('../auth/openid')>('../auth/openid').findOpenIDUser;
 const mockFindOpenIDUser = findOpenIDUser as jest.MockedFunction<typeof findOpenIDUser>;
@@ -226,6 +233,10 @@ function makeDeps(appConfig: AppConfig = makeConfig()) {
   };
 }
 
+function asDeps(deps: ReturnType<typeof makeDeps>): RemoteAgentAuthDeps {
+  return deps as unknown as RemoteAgentAuthDeps;
+}
+
 function setupOidcMocks(payload: JwtPayload, kid: string | null = 'test-kid') {
   (jwt.decode as jest.Mock).mockReturnValue({ header: kid == null ? {} : { kid }, payload });
   mockGetSigningKey.mockResolvedValue({ getPublicKey: () => 'public-key' });
@@ -247,6 +258,8 @@ describe('createRemoteAgentAuth', () => {
     mockFetch.mockReset();
     mockMath.mockReturnValue(60000);
     mockIsEnabled.mockImplementation((value?: string) => value === 'true');
+    mockGetEnvProxyDispatcher.mockReturnValue(undefined);
+    mockGetHttpsProxyAgent.mockReturnValue(undefined);
     mockFindOpenIDUser.mockImplementation(realFindOpenIDUser);
     mockNext = jest.fn();
   });
@@ -265,7 +278,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps(makeConfig({ enabled: false }, { enabled: false }));
       const { res, status, json } = makeRes();
 
-      await createRemoteAgentAuth(deps)(makeReq() as Request, res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(makeReq() as Request, res, mockNext);
 
       expect(status).toHaveBeenCalledWith(401);
       expect(json).toHaveBeenCalledWith({ error: 'Authentication required' });
@@ -275,14 +288,14 @@ describe('createRemoteAgentAuth', () => {
 
     it('falls back to apiKeyMiddleware when oidc.enabled is false', async () => {
       const deps = makeDeps(makeConfig({ enabled: false }));
-      await createRemoteAgentAuth(deps)(makeReq() as Request, makeRes().res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(makeReq() as Request, makeRes().res, mockNext);
       expect(deps.apiKeyMiddleware).toHaveBeenCalled();
     });
 
     it('loads base config before authentication when tenant context is absent', async () => {
       const deps = makeDeps(makeConfig({ enabled: false }));
 
-      await createRemoteAgentAuth(deps)(makeReq() as Request, makeRes().res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(makeReq() as Request, makeRes().res, mockNext);
 
       expect(deps.getAppConfig).toHaveBeenCalledWith({ baseOnly: true });
       expect(deps.apiKeyMiddleware).toHaveBeenCalled();
@@ -301,7 +314,7 @@ describe('createRemoteAgentAuth', () => {
       });
       const { res, status, json } = makeRes();
 
-      await createRemoteAgentAuth(deps)(makeReq() as Request, res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(makeReq() as Request, res, mockNext);
 
       expect(deps.getAppConfig).toHaveBeenNthCalledWith(1, { baseOnly: true });
       expect(deps.getAppConfig).toHaveBeenNthCalledWith(2, { tenantId: 'tenant-oidc-only' });
@@ -314,7 +327,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps(makeConfig({ enabled: false }));
 
       await tenantStorage.run({ tenantId: 'tenant-preauth' }, async () => {
-        await createRemoteAgentAuth(deps)(makeReq() as Request, makeRes().res, mockNext);
+        await createRemoteAgentAuth(asDeps(deps))(makeReq() as Request, makeRes().res, mockNext);
       });
 
       expect(deps.getAppConfig).toHaveBeenCalledWith({ tenantId: 'tenant-preauth' });
@@ -331,7 +344,7 @@ describe('createRemoteAgentAuth', () => {
       const { res, status } = makeRes();
 
       await tenantStorage.run({ tenantId: 'tenant-oidc-only' }, async () => {
-        await createRemoteAgentAuth(deps)(makeReq() as Request, res, mockNext);
+        await createRemoteAgentAuth(asDeps(deps))(makeReq() as Request, res, mockNext);
       });
 
       expect(deps.getAppConfig).toHaveBeenCalledWith({ tenantId: 'tenant-oidc-only' });
@@ -344,7 +357,7 @@ describe('createRemoteAgentAuth', () => {
       const req = makeReq();
       req.user = makeUser({ tenantId: 'tenant-a' });
 
-      await createRemoteAgentAuth(deps)(req as Request, makeRes().res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(req as Request, makeRes().res, mockNext);
 
       expect(deps.getAppConfig).toHaveBeenCalledWith({ tenantId: 'tenant-a' });
       expect(deps.apiKeyMiddleware).toHaveBeenCalled();
@@ -352,7 +365,7 @@ describe('createRemoteAgentAuth', () => {
 
     it('falls back to apiKeyMiddleware when remoteApi auth is absent', async () => {
       const deps = makeDeps({ endpoints: { agents: {} } } as unknown as AppConfig);
-      await createRemoteAgentAuth(deps)(makeReq() as Request, makeRes().res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(makeReq() as Request, makeRes().res, mockNext);
       expect(deps.apiKeyMiddleware).toHaveBeenCalled();
     });
 
@@ -363,7 +376,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps(config);
       const { res, status } = makeRes();
 
-      await createRemoteAgentAuth(deps)(makeReq() as Request, res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(makeReq() as Request, res, mockNext);
 
       expect(status).toHaveBeenCalledWith(401);
       expect(mockNext).not.toHaveBeenCalled();
@@ -376,7 +389,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps(makeConfig({}, { enabled: true }));
       const { res } = makeRes();
 
-      await createRemoteAgentAuth(deps)(makeReq() as Request, res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(makeReq() as Request, res, mockNext);
 
       expect(deps.apiKeyMiddleware).toHaveBeenCalled();
       expect(mockNext).toHaveBeenCalled();
@@ -386,7 +399,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps(makeConfig({}, { enabled: false }));
       const { res, status, json } = makeRes();
 
-      await createRemoteAgentAuth(deps)(makeReq() as Request, res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(makeReq() as Request, res, mockNext);
 
       expect(status).toHaveBeenCalledWith(401);
       expect(json).toHaveBeenCalledWith({ error: 'Bearer token required' });
@@ -397,7 +410,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps(makeConfig({ issuer: undefined }, { enabled: false }));
       const { res, status, json } = makeRes();
 
-      await createRemoteAgentAuth(deps)(makeReq() as Request, res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(makeReq() as Request, res, mockNext);
 
       expect(status).toHaveBeenCalledWith(500);
       expect(json).toHaveBeenCalledWith({ error: 'Internal server error' });
@@ -408,7 +421,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps(makeConfig({ audience: undefined }, { enabled: false }));
       const { res, status, json } = makeRes();
 
-      await createRemoteAgentAuth(deps)(makeReq() as Request, res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(makeReq() as Request, res, mockNext);
 
       expect(status).toHaveBeenCalledWith(500);
       expect(json).toHaveBeenCalledWith({ error: 'Internal server error' });
@@ -423,7 +436,7 @@ describe('createRemoteAgentAuth', () => {
       const req = makeReq({ authorization: `Bearer ${FAKE_TOKEN}` });
       const { res } = makeRes();
 
-      await createRemoteAgentAuth(deps)(req as Request, res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(req as Request, res, mockNext);
 
       expect(req.user).toMatchObject({ id: 'uid123', email: 'agent@test.com' });
       expect((jwt.verify as jest.Mock).mock.calls[0][2]).toEqual(
@@ -444,7 +457,7 @@ describe('createRemoteAgentAuth', () => {
       );
       const req = makeReq({ authorization: `Bearer ${FAKE_TOKEN}` });
 
-      await createRemoteAgentAuth(deps)(req as Request, makeRes().res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(req as Request, makeRes().res, mockNext);
 
       expect(deps.getAppConfig).toHaveBeenNthCalledWith(1, { baseOnly: true });
       expect(deps.getAppConfig).toHaveBeenNthCalledWith(2, {
@@ -480,7 +493,7 @@ describe('createRemoteAgentAuth', () => {
       const req = makeReq({ authorization: `Bearer ${FAKE_TOKEN}` });
       const { res, status, json } = makeRes();
 
-      await createRemoteAgentAuth(deps)(req as Request, res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(req as Request, res, mockNext);
 
       expect(deps.getAppConfig).toHaveBeenNthCalledWith(1, { baseOnly: true });
       expect(deps.getAppConfig).toHaveBeenNthCalledWith(2, {
@@ -516,7 +529,7 @@ describe('createRemoteAgentAuth', () => {
       const req = makeReq({ authorization: `Bearer ${FAKE_TOKEN}` });
       const { res, status, json } = makeRes();
 
-      await createRemoteAgentAuth(deps)(req as Request, res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(req as Request, res, mockNext);
 
       expect(deps.getAppConfig).toHaveBeenNthCalledWith(1, { baseOnly: true });
       expect(deps.getAppConfig).toHaveBeenNthCalledWith(2, {
@@ -538,7 +551,7 @@ describe('createRemoteAgentAuth', () => {
       const issuer = `${BASE_ISSUER}/`;
       const deps = makeDeps(makeConfig({ issuer }));
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         makeRes().res,
         mockNext,
@@ -555,7 +568,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps();
       const req = makeReq({ authorization: `bearer ${FAKE_TOKEN}` });
 
-      await createRemoteAgentAuth(deps)(req as Request, makeRes().res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(req as Request, makeRes().res, mockNext);
 
       expect(jwt.verify).toHaveBeenCalledWith(
         FAKE_TOKEN,
@@ -572,7 +585,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps();
       const req = makeReq({ authorization: `Bearer ${FAKE_TOKEN}   ` });
 
-      await createRemoteAgentAuth(deps)(req as Request, makeRes().res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(req as Request, makeRes().res, mockNext);
 
       expect(jwt.verify).toHaveBeenCalledWith(
         FAKE_TOKEN,
@@ -588,7 +601,7 @@ describe('createRemoteAgentAuth', () => {
       setupOidcMocks({ sub: 'sub123', email: 'agent@test.com' });
       const deps = makeDeps();
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         makeRes().res,
         mockNext,
@@ -615,7 +628,7 @@ describe('createRemoteAgentAuth', () => {
       setupOidcMocks({ sub: 'sub123', email: 'agent@test.com' });
       const deps = makeDeps();
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         makeRes().res,
         mockNext,
@@ -648,7 +661,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps();
       const req = makeReq({ authorization: `Bearer ${FAKE_TOKEN}` });
 
-      await createRemoteAgentAuth(deps)(req as Request, makeRes().res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(req as Request, makeRes().res, mockNext);
 
       expect(mockGetSigningKey).not.toHaveBeenCalled();
       expect(jwt.verify).toHaveBeenCalledTimes(2);
@@ -664,7 +677,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps();
       const req = makeReq({ authorization: `Bearer ${FAKE_TOKEN}` });
 
-      await createRemoteAgentAuth(deps)(req as Request, makeRes().res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(req as Request, makeRes().res, mockNext);
 
       expect((req.user as IUser).federatedTokens).toEqual({
         access_token: FAKE_TOKEN,
@@ -677,7 +690,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps();
       const req = makeReq({ authorization: `Bearer ${FAKE_TOKEN}` });
 
-      await createRemoteAgentAuth(deps)(req as Request, makeRes().res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(req as Request, makeRes().res, mockNext);
 
       expect((req.user as IUser).federatedTokens).toEqual({
         access_token: FAKE_TOKEN,
@@ -691,7 +704,7 @@ describe('createRemoteAgentAuth', () => {
       deps.findUser.mockResolvedValue(null);
       const { res } = makeRes();
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         res,
         mockNext,
@@ -710,7 +723,7 @@ describe('createRemoteAgentAuth', () => {
       deps.findUser.mockResolvedValue(null);
       const { res, status, json } = makeRes();
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         res,
         mockNext,
@@ -736,7 +749,7 @@ describe('createRemoteAgentAuth', () => {
       const req = makeReq({ authorization: `Bearer ${FAKE_TOKEN}` });
       const { res, status, json } = makeRes();
 
-      await createRemoteAgentAuth(deps)(req as Request, res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(req as Request, res, mockNext);
 
       expect(status).toHaveBeenCalledWith(401);
       expect(json).toHaveBeenCalledWith({ error: 'Unauthorized' });
@@ -751,7 +764,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps(makeConfig({}, { enabled: true }));
       const { res, status, json } = makeRes();
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         res,
         mockNext,
@@ -773,7 +786,7 @@ describe('createRemoteAgentAuth', () => {
         .mockResolvedValueOnce(makeUser({ provider: 'google', openidId: undefined }));
       const { res, status, json } = makeRes();
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         res,
         mockNext,
@@ -796,7 +809,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps(makeConfig({}, { enabled: true }));
       const { res } = makeRes();
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         res,
         mockNext,
@@ -814,7 +827,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps(makeConfig({}, { enabled: false }));
       const { res, status, json } = makeRes();
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         res,
         mockNext,
@@ -833,7 +846,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps(makeConfig({}, { enabled: false }));
       const { res, status } = makeRes();
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: 'Bearer not.a.jwt' }) as Request,
         res,
         mockNext,
@@ -858,7 +871,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps(makeConfig({}, { enabled: false }));
       const { res, status, json } = makeRes();
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         res,
         mockNext,
@@ -883,7 +896,7 @@ describe('createRemoteAgentAuth', () => {
       };
       const { res, status, json } = makeRes();
 
-      await createRemoteAgentAuth(deps)(makeReq() as Request, res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(makeReq() as Request, res, mockNext);
 
       expect(status).toHaveBeenCalledWith(500);
       expect(json).toHaveBeenCalledWith({ error: 'Internal server error' });
@@ -900,7 +913,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps(makeConfig({}, { enabled: true }));
       const { res, status, json } = makeRes();
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         res,
         mockNext,
@@ -925,7 +938,7 @@ describe('createRemoteAgentAuth', () => {
         }),
       );
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         makeRes().res,
         mockNext,
@@ -941,7 +954,7 @@ describe('createRemoteAgentAuth', () => {
         makeConfig({ jwksUri: undefined, issuer: 'https://issuer-env-1.example.com' }),
       );
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         makeRes().res,
         mockNext,
@@ -961,7 +974,7 @@ describe('createRemoteAgentAuth', () => {
       );
       const { res, status } = makeRes();
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         res,
         mockNext,
@@ -983,7 +996,7 @@ describe('createRemoteAgentAuth', () => {
       );
       const { res, status } = makeRes();
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         res,
         mockNext,
@@ -1001,7 +1014,7 @@ describe('createRemoteAgentAuth', () => {
         makeConfig({ jwksUri: undefined, issuer: 'http://localhost:8080/realms/test' }),
       );
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         makeRes().res,
         mockNext,
@@ -1024,7 +1037,7 @@ describe('createRemoteAgentAuth', () => {
 
       const deps = makeDeps(makeConfig({ jwksUri: undefined, issuer }));
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         makeRes().res,
         mockNext,
@@ -1048,7 +1061,7 @@ describe('createRemoteAgentAuth', () => {
 
       const deps = makeDeps(makeConfig({ jwksUri: undefined, issuer }));
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         makeRes().res,
         mockNext,
@@ -1075,7 +1088,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps(makeConfig({ jwksUri: undefined, issuer }, { enabled: false }));
       const { res, status } = makeRes();
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         res,
         mockNext,
@@ -1086,8 +1099,9 @@ describe('createRemoteAgentAuth', () => {
       expect(mockNext).not.toHaveBeenCalled();
     });
 
-    it('uses a proxy agent for discovery when PROXY is set', async () => {
-      process.env.PROXY = 'http://proxy.example.com';
+    it('uses a proxy dispatcher for discovery when configured', async () => {
+      const proxyDispatcher = { dispatch: jest.fn() };
+      mockGetEnvProxyDispatcher.mockReturnValue(proxyDispatcher);
       const issuer = 'https://issuer-proxy.example.com';
 
       mockFetch.mockResolvedValue({
@@ -1097,16 +1111,15 @@ describe('createRemoteAgentAuth', () => {
 
       const deps = makeDeps(makeConfig({ jwksUri: undefined, issuer }));
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         makeRes().res,
         mockNext,
       );
 
-      expect(mockProxyAgent).toHaveBeenCalledWith('http://proxy.example.com');
       expect(mockFetch).toHaveBeenCalledWith(
         `${issuer}/.well-known/openid-configuration`,
-        expect.objectContaining({ dispatcher: { proxy: 'http://proxy.example.com' } }),
+        expect.objectContaining({ dispatcher: proxyDispatcher }),
       );
     });
 
@@ -1116,7 +1129,7 @@ describe('createRemoteAgentAuth', () => {
         makeConfig({ jwksUri: undefined, issuer: 'https://issuer-env-cache.example.com' }),
       );
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         makeRes().res,
         mockNext,
@@ -1124,7 +1137,7 @@ describe('createRemoteAgentAuth', () => {
 
       process.env.OPENID_JWKS_URL = 'https://env-two.example.com/jwks';
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         makeRes().res,
         mockNext,
@@ -1147,13 +1160,13 @@ describe('createRemoteAgentAuth', () => {
         }),
       );
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         makeRes().res,
         mockNext,
       );
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         makeRes().res,
         mockNext,
@@ -1171,7 +1184,7 @@ describe('createRemoteAgentAuth', () => {
           }),
         );
 
-        await createRemoteAgentAuth(deps)(
+        await createRemoteAgentAuth(asDeps(deps))(
           makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
           makeRes().res,
           mockNext,
@@ -1199,7 +1212,7 @@ describe('createRemoteAgentAuth', () => {
           }),
         );
 
-        await createRemoteAgentAuth(deps)(
+        await createRemoteAgentAuth(asDeps(deps))(
           makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
           makeRes().res,
           mockNext,
@@ -1247,7 +1260,7 @@ describe('createRemoteAgentAuth', () => {
           ),
         );
         const { res, status } = makeRes();
-        const request = createRemoteAgentAuth(deps)(
+        const request = createRemoteAgentAuth(asDeps(deps))(
           makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
           res,
           mockNext,
@@ -1275,7 +1288,7 @@ describe('createRemoteAgentAuth', () => {
       );
       const { res, status } = makeRes();
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         res,
         mockNext,
@@ -1295,7 +1308,7 @@ describe('createRemoteAgentAuth', () => {
       );
       const { res, status } = makeRes();
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         res,
         mockNext,
@@ -1313,7 +1326,7 @@ describe('createRemoteAgentAuth', () => {
       deps.findUser
         .mockResolvedValueOnce(null)
         .mockResolvedValueOnce(makeUser({ email: getOpenIdEmail(claims), openidId: claims.sub }));
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         makeRes().res,
         mockNext,
@@ -1375,7 +1388,7 @@ describe('createRemoteAgentAuth', () => {
           role: 'user',
         }),
       );
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         makeRes().res,
         mockNext,
@@ -1407,7 +1420,7 @@ describe('createRemoteAgentAuth', () => {
       );
       const { res, status, json } = makeRes();
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         res,
         mockNext,
@@ -1424,7 +1437,7 @@ describe('createRemoteAgentAuth', () => {
       setupOidcMocks({ sub: 'sub123', email: 'agent@test.com' });
 
       const deps = { ...makeDeps(), updateUser: mockUpdateUser };
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         makeRes().res,
         mockNext,
@@ -1456,7 +1469,7 @@ describe('createRemoteAgentAuth', () => {
       setupOidcMocks({ sub: 'sub123', email: 'agent@test.com', roles: ['STANDARD-USER'] });
 
       const deps = makeDeps();
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         makeRes().res,
         mockNext,
@@ -1477,7 +1490,7 @@ describe('createRemoteAgentAuth', () => {
 
       const deps = makeDeps();
       const req = makeReq({ authorization: `Bearer ${FAKE_TOKEN}` });
-      await createRemoteAgentAuth(deps)(req as Request, makeRes().res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(req as Request, makeRes().res, mockNext);
 
       expect(deps.updateUser).toHaveBeenCalledWith('uid123', { role: 'STANDARD-USER' });
       expect(req.user).toMatchObject({ role: 'STANDARD-USER' });
@@ -1494,7 +1507,7 @@ describe('createRemoteAgentAuth', () => {
 
       const deps = makeDeps();
       const req = makeReq({ authorization: `Bearer ${FAKE_TOKEN}` });
-      await createRemoteAgentAuth(deps)(req as Request, makeRes().res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(req as Request, makeRes().res, mockNext);
 
       expect(deps.updateUser).toHaveBeenCalledWith('uid123', { role: 'USER' });
       expect(req.user).toMatchObject({ role: 'USER' });
@@ -1510,7 +1523,7 @@ describe('createRemoteAgentAuth', () => {
 
       const deps = makeDeps();
       const req = makeReq({ authorization: `Bearer ${FAKE_TOKEN}` });
-      await createRemoteAgentAuth(deps)(req as Request, makeRes().res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(req as Request, makeRes().res, mockNext);
 
       expect(deps.updateUser).toHaveBeenCalledWith('uid123', { role: 'USER' });
       expect(req.user).toMatchObject({ role: 'USER' });
@@ -1527,7 +1540,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps();
       deps.findUser = makeFindUser(makeUser({ role: SystemRoles.ADMIN }));
       const req = makeReq({ authorization: `Bearer ${FAKE_TOKEN}` });
-      await createRemoteAgentAuth(deps)(req as Request, makeRes().res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(req as Request, makeRes().res, mockNext);
 
       expect(deps.getRolesByNames).not.toHaveBeenCalled();
       expect(deps.updateUser).not.toHaveBeenCalled();
@@ -1540,7 +1553,7 @@ describe('createRemoteAgentAuth', () => {
 
       const deps = makeDeps();
       const req = makeReq({ authorization: `Bearer ${FAKE_TOKEN}` });
-      await createRemoteAgentAuth(deps)(req as Request, makeRes().res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(req as Request, makeRes().res, mockNext);
 
       expect(deps.getRolesByNames).not.toHaveBeenCalled();
       expect(deps.updateUser).not.toHaveBeenCalled();
@@ -1557,7 +1570,7 @@ describe('createRemoteAgentAuth', () => {
 
       const deps = makeDeps();
       const req = makeReq({ authorization: `Bearer ${FAKE_TOKEN}` });
-      await createRemoteAgentAuth(deps)(req as Request, makeRes().res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(req as Request, makeRes().res, mockNext);
 
       expect(deps.updateUser).not.toHaveBeenCalled();
       expect(req.user).toMatchObject({ role: 'user' });
@@ -1576,7 +1589,7 @@ describe('createRemoteAgentAuth', () => {
       );
       const req = makeReq({ authorization: `Bearer ${FAKE_TOKEN}` });
 
-      await createRemoteAgentAuth(deps)(req as Request, makeRes().res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(req as Request, makeRes().res, mockNext);
 
       expect(deps.getRolesByNames).toHaveBeenCalledWith(
         ['STANDARD-USER', 'BASIC-USER', 'USER'],
@@ -1604,7 +1617,7 @@ describe('createRemoteAgentAuth', () => {
       const req = makeReq({ authorization: `Bearer ${FAKE_TOKEN}` });
       const { res, status, json } = makeRes();
 
-      await createRemoteAgentAuth(deps)(req as Request, res, mockNext);
+      await createRemoteAgentAuth(asDeps(deps))(req as Request, res, mockNext);
 
       expect(status).toHaveBeenCalledWith(401);
       expect(json).toHaveBeenCalledWith({ error: 'Unauthorized' });
@@ -1621,7 +1634,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps(makeConfig({ scope: 'remote_agent' }, { enabled: false }));
       const { res, status, json } = makeRes();
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         res,
         mockNext,
@@ -1637,7 +1650,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps(makeConfig({ scope: 'remote_agent' }, { enabled: true }));
       const { res, status, json } = makeRes();
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         res,
         mockNext,
@@ -1657,7 +1670,7 @@ describe('createRemoteAgentAuth', () => {
       });
 
       const deps = makeDeps(makeConfig({ scope: 'remote_agent' }));
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         makeRes().res,
         mockNext,
@@ -1674,7 +1687,7 @@ describe('createRemoteAgentAuth', () => {
       });
 
       const deps = makeDeps(makeConfig({ scope: 'remote_agent' }));
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         makeRes().res,
         mockNext,
@@ -1691,7 +1704,7 @@ describe('createRemoteAgentAuth', () => {
       });
 
       const deps = makeDeps(makeConfig({ scope: 'remote_agent admin' }));
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         makeRes().res,
         mockNext,
@@ -1710,7 +1723,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps(makeConfig({ scope: 'remote_agent admin' }, { enabled: false }));
       const { res, status, json } = makeRes();
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         res,
         mockNext,
@@ -1731,7 +1744,7 @@ describe('createRemoteAgentAuth', () => {
       const deps = makeDeps(makeConfig({ scope: 'remote_agent,admin' }, { enabled: false }));
       const { res, status, json } = makeRes();
 
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         res,
         mockNext,
@@ -1746,7 +1759,7 @@ describe('createRemoteAgentAuth', () => {
       setupOidcMocks({ sub: 'sub123', email: 'agent@test.com' });
 
       const deps = makeDeps(makeConfig({ scope: undefined }));
-      await createRemoteAgentAuth(deps)(
+      await createRemoteAgentAuth(asDeps(deps))(
         makeReq({ authorization: `Bearer ${FAKE_TOKEN}` }) as Request,
         makeRes().res,
         mockNext,
diff --git a/packages/api/src/middleware/remoteAgentAuth.ts b/packages/api/src/middleware/remoteAgentAuth.ts
index 49b160d4dc5..c198292dc2b 100644
--- a/packages/api/src/middleware/remoteAgentAuth.ts
+++ b/packages/api/src/middleware/remoteAgentAuth.ts
@@ -1,22 +1,22 @@
 import jwt from 'jsonwebtoken';
 import jwksRsa from 'jwks-rsa';
-import { HttpsProxyAgent } from 'https-proxy-agent';
-import { ProxyAgent, fetch as undiciFetch } from 'undici';
+import { fetch as undiciFetch } from 'undici';
 import { getTenantId, logger, tenantStorage } from '@librechat/data-schemas';
 import { SystemRoles, isRemoteOidcUrlAllowed } from 'librechat-data-provider';
-import type { RequestHandler, Request, Response, NextFunction } from 'express';
 import type { AppConfig, IUser, RoleMethods, UserMethods } from '@librechat/data-schemas';
+import type { RequestHandler, Request, Response, NextFunction } from 'express';
 import type { Algorithm, JwtPayload, VerifyOptions } from 'jsonwebtoken';
 import type { TAgentsEndpoint } from 'librechat-data-provider';
 import type { RequestInit } from 'undici';
 import type { GetAppConfigOptions } from '../app/service';
-import { findOpenIDUser, getOpenIdEmail, normalizeOpenIdIssuer } from '../auth/openid';
 import {
   getLibreChatRolesForOpenIdSync,
   getOpenIdRolesForOpenIdSync,
   getOpenIdRoleSyncOptions,
   selectOpenIdRole,
 } from '../auth/openidRoleSync';
+import { findOpenIDUser, getOpenIdEmail, normalizeOpenIdIssuer } from '../auth/openid';
+import { getEnvProxyDispatcher, getHttpsProxyAgent } from '~/utils/proxy';
 import { isEnabled, math } from '~/utils';
 
 export interface RemoteAgentAuthDeps {
@@ -127,9 +127,10 @@ function getJwksCacheOptions(): JwksCacheOptions {
 
 function buildDiscoveryOptions(controller: AbortController): RequestInit {
   const options: RequestInit = { signal: controller.signal };
+  const dispatcher = getEnvProxyDispatcher();
 
-  if (process.env.PROXY) {
-    options.dispatcher = new ProxyAgent(process.env.PROXY);
+  if (dispatcher) {
+    options.dispatcher = dispatcher;
   }
 
   return options;
@@ -196,8 +197,9 @@ function buildJwksClient(uri: string, cacheOptions: JwksCacheOptions): jwksRsa.J
     jwksUri: uri,
   };
 
-  if (process.env.PROXY) {
-    options.requestAgent = new HttpsProxyAgent(process.env.PROXY);
+  const requestAgent = getHttpsProxyAgent(uri);
+  if (requestAgent) {
+    options.requestAgent = requestAgent;
   }
 
   return jwksRsa(options);
diff --git a/packages/api/src/middleware/share.spec.ts b/packages/api/src/middleware/share.spec.ts
index 3924d4bf6ce..beff01d581f 100644
--- a/packages/api/src/middleware/share.spec.ts
+++ b/packages/api/src/middleware/share.spec.ts
@@ -6,7 +6,7 @@ jest.mock('@librechat/data-schemas', () => ({
   },
 }));
 
-import { Permissions, PermissionTypes, ResourceType } from 'librechat-data-provider';
+import { Permissions, PermissionTypes, PrincipalType, ResourceType } from 'librechat-data-provider';
 import type { NextFunction, Response } from 'express';
 import type { IRole } from '@librechat/data-schemas';
 import type { ServerRequest } from '~/types/http';
@@ -19,6 +19,9 @@ type ShareTestRequest = ServerRequest & {
   };
   body: ServerRequest['body'] & {
     public?: boolean;
+    updated?: Array<{
+      type?: string;
+    }>;
   };
 };
 
@@ -168,6 +171,41 @@ describe('createSharePolicyMiddleware', () => {
     expect(next).not.toHaveBeenCalled();
   });
 
+  it('requires SHARE_PUBLIC when PUBLIC is granted through updated principals', async () => {
+    const { checkSharePublicAccess } = createSharePolicyMiddleware({
+      getRoleByName,
+      hasCapability,
+    });
+    getRoleByName.mockResolvedValue(
+      createRole({
+        [PermissionTypes.SHARED_LINKS]: {
+          [Permissions.SHARE]: true,
+          [Permissions.SHARE_PUBLIC]: false,
+        },
+      }),
+    );
+    const req = createRequest({
+      params: { resourceType: ResourceType.SHARED_LINK },
+      body: {
+        updated: [
+          {
+            type: PrincipalType.PUBLIC,
+          },
+        ],
+      },
+    });
+    const res = createResponse();
+
+    await checkSharePublicAccess(req, res, next);
+
+    expect(res.status).toHaveBeenCalledWith(403);
+    expect(res.json).toHaveBeenCalledWith({
+      error: 'Forbidden',
+      message: `You do not have permission to share ${ResourceType.SHARED_LINK} resources publicly`,
+    });
+    expect(next).not.toHaveBeenCalled();
+  });
+
   it('reuses the role permission lookup for public sharing checks', async () => {
     const { checkShareAccess, checkSharePublicAccess } = createSharePolicyMiddleware({
       getRoleByName,
diff --git a/packages/api/src/middleware/share.ts b/packages/api/src/middleware/share.ts
index ec5074a6cc1..2d265308b64 100644
--- a/packages/api/src/middleware/share.ts
+++ b/packages/api/src/middleware/share.ts
@@ -1,5 +1,5 @@
 import { logger, ResourceCapabilityMap } from '@librechat/data-schemas';
-import { Permissions, PermissionTypes, ResourceType } from 'librechat-data-provider';
+import { Permissions, PermissionTypes, PrincipalType, ResourceType } from 'librechat-data-provider';
 import type { NextFunction, Response } from 'express';
 import type { IRole } from '@librechat/data-schemas';
 import type { CapabilityUser, HasCapabilityFn } from './capabilities';
@@ -18,6 +18,9 @@ type ShareRequest = ServerRequest & {
   };
   body: RequestBody & {
     public?: boolean;
+    updated?: Array<{
+      type?: string;
+    }>;
   };
   sharePermissionContext?: SharePermissionCache;
 };
@@ -45,6 +48,7 @@ const resourceToPermissionType: Record<ResourceType, PermissionTypes> = {
   [ResourceType.MCPSERVER]: PermissionTypes.MCP_SERVERS,
   [ResourceType.REMOTE_AGENT]: PermissionTypes.REMOTE_AGENTS,
   [ResourceType.SKILL]: PermissionTypes.SKILLS,
+  [ResourceType.SHARED_LINK]: PermissionTypes.SHARED_LINKS,
 };
 
 function formatError(error: unknown): string {
@@ -204,9 +208,12 @@ export function createSharePolicyMiddleware({ getRoleByName, hasCapability }: Sh
     next: NextFunction,
   ): Promise<Response | void> {
     try {
-      const { public: isPublic } = req.body;
+      const { public: isPublic, updated } = req.body;
+      const updatesPublicPrincipal =
+        Array.isArray(updated) &&
+        updated.some((principal) => principal?.type === PrincipalType.PUBLIC);
 
-      if (!isPublic) {
+      if (!isPublic && !updatesPublicPrincipal) {
         return next();
       }
 
diff --git a/packages/api/src/middleware/tenant.ts b/packages/api/src/middleware/tenant.ts
index 52f89a02d7a..b78ca8a7439 100644
--- a/packages/api/src/middleware/tenant.ts
+++ b/packages/api/src/middleware/tenant.ts
@@ -68,7 +68,7 @@ function hasTenantContext(context: TenantContext): boolean {
 
 export function buildTenantContext(
   req: ContextRequest,
-  tenantId = req.tenantId ?? req.user?.tenantId,
+  tenantId: string | undefined = req.tenantId ?? req.user?.tenantId,
 ): TenantContext {
   return {
     tenantId: normalizeContextValue(tenantId),
diff --git a/packages/api/src/modelSpecs/index.ts b/packages/api/src/modelSpecs/index.ts
index 4e34dd0bac6..30c895d89c0 100644
--- a/packages/api/src/modelSpecs/index.ts
+++ b/packages/api/src/modelSpecs/index.ts
@@ -10,7 +10,14 @@ import {
   type TUser,
 } from 'librechat-data-provider';
 
-export const PRIVATE_MODEL_SPEC_PRESET_FIELDS = [
+export const PRIVATE_MODEL_SPEC_PRESET_FIELDS: readonly [
+  'promptPrefix',
+  'instructions',
+  'additional_instructions',
+  'system',
+  'context',
+  'examples',
+] = [
   'promptPrefix',
   'instructions',
   'additional_instructions',
@@ -23,6 +30,10 @@ export type PrivateModelSpecPresetField = (typeof PRIVATE_MODEL_SPEC_PRESET_FIEL
 export type ModelSpecParsedBody = Partial<TConversation | TPreset | TModelSpecPreset> &
   Record<string, unknown>;
 
+export const ENFORCED_MODEL_SPEC_REQUEST_FIELDS: readonly ['chatProjectId'] = [
+  'chatProjectId',
+] as const satisfies readonly (keyof ModelSpecParsedBody)[];
+
 export type ApplyModelSpecPresetParams = {
   modelSpec: TModelSpec;
   parsedBody: ModelSpecParsedBody;
@@ -57,15 +68,30 @@ function hasModelSpecValue(field: PrivateModelSpecPresetField, value: unknown):
   return value.length > 0;
 }
 
+function pickEnforcedModelSpecRequestFields(parsedBody: ModelSpecParsedBody): ModelSpecParsedBody {
+  const requestFields: ModelSpecParsedBody = {};
+
+  for (const field of ENFORCED_MODEL_SPEC_REQUEST_FIELDS) {
+    if (parsedBody[field] !== undefined) {
+      requestFields[field] = parsedBody[field];
+    }
+  }
+
+  return requestFields;
+}
+
 function mergeModelSpecPreset(
   modelSpec: TModelSpec,
   parsedBody: ModelSpecParsedBody,
   { includePresetDefaults = false }: Pick<ApplyModelSpecPresetParams, 'includePresetDefaults'> = {},
 ): ApplyModelSpecPresetResult {
   const preset = modelSpec.preset;
+  const requestFields = includePresetDefaults
+    ? pickEnforcedModelSpecRequestFields(parsedBody)
+    : parsedBody;
   const merged = {
+    ...requestFields,
     ...(includePresetDefaults ? preset : {}),
-    ...parsedBody,
     spec: modelSpec.name,
   } as ModelSpecParsedBody;
   const appliedPrivateFields = new Set<PrivateModelSpecPresetField>();
@@ -170,9 +196,30 @@ export function sanitizeModelSpecs<T extends Partial<TSpecsConfig> | null | unde
   return {
     ...modelSpecs,
     list: modelSpecs.list.map((modelSpec) => {
+      if (!modelSpec || typeof modelSpec !== 'object') {
+        return modelSpec;
+      }
+
       const preset = modelSpec?.preset;
+      const sanitizedModelSpec = { ...modelSpec };
+      delete (sanitizedModelSpec as { skills?: unknown }).skills;
+      const subagents = sanitizedModelSpec.subagents;
+      if (subagents && typeof subagents === 'object') {
+        const sanitizedSubagents: TModelSpec['subagents'] = {};
+        if (subagents.enabled !== undefined) {
+          sanitizedSubagents.enabled = subagents.enabled;
+        }
+        if (subagents.allowSelf !== undefined) {
+          sanitizedSubagents.allowSelf = subagents.allowSelf;
+        }
+        if (Object.keys(sanitizedSubagents).length > 0) {
+          sanitizedModelSpec.subagents = sanitizedSubagents;
+        } else {
+          delete sanitizedModelSpec.subagents;
+        }
+      }
       if (!preset || typeof preset !== 'object') {
-        return modelSpec;
+        return sanitizedModelSpec;
       }
 
       const sanitizedPreset = { ...preset };
@@ -181,7 +228,7 @@ export function sanitizeModelSpecs<T extends Partial<TSpecsConfig> | null | unde
       }
 
       return {
-        ...modelSpec,
+        ...sanitizedModelSpec,
         preset: sanitizedPreset,
       };
     }),
diff --git a/packages/api/src/modelSpecs/modelSpecs.test.ts b/packages/api/src/modelSpecs/modelSpecs.test.ts
index a617cd94429..90287a4d4b0 100644
--- a/packages/api/src/modelSpecs/modelSpecs.test.ts
+++ b/packages/api/src/modelSpecs/modelSpecs.test.ts
@@ -17,6 +17,8 @@ describe('modelSpecs helpers', () => {
         {
           name: 'guarded-spec',
           label: 'Guarded Spec',
+          skills: ['private-skill'],
+          subagents: { enabled: true, allowSelf: true, agent_ids: ['agent_private'] },
           preset: {
             endpoint: EModelEndpoint.openAI,
             model: 'gpt-4o',
@@ -32,11 +34,43 @@ describe('modelSpecs helpers', () => {
       ],
     };
 
-    expect(sanitizeModelSpecs(modelSpecs).list[0].preset).toEqual({
+    const sanitizedModelSpecs = sanitizeModelSpecs(modelSpecs);
+    expect(sanitizedModelSpecs.list[0].subagents).toEqual({
+      enabled: true,
+      allowSelf: true,
+    });
+    expect(sanitizedModelSpecs.list[0].preset).toEqual({
       endpoint: EModelEndpoint.openAI,
       model: 'gpt-4o',
       greeting: 'Hello',
     });
+    expect(sanitizedModelSpecs.list[0]).not.toHaveProperty('skills');
+  });
+
+  it('should preserve conversation starters on model specs', () => {
+    const modelSpecs = {
+      enforce: false,
+      prioritize: true,
+      list: [
+        {
+          name: 'starter-spec',
+          label: 'Starter Spec',
+          conversation_starters: ['Summarize an article', 'Plan my week'],
+          preset: {
+            endpoint: EModelEndpoint.openAI,
+            model: 'gpt-4o',
+            promptPrefix: 'private prompt prefix',
+          },
+        },
+      ],
+    };
+
+    const sanitizedModelSpecs = sanitizeModelSpecs(modelSpecs);
+    expect(sanitizedModelSpecs.list[0].conversation_starters).toEqual([
+      'Summarize an article',
+      'Plan my week',
+    ]);
+    expect(sanitizedModelSpecs.list[0].preset).not.toHaveProperty('promptPrefix');
   });
 
   it('should restore only private fields for non-enforced model specs', () => {
@@ -89,14 +123,24 @@ describe('modelSpecs helpers', () => {
 
     const { parsedBody } = applyModelSpecPreset({
       modelSpec,
-      parsedBody: modelSpec.preset,
+      parsedBody: {
+        endpoint: EModelEndpoint.openAI,
+        spec: 'enforced-openai',
+        model: 'client-model',
+        temperature: 0.8,
+        topP: 0.9,
+        chatProjectId: 'project-1',
+      },
       endpoint: EModelEndpoint.openAI,
       includePresetDefaults: true,
     });
 
     expect(parsedBody.spec).toBe('enforced-openai');
+    expect(parsedBody.model).toBe('gpt-4o');
     expect(parsedBody.promptPrefix).toBe('private prompt prefix');
     expect(parsedBody.temperature).toBe(0.2);
+    expect(parsedBody.topP).toBeUndefined();
+    expect(parsedBody.chatProjectId).toBe('project-1');
   });
 
   it('should restore private examples when parser supplies an empty default', () => {
diff --git a/packages/api/src/oauth/csrf.ts b/packages/api/src/oauth/csrf.ts
index d2e0540c5d8..802655f2ee6 100644
--- a/packages/api/src/oauth/csrf.ts
+++ b/packages/api/src/oauth/csrf.ts
@@ -3,10 +3,10 @@ import type { Request, Response, NextFunction } from 'express';
 import { isEnabled } from '~/utils/common';
 
 export const OAUTH_CSRF_COOKIE = 'oauth_csrf';
-export const OAUTH_CSRF_MAX_AGE = 10 * 60 * 1000;
+export const OAUTH_CSRF_MAX_AGE: number = 10 * 60 * 1000;
 
 export const OAUTH_SESSION_COOKIE = 'oauth_session';
-export const OAUTH_SESSION_MAX_AGE = 24 * 60 * 60 * 1000;
+export const OAUTH_SESSION_MAX_AGE: number = 24 * 60 * 60 * 1000;
 export const OAUTH_SESSION_COOKIE_PATH = '/api';
 
 /**
diff --git a/packages/api/src/oauth/tokens.ts b/packages/api/src/oauth/tokens.ts
index 596860bf580..dfdac87bb2f 100644
--- a/packages/api/src/oauth/tokens.ts
+++ b/packages/api/src/oauth/tokens.ts
@@ -1,11 +1,11 @@
 import axios from 'axios';
-import { logger, encryptV2, decryptV2 } from '@librechat/data-schemas';
 import { TokenExchangeMethodEnum } from 'librechat-data-provider';
-import type { TokenMethods } from '@librechat/data-schemas';
+import { logger, encryptV2, decryptV2 } from '@librechat/data-schemas';
+import type { IToken, TokenMethods } from '@librechat/data-schemas';
 import type { AxiosError } from 'axios';
+import { validateActionOAuthEndpoint } from './validation';
 import { createSSRFSafeAgents } from '~/auth';
 import { logAxiosError } from '~/utils';
-import { validateActionOAuthEndpoint } from './validation';
 
 const actionOAuthAgents = createSSRFSafeAgents();
 const actionOAuthAgentsByAddress = new Map<string, ReturnType<typeof createSSRFSafeAgents>>();
@@ -59,7 +59,7 @@ export function createHandleOAuthToken({
     expiresIn?: number | string | null;
     metadata?: Record<string, unknown>;
     type?: string;
-  }) {
+  }): Promise<IToken | null> {
     const encrypedToken = await encryptV2(token);
     let expiresInNumber = 3600;
     if (typeof expiresIn === 'number') {
diff --git a/packages/api/src/projects/handlers.ts b/packages/api/src/projects/handlers.ts
new file mode 100644
index 00000000000..6c05457d07a
--- /dev/null
+++ b/packages/api/src/projects/handlers.ts
@@ -0,0 +1,230 @@
+import { isValidObjectIdString, logger } from '@librechat/data-schemas';
+
+import type {
+  ChatProjectMethods,
+  ChatProjectSortBy,
+  ChatProjectSortDirection,
+  CreateChatProjectInput,
+  UpdateChatProjectInput,
+} from '@librechat/data-schemas';
+import type { Request, Response } from 'express';
+
+const PROJECT_NOT_FOUND = 'Project not found';
+const CONVERSATION_NOT_FOUND = 'Conversation not found';
+
+const PROJECT_SORT_FIELDS = new Set<ChatProjectSortBy>(['name', 'createdAt', 'lastConversationAt']);
+
+interface ProjectUser {
+  id: string;
+  _id?: {
+    toString(): string;
+  };
+}
+
+interface ProjectRequest extends Request {
+  user?: ProjectUser;
+}
+
+type ProjectHandlerDependencies = Pick<
+  ChatProjectMethods,
+  | 'listChatProjects'
+  | 'createChatProject'
+  | 'getChatProject'
+  | 'updateChatProject'
+  | 'deleteChatProject'
+  | 'assignConversationToProject'
+>;
+
+const getUserId = (req: ProjectRequest): string => req.user?.id ?? req.user?._id?.toString() ?? '';
+
+const queryString = (value: Request['query'][string]): string | undefined => {
+  if (typeof value === 'string') {
+    return value;
+  }
+  if (Array.isArray(value)) {
+    return queryString(value[0]);
+  }
+  return undefined;
+};
+
+const normalizeString = (value: string | null | undefined): string =>
+  typeof value === 'string' ? value.trim() : '';
+
+const normalizeLimit = (value: Request['query'][string]): number => {
+  const limit = parseInt(queryString(value) ?? '', 10);
+  if (!Number.isFinite(limit)) {
+    return 25;
+  }
+  return Math.min(Math.max(limit, 1), 100);
+};
+
+const normalizeSortBy = (value: Request['query'][string]): ChatProjectSortBy | undefined => {
+  const sortBy = queryString(value);
+  return PROJECT_SORT_FIELDS.has(sortBy as ChatProjectSortBy)
+    ? (sortBy as ChatProjectSortBy)
+    : undefined;
+};
+
+const normalizeSortDirection = (
+  value: Request['query'][string],
+): ChatProjectSortDirection | undefined => {
+  const sortDirection = queryString(value);
+  return sortDirection === 'asc' || sortDirection === 'desc' ? sortDirection : undefined;
+};
+
+const createProjectInput = (req: ProjectRequest): CreateChatProjectInput | null => {
+  const name = normalizeString(req.body?.name);
+  if (!name) {
+    return null;
+  }
+
+  return {
+    name,
+    description: typeof req.body?.description === 'string' ? req.body.description : '',
+  };
+};
+
+export function createProjectHandlers(deps: ProjectHandlerDependencies): {
+  listProjects: (req: ProjectRequest, res: Response) => Promise<Response>;
+  createProject: (req: ProjectRequest, res: Response) => Promise<Response>;
+  assignConversationToProject: (req: ProjectRequest, res: Response) => Promise<Response>;
+  getProject: (req: ProjectRequest, res: Response) => Promise<Response>;
+  updateProject: (req: ProjectRequest, res: Response) => Promise<Response>;
+  deleteProject: (req: ProjectRequest, res: Response) => Promise<Response>;
+} {
+  async function listProjects(req: ProjectRequest, res: Response): Promise<Response> {
+    try {
+      const result = await deps.listChatProjects(getUserId(req), {
+        cursor: queryString(req.query.cursor),
+        limit: normalizeLimit(req.query.limit),
+        sortBy: normalizeSortBy(req.query.sortBy),
+        sortDirection: normalizeSortDirection(req.query.sortDirection),
+        search: queryString(req.query.search),
+      });
+      return res.status(200).json(result);
+    } catch (error) {
+      logger.error('[projects] Error listing projects', error);
+      return res.status(500).json({ error: 'Error listing projects' });
+    }
+  }
+
+  async function createProject(req: ProjectRequest, res: Response): Promise<Response> {
+    const input = createProjectInput(req);
+    if (!input) {
+      return res.status(400).json({ error: 'name is required' });
+    }
+
+    try {
+      const project = await deps.createChatProject(getUserId(req), input);
+      return res.status(201).json(project);
+    } catch (error) {
+      logger.error('[projects] Error creating project', error);
+      return res.status(500).json({ error: 'Error creating project' });
+    }
+  }
+
+  async function assignConversationToProject(
+    req: ProjectRequest,
+    res: Response,
+  ): Promise<Response> {
+    const { conversationId } = req.params;
+    const projectId = req.body?.projectId ?? null;
+
+    if (projectId !== null && typeof projectId !== 'string') {
+      return res.status(400).json({ error: 'projectId must be a string or null' });
+    }
+
+    try {
+      const result = await deps.assignConversationToProject(
+        getUserId(req),
+        conversationId,
+        projectId,
+      );
+      if (!result) {
+        return res.status(404).json({ error: CONVERSATION_NOT_FOUND });
+      }
+      return res.status(200).json(result);
+    } catch (error) {
+      if (error instanceof Error && error.message === PROJECT_NOT_FOUND) {
+        return res.status(404).json({ error: PROJECT_NOT_FOUND });
+      }
+      logger.error('[projects] Error assigning conversation to project', error);
+      return res.status(500).json({ error: 'Error assigning conversation to project' });
+    }
+  }
+
+  async function getProject(req: ProjectRequest, res: Response): Promise<Response> {
+    const { projectId } = req.params;
+    if (!isValidObjectIdString(projectId)) {
+      return res.status(404).json({ error: PROJECT_NOT_FOUND });
+    }
+
+    try {
+      const project = await deps.getChatProject(getUserId(req), projectId);
+      if (!project) {
+        return res.status(404).json({ error: PROJECT_NOT_FOUND });
+      }
+      return res.status(200).json(project);
+    } catch (error) {
+      logger.error('[projects] Error getting project', error);
+      return res.status(500).json({ error: 'Error getting project' });
+    }
+  }
+
+  async function updateProject(req: ProjectRequest, res: Response): Promise<Response> {
+    const { projectId } = req.params;
+    if (!isValidObjectIdString(projectId)) {
+      return res.status(404).json({ error: PROJECT_NOT_FOUND });
+    }
+
+    const input: UpdateChatProjectInput = {};
+    if (req.body?.name !== undefined) {
+      const name = normalizeString(req.body.name);
+      if (!name) {
+        return res.status(400).json({ error: 'name is required' });
+      }
+      input.name = name;
+    }
+    if (req.body?.description !== undefined) {
+      input.description = typeof req.body.description === 'string' ? req.body.description : '';
+    }
+
+    try {
+      const project = await deps.updateChatProject(getUserId(req), projectId, input);
+      if (!project) {
+        return res.status(404).json({ error: PROJECT_NOT_FOUND });
+      }
+      return res.status(200).json(project);
+    } catch (error) {
+      logger.error('[projects] Error updating project', error);
+      return res.status(500).json({ error: 'Error updating project' });
+    }
+  }
+
+  async function deleteProject(req: ProjectRequest, res: Response): Promise<Response> {
+    const { projectId } = req.params;
+    if (!isValidObjectIdString(projectId)) {
+      return res.status(404).json({ error: PROJECT_NOT_FOUND });
+    }
+
+    try {
+      const result = await deps.deleteChatProject(getUserId(req), projectId);
+      if (!result.deletedCount) {
+        return res.status(404).json({ error: PROJECT_NOT_FOUND });
+      }
+      return res.status(200).json(result);
+    } catch (error) {
+      logger.error('[projects] Error deleting project', error);
+      return res.status(500).json({ error: 'Error deleting project' });
+    }
+  }
+
+  return {
+    listProjects,
+    createProject,
+    assignConversationToProject,
+    getProject,
+    updateProject,
+    deleteProject,
+  };
+}
diff --git a/packages/api/src/projects/index.ts b/packages/api/src/projects/index.ts
new file mode 100644
index 00000000000..6c6f862d018
--- /dev/null
+++ b/packages/api/src/projects/index.ts
@@ -0,0 +1 @@
+export * from './handlers';
diff --git a/packages/api/src/prompts/schemas.ts b/packages/api/src/prompts/schemas.ts
index 43cb9d7e94f..c9df44bfe7a 100644
--- a/packages/api/src/prompts/schemas.ts
+++ b/packages/api/src/prompts/schemas.ts
@@ -6,7 +6,19 @@ import { Constants } from 'librechat-data-provider';
  * Only allows fields that users should be able to modify.
  * Sensitive fields like author, authorName, _id, productionId, etc. are excluded.
  */
-export const updatePromptGroupSchema = z
+export const updatePromptGroupSchema: z.ZodObject<
+  {
+    /** The name of the prompt group */
+    name: z.ZodOptional<z.ZodString>;
+    /** Short description/oneliner for the prompt group */
+    oneliner: z.ZodOptional<z.ZodString>;
+    /** Category for organizing prompt groups */
+    category: z.ZodOptional<z.ZodString>;
+    /** Command shortcut for the prompt group */
+    command: z.ZodNullable<z.ZodOptional<z.ZodString>>;
+  },
+  'strict'
+> = z
   .object({
     /** The name of the prompt group */
     name: z.string().min(1).max(255).optional(),
@@ -44,6 +56,19 @@ export function validatePromptGroupUpdate(data: unknown): TUpdatePromptGroupSche
  * @param data - The raw request body to validate
  * @returns A SafeParseResult with either the validated data or validation errors
  */
-export function safeValidatePromptGroupUpdate(data: unknown) {
+export function safeValidatePromptGroupUpdate(data: unknown): z.SafeParseReturnType<
+  {
+    name?: string | undefined;
+    category?: string | undefined;
+    command?: string | null | undefined;
+    oneliner?: string | undefined;
+  },
+  {
+    name?: string | undefined;
+    category?: string | undefined;
+    command?: string | null | undefined;
+    oneliner?: string | undefined;
+  }
+> {
   return updatePromptGroupSchema.safeParse(data);
 }
diff --git a/packages/api/src/rum/proxy.spec.ts b/packages/api/src/rum/proxy.spec.ts
index 989dea46a56..22aeeb9374e 100644
--- a/packages/api/src/rum/proxy.spec.ts
+++ b/packages/api/src/rum/proxy.spec.ts
@@ -1,3 +1,8 @@
+jest.mock('~/app/metrics', () => ({
+  recordRumProxyRequest: jest.fn(),
+}));
+
+import { recordRumProxyRequest } from '~/app/metrics';
 import {
   getRumProxyBodyLimit,
   getRumProxyClientUrl,
@@ -24,6 +29,7 @@ describe('RUM proxy configuration', () => {
 
   beforeEach(() => {
     process.env = { ...originalEnv };
+    jest.mocked(recordRumProxyRequest).mockClear();
   });
 
   afterEach(() => {
@@ -114,6 +120,7 @@ describe('RUM proxy configuration', () => {
     expect(res.set).toHaveBeenCalledWith('content-type', 'application/json');
     expect(res.status).toHaveBeenCalledWith(202);
     expect(res.send).toHaveBeenCalledWith(Buffer.from('ok'));
+    expect(recordRumProxyRequest).toHaveBeenCalledWith('traces', 'success');
 
     fetchMock.mockRestore();
   });
@@ -133,6 +140,8 @@ describe('RUM proxy configuration', () => {
 
     expect(missingBodyRes.status).toHaveBeenCalledWith(400);
     expect(unsupportedPathRes.status).toHaveBeenCalledWith(404);
+    expect(recordRumProxyRequest).toHaveBeenCalledWith('traces', 'bad_request');
+    expect(recordRumProxyRequest).toHaveBeenCalledWith('unknown', 'not_configured');
   });
 
   it('returns 502 when the collector request fails', async () => {
@@ -148,6 +157,26 @@ describe('RUM proxy configuration', () => {
     );
 
     expect(res.status).toHaveBeenCalledWith(502);
+    expect(recordRumProxyRequest).toHaveBeenCalledWith('traces', 'collector_error');
+    fetchMock.mockRestore();
+  });
+
+  it('records collector error status classes', async () => {
+    process.env.RUM_ENABLED = 'true';
+    process.env.RUM_AUTH_MODE = 'proxy';
+    process.env.RUM_PROXY_TARGET_URL = 'http://otel-collector:4318';
+    const fetchMock = jest
+      .spyOn(global, 'fetch')
+      .mockResolvedValue(new Response('nope', { status: 503 }));
+    const res = makeResponse();
+
+    await proxyRumRequest(
+      { path: '/v1/logs', body: Buffer.from('payload'), headers: {} } as never,
+      res as never,
+    );
+
+    expect(res.status).toHaveBeenCalledWith(503);
+    expect(recordRumProxyRequest).toHaveBeenCalledWith('logs', 'collector_5xx');
     fetchMock.mockRestore();
   });
 });
diff --git a/packages/api/src/rum/proxy.ts b/packages/api/src/rum/proxy.ts
index 804186f238c..856457be5f2 100644
--- a/packages/api/src/rum/proxy.ts
+++ b/packages/api/src/rum/proxy.ts
@@ -1,5 +1,7 @@
-import type { Request, Response } from 'express';
 import { logger } from '@librechat/data-schemas';
+import type { Request, Response } from 'express';
+import type { RumProxyEndpoint, RumProxyResult } from '~/app/metrics';
+import { recordRumProxyRequest } from '~/app/metrics';
 import { isEnabled } from '~/utils';
 
 const DEFAULT_PROXY_PATH = '/api/rum';
@@ -75,6 +77,27 @@ export function resolveRumProxyTarget(path: string): string | undefined {
   return targetUrl.href;
 }
 
+// Keep in sync with api/server/middleware/requireJwtAuth.js; auth drops are recorded there.
+function getRumProxyEndpoint(path: string): RumProxyEndpoint {
+  if (path === '/v1/traces') {
+    return 'traces';
+  }
+  if (path === '/v1/logs') {
+    return 'logs';
+  }
+  return 'unknown';
+}
+
+function getRumCollectorResult(status: number): RumProxyResult {
+  if (status >= 500) {
+    return 'collector_5xx';
+  }
+  if (status >= 400) {
+    return 'collector_4xx';
+  }
+  return 'success';
+}
+
 function getRequestBody(req: Request): Buffer | string | undefined {
   const body = req.body as unknown;
 
@@ -109,14 +132,17 @@ function getProxyHeaders(req: Request, body: Buffer | string): Record<string, st
 }
 
 export async function proxyRumRequest(req: Request, res: Response): Promise<void> {
+  const endpoint = getRumProxyEndpoint(req.path);
   const target = resolveRumProxyTarget(req.path);
   if (!target) {
+    recordRumProxyRequest(endpoint, 'not_configured');
     res.status(404).json({ message: 'RUM proxy is not configured' });
     return;
   }
 
   const body = getRequestBody(req);
   if (!body) {
+    recordRumProxyRequest(endpoint, 'bad_request');
     res.status(400).json({ message: 'RUM payload is required' });
     return;
   }
@@ -127,7 +153,9 @@ export async function proxyRumRequest(req: Request, res: Response): Promise<void
     const response = await fetch(target, {
       method: 'POST',
       headers: getProxyHeaders(req, body),
-      body,
+      // TS 5.9 made `Buffer` generic (`Buffer<ArrayBufferLike>`), which no longer
+      // structurally matches `BodyInit`; Node's fetch accepts a Buffer body at runtime.
+      body: body as BodyInit,
       signal: controller.signal,
     });
 
@@ -137,8 +165,13 @@ export async function proxyRumRequest(req: Request, res: Response): Promise<void
     }
 
     const responseBody = Buffer.from(await response.arrayBuffer());
+    recordRumProxyRequest(endpoint, getRumCollectorResult(response.status));
     res.status(response.status).send(responseBody);
   } catch (error) {
+    recordRumProxyRequest(
+      endpoint,
+      controller.signal.aborted ? 'collector_timeout' : 'collector_error',
+    );
     logger.warn('[rumProxy] Failed to proxy RUM telemetry', {
       error: error instanceof Error ? error.message : String(error),
       target,
diff --git a/packages/api/src/shared-links/access.test.ts b/packages/api/src/shared-links/access.test.ts
new file mode 100644
index 00000000000..795ef6c7f16
--- /dev/null
+++ b/packages/api/src/shared-links/access.test.ts
@@ -0,0 +1,325 @@
+jest.mock('@librechat/data-schemas', () => ({
+  ...jest.requireActual('@librechat/data-schemas'),
+  logger: { error: jest.fn(), info: jest.fn(), warn: jest.fn(), debug: jest.fn() },
+}));
+
+import mongoose, { Types, Model } from 'mongoose';
+import { MongoMemoryServer } from 'mongodb-memory-server';
+import { createModels, createMethods } from '@librechat/data-schemas';
+import { ResourceType, PrincipalType, AccessRoleIds } from 'librechat-data-provider';
+import type { Request, Response, NextFunction } from 'express';
+import type { IAclEntry, ISharedLink } from '@librechat/data-schemas';
+import { AccessControlService } from '~/acl/accessControlService';
+import { createSharedLinkAccessMiddleware } from './access';
+
+let mongoServer: MongoMemoryServer;
+let AclEntry: Model<IAclEntry>;
+let SharedLink: Model<ISharedLink>;
+let aclService: AccessControlService;
+let canAccessSharedLink: ReturnType<typeof createSharedLinkAccessMiddleware>;
+
+const userId = new Types.ObjectId();
+const mockGetUserPrincipals = jest.fn();
+
+beforeAll(async () => {
+  mongoServer = await MongoMemoryServer.create();
+  await mongoose.connect(mongoServer.getUri());
+  createModels(mongoose);
+  const methods = createMethods(mongoose);
+  await methods.seedDefaultRoles();
+  AclEntry = mongoose.models.AclEntry as Model<IAclEntry>;
+  SharedLink = mongoose.models.SharedLink as Model<ISharedLink>;
+
+  aclService = new AccessControlService(mongoose);
+  const originalMethods = aclService['_dbMethods'];
+  aclService['_dbMethods'] = {
+    ...originalMethods,
+    getUserPrincipals: mockGetUserPrincipals,
+  };
+
+  canAccessSharedLink = createSharedLinkAccessMiddleware({ mongoose, aclService });
+});
+
+afterAll(async () => {
+  await mongoose.disconnect();
+  await mongoServer.stop();
+});
+
+beforeEach(async () => {
+  await AclEntry.deleteMany({});
+  await SharedLink.deleteMany({});
+  mockGetUserPrincipals.mockReset();
+  delete process.env.ALLOW_SHARED_LINKS_PUBLIC;
+  delete process.env.SHARED_LINKS_AUTO_MIGRATE;
+});
+
+function createReq(overrides: Record<string, unknown> = {}): Request {
+  return { params: {}, user: undefined, ...overrides } as unknown as Request;
+}
+
+function createRes(): Response & { _status: number; _json: unknown } {
+  const res = {
+    _status: 0,
+    _json: null as unknown,
+    status(code: number) {
+      res._status = code;
+      return res;
+    },
+    json(body: unknown) {
+      res._json = body;
+      return res;
+    },
+  };
+  return res as unknown as Response & { _status: number; _json: unknown };
+}
+
+async function createTestLink(overrides: Partial<ISharedLink> = {}) {
+  return SharedLink.create({
+    shareId: `share-${Date.now()}-${Math.random()}`,
+    conversationId: 'convo1',
+    user: userId.toString(),
+    messages: [],
+    ...overrides,
+  });
+}
+
+async function grantPublicViewer(resourceId: Types.ObjectId) {
+  await aclService.grantPermission({
+    principalType: PrincipalType.PUBLIC,
+    principalId: null,
+    resourceType: ResourceType.SHARED_LINK,
+    resourceId,
+    accessRoleId: AccessRoleIds.SHARED_LINK_VIEWER,
+    grantedBy: userId,
+  });
+}
+
+async function grantUserViewer(resourceId: Types.ObjectId, uid: Types.ObjectId) {
+  await aclService.grantPermission({
+    principalType: PrincipalType.USER,
+    principalId: uid,
+    resourceType: ResourceType.SHARED_LINK,
+    resourceId,
+    accessRoleId: AccessRoleIds.SHARED_LINK_VIEWER,
+    grantedBy: userId,
+  });
+}
+
+describe('canAccessSharedLink', () => {
+  describe('input validation', () => {
+    test('returns 400 when shareId is missing', async () => {
+      const req = createReq({ params: {} });
+      const res = createRes();
+      const next = jest.fn();
+      await canAccessSharedLink(req, res, next as unknown as NextFunction);
+      expect(res._status).toBe(400);
+      expect(next).not.toHaveBeenCalled();
+    });
+
+    test('returns 404 when share does not exist', async () => {
+      const req = createReq({ params: { shareId: 'nonexistent' } });
+      const res = createRes();
+      const next = jest.fn();
+      await canAccessSharedLink(req, res, next as unknown as NextFunction);
+      expect(res._status).toBe(404);
+      expect(next).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('public links', () => {
+    test('calls next() for anonymous access when ALLOW_SHARED_LINKS_PUBLIC is true', async () => {
+      const link = await createTestLink();
+      await grantPublicViewer(link._id);
+      process.env.ALLOW_SHARED_LINKS_PUBLIC = 'true';
+
+      const req = createReq({ params: { shareId: link.shareId } });
+      const res = createRes();
+      const next = jest.fn();
+      await canAccessSharedLink(req, res, next as unknown as NextFunction);
+
+      expect(next).toHaveBeenCalled();
+      expect((req as unknown as Record<string, unknown>).shareResourceId).toBe(link._id.toString());
+    });
+
+    test('returns 401 for anonymous access when ALLOW_SHARED_LINKS_PUBLIC is not set', async () => {
+      const link = await createTestLink();
+      await grantPublicViewer(link._id);
+
+      const req = createReq({ params: { shareId: link.shareId } });
+      const res = createRes();
+      const next = jest.fn();
+      await canAccessSharedLink(req, res, next as unknown as NextFunction);
+
+      expect(res._status).toBe(401);
+      expect(next).not.toHaveBeenCalled();
+    });
+
+    test('calls next() for authenticated access to public link even without ALLOW_SHARED_LINKS_PUBLIC', async () => {
+      const link = await createTestLink();
+      await grantPublicViewer(link._id);
+
+      const req = createReq({
+        params: { shareId: link.shareId },
+        user: { id: userId.toString(), _id: userId },
+      });
+      const res = createRes();
+      const next = jest.fn();
+      await canAccessSharedLink(req, res, next as unknown as NextFunction);
+
+      expect(next).toHaveBeenCalled();
+      expect((req as unknown as Record<string, unknown>).shareResourceId).toBe(link._id.toString());
+    });
+  });
+
+  describe('private links', () => {
+    test('returns 401 for unauthenticated user', async () => {
+      const link = await createTestLink();
+
+      const req = createReq({ params: { shareId: link.shareId } });
+      const res = createRes();
+      const next = jest.fn();
+      await canAccessSharedLink(req, res, next as unknown as NextFunction);
+
+      expect(res._status).toBe(401);
+      expect(next).not.toHaveBeenCalled();
+    });
+
+    test('returns 403 for authenticated user without ACL entry', async () => {
+      const link = await createTestLink();
+      const otherUser = new Types.ObjectId();
+
+      mockGetUserPrincipals.mockResolvedValue([
+        { principalType: PrincipalType.USER, principalId: otherUser },
+      ]);
+
+      const req = createReq({
+        params: { shareId: link.shareId },
+        user: { id: otherUser.toString(), _id: otherUser, role: 'USER' },
+      });
+      const res = createRes();
+      const next = jest.fn();
+      await canAccessSharedLink(req, res, next as unknown as NextFunction);
+
+      expect(res._status).toBe(403);
+      expect(next).not.toHaveBeenCalled();
+    });
+
+    test('calls next() for authenticated user with ACL entry', async () => {
+      const link = await createTestLink();
+      const viewer = new Types.ObjectId();
+      await grantUserViewer(link._id, viewer);
+
+      mockGetUserPrincipals.mockResolvedValue([
+        { principalType: PrincipalType.USER, principalId: viewer },
+      ]);
+
+      const req = createReq({
+        params: { shareId: link.shareId },
+        user: { id: viewer.toString(), _id: viewer, role: 'USER' },
+      });
+      const res = createRes();
+      const next = jest.fn();
+      await canAccessSharedLink(req, res, next as unknown as NextFunction);
+
+      expect(next).toHaveBeenCalled();
+      expect((req as unknown as Record<string, unknown>).shareResourceId).toBe(link._id.toString());
+    });
+  });
+
+  describe('legacy link auto-migration', () => {
+    async function createLegacyLink(isPublic: boolean) {
+      const link = await createTestLink();
+      // Inject isPublic directly into MongoDB to simulate a legacy document
+      await mongoose.connection
+        .db!.collection('sharedlinks')
+        .updateOne({ _id: link._id }, { $set: { isPublic } });
+      return link;
+    }
+
+    test('auto-migrates public legacy link and calls next()', async () => {
+      const link = await createLegacyLink(true);
+      process.env.ALLOW_SHARED_LINKS_PUBLIC = 'true';
+
+      const req = createReq({ params: { shareId: link.shareId } });
+      const res = createRes();
+      const next = jest.fn();
+      await canAccessSharedLink(req, res, next as unknown as NextFunction);
+
+      expect(next).toHaveBeenCalled();
+
+      const entries = await AclEntry.find({ resourceId: link._id }).lean();
+      const hasOwner = entries.some((e) => e.principalType === PrincipalType.USER);
+      const hasPublic = entries.some((e) => e.principalType === PrincipalType.PUBLIC);
+      expect(hasOwner).toBe(true);
+      expect(hasPublic).toBe(true);
+
+      const rawDoc = await mongoose.connection
+        .db!.collection('sharedlinks')
+        .findOne({ _id: link._id });
+      expect(rawDoc).not.toHaveProperty('isPublic');
+    });
+
+    test('does not re-create PUBLIC after owner removes it', async () => {
+      const link = await createLegacyLink(true);
+      process.env.ALLOW_SHARED_LINKS_PUBLIC = 'true';
+
+      const next1 = jest.fn();
+      const req1 = createReq({ params: { shareId: link.shareId } });
+      await canAccessSharedLink(req1, createRes(), next1 as unknown as NextFunction);
+
+      await AclEntry.deleteMany({
+        resourceId: link._id,
+        principalType: PrincipalType.PUBLIC,
+      });
+
+      const next2 = jest.fn();
+      const req2 = createReq({ params: { shareId: link.shareId } });
+      const res2 = createRes();
+      await canAccessSharedLink(req2, res2, next2 as unknown as NextFunction);
+
+      const publicEntries = await AclEntry.find({
+        resourceId: link._id,
+        principalType: PrincipalType.PUBLIC,
+      }).lean();
+      expect(publicEntries).toHaveLength(0);
+    });
+
+    test('auto-migrates legacy link with isPublic: false — no PUBLIC grant', async () => {
+      const link = await createLegacyLink(false);
+      const viewer = new Types.ObjectId();
+      await grantUserViewer(link._id, viewer);
+
+      mockGetUserPrincipals.mockResolvedValue([
+        { principalType: PrincipalType.USER, principalId: viewer },
+      ]);
+
+      const req = createReq({
+        params: { shareId: link.shareId },
+        user: { id: viewer.toString(), _id: viewer, role: 'USER' },
+      });
+      const res = createRes();
+      const next = jest.fn();
+      await canAccessSharedLink(req, res, next as unknown as NextFunction);
+
+      const publicEntries = await AclEntry.find({
+        resourceId: link._id,
+        principalType: PrincipalType.PUBLIC,
+      }).lean();
+      expect(publicEntries).toHaveLength(0);
+    });
+
+    test('returns 403 when auto-migration is disabled', async () => {
+      const link = await createLegacyLink(true);
+      process.env.SHARED_LINKS_AUTO_MIGRATE = 'false';
+
+      const req = createReq({ params: { shareId: link.shareId } });
+      const res = createRes();
+      const next = jest.fn();
+      await canAccessSharedLink(req, res, next as unknown as NextFunction);
+
+      expect(res._status).toBe(403);
+      expect(next).not.toHaveBeenCalled();
+      expect((res._json as Record<string, string>).message).toContain('migration');
+    });
+  });
+});
diff --git a/packages/api/src/shared-links/access.ts b/packages/api/src/shared-links/access.ts
new file mode 100644
index 00000000000..dbbf43a3a4f
--- /dev/null
+++ b/packages/api/src/shared-links/access.ts
@@ -0,0 +1,137 @@
+import { getTenantId, runAsSystem, tenantStorage } from '@librechat/data-schemas';
+import { ResourceType, PermissionBits } from 'librechat-data-provider';
+import type { Request, Response, NextFunction } from 'express';
+import type { Types, Model } from 'mongoose';
+import type { IUser } from '@librechat/data-schemas';
+import { AccessControlService } from '~/acl/accessControlService';
+import { autoMigrateLegacyLink } from './service';
+import { isEnabled } from '~/utils';
+
+interface RawSharedLink {
+  _id?: Types.ObjectId;
+  conversationId: string;
+  title?: string;
+  user?: string;
+  shareId?: string;
+  tenantId?: string;
+  isPublic?: boolean;
+  expiredAt?: Date;
+}
+
+export interface SharedLinkAccessDeps {
+  mongoose: typeof import('mongoose');
+  aclService?: AccessControlService;
+}
+
+function isAutoMigrateEnabled(): boolean {
+  // Fallback for legacy rows missed by the explicit shared-link permissions migration.
+  const val = process.env.SHARED_LINKS_AUTO_MIGRATE;
+  return val === undefined || isEnabled(val);
+}
+
+export function createSharedLinkAccessMiddleware(deps: SharedLinkAccessDeps) {
+  const { mongoose: mg } = deps;
+  const aclService = deps.aclService ?? new AccessControlService(mg);
+
+  async function hasPublicViewPermission(resourceId: string): Promise<boolean> {
+    return aclService.hasPublicAccess({
+      resourceType: ResourceType.SHARED_LINK,
+      resourceId,
+    });
+  }
+
+  return async function canAccessSharedLink(
+    req: Request,
+    res: Response,
+    next: NextFunction,
+  ): Promise<void> {
+    const { shareId } = req.params;
+    if (!shareId) {
+      res.status(400).json({ message: 'Missing shareId' });
+      return;
+    }
+
+    const SharedLink = mg.models.SharedLink as Model<RawSharedLink>;
+    const findShare = async () =>
+      (await SharedLink.findOne({ shareId }).lean()) as RawSharedLink | null;
+    const rawShare = getTenantId() ? await findShare() : await runAsSystem(findShare);
+
+    if (!rawShare) {
+      res.status(404).json({ message: 'Shared link not found' });
+      return;
+    }
+
+    const resourceId = rawShare._id?.toString();
+    if (!resourceId) {
+      res.status(404).json({ message: 'Shared link not found' });
+      return;
+    }
+
+    const user = req.user as IUser | undefined;
+
+    const runWithTenant = async (fn: () => Promise<void>): Promise<void> => {
+      if (rawShare.tenantId) {
+        return tenantStorage.run({ tenantId: rawShare.tenantId }, fn);
+      }
+      return runAsSystem(fn);
+    };
+
+    await runWithTenant(async () => {
+      const isLegacy = 'isPublic' in rawShare;
+
+      if (isLegacy) {
+        if (!isAutoMigrateEnabled()) {
+          res.status(403).json({ message: 'Legacy shared link requires migration' });
+          return;
+        }
+        await autoMigrateLegacyLink(rawShare);
+      }
+
+      const publicGranted = await hasPublicViewPermission(resourceId);
+
+      if (publicGranted) {
+        if (isEnabled(process.env.ALLOW_SHARED_LINKS_PUBLIC)) {
+          (req as unknown as Record<string, unknown>).shareResourceId = resourceId;
+          next();
+          return;
+        }
+
+        if (!user) {
+          res.status(401).json({ message: 'Authentication required' });
+          return;
+        }
+
+        (req as unknown as Record<string, unknown>).shareResourceId = resourceId;
+        next();
+        return;
+      }
+
+      if (!user) {
+        res.status(401).json({ message: 'Authentication required' });
+        return;
+      }
+
+      const userId = user.id ?? user._id?.toString();
+      if (!userId) {
+        res.status(401).json({ message: 'Authentication required' });
+        return;
+      }
+
+      const hasAccess = await aclService.checkPermission({
+        userId,
+        role: user.role,
+        resourceType: ResourceType.SHARED_LINK,
+        resourceId,
+        requiredPermission: PermissionBits.VIEW,
+      });
+
+      if (!hasAccess) {
+        res.status(403).json({ message: 'You do not have permission to view this shared link' });
+        return;
+      }
+
+      (req as unknown as Record<string, unknown>).shareResourceId = resourceId;
+      next();
+    });
+  };
+}
diff --git a/packages/api/src/shared-links/service.test.ts b/packages/api/src/shared-links/service.test.ts
new file mode 100644
index 00000000000..314569a5316
--- /dev/null
+++ b/packages/api/src/shared-links/service.test.ts
@@ -0,0 +1,369 @@
+jest.mock('@librechat/data-schemas', () => ({
+  ...jest.requireActual('@librechat/data-schemas'),
+  logger: { error: jest.fn(), info: jest.fn(), warn: jest.fn(), debug: jest.fn() },
+}));
+
+import mongoose, { Types, Model } from 'mongoose';
+import { MongoMemoryServer } from 'mongodb-memory-server';
+import { createModels, createMethods } from '@librechat/data-schemas';
+import { PrincipalType, AccessRoleIds } from 'librechat-data-provider';
+import type { IAclEntry, ISharedLink } from '@librechat/data-schemas';
+import {
+  autoMigrateLegacyLink,
+  grantCreationPermissions,
+  ensureLinkPermissions,
+  updateSharedLinkPermissionsExpiration,
+  deleteSharedLinkWithCleanup,
+  deleteConvoSharedLinksWithCleanup,
+  deleteAllSharedLinksWithCleanup,
+} from './service';
+
+let mongoServer: MongoMemoryServer;
+let AclEntry: Model<IAclEntry>;
+let SharedLink: Model<ISharedLink>;
+
+beforeAll(async () => {
+  mongoServer = await MongoMemoryServer.create();
+  await mongoose.connect(mongoServer.getUri());
+  createModels(mongoose);
+  const methods = createMethods(mongoose);
+  await methods.seedDefaultRoles();
+  AclEntry = mongoose.models.AclEntry as Model<IAclEntry>;
+  SharedLink = mongoose.models.SharedLink as Model<ISharedLink>;
+});
+
+afterAll(async () => {
+  await mongoose.disconnect();
+  await mongoServer.stop();
+});
+
+beforeEach(async () => {
+  await AclEntry.deleteMany({});
+  await SharedLink.deleteMany({});
+});
+
+const userId = new Types.ObjectId().toString();
+
+async function createTestLink(overrides: Partial<ISharedLink> = {}) {
+  return SharedLink.create({
+    shareId: `share-${Date.now()}-${Math.random()}`,
+    conversationId: 'convo1',
+    user: userId,
+    messages: [],
+    ...overrides,
+  });
+}
+
+describe('autoMigrateLegacyLink', () => {
+  async function createLegacyLink(isPublic: boolean) {
+    const link = await createTestLink();
+    await mongoose.connection
+      .db!.collection('sharedlinks')
+      .updateOne({ _id: link._id }, { $set: { isPublic } });
+    return link;
+  }
+
+  async function createOwnerlessLegacyLink(isPublic: boolean) {
+    const link = await SharedLink.create({
+      shareId: `share-${Date.now()}-${Math.random()}`,
+      conversationId: 'convo1',
+      messages: [],
+    });
+    await mongoose.connection
+      .db!.collection('sharedlinks')
+      .updateOne({ _id: link._id }, { $set: { isPublic } });
+    return link;
+  }
+
+  test('grants OWNER and PUBLIC VIEWER for public legacy link', async () => {
+    const link = await createLegacyLink(true);
+    await autoMigrateLegacyLink({
+      _id: link._id,
+      conversationId: link.conversationId,
+      user: userId,
+      shareId: link.shareId,
+      isPublic: true,
+    });
+
+    const entries = await AclEntry.find({ resourceId: link._id }).lean();
+    const hasOwner = entries.some((e) => e.principalType === PrincipalType.USER);
+    const hasPublic = entries.some((e) => e.principalType === PrincipalType.PUBLIC);
+    expect(hasOwner).toBe(true);
+    expect(hasPublic).toBe(true);
+  });
+
+  test('grants OWNER only for private legacy link (isPublic: false)', async () => {
+    const link = await createLegacyLink(false);
+    await autoMigrateLegacyLink({
+      _id: link._id,
+      conversationId: link.conversationId,
+      user: userId,
+      shareId: link.shareId,
+      isPublic: false,
+    });
+
+    const entries = await AclEntry.find({ resourceId: link._id }).lean();
+    const hasOwner = entries.some((e) => e.principalType === PrincipalType.USER);
+    const hasPublic = entries.some((e) => e.principalType === PrincipalType.PUBLIC);
+    expect(hasOwner).toBe(true);
+    expect(hasPublic).toBe(false);
+  });
+
+  test('grants PUBLIC VIEWER for ownerless public legacy link', async () => {
+    const link = await createOwnerlessLegacyLink(true);
+    await autoMigrateLegacyLink({
+      _id: link._id,
+      conversationId: link.conversationId,
+      shareId: link.shareId,
+      isPublic: true,
+    });
+
+    const entries = await AclEntry.find({ resourceId: link._id }).lean();
+    const hasOwner = entries.some((e) => e.principalType === PrincipalType.USER);
+    const hasPublic = entries.some((e) => e.principalType === PrincipalType.PUBLIC);
+    expect(hasOwner).toBe(false);
+    expect(hasPublic).toBe(true);
+  });
+
+  test('removes isPublic field from document', async () => {
+    const link = await createLegacyLink(true);
+    await autoMigrateLegacyLink({
+      _id: link._id,
+      conversationId: link.conversationId,
+      user: userId,
+      shareId: link.shareId,
+      isPublic: true,
+    });
+
+    const rawDoc = await mongoose.connection
+      .db!.collection('sharedlinks')
+      .findOne({ _id: link._id });
+    expect(rawDoc).not.toHaveProperty('isPublic');
+  });
+
+  test('preserves isPublic when grant fails, allowing retry on next access', async () => {
+    const link = await createLegacyLink(true);
+    const AccessRole = mongoose.models.AccessRole;
+    await AccessRole.deleteOne({ accessRoleId: AccessRoleIds.SHARED_LINK_OWNER });
+
+    try {
+      await autoMigrateLegacyLink({
+        _id: link._id,
+        conversationId: link.conversationId,
+        user: userId,
+        shareId: link.shareId,
+        isPublic: true,
+      });
+
+      const rawDoc = await mongoose.connection
+        .db!.collection('sharedlinks')
+        .findOne({ _id: link._id });
+      expect(rawDoc).toHaveProperty('isPublic');
+    } finally {
+      const methods = createMethods(mongoose);
+      await methods.seedDefaultRoles();
+    }
+  });
+
+  test('is idempotent — does not duplicate ACL entries on repeated calls', async () => {
+    const link = await createLegacyLink(true);
+    const args = {
+      _id: link._id,
+      conversationId: link.conversationId,
+      user: userId,
+      shareId: link.shareId,
+      isPublic: true,
+    };
+    await autoMigrateLegacyLink(args);
+    await autoMigrateLegacyLink(args);
+
+    const ownerEntries = await AclEntry.find({
+      resourceId: link._id,
+      principalType: PrincipalType.USER,
+    }).lean();
+    expect(ownerEntries).toHaveLength(1);
+  });
+});
+
+describe('grantCreationPermissions', () => {
+  test('creates OWNER and PUBLIC VIEWER AclEntries', async () => {
+    const link = await createTestLink();
+    await grantCreationPermissions(link._id, userId, true);
+
+    const entries = await AclEntry.find({ resourceId: link._id }).lean();
+    expect(entries).toHaveLength(2);
+
+    const owner = entries.find((e) => e.principalType === PrincipalType.USER);
+    expect(owner).toBeDefined();
+    expect(owner!.principalId!.toString()).toBe(userId);
+
+    const pub = entries.find((e) => e.principalType === PrincipalType.PUBLIC);
+    expect(pub).toBeDefined();
+  });
+
+  test('creates only OWNER when grantPublic is false', async () => {
+    const link = await createTestLink();
+    await grantCreationPermissions(link._id, userId, false);
+
+    const entries = await AclEntry.find({ resourceId: link._id }).lean();
+    expect(entries).toHaveLength(1);
+    expect(entries[0].principalType).toBe(PrincipalType.USER);
+  });
+
+  test('propagates shared link expiration to created AclEntries', async () => {
+    const expiredAt = new Date(Date.now() + 60 * 60 * 1000);
+    const link = await createTestLink({ expiredAt });
+
+    await grantCreationPermissions(link._id, userId, true, expiredAt);
+
+    const entries = await AclEntry.find({ resourceId: link._id }).lean();
+    expect(entries).toHaveLength(2);
+    for (const entry of entries) {
+      expect(entry.expiredAt?.toISOString()).toBe(expiredAt.toISOString());
+    }
+  });
+
+  test('deletes SharedLink when OWNER grant fails', async () => {
+    const link = await createTestLink();
+
+    try {
+      const AccessRole = mongoose.models.AccessRole;
+      await AccessRole.deleteOne({ accessRoleId: AccessRoleIds.SHARED_LINK_OWNER });
+
+      await expect(grantCreationPermissions(link._id, userId, true)).rejects.toThrow();
+
+      const linkAfter = await SharedLink.findById(link._id);
+      expect(linkAfter).toBeNull();
+    } finally {
+      const methods = createMethods(mongoose);
+      await methods.seedDefaultRoles();
+    }
+  });
+});
+
+describe('ensureLinkPermissions', () => {
+  test('creates OWNER AclEntry for legacy link with no entries', async () => {
+    const link = await createTestLink();
+
+    const beforeCount = await AclEntry.countDocuments({ resourceId: link._id });
+    expect(beforeCount).toBe(0);
+
+    await ensureLinkPermissions(link._id, userId);
+
+    const entries = await AclEntry.find({ resourceId: link._id }).lean();
+    expect(entries).toHaveLength(1);
+    expect(entries[0].principalType).toBe(PrincipalType.USER);
+  });
+
+  test('is idempotent — does not duplicate on repeated calls', async () => {
+    const link = await createTestLink();
+
+    await ensureLinkPermissions(link._id, userId);
+    await ensureLinkPermissions(link._id, userId);
+
+    const entries = await AclEntry.find({ resourceId: link._id }).lean();
+    expect(entries).toHaveLength(1);
+  });
+
+  test('does not delete the SharedLink on failure', async () => {
+    const link = await createTestLink();
+    const AccessRole = mongoose.models.AccessRole;
+    await AccessRole.deleteOne({ accessRoleId: AccessRoleIds.SHARED_LINK_OWNER });
+
+    try {
+      await ensureLinkPermissions(link._id, userId);
+
+      const linkAfter = await SharedLink.findById(link._id);
+      expect(linkAfter).not.toBeNull();
+    } finally {
+      const methods = createMethods(mongoose);
+      await methods.seedDefaultRoles();
+    }
+  });
+});
+
+describe('updateSharedLinkPermissionsExpiration', () => {
+  test('sets and clears expiration on shared-link AclEntries', async () => {
+    const link = await createTestLink();
+    await grantCreationPermissions(link._id, userId, true);
+
+    const expiredAt = new Date(Date.now() + 60 * 60 * 1000);
+    await updateSharedLinkPermissionsExpiration(link._id, expiredAt);
+
+    const expiringEntries = await AclEntry.find({ resourceId: link._id }).lean();
+    expect(expiringEntries).toHaveLength(2);
+    for (const entry of expiringEntries) {
+      expect(entry.expiredAt?.toISOString()).toBe(expiredAt.toISOString());
+    }
+
+    await updateSharedLinkPermissionsExpiration(link._id, null);
+
+    const retainedEntries = await AclEntry.find({ resourceId: link._id }).lean();
+    for (const entry of retainedEntries) {
+      expect(entry).not.toHaveProperty('expiredAt');
+    }
+  });
+});
+
+describe('deleteSharedLinkWithCleanup', () => {
+  test('deletes link and triggers ACL cleanup', async () => {
+    const link = await createTestLink();
+    await grantCreationPermissions(link._id, userId, true);
+
+    const result = await deleteSharedLinkWithCleanup(userId, link.shareId!);
+
+    expect(result).toMatchObject({ success: true, shareId: link.shareId! });
+    expect(result!._id).toBe(link._id.toString());
+
+    const linkAfter = await SharedLink.findById(link._id);
+    expect(linkAfter).toBeNull();
+
+    // ACL cleanup is async (fire-and-forget), wait briefly
+    await new Promise((r) => setTimeout(r, 100));
+    const aclAfter = await AclEntry.find({ resourceId: link._id }).lean();
+    expect(aclAfter).toHaveLength(0);
+  });
+
+  test('returns null when link not found', async () => {
+    const result = await deleteSharedLinkWithCleanup(userId, 'nonexistent');
+    expect(result).toBeNull();
+  });
+});
+
+describe('deleteConvoSharedLinksWithCleanup', () => {
+  test('deletes all links for conversation and cleans up ACLs', async () => {
+    const link1 = await createTestLink({ conversationId: 'convo-a' });
+    const link2 = await createTestLink({ conversationId: 'convo-a' });
+    await grantCreationPermissions(link1._id, userId, true);
+    await grantCreationPermissions(link2._id, userId, false);
+
+    const result = await deleteConvoSharedLinksWithCleanup(userId, 'convo-a');
+
+    expect(result.deletedCount).toBe(2);
+
+    await new Promise((r) => setTimeout(r, 100));
+    const aclAfter = await AclEntry.find({
+      resourceId: { $in: [link1._id, link2._id] },
+    }).lean();
+    expect(aclAfter).toHaveLength(0);
+  });
+});
+
+describe('deleteAllSharedLinksWithCleanup', () => {
+  test('deletes all user links and cleans up ACLs', async () => {
+    const link1 = await createTestLink({ conversationId: 'c1' });
+    const link2 = await createTestLink({ conversationId: 'c2' });
+    await grantCreationPermissions(link1._id, userId, true);
+    await grantCreationPermissions(link2._id, userId, true);
+
+    const result = await deleteAllSharedLinksWithCleanup(userId);
+
+    expect(result.deletedCount).toBe(2);
+
+    await new Promise((r) => setTimeout(r, 100));
+    const aclAfter = await AclEntry.find({
+      resourceId: { $in: [link1._id, link2._id] },
+    }).lean();
+    expect(aclAfter).toHaveLength(0);
+  });
+});
diff --git a/packages/api/src/shared-links/service.ts b/packages/api/src/shared-links/service.ts
new file mode 100644
index 00000000000..7fb786b1ea1
--- /dev/null
+++ b/packages/api/src/shared-links/service.ts
@@ -0,0 +1,324 @@
+import mongoose from 'mongoose';
+import { logger } from '@librechat/data-schemas';
+import {
+  PrincipalType,
+  ResourceType,
+  AccessRoleIds,
+  PermissionBits,
+} from 'librechat-data-provider';
+import type { Model, Types, DeleteResult, UpdateQuery } from 'mongoose';
+import type { IAclEntry, ISharedLink } from '@librechat/data-schemas';
+import { AccessControlService } from '~/acl/accessControlService';
+
+let _aclService: AccessControlService | null = null;
+function getAclService(): AccessControlService {
+  if (!_aclService) {
+    _aclService = new AccessControlService(mongoose);
+  }
+  return _aclService;
+}
+
+interface RawSharedLink {
+  _id?: Types.ObjectId;
+  conversationId: string;
+  title?: string;
+  user?: string;
+  shareId?: string;
+  tenantId?: string;
+  isPublic?: boolean;
+  expiredAt?: Date;
+}
+
+export async function autoMigrateLegacyLink(share: RawSharedLink): Promise<void> {
+  const shareId = share._id;
+  if (!shareId) {
+    return;
+  }
+
+  const resourceId = shareId.toString();
+  let ownerGranted = false;
+  let publicGranted = false;
+  let existingOwner = false;
+  if (share.user) {
+    existingOwner = await getAclService().checkPermission({
+      userId: share.user,
+      resourceType: ResourceType.SHARED_LINK,
+      resourceId,
+      requiredPermission: PermissionBits.DELETE,
+    });
+
+    if (!existingOwner) {
+      try {
+        await getAclService().grantPermission({
+          principalType: PrincipalType.USER,
+          principalId: share.user,
+          resourceType: ResourceType.SHARED_LINK,
+          resourceId,
+          accessRoleId: AccessRoleIds.SHARED_LINK_OWNER,
+          grantedBy: share.user,
+          expiredAt: share.expiredAt,
+        });
+        existingOwner = true;
+        ownerGranted = true;
+      } catch (err) {
+        logger.error('[autoMigrateLegacyLink] Failed to grant OWNER', {
+          shareId: share.shareId,
+          error: err instanceof Error ? err.message : String(err),
+        });
+      }
+    }
+  }
+  const needsPublicGrant = share.isPublic !== false;
+  if (needsPublicGrant) {
+    const hasPublic = await getAclService().hasPublicAccess({
+      resourceType: ResourceType.SHARED_LINK,
+      resourceId,
+    });
+
+    if (!hasPublic) {
+      try {
+        await getAclService().grantPermission({
+          principalType: PrincipalType.PUBLIC,
+          principalId: null,
+          resourceType: ResourceType.SHARED_LINK,
+          resourceId,
+          accessRoleId: AccessRoleIds.SHARED_LINK_VIEWER,
+          grantedBy: share.user,
+          expiredAt: share.expiredAt,
+        });
+        publicGranted = true;
+      } catch (err) {
+        logger.error('[autoMigrateLegacyLink] Failed to grant PUBLIC VIEWER', {
+          shareId: share.shareId,
+          error: err instanceof Error ? err.message : String(err),
+        });
+      }
+    } else {
+      publicGranted = true;
+    }
+  }
+
+  const ownerOk = existingOwner || !share.user;
+  const publicOk = publicGranted || !needsPublicGrant;
+
+  if (!ownerOk || !publicOk) {
+    logger.warn('[autoMigrateLegacyLink] Grants incomplete, keeping isPublic for retry', {
+      shareId: share.shareId,
+      ownerOk,
+      publicOk,
+    });
+    return;
+  }
+
+  await mongoose.connection
+    .db!.collection('sharedlinks')
+    .updateOne({ _id: shareId }, { $unset: { isPublic: 1 } });
+
+  logger.info('[autoMigrateLegacyLink] Migrated legacy shared link', {
+    shareId: share.shareId,
+    resourceId,
+    ownerGranted,
+    publicGranted,
+  });
+}
+
+export async function grantCreationPermissions(
+  sharedLinkId: string | Types.ObjectId,
+  userId: string,
+  grantPublic: boolean = true,
+  expiredAt?: Date | null,
+): Promise<void> {
+  const resourceId = sharedLinkId.toString();
+
+  try {
+    await getAclService().grantPermission({
+      principalType: PrincipalType.USER,
+      principalId: userId,
+      resourceType: ResourceType.SHARED_LINK,
+      resourceId,
+      accessRoleId: AccessRoleIds.SHARED_LINK_OWNER,
+      grantedBy: userId,
+      expiredAt: expiredAt ?? undefined,
+    });
+  } catch (err) {
+    logger.error('[grantCreationPermissions] OWNER grant failed, deleting SharedLink', {
+      resourceId,
+      error: err instanceof Error ? err.message : String(err),
+    });
+    await mongoose.models.SharedLink.deleteOne({ _id: sharedLinkId });
+    throw err;
+  }
+
+  if (grantPublic) {
+    try {
+      await getAclService().grantPermission({
+        principalType: PrincipalType.PUBLIC,
+        principalId: null,
+        resourceType: ResourceType.SHARED_LINK,
+        resourceId,
+        accessRoleId: AccessRoleIds.SHARED_LINK_VIEWER,
+        grantedBy: userId,
+        expiredAt: expiredAt ?? undefined,
+      });
+    } catch (err) {
+      logger.error('[grantCreationPermissions] PUBLIC VIEWER grant failed, cleaning up', {
+        resourceId,
+        error: err instanceof Error ? err.message : String(err),
+      });
+      await Promise.all([
+        mongoose.models.SharedLink.deleteOne({ _id: sharedLinkId }),
+        getAclService().removeAllPermissions({
+          resourceType: ResourceType.SHARED_LINK,
+          resourceId,
+        }),
+      ]);
+      throw err;
+    }
+  }
+}
+
+export async function ensureLinkPermissions(
+  sharedLinkId: string | Types.ObjectId,
+  userId: string,
+): Promise<void> {
+  const SharedLink = mongoose.models.SharedLink as Model<ISharedLink>;
+  const rawDoc = await SharedLink.findById(sharedLinkId).lean();
+
+  if (!rawDoc) {
+    return;
+  }
+
+  if ('isPublic' in rawDoc) {
+    await autoMigrateLegacyLink(rawDoc as Parameters<typeof autoMigrateLegacyLink>[0]);
+    return;
+  }
+
+  try {
+    await getAclService().grantPermission({
+      principalType: PrincipalType.USER,
+      principalId: userId,
+      resourceType: ResourceType.SHARED_LINK,
+      resourceId: sharedLinkId.toString(),
+      accessRoleId: AccessRoleIds.SHARED_LINK_OWNER,
+      grantedBy: userId,
+      expiredAt: rawDoc.expiredAt,
+    });
+  } catch (err) {
+    logger.error('[ensureLinkPermissions] Failed to ensure OWNER AclEntry', {
+      resourceId: sharedLinkId.toString(),
+      error: err instanceof Error ? err.message : String(err),
+    });
+  }
+}
+
+export async function cleanupSharedLinkPermissions(
+  resourceId: string | Types.ObjectId,
+): Promise<DeleteResult> {
+  return getAclService().removeAllPermissions({
+    resourceType: ResourceType.SHARED_LINK,
+    resourceId,
+  });
+}
+
+export async function cleanupBulkSharedLinkPermissions(
+  resourceIds: (string | Types.ObjectId)[],
+): Promise<DeleteResult> {
+  const AclEntry = mongoose.models.AclEntry as Model<IAclEntry>;
+  return AclEntry.deleteMany({
+    resourceType: ResourceType.SHARED_LINK,
+    resourceId: { $in: resourceIds },
+  });
+}
+
+export async function updateSharedLinkPermissionsExpiration(
+  resourceId: string | Types.ObjectId,
+  expiredAt: Date | null,
+): Promise<void> {
+  const AclEntry = mongoose.models.AclEntry as Model<IAclEntry>;
+  const update: UpdateQuery<IAclEntry> =
+    expiredAt instanceof Date ? { $set: { expiredAt } } : { $unset: { expiredAt: 1 } };
+
+  await AclEntry.updateMany(
+    {
+      resourceType: ResourceType.SHARED_LINK,
+      resourceId,
+    },
+    update,
+  );
+}
+
+export async function deleteSharedLinkWithCleanup(
+  user: string,
+  shareId: string,
+): Promise<{ _id?: string; success: boolean; shareId: string; message: string } | null> {
+  const SharedLink = mongoose.models.SharedLink as Model<ISharedLink>;
+  const result = await SharedLink.findOneAndDelete({ shareId, user }).lean();
+
+  if (!result) {
+    return null;
+  }
+
+  const resourceId = result._id;
+  if (resourceId) {
+    cleanupSharedLinkPermissions(resourceId).catch((err) => {
+      logger.error('[deleteSharedLinkWithCleanup] ACL cleanup failed', {
+        shareId,
+        error: err instanceof Error ? err.message : String(err),
+      });
+    });
+  }
+
+  return {
+    _id: resourceId?.toString(),
+    success: true,
+    shareId,
+    message: 'Share deleted successfully',
+  };
+}
+
+export async function deleteConvoSharedLinksWithCleanup(
+  user: string,
+  conversationId: string,
+): Promise<{ message: string; deletedCount: number }> {
+  const SharedLink = mongoose.models.SharedLink as Model<ISharedLink>;
+  const links = await SharedLink.find({ user, conversationId }).select('_id').lean();
+  const ids = links.map((l) => l._id);
+  const result = await SharedLink.deleteMany({ user, conversationId });
+
+  if (ids.length > 0) {
+    cleanupBulkSharedLinkPermissions(ids).catch((err) => {
+      logger.error('[deleteConvoSharedLinksWithCleanup] ACL cleanup failed', {
+        conversationId,
+        error: err instanceof Error ? err.message : String(err),
+      });
+    });
+  }
+
+  return {
+    message: 'Shared links deleted successfully',
+    deletedCount: result.deletedCount,
+  };
+}
+
+export async function deleteAllSharedLinksWithCleanup(
+  user: string,
+): Promise<{ message: string; deletedCount: number }> {
+  const SharedLink = mongoose.models.SharedLink as Model<ISharedLink>;
+  const links = await SharedLink.find({ user }).select('_id').lean();
+  const ids = links.map((l) => l._id);
+  const result = await SharedLink.deleteMany({ user });
+
+  if (ids.length > 0) {
+    cleanupBulkSharedLinkPermissions(ids).catch((err) => {
+      logger.error('[deleteAllSharedLinksWithCleanup] ACL cleanup failed', {
+        user,
+        error: err instanceof Error ? err.message : String(err),
+      });
+    });
+  }
+
+  return {
+    message: 'All shared links deleted successfully',
+    deletedCount: result.deletedCount,
+  };
+}
diff --git a/packages/api/src/skills/__tests__/deployment.test.ts b/packages/api/src/skills/__tests__/deployment.test.ts
new file mode 100644
index 00000000000..ea180d240ba
--- /dev/null
+++ b/packages/api/src/skills/__tests__/deployment.test.ts
@@ -0,0 +1,615 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { Types } from 'mongoose';
+import { logger } from '@librechat/data-schemas';
+import type { CodeEnvRef } from 'librechat-data-provider';
+import type { DeploymentSkillBaseMethods } from '../deployment';
+import {
+  DEPLOYMENT_SKILLS_DIR_ENV,
+  createDeploymentSkillMethods,
+  getDeploymentSkillIds,
+  initializeDeploymentSkills,
+  loadDeploymentSkillsFromDirectory,
+  mergeDeploymentSkillIds,
+  resolveDeploymentSkillDirectory,
+} from '../deployment';
+
+const DESCRIPTION = 'Use this skill when the deployment needs a shared testing fixture.';
+
+let tempRoots: string[] = [];
+
+async function makeTempRoot(): Promise<string> {
+  const root = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'deployment-skills-'));
+  tempRoots.push(root);
+  return root;
+}
+
+async function writeDeploymentSkill(
+  root: string,
+  options: {
+    skillsDir?: string;
+    folder?: string;
+    name?: string;
+    alwaysApply?: boolean;
+    frontmatter?: string;
+  } = {},
+): Promise<string> {
+  const skillsDir = options.skillsDir ?? 'skill';
+  const folder = options.folder ?? options.name ?? 'analysis-kit';
+  const name = options.name ?? folder;
+  const skillDir = path.join(root, skillsDir, folder);
+  await fs.promises.mkdir(path.join(skillDir, 'references'), { recursive: true });
+  await fs.promises.mkdir(path.join(skillDir, 'assets'), { recursive: true });
+  await fs.promises.writeFile(
+    path.join(skillDir, 'SKILL.md'),
+    options.frontmatter ??
+      [
+        '---',
+        `name: ${name}`,
+        `description: ${DESCRIPTION}`,
+        'allowed-tools:',
+        '  - execute_code',
+        'disable-model-invocation: true',
+        'user-invocable: false',
+        `always-apply: ${options.alwaysApply === true ? 'true' : 'false'}`,
+        '---',
+        '',
+        '# Analysis Kit',
+        '',
+        'Read references/guide.txt before answering.',
+      ].join('\n'),
+  );
+  await fs.promises.writeFile(path.join(skillDir, 'references', 'guide.txt'), 'reference notes');
+  await fs.promises.writeFile(path.join(skillDir, 'assets', 'pixel.bin'), Buffer.from([0, 1, 2]));
+  return skillDir;
+}
+
+function encodeTestCursor(row: { _id: Types.ObjectId; updatedAt: Date }): string {
+  return Buffer.from(
+    JSON.stringify({
+      updatedAt: row.updatedAt.toISOString(),
+      _id: row._id.toString(),
+    }),
+  ).toString('base64');
+}
+
+afterEach(async () => {
+  const emptyRoot = await makeTempRoot();
+  await initializeDeploymentSkills({ projectRoot: emptyRoot, env: {} });
+  await Promise.all(
+    tempRoots.map((root) => fs.promises.rm(root, { recursive: true, force: true })),
+  );
+  tempRoots = [];
+});
+
+describe('resolveDeploymentSkillDirectory', () => {
+  it('defaults to project root ./skill', () => {
+    const root = path.join(os.tmpdir(), 'librechat-root');
+    expect(resolveDeploymentSkillDirectory({ projectRoot: root, env: {} })).toEqual({
+      directory: path.join(root, 'skill'),
+      explicitlyConfigured: false,
+    });
+  });
+
+  it('honors a relative DEPLOYMENT_SKILLS_DIR override', () => {
+    const root = path.join(os.tmpdir(), 'librechat-root');
+    const env = { [DEPLOYMENT_SKILLS_DIR_ENV]: 'config/skills' };
+    expect(resolveDeploymentSkillDirectory({ projectRoot: root, env })).toEqual({
+      directory: path.join(root, 'config', 'skills'),
+      explicitlyConfigured: true,
+    });
+  });
+});
+
+describe('loadDeploymentSkillsFromDirectory', () => {
+  it('treats a missing default directory as an empty deployment catalog', async () => {
+    const root = await makeTempRoot();
+    const registry = await loadDeploymentSkillsFromDirectory(path.join(root, 'skill'), {
+      projectRoot: root,
+    });
+    expect(registry.list()).toEqual([]);
+  });
+
+  it('fails startup validation when an explicitly configured directory is missing', async () => {
+    const root = await makeTempRoot();
+    await expect(
+      loadDeploymentSkillsFromDirectory(path.join(root, 'missing-skills'), {
+        projectRoot: root,
+        explicitlyConfigured: true,
+      }),
+    ).rejects.toThrow(/Deployment skills directory not found/);
+  });
+
+  it('loads bundled skills and their files without touching the DB', async () => {
+    const root = await makeTempRoot();
+    await writeDeploymentSkill(root, { name: 'analysis-kit', alwaysApply: true });
+
+    const registry = await loadDeploymentSkillsFromDirectory(path.join(root, 'skill'), {
+      projectRoot: root,
+    });
+    const [skill] = registry.list();
+
+    expect(skill).toMatchObject({
+      name: 'analysis-kit',
+      description: DESCRIPTION,
+      source: 'deployment',
+      deployment: true,
+      isPublic: true,
+      alwaysApply: true,
+      allowedTools: ['execute_code'],
+      disableModelInvocation: true,
+      userInvocable: false,
+      authorName: 'Deployment',
+      sourceMetadata: { deployment: true, directory: 'skill/analysis-kit' },
+    });
+    expect(skill.fileCount).toBe(2);
+    expect(skill.files.map((file) => [file.relativePath, file.category])).toEqual([
+      ['assets/pixel.bin', 'asset'],
+      ['references/guide.txt', 'reference'],
+    ]);
+    expect(skill.files.find((file) => file.relativePath === 'references/guide.txt')).toMatchObject({
+      source: 'deployment',
+      content: 'reference notes',
+      isBinary: false,
+      mimeType: 'text/plain',
+    });
+    expect(skill.files.find((file) => file.relativePath === 'assets/pixel.bin')).toMatchObject({
+      isBinary: true,
+    });
+  });
+
+  it('validates SKILL.md frontmatter at startup', async () => {
+    const root = await makeTempRoot();
+    await writeDeploymentSkill(root, {
+      name: 'bad-frontmatter',
+      frontmatter: [
+        '---',
+        'name: bad-frontmatter',
+        `description: ${DESCRIPTION}`,
+        'unknown-key: nope',
+        '---',
+        '',
+        'Body',
+      ].join('\n'),
+    });
+
+    await expect(
+      loadDeploymentSkillsFromDirectory(path.join(root, 'skill'), { projectRoot: root }),
+    ).rejects.toThrow(/frontmatter\.unknown-key/);
+  });
+
+  it('validates bundled file paths at startup', async () => {
+    const root = await makeTempRoot();
+    const skillDir = await writeDeploymentSkill(root, { name: 'bad-path' });
+    await fs.promises.writeFile(path.join(skillDir, 'references', 'bad path.txt'), 'bad');
+
+    await expect(
+      loadDeploymentSkillsFromDirectory(path.join(root, 'skill'), { projectRoot: root }),
+    ).rejects.toThrow(/relativePath: Relative path contains invalid characters/);
+  });
+
+  it('rejects duplicate deployment skill names', async () => {
+    const root = await makeTempRoot();
+    await writeDeploymentSkill(root, { folder: 'one', name: 'duplicate-name' });
+    await writeDeploymentSkill(root, { folder: 'two', name: 'duplicate-name' });
+
+    await expect(
+      loadDeploymentSkillsFromDirectory(path.join(root, 'skill'), { projectRoot: root }),
+    ).rejects.toThrow(/Duplicate deployment skill name "duplicate-name"/);
+  });
+});
+
+describe('createDeploymentSkillMethods', () => {
+  it('merges deployment skills into read paths while stripping them from DB calls', async () => {
+    const root = await makeTempRoot();
+    await writeDeploymentSkill(root, {
+      skillsDir: 'config/skills',
+      name: 'analysis-kit',
+      alwaysApply: true,
+    });
+    await initializeDeploymentSkills({
+      projectRoot: root,
+      env: { [DEPLOYMENT_SKILLS_DIR_ENV]: 'config/skills' },
+    });
+
+    const deploymentId = getDeploymentSkillIds()[0];
+    const dbId = new Types.ObjectId();
+    const dbAuthor = new Types.ObjectId();
+    const dbSkill = {
+      _id: dbId,
+      name: 'db-skill',
+      description: 'A persisted skill.',
+      body: 'persisted body',
+      author: dbAuthor,
+      version: 3,
+      fileCount: 0,
+      updatedAt: new Date(0),
+    };
+    const base: DeploymentSkillBaseMethods = {
+      getSkillById: jest.fn(async (id) => (id.toString() === dbId.toString() ? dbSkill : null)),
+      getSkillByName: jest.fn(async (name) => (name === dbSkill.name ? dbSkill : null)),
+      listSkillsByAccess: jest.fn(async () => ({
+        skills: [dbSkill],
+        has_more: false,
+        after: null,
+      })),
+      listAlwaysApplySkills: jest.fn(async () => ({
+        skills: [{ _id: dbId, name: 'db-always', body: 'db always', author: dbAuthor }],
+        has_more: false,
+        after: null,
+      })),
+      listSkillFiles: jest.fn(async () => []),
+      getSkillFileByPath: jest.fn(async () => null),
+      updateSkillFileContent: jest.fn(async () => undefined),
+      updateSkillFileCodeEnvIds: jest.fn(async (updates) => ({
+        matchedCount: updates.length,
+        modifiedCount: updates.length,
+      })),
+    };
+
+    const methods = createDeploymentSkillMethods(base);
+    const mergedIds = mergeDeploymentSkillIds([dbId]);
+
+    expect(mergedIds.map((id) => id.toString())).toEqual([
+      dbId.toString(),
+      deploymentId.toString(),
+    ]);
+
+    const deploymentSkill = await methods.getSkillById(deploymentId);
+    expect(deploymentSkill).toMatchObject({ name: 'analysis-kit', source: 'deployment' });
+    expect(base.getSkillById).not.toHaveBeenCalled();
+
+    const listed = await methods.listSkillsByAccess?.({
+      accessibleIds: mergedIds,
+      limit: 10,
+    });
+    expect(listed?.skills.map((skill) => skill.name).sort()).toEqual(['analysis-kit', 'db-skill']);
+    expect(base.listSkillsByAccess).toHaveBeenCalledWith({
+      accessibleIds: [dbId],
+      limit: 10,
+    });
+
+    const alwaysApply = await methods.listAlwaysApplySkills?.({
+      accessibleIds: mergedIds,
+      limit: 10,
+    });
+    expect(alwaysApply?.skills.map((skill) => skill.name).sort()).toEqual([
+      'analysis-kit',
+      'db-always',
+    ]);
+    expect(base.listAlwaysApplySkills).toHaveBeenCalledWith({
+      accessibleIds: [dbId],
+      limit: 10,
+    });
+
+    const files = await methods.listSkillFiles?.(deploymentId);
+    expect(files?.map((file) => file.relativePath).sort()).toEqual([
+      'assets/pixel.bin',
+      'references/guide.txt',
+    ]);
+    const guideFile = files?.find((file) => file.relativePath === 'references/guide.txt');
+    expect(guideFile?._id).toBeInstanceOf(Types.ObjectId);
+    expect(guideFile?.skillId.toString()).toBe(deploymentId.toString());
+    expect(guideFile).toMatchObject({
+      file_id: expect.any(String),
+      filename: 'guide.txt',
+      source: 'deployment',
+      mimeType: 'text/plain',
+      bytes: 'reference notes'.length,
+      category: 'reference',
+      isExecutable: false,
+      author: expect.any(Types.ObjectId),
+    });
+    expect(guideFile?.createdAt.getTime()).toEqual(expect.any(Number));
+    expect(guideFile?.updatedAt.getTime()).toEqual(expect.any(Number));
+    expect(guideFile).not.toHaveProperty('content');
+    expect(base.listSkillFiles).not.toHaveBeenCalled();
+
+    await methods.updateSkillFileContent?.(deploymentId, 'references/guide.txt', {
+      content: 'updated content',
+      isBinary: false,
+    });
+    const updatedFile = await methods.getSkillFileByPath?.(deploymentId, 'references/guide.txt');
+    expect(updatedFile?.content).toBe('updated content');
+    expect(base.updateSkillFileContent).not.toHaveBeenCalled();
+
+    const codeEnvRef: CodeEnvRef = {
+      kind: 'skill',
+      id: deploymentId.toString(),
+      version: 1,
+      storage_session_id: 'storage-session',
+      file_id: 'file-id',
+    };
+    const updateResult = await methods.updateSkillFileCodeEnvIds?.([
+      { skillId: deploymentId, relativePath: 'references/guide.txt', codeEnvRef },
+      { skillId: dbId, relativePath: 'references/db.txt', codeEnvRef },
+    ]);
+
+    expect(updateResult).toEqual({ matchedCount: 1, modifiedCount: 1 });
+    expect(base.updateSkillFileCodeEnvIds).toHaveBeenCalledWith([
+      { skillId: dbId, relativePath: 'references/db.txt', codeEnvRef },
+    ]);
+    expect(
+      (await methods.getSkillFileByPath?.(deploymentId, 'references/guide.txt'))?.codeEnvRef,
+    ).toEqual(codeEnvRef);
+  });
+
+  it('lets deployment skills shadow persisted skills with the same name', async () => {
+    const root = await makeTempRoot();
+    await writeDeploymentSkill(root, {
+      skillsDir: 'config/skills',
+      name: 'analysis-kit',
+      alwaysApply: true,
+    });
+    await initializeDeploymentSkills({
+      projectRoot: root,
+      env: { [DEPLOYMENT_SKILLS_DIR_ENV]: 'config/skills' },
+    });
+
+    const deploymentId = getDeploymentSkillIds()[0];
+    const dbId = new Types.ObjectId();
+    const otherId = new Types.ObjectId();
+    const dbAuthor = new Types.ObjectId();
+    const shadowedSkill = {
+      _id: dbId,
+      name: 'analysis-kit',
+      description: 'A persisted duplicate skill.',
+      body: 'persisted duplicate body',
+      author: dbAuthor,
+      version: 9,
+      fileCount: 0,
+      updatedAt: new Date(Date.now() + 60_000),
+    };
+    const otherSkill = {
+      _id: otherId,
+      name: 'db-skill',
+      description: 'A persisted non-duplicate skill.',
+      body: 'persisted body',
+      author: dbAuthor,
+      version: 1,
+      fileCount: 0,
+      updatedAt: new Date(0),
+    };
+    const base: DeploymentSkillBaseMethods = {
+      getSkillByName: jest.fn(async (name) => (name === shadowedSkill.name ? shadowedSkill : null)),
+      listSkillsByAccess: jest.fn(async () => ({
+        skills: [shadowedSkill, otherSkill],
+        has_more: false,
+        after: null,
+      })),
+      listAlwaysApplySkills: jest.fn(async () => ({
+        skills: [
+          {
+            _id: dbId,
+            name: shadowedSkill.name,
+            body: shadowedSkill.body,
+            author: dbAuthor,
+            updatedAt: shadowedSkill.updatedAt,
+          },
+          {
+            _id: otherId,
+            name: 'db-always',
+            body: 'db always',
+            author: dbAuthor,
+            updatedAt: otherSkill.updatedAt,
+          },
+        ],
+        has_more: false,
+        after: null,
+      })),
+    };
+
+    const methods = createDeploymentSkillMethods(base);
+    const mergedIds = mergeDeploymentSkillIds([dbId, otherId]);
+    const warnSpy = jest.spyOn(logger, 'warn').mockImplementation(() => logger);
+
+    const byName = await methods.getSkillByName?.(shadowedSkill.name, mergedIds, {
+      preferUserInvocable: true,
+    });
+    expect(byName).toMatchObject({
+      _id: deploymentId,
+      name: shadowedSkill.name,
+      source: 'deployment',
+    });
+    expect(base.getSkillByName).not.toHaveBeenCalled();
+
+    const listed = await methods.listSkillsByAccess?.({
+      accessibleIds: mergedIds,
+      limit: 10,
+    });
+    expect(listed?.skills.map((skill) => [skill.name, skill._id.toString()]).sort()).toEqual([
+      ['analysis-kit', deploymentId.toString()],
+      ['db-skill', otherId.toString()],
+    ]);
+
+    await methods.listSkillsByAccess?.({
+      accessibleIds: mergedIds,
+      limit: 10,
+    });
+    expect(warnSpy).toHaveBeenCalledTimes(1);
+    expect(warnSpy).toHaveBeenNthCalledWith(
+      1,
+      expect.stringContaining('persisted list skill row(s) shadowed'),
+    );
+
+    const alwaysApply = await methods.listAlwaysApplySkills?.({
+      accessibleIds: mergedIds,
+      limit: 10,
+    });
+    expect(alwaysApply?.skills.map((skill) => [skill.name, skill._id.toString()]).sort()).toEqual([
+      ['analysis-kit', deploymentId.toString()],
+      ['db-always', otherId.toString()],
+    ]);
+
+    await methods.listAlwaysApplySkills?.({
+      accessibleIds: mergedIds,
+      limit: 10,
+    });
+    expect(warnSpy).toHaveBeenCalledTimes(2);
+    expect(warnSpy).toHaveBeenNthCalledWith(
+      2,
+      expect.stringContaining('persisted always-apply skill row(s) shadowed'),
+    );
+    warnSpy.mockRestore();
+  });
+
+  it('preserves pagination when an always-apply DB page only contains shadowed skills', async () => {
+    const root = await makeTempRoot();
+    await writeDeploymentSkill(root, {
+      skillsDir: 'config/skills',
+      name: 'analysis-kit',
+      alwaysApply: false,
+    });
+    await initializeDeploymentSkills({
+      projectRoot: root,
+      env: { [DEPLOYMENT_SKILLS_DIR_ENV]: 'config/skills' },
+    });
+
+    const dbId = new Types.ObjectId();
+    const nextId = new Types.ObjectId();
+    const dbAuthor = new Types.ObjectId();
+    const shadowedUpdatedAt = new Date('2026-01-02T00:00:00.000Z');
+    const shadowedSkill = {
+      _id: dbId,
+      name: 'analysis-kit',
+      body: 'persisted duplicate body',
+      author: dbAuthor,
+    };
+    const nextSkill = {
+      _id: nextId,
+      name: 'db-next',
+      body: 'next persisted body',
+      author: dbAuthor,
+    };
+    const shadowedCursor = encodeTestCursor({ _id: dbId, updatedAt: shadowedUpdatedAt });
+    const base: DeploymentSkillBaseMethods = {
+      listAlwaysApplySkills: jest.fn(async (params) => {
+        if (params.cursor) {
+          return {
+            skills: [nextSkill],
+            has_more: false,
+            after: null,
+          };
+        }
+        return {
+          skills: [shadowedSkill],
+          has_more: true,
+          after: shadowedCursor,
+        };
+      }),
+    };
+
+    const methods = createDeploymentSkillMethods(base);
+    const mergedIds = mergeDeploymentSkillIds([dbId, nextId]);
+    const warnSpy = jest.spyOn(logger, 'warn').mockImplementation(() => logger);
+
+    const first = await methods.listAlwaysApplySkills?.({
+      accessibleIds: mergedIds,
+      limit: 1,
+    });
+    expect(first?.skills).toEqual([]);
+    expect(first?.has_more).toBe(true);
+    expect(first?.after).toBe(shadowedCursor);
+
+    const second = await methods.listAlwaysApplySkills?.({
+      accessibleIds: mergedIds,
+      limit: 1,
+      cursor: first?.after,
+    });
+    expect(second?.skills.map((skill) => skill.name)).toEqual(['db-next']);
+    expect(second?.has_more).toBe(false);
+    expect(base.listAlwaysApplySkills).toHaveBeenNthCalledWith(2, {
+      accessibleIds: [dbId, nextId],
+      limit: 1,
+      cursor: first?.after,
+    });
+    warnSpy.mockRestore();
+  });
+
+  it('waits to return older deployment rows until the DB page boundary advances', async () => {
+    const root = await makeTempRoot();
+    await writeDeploymentSkill(root, {
+      skillsDir: 'config/skills',
+      name: 'analysis-kit',
+      alwaysApply: false,
+    });
+    await initializeDeploymentSkills({
+      projectRoot: root,
+      env: { [DEPLOYMENT_SKILLS_DIR_ENV]: 'config/skills' },
+    });
+
+    const hiddenId = new Types.ObjectId();
+    const visibleId = new Types.ObjectId();
+    const nextId = new Types.ObjectId();
+    const dbAuthor = new Types.ObjectId();
+    const hiddenSkill = {
+      _id: hiddenId,
+      name: 'analysis-kit',
+      description: 'A persisted duplicate skill.',
+      author: dbAuthor,
+      version: 1,
+      fileCount: 0,
+      updatedAt: new Date('2026-12-03T00:00:00.000Z'),
+    };
+    const visibleSkill = {
+      _id: visibleId,
+      name: 'db-visible',
+      description: 'A visible persisted skill.',
+      author: dbAuthor,
+      version: 1,
+      fileCount: 0,
+      updatedAt: new Date('2026-12-02T00:00:00.000Z'),
+    };
+    const nextSkill = {
+      _id: nextId,
+      name: 'db-next',
+      description: 'The next persisted skill.',
+      author: dbAuthor,
+      version: 1,
+      fileCount: 0,
+      updatedAt: new Date('2026-12-01T00:00:00.000Z'),
+    };
+    const visibleCursor = encodeTestCursor({
+      _id: visibleId,
+      updatedAt: visibleSkill.updatedAt,
+    });
+    const base: DeploymentSkillBaseMethods = {
+      listSkillsByAccess: jest.fn(async (params) => {
+        if (params.cursor) {
+          return {
+            skills: [nextSkill],
+            has_more: false,
+            after: null,
+          };
+        }
+        return {
+          skills: [hiddenSkill, visibleSkill],
+          has_more: true,
+          after: visibleCursor,
+        };
+      }),
+    };
+
+    const methods = createDeploymentSkillMethods(base);
+    const mergedIds = mergeDeploymentSkillIds([hiddenId, visibleId, nextId]);
+    const warnSpy = jest.spyOn(logger, 'warn').mockImplementation(() => logger);
+
+    const first = await methods.listSkillsByAccess?.({
+      accessibleIds: mergedIds,
+      limit: 2,
+    });
+    expect(first?.skills.map((skill) => skill.name)).toEqual(['db-visible']);
+    expect(first?.has_more).toBe(true);
+    expect(first?.after).toBe(visibleCursor);
+
+    const second = await methods.listSkillsByAccess?.({
+      accessibleIds: mergedIds,
+      limit: 2,
+      cursor: first?.after,
+    });
+    expect(second?.skills.map((skill) => skill.name)).toEqual(['db-next', 'analysis-kit']);
+    expect(second?.has_more).toBe(false);
+    warnSpy.mockRestore();
+  });
+});
diff --git a/packages/api/src/skills/__tests__/import.test.ts b/packages/api/src/skills/__tests__/import.test.ts
index 626edbdb808..55416967d21 100644
--- a/packages/api/src/skills/__tests__/import.test.ts
+++ b/packages/api/src/skills/__tests__/import.test.ts
@@ -67,6 +67,20 @@ function mockZipRequest(buffer: Buffer): ImportRequest {
   } as unknown as ImportRequest;
 }
 
+function mockMarkdownRequest(content: string, originalname = 'bad-frontmatter.md'): ImportRequest {
+  return {
+    user: {
+      id: 'user-1',
+      _id: new Types.ObjectId(),
+      username: 'tester',
+    },
+    file: {
+      originalname,
+      buffer: Buffer.from(content),
+    },
+  } as unknown as ImportRequest;
+}
+
 function importSummary(body: unknown): ImportSummary {
   return (body as { _importSummary: ImportSummary })._importSummary;
 }
@@ -90,6 +104,12 @@ async function zipWithAdditionalFiles(fileCount: number, fileBytes: number): Pro
   return zip.generateAsync({ type: 'nodebuffer', compression: 'DEFLATE' });
 }
 
+async function zipWithSkillMarkdown(skillMarkdown: string): Promise<Buffer> {
+  const zip = new JSZip();
+  zip.file('SKILL.md', skillMarkdown);
+  return zip.generateAsync({ type: 'nodebuffer', compression: 'DEFLATE' });
+}
+
 describe('parseFrontmatter', () => {
   it('extracts name + description from a minimal frontmatter block', () => {
     const raw = `---\nname: demo\ndescription: A demo skill.\n---\n\n# Body`;
@@ -101,6 +121,16 @@ describe('parseFrontmatter', () => {
     });
   });
 
+  it('coerces non-string scalar name and description to strings', () => {
+    const raw = `---\nname: 123\ndescription: 2024\n---\n\n# Body`;
+    expect(parseFrontmatter(raw)).toEqual({
+      name: '123',
+      description: '2024',
+      alwaysApply: undefined,
+      invalidBooleans: [],
+    });
+  });
+
   it('extracts always-apply: true', () => {
     const raw = `---\nname: legal\ndescription: Legal rules.\nalways-apply: true\n---\n\n# Legal body`;
     expect(parseFrontmatter(raw)).toEqual({
@@ -121,6 +151,37 @@ describe('parseFrontmatter', () => {
     });
   });
 
+  it('extracts alwaysApply: true', () => {
+    const raw = `---\nname: legal\ndescription: Legal rules.\nalwaysApply: true\n---\n\n# Legal body`;
+    expect(parseFrontmatter(raw)).toEqual({
+      name: 'legal',
+      description: 'Legal rules.',
+      alwaysApply: true,
+      invalidBooleans: [],
+    });
+  });
+
+  it('lets always-apply win when both spellings are present', () => {
+    const raw = `---\nname: legal\ndescription: Legal rules.\nalways-apply: false\nalwaysApply: true\n---\n\n# Legal body`;
+    expect(parseFrontmatter(raw).alwaysApply).toBe(false);
+  });
+
+  it('ignores invalid alwaysApply alias when canonical always-apply is valid', () => {
+    const raw = `---\nname: legal\ndescription: Legal rules.\nalways-apply: true\nalwaysApply: yes\n---\n\n# Legal body`;
+    const result = parseFrontmatter(raw);
+
+    expect(result.alwaysApply).toBe(true);
+    expect(result.invalidBooleans).toEqual([]);
+  });
+
+  it('ignores invalid alwaysApply alias before a valid canonical always-apply', () => {
+    const raw = `---\nname: legal\ndescription: Legal rules.\nalwaysApply: yes\nalways-apply: false\n---\n\n# Legal body`;
+    const result = parseFrontmatter(raw);
+
+    expect(result.alwaysApply).toBe(false);
+    expect(result.invalidBooleans).toEqual([]);
+  });
+
   it('flags non-boolean always-apply values as invalid (no silent drop)', () => {
     const raw = `---\nname: n\ndescription: d\nalways-apply: yes\n---\n\nbody`;
     const result = parseFrontmatter(raw);
@@ -128,6 +189,27 @@ describe('parseFrontmatter', () => {
     expect(result.invalidBooleans).toEqual(['always-apply']);
   });
 
+  it('flags non-boolean alwaysApply values as invalid (no silent drop)', () => {
+    const raw = `---\nname: n\ndescription: d\nalwaysApply: yes\n---\n\nbody`;
+    const result = parseFrontmatter(raw);
+    expect(result.alwaysApply).toBeUndefined();
+    expect(result.invalidBooleans).toEqual(['alwaysApply']);
+  });
+
+  it('flags legacy YAML boolean aliases as invalid', () => {
+    const raw = `---\nname: n\ndescription: d\nalways-apply: on\n---\n\nbody`;
+    const result = parseFrontmatter(raw);
+    expect(result.alwaysApply).toBeUndefined();
+    expect(result.invalidBooleans).toEqual(['always-apply']);
+  });
+
+  it.each(['null', '~'])('flags always-apply: %s as invalid', (value) => {
+    const raw = `---\nname: n\ndescription: d\nalways-apply: ${value}\n---\n\nbody`;
+    const result = parseFrontmatter(raw);
+    expect(result.alwaysApply).toBeUndefined();
+    expect(result.invalidBooleans).toEqual(['always-apply']);
+  });
+
   it('does not flag always-apply when the key is absent', () => {
     const raw = `---\nname: n\ndescription: d\n---\n\nbody`;
     expect(parseFrontmatter(raw).invalidBooleans).toEqual([]);
@@ -164,6 +246,26 @@ describe('parseFrontmatter', () => {
     });
   });
 
+  it('extracts frontmatter after a BOM and leading blank lines', () => {
+    const raw = `\uFEFF\n\n---\nname: prologue\ndescription: Has leading whitespace.\n---\n\nbody`;
+    expect(parseFrontmatter(raw)).toEqual({
+      name: 'prologue',
+      description: 'Has leading whitespace.',
+      alwaysApply: undefined,
+      invalidBooleans: [],
+    });
+  });
+
+  it('does not treat frontmatter scalar lines that start with --- text as closing fences', () => {
+    const raw = `---\nname: marker\ndescription: 'first\n---not a closing fence\nlast'\nalways-apply: false\n---\n\nbody`;
+    expect(parseFrontmatter(raw)).toEqual({
+      name: 'marker',
+      description: 'first ---not a closing fence last',
+      alwaysApply: false,
+      invalidBooleans: [],
+    });
+  });
+
   it('returns empty fields when frontmatter is unterminated', () => {
     const raw = `---\nname: incomplete\n`;
     expect(parseFrontmatter(raw)).toEqual({
@@ -173,6 +275,18 @@ describe('parseFrontmatter', () => {
     });
   });
 
+  it('returns empty fields when frontmatter YAML is malformed', () => {
+    const raw = `---\nname: [\n---\n\nbody`;
+    expect(parseFrontmatter(raw)).toEqual(
+      expect.objectContaining({
+        name: '',
+        description: '',
+        invalidBooleans: [],
+        parseError: expect.any(String),
+      }),
+    );
+  });
+
   it('ignores always-apply appearing outside the frontmatter block', () => {
     const raw = `---\nname: n\ndescription: d\n---\n\nalways-apply: true (but this is in the body)`;
     const result = parseFrontmatter(raw);
@@ -256,4 +370,49 @@ describe('createImportHandler', () => {
     expect(summary.filesFailed).toBe(3);
     expect(summary.errors).toHaveLength(3);
   });
+
+  it('rejects malformed YAML frontmatter in markdown imports', async () => {
+    const deps = mockImportDeps();
+    const handler = createImportHandler(deps);
+    const res = mockResponse();
+
+    await handler(mockMarkdownRequest('---\nname: [\n---\n\nbody'), res);
+
+    expect(res.status).toHaveBeenCalledWith(400);
+    expect(res.body).toEqual(
+      expect.objectContaining({
+        error: 'Validation failed',
+        issues: expect.arrayContaining([
+          expect.objectContaining({
+            field: 'frontmatter',
+            code: 'INVALID_YAML',
+          }),
+        ]),
+      }),
+    );
+    expect(deps.createSkill).not.toHaveBeenCalled();
+  });
+
+  it('rejects malformed YAML frontmatter in archive imports', async () => {
+    const deps = mockImportDeps();
+    const handler = createImportHandler(deps);
+    const res = mockResponse();
+    const buffer = await zipWithSkillMarkdown('---\nname: [\n---\n\nbody');
+
+    await handler(mockZipRequest(buffer), res);
+
+    expect(res.status).toHaveBeenCalledWith(400);
+    expect(res.body).toEqual(
+      expect.objectContaining({
+        error: 'Validation failed',
+        issues: expect.arrayContaining([
+          expect.objectContaining({
+            field: 'frontmatter',
+            code: 'INVALID_YAML',
+          }),
+        ]),
+      }),
+    );
+    expect(deps.createSkill).not.toHaveBeenCalled();
+  });
 });
diff --git a/packages/api/src/skills/deployment.ts b/packages/api/src/skills/deployment.ts
new file mode 100644
index 00000000000..3824fe055ff
--- /dev/null
+++ b/packages/api/src/skills/deployment.ts
@@ -0,0 +1,1073 @@
+import fs from 'fs';
+import path from 'path';
+import yaml from 'js-yaml';
+import crypto from 'crypto';
+import { Types } from 'mongoose';
+import {
+  logger,
+  partitionIssues,
+  validateSkillName,
+  validateSkillBody,
+  validateRelativePath,
+  inferSkillFileCategory,
+  validateSkillFrontmatter,
+  validateSkillDescription,
+  deriveStructuredFrontmatterFields,
+} from '@librechat/data-schemas';
+import type { ValidationIssue } from '@librechat/data-schemas';
+import type { CodeEnvRef } from 'librechat-data-provider';
+import { parseFrontmatter, guessMimeType } from './import';
+
+export const DEPLOYMENT_SKILLS_DIR_ENV = 'DEPLOYMENT_SKILLS_DIR';
+export const DEFAULT_DEPLOYMENT_SKILLS_DIR = 'skill';
+export const DEPLOYMENT_SKILL_SOURCE = 'deployment';
+export const DEPLOYMENT_SKILL_FILE_SOURCE = 'deployment';
+
+const SKILL_MD = 'SKILL.md';
+const DEPLOYMENT_AUTHOR_ID = new Types.ObjectId('de9100000000000000000000');
+const MAX_CACHED_TEXT_BYTES = 512 * 1024;
+
+type SkillId = Types.ObjectId | string;
+
+export type DeploymentSkillFile = {
+  _id: Types.ObjectId;
+  skillId: Types.ObjectId;
+  relativePath: string;
+  file_id: string;
+  filename: string;
+  filepath: string;
+  source: typeof DEPLOYMENT_SKILL_FILE_SOURCE;
+  mimeType: string;
+  bytes: number;
+  category: 'script' | 'reference' | 'asset' | 'other';
+  isExecutable: boolean;
+  author: Types.ObjectId;
+  content?: string;
+  isBinary?: boolean;
+  codeEnvRef?: CodeEnvRef;
+  createdAt: Date;
+  updatedAt: Date;
+};
+
+export type DeploymentSkill = {
+  _id: Types.ObjectId;
+  name: string;
+  displayTitle?: string;
+  description: string;
+  body: string;
+  frontmatter: Record<string, unknown>;
+  category: string;
+  disableModelInvocation?: boolean;
+  userInvocable?: boolean;
+  allowedTools?: string[];
+  author: Types.ObjectId;
+  authorName: string;
+  version: number;
+  source: typeof DEPLOYMENT_SKILL_SOURCE;
+  sourceMetadata: { deployment: true; directory: string };
+  fileCount: number;
+  alwaysApply: boolean;
+  isPublic: true;
+  deployment: true;
+  files: DeploymentSkillFile[];
+  createdAt: Date;
+  updatedAt: Date;
+};
+
+type SkillLookupOptions = {
+  preferUserInvocable?: boolean;
+  preferModelInvocable?: boolean;
+};
+
+type SkillSummaryRow = {
+  _id: Types.ObjectId;
+  name: string;
+  displayTitle?: string;
+  description: string;
+  category?: string;
+  disableModelInvocation?: boolean;
+  userInvocable?: boolean;
+  allowedTools?: string[];
+  author: Types.ObjectId;
+  authorName?: string;
+  version?: number;
+  source?: string;
+  sourceMetadata?: Record<string, unknown>;
+  fileCount?: number;
+  alwaysApply?: boolean;
+  isPublic?: boolean;
+  tenantId?: string;
+  deployment?: boolean;
+  createdAt?: Date;
+  updatedAt?: Date;
+};
+
+type SkillDetailRow = SkillSummaryRow & {
+  body: string;
+  frontmatter?: Record<string, unknown>;
+  version: number;
+  fileCount: number;
+};
+
+type AlwaysApplySkillRow = {
+  _id: Types.ObjectId;
+  name: string;
+  body: string;
+  author: Types.ObjectId | string;
+  allowedTools?: string[];
+  deployment?: boolean;
+  updatedAt?: Date;
+};
+
+type ListSkillsByAccessParams = {
+  accessibleIds: Types.ObjectId[];
+  category?: string;
+  search?: string;
+  limit: number;
+  cursor?: string | null;
+};
+
+type ListSkillsByAccessResult = {
+  skills: SkillSummaryRow[];
+  has_more?: boolean;
+  after?: string | null;
+};
+
+type ListAlwaysApplyParams = {
+  accessibleIds: Types.ObjectId[];
+  limit: number;
+  cursor?: string | null;
+};
+
+type ListAlwaysApplyResult = {
+  skills: AlwaysApplySkillRow[];
+  has_more?: boolean;
+  after?: string | null;
+};
+
+type SkillFileRow = Omit<DeploymentSkillFile, 'codeEnvRef' | 'content' | 'isBinary'> & {
+  storageKey?: string;
+  storageRegion?: string;
+  tenantId?: string;
+};
+
+type SkillFileContentRow = SkillFileRow & {
+  codeEnvRef?: CodeEnvRef;
+  content?: string;
+  isBinary?: boolean;
+};
+
+export type DeploymentSkillBaseMethods = {
+  getSkillById?: (id: SkillId) => Promise<SkillDetailRow | null>;
+  getSkillByName?: (
+    name: string,
+    accessibleIds: Types.ObjectId[],
+    options?: SkillLookupOptions,
+  ) => Promise<SkillDetailRow | null>;
+  listSkillsByAccess?: (params: ListSkillsByAccessParams) => Promise<ListSkillsByAccessResult>;
+  listAlwaysApplySkills?: (params: ListAlwaysApplyParams) => Promise<ListAlwaysApplyResult>;
+  listSkillFiles?: (skillId: SkillId) => Promise<SkillFileRow[]>;
+  getSkillFileByPath?: (
+    skillId: SkillId,
+    relativePath: string,
+  ) => Promise<SkillFileContentRow | null>;
+  updateSkillFileContent?: (
+    skillId: SkillId,
+    relativePath: string,
+    update: { content?: string; isBinary?: boolean },
+  ) => Promise<void>;
+  updateSkillFileCodeEnvIds?: (
+    updates: Array<{ skillId: SkillId; relativePath: string; codeEnvRef: CodeEnvRef }>,
+  ) => Promise<{ matchedCount: number; modifiedCount: number } | void>;
+};
+
+type Cursor = { updatedAt: Date; _id: Types.ObjectId };
+type CollisionFilterResult<T> = {
+  rows: T[];
+};
+
+type LoadDeploymentSkillsOptions = {
+  projectRoot?: string;
+  env?: NodeJS.ProcessEnv;
+};
+
+type DirectoryResolution = {
+  directory: string;
+  explicitlyConfigured: boolean;
+};
+
+type LoadedSkillDirectory = {
+  directory: string;
+  relativeDirectory: string;
+};
+
+export class DeploymentSkillRegistry {
+  private readonly skillsById = new Map<string, DeploymentSkill>();
+  private readonly skillsByName = new Map<string, DeploymentSkill>();
+  private readonly filesByPath = new Map<string, DeploymentSkillFile>();
+
+  constructor(
+    private readonly directory: string | null,
+    skills: DeploymentSkill[],
+  ) {
+    for (const skill of skills) {
+      this.skillsById.set(skill._id.toString(), skill);
+      this.skillsByName.set(skill.name, skill);
+      for (const file of skill.files) {
+        this.filesByPath.set(file.filepath, file);
+      }
+    }
+  }
+
+  getDirectory(): string | null {
+    return this.directory;
+  }
+
+  list(): DeploymentSkill[] {
+    return Array.from(this.skillsById.values());
+  }
+
+  ids(): Types.ObjectId[] {
+    return this.list().map((skill) => skill._id);
+  }
+
+  hasId(id: SkillId | undefined): boolean {
+    return id != null && this.skillsById.has(id.toString());
+  }
+
+  getById(id: SkillId): DeploymentSkill | null {
+    return this.skillsById.get(id.toString()) ?? null;
+  }
+
+  getByName(
+    name: string,
+    accessibleIds: Types.ObjectId[],
+    _options?: SkillLookupOptions,
+  ): DeploymentSkill | null {
+    const skill = this.skillsByName.get(name);
+    if (!skill) {
+      return null;
+    }
+    if (!hasAccessibleId(accessibleIds, skill._id)) {
+      return null;
+    }
+    return skill;
+  }
+
+  namesByAccess(accessibleIds: Types.ObjectId[]): Set<string> {
+    const accessibleSet = new Set(accessibleIds.map((id) => id.toString()));
+    const names = new Set<string>();
+    for (const skill of this.list()) {
+      if (accessibleSet.has(skill._id.toString())) {
+        names.add(skill.name);
+      }
+    }
+    return names;
+  }
+
+  listByAccess(params: ListSkillsByAccessParams): DeploymentSkill[] {
+    const accessibleSet = new Set(params.accessibleIds.map((id) => id.toString()));
+    const cursor = decodeCursor(params.cursor);
+    const search = params.search?.toLowerCase();
+    return this.list()
+      .filter((skill) => accessibleSet.has(skill._id.toString()))
+      .filter((skill) => !params.category || skill.category === params.category)
+      .filter((skill) => {
+        if (!search) {
+          return true;
+        }
+        return (
+          skill.name.toLowerCase().includes(search) ||
+          skill.description.toLowerCase().includes(search) ||
+          (skill.displayTitle?.toLowerCase().includes(search) ?? false)
+        );
+      })
+      .filter((skill) => isAfterCursor(skill, cursor))
+      .sort(compareBySkillCursor);
+  }
+
+  listAlwaysApply(params: ListAlwaysApplyParams): DeploymentSkill[] {
+    const accessibleSet = new Set(params.accessibleIds.map((id) => id.toString()));
+    const cursor = decodeCursor(params.cursor);
+    return this.list()
+      .filter((skill) => skill.alwaysApply === true)
+      .filter((skill) => accessibleSet.has(skill._id.toString()))
+      .filter((skill) => isAfterCursor(skill, cursor))
+      .sort(compareBySkillCursor);
+  }
+
+  listFiles(skillId: SkillId): DeploymentSkillFile[] | null {
+    const skill = this.getById(skillId);
+    return skill ? [...skill.files] : null;
+  }
+
+  getFileByPath(skillId: SkillId, relativePath: string): DeploymentSkillFile | null {
+    const skill = this.getById(skillId);
+    if (!skill) {
+      return null;
+    }
+    return skill.files.find((file) => file.relativePath === relativePath) ?? null;
+  }
+
+  hasFilePath(filepath: string): boolean {
+    return this.filesByPath.has(filepath);
+  }
+
+  updateFileCodeEnvRefs(
+    updates: Array<{ skillId: SkillId; relativePath: string; codeEnvRef: CodeEnvRef }>,
+  ): Array<{ skillId: SkillId; relativePath: string; codeEnvRef: CodeEnvRef }> {
+    const dbUpdates: Array<{ skillId: SkillId; relativePath: string; codeEnvRef: CodeEnvRef }> = [];
+    for (const update of updates) {
+      const file = this.getFileByPath(update.skillId, update.relativePath);
+      if (!file) {
+        dbUpdates.push(update);
+        continue;
+      }
+      file.codeEnvRef = update.codeEnvRef;
+    }
+    return dbUpdates;
+  }
+}
+
+let registry = new DeploymentSkillRegistry(null, []);
+const warnedDeploymentNameCollisions = new Set<string>();
+
+export function getDeploymentSkillRegistry(): DeploymentSkillRegistry {
+  return registry;
+}
+
+export function getDeploymentSkillIds(): Types.ObjectId[] {
+  return registry.ids();
+}
+
+export function mergeDeploymentSkillIds(ids: Array<SkillId>): Types.ObjectId[] {
+  const seen = new Set<string>();
+  const merged: Types.ObjectId[] = [];
+  for (const id of [...ids, ...registry.ids()]) {
+    const oid = typeof id === 'string' ? new Types.ObjectId(id) : id;
+    const key = oid.toString();
+    if (seen.has(key)) {
+      continue;
+    }
+    seen.add(key);
+    merged.push(oid);
+  }
+  return merged;
+}
+
+export function isDeploymentSkillId(id: SkillId | undefined): boolean {
+  return registry.hasId(id);
+}
+
+export function isDeploymentSkillFileSource(source: unknown): boolean {
+  return source === DEPLOYMENT_SKILL_FILE_SOURCE;
+}
+
+export function getDeploymentSkillById(id: SkillId): DeploymentSkill | null {
+  return registry.getById(id);
+}
+
+export function isDeploymentSkillFilePath(filepath: string): boolean {
+  return registry.hasFilePath(filepath);
+}
+
+export async function getDeploymentSkillDownloadStream(
+  filepath: string,
+): Promise<NodeJS.ReadableStream> {
+  if (!registry.hasFilePath(filepath)) {
+    throw new Error('Deployment skill file is not registered');
+  }
+  return fs.createReadStream(filepath);
+}
+
+export function updateDeploymentSkillFileCodeEnvRefs(
+  updates: Array<{ skillId: SkillId; relativePath: string; codeEnvRef: CodeEnvRef }>,
+): Array<{ skillId: SkillId; relativePath: string; codeEnvRef: CodeEnvRef }> {
+  return registry.updateFileCodeEnvRefs(updates);
+}
+
+export function resolveDeploymentSkillDirectory(
+  options: LoadDeploymentSkillsOptions = {},
+): DirectoryResolution {
+  const env = options.env ?? process.env;
+  const projectRoot = options.projectRoot ?? process.cwd();
+  const configured = env[DEPLOYMENT_SKILLS_DIR_ENV]?.trim();
+  const rawDirectory =
+    configured && configured.length > 0 ? configured : DEFAULT_DEPLOYMENT_SKILLS_DIR;
+  return {
+    directory: path.isAbsolute(rawDirectory)
+      ? rawDirectory
+      : path.resolve(projectRoot, rawDirectory),
+    explicitlyConfigured: configured != null && configured.length > 0,
+  };
+}
+
+export async function initializeDeploymentSkills(
+  options: LoadDeploymentSkillsOptions = {},
+): Promise<DeploymentSkillRegistry> {
+  const resolved = resolveDeploymentSkillDirectory(options);
+  registry = await loadDeploymentSkillsFromDirectory(resolved.directory, {
+    projectRoot: options.projectRoot ?? process.cwd(),
+    explicitlyConfigured: resolved.explicitlyConfigured,
+  });
+  const count = registry.list().length;
+  if (count > 0) {
+    logger.info(
+      `[deploymentSkills] Loaded ${count} deployment skill(s) from ${registry.getDirectory()}`,
+    );
+  } else {
+    logger.debug(`[deploymentSkills] No deployment skills loaded from ${resolved.directory}`);
+  }
+  return registry;
+}
+
+export async function loadDeploymentSkillsFromDirectory(
+  directory: string,
+  options: { projectRoot?: string; explicitlyConfigured?: boolean } = {},
+): Promise<DeploymentSkillRegistry> {
+  let rootStat: fs.Stats;
+  try {
+    rootStat = await fs.promises.stat(directory);
+  } catch (error) {
+    if (
+      (error as NodeJS.ErrnoException).code === 'ENOENT' &&
+      options.explicitlyConfigured !== true
+    ) {
+      return new DeploymentSkillRegistry(directory, []);
+    }
+    throw new Error(`Deployment skills directory not found: ${directory}`);
+  }
+  if (!rootStat.isDirectory()) {
+    throw new Error(`Deployment skills path must be a directory: ${directory}`);
+  }
+
+  const skillDirectories = await findSkillDirectories(directory, options.projectRoot ?? directory);
+  const skills = await Promise.all(
+    skillDirectories.map((skillDirectory) => loadDeploymentSkill(skillDirectory, directory)),
+  );
+  validateUniqueNames(skills);
+  return new DeploymentSkillRegistry(directory, skills.sort(compareBySkillCursor));
+}
+
+export function createDeploymentSkillMethods<T extends DeploymentSkillBaseMethods>(
+  base: T,
+): T & Required<Pick<DeploymentSkillBaseMethods, 'getSkillById'>> {
+  const methods = {
+    ...base,
+    getSkillById: async (id: SkillId): Promise<SkillDetailRow | null> => {
+      const deployment = registry.getById(id);
+      if (deployment) {
+        return toSkillDetailRow(deployment);
+      }
+      return base.getSkillById ? base.getSkillById(id) : null;
+    },
+    getSkillByName: async (
+      name: string,
+      accessibleIds: Types.ObjectId[],
+      options?: SkillLookupOptions,
+    ): Promise<SkillDetailRow | null> => {
+      const deployment = registry.getByName(name, accessibleIds, options);
+      if (deployment) {
+        return toSkillDetailRow(deployment);
+      }
+      const dbSkill = base.getSkillByName
+        ? await base.getSkillByName(name, stripDeploymentIds(accessibleIds), options)
+        : null;
+      return dbSkill;
+    },
+    listSkillsByAccess: async (
+      params: ListSkillsByAccessParams,
+    ): Promise<ListSkillsByAccessResult> => {
+      const dbResult = base.listSkillsByAccess
+        ? await base.listSkillsByAccess({
+            ...params,
+            accessibleIds: stripDeploymentIds(params.accessibleIds),
+          })
+        : { skills: [], has_more: false, after: null };
+      const deploymentNames = registry.namesByAccess(params.accessibleIds);
+      const filteredDb = filterDeploymentNameCollisions(dbResult.skills, deploymentNames, 'list');
+      const dbPageBoundary = getDbPageBoundary(dbResult);
+      const deploymentRows = limitRowsToDbPageBoundary(
+        registry.listByAccess(params).map(toSkillSummaryRow),
+        dbPageBoundary,
+      );
+      return mergeSkillPage({
+        dbResult: {
+          ...dbResult,
+          skills: filteredDb.rows,
+        },
+        dbPageBoundary,
+        deploymentRows,
+        limit: params.limit,
+      });
+    },
+    listAlwaysApplySkills: async (
+      params: ListAlwaysApplyParams,
+    ): Promise<ListAlwaysApplyResult> => {
+      const dbResult = base.listAlwaysApplySkills
+        ? await base.listAlwaysApplySkills({
+            ...params,
+            accessibleIds: stripDeploymentIds(params.accessibleIds),
+          })
+        : { skills: [], has_more: false, after: null };
+      const deploymentNames = registry.namesByAccess(params.accessibleIds);
+      const filteredDb = filterDeploymentNameCollisions(
+        dbResult.skills,
+        deploymentNames,
+        'always-apply',
+      );
+      const dbPageBoundary = getDbPageBoundary(dbResult);
+      return mergeAlwaysApplyPage({
+        dbResult: {
+          ...dbResult,
+          skills: filteredDb.rows,
+        },
+        dbPageBoundary,
+        deploymentRows: limitRowsToDbPageBoundary(
+          registry.listAlwaysApply(params).map(toAlwaysApplyRow),
+          dbPageBoundary,
+        ),
+        limit: params.limit,
+      });
+    },
+    listSkillFiles: async (skillId: SkillId): Promise<SkillFileRow[]> => {
+      const deploymentFiles = registry.listFiles(skillId);
+      if (deploymentFiles) {
+        return deploymentFiles.map(toSkillFileRow);
+      }
+      return base.listSkillFiles ? base.listSkillFiles(skillId) : [];
+    },
+    getSkillFileByPath: async (
+      skillId: SkillId,
+      relativePath: string,
+    ): Promise<SkillFileContentRow | null> => {
+      const deploymentFile = registry.getFileByPath(skillId, relativePath);
+      if (deploymentFile) {
+        return toSkillFileContentRow(deploymentFile);
+      }
+      return base.getSkillFileByPath ? base.getSkillFileByPath(skillId, relativePath) : null;
+    },
+    updateSkillFileContent: async (
+      skillId: SkillId,
+      relativePath: string,
+      update: { content?: string; isBinary?: boolean },
+    ): Promise<void> => {
+      const deploymentFile = registry.getFileByPath(skillId, relativePath);
+      if (deploymentFile) {
+        if (update.content !== undefined) {
+          deploymentFile.content = update.content;
+        }
+        if (update.isBinary !== undefined) {
+          deploymentFile.isBinary = update.isBinary;
+        }
+        return;
+      }
+      if (base.updateSkillFileContent) {
+        await base.updateSkillFileContent(skillId, relativePath, update);
+      }
+    },
+    updateSkillFileCodeEnvIds: async (
+      updates: Array<{ skillId: SkillId; relativePath: string; codeEnvRef: CodeEnvRef }>,
+    ): Promise<{ matchedCount: number; modifiedCount: number } | void> => {
+      const dbUpdates = registry.updateFileCodeEnvRefs(updates);
+      if (dbUpdates.length === 0) {
+        return { matchedCount: updates.length, modifiedCount: updates.length };
+      }
+      return base.updateSkillFileCodeEnvIds
+        ? base.updateSkillFileCodeEnvIds(dbUpdates)
+        : { matchedCount: 0, modifiedCount: 0 };
+    },
+  };
+  return methods as T & Required<Pick<DeploymentSkillBaseMethods, 'getSkillById'>>;
+}
+
+async function findSkillDirectories(
+  directory: string,
+  projectRoot: string,
+): Promise<LoadedSkillDirectory[]> {
+  const directories: LoadedSkillDirectory[] = [];
+  if (await fileExists(path.join(directory, SKILL_MD))) {
+    directories.push({
+      directory,
+      relativeDirectory: relativeToRoot(projectRoot, directory),
+    });
+  }
+
+  const entries = await fs.promises.readdir(directory, { withFileTypes: true });
+  const childDirectories = entries
+    .filter((entry) => entry.isDirectory())
+    .map((entry) => path.join(directory, entry.name));
+  const childSkillChecks = await Promise.all(
+    childDirectories.map(async (child) =>
+      (await fileExists(path.join(child, SKILL_MD)))
+        ? {
+            directory: child,
+            relativeDirectory: relativeToRoot(projectRoot, child),
+          }
+        : null,
+    ),
+  );
+  for (const child of childSkillChecks) {
+    if (child) {
+      directories.push(child);
+    }
+  }
+  return directories;
+}
+
+async function loadDeploymentSkill(
+  skillDirectory: LoadedSkillDirectory,
+  rootDirectory: string,
+): Promise<DeploymentSkill> {
+  const skillMdPath = path.join(skillDirectory.directory, SKILL_MD);
+  const [content, stat] = await Promise.all([
+    fs.promises.readFile(skillMdPath, 'utf8'),
+    fs.promises.stat(skillMdPath),
+  ]);
+  const parsed = parseFrontmatter(content);
+  const structured = parseStructuredFrontmatter(content);
+  if ('error' in structured) {
+    throw new Error(`${skillDirectory.relativeDirectory}/${SKILL_MD}: ${structured.error}`);
+  }
+  const frontmatter = structured.frontmatter ?? {};
+  const description =
+    typeof frontmatter.description === 'string' ? frontmatter.description : parsed.description;
+  const name = typeof frontmatter.name === 'string' ? frontmatter.name : parsed.name;
+  const issues: ValidationIssue[] = [
+    ...validateSkillName(name),
+    ...validateSkillDescription(description),
+    ...validateSkillBody(content),
+    ...validateSkillFrontmatter(frontmatter),
+  ];
+  if (parsed.invalidBooleans.length > 0) {
+    issues.push(
+      ...parsed.invalidBooleans.map((key) => ({
+        field: `frontmatter.${key}`,
+        code: 'INVALID_TYPE',
+        message: `"${key}" must be a boolean (true or false)`,
+      })),
+    );
+  }
+  const { errors, warnings } = partitionIssues(issues);
+  if (errors.length > 0) {
+    throw new Error(
+      `${skillDirectory.relativeDirectory}/${SKILL_MD}: ${errors
+        .map((issue) => `${issue.field}: ${issue.message}`)
+        .join('; ')}`,
+    );
+  }
+  if (warnings.length > 0) {
+    logger.warn(
+      `[deploymentSkills] ${skillDirectory.relativeDirectory}/${SKILL_MD}: ${warnings
+        .map((issue) => `${issue.field}: ${issue.message}`)
+        .join('; ')}`,
+    );
+  }
+
+  const derived = deriveStructuredFrontmatterFields(frontmatter);
+  const skillId = stableObjectId(`deployment-skill:${name}`);
+  const files = await loadDeploymentSkillFiles({
+    skillId,
+    skillName: name,
+    skillDirectory: skillDirectory.directory,
+    rootDirectory,
+  });
+  return {
+    _id: skillId,
+    name,
+    description,
+    body: content,
+    frontmatter,
+    category: '',
+    author: DEPLOYMENT_AUTHOR_ID,
+    authorName: 'Deployment',
+    version: 1,
+    source: DEPLOYMENT_SKILL_SOURCE,
+    sourceMetadata: {
+      deployment: true,
+      directory: skillDirectory.relativeDirectory,
+    },
+    fileCount: files.length,
+    alwaysApply: parsed.alwaysApply ?? false,
+    isPublic: true,
+    deployment: true,
+    files,
+    createdAt: stat.birthtime,
+    updatedAt: stat.mtime,
+    ...derived,
+  };
+}
+
+async function loadDeploymentSkillFiles({
+  skillId,
+  skillName,
+  skillDirectory,
+  rootDirectory,
+}: {
+  skillId: Types.ObjectId;
+  skillName: string;
+  skillDirectory: string;
+  rootDirectory: string;
+}): Promise<DeploymentSkillFile[]> {
+  const files = await collectSkillFiles(skillDirectory, skillDirectory);
+  const rows = await Promise.all(
+    files.map(async (filePath) => {
+      const relativePath = normalizePath(path.relative(skillDirectory, filePath));
+      const issues = validateRelativePath(relativePath);
+      if (issues.length > 0) {
+        throw new Error(
+          `${relativeToRoot(rootDirectory, filePath)}: ${issues
+            .map((issue) => `${issue.field}: ${issue.message}`)
+            .join('; ')}`,
+        );
+      }
+      const stat = await fs.promises.stat(filePath);
+      const mimeType = guessMimeType(relativePath);
+      const cache = await readCachedFileContent(filePath, stat.size);
+      return {
+        _id: stableObjectId(`deployment-skill-file:${skillName}:${relativePath}`),
+        skillId,
+        relativePath,
+        file_id: stableObjectId(`deployment-skill-file-id:${skillName}:${relativePath}`).toString(),
+        filename: path.basename(relativePath),
+        filepath: filePath,
+        source: DEPLOYMENT_SKILL_FILE_SOURCE,
+        mimeType,
+        bytes: stat.size,
+        category: inferSkillFileCategory(relativePath),
+        isExecutable: false,
+        author: DEPLOYMENT_AUTHOR_ID,
+        createdAt: stat.birthtime,
+        updatedAt: stat.mtime,
+        ...cache,
+      } satisfies DeploymentSkillFile;
+    }),
+  );
+  return rows.sort((a, b) => a.relativePath.localeCompare(b.relativePath));
+}
+
+async function collectSkillFiles(root: string, directory: string): Promise<string[]> {
+  const entries = await fs.promises.readdir(directory, { withFileTypes: true });
+  const results = await Promise.all(
+    entries.map(async (entry) => {
+      const filePath = path.join(directory, entry.name);
+      const relativePath = normalizePath(path.relative(root, filePath));
+      if (relativePath === SKILL_MD) {
+        return [];
+      }
+      if (entry.isSymbolicLink()) {
+        throw new Error(`${relativePath}: symlinks are not allowed in deployment skills`);
+      }
+      if (entry.isDirectory()) {
+        return collectSkillFiles(root, filePath);
+      }
+      if (!entry.isFile()) {
+        return [];
+      }
+      return [filePath];
+    }),
+  );
+  return results.flat();
+}
+
+async function readCachedFileContent(
+  filePath: string,
+  bytes: number,
+): Promise<Pick<DeploymentSkillFile, 'content' | 'isBinary'>> {
+  const file = await fs.promises.open(filePath, 'r');
+  try {
+    const probe = Buffer.alloc(Math.min(bytes, 8192));
+    if (probe.length > 0) {
+      await file.read(probe, 0, probe.length, 0);
+    }
+    if (probe.includes(0)) {
+      return { isBinary: true };
+    }
+  } finally {
+    await file.close();
+  }
+  if (bytes > MAX_CACHED_TEXT_BYTES) {
+    return { isBinary: false };
+  }
+  return {
+    isBinary: false,
+    content: await fs.promises.readFile(filePath, 'utf8'),
+  };
+}
+
+function parseStructuredFrontmatter(
+  content: string,
+): { frontmatter?: Record<string, unknown>; error?: undefined } | { error: string } {
+  const trimmed = content.trim();
+  if (!trimmed.startsWith('---')) {
+    return { frontmatter: {} };
+  }
+  const after = trimmed.slice(3);
+  const closingIdx = after.indexOf('\n---');
+  if (closingIdx === -1) {
+    return { error: `Invalid ${SKILL_MD} frontmatter: missing closing "---".` };
+  }
+  try {
+    const parsed = yaml.load(after.slice(0, closingIdx));
+    if (parsed == null) {
+      return { frontmatter: {} };
+    }
+    if (typeof parsed !== 'object' || Array.isArray(parsed)) {
+      return { error: `${SKILL_MD} frontmatter must be a YAML mapping.` };
+    }
+    return { frontmatter: parsed as Record<string, unknown> };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return { error: `Invalid ${SKILL_MD} frontmatter: ${message}` };
+  }
+}
+
+function validateUniqueNames(skills: DeploymentSkill[]): void {
+  const seen = new Set<string>();
+  for (const skill of skills) {
+    if (seen.has(skill.name)) {
+      throw new Error(`Duplicate deployment skill name "${skill.name}"`);
+    }
+    seen.add(skill.name);
+  }
+}
+
+function mergeSkillPage({
+  dbResult,
+  dbPageBoundary,
+  deploymentRows,
+  limit,
+}: {
+  dbResult: ListSkillsByAccessResult;
+  dbPageBoundary?: Cursor | null;
+  deploymentRows: SkillSummaryRow[];
+  limit: number;
+}): ListSkillsByAccessResult {
+  const boundedLimit = Math.min(Math.max(1, limit || 20), 100);
+  const merged = [...deploymentRows, ...dbResult.skills].sort(compareBySkillCursor);
+  const sliced = merged.slice(0, boundedLimit);
+  const hasMore = merged.length > boundedLimit || dbResult.has_more === true;
+  const cursorRow = getMergedPageCursor(sliced, boundedLimit, dbPageBoundary);
+  return {
+    skills: sliced,
+    has_more: hasMore,
+    after: hasMore && cursorRow ? encodeCursor(cursorRow) : null,
+  };
+}
+
+function mergeAlwaysApplyPage({
+  dbResult,
+  dbPageBoundary,
+  deploymentRows,
+  limit,
+}: {
+  dbResult: ListAlwaysApplyResult;
+  dbPageBoundary?: Cursor | null;
+  deploymentRows: AlwaysApplySkillRow[];
+  limit: number;
+}): ListAlwaysApplyResult {
+  const boundedLimit = Math.min(Math.max(1, limit || 20), 100);
+  const merged = [...deploymentRows, ...dbResult.skills].sort(compareBySkillCursor);
+  const sliced = merged.slice(0, boundedLimit);
+  const hasMore = merged.length > boundedLimit || dbResult.has_more === true;
+  const cursorRow = getMergedPageCursor(sliced, boundedLimit, dbPageBoundary);
+  return {
+    skills: sliced,
+    has_more: hasMore,
+    after: hasMore && cursorRow ? encodeCursor(cursorRow) : null,
+  };
+}
+
+function getMergedPageCursor<T extends Pick<SkillSummaryRow, '_id' | 'updatedAt'>>(
+  sliced: T[],
+  boundedLimit: number,
+  dbPageBoundary?: Cursor | null,
+): Pick<SkillSummaryRow, '_id' | 'updatedAt'> | null {
+  const lastReturned = sliced.length > 0 ? sliced[sliced.length - 1] : null;
+  if (sliced.length < boundedLimit && dbPageBoundary) {
+    return dbPageBoundary;
+  }
+  return lastReturned;
+}
+
+function getDbPageBoundary<T extends Pick<SkillSummaryRow, '_id' | 'updatedAt'>>(dbResult: {
+  skills: T[];
+  has_more?: boolean;
+  after?: string | null;
+}): Cursor | null {
+  if (dbResult.has_more !== true) {
+    return null;
+  }
+  const last = dbResult.skills.length > 0 ? dbResult.skills[dbResult.skills.length - 1] : null;
+  if (last?.updatedAt) {
+    return { _id: last._id, updatedAt: last.updatedAt };
+  }
+  return decodeCursor(dbResult.after);
+}
+
+function limitRowsToDbPageBoundary<T extends Pick<SkillSummaryRow, '_id' | 'updatedAt'>>(
+  rows: T[],
+  dbPageBoundary: Cursor | null,
+): T[] {
+  if (!dbPageBoundary) {
+    return rows;
+  }
+  return rows.filter((row) => compareBySkillCursor(row, dbPageBoundary) <= 0);
+}
+
+function toSkillSummaryRow(skill: DeploymentSkill): SkillSummaryRow {
+  const { body: _body, frontmatter: _frontmatter, files: _files, ...row } = skill;
+  return row;
+}
+
+function toSkillDetailRow(skill: DeploymentSkill): SkillDetailRow {
+  const { files: _files, ...row } = skill;
+  return row;
+}
+
+function toAlwaysApplyRow(skill: DeploymentSkill): AlwaysApplySkillRow {
+  return {
+    _id: skill._id,
+    name: skill.name,
+    body: skill.body,
+    author: skill.author,
+    deployment: true,
+    updatedAt: skill.updatedAt,
+    ...(skill.allowedTools !== undefined ? { allowedTools: skill.allowedTools } : {}),
+  };
+}
+
+function toSkillFileRow(file: DeploymentSkillFile): SkillFileRow {
+  const { codeEnvRef: _codeEnvRef, content: _content, isBinary: _isBinary, ...row } = file;
+  return row;
+}
+
+function toSkillFileContentRow(file: DeploymentSkillFile): SkillFileContentRow {
+  return {
+    ...toSkillFileRow(file),
+    codeEnvRef: file.codeEnvRef,
+    content: file.content,
+    isBinary: file.isBinary,
+  };
+}
+
+function stripDeploymentIds(ids: Types.ObjectId[]): Types.ObjectId[] {
+  return ids.filter((id) => !registry.hasId(id));
+}
+
+function hasAccessibleId(ids: Types.ObjectId[], skillId: Types.ObjectId): boolean {
+  const key = skillId.toString();
+  return ids.some((id) => id.toString() === key);
+}
+
+function filterDeploymentNameCollisions<
+  T extends { name: string } & Pick<SkillSummaryRow, '_id' | 'updatedAt'>,
+>(rows: T[], deploymentNames: Set<string>, context: string): CollisionFilterResult<T> {
+  if (rows.length === 0 || deploymentNames.size === 0) {
+    return { rows };
+  }
+  const hiddenNames = new Set<string>();
+  const filtered = rows.filter((row) => {
+    if (!deploymentNames.has(row.name)) {
+      return true;
+    }
+    hiddenNames.add(row.name);
+    return false;
+  });
+  if (hiddenNames.size > 0) {
+    const unwarnedNames = Array.from(hiddenNames).filter((name) => {
+      const key = `${context}:${name}`;
+      if (warnedDeploymentNameCollisions.has(key)) {
+        return false;
+      }
+      warnedDeploymentNameCollisions.add(key);
+      return true;
+    });
+    if (unwarnedNames.length > 0) {
+      logger.warn(
+        `[deploymentSkills] Hid persisted ${context} skill row(s) shadowed by deployment skill name(s): ${unwarnedNames.join(', ')}`,
+      );
+    }
+  }
+  return { rows: filtered };
+}
+
+function compareBySkillCursor(
+  a: Pick<SkillSummaryRow, '_id' | 'updatedAt'>,
+  b: Pick<SkillSummaryRow, '_id' | 'updatedAt'>,
+): number {
+  const aTime = (a.updatedAt ?? new Date(0)).getTime();
+  const bTime = (b.updatedAt ?? new Date(0)).getTime();
+  if (aTime !== bTime) {
+    return bTime - aTime;
+  }
+  return a._id.toString().localeCompare(b._id.toString());
+}
+
+function isAfterCursor(row: Pick<SkillSummaryRow, '_id' | 'updatedAt'>, cursor: Cursor | null) {
+  if (!cursor) {
+    return true;
+  }
+  const rowTime = (row.updatedAt ?? new Date(0)).getTime();
+  const cursorTime = cursor.updatedAt.getTime();
+  if (rowTime < cursorTime) {
+    return true;
+  }
+  if (rowTime > cursorTime) {
+    return false;
+  }
+  return row._id.toString() > cursor._id.toString();
+}
+
+function decodeCursor(cursor: string | null | undefined): Cursor | null {
+  if (!cursor || cursor === 'undefined' || cursor === 'null') {
+    return null;
+  }
+  try {
+    const decoded = JSON.parse(Buffer.from(cursor, 'base64').toString('utf8')) as {
+      updatedAt?: string;
+      _id?: string;
+    };
+    if (!decoded.updatedAt || !decoded._id || !Types.ObjectId.isValid(decoded._id)) {
+      return null;
+    }
+    const updatedAt = new Date(decoded.updatedAt);
+    if (Number.isNaN(updatedAt.getTime())) {
+      return null;
+    }
+    return { updatedAt, _id: new Types.ObjectId(decoded._id) };
+  } catch {
+    return null;
+  }
+}
+
+function encodeCursor(row: Pick<SkillSummaryRow, '_id' | 'updatedAt'>): string {
+  return Buffer.from(
+    JSON.stringify({
+      updatedAt: (row.updatedAt ?? new Date(0)).toISOString(),
+      _id: row._id.toString(),
+    }),
+  ).toString('base64');
+}
+
+function stableObjectId(seed: string): Types.ObjectId {
+  return new Types.ObjectId(crypto.createHash('sha1').update(seed).digest('hex').slice(0, 24));
+}
+
+async function fileExists(filePath: string): Promise<boolean> {
+  try {
+    const stat = await fs.promises.stat(filePath);
+    return stat.isFile();
+  } catch {
+    return false;
+  }
+}
+
+function normalizePath(value: string): string {
+  return value.split(path.sep).join('/');
+}
+
+function relativeToRoot(root: string, target: string): string {
+  const relative = normalizePath(path.relative(root, target));
+  return relative.length > 0 ? relative : '.';
+}
diff --git a/packages/api/src/skills/handlers.ts b/packages/api/src/skills/handlers.ts
index 41836b66cd2..e2b135c4b0c 100644
--- a/packages/api/src/skills/handlers.ts
+++ b/packages/api/src/skills/handlers.ts
@@ -5,19 +5,6 @@ import {
   PrincipalType,
   PermissionBits,
 } from 'librechat-data-provider';
-import type { Response } from 'express';
-import type { Types } from 'mongoose';
-import type {
-  ISkill,
-  ISkillFile,
-  ISkillSummary,
-  CreateSkillInput,
-  CreateSkillResult,
-  UpdateSkillInput,
-  ListSkillsByAccessResult,
-  UpdateSkillResult,
-  ValidationIssue,
-} from '@librechat/data-schemas';
 import type {
   TSkill,
   TSkillFile,
@@ -31,6 +18,19 @@ import type {
   TSkillConflictResponse,
   TSkillFileContentResponse,
 } from 'librechat-data-provider';
+import type {
+  ISkill,
+  ISkillFile,
+  ISkillSummary,
+  CreateSkillInput,
+  CreateSkillResult,
+  UpdateSkillInput,
+  ListSkillsByAccessResult,
+  UpdateSkillResult,
+  ValidationIssue,
+} from '@librechat/data-schemas';
+import type { Response } from 'express';
+import type { Types } from 'mongoose';
 import type { ServerRequest, StrategyFunctions } from '~/types';
 import { isBinaryBuffer } from './binary';
 
@@ -206,6 +206,7 @@ function serializeSkillFile(file: ISkillFile & { _id: Types.ObjectId }): TSkillF
     storageKey: file.storageKey,
     storageRegion: file.storageRegion,
     source: file.source as TSkillFile['source'],
+    sourceMetadata: file.sourceMetadata as TSkillFile['sourceMetadata'],
     mimeType: file.mimeType,
     bytes: file.bytes,
     category: file.category,
@@ -268,7 +269,16 @@ function parseLimit(raw: unknown): number {
  * deps from `~/models` + `PermissionService`, and wires the returned handlers
  * onto the Express router.
  */
-export function createSkillsHandlers(deps: SkillsHandlersDeps) {
+export function createSkillsHandlers(deps: SkillsHandlersDeps): {
+  list: (req: ServerRequest, res: Response) => Promise<Response>;
+  create: (req: ServerRequest, res: Response) => Promise<Response>;
+  get: (req: ServerRequest, res: Response) => Promise<Response>;
+  patch: (req: ServerRequest, res: Response) => Promise<Response>;
+  delete: (req: ServerRequest, res: Response) => Promise<Response>;
+  listFiles: (req: ServerRequest, res: Response) => Promise<Response>;
+  downloadFile: (req: ServerRequest, res: Response) => Promise<Response | undefined>;
+  deleteFile: (req: ServerRequest, res: Response) => Promise<Response>;
+} {
   const {
     createSkill,
     getSkillById,
diff --git a/packages/api/src/skills/import.ts b/packages/api/src/skills/import.ts
index 013a0219332..c93b0215938 100644
--- a/packages/api/src/skills/import.ts
+++ b/packages/api/src/skills/import.ts
@@ -1,10 +1,8 @@
-import crypto from 'crypto';
 import path from 'path';
 import JSZip from 'jszip';
+import crypto from 'crypto';
+import { logger } from '@librechat/data-schemas';
 import { ResourceType, AccessRoleIds, PrincipalType } from 'librechat-data-provider';
-import { logger, stripYamlTrailingComment } from '@librechat/data-schemas';
-import type { Request, Response } from 'express';
-import type { Types } from 'mongoose';
 import type {
   ISkill,
   ISkillFile,
@@ -12,50 +10,16 @@ import type {
   CreateSkillResult,
   UpsertSkillFileInput,
 } from '@librechat/data-schemas';
+import type { Request, Response } from 'express';
+import type { Types } from 'mongoose';
+import type { ImportLimits } from './limits';
 import { resolveRequestTenantId } from '~/middleware/tenant';
+import { DEFAULT_SKILL_IMPORT_LIMITS } from './limits';
+import { parseSkillMarkdown } from './parse';
 
-/** Security limits for zip processing. */
-const MAX_ZIP_BYTES = 50 * 1024 * 1024; // 50 MB compressed
-const MAX_DECOMPRESSED_BYTES = 500 * 1024 * 1024; // 500 MB total decompressed
-const MAX_ENTRIES = 500;
-const MAX_SINGLE_FILE_BYTES = 10 * 1024 * 1024; // 10 MB per file
 const SKILL_MD = 'SKILL.md';
 
-export interface ImportLimits {
-  maxZipBytes: number;
-  maxDecompressedBytes: number;
-  maxEntries: number;
-  maxSingleFileBytes: number;
-}
-
-/** Strip surrounding YAML quotes (single or double) from a scalar value. */
-function unquoteYaml(value: string): string {
-  if (
-    value.length >= 2 &&
-    ((value[0] === '"' && value[value.length - 1] === '"') ||
-      (value[0] === "'" && value[value.length - 1] === "'"))
-  ) {
-    return value.slice(1, -1);
-  }
-  return value;
-}
-
-/**
- * Parse a YAML scalar as a strict boolean. Returns `undefined` when the
- * value is neither `true` nor `false`. Callers should pre-strip inline
- * comments with `stripYamlTrailingComment` when needed; this helper only
- * normalizes case / whitespace so the call site stays one-purpose.
- */
-function parseBooleanScalar(value: string): boolean | undefined {
-  const lowered = value.trim().toLowerCase();
-  if (lowered === 'true') {
-    return true;
-  }
-  if (lowered === 'false') {
-    return false;
-  }
-  return undefined;
-}
+export type { ImportLimits } from './limits';
 
 /**
  * YAML frontmatter parser — extracts the first-class fields LibreChat
@@ -64,11 +28,12 @@ function parseBooleanScalar(value: string): boolean | undefined {
  * `packages/data-schemas/src/methods/skill.ts` covers the wire contract;
  * this parser only needs to hand `createSkill` the columns it populates.
  *
- * When a known boolean field (currently just `always-apply`) is present
+ * When a known boolean field (currently `always-apply` plus the accepted
+ * `alwaysApply` alias) is present
  * with a value that isn't recognizable as `true`/`false`, the parser
  * records it on `invalidBooleans[]` so the import handler can surface
  * a 400 instead of silently dropping the flag. Without this signal,
- * authoring mistakes like `always-apply: yes` would be lossy-converted
+ * authoring mistakes like `alwaysApply: yes` would be lossy-converted
  * to "not always-applied" and the user would never learn their
  * frontmatter was malformed.
  *
@@ -80,55 +45,40 @@ export function parseFrontmatter(raw: string): {
   alwaysApply?: boolean;
   /** Keys that carried non-boolean values for fields that must be boolean. */
   invalidBooleans: string[];
+  parseError?: string;
 } {
-  const trimmed = raw.trim();
-  if (!trimmed.startsWith('---')) {
-    return { name: '', description: '', invalidBooleans: [] };
+  const parsed = parseSkillMarkdown(raw);
+  const result: {
+    name: string;
+    description: string;
+    alwaysApply?: boolean;
+    invalidBooleans: string[];
+    parseError?: string;
+  } = {
+    name: parsed.name,
+    description: parsed.description,
+    invalidBooleans: parsed.invalidBooleans,
+  };
+  if (parsed.parseError) {
+    result.parseError = parsed.parseError;
   }
-  const after = trimmed.slice(3);
-  const closingIdx = after.indexOf('\n---');
-  if (closingIdx === -1) {
-    return { name: '', description: '', invalidBooleans: [] };
+  if ('alwaysApply' in parsed) {
+    result.alwaysApply = parsed.alwaysApply;
   }
-  const block = after.slice(0, closingIdx);
-  let name = '';
-  let description = '';
-  let alwaysApply: boolean | undefined;
-  const invalidBooleans: string[] = [];
-  for (const line of block.split('\n')) {
-    const colon = line.indexOf(':');
-    if (colon === -1) {
-      continue;
-    }
-    const key = line.slice(0, colon).trim().toLowerCase();
-    const rawValue = line.slice(colon + 1).trim();
-    if (key === 'name') {
-      name = unquoteYaml(rawValue);
-    } else if (key === 'description') {
-      description = unquoteYaml(rawValue);
-    } else if (key === 'always-apply') {
-      // Operate on the raw post-colon text (no outer `unquoteYaml`): a
-      // line like `always-apply: "true" # note` must have its comment
-      // stripped BEFORE unquoting. Running `unquoteYaml` on the whole
-      // line first would miss the quoted branch (the line doesn't end
-      // in a quote once the comment is attached), and unquoting twice
-      // would be fragile if `unquoteYaml` ever gains richer YAML-escape
-      // handling.
-      const stripped = stripYamlTrailingComment(rawValue).trim();
-      if (stripped === '') {
-        // Empty value or comment-only (`always-apply: # TBD`) — treat as
-        // absent so mid-edit placeholder states don't reject the save.
-        continue;
-      }
-      const parsed = parseBooleanScalar(unquoteYaml(stripped));
-      if (parsed === undefined) {
-        invalidBooleans.push(key);
-      } else {
-        alwaysApply = parsed;
-      }
-    }
-  }
-  return { name, description, alwaysApply, invalidBooleans };
+  return result;
+}
+
+function sendFrontmatterParseError(res: Response, parseError: string) {
+  return res.status(400).json({
+    error: 'Validation failed',
+    issues: [
+      {
+        field: 'frontmatter',
+        code: 'INVALID_YAML',
+        message: `Invalid YAML frontmatter: ${parseError}`,
+      },
+    ],
+  });
 }
 
 /** Validates a relative path is safe (no traversal, no absolute paths). */
@@ -214,7 +164,7 @@ interface ServerRequest extends Request {
  * Grants SKILL_OWNER to the uploader.
  */
 export function createImportHandler(deps: ImportSkillDeps) {
-  return async function importSkillHandler(req: ServerRequest, res: Response) {
+  return async function importSkillHandler(req: ServerRequest, res: Response): Promise<Response> {
     const { file } = req;
     if (!file) {
       return res.status(400).json({ error: 'No file provided' });
@@ -250,10 +200,12 @@ export function createImportHandler(deps: ImportSkillDeps) {
 
 function getImportLimits(limits?: Partial<ImportLimits>): ImportLimits {
   return {
-    maxZipBytes: limits?.maxZipBytes ?? MAX_ZIP_BYTES,
-    maxDecompressedBytes: limits?.maxDecompressedBytes ?? MAX_DECOMPRESSED_BYTES,
-    maxEntries: limits?.maxEntries ?? MAX_ENTRIES,
-    maxSingleFileBytes: limits?.maxSingleFileBytes ?? MAX_SINGLE_FILE_BYTES,
+    maxZipBytes: limits?.maxZipBytes ?? DEFAULT_SKILL_IMPORT_LIMITS.maxZipBytes,
+    maxDecompressedBytes:
+      limits?.maxDecompressedBytes ?? DEFAULT_SKILL_IMPORT_LIMITS.maxDecompressedBytes,
+    maxEntries: limits?.maxEntries ?? DEFAULT_SKILL_IMPORT_LIMITS.maxEntries,
+    maxSingleFileBytes:
+      limits?.maxSingleFileBytes ?? DEFAULT_SKILL_IMPORT_LIMITS.maxSingleFileBytes,
   };
 }
 
@@ -308,7 +260,10 @@ async function handleMarkdown(
 ) {
   const content = file.buffer.toString('utf-8');
 
-  const { name, description, alwaysApply, invalidBooleans } = parseFrontmatter(content);
+  const { name, description, alwaysApply, invalidBooleans, parseError } = parseFrontmatter(content);
+  if (parseError) {
+    return sendFrontmatterParseError(res, parseError);
+  }
   if (invalidBooleans.length > 0) {
     return res.status(400).json({
       error: 'Validation failed',
@@ -419,7 +374,11 @@ async function handleZip(
     return res.status(400).json({ error: 'SKILL.md exceeds maximum file size' });
   }
 
-  const { name, description, alwaysApply, invalidBooleans } = parseFrontmatter(skillMdContent);
+  const { name, description, alwaysApply, invalidBooleans, parseError } =
+    parseFrontmatter(skillMdContent);
+  if (parseError) {
+    return sendFrontmatterParseError(res, parseError);
+  }
   if (invalidBooleans.length > 0) {
     return res.status(400).json({
       error: 'Validation failed',
@@ -662,6 +621,6 @@ const MIME_MAP: Record<string, string> = {
   '.pdf': 'application/pdf',
 };
 
-function guessMimeType(filename: string): string {
+export function guessMimeType(filename: string): string {
   return MIME_MAP[path.extname(filename).toLowerCase()] || 'application/octet-stream';
 }
diff --git a/packages/api/src/skills/index.ts b/packages/api/src/skills/index.ts
index 5d32c38cbe0..5669d6586bd 100644
--- a/packages/api/src/skills/index.ts
+++ b/packages/api/src/skills/index.ts
@@ -1,4 +1,8 @@
 export * from './binary';
 export * from './handlers';
 export * from './import';
+export * from './limits';
+export * from './parse';
 export * from './skillStates';
+export * from './deployment';
+export * from './sync';
diff --git a/packages/api/src/skills/limits.ts b/packages/api/src/skills/limits.ts
new file mode 100644
index 00000000000..0d7624485a1
--- /dev/null
+++ b/packages/api/src/skills/limits.ts
@@ -0,0 +1,13 @@
+export type ImportLimits = {
+  maxZipBytes: number;
+  maxDecompressedBytes: number;
+  maxEntries: number;
+  maxSingleFileBytes: number;
+};
+
+export const DEFAULT_SKILL_IMPORT_LIMITS: ImportLimits = {
+  maxZipBytes: 50 * 1024 * 1024,
+  maxDecompressedBytes: 500 * 1024 * 1024,
+  maxEntries: 500,
+  maxSingleFileBytes: 10 * 1024 * 1024,
+};
diff --git a/packages/api/src/skills/parse.ts b/packages/api/src/skills/parse.ts
new file mode 100644
index 00000000000..041e87ed5e3
--- /dev/null
+++ b/packages/api/src/skills/parse.ts
@@ -0,0 +1,160 @@
+import yaml from 'js-yaml';
+
+export type ParsedSkillMarkdown = {
+  name: string;
+  description: string;
+  alwaysApply?: boolean;
+  frontmatter?: Record<string, unknown>;
+  invalidBooleans: string[];
+  parseError?: string;
+};
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+function extractFrontmatterBlock(raw: string): string | null {
+  const normalized = raw.replace(/^\uFEFF/, '').replace(/\r\n/g, '\n');
+  const firstContentIndex = normalized.search(/\S/);
+  if (firstContentIndex === -1) {
+    return null;
+  }
+  const content = normalized.slice(firstContentIndex);
+  const opening = /^---[ \t]*\n/.exec(content);
+  if (!opening) {
+    return null;
+  }
+  const body = content.slice(opening[0].length);
+  const closingFence = /(?:^|\n)---[ \t]*(?:\n|$)/.exec(body);
+  if (!closingFence) {
+    return null;
+  }
+  return body.slice(0, closingFence.index);
+}
+
+function getCaseInsensitive(frontmatter: Record<string, unknown>, key: string): unknown {
+  const entry = Object.entries(frontmatter).find(([candidate]) => candidate.toLowerCase() === key);
+  return entry?.[1];
+}
+
+function hasCaseInsensitive(frontmatter: Record<string, unknown>, key: string): boolean {
+  return Object.keys(frontmatter).some((candidate) => candidate.toLowerCase() === key);
+}
+
+function getRawFrontmatterValue(block: string, key: string): string | undefined {
+  const escapedKey = key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const pattern = new RegExp(`^\\s*${escapedKey}\\s*:\\s*(.*)$`, 'i');
+  const line = block.split('\n').find((candidate) => pattern.test(candidate));
+  const match = line?.match(pattern);
+  return match?.[1];
+}
+
+function stripInlineComment(value: string): string {
+  let quote: '"' | "'" | null = null;
+  for (let i = 0; i < value.length; i++) {
+    const char = value[i];
+    if ((char === '"' || char === "'") && (!quote || quote === char)) {
+      quote = quote ? null : char;
+      continue;
+    }
+    if (char === '#' && !quote) {
+      return value.slice(0, i).trim();
+    }
+  }
+  return value.trim();
+}
+
+function normalizeFrontmatterKeys(frontmatter: Record<string, unknown>): Record<string, unknown> {
+  return Object.entries(frontmatter).reduce<Record<string, unknown>>((acc, [key, value]) => {
+    const normalizedKey = key.toLowerCase();
+    acc[normalizedKey === 'alwaysapply' ? 'alwaysApply' : normalizedKey] = value;
+    return acc;
+  }, {});
+}
+
+function parseBoolean(value: unknown, rawValue?: string): boolean | undefined {
+  const raw = rawValue === undefined ? undefined : stripInlineComment(rawValue).toLowerCase();
+  if (typeof value === 'boolean') {
+    return raw === 'true' || raw === 'false' ? value : undefined;
+  }
+  if (typeof value !== 'string') {
+    return undefined;
+  }
+  const lowered = value.trim().toLowerCase();
+  if (lowered === 'true') {
+    return true;
+  }
+  if (lowered === 'false') {
+    return false;
+  }
+  return undefined;
+}
+
+function hasBooleanPlaceholder(rawValue?: string): boolean {
+  return rawValue !== undefined && stripInlineComment(rawValue).length === 0;
+}
+
+function toScalarString(value: unknown): string {
+  if (typeof value === 'string') {
+    return value;
+  }
+  if (typeof value === 'number' || typeof value === 'boolean') {
+    return String(value);
+  }
+  return '';
+}
+
+export function parseSkillMarkdown(raw: string): ParsedSkillMarkdown {
+  const block = extractFrontmatterBlock(raw);
+  if (!block) {
+    return { name: '', description: '', invalidBooleans: [] };
+  }
+  let parsed: unknown;
+  try {
+    parsed = yaml.load(block);
+  } catch (error) {
+    return {
+      name: '',
+      description: '',
+      invalidBooleans: [],
+      parseError: error instanceof Error ? error.message : 'Invalid YAML frontmatter',
+    };
+  }
+  const frontmatter = isPlainObject(parsed) ? normalizeFrontmatterKeys(parsed) : {};
+  const nameValue = getCaseInsensitive(frontmatter, 'name');
+  const descriptionValue = getCaseInsensitive(frontmatter, 'description');
+  const whenToUseValue = getCaseInsensitive(frontmatter, 'when-to-use');
+  const hasCanonicalAlwaysApply = hasCaseInsensitive(frontmatter, 'always-apply');
+  const hasAliasAlwaysApply = hasCaseInsensitive(frontmatter, 'alwaysapply');
+  const canonicalAlwaysApplyValue = getCaseInsensitive(frontmatter, 'always-apply');
+  const aliasAlwaysApplyValue = getCaseInsensitive(frontmatter, 'alwaysapply');
+  const rawCanonicalAlwaysApplyValue = getRawFrontmatterValue(block, 'always-apply');
+  const rawAliasAlwaysApplyValue = getRawFrontmatterValue(block, 'alwaysApply');
+  const name = toScalarString(nameValue);
+  let description = '';
+  if (descriptionValue !== undefined) {
+    description = toScalarString(descriptionValue);
+  } else if (whenToUseValue !== undefined) {
+    description = toScalarString(whenToUseValue);
+  }
+  let alwaysApply: boolean | undefined;
+  const invalidBooleans: string[] = [];
+  if (hasCanonicalAlwaysApply) {
+    alwaysApply = parseBoolean(canonicalAlwaysApplyValue, rawCanonicalAlwaysApplyValue);
+    if (alwaysApply === undefined && !hasBooleanPlaceholder(rawCanonicalAlwaysApplyValue)) {
+      invalidBooleans.push('always-apply');
+    }
+  } else if (hasAliasAlwaysApply) {
+    alwaysApply = parseBoolean(aliasAlwaysApplyValue, rawAliasAlwaysApplyValue);
+    if (alwaysApply === undefined && !hasBooleanPlaceholder(rawAliasAlwaysApplyValue)) {
+      invalidBooleans.push('alwaysApply');
+    }
+  }
+  return {
+    name,
+    description,
+    alwaysApply,
+    frontmatter,
+    invalidBooleans,
+  };
+}
diff --git a/packages/api/src/skills/skillStates.ts b/packages/api/src/skills/skillStates.ts
index 902debaced4..f04ecd66982 100644
--- a/packages/api/src/skills/skillStates.ts
+++ b/packages/api/src/skills/skillStates.ts
@@ -9,7 +9,7 @@ export const MAX_KEY_LENGTH = 64;
  * Generous upper bound on raw payload size to reject abusive inputs before
  * we spend cycles validating or querying the DB for orphan cleanup.
  */
-export const MAX_RAW_PAYLOAD = MAX_SKILL_STATES * 2;
+export const MAX_RAW_PAYLOAD: number = MAX_SKILL_STATES * 2;
 
 /** Map of skillId → explicit active state override. */
 export type SkillStatesRecord = Record<string, boolean>;
diff --git a/packages/api/src/skills/sync/github.spec.ts b/packages/api/src/skills/sync/github.spec.ts
new file mode 100644
index 00000000000..d0c8e946a6d
--- /dev/null
+++ b/packages/api/src/skills/sync/github.spec.ts
@@ -0,0 +1,2271 @@
+import crypto from 'crypto';
+import { Types } from 'mongoose';
+import { getTenantId } from '@librechat/data-schemas';
+import type {
+  ISkill,
+  ISkillFile,
+  CreateSkillInput,
+  CreateSkillResult,
+  ISkillSyncStatus,
+  SkillSyncStatusInput,
+  UpdateSkillInput,
+  UpdateSkillResult,
+} from '@librechat/data-schemas';
+import type { GitHubSkillSyncDeps } from './github';
+import { DEFAULT_SKILL_IMPORT_LIMITS } from '../limits';
+import { createGitHubSkillSyncRunner } from './github';
+
+function response(body: unknown, status = 200, headers: Record<string, string> = {}): Response {
+  const normalizedHeaders = new Map(
+    Object.entries(headers).map(([key, value]) => [key.toLowerCase(), value]),
+  );
+  return {
+    ok: status >= 200 && status < 300,
+    status,
+    headers: {
+      get: (key: string) => normalizedHeaders.get(key.toLowerCase()) ?? null,
+    },
+    json: async () => body,
+  } as unknown as Response;
+}
+
+function blob(content: string) {
+  return {
+    sha: 'blob-sha',
+    encoding: 'base64',
+    size: Buffer.byteLength(content),
+    content: Buffer.from(content).toString('base64'),
+  };
+}
+
+function githubFetch(
+  skillMarkdown = '---\nname: research\ndescription: Research things\nalways-apply: true\n---\nBody',
+): typeof fetch {
+  return jest.fn(async (input: RequestInfo | URL) => {
+    const url = input.toString();
+    if (url.includes('/commits/')) {
+      return response({ sha: 'commit-sha', commit: { tree: { sha: 'tree-sha' } } });
+    }
+    if (url.includes('/git/trees/tree-sha')) {
+      return response({
+        sha: 'tree-sha',
+        truncated: false,
+        tree: [
+          {
+            path: 'skills',
+            mode: '040000',
+            type: 'tree',
+            sha: 'skills-tree-sha',
+            url: 'https://api.github.test/tree/skills',
+          },
+        ],
+      });
+    }
+    if (url.includes('/git/trees/skills-tree-sha')) {
+      return response({
+        sha: 'skills-tree-sha',
+        truncated: false,
+        tree: [
+          {
+            path: 'research/SKILL.md',
+            mode: '100644',
+            type: 'blob',
+            sha: 'skill-md-sha',
+            size: Buffer.byteLength(skillMarkdown),
+            url: 'https://api.github.test/blob/skill',
+          },
+          {
+            path: 'research/scripts/run.sh',
+            mode: '100644',
+            type: 'blob',
+            sha: 'file-sha',
+            size: 7,
+            url: 'https://api.github.test/blob/file',
+          },
+        ],
+      });
+    }
+    if (url.includes('/git/blobs/skill-md-sha')) {
+      return response(blob(skillMarkdown));
+    }
+    if (url.includes('/git/blobs/file-sha')) {
+      return response(blob('echo ok'));
+    }
+    return response({ message: 'not found' }, 404);
+  }) as unknown as typeof fetch;
+}
+
+function makeSkill(input: CreateSkillInput): ISkill & { _id: Types.ObjectId } {
+  return {
+    _id: new Types.ObjectId(),
+    name: input.name,
+    description: input.description,
+    body: input.body ?? '',
+    frontmatter: input.frontmatter ?? {},
+    author: input.author,
+    authorName: input.authorName,
+    version: 1,
+    source: input.source ?? 'inline',
+    sourceMetadata: input.sourceMetadata,
+    fileCount: 0,
+    alwaysApply: input.alwaysApply ?? false,
+    tenantId: input.tenantId,
+  };
+}
+
+function makeSkillFile(
+  skill: ISkill & { _id: Types.ObjectId },
+  overrides: Partial<ISkillFile> = {},
+): ISkillFile & { _id: Types.ObjectId } {
+  return {
+    _id: new Types.ObjectId(),
+    skillId: skill._id,
+    relativePath: 'scripts/run.sh',
+    file_id: 'old-file-id',
+    filename: 'run.sh',
+    filepath: '/uploads/old-file-id__run.sh',
+    source: 'local',
+    sourceMetadata: {
+      provider: 'github',
+      sourceId: 'librechat-skills',
+      upstreamId: 'librechat-skills:skills/research',
+      commitSha: 'old-commit-sha',
+      blobSha: 'old-file-sha',
+      path: 'skills/research/scripts/run.sh',
+    },
+    mimeType: 'application/x-sh',
+    bytes: 7,
+    category: 'script',
+    isExecutable: false,
+    author: skill.author,
+    ...overrides,
+  };
+}
+
+function makeSourceAuthorId(sourceId = 'librechat-skills', tenantId?: string): Types.ObjectId {
+  const seed = tenantId ? `github:${sourceId}:${tenantId}` : `github:${sourceId}`;
+  return new Types.ObjectId(crypto.createHash('sha256').update(seed).digest('hex').slice(0, 24));
+}
+
+function createDeps(
+  overrides: Partial<GitHubSkillSyncDeps> = {},
+): GitHubSkillSyncDeps & { statuses: ISkillSyncStatus[] } {
+  const statuses: ISkillSyncStatus[] = [];
+  const deps: GitHubSkillSyncDeps & { statuses: ISkillSyncStatus[] } = {
+    statuses,
+    getConfig: () => ({
+      github: {
+        enabled: true,
+        intervalMinutes: 60,
+        runOnStartup: false,
+        sources: [
+          {
+            id: 'librechat-skills',
+            owner: 'LibreChat',
+            repo: 'skills',
+            ref: 'main',
+            paths: ['skills'],
+            credentialKey: 'github-skills-prod',
+          },
+        ],
+      },
+    }),
+    getCredentialToken: jest.fn(async () => 'github_pat_secret'),
+    getCredentialSummary: jest.fn(async () => ({
+      provider: 'github' as const,
+      credentialKey: 'github-skills-prod',
+      credentialPresent: true,
+      tokenFingerprint: 'abc123',
+    })),
+    listCredentials: jest.fn(async () => []),
+    listStatuses: jest.fn(async () => statuses),
+    upsertStatus: jest.fn(async (input: SkillSyncStatusInput) => {
+      const status: ISkillSyncStatus = {
+        provider: input.provider,
+        sourceId: input.sourceId,
+        tenantId: input.tenantId,
+        status: input.status,
+        credentialKey: input.credentialKey,
+        owner: input.owner,
+        repo: input.repo,
+        ref: input.ref,
+        paths: input.paths,
+        startedAt: input.startedAt,
+        finishedAt: input.finishedAt,
+        lastSuccessAt: input.status === 'succeeded' ? input.finishedAt : undefined,
+        lastFailureAt: input.status === 'failed' ? input.finishedAt : undefined,
+        errorCode: input.errorCode,
+        errorMessage: input.errorMessage,
+        syncedSkillCount: input.syncedSkillCount ?? 0,
+        syncedFileCount: input.syncedFileCount ?? 0,
+        deletedSkillCount: input.deletedSkillCount ?? 0,
+        deletedFileCount: input.deletedFileCount ?? 0,
+      };
+      statuses.push(status);
+      return status;
+    }),
+    tryAcquireLock: jest.fn(async () => true),
+    refreshLock: jest.fn(async () => true),
+    releaseLock: jest.fn(async () => undefined),
+    createSkill: jest.fn(async (input: CreateSkillInput): Promise<CreateSkillResult> => {
+      return { skill: makeSkill(input), warnings: [] };
+    }),
+    updateSkill: jest.fn(),
+    getSkillById: jest.fn(),
+    findSkillBySourceIdentity: jest.fn(async () => null),
+    listSkillsBySource: jest.fn(async () => []),
+    listSkillFiles: jest.fn(async () => []),
+    getSkillFileByPath: jest.fn(async () => null),
+    upsertSkillFile: jest.fn(async () => {
+      return {
+        _id: new Types.ObjectId(),
+        skillId: new Types.ObjectId(),
+        relativePath: 'scripts/run.sh',
+        file_id: 'file-id',
+        filename: 'run.sh',
+        filepath: '/uploads/file-id__run.sh',
+        source: 'local',
+        mimeType: 'application/x-sh',
+        bytes: 7,
+        category: 'script',
+        isExecutable: false,
+        author: new Types.ObjectId(),
+      } as ISkillFile & { _id: Types.ObjectId };
+    }),
+    deleteSkillFile: jest.fn(async () => ({ deleted: true })),
+    deleteSkill: jest.fn(async () => ({ deleted: true })),
+    saveBuffer: jest.fn(async () => ({ filepath: '/uploads/file-id__run.sh', source: 'local' })),
+    deleteFile: jest.fn(async () => undefined),
+    grantPermission: jest.fn(async () => undefined),
+    fetchFn: githubFetch(),
+    ...overrides,
+  };
+  return deps;
+}
+
+describe('createGitHubSkillSyncRunner', () => {
+  it('creates a GitHub skill and syncs bundled files from a configured path', async () => {
+    const deps = createDeps();
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+    const fetchedUrls = (deps.fetchFn as unknown as jest.Mock).mock.calls.map(
+      ([input]: [RequestInfo | URL]) => input.toString(),
+    );
+
+    expect(result.status).toBe('completed');
+    expect(fetchedUrls.some((url) => url.includes('/git/trees/tree-sha?recursive=1'))).toBe(false);
+    expect(fetchedUrls.some((url) => url.includes('/git/trees/skills-tree-sha?recursive=1'))).toBe(
+      true,
+    );
+    expect(deps.createSkill).toHaveBeenCalledWith(
+      expect.objectContaining({
+        name: 'research',
+        description: 'Research things',
+        body: expect.stringContaining('Body'),
+        alwaysApply: true,
+        source: 'github',
+        sourceMetadata: expect.objectContaining({
+          provider: 'github',
+          sourceId: 'librechat-skills',
+          upstreamId: 'librechat-skills:skills/research',
+          skillBlobSha: 'skill-md-sha',
+        }),
+      }),
+    );
+    expect(deps.upsertSkillFile).toHaveBeenCalledWith(
+      expect.objectContaining({
+        relativePath: 'scripts/run.sh',
+        sourceMetadata: expect.objectContaining({
+          upstreamId: 'librechat-skills:skills/research',
+          blobSha: 'file-sha',
+          commitSha: 'commit-sha',
+        }),
+      }),
+    );
+    expect(deps.grantPermission).toHaveBeenCalledWith(
+      expect.objectContaining({
+        principalType: 'public',
+        accessRoleId: 'skill_viewer',
+      }),
+    );
+  });
+
+  it('drops an invalid alwaysApply alias when canonical always-apply is valid', async () => {
+    const deps = createDeps({
+      fetchFn: githubFetch(
+        '---\nname: research\ndescription: Research things\nalways-apply: true\nalwaysApply: yes\n---\nBody',
+      ),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('completed');
+    expect(deps.createSkill).toHaveBeenCalledWith(
+      expect.objectContaining({
+        alwaysApply: true,
+        frontmatter: { 'always-apply': true },
+      }),
+    );
+  });
+
+  it('fails duplicate discovered skill names before publishing partial mirrors', async () => {
+    const duplicateFetch = jest.fn(async (input: RequestInfo | URL) => {
+      const url = input.toString();
+      if (url.includes('/commits/')) {
+        return response({ sha: 'commit-sha', commit: { tree: { sha: 'tree-sha' } } });
+      }
+      if (url.includes('/git/trees/tree-sha')) {
+        return response({
+          sha: 'tree-sha',
+          truncated: false,
+          tree: [
+            {
+              path: 'skills',
+              mode: '040000',
+              type: 'tree',
+              sha: 'skills-tree-sha',
+              url: 'https://api.github.test/tree/skills',
+            },
+          ],
+        });
+      }
+      if (url.includes('/git/trees/skills-tree-sha')) {
+        return response({
+          sha: 'skills-tree-sha',
+          truncated: false,
+          tree: [
+            {
+              path: 'research/SKILL.md',
+              mode: '100644',
+              type: 'blob',
+              sha: 'skill-a-sha',
+              size: 50,
+              url: 'https://api.github.test/blob/skill-a',
+            },
+            {
+              path: 'analysis/SKILL.md',
+              mode: '100644',
+              type: 'blob',
+              sha: 'skill-b-sha',
+              size: 50,
+              url: 'https://api.github.test/blob/skill-b',
+            },
+          ],
+        });
+      }
+      if (url.includes('/git/blobs/skill-a-sha')) {
+        return response(blob('---\nname: duplicate\ndescription: First\n---\nBody'));
+      }
+      if (url.includes('/git/blobs/skill-b-sha')) {
+        return response(blob('---\nname: duplicate\ndescription: Second\n---\nBody'));
+      }
+      return response({ message: 'not found' }, 404);
+    }) as unknown as typeof fetch;
+    const deps = createDeps({ fetchFn: duplicateFetch });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('failed');
+    expect(deps.createSkill).not.toHaveBeenCalled();
+    expect(deps.updateSkill).not.toHaveBeenCalled();
+    expect(deps.upsertStatus).toHaveBeenLastCalledWith(
+      expect.objectContaining({
+        status: 'failed',
+        errorCode: 'DUPLICATE_SKILL_NAME',
+        errorMessage: 'GitHub source "librechat-skills" contains multiple skills named "duplicate"',
+      }),
+    );
+  });
+
+  it('fails duplicate root and nested skill names before publishing partial mirrors', async () => {
+    const duplicateFetch = jest.fn(async (input: RequestInfo | URL) => {
+      const url = input.toString();
+      if (url.includes('/commits/')) {
+        return response({ sha: 'commit-sha', commit: { tree: { sha: 'tree-sha' } } });
+      }
+      if (url.includes('/git/trees/tree-sha')) {
+        return response({
+          sha: 'tree-sha',
+          truncated: false,
+          tree: [
+            {
+              path: 'SKILL.md',
+              mode: '100644',
+              type: 'blob',
+              sha: 'root-skill-sha',
+              size: 50,
+              url: 'https://api.github.test/blob/root-skill',
+            },
+            {
+              path: 'child/SKILL.md',
+              mode: '100644',
+              type: 'blob',
+              sha: 'child-skill-sha',
+              size: 50,
+              url: 'https://api.github.test/blob/child-skill',
+            },
+          ],
+        });
+      }
+      if (url.includes('/git/blobs/root-skill-sha')) {
+        return response(blob('---\nname: duplicate\ndescription: Root\n---\nBody'));
+      }
+      if (url.includes('/git/blobs/child-skill-sha')) {
+        return response(blob('---\nname: duplicate\ndescription: Child\n---\nBody'));
+      }
+      return response({ message: 'not found' }, 404);
+    }) as unknown as typeof fetch;
+    const deps = createDeps({
+      fetchFn: duplicateFetch,
+      getConfig: () => ({
+        github: {
+          enabled: true,
+          intervalMinutes: 60,
+          runOnStartup: false,
+          sources: [
+            {
+              id: 'librechat-skills',
+              owner: 'LibreChat',
+              repo: 'skills',
+              ref: 'main',
+              paths: [''],
+              credentialKey: 'github-skills-prod',
+            },
+          ],
+        },
+      }),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('failed');
+    expect(deps.createSkill).not.toHaveBeenCalled();
+    expect(deps.updateSkill).not.toHaveBeenCalled();
+    expect(deps.upsertStatus).toHaveBeenLastCalledWith(
+      expect.objectContaining({
+        status: 'failed',
+        errorCode: 'DUPLICATE_SKILL_NAME',
+        errorMessage: 'GitHub source "librechat-skills" contains multiple skills named "duplicate"',
+      }),
+    );
+  });
+
+  it('discovers nested skill roots within the configured discovery depth', async () => {
+    const skillMarkdown = '---\nname: tdd\ndescription: Test-driven development\n---\nBody';
+    const fetchFn = jest.fn(async (input: RequestInfo | URL) => {
+      const url = input.toString();
+      if (url.includes('/commits/')) {
+        return response({ sha: 'commit-sha', commit: { tree: { sha: 'tree-sha' } } });
+      }
+      if (url.includes('/git/trees/tree-sha')) {
+        return response({
+          sha: 'tree-sha',
+          truncated: false,
+          tree: [
+            {
+              path: 'skills',
+              mode: '040000',
+              type: 'tree',
+              sha: 'skills-tree-sha',
+              url: 'https://api.github.test/tree/skills',
+            },
+          ],
+        });
+      }
+      if (url.includes('/git/trees/skills-tree-sha')) {
+        return response({
+          sha: 'skills-tree-sha',
+          truncated: false,
+          tree: [
+            {
+              path: 'engineering/tdd/SKILL.md',
+              mode: '100644',
+              type: 'blob',
+              sha: 'skill-md-sha',
+              size: Buffer.byteLength(skillMarkdown),
+              url: 'https://api.github.test/blob/skill',
+            },
+            {
+              path: 'engineering/tdd/tests.md',
+              mode: '100644',
+              type: 'blob',
+              sha: 'tests-md-sha',
+              size: 5,
+              url: 'https://api.github.test/blob/tests',
+            },
+          ],
+        });
+      }
+      if (url.includes('/git/blobs/skill-md-sha')) {
+        return response(blob(skillMarkdown));
+      }
+      if (url.includes('/git/blobs/tests-md-sha')) {
+        return response(blob('tests'));
+      }
+      return response({ message: 'not found' }, 404);
+    }) as unknown as typeof fetch;
+    const deps = createDeps({
+      fetchFn,
+      getConfig: () => ({
+        github: {
+          enabled: true,
+          intervalMinutes: 60,
+          runOnStartup: false,
+          sources: [
+            {
+              id: 'mattpocock-skills',
+              owner: 'mattpocock',
+              repo: 'skills',
+              ref: 'main',
+              paths: ['skills'],
+              skillDiscoveryDepth: 2,
+              credentialKey: 'github-skills-prod',
+            },
+          ],
+        },
+      }),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('completed');
+    expect(deps.createSkill).toHaveBeenCalledWith(
+      expect.objectContaining({
+        name: 'tdd',
+        sourceMetadata: expect.objectContaining({
+          sourceId: 'mattpocock-skills',
+          upstreamId: 'mattpocock-skills:skills/engineering/tdd',
+        }),
+      }),
+    );
+    expect(deps.upsertSkillFile).toHaveBeenCalledWith(
+      expect.objectContaining({
+        relativePath: 'tests.md',
+        sourceMetadata: expect.objectContaining({
+          path: 'skills/engineering/tdd/tests.md',
+        }),
+      }),
+    );
+  });
+
+  it('uses an env-backed source token without loading a stored credential', async () => {
+    const previousToken = process.env.GITHUB_SKILLS_TOKEN;
+    process.env.GITHUB_SKILLS_TOKEN = 'github_pat_from_env';
+    const getCredentialToken = jest.fn(async () => 'github_pat_from_db');
+    const deps = createDeps({
+      getCredentialToken,
+      getConfig: () => ({
+        github: {
+          enabled: true,
+          intervalMinutes: 60,
+          runOnStartup: false,
+          sources: [
+            {
+              id: 'librechat-skills',
+              owner: 'LibreChat',
+              repo: 'skills',
+              ref: 'main',
+              paths: ['skills'],
+              token: '${GITHUB_SKILLS_TOKEN}',
+            },
+          ],
+        },
+      }),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+
+    try {
+      const status = await runner.getStatus();
+      const result = await runner.runOnce();
+
+      expect(status.sources[0]?.credentialPresent).toBe(true);
+      expect(result.status).toBe('completed');
+      expect(getCredentialToken).not.toHaveBeenCalled();
+      expect(deps.createSkill).toHaveBeenCalledWith(
+        expect.objectContaining({
+          sourceMetadata: expect.objectContaining({ sourceId: 'librechat-skills' }),
+        }),
+      );
+    } finally {
+      if (previousToken == null) {
+        delete process.env.GITHUB_SKILLS_TOKEN;
+      } else {
+        process.env.GITHUB_SKILLS_TOKEN = previousToken;
+      }
+    }
+  });
+
+  it('does not list or resolve server credentials and skips runs when they are disabled', async () => {
+    const previousToken = process.env.GITHUB_SKILLS_TOKEN;
+    process.env.GITHUB_SKILLS_TOKEN = 'github_pat_from_env';
+    const getCredentialToken = jest.fn(async () => 'github_pat_from_db');
+    const listCredentials = jest.fn(async () => [
+      {
+        provider: 'github' as const,
+        credentialKey: 'github-skills-prod',
+        credentialPresent: true,
+        tokenFingerprint: 'abc123',
+      },
+    ]);
+    const deps = createDeps({
+      allowServerCredentials: false,
+      getCredentialToken,
+      listCredentials,
+      getConfig: () => ({
+        github: {
+          enabled: true,
+          intervalMinutes: 60,
+          runOnStartup: false,
+          sources: [
+            {
+              id: 'librechat-skills',
+              owner: 'LibreChat',
+              repo: 'skills',
+              ref: 'main',
+              paths: ['skills'],
+              token: '${GITHUB_SKILLS_TOKEN}',
+            },
+            {
+              id: 'stored-credential-skills',
+              owner: 'LibreChat',
+              repo: 'skills',
+              ref: 'main',
+              paths: ['skills'],
+              credentialKey: 'github-skills-prod',
+            },
+          ],
+        },
+      }),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+
+    try {
+      const status = await runner.getStatus();
+      const result = await runner.runOnce();
+
+      expect(status.credentials).toEqual([]);
+      expect(status.sources).toEqual([
+        expect.objectContaining({ sourceId: 'librechat-skills', credentialPresent: false }),
+        expect.objectContaining({
+          sourceId: 'stored-credential-skills',
+          credentialPresent: false,
+        }),
+      ]);
+      expect(result.status).toBe('skipped');
+      expect(result.message).toBe(
+        'GitHub skill sync credentials are not available for this runner',
+      );
+      expect(result.sources).toEqual([
+        expect.objectContaining({ sourceId: 'librechat-skills', credentialPresent: false }),
+        expect.objectContaining({
+          sourceId: 'stored-credential-skills',
+          credentialPresent: false,
+        }),
+      ]);
+      expect(listCredentials).not.toHaveBeenCalled();
+      expect(getCredentialToken).not.toHaveBeenCalled();
+      expect(deps.fetchFn).not.toHaveBeenCalled();
+      expect(deps.tryAcquireLock).not.toHaveBeenCalled();
+      expect(deps.upsertStatus).not.toHaveBeenCalled();
+    } finally {
+      if (previousToken == null) {
+        delete process.env.GITHUB_SKILLS_TOKEN;
+      } else {
+        process.env.GITHUB_SKILLS_TOKEN = previousToken;
+      }
+    }
+  });
+
+  it('preserves slash-delimited refs when fetching the GitHub commit', async () => {
+    const baseFetch = githubFetch();
+    const fetchFn = jest.fn(async (input: RequestInfo | URL) => {
+      const url = input.toString();
+      if (url.includes('/commits/')) {
+        expect(url).toContain('/commits/heads/release/2026-05');
+        expect(url).not.toContain('heads%2Frelease%2F2026-05');
+      }
+      return baseFetch(input);
+    }) as unknown as typeof fetch;
+    const deps = createDeps({
+      fetchFn,
+      getConfig: () => ({
+        github: {
+          enabled: true,
+          intervalMinutes: 60,
+          runOnStartup: false,
+          sources: [
+            {
+              id: 'librechat-skills',
+              owner: 'LibreChat',
+              repo: 'skills',
+              ref: 'heads/release/2026-05',
+              paths: ['skills'],
+              credentialKey: 'github-skills-prod',
+            },
+          ],
+        },
+      }),
+    });
+    const result = await createGitHubSkillSyncRunner(deps).runOnce();
+
+    expect(result.status).toBe('completed');
+    expect(fetchFn).toHaveBeenCalled();
+  });
+
+  it('runs a tenant-scoped source inside its tenant context and stamps the skill tenantId', async () => {
+    let observedTenantId: string | undefined = 'unset';
+    const deps = createDeps({
+      getConfig: () => ({
+        github: {
+          enabled: true,
+          intervalMinutes: 60,
+          runOnStartup: false,
+          sources: [
+            {
+              id: 'librechat-skills',
+              owner: 'LibreChat',
+              repo: 'skills',
+              ref: 'main',
+              paths: ['skills'],
+              credentialKey: 'github-skills-prod',
+              tenantId: 'tenant-a',
+            },
+          ],
+        },
+      }),
+      createSkill: jest.fn(async (input: CreateSkillInput): Promise<CreateSkillResult> => {
+        observedTenantId = getTenantId();
+        return { skill: makeSkill(input), warnings: [] };
+      }),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('completed');
+    expect(observedTenantId).toBe('tenant-a');
+    expect(deps.findSkillBySourceIdentity).toHaveBeenCalledWith({
+      source: 'github',
+      upstreamId: 'librechat-skills:skills/research',
+      tenantId: 'tenant-a',
+    });
+    expect(deps.createSkill).toHaveBeenCalledWith(
+      expect.objectContaining({ name: 'research', tenantId: 'tenant-a' }),
+    );
+    expect(deps.upsertStatus).toHaveBeenCalledWith(
+      expect.objectContaining({ sourceId: 'librechat-skills', tenantId: 'tenant-a' }),
+    );
+    const [lockParams] = (deps.tryAcquireLock as jest.Mock).mock.calls[0];
+    expect(lockParams).not.toHaveProperty('tenantId');
+  });
+
+  it('matches stored source status by tenant and source id', async () => {
+    const deps = createDeps({
+      listStatuses: jest.fn(async () => [
+        {
+          provider: 'github',
+          sourceId: 'librechat-skills',
+          tenantId: 'tenant-a',
+          status: 'succeeded',
+          syncedSkillCount: 1,
+          syncedFileCount: 2,
+          deletedSkillCount: 0,
+          deletedFileCount: 0,
+        } as ISkillSyncStatus,
+        {
+          provider: 'github',
+          sourceId: 'librechat-skills',
+          tenantId: 'tenant-b',
+          status: 'failed',
+          errorCode: 'OTHER_TENANT',
+          syncedSkillCount: 0,
+          syncedFileCount: 0,
+          deletedSkillCount: 0,
+          deletedFileCount: 0,
+        } as ISkillSyncStatus,
+      ]),
+      getConfig: () => ({
+        github: {
+          enabled: true,
+          intervalMinutes: 60,
+          runOnStartup: false,
+          sources: [
+            {
+              id: 'librechat-skills',
+              owner: 'LibreChat',
+              repo: 'skills',
+              ref: 'main',
+              paths: ['skills'],
+              credentialKey: 'github-skills-prod',
+              tenantId: 'tenant-b',
+            },
+          ],
+        },
+      }),
+    });
+
+    const status = await createGitHubSkillSyncRunner(deps).getStatus();
+
+    expect(status.sources[0]).toEqual(
+      expect.objectContaining({
+        sourceId: 'librechat-skills',
+        tenantId: 'tenant-b',
+        status: 'failed',
+        errorCode: 'OTHER_TENANT',
+      }),
+    );
+  });
+
+  it('runs in the ambient context when a source has no configured tenantId', async () => {
+    let observedTenantId: string | undefined = 'unset';
+    const deps = createDeps({
+      createSkill: jest.fn(async (input: CreateSkillInput): Promise<CreateSkillResult> => {
+        observedTenantId = getTenantId();
+        return { skill: makeSkill(input), warnings: [] };
+      }),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('completed');
+    expect(observedTenantId).toBeUndefined();
+    expect(deps.createSkill).toHaveBeenCalledWith(
+      expect.objectContaining({ name: 'research', tenantId: undefined }),
+    );
+  });
+
+  it('scopes mirror cleanup to the current source and deletes only its absent upstream skills', async () => {
+    const keptId = new Types.ObjectId();
+    const staleId = new Types.ObjectId();
+    const existingSkill = (upstreamId: string, _id: Types.ObjectId) => {
+      const skill = makeSkill({
+        name: 'research',
+        description: 'Research things',
+        author: new Types.ObjectId(),
+        authorName: 'GitHub Sync',
+        source: 'github',
+        sourceMetadata: { provider: 'github', sourceId: 'librechat-skills', upstreamId },
+      });
+      skill._id = _id;
+      return skill;
+    };
+    const listSkillsBySource = jest.fn(async () => [
+      existingSkill('librechat-skills:skills/research', keptId),
+      existingSkill('librechat-skills:skills/removed', staleId),
+    ]);
+    const deps = createDeps({ listSkillsBySource });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('completed');
+    expect(listSkillsBySource).toHaveBeenCalledWith({
+      source: 'github',
+      sourceId: 'librechat-skills',
+    });
+    expect(deps.deleteSkill).toHaveBeenCalledTimes(1);
+    expect(deps.deleteSkill).toHaveBeenCalledWith(staleId.toString());
+  });
+
+  it('deletes stale name-conflicting mirrors after file sync and before same-commit renames', async () => {
+    const staleId = new Types.ObjectId();
+    const existingId = new Types.ObjectId();
+    const author = makeSourceAuthorId();
+    const existingSkill = (
+      upstreamId: string,
+      _id: Types.ObjectId,
+      name: string,
+    ): ISkill & { _id: Types.ObjectId } => {
+      const skill = makeSkill({
+        name,
+        description: `${name} skill`,
+        body: 'Old body',
+        author,
+        authorName: 'GitHub Sync',
+        source: 'github',
+        sourceMetadata: { provider: 'github', sourceId: 'librechat-skills', upstreamId },
+      });
+      skill._id = _id;
+      return skill;
+    };
+    const staleSkill = existingSkill('librechat-skills:skills/removed', staleId, 'renamed');
+    const syncedSkill = existingSkill('librechat-skills:skills/research', existingId, 'research');
+    const existingById = new Map([[existingId.toString(), syncedSkill]]);
+    const deletedIds = new Set<string>();
+    const listSkillsBySource = jest.fn(async () =>
+      [staleSkill, syncedSkill].filter((skill) => !deletedIds.has(skill._id.toString())),
+    );
+    const deleteSkill = jest.fn(async (id: string) => {
+      deletedIds.add(id);
+      return { deleted: true };
+    });
+    const updateSkill = jest.fn(
+      async ({
+        id,
+        update,
+      }: {
+        id: string;
+        expectedVersion: number;
+        update: UpdateSkillInput;
+      }): Promise<UpdateSkillResult> => {
+        if (!deletedIds.has(staleId.toString()) && update.name === 'renamed') {
+          throw new Error('duplicate key');
+        }
+        const skill = existingById.get(id);
+        if (!skill) {
+          return { status: 'not_found' as const };
+        }
+        const updated = { ...skill, ...update, version: skill.version + 1 };
+        existingById.set(id, updated);
+        return { status: 'updated' as const, skill: updated, warnings: [] };
+      },
+    );
+    const deps = createDeps({
+      fetchFn: githubFetch('---\nname: renamed\ndescription: Renamed skill\n---\nBody'),
+      findSkillBySourceIdentity: jest.fn(async ({ upstreamId }) =>
+        upstreamId === 'librechat-skills:skills/research' ? syncedSkill : null,
+      ),
+      getSkillById: jest.fn(async (id) => existingById.get(id.toString()) ?? null),
+      listSkillsBySource,
+      deleteSkill,
+      updateSkill,
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('completed');
+    expect(deleteSkill).toHaveBeenCalledWith(staleId.toString());
+    expect(updateSkill).toHaveBeenCalledWith(
+      expect.objectContaining({
+        id: existingId.toString(),
+        update: expect.objectContaining({ name: 'renamed' }),
+      }),
+    );
+    expect((deps.upsertSkillFile as jest.Mock).mock.invocationCallOrder[0]).toBeLessThan(
+      deleteSkill.mock.invocationCallOrder[0],
+    );
+    expect(deleteSkill.mock.invocationCallOrder[0]).toBeLessThan(
+      updateSkill.mock.invocationCallOrder[0],
+    );
+  });
+
+  it('does not delete stale name-conflicting mirrors before another skill file sync fails', async () => {
+    const renamedMarkdown = '---\nname: renamed\ndescription: Renamed skill\n---\nBody';
+    const brokenMarkdown = '---\nname: broken\ndescription: Broken skill\n---\nBody';
+    const fetchFn = jest.fn(async (input: RequestInfo | URL) => {
+      const url = input.toString();
+      if (url.includes('/commits/')) {
+        return response({ sha: 'commit-sha', commit: { tree: { sha: 'tree-sha' } } });
+      }
+      if (url.includes('/git/trees/tree-sha')) {
+        return response({
+          sha: 'tree-sha',
+          truncated: false,
+          tree: [
+            {
+              path: 'skills',
+              mode: '040000',
+              type: 'tree',
+              sha: 'skills-tree-sha',
+              url: 'https://api.github.test/tree/skills',
+            },
+          ],
+        });
+      }
+      if (url.includes('/git/trees/skills-tree-sha')) {
+        return response({
+          sha: 'skills-tree-sha',
+          truncated: false,
+          tree: [
+            {
+              path: 'research/SKILL.md',
+              mode: '100644',
+              type: 'blob',
+              sha: 'research-skill-sha',
+              size: Buffer.byteLength(renamedMarkdown),
+              url: 'https://api.github.test/blob/research-skill',
+            },
+            {
+              path: 'research/scripts/run.sh',
+              mode: '100644',
+              type: 'blob',
+              sha: 'research-file-sha',
+              size: 7,
+              url: 'https://api.github.test/blob/research-file',
+            },
+            {
+              path: 'broken/SKILL.md',
+              mode: '100644',
+              type: 'blob',
+              sha: 'broken-skill-sha',
+              size: Buffer.byteLength(brokenMarkdown),
+              url: 'https://api.github.test/blob/broken-skill',
+            },
+            {
+              path: 'broken/scripts/run.sh',
+              mode: '100644',
+              type: 'blob',
+              sha: 'broken-file-sha',
+              size: 7,
+              url: 'https://api.github.test/blob/broken-file',
+            },
+          ],
+        });
+      }
+      if (url.includes('/git/blobs/research-skill-sha')) {
+        return response(blob(renamedMarkdown));
+      }
+      if (url.includes('/git/blobs/broken-skill-sha')) {
+        return response(blob(brokenMarkdown));
+      }
+      if (url.includes('/git/blobs/research-file-sha')) {
+        return response(blob('echo ok'));
+      }
+      if (url.includes('/git/blobs/broken-file-sha')) {
+        return response(blob('echo ok'));
+      }
+      return response({ message: 'not found' }, 404);
+    }) as unknown as typeof fetch;
+    const staleId = new Types.ObjectId();
+    const existingId = new Types.ObjectId();
+    const author = makeSourceAuthorId();
+    const makeExisting = (
+      upstreamId: string,
+      _id: Types.ObjectId,
+      name: string,
+    ): ISkill & { _id: Types.ObjectId } => {
+      const skill = makeSkill({
+        name,
+        description: `${name} skill`,
+        body: 'Old body',
+        author,
+        authorName: 'GitHub Sync',
+        source: 'github',
+        sourceMetadata: { provider: 'github', sourceId: 'librechat-skills', upstreamId },
+      });
+      skill._id = _id;
+      return skill;
+    };
+    const staleSkill = makeExisting('librechat-skills:skills/removed', staleId, 'renamed');
+    const syncedSkill = makeExisting('librechat-skills:skills/research', existingId, 'research');
+    const createdIds: string[] = [];
+    const deleteSkill = jest.fn(async (id: string) => ({ deleted: createdIds.includes(id) }));
+    const deps = createDeps({
+      fetchFn,
+      findSkillBySourceIdentity: jest.fn(async ({ upstreamId }) =>
+        upstreamId === 'librechat-skills:skills/research' ? syncedSkill : null,
+      ),
+      getSkillById: jest.fn(async (id) =>
+        id.toString() === existingId.toString() ? syncedSkill : null,
+      ),
+      listSkillsBySource: jest.fn(async () => [staleSkill, syncedSkill]),
+      createSkill: jest.fn(async (input: CreateSkillInput): Promise<CreateSkillResult> => {
+        const skill = makeSkill(input);
+        createdIds.push(skill._id.toString());
+        return { skill, warnings: [] };
+      }),
+      saveBuffer: jest.fn(async () => {
+        throw new Error('storage unavailable');
+      }),
+      deleteSkill,
+      updateSkill: jest.fn(),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('failed');
+    expect(deleteSkill).not.toHaveBeenCalledWith(staleId.toString());
+    expect(deps.updateSkill).not.toHaveBeenCalled();
+    expect(deps.upsertStatus).toHaveBeenLastCalledWith(
+      expect.objectContaining({
+        status: 'failed',
+        errorMessage: 'storage unavailable',
+      }),
+    );
+  });
+
+  it('restores a stale name-conflicting mirror when the rename update fails after deletion', async () => {
+    const staleId = new Types.ObjectId();
+    const existingId = new Types.ObjectId();
+    const author = makeSourceAuthorId();
+    const makeExisting = (
+      upstreamId: string,
+      _id: Types.ObjectId,
+      name: string,
+    ): ISkill & { _id: Types.ObjectId } => {
+      const skill = makeSkill({
+        name,
+        description: `${name} skill`,
+        body: 'Old body',
+        author,
+        authorName: 'GitHub Sync',
+        source: 'github',
+        sourceMetadata: { provider: 'github', sourceId: 'librechat-skills', upstreamId },
+      });
+      skill._id = _id;
+      return skill;
+    };
+    const staleSkill = makeExisting('librechat-skills:skills/removed', staleId, 'renamed');
+    const syncedSkill = makeExisting('librechat-skills:skills/research', existingId, 'research');
+    const deletedIds = new Set<string>();
+    let restoredSkill: (ISkill & { _id: Types.ObjectId }) | undefined;
+    const createSkill = jest.fn(async (input: CreateSkillInput): Promise<CreateSkillResult> => {
+      restoredSkill = makeSkill(input);
+      return { skill: restoredSkill, warnings: [] };
+    });
+    const deleteSkill = jest.fn(async (id: string) => {
+      deletedIds.add(id);
+      return { deleted: true };
+    });
+    const deps = createDeps({
+      fetchFn: githubFetch('---\nname: renamed\ndescription: Renamed skill\n---\nBody'),
+      findSkillBySourceIdentity: jest.fn(async ({ upstreamId }) =>
+        upstreamId === 'librechat-skills:skills/research' ? syncedSkill : null,
+      ),
+      getSkillById: jest.fn(async (id) =>
+        id.toString() === existingId.toString() ? syncedSkill : null,
+      ),
+      listSkillsBySource: jest.fn(async () =>
+        [staleSkill, syncedSkill].filter((skill) => !deletedIds.has(skill._id.toString())),
+      ),
+      createSkill,
+      deleteSkill,
+      updateSkill: jest.fn(async () => ({ status: 'conflict' as const, current: syncedSkill })),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('failed');
+    expect(deleteSkill).toHaveBeenCalledWith(staleId.toString());
+    expect(createSkill).toHaveBeenCalledWith(
+      expect.objectContaining({
+        name: 'renamed',
+        sourceMetadata: expect.objectContaining({
+          upstreamId: 'librechat-skills:skills/removed',
+        }),
+      }),
+    );
+    expect(deps.grantPermission).toHaveBeenCalledWith(
+      expect.objectContaining({ resourceId: restoredSkill?._id }),
+    );
+  });
+
+  it("does not mirror-delete another tenant's skills from an ambient source run", async () => {
+    const ambientStaleId = new Types.ObjectId();
+    const otherTenantId = new Types.ObjectId();
+    const makeExisting = (
+      upstreamId: string,
+      _id: Types.ObjectId,
+      tenantId?: string,
+    ): ISkill & { _id: Types.ObjectId } => {
+      const skill = makeSkill({
+        name: 'research',
+        description: 'Research things',
+        author: new Types.ObjectId(),
+        authorName: 'GitHub Sync',
+        source: 'github',
+        sourceMetadata: { provider: 'github', sourceId: 'librechat-skills', upstreamId },
+      });
+      skill._id = _id;
+      skill.tenantId = tenantId;
+      return skill;
+    };
+    // The configured source is ambient (no tenantId), but listSkillsBySource
+    // (non-strict) returns a skill owned by tenant-b. It must not be deleted.
+    const listSkillsBySource = jest.fn(async () => [
+      makeExisting('librechat-skills:skills/removed', ambientStaleId, undefined),
+      makeExisting('librechat-skills:skills/removed', otherTenantId, 'tenant-b'),
+    ]);
+    const deps = createDeps({ listSkillsBySource });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('completed');
+    expect(deps.deleteSkill).toHaveBeenCalledTimes(1);
+    expect(deps.deleteSkill).toHaveBeenCalledWith(ambientStaleId.toString());
+    expect(deps.deleteSkill).not.toHaveBeenCalledWith(otherTenantId.toString());
+  });
+
+  it('derives distinct synthetic authors for the same source mirrored into different tenants', async () => {
+    const authorForTenant = async (tenantId: string): Promise<string> => {
+      let author = '';
+      const deps = createDeps({
+        getConfig: () => ({
+          github: {
+            enabled: true,
+            intervalMinutes: 60,
+            runOnStartup: false,
+            sources: [
+              {
+                id: 'librechat-skills',
+                owner: 'LibreChat',
+                repo: 'skills',
+                ref: 'main',
+                paths: ['skills'],
+                credentialKey: 'github-skills-prod',
+                tenantId,
+              },
+            ],
+          },
+        }),
+        createSkill: jest.fn(async (input: CreateSkillInput): Promise<CreateSkillResult> => {
+          author = input.author.toString();
+          return { skill: makeSkill(input), warnings: [] };
+        }),
+      });
+      await createGitHubSkillSyncRunner(deps).runOnce();
+      return author;
+    };
+
+    const [authorA, authorB] = [
+      await authorForTenant('tenant-a'),
+      await authorForTenant('tenant-b'),
+    ];
+    expect(authorA).not.toBe('');
+    expect(authorA).not.toBe(authorB);
+  });
+
+  it('uses distinct synthetic authors so same-named skills can sync from different sources', async () => {
+    const seenNamesByAuthor = new Set<string>();
+    const deps = createDeps({
+      getConfig: () => ({
+        github: {
+          enabled: true,
+          intervalMinutes: 60,
+          runOnStartup: false,
+          sources: [
+            {
+              id: 'source-a',
+              owner: 'LibreChat',
+              repo: 'skills-a',
+              ref: 'main',
+              paths: ['skills'],
+              credentialKey: 'github-skills-prod',
+            },
+            {
+              id: 'source-b',
+              owner: 'LibreChat',
+              repo: 'skills-b',
+              ref: 'main',
+              paths: ['skills'],
+              credentialKey: 'github-skills-prod',
+            },
+          ],
+        },
+      }),
+      createSkill: jest.fn(async (input: CreateSkillInput): Promise<CreateSkillResult> => {
+        const key = `${input.name}:${input.author.toString()}`;
+        if (seenNamesByAuthor.has(key)) {
+          throw new Error('duplicate key');
+        }
+        seenNamesByAuthor.add(key);
+        return { skill: makeSkill(input), warnings: [] };
+      }),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+    const createCalls = (deps.createSkill as jest.Mock).mock.calls.map(
+      ([input]: [CreateSkillInput]) => input,
+    );
+
+    expect(result.status).toBe('completed');
+    expect(createCalls).toHaveLength(2);
+    expect(createCalls.map((input) => input.name)).toEqual(['research', 'research']);
+    expect(new Set(createCalls.map((input) => input.author.toString())).size).toBe(2);
+  });
+
+  it('marks a source failed and skips mirror deletion when the credential is missing', async () => {
+    const deps = createDeps({
+      getCredentialToken: jest.fn(async () => null),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('failed');
+    expect(deps.listSkillsBySource).not.toHaveBeenCalled();
+    expect(deps.deleteSkill).not.toHaveBeenCalled();
+    expect(deps.upsertStatus).toHaveBeenLastCalledWith(
+      expect.objectContaining({
+        status: 'failed',
+        errorCode: 'MISSING_CREDENTIAL',
+      }),
+    );
+  });
+
+  it('marks GitHub secondary rate limits as rate limited instead of auth failures', async () => {
+    const deps = createDeps({
+      fetchFn: jest.fn(async () =>
+        response(
+          { message: 'You have exceeded a secondary rate limit. Please wait before retrying.' },
+          403,
+          { 'x-ratelimit-remaining': '42' },
+        ),
+      ) as unknown as typeof fetch,
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('failed');
+    expect(deps.upsertStatus).toHaveBeenLastCalledWith(
+      expect.objectContaining({
+        status: 'failed',
+        errorCode: 'GITHUB_RATE_LIMITED',
+      }),
+    );
+  });
+
+  it('keeps non-rate-limit GitHub 403 responses classified as auth failures', async () => {
+    const deps = createDeps({
+      fetchFn: jest.fn(async () =>
+        response({ message: 'Resource not accessible by personal access token' }, 403, {
+          'x-ratelimit-remaining': '42',
+        }),
+      ) as unknown as typeof fetch,
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('failed');
+    expect(deps.upsertStatus).toHaveBeenLastCalledWith(
+      expect.objectContaining({
+        status: 'failed',
+        errorCode: 'GITHUB_AUTH_FAILED',
+      }),
+    );
+  });
+
+  it('marks a source failed and skips mirror deletion when SKILL.md frontmatter is malformed', async () => {
+    const deps = createDeps({
+      fetchFn: githubFetch('---\nname: [\n---\nBody'),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('failed');
+    expect(deps.createSkill).not.toHaveBeenCalled();
+    expect(deps.listSkillsBySource).not.toHaveBeenCalled();
+    expect(deps.deleteSkill).not.toHaveBeenCalled();
+    expect(deps.upsertStatus).toHaveBeenLastCalledWith(
+      expect.objectContaining({
+        status: 'failed',
+        errorCode: 'SKILL_PARSE_FAILED',
+        errorMessage: expect.stringContaining('skills/research/SKILL.md'),
+      }),
+    );
+  });
+
+  it('uses a ref-independent upstream identity when updating an existing GitHub skill', async () => {
+    const existing = makeSkill({
+      name: 'research',
+      description: 'Old description',
+      author: new Types.ObjectId(),
+      authorName: 'GitHub Sync',
+      frontmatter: { 'allowed-tools': ['old-tool'] },
+      source: 'github',
+      sourceMetadata: {
+        provider: 'github',
+        sourceId: 'librechat-skills',
+        upstreamId: 'librechat-skills:skills/research',
+        owner: 'LibreChat',
+        repo: 'skills',
+        ref: 'main',
+        skillPath: 'skills/research',
+      },
+    }) as ISkill & { _id: Types.ObjectId };
+    const deps = createDeps({
+      getConfig: () => ({
+        github: {
+          enabled: true,
+          intervalMinutes: 60,
+          runOnStartup: false,
+          sources: [
+            {
+              id: 'librechat-skills',
+              owner: 'LibreChat',
+              repo: 'skills',
+              ref: 'release',
+              paths: ['skills'],
+              credentialKey: 'github-skills-prod',
+            },
+          ],
+        },
+      }),
+      findSkillBySourceIdentity: jest.fn(async () => existing),
+      getSkillById: jest.fn(async () => ({ ...existing, version: existing.version + 1 })),
+      fetchFn: githubFetch('---\nname: research\ndescription: Research things\n---\nBody'),
+      updateSkill: jest.fn(async ({ update }) => ({
+        status: 'updated' as const,
+        skill: {
+          ...existing,
+          ...update,
+          version: existing.version + 1,
+        },
+        warnings: [],
+      })),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('completed');
+    expect(deps.findSkillBySourceIdentity).toHaveBeenCalledWith({
+      source: 'github',
+      upstreamId: 'librechat-skills:skills/research',
+      tenantId: undefined,
+    });
+    expect(deps.createSkill).not.toHaveBeenCalled();
+    expect(deps.updateSkill).toHaveBeenCalledWith(
+      expect.objectContaining({
+        update: expect.objectContaining({
+          sourceMetadata: expect.objectContaining({
+            ref: 'release',
+            upstreamId: 'librechat-skills:skills/research',
+          }),
+          frontmatter: {},
+        }),
+      }),
+    );
+  });
+
+  it('ignores source identity matches from a different tenant bucket', async () => {
+    const otherTenantSkill = makeSkill({
+      name: 'research',
+      description: 'Tenant skill',
+      author: makeSourceAuthorId('librechat-skills', 'tenant-b'),
+      authorName: 'GitHub Sync',
+      frontmatter: {},
+      source: 'github',
+      tenantId: 'tenant-b',
+      sourceMetadata: {
+        provider: 'github',
+        sourceId: 'librechat-skills',
+        upstreamId: 'librechat-skills:skills/research',
+        owner: 'LibreChat',
+        repo: 'skills',
+        ref: 'main',
+        skillPath: 'skills/research',
+      },
+    }) as ISkill & { _id: Types.ObjectId };
+    const deps = createDeps({
+      findSkillBySourceIdentity: jest.fn(async () => otherTenantSkill),
+      listSkillsBySource: jest.fn(async () => [otherTenantSkill]),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('completed');
+    expect(deps.createSkill).toHaveBeenCalledWith(
+      expect.objectContaining({
+        name: 'research',
+        tenantId: undefined,
+      }),
+    );
+    expect(deps.updateSkill).not.toHaveBeenCalled();
+    expect(deps.deleteSkill).not.toHaveBeenCalledWith(otherTenantSkill._id.toString());
+  });
+
+  it('does not match still-discovered mirrors as moved skills when new skills sync first', async () => {
+    const newSkillMarkdown = '---\nname: research\ndescription: New research skill\n---\nNew';
+    const renamedSkillMarkdown = '---\nname: renamed\ndescription: Renamed skill\n---\nRenamed';
+    const fetchFn = jest.fn(async (input: RequestInfo | URL) => {
+      const url = input.toString();
+      if (url.includes('/commits/')) {
+        return response({ sha: 'commit-sha', commit: { tree: { sha: 'tree-sha' } } });
+      }
+      if (url.includes('/git/trees/tree-sha')) {
+        return response({
+          sha: 'tree-sha',
+          truncated: false,
+          tree: [
+            {
+              path: 'skills',
+              mode: '040000',
+              type: 'tree',
+              sha: 'skills-tree-sha',
+              url: 'https://api.github.test/tree/skills',
+            },
+          ],
+        });
+      }
+      if (url.includes('/git/trees/skills-tree-sha')) {
+        return response({
+          sha: 'skills-tree-sha',
+          truncated: false,
+          tree: [
+            {
+              path: 'new/SKILL.md',
+              mode: '100644',
+              type: 'blob',
+              sha: 'new-skill-sha',
+              size: Buffer.byteLength(newSkillMarkdown),
+              url: 'https://api.github.test/blob/new-skill',
+            },
+            {
+              path: 'research/SKILL.md',
+              mode: '100644',
+              type: 'blob',
+              sha: 'renamed-skill-sha',
+              size: Buffer.byteLength(renamedSkillMarkdown),
+              url: 'https://api.github.test/blob/renamed-skill',
+            },
+          ],
+        });
+      }
+      if (url.includes('/git/blobs/new-skill-sha')) {
+        return response(blob(newSkillMarkdown));
+      }
+      if (url.includes('/git/blobs/renamed-skill-sha')) {
+        return response(blob(renamedSkillMarkdown));
+      }
+      return response({ message: 'not found' }, 404);
+    }) as unknown as typeof fetch;
+    const existing = makeSkill({
+      name: 'research',
+      description: 'Old research skill',
+      body: 'Old body',
+      author: makeSourceAuthorId(),
+      authorName: 'GitHub Sync',
+      source: 'github',
+      sourceMetadata: {
+        provider: 'github',
+        sourceId: 'librechat-skills',
+        upstreamId: 'librechat-skills:skills/research',
+        owner: 'LibreChat',
+        repo: 'skills',
+        ref: 'main',
+        skillPath: 'skills/research',
+      },
+    }) as ISkill & { _id: Types.ObjectId };
+    const deps = createDeps({
+      fetchFn,
+      findSkillBySourceIdentity: jest.fn(async ({ upstreamId }) =>
+        upstreamId === 'librechat-skills:skills/research' ? existing : null,
+      ),
+      listSkillsBySource: jest.fn(async () => [existing]),
+      getSkillById: jest.fn(async (id) =>
+        id.toString() === existing._id.toString() ? existing : null,
+      ),
+      updateSkill: jest.fn(async ({ update }) => ({
+        status: 'updated' as const,
+        skill: { ...existing, ...update, version: existing.version + 1 },
+        warnings: [],
+      })),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('completed');
+    expect(deps.createSkill).toHaveBeenCalledWith(
+      expect.objectContaining({
+        name: 'research',
+        sourceMetadata: expect.objectContaining({
+          upstreamId: 'librechat-skills:skills/new',
+        }),
+      }),
+    );
+    expect(deps.updateSkill).toHaveBeenCalledWith(
+      expect.objectContaining({
+        id: existing._id.toString(),
+        update: expect.objectContaining({
+          name: 'renamed',
+          sourceMetadata: expect.objectContaining({
+            upstreamId: 'librechat-skills:skills/research',
+          }),
+        }),
+      }),
+    );
+  });
+
+  it('reuses a same-named source mirror when a skill moves configured paths', async () => {
+    const existing = makeSkill({
+      name: 'research',
+      description: 'Old description',
+      author: makeSourceAuthorId(),
+      authorName: 'GitHub Sync',
+      frontmatter: {},
+      source: 'github',
+      sourceMetadata: {
+        provider: 'github',
+        sourceId: 'librechat-skills',
+        upstreamId: 'librechat-skills:skills/old-research',
+        owner: 'LibreChat',
+        repo: 'skills',
+        ref: 'main',
+        skillPath: 'skills/old-research',
+      },
+    }) as ISkill & { _id: Types.ObjectId };
+    const unchangedFile = makeSkillFile(existing, {
+      sourceMetadata: {
+        provider: 'github',
+        sourceId: 'librechat-skills',
+        upstreamId: 'librechat-skills:skills/old-research',
+        commitSha: 'old-commit-sha',
+        blobSha: 'file-sha',
+        path: 'skills/old-research/scripts/run.sh',
+      },
+    });
+    const deps = createDeps({
+      findSkillBySourceIdentity: jest.fn(async () => null),
+      listSkillsBySource: jest.fn(async () => [existing]),
+      getSkillById: jest.fn(async () => existing),
+      getSkillFileByPath: jest.fn(async () => unchangedFile),
+      listSkillFiles: jest.fn(async () => [unchangedFile]),
+      updateSkill: jest.fn(async ({ update }) => {
+        Object.assign(existing, update, { version: existing.version + 1 });
+        return { status: 'updated' as const, skill: existing, warnings: [] };
+      }),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('completed');
+    expect(deps.createSkill).not.toHaveBeenCalled();
+    expect(deps.updateSkill).toHaveBeenCalledWith(
+      expect.objectContaining({
+        id: existing._id.toString(),
+        update: expect.objectContaining({
+          sourceMetadata: expect.objectContaining({
+            upstreamId: 'librechat-skills:skills/research',
+            skillPath: 'skills/research',
+          }),
+        }),
+      }),
+    );
+    expect(deps.deleteSkill).not.toHaveBeenCalled();
+  });
+
+  it('refreshes an existing skill version after file sync before updating metadata', async () => {
+    const existing = makeSkill({
+      name: 'research',
+      description: 'Old description',
+      author: new Types.ObjectId(),
+      authorName: 'GitHub Sync',
+      source: 'github',
+      sourceMetadata: {
+        provider: 'github',
+        sourceId: 'librechat-skills',
+        upstreamId: 'librechat-skills:skills/research',
+        owner: 'LibreChat',
+        repo: 'skills',
+        ref: 'main',
+        skillPath: 'skills/research',
+      },
+    }) as ISkill & { _id: Types.ObjectId };
+    const afterFileSync = { ...existing, version: existing.version + 2 };
+    const deps = createDeps({
+      findSkillBySourceIdentity: jest.fn(async () => existing),
+      getSkillById: jest.fn(async () => afterFileSync),
+      updateSkill: jest.fn(async ({ expectedVersion, update }) => ({
+        status: 'updated' as const,
+        skill: {
+          ...afterFileSync,
+          ...update,
+          version: expectedVersion + 1,
+        },
+        warnings: [],
+      })),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('completed');
+    expect(deps.upsertSkillFile).toHaveBeenCalled();
+    expect(deps.getSkillById).toHaveBeenCalledWith(existing._id);
+    expect(deps.updateSkill).toHaveBeenCalledWith(
+      expect.objectContaining({
+        id: existing._id.toString(),
+        expectedVersion: afterFileSync.version,
+      }),
+    );
+  });
+
+  it('treats frontmatter-only edits during sync as conflicts', async () => {
+    const existing = makeSkill({
+      name: 'research',
+      description: 'Old description',
+      body: 'Old body',
+      frontmatter: { 'allowed-tools': ['old-tool'] },
+      author: new Types.ObjectId(),
+      authorName: 'GitHub Sync',
+      source: 'github',
+      sourceMetadata: {
+        provider: 'github',
+        sourceId: 'librechat-skills',
+        upstreamId: 'librechat-skills:skills/research',
+        owner: 'LibreChat',
+        repo: 'skills',
+        ref: 'main',
+        skillPath: 'skills/research',
+      },
+    }) as ISkill & { _id: Types.ObjectId };
+    const edited = {
+      ...existing,
+      version: existing.version + 1,
+      frontmatter: { 'allowed-tools': ['user-tool'] },
+    };
+    const deps = createDeps({
+      findSkillBySourceIdentity: jest.fn(async () => existing),
+      getSkillById: jest.fn(async () => edited),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('failed');
+    expect(deps.upsertSkillFile).not.toHaveBeenCalled();
+    expect(deps.updateSkill).not.toHaveBeenCalled();
+    expect(deps.upsertStatus).toHaveBeenLastCalledWith(
+      expect.objectContaining({
+        status: 'failed',
+        errorCode: 'SKILL_CONFLICT',
+      }),
+    );
+  });
+
+  it('skips existing skill updates when the upstream package is unchanged', async () => {
+    const skillMarkdown = '---\nname: research\ndescription: Research things\n---\nBody';
+    const existing = makeSkill({
+      name: 'research',
+      description: 'Research things',
+      body: skillMarkdown,
+      frontmatter: {},
+      author: new Types.ObjectId(),
+      authorName: 'GitHub Sync',
+      source: 'github',
+      sourceMetadata: {
+        provider: 'github',
+        sourceId: 'librechat-skills',
+        upstreamId: 'librechat-skills:skills/research',
+        owner: 'LibreChat',
+        repo: 'skills',
+        ref: 'main',
+        skillPath: 'skills/research',
+        commitSha: 'old-commit-sha',
+        skillBlobSha: 'skill-md-sha',
+        syncedAt: '2026-05-30T00:00:00.000Z',
+        syncStatus: 'synced',
+      },
+    }) as ISkill & { _id: Types.ObjectId };
+    const unchangedFile = makeSkillFile(existing, {
+      sourceMetadata: {
+        provider: 'github',
+        sourceId: 'librechat-skills',
+        upstreamId: 'librechat-skills:skills/research',
+        commitSha: 'old-commit-sha',
+        blobSha: 'file-sha',
+        path: 'skills/research/scripts/run.sh',
+      },
+    });
+    const deps = createDeps({
+      fetchFn: githubFetch(skillMarkdown),
+      findSkillBySourceIdentity: jest.fn(async () => existing),
+      getSkillById: jest.fn(async () => existing),
+      getSkillFileByPath: jest.fn(async () => unchangedFile),
+      listSkillFiles: jest.fn(async () => [unchangedFile]),
+      updateSkill: jest.fn(),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('completed');
+    expect(deps.saveBuffer).not.toHaveBeenCalled();
+    expect(deps.upsertSkillFile).not.toHaveBeenCalled();
+    expect(deps.updateSkill).not.toHaveBeenCalled();
+    expect(deps.grantPermission).toHaveBeenCalled();
+  });
+
+  it('does not mutate existing skill files when permission grant fails', async () => {
+    const existing = makeSkill({
+      name: 'research',
+      description: 'Old description',
+      body: 'Old body',
+      author: new Types.ObjectId(),
+      authorName: 'GitHub Sync',
+      source: 'github',
+      sourceMetadata: {
+        provider: 'github',
+        sourceId: 'librechat-skills',
+        upstreamId: 'librechat-skills:skills/research',
+        owner: 'LibreChat',
+        repo: 'skills',
+        ref: 'main',
+        skillPath: 'skills/research',
+      },
+    }) as ISkill & { _id: Types.ObjectId };
+    const deps = createDeps({
+      findSkillBySourceIdentity: jest.fn(async () => existing),
+      getSkillById: jest.fn(async () => existing),
+      grantPermission: jest.fn(async () => {
+        throw new Error('permission unavailable');
+      }),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('failed');
+    expect(deps.grantPermission).toHaveBeenCalledWith(
+      expect.objectContaining({ resourceId: existing._id }),
+    );
+    expect(deps.listSkillFiles).not.toHaveBeenCalled();
+    expect(deps.saveBuffer).not.toHaveBeenCalled();
+    expect(deps.upsertSkillFile).not.toHaveBeenCalled();
+    expect(deps.updateSkill).not.toHaveBeenCalled();
+  });
+
+  it('restores existing skill files when the skill update fails after file sync', async () => {
+    const existing = makeSkill({
+      name: 'research',
+      description: 'Old description',
+      body: 'Old body',
+      author: new Types.ObjectId(),
+      authorName: 'GitHub Sync',
+      source: 'github',
+      sourceMetadata: {
+        provider: 'github',
+        sourceId: 'librechat-skills',
+        upstreamId: 'librechat-skills:skills/research',
+        owner: 'LibreChat',
+        repo: 'skills',
+        ref: 'main',
+        skillPath: 'skills/research',
+      },
+    }) as ISkill & { _id: Types.ObjectId };
+    const oldFile = makeSkillFile(existing);
+    const files = new Map<string, ISkillFile & { _id: Types.ObjectId }>([
+      [oldFile.relativePath, oldFile],
+    ]);
+    const upsertSkillFile = jest.fn(
+      async (
+        row: Parameters<GitHubSkillSyncDeps['upsertSkillFile']>[0],
+      ): Promise<ISkillFile & { _id: Types.ObjectId }> => {
+        const current = files.get(row.relativePath);
+        const next = {
+          _id: current?._id ?? new Types.ObjectId(),
+          skillId: row.skillId as Types.ObjectId,
+          relativePath: row.relativePath,
+          file_id: row.file_id,
+          filename: row.filename,
+          filepath: row.filepath,
+          storageKey: row.storageKey,
+          storageRegion: row.storageRegion,
+          source: row.source,
+          sourceMetadata: row.sourceMetadata,
+          mimeType: row.mimeType,
+          bytes: row.bytes,
+          category: 'script' as const,
+          isExecutable: row.isExecutable ?? false,
+          author: row.author,
+          tenantId: row.tenantId,
+        };
+        files.set(row.relativePath, next);
+        return next;
+      },
+    );
+    const deps = createDeps({
+      findSkillBySourceIdentity: jest.fn(async () => existing),
+      getSkillById: jest.fn(async () => ({ ...existing, version: existing.version + 1 })),
+      getSkillFileByPath: jest.fn(
+        async (_skillId, relativePath) => files.get(relativePath) ?? null,
+      ),
+      listSkillFiles: jest.fn(async () => Array.from(files.values())),
+      upsertSkillFile,
+      deleteSkillFile: jest.fn(async (_skillId, relativePath) => ({
+        deleted: files.delete(relativePath),
+      })),
+      saveBuffer: jest.fn(async () => ({
+        filepath: '/uploads/new-file-id__run.sh',
+        source: 'local',
+      })),
+      deleteFile: jest.fn(async () => undefined),
+      updateSkill: jest.fn(async () => ({ status: 'conflict' as const, current: existing })),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('failed');
+    expect(deps.upsertStatus).toHaveBeenLastCalledWith(
+      expect.objectContaining({
+        status: 'failed',
+        errorCode: 'SKILL_CONFLICT',
+      }),
+    );
+    expect(files.get('scripts/run.sh')).toEqual(
+      expect.objectContaining({ filepath: oldFile.filepath }),
+    );
+    expect(deps.deleteFile).toHaveBeenCalledWith(
+      expect.objectContaining({ filepath: '/uploads/new-file-id__run.sh' }),
+    );
+    expect(deps.deleteFile).not.toHaveBeenCalledWith(
+      expect.objectContaining({ filepath: oldFile.filepath }),
+    );
+  });
+
+  it('preserves credential presence when a manual run is skipped by an active lock', async () => {
+    const deps = createDeps({
+      tryAcquireLock: jest.fn(async () => false),
+      listCredentials: jest.fn(async () => [
+        {
+          provider: 'github' as const,
+          credentialKey: 'github-skills-prod',
+          credentialPresent: true,
+          tokenFingerprint: 'abc123',
+        },
+      ]),
+      listStatuses: jest.fn(async () => [
+        {
+          provider: 'github',
+          sourceId: 'librechat-skills',
+          status: 'running',
+          credentialKey: 'github-skills-prod',
+          owner: 'LibreChat',
+          repo: 'skills',
+          ref: 'main',
+          paths: ['skills'],
+          syncedSkillCount: 0,
+          syncedFileCount: 0,
+          deletedSkillCount: 0,
+          deletedFileCount: 0,
+        } as ISkillSyncStatus,
+      ]),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('skipped');
+    expect(result.sources).toEqual([
+      expect.objectContaining({
+        sourceId: 'librechat-skills',
+        status: 'running',
+        credentialPresent: true,
+      }),
+    ]);
+  });
+
+  it('uses a fresh lock owner for each sync run', async () => {
+    const deps = createDeps({ lockOwner: 'worker-a' });
+    const runner = createGitHubSkillSyncRunner(deps);
+
+    await runner.runOnce();
+    await runner.runOnce();
+
+    const lockOwners = (deps.tryAcquireLock as jest.Mock).mock.calls.map(
+      ([params]: [Parameters<GitHubSkillSyncDeps['tryAcquireLock']>[0]]) => params.lockOwner,
+    );
+    const releasedOwners = (deps.releaseLock as jest.Mock).mock.calls.map(
+      ([params]: [Parameters<GitHubSkillSyncDeps['releaseLock']>[0]]) => params.lockOwner,
+    );
+
+    expect(lockOwners).toHaveLength(2);
+    expect(lockOwners[0]).not.toBe(lockOwners[1]);
+    expect(lockOwners.every((owner) => owner.startsWith('worker-a:'))).toBe(true);
+    expect(releasedOwners).toEqual(lockOwners);
+  });
+
+  it('excludes child skill packages from parent synced files', async () => {
+    const parentSkillMarkdown = '---\nname: parent\ndescription: Parent skill\n---\nParent';
+    const childSkillMarkdown = '---\nname: child\ndescription: Child skill\n---\nChild';
+    const fetchFn = jest.fn(async (input: RequestInfo | URL) => {
+      const url = input.toString();
+      if (url.includes('/commits/')) {
+        return response({ sha: 'commit-sha', commit: { tree: { sha: 'tree-sha' } } });
+      }
+      if (url.includes('/git/trees/tree-sha')) {
+        return response({
+          sha: 'tree-sha',
+          truncated: false,
+          tree: [
+            {
+              path: 'skills',
+              mode: '040000',
+              type: 'tree',
+              sha: 'skills-tree-sha',
+              url: 'https://api.github.test/tree/skills',
+            },
+          ],
+        });
+      }
+      if (url.includes('/git/trees/skills-tree-sha')) {
+        return response({
+          sha: 'skills-tree-sha',
+          truncated: false,
+          tree: [
+            {
+              path: 'SKILL.md',
+              mode: '100644',
+              type: 'blob',
+              sha: 'parent-skill-sha',
+              size: Buffer.byteLength(parentSkillMarkdown),
+              url: 'https://api.github.test/blob/parent-skill',
+            },
+            {
+              path: 'parent.txt',
+              mode: '100644',
+              type: 'blob',
+              sha: 'parent-file-sha',
+              size: 6,
+              url: 'https://api.github.test/blob/parent-file',
+            },
+            {
+              path: 'child/SKILL.md',
+              mode: '100644',
+              type: 'blob',
+              sha: 'child-skill-sha',
+              size: Buffer.byteLength(childSkillMarkdown),
+              url: 'https://api.github.test/blob/child-skill',
+            },
+            {
+              path: 'child/child.txt',
+              mode: '100644',
+              type: 'blob',
+              sha: 'child-file-sha',
+              size: 5,
+              url: 'https://api.github.test/blob/child-file',
+            },
+          ],
+        });
+      }
+      if (url.includes('/git/blobs/parent-skill-sha')) {
+        return response(blob(parentSkillMarkdown));
+      }
+      if (url.includes('/git/blobs/parent-file-sha')) {
+        return response(blob('parent'));
+      }
+      if (url.includes('/git/blobs/child-skill-sha')) {
+        return response(blob(childSkillMarkdown));
+      }
+      if (url.includes('/git/blobs/child-file-sha')) {
+        return response(blob('child'));
+      }
+      return response({ message: 'not found' }, 404);
+    }) as unknown as typeof fetch;
+    const deps = createDeps({ fetchFn });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+    const fileCalls = (deps.upsertSkillFile as jest.Mock).mock.calls.map(
+      ([row]: [Parameters<GitHubSkillSyncDeps['upsertSkillFile']>[0]]) => row,
+    );
+
+    expect(result.status).toBe('completed');
+    expect(fileCalls).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          relativePath: 'parent.txt',
+          sourceMetadata: expect.objectContaining({
+            upstreamId: 'librechat-skills:skills',
+          }),
+        }),
+        expect.objectContaining({
+          relativePath: 'child.txt',
+          sourceMetadata: expect.objectContaining({
+            upstreamId: 'librechat-skills:skills/child',
+          }),
+        }),
+      ]),
+    );
+    expect(fileCalls).not.toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          relativePath: 'child/SKILL.md',
+          sourceMetadata: expect.objectContaining({
+            upstreamId: 'librechat-skills:skills',
+          }),
+        }),
+        expect.objectContaining({
+          relativePath: 'child/child.txt',
+          sourceMetadata: expect.objectContaining({
+            upstreamId: 'librechat-skills:skills',
+          }),
+        }),
+      ]),
+    );
+  });
+
+  it('rejects oversized GitHub blobs before downloading file content', async () => {
+    const skillMarkdown = '---\nname: research\ndescription: Research things\n---\nBody';
+    const oversizedBytes = DEFAULT_SKILL_IMPORT_LIMITS.maxSingleFileBytes + 1;
+    const fetchFn = jest.fn(async (input: RequestInfo | URL) => {
+      const url = input.toString();
+      if (url.includes('/commits/')) {
+        return response({ sha: 'commit-sha', commit: { tree: { sha: 'tree-sha' } } });
+      }
+      if (url.includes('/git/trees/tree-sha')) {
+        return response({
+          sha: 'tree-sha',
+          truncated: false,
+          tree: [
+            {
+              path: 'skills',
+              mode: '040000',
+              type: 'tree',
+              sha: 'skills-tree-sha',
+              url: 'https://api.github.test/tree/skills',
+            },
+          ],
+        });
+      }
+      if (url.includes('/git/trees/skills-tree-sha')) {
+        return response({
+          sha: 'skills-tree-sha',
+          truncated: false,
+          tree: [
+            {
+              path: 'research/SKILL.md',
+              mode: '100644',
+              type: 'blob',
+              sha: 'skill-md-sha',
+              size: Buffer.byteLength(skillMarkdown),
+              url: 'https://api.github.test/blob/skill',
+            },
+            {
+              path: 'research/data.bin',
+              mode: '100644',
+              type: 'blob',
+              sha: 'oversized-file-sha',
+              size: oversizedBytes,
+              url: 'https://api.github.test/blob/oversized',
+            },
+          ],
+        });
+      }
+      if (url.includes('/git/blobs/skill-md-sha')) {
+        return response(blob(skillMarkdown));
+      }
+      if (url.includes('/git/blobs/oversized-file-sha')) {
+        throw new Error('oversized blob should not be downloaded');
+      }
+      return response({ message: 'not found' }, 404);
+    }) as unknown as typeof fetch;
+    const deps = createDeps({ fetchFn });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+    const fetchedUrls = (fetchFn as unknown as jest.Mock).mock.calls.map(
+      ([input]: [RequestInfo | URL]) => input.toString(),
+    );
+
+    expect(result.status).toBe('failed');
+    expect(fetchedUrls.some((url) => url.includes('/git/blobs/oversized-file-sha'))).toBe(false);
+    expect(deps.createSkill).not.toHaveBeenCalled();
+    expect(deps.saveBuffer).not.toHaveBeenCalled();
+    expect(deps.listSkillsBySource).not.toHaveBeenCalled();
+    expect(deps.upsertStatus).toHaveBeenLastCalledWith(
+      expect.objectContaining({
+        status: 'failed',
+        errorCode: 'GITHUB_BLOB_TOO_LARGE',
+      }),
+    );
+  });
+
+  it('rejects packages that exceed the skill import entry limit before blob downloads', async () => {
+    const skillMarkdown = '---\nname: research\ndescription: Research things\n---\nBody';
+    const extraFiles = Array.from(
+      { length: DEFAULT_SKILL_IMPORT_LIMITS.maxEntries },
+      (_, index) => ({
+        path: `research/files/${index}.txt`,
+        mode: '100644',
+        type: 'blob',
+        sha: `file-${index}-sha`,
+        size: 1,
+        url: `https://api.github.test/blob/file-${index}`,
+      }),
+    );
+    const fetchFn = jest.fn(async (input: RequestInfo | URL) => {
+      const url = input.toString();
+      if (url.includes('/commits/')) {
+        return response({ sha: 'commit-sha', commit: { tree: { sha: 'tree-sha' } } });
+      }
+      if (url.includes('/git/trees/tree-sha')) {
+        return response({
+          sha: 'tree-sha',
+          truncated: false,
+          tree: [
+            {
+              path: 'skills',
+              mode: '040000',
+              type: 'tree',
+              sha: 'skills-tree-sha',
+              url: 'https://api.github.test/tree/skills',
+            },
+          ],
+        });
+      }
+      if (url.includes('/git/trees/skills-tree-sha')) {
+        return response({
+          sha: 'skills-tree-sha',
+          truncated: false,
+          tree: [
+            {
+              path: 'research/SKILL.md',
+              mode: '100644',
+              type: 'blob',
+              sha: 'skill-md-sha',
+              size: Buffer.byteLength(skillMarkdown),
+              url: 'https://api.github.test/blob/skill',
+            },
+            ...extraFiles,
+          ],
+        });
+      }
+      if (url.includes('/git/blobs/')) {
+        throw new Error('blob should not be downloaded');
+      }
+      return response({ message: 'not found' }, 404);
+    }) as unknown as typeof fetch;
+    const deps = createDeps({ fetchFn });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('failed');
+    expect(deps.createSkill).not.toHaveBeenCalled();
+    expect(deps.saveBuffer).not.toHaveBeenCalled();
+    expect(deps.upsertStatus).toHaveBeenLastCalledWith(
+      expect.objectContaining({
+        status: 'failed',
+        errorCode: 'GITHUB_TOO_MANY_FILES',
+      }),
+    );
+  });
+
+  it('rolls back a newly created skill when file sync fails before publishing', async () => {
+    const deps = createDeps({
+      saveBuffer: jest.fn(async () => {
+        throw new Error('storage unavailable');
+      }),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+    const result = await runner.runOnce();
+
+    expect(result.status).toBe('failed');
+    expect(deps.createSkill).toHaveBeenCalled();
+    expect(deps.grantPermission).not.toHaveBeenCalled();
+    expect(deps.upsertSkillFile).not.toHaveBeenCalled();
+    expect(deps.deleteSkill).toHaveBeenCalledWith(expect.any(String));
+  });
+
+  it('stops syncing after losing the Mongo lock lease', async () => {
+    jest.useFakeTimers();
+    let releaseToken: (token: string) => void = () => undefined;
+    const tokenPromise = new Promise<string>((resolve) => {
+      releaseToken = resolve;
+    });
+    const deps = createDeps({
+      getCredentialToken: jest.fn(() => tokenPromise),
+      refreshLock: jest.fn(async () => false),
+    });
+    const runner = createGitHubSkillSyncRunner(deps);
+
+    try {
+      const runPromise = runner.runOnce();
+      await jest.advanceTimersByTimeAsync(10 * 60 * 1000);
+      releaseToken('github_pat_secret');
+      const result = await runPromise;
+
+      expect(result.status).toBe('failed');
+      expect(result.message).toBe('GitHub skill sync lock was lost');
+      expect(deps.fetchFn).not.toHaveBeenCalled();
+      expect(deps.upsertStatus).toHaveBeenLastCalledWith(
+        expect.objectContaining({
+          status: 'failed',
+          errorCode: 'SYNC_LOCK_LOST',
+        }),
+      );
+    } finally {
+      jest.useRealTimers();
+    }
+  });
+});
diff --git a/packages/api/src/skills/sync/github.ts b/packages/api/src/skills/sync/github.ts
new file mode 100644
index 00000000000..5af41921f32
--- /dev/null
+++ b/packages/api/src/skills/sync/github.ts
@@ -0,0 +1,1872 @@
+import path from 'path';
+import crypto from 'crypto';
+import { Types } from 'mongoose';
+import { logger, tenantStorage } from '@librechat/data-schemas';
+import {
+  ResourceType,
+  PrincipalType,
+  AccessRoleIds,
+  SKILL_SYNC_DEFAULT_DISCOVERY_DEPTH,
+} from 'librechat-data-provider';
+import type {
+  ISkill,
+  ISkillFile,
+  CreateSkillInput,
+  UpdateSkillInput,
+  CreateSkillResult,
+  UpdateSkillResult,
+  UpsertSkillFileInput,
+  ISkillSyncStatus,
+  SkillSyncProvider,
+  SkillSyncCredentialSummary,
+  SkillSyncStatusInput,
+} from '@librechat/data-schemas';
+import type { SkillSyncConfig, SkillSyncGitHubSourceConfig } from 'librechat-data-provider';
+import { DEFAULT_SKILL_IMPORT_LIMITS } from '../limits';
+import { parseSkillMarkdown } from '../parse';
+
+const GITHUB_API_BASE = 'https://api.github.com';
+const SYSTEM_AUTHOR_ID = new Types.ObjectId('000000000000000000000000');
+const SYSTEM_AUTHOR_NAME = 'GitHub Sync';
+const PROVIDER: SkillSyncProvider = 'github';
+const LOCK_LEASE_MS = 30 * 60 * 1000;
+
+export const GITHUB_FINE_GRAINED_TOKEN_RECOMMENDATION =
+  'Use a GitHub fine-grained personal access token scoped to the selected repository with read-only Contents and Metadata permissions.';
+
+type FetchFn = typeof fetch;
+
+type GitHubTreeEntry = {
+  path: string;
+  mode: string;
+  type: 'blob' | 'tree' | 'commit';
+  sha: string;
+  size?: number;
+  url: string;
+};
+
+type GitHubTreeResponse = {
+  sha: string;
+  tree: GitHubTreeEntry[];
+  truncated: boolean;
+};
+
+type GitHubBlobResponse = {
+  sha: string;
+  content: string;
+  encoding: string;
+  size: number;
+};
+
+type GitHubCommitResponse = {
+  sha: string;
+  commit: {
+    tree: {
+      sha: string;
+    };
+  };
+};
+
+type SyncCounters = {
+  syncedSkillCount: number;
+  syncedFileCount: number;
+  deletedSkillCount: number;
+  deletedFileCount: number;
+};
+
+type AssertNotCancelled = () => void;
+
+type DiscoveredSkill = {
+  rootPath: string;
+  skillMd: GitHubTreeEntry;
+  files: GitHubTreeEntry[];
+};
+
+type UpsertRemoteSkillResult = {
+  skill: ISkill & { _id: Types.ObjectId };
+  created: boolean;
+};
+
+type PreparedRemoteSkill = {
+  existing: (ISkill & { _id: Types.ObjectId }) | null;
+  update: UpdateSkillInput;
+  createInput: CreateSkillInput;
+};
+
+type PreparedExistingRemoteSkill = PreparedRemoteSkill & {
+  existing: ISkill & { _id: Types.ObjectId };
+};
+
+type PreparedDiscoveredSkill = {
+  discovered: DiscoveredSkill;
+  prepared: PreparedRemoteSkill;
+};
+
+type SaveBufferResult = {
+  filepath: string;
+  source: string;
+  storageKey?: string;
+  storageRegion?: string;
+};
+
+type StoredSkillFileRef = {
+  filepath: string;
+  source: string;
+  storageKey?: string;
+  storageRegion?: string;
+  author?: Types.ObjectId | string;
+  tenantId?: string;
+};
+
+type DeletedSyncedSkillJournal = {
+  skill: ISkill & { _id: Types.ObjectId };
+  files: Array<ISkillFile & { _id: Types.ObjectId }>;
+};
+
+type SyncSkillFilesJournal = {
+  staleFiles: StoredSkillFileRef[];
+  savedFiles: StoredSkillFileRef[];
+};
+
+type SyncSkillFilesResult = Pick<SyncCounters, 'syncedFileCount' | 'deletedFileCount'> &
+  SyncSkillFilesJournal;
+
+type MaybePromise<T> = T | Promise<T>;
+
+export type GitHubSkillSyncDeps = {
+  getConfig: () => MaybePromise<SkillSyncConfig | undefined>;
+  getCredentialToken: (
+    provider: SkillSyncProvider,
+    credentialKey: string,
+  ) => Promise<string | null>;
+  getCredentialSummary: (
+    provider: SkillSyncProvider,
+    credentialKey: string,
+  ) => Promise<SkillSyncCredentialSummary | null>;
+  listCredentials: (provider: SkillSyncProvider) => Promise<SkillSyncCredentialSummary[]>;
+  listStatuses: (provider: SkillSyncProvider) => Promise<ISkillSyncStatus[]>;
+  upsertStatus: (input: SkillSyncStatusInput) => Promise<ISkillSyncStatus>;
+  tryAcquireLock: (params: {
+    provider: SkillSyncProvider;
+    lockOwner: string;
+    leaseMs: number;
+    tenantId?: string;
+  }) => Promise<boolean>;
+  refreshLock: (params: {
+    provider: SkillSyncProvider;
+    lockOwner: string;
+    leaseMs: number;
+    tenantId?: string;
+  }) => Promise<boolean>;
+  releaseLock: (params: {
+    provider: SkillSyncProvider;
+    lockOwner: string;
+    tenantId?: string;
+  }) => Promise<void>;
+  createSkill: (data: CreateSkillInput) => Promise<CreateSkillResult>;
+  updateSkill: (params: {
+    id: string;
+    expectedVersion: number;
+    update: UpdateSkillInput;
+  }) => Promise<UpdateSkillResult>;
+  getSkillById: (id: string | Types.ObjectId) => Promise<(ISkill & { _id: Types.ObjectId }) | null>;
+  findSkillBySourceIdentity: (params: {
+    source: 'github' | 'notion';
+    upstreamId: string;
+    tenantId?: string;
+  }) => Promise<(ISkill & { _id: Types.ObjectId }) | null>;
+  listSkillsBySource: (params: {
+    source: 'github' | 'notion';
+    sourceId: string;
+  }) => Promise<Array<ISkill & { _id: Types.ObjectId }>>;
+  listSkillFiles: (
+    skillId: string | Types.ObjectId,
+  ) => Promise<Array<ISkillFile & { _id: Types.ObjectId }>>;
+  getSkillFileByPath: (
+    skillId: string | Types.ObjectId,
+    relativePath: string,
+  ) => Promise<(ISkillFile & { _id: Types.ObjectId }) | null>;
+  upsertSkillFile: (row: UpsertSkillFileInput) => Promise<ISkillFile & { _id: Types.ObjectId }>;
+  deleteSkillFile: (
+    skillId: string | Types.ObjectId,
+    relativePath: string,
+  ) => Promise<{ deleted: boolean }>;
+  deleteSkill: (id: string) => Promise<{ deleted: boolean }>;
+  saveBuffer: (params: {
+    userId: string;
+    buffer: Buffer;
+    fileName: string;
+    basePath?: string;
+    isImage?: boolean;
+    tenantId?: string;
+  }) => Promise<SaveBufferResult>;
+  deleteFile?: (file: {
+    filepath: string;
+    source: string;
+    storageKey?: string;
+    storageRegion?: string;
+    user?: Types.ObjectId | string;
+    tenantId?: string;
+  }) => Promise<void>;
+  grantPermission: (params: {
+    principalType: string;
+    principalId: string | Types.ObjectId | null;
+    resourceType: string;
+    resourceId: string | Types.ObjectId;
+    accessRoleId: string;
+    grantedBy: string | Types.ObjectId;
+  }) => Promise<unknown>;
+  fetchFn?: FetchFn;
+  lockOwner?: string;
+  allowServerCredentials?: boolean;
+};
+
+export type GitHubSkillSyncRunResult = {
+  status: 'started' | 'skipped' | 'completed' | 'failed';
+  message?: string;
+  sources: Array<ISkillSyncStatus & { credentialPresent?: boolean }>;
+};
+
+export type GitHubSkillSyncStatus = {
+  enabled: boolean;
+  intervalMinutes: number;
+  runOnStartup: boolean;
+  sources: Array<ISkillSyncStatus & { credentialPresent: boolean }>;
+  credentials: SkillSyncCredentialSummary[];
+  fineGrainedTokenRecommendation: string;
+};
+
+export type GitHubSkillSyncRunner = {
+  getStatus: () => Promise<GitHubSkillSyncStatus>;
+  runOnce: () => Promise<GitHubSkillSyncRunResult>;
+};
+
+class SkillSyncError extends Error {
+  code: string;
+
+  constructor(code: string, message: string) {
+    super(message);
+    this.name = 'SkillSyncError';
+    this.code = code;
+  }
+}
+
+function normalizeRepoPath(value: string): string {
+  const trimmed = value.trim().replace(/^\/+|\/+$/g, '');
+  return trimmed === '.' ? '' : trimmed;
+}
+
+function isSafeRelativePath(value: string): boolean {
+  if (!value || value.startsWith('/') || value.startsWith('\\')) {
+    return false;
+  }
+  if (!/^[a-zA-Z0-9._\-/]+$/.test(value)) {
+    return false;
+  }
+  return value.split('/').every((segment) => segment !== '' && segment !== '.' && segment !== '..');
+}
+
+function makeUpstreamId(source: SkillSyncGitHubSourceConfig, rootPath: string): string {
+  // Identity is keyed on the stable, admin-controlled source id and the skill's
+  // root path only — never owner/repo/ref. Repointing a source to a renamed or
+  // replacement repository (or rotating its ref) keeps the same upstream id, so
+  // existing mirrors are updated in place instead of being treated as new and
+  // colliding on the (name, author, tenantId) uniqueness constraint.
+  return `${source.id}:${rootPath}`;
+}
+
+function makeSourceAuthorId(source: SkillSyncGitHubSourceConfig): Types.ObjectId {
+  // Fold the tenant into the synthetic author so the same source mirrored into
+  // different tenants gets distinct author ids (clearer audits, no cross-tenant
+  // author collisions). The tenant suffix is omitted when absent so single-tenant
+  // author ids stay stable.
+  const seed = source.tenantId
+    ? `${PROVIDER}:${source.id}:${source.tenantId}`
+    : `${PROVIDER}:${source.id}`;
+  const digest = crypto.createHash('sha256').update(seed).digest('hex').slice(0, 24);
+  return new Types.ObjectId(digest);
+}
+
+function toSkillName(value: string): string {
+  const normalized = value
+    .toLowerCase()
+    .replace(/[^a-z0-9-]/g, '-')
+    .replace(/^-+|-+$/g, '')
+    .replace(/-{2,}/g, '-');
+  return normalized || 'github-skill';
+}
+
+function getFilename(relativePath: string): string {
+  return path.posix.basename(relativePath);
+}
+
+function guessMimeType(filename: string): string {
+  const ext = path.extname(filename).toLowerCase();
+  const mimeMap: Record<string, string> = {
+    '.md': 'text/markdown',
+    '.txt': 'text/plain',
+    '.js': 'application/javascript',
+    '.ts': 'text/typescript',
+    '.jsx': 'text/jsx',
+    '.tsx': 'text/tsx',
+    '.json': 'application/json',
+    '.yaml': 'text/yaml',
+    '.yml': 'text/yaml',
+    '.py': 'text/x-python',
+    '.sh': 'application/x-sh',
+    '.css': 'text/css',
+    '.html': 'text/html',
+    '.xml': 'application/xml',
+    '.csv': 'text/csv',
+    '.toml': 'text/toml',
+    '.ini': 'text/ini',
+    '.png': 'image/png',
+    '.jpg': 'image/jpeg',
+    '.jpeg': 'image/jpeg',
+    '.gif': 'image/gif',
+    '.svg': 'image/svg+xml',
+    '.webp': 'image/webp',
+    '.pdf': 'application/pdf',
+  };
+  return mimeMap[ext] ?? 'application/octet-stream';
+}
+
+function toCleanFrontmatter(
+  frontmatter: Record<string, unknown> | undefined,
+): Record<string, unknown> {
+  if (!frontmatter) {
+    return {};
+  }
+  const clean = { ...frontmatter };
+  delete clean.name;
+  delete clean.description;
+  // Drop a placeholder/non-boolean always-apply (e.g. `always-apply:` or
+  // `always-apply: # TODO`, which js-yaml yields as null). Apply the same
+  // cleanup to the accepted `alwaysApply` alias so a malformed alias does not
+  // survive after the canonical key has already supplied the effective flag.
+  // The boolean is already captured in the dedicated alwaysApply field, and
+  // persisting a null here would leave ambiguous/invalid frontmatter on the
+  // synced skill.
+  if ('always-apply' in clean && typeof clean['always-apply'] !== 'boolean') {
+    delete clean['always-apply'];
+  }
+  if ('alwaysApply' in clean && typeof clean.alwaysApply !== 'boolean') {
+    delete clean.alwaysApply;
+  }
+  return clean;
+}
+
+function getLimitMegabytes(bytes: number): number {
+  return Math.round(bytes / 1024 / 1024);
+}
+
+function assertGitHubBlobSize(entry: GitHubTreeEntry, relativePath: string): number {
+  if (typeof entry.size !== 'number' || !Number.isFinite(entry.size) || entry.size < 0) {
+    throw new SkillSyncError(
+      'GITHUB_BLOB_SIZE_UNKNOWN',
+      `GitHub file "${relativePath}" did not include a valid blob size`,
+    );
+  }
+  if (entry.size > DEFAULT_SKILL_IMPORT_LIMITS.maxSingleFileBytes) {
+    throw new SkillSyncError(
+      'GITHUB_BLOB_TOO_LARGE',
+      `GitHub file "${relativePath}" exceeds the ${getLimitMegabytes(
+        DEFAULT_SKILL_IMPORT_LIMITS.maxSingleFileBytes,
+      )}MB per-file skill import limit`,
+    );
+  }
+  return entry.size;
+}
+
+function assertGitHubBufferSize(buffer: Buffer, relativePath: string): void {
+  if (buffer.length <= DEFAULT_SKILL_IMPORT_LIMITS.maxSingleFileBytes) {
+    return;
+  }
+  throw new SkillSyncError(
+    'GITHUB_BLOB_TOO_LARGE',
+    `GitHub file "${relativePath}" exceeds the ${getLimitMegabytes(
+      DEFAULT_SKILL_IMPORT_LIMITS.maxSingleFileBytes,
+    )}MB per-file skill import limit`,
+  );
+}
+
+function assertCumulativeGitHubFileSize(totalBytes: number): void {
+  if (totalBytes <= DEFAULT_SKILL_IMPORT_LIMITS.maxDecompressedBytes) {
+    return;
+  }
+  throw new SkillSyncError(
+    'GITHUB_PACKAGE_TOO_LARGE',
+    `GitHub skill files exceed the ${getLimitMegabytes(
+      DEFAULT_SKILL_IMPORT_LIMITS.maxDecompressedBytes,
+    )}MB cumulative skill import limit`,
+  );
+}
+
+function assertGitHubEntryCount(discovered: DiscoveredSkill): void {
+  const entryCount = discovered.files.length + 1;
+  if (entryCount <= DEFAULT_SKILL_IMPORT_LIMITS.maxEntries) {
+    return;
+  }
+  throw new SkillSyncError(
+    'GITHUB_TOO_MANY_FILES',
+    `GitHub skill "${discovered.rootPath}" exceeds the ${DEFAULT_SKILL_IMPORT_LIMITS.maxEntries} file skill import limit`,
+  );
+}
+
+function getSkillMdPath(discovered: DiscoveredSkill): string {
+  return discovered.rootPath ? `${discovered.rootPath}/SKILL.md` : 'SKILL.md';
+}
+
+function getDiscoveredRelativePath(discovered: DiscoveredSkill, entry: GitHubTreeEntry): string {
+  const prefix = discovered.rootPath ? `${discovered.rootPath}/` : '';
+  const normalized = normalizeRepoPath(entry.path);
+  return prefix ? normalized.slice(prefix.length) : normalized;
+}
+
+function assertGitHubSkillPackageManifest(discovered: DiscoveredSkill): void {
+  assertGitHubEntryCount(discovered);
+  assertGitHubBlobSize(discovered.skillMd, getSkillMdPath(discovered));
+  let totalFileBytes = 0;
+  for (const entry of discovered.files) {
+    const relativePath = getDiscoveredRelativePath(discovered, entry);
+    if (!isSafeRelativePath(relativePath) || relativePath.toUpperCase() === 'SKILL.MD') {
+      continue;
+    }
+    totalFileBytes += assertGitHubBlobSize(entry, relativePath);
+    assertCumulativeGitHubFileSize(totalFileBytes);
+  }
+}
+
+function getSourceMetadataString(
+  row: { sourceMetadata?: Record<string, unknown> },
+  key: string,
+): string | undefined {
+  const metadata = row.sourceMetadata;
+  const value = metadata && typeof metadata === 'object' ? metadata[key] : undefined;
+  return typeof value === 'string' ? value : undefined;
+}
+
+function serializeDate(date: Date): string {
+  return date.toISOString();
+}
+
+function sanitizeError(error: unknown): { code: string; message: string } {
+  if (error instanceof SkillSyncError) {
+    return { code: error.code, message: error.message };
+  }
+  if (error instanceof Error) {
+    return {
+      code: 'SYNC_FAILED',
+      message: error.message.replace(/Bearer\s+\S+/gi, 'Bearer [redacted]'),
+    };
+  }
+  return { code: 'SYNC_FAILED', message: 'Unknown skill sync failure' };
+}
+
+function buildGitHubHeaders(token: string): HeadersInit {
+  return {
+    Accept: 'application/vnd.github+json',
+    Authorization: `Bearer ${token}`,
+    'X-GitHub-Api-Version': '2022-11-28',
+    'User-Agent': 'LibreChat-Skill-Sync',
+  };
+}
+
+function buildGitHubUrl(pathname: string): string {
+  return `${GITHUB_API_BASE}${pathname}`;
+}
+
+function encodeGitHubPath(value: string): string {
+  return value.split('/').map(encodeURIComponent).join('/');
+}
+
+async function readGitHubErrorMessage(response: Response): Promise<string | undefined> {
+  try {
+    const body = (await response.json()) as { message?: unknown };
+    return typeof body.message === 'string' ? body.message : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function isGitHubRateLimitResponse(params: {
+  status: number;
+  remaining: string | null;
+  retryAfter: string | null;
+  message?: string;
+}): boolean {
+  if (params.status === 429 || params.remaining === '0' || params.retryAfter) {
+    return true;
+  }
+  const message = params.message?.toLowerCase() ?? '';
+  return message.includes('rate limit') || message.includes('abuse detection');
+}
+
+async function githubJson<T>(params: {
+  fetchFn: FetchFn;
+  token: string;
+  pathname: string;
+}): Promise<T> {
+  const response = await params.fetchFn(buildGitHubUrl(params.pathname), {
+    headers: buildGitHubHeaders(params.token),
+  });
+  if (response.ok) {
+    return (await response.json()) as T;
+  }
+  const remaining = response.headers.get('x-ratelimit-remaining');
+  const retryAfter = response.headers.get('retry-after');
+  const message = await readGitHubErrorMessage(response);
+  if (response.status === 401 || response.status === 403 || response.status === 429) {
+    const code = isGitHubRateLimitResponse({
+      status: response.status,
+      remaining,
+      retryAfter,
+      message,
+    })
+      ? 'GITHUB_RATE_LIMITED'
+      : 'GITHUB_AUTH_FAILED';
+    throw new SkillSyncError(code, `GitHub request failed with HTTP ${response.status}`);
+  }
+  if (response.status === 404) {
+    throw new SkillSyncError('GITHUB_NOT_FOUND', 'GitHub repository, ref, or path was not found');
+  }
+  throw new SkillSyncError(
+    'GITHUB_REQUEST_FAILED',
+    `GitHub request failed with HTTP ${response.status}`,
+  );
+}
+
+async function fetchCommit(params: {
+  fetchFn: FetchFn;
+  token: string;
+  source: SkillSyncGitHubSourceConfig;
+}): Promise<GitHubCommitResponse> {
+  const owner = encodeURIComponent(params.source.owner);
+  const repo = encodeURIComponent(params.source.repo);
+  const ref = encodeGitHubPath(params.source.ref);
+  return githubJson<GitHubCommitResponse>({
+    fetchFn: params.fetchFn,
+    token: params.token,
+    pathname: `/repos/${owner}/${repo}/commits/${ref}`,
+  });
+}
+
+async function fetchTree(params: {
+  fetchFn: FetchFn;
+  token: string;
+  source: SkillSyncGitHubSourceConfig;
+  treeSha: string;
+  recursive?: boolean;
+}): Promise<GitHubTreeResponse> {
+  const owner = encodeURIComponent(params.source.owner);
+  const repo = encodeURIComponent(params.source.repo);
+  const treeSha = encodeURIComponent(params.treeSha);
+  const recursive = params.recursive ?? true;
+  return githubJson<GitHubTreeResponse>({
+    fetchFn: params.fetchFn,
+    token: params.token,
+    pathname: `/repos/${owner}/${repo}/git/trees/${treeSha}${recursive ? '?recursive=1' : ''}`,
+  });
+}
+
+async function fetchTreeAtPath(params: {
+  fetchFn: FetchFn;
+  token: string;
+  source: SkillSyncGitHubSourceConfig;
+  rootTreeSha: string;
+  repoPath: string;
+  assertNotCancelled: AssertNotCancelled;
+}): Promise<GitHubTreeEntry[]> {
+  const normalizedPath = normalizeRepoPath(params.repoPath);
+  let treeSha = params.rootTreeSha;
+  if (normalizedPath) {
+    for (const segment of normalizedPath.split('/')) {
+      params.assertNotCancelled();
+      const tree = await fetchTree({
+        fetchFn: params.fetchFn,
+        token: params.token,
+        source: params.source,
+        treeSha,
+        recursive: false,
+      });
+      params.assertNotCancelled();
+      if (tree.truncated) {
+        throw new SkillSyncError('GITHUB_TREE_TRUNCATED', 'GitHub tree response was truncated');
+      }
+      const next = tree.tree.find((entry) => entry.type === 'tree' && entry.path === segment);
+      if (!next) {
+        throw new SkillSyncError(
+          'GITHUB_PATH_NOT_FOUND',
+          `Configured GitHub skill path "${normalizedPath}" was not found`,
+        );
+      }
+      treeSha = next.sha;
+    }
+  }
+
+  params.assertNotCancelled();
+  const tree = await fetchTree({
+    fetchFn: params.fetchFn,
+    token: params.token,
+    source: params.source,
+    treeSha,
+    recursive: true,
+  });
+  params.assertNotCancelled();
+  if (tree.truncated) {
+    throw new SkillSyncError('GITHUB_TREE_TRUNCATED', 'GitHub tree response was truncated');
+  }
+  if (!normalizedPath) {
+    return tree.tree;
+  }
+  return tree.tree.map((entry) => ({
+    ...entry,
+    path: `${normalizedPath}/${normalizeRepoPath(entry.path)}`,
+  }));
+}
+
+async function fetchConfiguredTreeEntries(params: {
+  fetchFn: FetchFn;
+  token: string;
+  source: SkillSyncGitHubSourceConfig;
+  rootTreeSha: string;
+  assertNotCancelled: AssertNotCancelled;
+}): Promise<GitHubTreeEntry[]> {
+  const entriesByPath = new Map<string, GitHubTreeEntry>();
+  for (const repoPath of params.source.paths) {
+    const entries = await fetchTreeAtPath({ ...params, repoPath });
+    for (const entry of entries) {
+      const normalizedPath = normalizeRepoPath(entry.path);
+      entriesByPath.set(normalizedPath, { ...entry, path: normalizedPath });
+    }
+  }
+  return [...entriesByPath.values()];
+}
+
+async function fetchBlob(params: {
+  fetchFn: FetchFn;
+  token: string;
+  source: SkillSyncGitHubSourceConfig;
+  sha: string;
+}): Promise<Buffer> {
+  const owner = encodeURIComponent(params.source.owner);
+  const repo = encodeURIComponent(params.source.repo);
+  const sha = encodeURIComponent(params.sha);
+  const blob = await githubJson<GitHubBlobResponse>({
+    fetchFn: params.fetchFn,
+    token: params.token,
+    pathname: `/repos/${owner}/${repo}/git/blobs/${sha}`,
+  });
+  if (blob.encoding !== 'base64') {
+    throw new SkillSyncError(
+      'GITHUB_UNSUPPORTED_BLOB',
+      `Unsupported GitHub blob encoding "${blob.encoding}"`,
+    );
+  }
+  return Buffer.from(blob.content.replace(/\s/g, ''), 'base64');
+}
+
+function isSkillRootWithinDiscoveryDepth(
+  rootPath: string,
+  basePath: string,
+  maxDepth: number,
+): boolean {
+  if (rootPath === basePath) {
+    return true;
+  }
+  if (basePath && !rootPath.startsWith(`${basePath}/`)) {
+    return false;
+  }
+  const relative = basePath ? rootPath.slice(basePath.length).replace(/^\/+/, '') : rootPath;
+  if (!relative) {
+    return true;
+  }
+  return relative.split('/').length <= maxDepth;
+}
+
+function discoverSkills(
+  tree: GitHubTreeEntry[],
+  source: SkillSyncGitHubSourceConfig,
+): DiscoveredSkill[] {
+  const basePaths = source.paths.map(normalizeRepoPath);
+  const skillDiscoveryDepth = source.skillDiscoveryDepth ?? SKILL_SYNC_DEFAULT_DISCOVERY_DEPTH;
+  const skillMdByRoot = new Map<string, GitHubTreeEntry>();
+  for (const entry of tree) {
+    if (entry.type !== 'blob') {
+      continue;
+    }
+    const normalized = normalizeRepoPath(entry.path);
+    const basename = path.posix.basename(normalized);
+    if (basename.toUpperCase() !== 'SKILL.MD') {
+      continue;
+    }
+    const parent = normalizeRepoPath(path.posix.dirname(normalized));
+    for (const basePath of basePaths) {
+      if (isSkillRootWithinDiscoveryDepth(parent, basePath, skillDiscoveryDepth)) {
+        skillMdByRoot.set(parent, entry);
+      }
+    }
+  }
+
+  const skillRoots = [...skillMdByRoot.keys()];
+  return [...skillMdByRoot.entries()].map(([rootPath, skillMd]) => {
+    const prefix = rootPath ? `${rootPath}/` : '';
+    const childSkillRoots = skillRoots.filter((candidate) => {
+      if (!candidate || candidate === rootPath) {
+        return false;
+      }
+      return rootPath ? candidate.startsWith(`${rootPath}/`) : true;
+    });
+    const files = tree.filter((entry) => {
+      if (entry.type !== 'blob') {
+        return false;
+      }
+      const normalized = normalizeRepoPath(entry.path);
+      if (!normalized.startsWith(prefix) || normalized === skillMd.path) {
+        return false;
+      }
+      if (childSkillRoots.some((childRoot) => normalized.startsWith(`${childRoot}/`))) {
+        return false;
+      }
+      const relativePath = prefix ? normalized.slice(prefix.length) : normalized;
+      return isSafeRelativePath(relativePath) && relativePath.toUpperCase() !== 'SKILL.MD';
+    });
+    return { rootPath, skillMd, files };
+  });
+}
+
+function assertConfiguredPathsExist(
+  tree: GitHubTreeEntry[],
+  source: SkillSyncGitHubSourceConfig,
+): void {
+  for (const configuredPath of source.paths.map(normalizeRepoPath)) {
+    if (configuredPath === '') {
+      continue;
+    }
+    const exists = tree.some((entry) => {
+      const entryPath = normalizeRepoPath(entry.path);
+      return entryPath === configuredPath || entryPath.startsWith(`${configuredPath}/`);
+    });
+    if (!exists) {
+      throw new SkillSyncError(
+        'GITHUB_PATH_NOT_FOUND',
+        `Configured GitHub skill path "${configuredPath}" was not found`,
+      );
+    }
+  }
+}
+
+function makeStatusInput(params: {
+  source: SkillSyncGitHubSourceConfig;
+  status: SkillSyncStatusInput['status'];
+  startedAt?: Date;
+  finishedAt?: Date;
+  errorCode?: string;
+  errorMessage?: string;
+  counts?: Partial<SyncCounters>;
+}): SkillSyncStatusInput {
+  return {
+    provider: PROVIDER,
+    sourceId: params.source.id,
+    tenantId: params.source.tenantId,
+    status: params.status,
+    credentialKey: params.source.credentialKey,
+    owner: params.source.owner,
+    repo: params.source.repo,
+    ref: params.source.ref,
+    paths: params.source.paths,
+    startedAt: params.startedAt,
+    finishedAt: params.finishedAt,
+    errorCode: params.errorCode,
+    errorMessage: params.errorMessage,
+    syncedSkillCount: params.counts?.syncedSkillCount ?? 0,
+    syncedFileCount: params.counts?.syncedFileCount ?? 0,
+    deletedSkillCount: params.counts?.deletedSkillCount ?? 0,
+    deletedFileCount: params.counts?.deletedFileCount ?? 0,
+  };
+}
+
+function makeStatusKey(sourceId: string, tenantId?: string): string {
+  return `${tenantId ?? ''}:${sourceId}`;
+}
+
+async function ensurePublicViewer(
+  deps: GitHubSkillSyncDeps,
+  skillId: Types.ObjectId,
+): Promise<void> {
+  await deps.grantPermission({
+    principalType: PrincipalType.PUBLIC,
+    principalId: null,
+    resourceType: ResourceType.SKILL,
+    resourceId: skillId,
+    accessRoleId: AccessRoleIds.SKILL_VIEWER,
+    grantedBy: SYSTEM_AUTHOR_ID,
+  });
+}
+
+async function prepareRemoteSkill(params: {
+  deps: GitHubSkillSyncDeps;
+  source: SkillSyncGitHubSourceConfig;
+  discovered: DiscoveredSkill;
+  skillMdContent: string;
+  commitSha: string;
+  syncedAt: Date;
+}): Promise<PreparedRemoteSkill> {
+  const { deps, source, discovered, skillMdContent, commitSha, syncedAt } = params;
+  const parsed = parseSkillMarkdown(skillMdContent);
+  if (parsed.parseError) {
+    throw new SkillSyncError(
+      'SKILL_PARSE_FAILED',
+      `${discovered.rootPath}/SKILL.md contains invalid YAML frontmatter: ${parsed.parseError}`,
+    );
+  }
+  if (parsed.invalidBooleans.length > 0) {
+    throw new SkillSyncError(
+      'SKILL_PARSE_FAILED',
+      `${discovered.rootPath}/SKILL.md contains invalid boolean frontmatter`,
+    );
+  }
+  const upstreamId = makeUpstreamId(source, discovered.rootPath);
+  const fallbackName = toSkillName(path.posix.basename(discovered.rootPath) || source.id);
+  const sourceMetadata = {
+    provider: PROVIDER,
+    sourceId: source.id,
+    upstreamId,
+    owner: source.owner,
+    repo: source.repo,
+    ref: source.ref,
+    skillPath: discovered.rootPath,
+    commitSha,
+    skillBlobSha: discovered.skillMd.sha,
+    syncedAt: serializeDate(syncedAt),
+    syncStatus: 'synced',
+  };
+  const update: UpdateSkillInput = {
+    name: parsed.name || fallbackName,
+    description: parsed.description || parsed.name || fallbackName,
+    body: skillMdContent,
+    frontmatter: toCleanFrontmatter(parsed.frontmatter),
+    alwaysApply: parsed.alwaysApply,
+    source: PROVIDER,
+    sourceMetadata,
+  };
+  const sourceTenantId = source.tenantId ?? undefined;
+  const foundExisting = await deps.findSkillBySourceIdentity({
+    source: PROVIDER,
+    upstreamId,
+    tenantId: sourceTenantId,
+  });
+  const existing =
+    foundExisting && (foundExisting.tenantId ?? undefined) === sourceTenantId
+      ? foundExisting
+      : null;
+  const createInput: CreateSkillInput = {
+    ...(update as Omit<UpdateSkillInput, 'source'>),
+    name: update.name ?? fallbackName,
+    description: update.description ?? fallbackName,
+    author: makeSourceAuthorId(source),
+    authorName: SYSTEM_AUTHOR_NAME,
+    source: PROVIDER,
+    tenantId: source.tenantId,
+  };
+  return { existing, update, createInput };
+}
+
+async function commitRemoteSkill(
+  deps: GitHubSkillSyncDeps,
+  prepared: PreparedRemoteSkill,
+): Promise<UpsertRemoteSkillResult> {
+  if (prepared.existing) {
+    const result = await deps.updateSkill({
+      id: prepared.existing._id.toString(),
+      expectedVersion: prepared.existing.version,
+      update: prepared.update,
+    });
+    if (result.status === 'updated') {
+      return { skill: result.skill, created: false };
+    }
+    if (result.status === 'conflict') {
+      throw new SkillSyncError(
+        'SKILL_CONFLICT',
+        `Skill "${prepared.existing.name}" changed during sync`,
+      );
+    }
+    throw new SkillSyncError(
+      'SKILL_NOT_FOUND',
+      `Previously synced skill "${prepared.existing.name}" was removed`,
+    );
+  }
+  const created = await deps.createSkill(prepared.createInput);
+  return { skill: created.skill, created: true };
+}
+
+/**
+ * File sync bumps the parent skill's `version` (via file upserts/deletes) but
+ * never changes its authored content, so we must re-read to get past our own
+ * version bumps. A plain re-read would also silently accept and overwrite a
+ * concurrent external edit; compare the refreshed content against the pre-sync
+ * snapshot and treat a changed body/name/description/always-apply as a conflict.
+ */
+function hasExternalSkillEdit(before: ISkill, after: ISkill): boolean {
+  return (
+    before.body !== after.body ||
+    before.name !== after.name ||
+    before.description !== after.description ||
+    (before.alwaysApply ?? false) !== (after.alwaysApply ?? false) ||
+    JSON.stringify(before.frontmatter ?? {}) !== JSON.stringify(after.frontmatter ?? {})
+  );
+}
+
+async function commitExistingRemoteSkillAfterFileSync(
+  deps: GitHubSkillSyncDeps,
+  prepared: PreparedExistingRemoteSkill,
+  options: { forceCommit?: boolean } = {},
+): Promise<UpsertRemoteSkillResult> {
+  const refreshed = await deps.getSkillById(prepared.existing._id);
+  if (!refreshed) {
+    throw new SkillSyncError(
+      'SKILL_NOT_FOUND',
+      `Previously synced skill "${prepared.existing.name}" was removed`,
+    );
+  }
+  if (hasExternalSkillEdit(prepared.existing, refreshed)) {
+    throw new SkillSyncError(
+      'SKILL_CONFLICT',
+      `Skill "${prepared.existing.name}" was modified during sync`,
+    );
+  }
+  if (!options.forceCommit && !hasRemoteSkillDefinitionChanged(prepared.update, refreshed)) {
+    return { skill: refreshed, created: false };
+  }
+  return commitRemoteSkill(deps, { ...prepared, existing: refreshed });
+}
+
+async function cleanupFile(deps: GitHubSkillSyncDeps, file: StoredSkillFileRef): Promise<void> {
+  if (!deps.deleteFile) {
+    return;
+  }
+  await deps.deleteFile({
+    filepath: file.filepath,
+    source: file.source,
+    storageKey: file.storageKey,
+    storageRegion: file.storageRegion,
+    user: file.author,
+    tenantId: file.tenantId,
+  });
+}
+
+function toStoredFileRef(params: {
+  saved: SaveBufferResult;
+  author: Types.ObjectId;
+  tenantId?: string;
+}): StoredSkillFileRef {
+  return {
+    filepath: params.saved.filepath,
+    source: params.saved.source,
+    storageKey: params.saved.storageKey,
+    storageRegion: params.saved.storageRegion,
+    author: params.author,
+    tenantId: params.tenantId,
+  };
+}
+
+function toSkillFileInput(file: ISkillFile & { _id: Types.ObjectId }): UpsertSkillFileInput {
+  return {
+    skillId: file.skillId,
+    relativePath: file.relativePath,
+    file_id: file.file_id,
+    filename: file.filename,
+    filepath: file.filepath,
+    storageKey: file.storageKey,
+    storageRegion: file.storageRegion,
+    source: file.source,
+    sourceMetadata: file.sourceMetadata,
+    mimeType: file.mimeType,
+    bytes: file.bytes,
+    isExecutable: file.isExecutable,
+    author: file.author,
+    tenantId: file.tenantId,
+  };
+}
+
+function toCreateSkillInput(skill: ISkill & { _id: Types.ObjectId }): CreateSkillInput {
+  return {
+    name: skill.name,
+    displayTitle: skill.displayTitle,
+    description: skill.description,
+    body: skill.body,
+    frontmatter: skill.frontmatter,
+    category: skill.category,
+    author: skill.author,
+    authorName: skill.authorName,
+    source: PROVIDER,
+    sourceMetadata: skill.sourceMetadata,
+    alwaysApply: skill.alwaysApply,
+    tenantId: skill.tenantId,
+  };
+}
+
+function toStoredFileRefFromSkillFile(
+  file: ISkillFile & { _id: Types.ObjectId },
+): StoredSkillFileRef {
+  return {
+    filepath: file.filepath,
+    source: file.source,
+    storageKey: file.storageKey,
+    storageRegion: file.storageRegion,
+    author: file.author,
+    tenantId: file.tenantId,
+  };
+}
+
+function getStoredFileKey(file: StoredSkillFileRef): string {
+  return [file.source, file.filepath, file.storageKey ?? '', file.storageRegion ?? ''].join(':');
+}
+
+async function cleanupStoredFiles(params: {
+  deps: GitHubSkillSyncDeps;
+  files: StoredSkillFileRef[];
+  logMessage: string;
+}): Promise<void> {
+  const seen = new Set<string>();
+  for (const file of params.files) {
+    const key = getStoredFileKey(file);
+    if (seen.has(key)) {
+      continue;
+    }
+    seen.add(key);
+    await cleanupFile(params.deps, file).catch((cleanupError) =>
+      logger.error(params.logMessage, cleanupError),
+    );
+  }
+}
+
+async function restoreExistingSkillFiles(params: {
+  deps: GitHubSkillSyncDeps;
+  skill: ISkill & { _id: Types.ObjectId };
+  previousFiles: Array<ISkillFile & { _id: Types.ObjectId }>;
+  savedFiles: StoredSkillFileRef[];
+}): Promise<void> {
+  const { deps, skill, previousFiles, savedFiles } = params;
+  const previousByPath = new Map(previousFiles.map((file) => [file.relativePath, file]));
+  const currentFiles = await deps.listSkillFiles(skill._id);
+
+  for (const file of currentFiles) {
+    if (previousByPath.has(file.relativePath)) {
+      continue;
+    }
+    await deps.deleteSkillFile(skill._id, file.relativePath);
+  }
+  for (const file of previousFiles) {
+    await deps.upsertSkillFile(toSkillFileInput(file));
+  }
+  await cleanupStoredFiles({
+    deps,
+    files: savedFiles,
+    logMessage: '[GitHubSkillSync] Failed to clean up rolled-back synced file:',
+  });
+}
+
+async function deleteSyncedSkillForRestore(
+  deps: GitHubSkillSyncDeps,
+  skill: ISkill & { _id: Types.ObjectId },
+): Promise<{ deletedFileCount: number; deletedSkill: DeletedSyncedSkillJournal }> {
+  const files = await deps.listSkillFiles(skill._id);
+  await deps.deleteSkill(skill._id.toString());
+  return {
+    deletedFileCount: files.length,
+    deletedSkill: { skill, files },
+  };
+}
+
+async function restoreDeletedSyncedSkill(
+  deps: GitHubSkillSyncDeps,
+  deleted: DeletedSyncedSkillJournal,
+): Promise<void> {
+  const restored = await deps.createSkill(toCreateSkillInput(deleted.skill));
+  for (const file of deleted.files) {
+    await deps.upsertSkillFile({
+      ...toSkillFileInput(file),
+      skillId: restored.skill._id,
+    });
+  }
+  await ensurePublicViewer(deps, restored.skill._id);
+}
+
+async function cleanupDeletedSyncedSkillFiles(
+  deps: GitHubSkillSyncDeps,
+  deleted: DeletedSyncedSkillJournal,
+): Promise<void> {
+  await cleanupStoredFiles({
+    deps,
+    files: deleted.files.map(toStoredFileRefFromSkillFile),
+    logMessage: '[GitHubSkillSync] Failed to clean up deleted stale mirrored skill file:',
+  });
+}
+
+function comparableSourceMetadata(metadata: Record<string, unknown> | undefined): string {
+  const { commitSha: _commitSha, syncedAt: _syncedAt, ...rest } = metadata ?? {};
+  return JSON.stringify(rest);
+}
+
+function hasRemoteSkillDefinitionChanged(update: UpdateSkillInput, existing: ISkill): boolean {
+  return (
+    update.body !== existing.body ||
+    update.name !== existing.name ||
+    update.description !== existing.description ||
+    (update.alwaysApply ?? false) !== (existing.alwaysApply ?? false) ||
+    JSON.stringify(update.frontmatter ?? {}) !== JSON.stringify(existing.frontmatter ?? {}) ||
+    comparableSourceMetadata(update.sourceMetadata) !==
+      comparableSourceMetadata(existing.sourceMetadata)
+  );
+}
+
+function findMovedSourceSkill(params: {
+  source: SkillSyncGitHubSourceConfig;
+  prepared: PreparedRemoteSkill;
+  existingSyncedSkills: Array<ISkill & { _id: Types.ObjectId }>;
+  excludedUpstreamIds: Set<string>;
+}): (ISkill & { _id: Types.ObjectId }) | null {
+  const sourceTenantId = params.source.tenantId ?? undefined;
+  const sourceAuthor = params.prepared.createInput.author.toString();
+  const name = params.prepared.createInput.name;
+
+  return (
+    params.existingSyncedSkills.find((skill) => {
+      if ((skill.tenantId ?? undefined) !== sourceTenantId) {
+        return false;
+      }
+      if (skill.name !== name || skill.author.toString() !== sourceAuthor) {
+        return false;
+      }
+      const upstreamId = getSourceMetadataString(skill, 'upstreamId');
+      if (!upstreamId) {
+        return false;
+      }
+      return !params.excludedUpstreamIds.has(upstreamId);
+    }) ?? null
+  );
+}
+
+function hasNameConflictingStaleSkill(params: {
+  source: SkillSyncGitHubSourceConfig;
+  prepared: PreparedDiscoveredSkill;
+  existingSyncedSkills: Array<ISkill & { _id: Types.ObjectId }>;
+  discoveredUpstreamIds: Set<string>;
+}): boolean {
+  return Boolean(
+    findMovedSourceSkill({
+      source: params.source,
+      prepared: params.prepared.prepared,
+      existingSyncedSkills: params.existingSyncedSkills,
+      excludedUpstreamIds: params.discoveredUpstreamIds,
+    }),
+  );
+}
+
+function orderPreparedSkillsForSafeStaleDeletes(params: {
+  source: SkillSyncGitHubSourceConfig;
+  preparedSkills: PreparedDiscoveredSkill[];
+  existingSyncedSkills: Array<ISkill & { _id: Types.ObjectId }>;
+  discoveredUpstreamIds: Set<string>;
+}): PreparedDiscoveredSkill[] {
+  const regular: PreparedDiscoveredSkill[] = [];
+  const nameConflicting: PreparedDiscoveredSkill[] = [];
+  for (const prepared of params.preparedSkills) {
+    if (
+      prepared.prepared.existing &&
+      hasNameConflictingStaleSkill({
+        source: params.source,
+        prepared,
+        existingSyncedSkills: params.existingSyncedSkills,
+        discoveredUpstreamIds: params.discoveredUpstreamIds,
+      })
+    ) {
+      nameConflicting.push(prepared);
+      continue;
+    }
+    regular.push(prepared);
+  }
+  return [...regular, ...nameConflicting];
+}
+
+function getMirrorNameKey(params: {
+  tenantId?: string;
+  author: string;
+  name: string | undefined;
+}): string {
+  return `${params.tenantId ?? ''}:${params.author}:${params.name ?? ''}`;
+}
+
+function assertNoDuplicatePreparedSkillNames(
+  source: SkillSyncGitHubSourceConfig,
+  preparedSkills: PreparedDiscoveredSkill[],
+): void {
+  const sourceTenantId = source.tenantId ?? undefined;
+  const seen = new Map<string, string>();
+  for (const { discovered, prepared } of preparedSkills) {
+    const key = getMirrorNameKey({
+      tenantId: sourceTenantId,
+      author: prepared.createInput.author.toString(),
+      name: prepared.createInput.name,
+    });
+    if (seen.has(key)) {
+      throw new SkillSyncError(
+        'DUPLICATE_SKILL_NAME',
+        `GitHub source "${source.id}" contains multiple skills named "${prepared.createInput.name}"`,
+      );
+    }
+    seen.set(key, discovered.rootPath);
+  }
+}
+
+async function deleteNameConflictingStaleSkill(params: {
+  deps: GitHubSkillSyncDeps;
+  source: SkillSyncGitHubSourceConfig;
+  prepared: PreparedRemoteSkill;
+  existingSyncedSkills: Array<ISkill & { _id: Types.ObjectId }>;
+  discoveredUpstreamIds: Set<string>;
+  assertNotCancelled: AssertNotCancelled;
+}): Promise<{
+  remainingSkills: Array<ISkill & { _id: Types.ObjectId }>;
+  deletedSkillCount: number;
+  deletedFileCount: number;
+  deletedSkill?: DeletedSyncedSkillJournal;
+}> {
+  const staleSkill = findMovedSourceSkill({
+    source: params.source,
+    prepared: params.prepared,
+    existingSyncedSkills: params.existingSyncedSkills,
+    excludedUpstreamIds: params.discoveredUpstreamIds,
+  });
+  if (!staleSkill) {
+    return {
+      remainingSkills: params.existingSyncedSkills,
+      deletedSkillCount: 0,
+      deletedFileCount: 0,
+    };
+  }
+
+  params.assertNotCancelled();
+  const { deletedFileCount, deletedSkill } = await deleteSyncedSkillForRestore(
+    params.deps,
+    staleSkill,
+  );
+  const staleSkillId = staleSkill._id.toString();
+
+  return {
+    remainingSkills: params.existingSyncedSkills.filter(
+      (skill) => skill._id.toString() !== staleSkillId,
+    ),
+    deletedSkillCount: 1,
+    deletedFileCount,
+    deletedSkill,
+  };
+}
+
+async function syncSkillFiles(params: {
+  deps: GitHubSkillSyncDeps;
+  token: string;
+  source: SkillSyncGitHubSourceConfig;
+  skill: ISkill & { _id: Types.ObjectId };
+  discovered: DiscoveredSkill;
+  commitSha: string;
+  fetchFn: FetchFn;
+  assertNotCancelled: AssertNotCancelled;
+  journal?: SyncSkillFilesJournal;
+}): Promise<SyncSkillFilesResult> {
+  const { deps, token, source, skill, discovered, commitSha, fetchFn, assertNotCancelled } = params;
+  const journal = params.journal ?? { staleFiles: [], savedFiles: [] };
+  const remotePaths = new Set<string>();
+  let syncedFileCount = 0;
+  let deletedFileCount = 0;
+  let totalFileBytes = 0;
+
+  for (const entry of discovered.files) {
+    assertNotCancelled();
+    const relativePath = getDiscoveredRelativePath(discovered, entry);
+    if (!isSafeRelativePath(relativePath) || relativePath.toUpperCase() === 'SKILL.MD') {
+      continue;
+    }
+    totalFileBytes += assertGitHubBlobSize(entry, relativePath);
+    assertCumulativeGitHubFileSize(totalFileBytes);
+    remotePaths.add(relativePath);
+    const existing = await deps.getSkillFileByPath(skill._id, relativePath);
+    if (existing && getSourceMetadataString(existing, 'blobSha') === entry.sha) {
+      continue;
+    }
+    const buffer = await fetchBlob({ fetchFn, token, source, sha: entry.sha });
+    assertNotCancelled();
+    assertGitHubBufferSize(buffer, relativePath);
+    const fileId = crypto.randomUUID();
+    const filename = getFilename(relativePath);
+    const mimeType = guessMimeType(filename);
+    const saved = await deps.saveBuffer({
+      userId: skill.author.toString(),
+      buffer,
+      fileName: `${fileId}__${filename}`,
+      basePath: 'uploads',
+      isImage: mimeType.startsWith('image/'),
+      tenantId: skill.tenantId,
+    });
+    const savedFile = toStoredFileRef({ saved, author: skill.author, tenantId: skill.tenantId });
+    try {
+      await deps.upsertSkillFile({
+        skillId: skill._id,
+        relativePath,
+        file_id: fileId,
+        filename,
+        filepath: saved.filepath,
+        storageKey: saved.storageKey,
+        storageRegion: saved.storageRegion,
+        source: saved.source,
+        sourceMetadata: {
+          provider: PROVIDER,
+          sourceId: source.id,
+          upstreamId: makeUpstreamId(source, discovered.rootPath),
+          commitSha,
+          blobSha: entry.sha,
+          path: entry.path,
+        },
+        mimeType,
+        bytes: buffer.length,
+        isExecutable: false,
+        author: skill.author,
+        tenantId: skill.tenantId,
+      });
+    } catch (error) {
+      await cleanupFile(deps, savedFile).catch((cleanupError) =>
+        logger.error('[GitHubSkillSync] Failed to clean up orphaned synced file:', cleanupError),
+      );
+      throw error;
+    }
+    syncedFileCount++;
+    journal.savedFiles.push(savedFile);
+    if (existing && existing.filepath !== saved.filepath) {
+      journal.staleFiles.push(existing);
+    }
+  }
+
+  const existingFiles = await deps.listSkillFiles(skill._id);
+  for (const file of existingFiles) {
+    assertNotCancelled();
+    if (remotePaths.has(file.relativePath)) {
+      continue;
+    }
+    const result = await deps.deleteSkillFile(skill._id, file.relativePath);
+    if (result.deleted) {
+      deletedFileCount++;
+      journal.staleFiles.push(file);
+    }
+  }
+  return { syncedFileCount, deletedFileCount, ...journal };
+}
+
+async function deleteSyncedSkill(
+  deps: GitHubSkillSyncDeps,
+  skill: ISkill & { _id: Types.ObjectId },
+): Promise<number> {
+  const files = await deps.listSkillFiles(skill._id);
+  let deletedFiles = 0;
+  for (const file of files) {
+    await cleanupFile(deps, file).catch((cleanupError) =>
+      logger.error('[GitHubSkillSync] Failed to clean up mirrored skill file:', cleanupError),
+    );
+    deletedFiles++;
+  }
+  await deps.deleteSkill(skill._id.toString());
+  return deletedFiles;
+}
+
+function getTokenEnvVarName(tokenReference: string | undefined): string | null {
+  const match = tokenReference?.trim().match(/^\$\{([A-Za-z_][A-Za-z0-9_]*)\}$/);
+  return match?.[1] ?? null;
+}
+
+async function resolveGitHubToken(
+  deps: GitHubSkillSyncDeps,
+  source: SkillSyncGitHubSourceConfig,
+): Promise<string | null> {
+  if (deps.allowServerCredentials === false) {
+    return null;
+  }
+  const tokenEnvVar = getTokenEnvVarName(source.token);
+  if (tokenEnvVar) {
+    return process.env[tokenEnvVar]?.trim() || null;
+  }
+  if (!source.credentialKey) {
+    return null;
+  }
+  return deps.getCredentialToken(PROVIDER, source.credentialKey);
+}
+
+function getMissingCredentialMessage(
+  source: SkillSyncGitHubSourceConfig,
+  allowServerCredentials: boolean,
+): string {
+  if (!allowServerCredentials) {
+    return 'Server GitHub credentials are not available for this skill sync config';
+  }
+  const tokenEnvVar = getTokenEnvVarName(source.token);
+  if (tokenEnvVar) {
+    return `Missing GitHub token environment variable "${tokenEnvVar}"`;
+  }
+  return `Missing GitHub credential "${source.credentialKey ?? source.id}"`;
+}
+
+async function syncSource(params: {
+  deps: GitHubSkillSyncDeps;
+  source: SkillSyncGitHubSourceConfig;
+  fetchFn: FetchFn;
+  assertNotCancelled: AssertNotCancelled;
+}): Promise<ISkillSyncStatus> {
+  const { deps, source, fetchFn, assertNotCancelled } = params;
+  const startedAt = new Date();
+  await deps.upsertStatus(makeStatusInput({ source, status: 'running', startedAt }));
+  try {
+    assertNotCancelled();
+    const allowServerCredentials = deps.allowServerCredentials !== false;
+    const token = await resolveGitHubToken(deps, source);
+    assertNotCancelled();
+    if (!token) {
+      throw new SkillSyncError(
+        'MISSING_CREDENTIAL',
+        getMissingCredentialMessage(source, allowServerCredentials),
+      );
+    }
+    const commit = await fetchCommit({ fetchFn, token, source });
+    assertNotCancelled();
+    const treeEntries = await fetchConfiguredTreeEntries({
+      fetchFn,
+      token,
+      source,
+      rootTreeSha: commit.commit.tree.sha,
+      assertNotCancelled,
+    });
+    assertConfiguredPathsExist(treeEntries, source);
+    const discoveredSkills = discoverSkills(treeEntries, source);
+    const seenUpstreamIds = new Set<string>();
+    let existingSyncedSkills: Array<ISkill & { _id: Types.ObjectId }> | null = null;
+    const getExistingSyncedSkills = async () => {
+      if (!existingSyncedSkills) {
+        existingSyncedSkills = await deps.listSkillsBySource({
+          source: PROVIDER,
+          sourceId: source.id,
+        });
+      }
+      return existingSyncedSkills;
+    };
+    const counts: SyncCounters = {
+      syncedSkillCount: 0,
+      syncedFileCount: 0,
+      deletedSkillCount: 0,
+      deletedFileCount: 0,
+    };
+    const syncedAt = new Date();
+    const preparedSkills: PreparedDiscoveredSkill[] = [];
+
+    for (const discovered of discoveredSkills) {
+      assertNotCancelled();
+      assertGitHubSkillPackageManifest(discovered);
+      const skillMdPath = getSkillMdPath(discovered);
+      const skillMdBuffer = await fetchBlob({
+        fetchFn,
+        token,
+        source,
+        sha: discovered.skillMd.sha,
+      });
+      assertNotCancelled();
+      assertGitHubBufferSize(skillMdBuffer, skillMdPath);
+      const prepared = await prepareRemoteSkill({
+        deps,
+        source,
+        discovered,
+        skillMdContent: skillMdBuffer.toString('utf-8'),
+        commitSha: commit.sha,
+        syncedAt,
+      });
+      preparedSkills.push({ discovered, prepared });
+    }
+
+    const discoveredUpstreamIds = new Set(
+      preparedSkills.map(({ discovered }) => makeUpstreamId(source, discovered.rootPath)),
+    );
+    assertNoDuplicatePreparedSkillNames(source, preparedSkills);
+    const orderedPreparedSkills = orderPreparedSkillsForSafeStaleDeletes({
+      source,
+      preparedSkills,
+      existingSyncedSkills: await getExistingSyncedSkills(),
+      discoveredUpstreamIds,
+    });
+
+    for (const { discovered, prepared } of orderedPreparedSkills) {
+      assertNotCancelled();
+      const movedExisting = prepared.existing
+        ? null
+        : findMovedSourceSkill({
+            source,
+            prepared,
+            existingSyncedSkills: await getExistingSyncedSkills(),
+            excludedUpstreamIds: discoveredUpstreamIds,
+          });
+      const effectivePrepared: PreparedRemoteSkill = movedExisting
+        ? { ...prepared, existing: movedExisting }
+        : prepared;
+      seenUpstreamIds.add(makeUpstreamId(source, discovered.rootPath));
+      if (effectivePrepared.existing) {
+        // Check for an external edit before mutating files, so a concurrently
+        // edited skill fails fast without leaving its bundled files partially
+        // rewritten to the upstream version. The post-file-sync check below
+        // still guards edits that land during the file sync itself.
+        const beforeFileSync = await deps.getSkillById(effectivePrepared.existing._id);
+        if (!beforeFileSync) {
+          throw new SkillSyncError(
+            'SKILL_NOT_FOUND',
+            `Previously synced skill "${effectivePrepared.existing.name}" was removed`,
+          );
+        }
+        if (hasExternalSkillEdit(effectivePrepared.existing, beforeFileSync)) {
+          throw new SkillSyncError(
+            'SKILL_CONFLICT',
+            `Skill "${effectivePrepared.existing.name}" was modified during sync`,
+          );
+        }
+        await ensurePublicViewer(deps, effectivePrepared.existing._id);
+        const previousFiles = await deps.listSkillFiles(effectivePrepared.existing._id);
+        const journal: SyncSkillFilesJournal = { staleFiles: [], savedFiles: [] };
+        let fileCounts: SyncSkillFilesResult;
+        let staleConflictCleanup:
+          | Awaited<ReturnType<typeof deleteNameConflictingStaleSkill>>
+          | undefined;
+        try {
+          fileCounts = await syncSkillFiles({
+            deps,
+            token,
+            source,
+            skill: effectivePrepared.existing,
+            discovered,
+            commitSha: commit.sha,
+            fetchFn,
+            assertNotCancelled,
+            journal,
+          });
+          if (prepared.existing) {
+            staleConflictCleanup = await deleteNameConflictingStaleSkill({
+              deps,
+              source,
+              prepared: effectivePrepared,
+              existingSyncedSkills: await getExistingSyncedSkills(),
+              discoveredUpstreamIds,
+              assertNotCancelled,
+            });
+            existingSyncedSkills = staleConflictCleanup.remainingSkills;
+            counts.deletedSkillCount += staleConflictCleanup.deletedSkillCount;
+            counts.deletedFileCount += staleConflictCleanup.deletedFileCount;
+          }
+          await commitExistingRemoteSkillAfterFileSync(
+            deps,
+            {
+              ...effectivePrepared,
+              existing: effectivePrepared.existing,
+            },
+            { forceCommit: fileCounts.syncedFileCount > 0 || fileCounts.deletedFileCount > 0 },
+          );
+        } catch (error) {
+          await restoreExistingSkillFiles({
+            deps,
+            skill: effectivePrepared.existing,
+            previousFiles,
+            savedFiles: journal.savedFiles,
+          }).catch((cleanupError) =>
+            logger.error(
+              '[GitHubSkillSync] Failed to restore existing skill files after sync failure:',
+              cleanupError,
+            ),
+          );
+          if (staleConflictCleanup?.deletedSkill) {
+            await restoreDeletedSyncedSkill(deps, staleConflictCleanup.deletedSkill).catch(
+              (cleanupError) =>
+                logger.error(
+                  '[GitHubSkillSync] Failed to restore stale mirrored skill after sync failure:',
+                  cleanupError,
+                ),
+            );
+          }
+          throw error;
+        }
+        await cleanupStoredFiles({
+          deps,
+          files: fileCounts.staleFiles,
+          logMessage: '[GitHubSkillSync] Failed to clean up replaced synced file:',
+        });
+        if (staleConflictCleanup?.deletedSkill) {
+          await cleanupDeletedSyncedSkillFiles(deps, staleConflictCleanup.deletedSkill);
+        }
+        counts.syncedSkillCount++;
+        counts.syncedFileCount += fileCounts.syncedFileCount;
+        counts.deletedFileCount += fileCounts.deletedFileCount;
+        continue;
+      }
+
+      const upserted = await commitRemoteSkill(deps, effectivePrepared);
+      const { skill } = upserted;
+      try {
+        const fileCounts = await syncSkillFiles({
+          deps,
+          token,
+          source,
+          skill,
+          discovered,
+          commitSha: commit.sha,
+          fetchFn,
+          assertNotCancelled,
+        });
+        await ensurePublicViewer(deps, skill._id);
+        counts.syncedSkillCount++;
+        counts.syncedFileCount += fileCounts.syncedFileCount;
+        counts.deletedFileCount += fileCounts.deletedFileCount;
+      } catch (error) {
+        await deleteSyncedSkill(deps, skill).catch((cleanupError) =>
+          logger.error(
+            '[GitHubSkillSync] Failed to roll back partially synced skill:',
+            cleanupError,
+          ),
+        );
+        throw error;
+      }
+    }
+
+    const currentSyncedSkills = await deps.listSkillsBySource({
+      source: PROVIDER,
+      sourceId: source.id,
+    });
+    // Only mirror-delete skills owned by this source's tenant. With no
+    // configured tenantId under non-strict isolation, listSkillsBySource can
+    // return github skills across tenants, so without this guard an ambient sync
+    // could delete another tenant's mirrored skills. Absent tenantId is its own
+    // (ambient) bucket.
+    const sourceTenantId = source.tenantId ?? undefined;
+    for (const skill of currentSyncedSkills) {
+      assertNotCancelled();
+      if ((skill.tenantId ?? undefined) !== sourceTenantId) {
+        continue;
+      }
+      const upstreamId =
+        skill.sourceMetadata && typeof skill.sourceMetadata.upstreamId === 'string'
+          ? skill.sourceMetadata.upstreamId
+          : '';
+      if (seenUpstreamIds.has(upstreamId)) {
+        continue;
+      }
+      counts.deletedFileCount += await deleteSyncedSkill(deps, skill);
+      counts.deletedSkillCount++;
+    }
+
+    return deps.upsertStatus(
+      makeStatusInput({
+        source,
+        status: 'succeeded',
+        startedAt,
+        finishedAt: new Date(),
+        counts,
+      }),
+    );
+  } catch (error) {
+    const sanitized = sanitizeError(error);
+    logger.error(`[GitHubSkillSync] Source "${source.id}" failed: ${sanitized.message}`);
+    return deps.upsertStatus(
+      makeStatusInput({
+        source,
+        status: 'failed',
+        startedAt,
+        finishedAt: new Date(),
+        errorCode: sanitized.code,
+        errorMessage: sanitized.message,
+      }),
+    );
+  }
+}
+
+/**
+ * Runs a source sync inside its tenant's async context when `tenantId` is set,
+ * so the tenant-isolation mongoose hooks scope every skill/file/ACL read and
+ * write to that tenant (required under strict isolation). Storage writes also
+ * receive the tenant explicitly via `skill.tenantId`. Without a configured
+ * tenant the sync runs in the ambient context, preserving single-tenant behavior.
+ *
+ * The callback is `async` per the tenant-context contract so the ALS store
+ * propagates across every awaited Mongoose operation in `syncSource`.
+ */
+function syncSourceInTenantContext(params: {
+  deps: GitHubSkillSyncDeps;
+  source: SkillSyncGitHubSourceConfig;
+  fetchFn: FetchFn;
+  assertNotCancelled: AssertNotCancelled;
+}): Promise<ISkillSyncStatus> {
+  if (!params.source.tenantId) {
+    return syncSource(params);
+  }
+  return tenantStorage.run({ tenantId: params.source.tenantId }, async () => syncSource(params));
+}
+
+function getGithubConfig(config: SkillSyncConfig | undefined): {
+  enabled: boolean;
+  intervalMinutes: number;
+  runOnStartup: boolean;
+  sources: SkillSyncGitHubSourceConfig[];
+} {
+  return {
+    enabled: config?.github?.enabled ?? false,
+    intervalMinutes: config?.github?.intervalMinutes ?? 60,
+    runOnStartup: config?.github?.runOnStartup ?? false,
+    sources:
+      config?.github?.sources.map((source) => ({
+        ...source,
+        skillDiscoveryDepth: source.skillDiscoveryDepth ?? SKILL_SYNC_DEFAULT_DISCOVERY_DEPTH,
+      })) ?? [],
+  };
+}
+
+export function createGitHubSkillSyncRunner(deps: GitHubSkillSyncDeps): GitHubSkillSyncRunner {
+  const fetchFn = deps.fetchFn ?? fetch;
+  const lockOwnerPrefix = deps.lockOwner ?? `${process.pid}`;
+
+  async function getStatus(): Promise<GitHubSkillSyncStatus> {
+    const github = getGithubConfig(await deps.getConfig());
+    const allowServerCredentials = deps.allowServerCredentials !== false;
+    const [storedStatuses, credentials] = await Promise.all([
+      deps.listStatuses(PROVIDER),
+      allowServerCredentials ? deps.listCredentials(PROVIDER) : Promise.resolve([]),
+    ]);
+    const statusBySourceId = new Map(
+      storedStatuses.map((status) => [makeStatusKey(status.sourceId, status.tenantId), status]),
+    );
+    const credentialByKey = new Map(
+      credentials.map((credential) => [credential.credentialKey, credential]),
+    );
+    const sources = github.sources.map((source) => {
+      const stored = statusBySourceId.get(makeStatusKey(source.id, source.tenantId));
+      const credential =
+        allowServerCredentials && source.credentialKey
+          ? credentialByKey.get(source.credentialKey)
+          : null;
+      const tokenEnvVar = getTokenEnvVarName(source.token);
+      const envTokenPresent =
+        allowServerCredentials && tokenEnvVar ? Boolean(process.env[tokenEnvVar]?.trim()) : false;
+      return {
+        provider: PROVIDER,
+        sourceId: source.id,
+        tenantId: source.tenantId,
+        status: stored?.status ?? 'idle',
+        credentialKey: source.credentialKey,
+        credentialPresent: envTokenPresent || Boolean(credential),
+        owner: source.owner,
+        repo: source.repo,
+        ref: source.ref,
+        paths: source.paths,
+        startedAt: stored?.startedAt,
+        finishedAt: stored?.finishedAt,
+        lastSuccessAt: stored?.lastSuccessAt,
+        lastFailureAt: stored?.lastFailureAt,
+        errorCode: stored?.errorCode,
+        errorMessage: stored?.errorMessage,
+        syncedSkillCount: stored?.syncedSkillCount ?? 0,
+        syncedFileCount: stored?.syncedFileCount ?? 0,
+        deletedSkillCount: stored?.deletedSkillCount ?? 0,
+        deletedFileCount: stored?.deletedFileCount ?? 0,
+        createdAt: stored?.createdAt,
+        updatedAt: stored?.updatedAt,
+      } satisfies ISkillSyncStatus & { credentialPresent: boolean };
+    });
+    return {
+      enabled: github.enabled,
+      intervalMinutes: github.intervalMinutes,
+      runOnStartup: github.runOnStartup,
+      sources,
+      credentials,
+      fineGrainedTokenRecommendation: GITHUB_FINE_GRAINED_TOKEN_RECOMMENDATION,
+    };
+  }
+
+  async function runOnce(): Promise<GitHubSkillSyncRunResult> {
+    const github = getGithubConfig(await deps.getConfig());
+    if (!github.enabled || github.sources.length === 0) {
+      return { status: 'skipped', message: 'GitHub skill sync is disabled', sources: [] };
+    }
+    const allowServerCredentials = deps.allowServerCredentials !== false;
+    if (!allowServerCredentials) {
+      const status = await getStatus();
+      if (!status.sources.some((source) => source.credentialPresent)) {
+        return {
+          status: 'skipped',
+          message: 'GitHub skill sync credentials are not available for this runner',
+          sources: status.sources,
+        };
+      }
+    }
+    const lockOwner = `${lockOwnerPrefix}:${crypto.randomUUID().replace(/-/g, '').slice(0, 12)}`;
+    const acquired = await deps.tryAcquireLock({
+      provider: PROVIDER,
+      lockOwner,
+      leaseMs: LOCK_LEASE_MS,
+    });
+    if (!acquired) {
+      const status = await getStatus();
+      return {
+        status: 'skipped',
+        message: 'GitHub skill sync is already running',
+        sources: status.sources,
+      };
+    }
+    let lockLost = false;
+    const assertNotCancelled = () => {
+      if (lockLost) {
+        throw new SkillSyncError('SYNC_LOCK_LOST', 'GitHub skill sync lock was lost');
+      }
+    };
+    const refreshTimer = setInterval(
+      () => {
+        deps
+          .refreshLock({
+            provider: PROVIDER,
+            lockOwner,
+            leaseMs: LOCK_LEASE_MS,
+          })
+          .then((refreshed) => {
+            if (!refreshed) {
+              lockLost = true;
+              logger.warn('[GitHubSkillSync] Failed to refresh active sync lock');
+            }
+          })
+          .catch((error) => {
+            lockLost = true;
+            logger.error('[GitHubSkillSync] Failed to refresh active sync lock:', error);
+          });
+      },
+      Math.max(60_000, Math.floor(LOCK_LEASE_MS / 3)),
+    );
+    refreshTimer.unref?.();
+    try {
+      const sources: ISkillSyncStatus[] = [];
+      for (const source of github.sources) {
+        if (lockLost) {
+          break;
+        }
+        sources.push(
+          await syncSourceInTenantContext({ deps, source, fetchFn, assertNotCancelled }),
+        );
+      }
+      const failed = sources.some((source) => source.status === 'failed');
+      return {
+        status: failed || lockLost ? 'failed' : 'completed',
+        message: lockLost ? 'GitHub skill sync lock was lost' : undefined,
+        sources,
+      };
+    } finally {
+      clearInterval(refreshTimer);
+      await deps.releaseLock({ provider: PROVIDER, lockOwner });
+    }
+  }
+
+  return { getStatus, runOnce };
+}
diff --git a/packages/api/src/skills/sync/index.ts b/packages/api/src/skills/sync/index.ts
new file mode 100644
index 00000000000..8cfe4a506b3
--- /dev/null
+++ b/packages/api/src/skills/sync/index.ts
@@ -0,0 +1,3 @@
+export * from './github';
+export * from './orchestrator';
+export * from './scheduler';
diff --git a/packages/api/src/skills/sync/orchestrator.spec.ts b/packages/api/src/skills/sync/orchestrator.spec.ts
new file mode 100644
index 00000000000..c86359e966f
--- /dev/null
+++ b/packages/api/src/skills/sync/orchestrator.spec.ts
@@ -0,0 +1,416 @@
+import type { SkillSyncConfig } from 'librechat-data-provider';
+import type { SkillSyncTriggerRunnerFactoryInput } from './orchestrator';
+import type { GitHubSkillSyncRunner } from './github';
+import { createSkillSyncTriggerOrchestrator } from './orchestrator';
+
+type RunnerStatus = Awaited<ReturnType<GitHubSkillSyncRunner['getStatus']>>;
+type RunnerRunResult = Awaited<ReturnType<GitHubSkillSyncRunner['runOnce']>>;
+
+const source = {
+  id: 'tenant-skills',
+  owner: 'LibreChat',
+  repo: 'skills',
+  ref: 'main',
+  paths: ['skills'],
+  token: '${GITHUB_SKILLS_TOKEN}',
+  tenantId: 'other-tenant',
+};
+
+function skillSync(
+  overrides: Partial<NonNullable<SkillSyncConfig>['github']> = {},
+): SkillSyncConfig {
+  return {
+    github: {
+      enabled: true,
+      intervalMinutes: 60,
+      runOnStartup: true,
+      sources: [source],
+      ...overrides,
+    },
+  };
+}
+
+function statusFromConfig(
+  config: SkillSyncConfig | undefined,
+  { allowServerCredentials = true }: { allowServerCredentials?: boolean } = {},
+): RunnerStatus {
+  const github = config?.github;
+  return {
+    enabled: github?.enabled ?? false,
+    intervalMinutes: github?.intervalMinutes ?? 60,
+    runOnStartup: github?.runOnStartup ?? false,
+    sources:
+      github?.sources.map((configuredSource) => ({
+        provider: 'github',
+        sourceId: configuredSource.id,
+        tenantId: configuredSource.tenantId,
+        status: 'idle',
+        credentialKey: configuredSource.credentialKey,
+        credentialPresent:
+          allowServerCredentials &&
+          Boolean(configuredSource.credentialKey || configuredSource.token),
+        owner: configuredSource.owner,
+        repo: configuredSource.repo,
+        ref: configuredSource.ref,
+        paths: configuredSource.paths,
+        syncedSkillCount: 0,
+        syncedFileCount: 0,
+        deletedSkillCount: 0,
+        deletedFileCount: 0,
+        errorCode: undefined,
+        errorMessage: undefined,
+        startedAt: undefined,
+        finishedAt: undefined,
+        lastSuccessAt: undefined,
+        lastFailureAt: undefined,
+        createdAt: undefined,
+        updatedAt: undefined,
+      })) ?? [],
+    credentials: [],
+    fineGrainedTokenRecommendation: 'Use a GitHub fine-grained personal access token.',
+  };
+}
+
+function withRunnableCredentials(status: RunnerStatus): RunnerStatus {
+  return {
+    ...status,
+    sources: status.sources.map((configuredSource) => ({
+      ...configuredSource,
+      credentialPresent: true,
+    })),
+  };
+}
+
+function completedRun(): RunnerRunResult {
+  return { status: 'completed', sources: [] };
+}
+
+function deferred<T>() {
+  let resolve!: (value: T) => void;
+  const promise = new Promise<T>((res) => {
+    resolve = res;
+  });
+  return { promise, resolve };
+}
+
+async function flushPromises() {
+  await Promise.resolve();
+  await Promise.resolve();
+}
+
+function createHarness(
+  options: {
+    status?: RunnerStatus;
+    runOnce?: () => Promise<RunnerRunResult>;
+  } = {},
+) {
+  const runners: Array<{
+    input: SkillSyncTriggerRunnerFactoryInput;
+    runner: GitHubSkillSyncRunner;
+  }> = [];
+  const logger = {
+    warn: jest.fn(),
+    error: jest.fn(),
+  };
+  const createRunner = jest.fn((input: SkillSyncTriggerRunnerFactoryInput) => {
+    const runner: GitHubSkillSyncRunner = {
+      getStatus: jest.fn(
+        async () =>
+          options.status ??
+          statusFromConfig(await input.getConfig(), {
+            allowServerCredentials: input.allowServerCredentials !== false,
+          }),
+      ),
+      runOnce: jest.fn(options.runOnce ?? (async () => completedRun())),
+    };
+    runners.push({ input, runner });
+    return runner;
+  });
+  const orchestrator = createSkillSyncTriggerOrchestrator({
+    createRunner,
+    logger,
+  });
+  return { createRunner, logger, orchestrator, runners };
+}
+
+describe('createSkillSyncTriggerOrchestrator', () => {
+  it('starts request sync from resolved admin skillSync config and derives tenant from the request', async () => {
+    const config = skillSync();
+    const { orchestrator, runners } = createHarness({
+      status: withRunnableCredentials(statusFromConfig(config)),
+    });
+
+    const started = await orchestrator.maybeRunForRequest({
+      config: { skillSync: config, config: {} },
+      user: { tenantId: 'tenant-a' },
+    });
+
+    const requestConfig = await runners[0].input.getConfig();
+    expect(started).toBe(true);
+    expect(runners[0].input.allowServerCredentials).toBe(false);
+    expect(runners[0].runner.runOnce).toHaveBeenCalledTimes(1);
+    expect(requestConfig?.github?.runOnStartup).toBe(false);
+    expect(requestConfig?.github?.sources[0]).toEqual(
+      expect.objectContaining({ id: 'tenant-skills', tenantId: 'tenant-a' }),
+    );
+  });
+
+  it('does not auto-start request sync when only server credentials are configured', async () => {
+    const config = skillSync();
+    const { orchestrator, runners } = createHarness();
+
+    const started = await orchestrator.maybeRunForRequest({
+      config: { skillSync: config, config: {} },
+      user: { tenantId: 'tenant-a' },
+    });
+
+    expect(started).toBe(false);
+    expect(runners[0].input.allowServerCredentials).toBe(false);
+    expect(runners[0].runner.runOnce).not.toHaveBeenCalled();
+  });
+
+  it('starts request sync with server credentials when the caller opts in', async () => {
+    const config = skillSync();
+    const { orchestrator, runners } = createHarness();
+
+    const started = await orchestrator.maybeRunForRequest({
+      config: { skillSync: config, config: {} },
+      user: { tenantId: 'tenant-a' },
+      skillSyncAllowServerCredentials: true,
+    });
+
+    expect(started).toBe(true);
+    expect(runners[0].input.allowServerCredentials).toBe(true);
+    expect(runners[0].runner.runOnce).toHaveBeenCalledTimes(1);
+  });
+
+  it('does not start request sync for base YAML skillSync config', async () => {
+    const config = skillSync();
+    const { createRunner, orchestrator } = createHarness();
+
+    const started = await orchestrator.maybeRunForRequest({
+      config: { skillSync: config, config: { skillSync: config } },
+      user: { tenantId: 'tenant-a' },
+    });
+
+    expect(started).toBe(false);
+    expect(createRunner).not.toHaveBeenCalled();
+  });
+
+  it('creates an admin request runner from resolved config without disabling startup runs', async () => {
+    const config = skillSync();
+    const { orchestrator, runners } = createHarness();
+
+    const runner = orchestrator.getRunnerForAdminRequest({
+      config: { skillSync: config, config: {} },
+      user: { tenantId: 'tenant-a' },
+      skillSyncAllowServerCredentials: true,
+    });
+    const runnerConfig = await runners[0].input.getConfig();
+
+    expect(runner).toBe(runners[0].runner);
+    expect(runners[0].input.allowServerCredentials).toBe(true);
+    expect(runnerConfig?.github?.runOnStartup).toBe(true);
+    expect(runnerConfig?.github?.sources[0]).toEqual(
+      expect.objectContaining({ id: 'tenant-skills', tenantId: 'tenant-a' }),
+    );
+  });
+
+  it('preserves configured tenant scope for platform admin override runners', async () => {
+    const config = skillSync();
+    const { orchestrator, runners } = createHarness();
+
+    orchestrator.getRunnerForAdminRequest({
+      config: { skillSync: config, config: {} },
+      user: {},
+      skillSyncAllowServerCredentials: true,
+    });
+    const runnerConfig = await runners[0].input.getConfig();
+
+    expect(runnerConfig?.github?.runOnStartup).toBe(true);
+    expect(runnerConfig?.github?.sources[0]).toEqual(
+      expect.objectContaining({ id: 'tenant-skills', tenantId: 'other-tenant' }),
+    );
+  });
+
+  it('preserves configured tenant scope for admin base skillSync runs', async () => {
+    const config = skillSync();
+    const { orchestrator, runners } = createHarness();
+
+    orchestrator.getRunnerForAdminRequest({
+      config: { skillSync: config, config: { skillSync: config } },
+      user: { tenantId: 'tenant-a' },
+      skillSyncAllowServerCredentials: true,
+    });
+    const runnerConfig = await runners[0].input.getConfig();
+
+    expect(runnerConfig?.github?.runOnStartup).toBe(true);
+    expect(runnerConfig?.github?.sources[0]).toEqual(
+      expect.objectContaining({ id: 'tenant-skills', tenantId: 'other-tenant' }),
+    );
+  });
+
+  it('filters admin base skillSync status sources without rewriting unscoped sources', async () => {
+    const config = skillSync({
+      sources: [
+        {
+          ...source,
+          id: 'tenant-a-source',
+          tenantId: 'tenant-a',
+        },
+        {
+          ...source,
+          id: 'tenant-b-source',
+          tenantId: 'tenant-b',
+        },
+        {
+          id: 'shared-source',
+          owner: 'LibreChat',
+          repo: 'skills',
+          ref: 'main',
+          paths: ['skills'],
+          token: '${GITHUB_SKILLS_TOKEN}',
+        },
+      ],
+    });
+    const { orchestrator, runners } = createHarness();
+
+    orchestrator.getRunnerForAdminRequest({
+      config: { skillSync: config, config: { skillSync: config } },
+      user: { tenantId: 'tenant-a' },
+      skillSyncAllowServerCredentials: false,
+    });
+    const runnerConfig = await runners[0].input.getConfig();
+
+    expect(runnerConfig?.github?.sources).toEqual([
+      expect.objectContaining({ id: 'tenant-a-source', tenantId: 'tenant-a' }),
+      expect.objectContaining({ id: 'shared-source', tenantId: undefined }),
+    ]);
+  });
+
+  it('filters inherited base sources when admin override changes non-source fields', async () => {
+    const baseSources = [
+      {
+        ...source,
+        id: 'tenant-a-source',
+        tenantId: 'tenant-a',
+      },
+      {
+        ...source,
+        id: 'tenant-b-source',
+        tenantId: 'tenant-b',
+      },
+      {
+        id: 'shared-source',
+        owner: 'LibreChat',
+        repo: 'skills',
+        ref: 'main',
+        paths: ['skills'],
+        token: '${GITHUB_SKILLS_TOKEN}',
+      },
+    ];
+    const base = skillSync({ intervalMinutes: 60, sources: baseSources });
+    const resolved = skillSync({ intervalMinutes: 30, sources: baseSources });
+    const { orchestrator, runners } = createHarness();
+
+    orchestrator.getRunnerForAdminRequest({
+      config: { skillSync: resolved, config: { skillSync: base } },
+      user: { tenantId: 'tenant-a' },
+      skillSyncAllowServerCredentials: false,
+    });
+    const runnerConfig = await runners[0].input.getConfig();
+
+    expect(runnerConfig?.github?.intervalMinutes).toBe(30);
+    expect(runnerConfig?.github?.sources).toEqual([
+      expect.objectContaining({ id: 'tenant-a-source', tenantId: 'tenant-a' }),
+      expect.objectContaining({ id: 'shared-source', tenantId: undefined }),
+    ]);
+  });
+
+  it('does not allow admin override runners to use server credentials by default', async () => {
+    const config = skillSync();
+    const { orchestrator, runners } = createHarness();
+
+    orchestrator.getRunnerForAdminRequest({
+      config: { skillSync: config, config: {} },
+      user: { tenantId: 'tenant-a' },
+    });
+
+    expect(runners[0].input.allowServerCredentials).toBe(false);
+  });
+
+  it('does not start request sync when the configured source is already running', async () => {
+    const config = skillSync({ runOnStartup: false });
+    const { orchestrator, runners } = createHarness({
+      status: {
+        ...statusFromConfig(config),
+        sources: [
+          {
+            ...statusFromConfig(config).sources[0],
+            status: 'running',
+            startedAt: new Date(),
+          },
+        ],
+      },
+    });
+
+    const started = await orchestrator.maybeRunForRequest({
+      config: { skillSync: config, config: {} },
+      user: { tenantId: 'tenant-a' },
+    });
+
+    expect(started).toBe(false);
+    expect(runners[0].runner.runOnce).not.toHaveBeenCalled();
+  });
+
+  it('retries request sync when a running source status is stale', async () => {
+    const config = skillSync({ runOnStartup: false });
+    const { orchestrator, runners } = createHarness({
+      status: {
+        ...statusFromConfig(config),
+        sources: [
+          {
+            ...statusFromConfig(config).sources[0],
+            status: 'running',
+            credentialPresent: true,
+            startedAt: new Date(Date.now() - 40 * 60 * 1000),
+          },
+        ],
+      },
+    });
+
+    const started = await orchestrator.maybeRunForRequest({
+      config: { skillSync: config, config: {} },
+      user: { tenantId: 'tenant-a' },
+    });
+
+    expect(started).toBe(true);
+    expect(runners[0].runner.runOnce).toHaveBeenCalledTimes(1);
+  });
+
+  it('suppresses duplicate request sync while an equivalent run is in flight', async () => {
+    const pendingRun = deferred<RunnerRunResult>();
+    const config = skillSync({ runOnStartup: false });
+    const { orchestrator, runners } = createHarness({
+      status: withRunnableCredentials(statusFromConfig(config)),
+      runOnce: () => pendingRun.promise,
+    });
+
+    const first = await orchestrator.maybeRunForRequest({
+      config: { skillSync: config, config: {} },
+      user: { tenantId: 'tenant-a' },
+    });
+    const second = await orchestrator.maybeRunForRequest({
+      config: { skillSync: config, config: {} },
+      user: { tenantId: 'tenant-a' },
+    });
+
+    pendingRun.resolve(completedRun());
+    await flushPromises();
+
+    expect(first).toBe(true);
+    expect(second).toBe(false);
+    expect(runners).toHaveLength(1);
+    expect(runners[0].runner.runOnce).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/packages/api/src/skills/sync/orchestrator.ts b/packages/api/src/skills/sync/orchestrator.ts
new file mode 100644
index 00000000000..5181799f05a
--- /dev/null
+++ b/packages/api/src/skills/sync/orchestrator.ts
@@ -0,0 +1,302 @@
+import { skillSyncConfigSchema } from 'librechat-data-provider';
+import type { SkillSyncConfig } from 'librechat-data-provider';
+import type { GitHubSkillSyncRunner } from './github';
+
+const REQUEST_SYNC_MIN_INTERVAL_MS = 5 * 60 * 1000;
+const REQUEST_SYNC_STALE_RUNNING_MS = 35 * 60 * 1000;
+
+type MaybePromise<T> = T | Promise<T>;
+
+export type SkillSyncAppConfigLike = {
+  skillSync?: unknown;
+  config?: {
+    skillSync?: unknown;
+  };
+};
+
+export type SkillSyncRequestUser = {
+  tenantId?: string | null;
+};
+
+export type SkillSyncRequestLike = {
+  config?: SkillSyncAppConfigLike;
+  user?: SkillSyncRequestUser;
+  skillSyncAllowServerCredentials?: boolean;
+};
+
+type ResolvedSkillSyncConfig = NonNullable<SkillSyncConfig>;
+type ResolvedGitHubSkillSyncConfig = NonNullable<ResolvedSkillSyncConfig['github']>;
+type SkillSyncConfigWithGitHub = ResolvedSkillSyncConfig & {
+  github: ResolvedGitHubSkillSyncConfig;
+};
+
+type SkillSyncRunnerStatus = Awaited<ReturnType<GitHubSkillSyncRunner['getStatus']>>;
+
+type SkillSyncTriggerLogger = {
+  warn: (message: string, metadata?: object) => void;
+  error: (message: string, error?: unknown) => void;
+};
+
+export type SkillSyncTriggerRunnerFactoryInput = {
+  getConfig: () => MaybePromise<SkillSyncConfig | undefined>;
+  loadAppConfig: () => MaybePromise<SkillSyncAppConfigLike | undefined>;
+  allowServerCredentials?: boolean;
+};
+
+export type SkillSyncTriggerOrchestratorDeps = {
+  createRunner: (input: SkillSyncTriggerRunnerFactoryInput) => GitHubSkillSyncRunner;
+  logger: SkillSyncTriggerLogger;
+  minIntervalMs?: number;
+  staleRunningMs?: number;
+  inFlight?: Set<string>;
+};
+
+export type SkillSyncTriggerOrchestrator = {
+  getRunnerForAdminRequest: (request: SkillSyncRequestLike) => GitHubSkillSyncRunner;
+  maybeRunForRequest: (request: SkillSyncRequestLike) => Promise<boolean>;
+};
+
+function parseSkillSyncConfig(
+  raw: unknown,
+  logger: SkillSyncTriggerLogger,
+): SkillSyncConfig | undefined {
+  if (!raw || typeof raw !== 'object') {
+    return undefined;
+  }
+  const parsed = skillSyncConfigSchema.safeParse(raw);
+  if (!parsed.success) {
+    logger.warn('[GitHubSkillSync] Ignoring invalid skill sync config', {
+      issues: parsed.error.flatten(),
+    });
+    return undefined;
+  }
+  return parsed.data;
+}
+
+function hasGitHubConfig(config: SkillSyncConfig | undefined): config is SkillSyncConfigWithGitHub {
+  return Boolean(config?.github);
+}
+
+function isSameSkillSyncConfig(
+  left: SkillSyncConfig | undefined,
+  right: SkillSyncConfig | undefined,
+) {
+  return JSON.stringify(left ?? null) === JSON.stringify(right ?? null);
+}
+
+function getRequestTenantId(user: SkillSyncRequestUser | undefined): string | undefined {
+  return typeof user?.tenantId === 'string' && user.tenantId ? user.tenantId : undefined;
+}
+
+function withRequestTenant(
+  config: SkillSyncConfigWithGitHub,
+  user: SkillSyncRequestUser | undefined,
+  { disableRunOnStartup = false }: { disableRunOnStartup?: boolean } = {},
+): SkillSyncConfig {
+  const tenantId = getRequestTenantId(user);
+  return {
+    ...config,
+    github: {
+      ...config.github,
+      ...(disableRunOnStartup ? { runOnStartup: false } : {}),
+      sources: config.github.sources.map((source) => ({
+        ...source,
+        // Tenant-scoped requests derive their tenant from the request; platform
+        // requests have no tenant and preserve an explicitly configured source.
+        tenantId: tenantId ?? source.tenantId,
+      })),
+    },
+  };
+}
+
+function isSameGitHubSource(
+  left: ResolvedGitHubSkillSyncConfig['sources'][number] | undefined,
+  right: ResolvedGitHubSkillSyncConfig['sources'][number] | undefined,
+): boolean {
+  return JSON.stringify(left ?? null) === JSON.stringify(right ?? null);
+}
+
+function withAdminReadableTenantScope(
+  config: SkillSyncConfigWithGitHub,
+  user: SkillSyncRequestUser | undefined,
+  base: SkillSyncConfigWithGitHub | undefined,
+): SkillSyncConfig {
+  const tenantId = getRequestTenantId(user);
+  const baseSourceById = new Map(base?.github.sources.map((source) => [source.id, source]) ?? []);
+  const sources = tenantId
+    ? config.github.sources.flatMap((source) => {
+        const baseSource = baseSourceById.get(source.id);
+        if (isSameGitHubSource(source, baseSource)) {
+          if (source.tenantId && source.tenantId !== tenantId) {
+            return [];
+          }
+          return [{ ...source, tenantId: source.tenantId ? tenantId : undefined }];
+        }
+        if (source.tenantId && source.tenantId !== tenantId) {
+          return [];
+        }
+        return [{ ...source, tenantId }];
+      })
+    : [];
+  return {
+    ...config,
+    github: {
+      ...config.github,
+      sources,
+    },
+  };
+}
+
+function getRequestSkillSyncConfig(
+  appConfig: SkillSyncAppConfigLike | undefined,
+  user: SkillSyncRequestUser | undefined,
+  logger: SkillSyncTriggerLogger,
+): SkillSyncConfig | undefined {
+  const resolved = parseSkillSyncConfig(appConfig?.skillSync, logger);
+  if (
+    !hasGitHubConfig(resolved) ||
+    !resolved.github.enabled ||
+    resolved.github.sources.length === 0
+  ) {
+    return undefined;
+  }
+
+  const base = parseSkillSyncConfig(appConfig?.config?.skillSync, logger);
+  if (isSameSkillSyncConfig(resolved, base)) {
+    return undefined;
+  }
+
+  return withRequestTenant(resolved, user, { disableRunOnStartup: true });
+}
+
+function getAdminRequestSkillSyncConfig(
+  appConfig: SkillSyncAppConfigLike | undefined,
+  user: SkillSyncRequestUser | undefined,
+  logger: SkillSyncTriggerLogger,
+  { allowServerCredentials = false }: { allowServerCredentials?: boolean } = {},
+): SkillSyncConfig | undefined {
+  const resolved = parseSkillSyncConfig(appConfig?.skillSync, logger);
+  if (!hasGitHubConfig(resolved)) {
+    return resolved;
+  }
+
+  const base = parseSkillSyncConfig(appConfig?.config?.skillSync, logger);
+  const baseWithGitHub = hasGitHubConfig(base) ? base : undefined;
+  if (!allowServerCredentials) {
+    return withAdminReadableTenantScope(resolved, user, baseWithGitHub);
+  }
+  if (isSameSkillSyncConfig(resolved, base)) {
+    return resolved;
+  }
+
+  return withRequestTenant(resolved, user);
+}
+
+function toTimestamp(value: unknown): number {
+  if (!value) {
+    return 0;
+  }
+  if (value instanceof Date) {
+    return value.getTime();
+  }
+  const parsed = Date.parse(String(value));
+  return Number.isNaN(parsed) ? 0 : parsed;
+}
+
+function getLastAttemptAt(source: SkillSyncRunnerStatus['sources'][number]): number {
+  return Math.max(
+    toTimestamp(source.finishedAt),
+    toTimestamp(source.startedAt),
+    toTimestamp(source.updatedAt),
+    toTimestamp(source.lastSuccessAt),
+    toTimestamp(source.lastFailureAt),
+  );
+}
+
+function shouldRunRequestSync(
+  status: SkillSyncRunnerStatus,
+  { minIntervalMs, staleRunningMs }: { minIntervalMs: number; staleRunningMs: number },
+): boolean {
+  if (!status.enabled || status.sources.length === 0) {
+    return false;
+  }
+  const intervalMs = Math.max(minIntervalMs, (status.intervalMinutes ?? 60) * 60 * 1000);
+  const now = Date.now();
+  return status.sources.some((source) => {
+    if (!source.credentialPresent) {
+      return false;
+    }
+    if (source.status === 'running') {
+      const startedAt = toTimestamp(source.startedAt);
+      return Boolean(startedAt && now - startedAt >= staleRunningMs);
+    }
+    const lastAttemptAt = getLastAttemptAt(source);
+    return !lastAttemptAt || now - lastAttemptAt >= intervalMs;
+  });
+}
+
+function getRequestSyncKey(
+  config: SkillSyncConfigWithGitHub,
+  user: SkillSyncRequestUser | undefined,
+) {
+  const tenantId = user?.tenantId ?? '';
+  const sources = config.github.sources
+    .map((source) => source.id)
+    .sort()
+    .join(',');
+  return `${tenantId}:${sources}`;
+}
+
+export function createSkillSyncTriggerOrchestrator(
+  deps: SkillSyncTriggerOrchestratorDeps,
+): SkillSyncTriggerOrchestrator {
+  const inFlight = deps.inFlight ?? new Set<string>();
+  const minIntervalMs = deps.minIntervalMs ?? REQUEST_SYNC_MIN_INTERVAL_MS;
+  const staleRunningMs = deps.staleRunningMs ?? REQUEST_SYNC_STALE_RUNNING_MS;
+
+  function getRunnerForAdminRequest(request: SkillSyncRequestLike): GitHubSkillSyncRunner {
+    const allowServerCredentials = Boolean(request.skillSyncAllowServerCredentials);
+    const config = getAdminRequestSkillSyncConfig(request.config, request.user, deps.logger, {
+      allowServerCredentials,
+    });
+    return deps.createRunner({
+      getConfig: async () => config,
+      loadAppConfig: async () => request.config,
+      allowServerCredentials,
+    });
+  }
+
+  async function maybeRunForRequest(request: SkillSyncRequestLike): Promise<boolean> {
+    const config = getRequestSkillSyncConfig(request.config, request.user, deps.logger);
+    if (!hasGitHubConfig(config)) {
+      return false;
+    }
+
+    const syncKey = getRequestSyncKey(config, request.user);
+    if (inFlight.has(syncKey)) {
+      return false;
+    }
+
+    const requestRunner = deps.createRunner({
+      getConfig: async () => config,
+      loadAppConfig: async () => request.config,
+      allowServerCredentials: Boolean(request.skillSyncAllowServerCredentials),
+    });
+    const status = await requestRunner.getStatus();
+    if (!shouldRunRequestSync(status, { minIntervalMs, staleRunningMs })) {
+      return false;
+    }
+
+    inFlight.add(syncKey);
+    void requestRunner
+      .runOnce()
+      .catch((error) => deps.logger.error('[GitHubSkillSync] Request-scoped sync failed:', error))
+      .finally(() => inFlight.delete(syncKey));
+    return true;
+  }
+
+  return {
+    getRunnerForAdminRequest,
+    maybeRunForRequest,
+  };
+}
diff --git a/packages/api/src/skills/sync/scheduler.spec.ts b/packages/api/src/skills/sync/scheduler.spec.ts
new file mode 100644
index 00000000000..da9eb0fff48
--- /dev/null
+++ b/packages/api/src/skills/sync/scheduler.spec.ts
@@ -0,0 +1,86 @@
+import type { SkillSyncConfig } from 'librechat-data-provider';
+import type { GitHubSkillSyncRunner } from './github';
+import { SKILL_SYNC_MAX_TIMER_INTERVAL_MINUTES, startGitHubSkillSyncScheduler } from './scheduler';
+import { __resetShutdownStateForTests } from '~/app/shutdown';
+
+const source = {
+  id: 'librechat-skills',
+  owner: 'LibreChat',
+  repo: 'skills',
+  ref: 'main',
+  paths: ['skills'],
+  credentialKey: 'github-skills-prod',
+};
+
+function config(intervalMinutes: number, enabled = true): SkillSyncConfig {
+  return {
+    github: {
+      enabled,
+      intervalMinutes,
+      runOnStartup: false,
+      sources: [source],
+    },
+  };
+}
+
+function runner(): GitHubSkillSyncRunner {
+  return {
+    getStatus: jest.fn(),
+    runOnce: jest.fn(async () => ({ status: 'completed', sources: [] })),
+  } as unknown as GitHubSkillSyncRunner;
+}
+
+async function flushPromises() {
+  await Promise.resolve();
+  await Promise.resolve();
+  await Promise.resolve();
+  await Promise.resolve();
+}
+
+describe('startGitHubSkillSyncScheduler', () => {
+  beforeEach(() => {
+    jest.useFakeTimers();
+    __resetShutdownStateForTests();
+  });
+
+  afterEach(() => {
+    jest.useRealTimers();
+    jest.restoreAllMocks();
+    __resetShutdownStateForTests();
+  });
+
+  it('clamps oversized intervals before scheduling a timer', async () => {
+    const setTimeoutSpy = jest.spyOn(global, 'setTimeout');
+    const scheduler = startGitHubSkillSyncScheduler({
+      getConfig: () => config(Number.MAX_SAFE_INTEGER),
+      runner: runner(),
+    });
+
+    await flushPromises();
+
+    expect(setTimeoutSpy).toHaveBeenLastCalledWith(
+      expect.any(Function),
+      SKILL_SYNC_MAX_TIMER_INTERVAL_MINUTES * 60 * 1000,
+    );
+    scheduler.stop();
+  });
+
+  it('uses fresh config when scheduling the next run', async () => {
+    let intervalMinutes = 5;
+    const skillRunner = runner();
+    const setTimeoutSpy = jest.spyOn(global, 'setTimeout');
+    const scheduler = startGitHubSkillSyncScheduler({
+      getConfig: () => config(intervalMinutes),
+      runner: skillRunner,
+    });
+    await flushPromises();
+
+    intervalMinutes = 10;
+    await jest.advanceTimersByTimeAsync(5 * 60 * 1000);
+    await flushPromises();
+
+    expect(skillRunner.runOnce).toHaveBeenCalledTimes(1);
+    expect(setTimeoutSpy).toHaveBeenLastCalledWith(expect.any(Function), 10 * 60 * 1000);
+    scheduler.stop();
+  });
+});
diff --git a/packages/api/src/skills/sync/scheduler.ts b/packages/api/src/skills/sync/scheduler.ts
new file mode 100644
index 00000000000..7aad2d7bab0
--- /dev/null
+++ b/packages/api/src/skills/sync/scheduler.ts
@@ -0,0 +1,103 @@
+import { logger } from '@librechat/data-schemas';
+import type { SkillSyncConfig } from 'librechat-data-provider';
+import type { GitHubSkillSyncRunner } from './github';
+import { registerShutdownTask } from '~/app/shutdown';
+
+const NODE_TIMER_MAX_MS = 2147483647;
+const SKILL_SYNC_MIN_INTERVAL_MINUTES = 5;
+export const SKILL_SYNC_MAX_TIMER_INTERVAL_MINUTES: number = Math.floor(NODE_TIMER_MAX_MS / 60_000);
+
+type MaybePromise<T> = T | Promise<T>;
+
+export type GitHubSkillSyncScheduler = {
+  stop: () => void;
+};
+
+function normalizeIntervalMinutes(value: unknown): number {
+  if (typeof value !== 'number' || !Number.isFinite(value)) {
+    return 60;
+  }
+  return Math.min(
+    SKILL_SYNC_MAX_TIMER_INTERVAL_MINUTES,
+    Math.max(SKILL_SYNC_MIN_INTERVAL_MINUTES, Math.floor(value)),
+  );
+}
+
+function getSources(config: SkillSyncConfig | undefined) {
+  const sources = config?.github?.sources;
+  return Array.isArray(sources) ? sources : [];
+}
+
+export function startGitHubSkillSyncScheduler(params: {
+  getConfig: () => MaybePromise<SkillSyncConfig | undefined>;
+  runner: GitHubSkillSyncRunner;
+}): GitHubSkillSyncScheduler {
+  let stopped = false;
+  let timer: NodeJS.Timeout | undefined;
+
+  const getConfig = async (): Promise<SkillSyncConfig | undefined> => {
+    try {
+      return await params.getConfig();
+    } catch (error) {
+      logger.error('[GitHubSkillSync] Failed to load scheduler config:', error);
+      return undefined;
+    }
+  };
+
+  const scheduleNext = (config: SkillSyncConfig | undefined) => {
+    if (stopped) {
+      return;
+    }
+    const delayMs = normalizeIntervalMinutes(config?.github?.intervalMinutes) * 60 * 1000;
+    timer = setTimeout(tick, delayMs);
+    timer.unref?.();
+  };
+
+  const runIfEnabled = async () => {
+    const config = await getConfig();
+    const github = config?.github;
+    if (!github?.enabled || getSources(config).length === 0) {
+      return config;
+    }
+    try {
+      await params.runner.runOnce();
+    } catch (error) {
+      logger.error('[GitHubSkillSync] Scheduled run failed:', error);
+    }
+    return getConfig();
+  };
+
+  async function tick() {
+    if (stopped) {
+      return;
+    }
+    const config = await runIfEnabled();
+    scheduleNext(config);
+  }
+
+  const scheduler = {
+    stop: () => {
+      stopped = true;
+      if (timer) {
+        clearTimeout(timer);
+        timer = undefined;
+      }
+    },
+  };
+
+  void (async () => {
+    const config = await getConfig();
+    if (config?.github?.enabled && config.github.runOnStartup && getSources(config).length > 0) {
+      void params.runner.runOnce().catch((error) => {
+        logger.error('[GitHubSkillSync] Scheduled startup run failed:', error);
+      });
+    }
+    scheduleNext(config);
+  })();
+
+  registerShutdownTask('github skill sync scheduler', () => {
+    scheduler.stop();
+  });
+
+  return scheduler;
+}
diff --git a/packages/api/src/storage/s3/s3Config.ts b/packages/api/src/storage/s3/s3Config.ts
index 9f7a0ce5eb5..5dc374d07d4 100644
--- a/packages/api/src/storage/s3/s3Config.ts
+++ b/packages/api/src/storage/s3/s3Config.ts
@@ -1,6 +1,6 @@
 import { logger } from '@librechat/data-schemas';
-import { isEnabled } from '~/utils/common';
 import { DEFAULT_BASE_PATH } from '~/storage/constants';
+import { isEnabled } from '~/utils/common';
 
 const MAX_EXPIRY_SECONDS = 7 * 24 * 60 * 60; // 7 days
 const DEFAULT_EXPIRY_SECONDS = 2 * 60; // 2 minutes
@@ -39,7 +39,22 @@ const parseRefreshExpiry = (): number | null => {
 };
 
 // Internal module config — not part of the public @librechat/api surface
-export const s3Config = {
+export const s3Config: {
+  /** AWS region for S3 */
+  AWS_REGION: string;
+  /** S3 bucket name */
+  AWS_BUCKET_NAME: string;
+  /** Custom endpoint URL (for MinIO, R2, etc.) */
+  AWS_ENDPOINT_URL: string | undefined;
+  /** Use path-style URLs instead of virtual-hosted-style */
+  AWS_FORCE_PATH_STYLE: boolean;
+  /** Presigned URL expiry in seconds */
+  S3_URL_EXPIRY_SECONDS: number;
+  /** Custom refresh expiry in milliseconds (null = use default buffer logic) */
+  S3_REFRESH_EXPIRY_MS: number | null;
+  /** Default base path for file storage */
+  DEFAULT_BASE_PATH: string;
+} = {
   /** AWS region for S3 */
   AWS_REGION: process.env.AWS_REGION ?? '',
   /** S3 bucket name */
diff --git a/packages/api/src/stream/GenerationJobManager.ts b/packages/api/src/stream/GenerationJobManager.ts
index 6ab3af27644..4445417c5cd 100644
--- a/packages/api/src/stream/GenerationJobManager.ts
+++ b/packages/api/src/stream/GenerationJobManager.ts
@@ -1,7 +1,18 @@
 import { logger, getTenantId, SYSTEM_TENANT_ID } from '@librechat/data-schemas';
+import {
+  Constants,
+  UsageEvents,
+  parseTextParts,
+  reconcileContextUsage,
+  promptTokensFromUsage,
+} from 'librechat-data-provider';
+import type {
+  TMessageContentParts,
+  TContextUsageEvent,
+  TTokenUsageEvent,
+  Agents,
+} from 'librechat-data-provider';
 import type { StandardGraph } from '@librechat/agents';
-import { parseTextParts } from 'librechat-data-provider';
-import type { Agents, TMessageContentParts } from 'librechat-data-provider';
 import type {
   SerializableJobData,
   IEventTransport,
@@ -9,19 +20,93 @@ import type {
   AbortResult,
   IJobStore,
 } from './interfaces/IJobStore';
+import type { GenerationJobStore } from '~/app/metrics';
 import type * as t from '~/types';
 import {
-  recordGenerationJob,
   recordGenerationStreamResumePendingEvents,
   recordGenerationStreamSubscription,
   setGenerationJobsInFlight,
+  recordGenerationJob,
 } from '~/app/metrics';
-import type { GenerationJobStore } from '~/app/metrics';
 import { InMemoryEventTransport } from './implementations/InMemoryEventTransport';
 import { InMemoryJobStore } from './implementations/InMemoryJobStore';
+import { filterPersistableAbortContent } from './abortContent';
 
 /** Error surfaced to any client still attached when a stale/hung job is reaped. */
 const REAPED_JOB_ERROR = 'Generation timed out';
+const OAUTH_TOOL_CALL_PREFIX = `oauth${Constants.mcp_delimiter}`;
+
+function getToolCallName(toolCall: unknown): unknown {
+  return toolCall != null && typeof toolCall === 'object' && 'name' in toolCall
+    ? toolCall.name
+    : undefined;
+}
+
+function hasOAuthToolCall(toolCalls: unknown): boolean {
+  return (
+    Array.isArray(toolCalls) &&
+    toolCalls.some((toolCall) => {
+      const name = getToolCallName(toolCall);
+      return typeof name === 'string' && name.startsWith(OAUTH_TOOL_CALL_PREFIX);
+    })
+  );
+}
+
+function getReplayStepId(event: t.ServerSentEvent): unknown {
+  if (!('event' in event) || !event.data || typeof event.data !== 'object') {
+    return undefined;
+  }
+
+  if (event.event === 'on_run_step' || event.event === 'on_run_step_delta') {
+    return 'id' in event.data ? event.data.id : undefined;
+  }
+
+  if (event.event === 'on_run_step_completed') {
+    const result = 'result' in event.data ? event.data.result : undefined;
+    return result != null && typeof result === 'object' && 'id' in result ? result.id : undefined;
+  }
+
+  return undefined;
+}
+
+function isOAuthReplayEvent(event: t.ServerSentEvent): boolean {
+  if (!('event' in event) || !event.data || typeof event.data !== 'object') {
+    return false;
+  }
+
+  if (event.event === 'on_run_step') {
+    const stepDetails = 'stepDetails' in event.data ? event.data.stepDetails : undefined;
+    return (
+      stepDetails != null &&
+      typeof stepDetails === 'object' &&
+      'tool_calls' in stepDetails &&
+      hasOAuthToolCall(stepDetails.tool_calls)
+    );
+  }
+
+  if (event.event === 'on_run_step_delta') {
+    const delta = 'delta' in event.data ? event.data.delta : undefined;
+    if (delta == null || typeof delta !== 'object') {
+      return false;
+    }
+    if (!('tool_calls' in delta) || !hasOAuthToolCall(delta.tool_calls)) {
+      return false;
+    }
+
+    return true;
+  }
+
+  if (event.event === 'on_run_step_completed') {
+    const result = 'result' in event.data ? event.data.result : undefined;
+    if (result == null || typeof result !== 'object' || !('tool_call' in result)) {
+      return false;
+    }
+    const name = getToolCallName(result.tool_call);
+    return typeof name === 'string' && name.startsWith(OAUTH_TOOL_CALL_PREFIX);
+  }
+
+  return false;
+}
 
 /**
  * Configuration options for GenerationJobManager
@@ -100,6 +185,12 @@ class GenerationJobManagerClass {
   /** Jobs actively generating in this process. */
   private runningJobs = new Set<string>();
 
+  /** Serializes replay-event read/modify/write updates per stream. */
+  private replayEventWriteQueues = new Map<string, Promise<void>>();
+
+  /** Serializes token-usage read/modify/write updates per stream. */
+  private tokenUsageWriteQueues = new Map<string, Promise<void>>();
+
   private cleanupInterval: NodeJS.Timeout | null = null;
 
   /** Whether we're using Redis stores */
@@ -391,6 +482,10 @@ class GenerationJobManagerClass {
         userMessage: jobData.userMessage,
         responseMessageId: jobData.responseMessageId,
         sender: jobData.sender,
+        endpoint: jobData.endpoint,
+        iconURL: jobData.iconURL,
+        model: jobData.model,
+        promptTokens: jobData.promptTokens,
       },
       readyPromise: runtime.readyPromise,
       resolveReady: runtime.resolveReady,
@@ -567,6 +662,8 @@ class GenerationJobManagerClass {
     // Clear content state and run step buffer (Redis only)
     this.jobStore.clearContentState(streamId);
     this.runStepBuffers?.delete(streamId);
+    this.replayEventWriteQueues.delete(streamId);
+    this.tokenUsageWriteQueues.delete(streamId);
 
     // For error jobs, DON'T delete immediately - keep around so late-connecting
     // clients can receive the error. This handles the race condition where error
@@ -652,16 +749,20 @@ class GenerationJobManagerClass {
     /** Content before clearing state */
     const result = await this.jobStore.getContentParts(streamId);
     const content = result?.content ?? [];
+    const abortContent = filterPersistableAbortContent(content);
+    const shouldPersistAbortContent = abortContent.length > 0;
 
     /** Collected usage for all models */
     const collectedUsage = this.jobStore.getCollectedUsage(streamId);
 
     /** Text from content parts for fallback token counting */
-    const text = parseTextParts(content as TMessageContentParts[]);
+    const text = shouldPersistAbortContent
+      ? parseTextParts(abortContent as TMessageContentParts[])
+      : '';
 
     /** Detect "early abort" - aborted before any generation happened (e.g., during tool loading)
     In this case, no messages were saved to DB, so frontend shouldn't navigate to conversation */
-    const isEarlyAbort = content.length === 0 && !jobData.responseMessageId;
+    const isEarlyAbort = !shouldPersistAbortContent && jobData.createdEventEmitted !== true;
 
     /** Final event for abort */
     const userMessageId = jobData.userMessage?.messageId;
@@ -686,8 +787,11 @@ class GenerationJobManagerClass {
             messageId: jobData.responseMessageId ?? `${userMessageId ?? 'aborted'}_`,
             parentMessageId: userMessageId,
             conversationId: jobData.conversationId,
-            content,
+            content: abortContent,
             sender: jobData.sender ?? 'AI',
+            endpoint: jobData.endpoint,
+            iconURL: jobData.iconURL,
+            model: jobData.model,
             unfinished: true,
             error: false,
             isCreatedByUser: false,
@@ -704,6 +808,8 @@ class GenerationJobManagerClass {
     await this.eventTransport.emitDone(streamId, abortFinalEvent);
     this.jobStore.clearContentState(streamId);
     this.runStepBuffers?.delete(streamId);
+    this.replayEventWriteQueues.delete(streamId);
+    this.tokenUsageWriteQueues.delete(streamId);
 
     // Immediate cleanup if configured (default: true)
     if (this._cleanupOnComplete) {
@@ -726,7 +832,7 @@ class GenerationJobManagerClass {
     return {
       success: true,
       jobData,
-      content,
+      content: abortContent,
       finalEvent: abortFinalEvent,
       text,
       collectedUsage,
@@ -962,6 +1068,9 @@ class GenerationJobManagerClass {
 
     await this.trackUserMessage(streamId, event);
     await this.trackTitleEvent(streamId, event);
+    await this.trackReplayEvent(streamId, event);
+    await this.trackContextUsage(streamId, event);
+    await this.trackTokenUsage(streamId, event);
 
     // For Redis mode, persist chunk for later reconstruction (fire-and-forget for resumability)
     if (this._isRedis) {
@@ -1059,6 +1168,167 @@ class GenerationJobManagerClass {
     });
   }
 
+  /**
+   * Persist the latest context usage snapshot (one per model call) so a
+   * resuming client can restore the context gauge without waiting for the
+   * next model call.
+   */
+  private async trackContextUsage(streamId: string, event: t.ServerSentEvent): Promise<void> {
+    if (!('event' in event) || event.event !== UsageEvents.ON_CONTEXT_USAGE) {
+      return;
+    }
+
+    /** Share the token-usage queue so snapshot + usage writes are serialized per
+     *  stream: `persistTokenUsage` reconciles the stored snapshot (read-modify-
+     *  write), and a snapshot landing between its read and write — or a stale
+     *  reconciled write landing after a newer snapshot — would clobber the newer
+     *  run's gauge when visible calls interleave. FIFO ordering keeps each call's
+     *  pre-invoke snapshot ahead of its own usage and behind the next snapshot. */
+    await this.queueJobWrite(this.tokenUsageWriteQueues, streamId, () =>
+      this.jobStore.updateJob(streamId, {
+        contextUsage: JSON.stringify((event as { data?: unknown }).data ?? null),
+      }),
+    );
+  }
+
+  /**
+   * Chains a read/modify/write job update onto the stream's queue so
+   * concurrent writers can't clobber each other's merged state.
+   */
+  private async queueJobWrite(
+    queues: Map<string, Promise<void>>,
+    streamId: string,
+    write: () => Promise<void>,
+  ): Promise<void> {
+    const previousWrite = queues.get(streamId) ?? Promise.resolve();
+    const nextWrite = previousWrite
+      .catch(() => {
+        // Keep the queue moving even if a prior metadata write failed.
+      })
+      .then(write);
+
+    queues.set(streamId, nextWrite);
+
+    try {
+      await nextWrite;
+    } finally {
+      if (queues.get(streamId) === nextWrite) {
+        queues.delete(streamId);
+      }
+    }
+  }
+
+  /**
+   * Persist replay-only stream events that are needed to reconstruct active
+   * UI state on resume but are not represented by aggregated message content.
+   */
+  private async trackReplayEvent(streamId: string, event: t.ServerSentEvent): Promise<void> {
+    if (!isOAuthReplayEvent(event)) {
+      return;
+    }
+
+    await this.queueJobWrite(this.replayEventWriteQueues, streamId, () =>
+      this.persistReplayEvent(streamId, event),
+    );
+  }
+
+  /**
+   * Persist per-model-call token usage so resuming clients can rebuild
+   * usage totals on any replica (the live collectedUsage array only exists
+   * on the generating instance).
+   */
+  private async trackTokenUsage(streamId: string, event: t.ServerSentEvent): Promise<void> {
+    if (!('event' in event) || event.event !== UsageEvents.ON_TOKEN_USAGE) {
+      return;
+    }
+
+    await this.queueJobWrite(this.tokenUsageWriteQueues, streamId, () =>
+      this.persistTokenUsage(streamId, event as { data?: unknown }),
+    );
+  }
+
+  private async persistTokenUsage(streamId: string, event: { data?: unknown }): Promise<void> {
+    const jobData = await this.jobStore.getJob(streamId);
+    if (!jobData || event.data == null) {
+      return;
+    }
+
+    let tokenUsage: unknown[] = [];
+    if (jobData.tokenUsage) {
+      try {
+        tokenUsage = JSON.parse(jobData.tokenUsage) as unknown[];
+      } catch {
+        tokenUsage = [];
+      }
+    }
+    tokenUsage.push(event.data);
+
+    const update: Partial<SerializableJobData> = { tokenUsage: JSON.stringify(tokenUsage) };
+
+    /** Reconcile the resume snapshot to this call's ACTUAL prompt tokens. A primary
+     *  usage is the post-invoke truth for the call the latest stored snapshot
+     *  precedes (no snapshot is captured between a call's pre-invoke dispatch and
+     *  its usage), so a resuming client restores the real context instead of the
+     *  calibration-inflated estimate — and a mid-call resume (no usage yet) simply
+     *  keeps the raw snapshot rather than mis-applying an earlier call's tokens. */
+    const usage = event.data as TTokenUsageEvent;
+    if (usage.usage_type == null && jobData.contextUsage) {
+      try {
+        const snapshot = JSON.parse(jobData.contextUsage) as TContextUsageEvent | null;
+        if (
+          snapshot != null &&
+          (snapshot.runId == null || usage.runId == null || snapshot.runId === usage.runId)
+        ) {
+          update.contextUsage = JSON.stringify(
+            reconcileContextUsage(snapshot, promptTokensFromUsage(usage)),
+          );
+        }
+      } catch {
+        /* leave the stored snapshot as-is on parse failure */
+      }
+    }
+
+    await this.jobStore.updateJob(streamId, update);
+  }
+
+  private async persistReplayEvent(streamId: string, event: t.ServerSentEvent): Promise<void> {
+    const jobData = await this.jobStore.getJob(streamId);
+    if (!jobData) {
+      return;
+    }
+
+    let replayEvents: t.ServerSentEvent[] = [];
+    if (jobData.replayEvents) {
+      try {
+        replayEvents = JSON.parse(jobData.replayEvents) as t.ServerSentEvent[];
+      } catch {
+        replayEvents = [];
+      }
+    }
+
+    const stepId = getReplayStepId(event);
+    const eventName = 'event' in event ? event.event : undefined;
+    const existingIndex =
+      stepId == null
+        ? -1
+        : replayEvents.findIndex((candidate) => {
+            if (!('event' in candidate) || candidate.event !== eventName) {
+              return false;
+            }
+            return getReplayStepId(candidate) === stepId;
+          });
+
+    if (existingIndex >= 0) {
+      replayEvents[existingIndex] = event;
+    } else {
+      replayEvents.push(event);
+    }
+
+    await this.jobStore.updateJob(streamId, {
+      replayEvents: JSON.stringify(replayEvents),
+    });
+  }
+
   /**
    * Persist user message metadata from the created event.
    * Awaited in emitChunk so the HSET commits before the PUBLISH,
@@ -1072,6 +1342,7 @@ class GenerationJobManagerClass {
 
     const { message } = event;
     const updates: Partial<SerializableJobData> = {
+      createdEventEmitted: true,
       userMessage: {
         messageId: message.messageId,
         parentMessageId: message.parentMessageId,
@@ -1176,11 +1447,41 @@ class GenerationJobManagerClass {
         // Ignore malformed persisted title events.
       }
     }
+    let replayEvents: t.ResumeState['replayEvents'];
+    if (jobData.replayEvents) {
+      try {
+        replayEvents = JSON.parse(jobData.replayEvents) as t.ResumeState['replayEvents'];
+      } catch {
+        // Ignore malformed persisted replay events.
+      }
+    }
+
+    let contextUsage: t.ResumeState['contextUsage'];
+    if (jobData.contextUsage) {
+      try {
+        contextUsage = JSON.parse(jobData.contextUsage) as t.ResumeState['contextUsage'];
+      } catch {
+        // Ignore malformed persisted context usage.
+      }
+    }
+
+    /** Persisted per model call by trackTokenUsage — unlike the live
+     *  collectedUsage reference, this survives cross-replica resumes. */
+    let collectedUsage: t.ResumeState['collectedUsage'];
+    if (jobData.tokenUsage) {
+      try {
+        const parsed = JSON.parse(jobData.tokenUsage) as t.ResumeState['collectedUsage'];
+        collectedUsage = parsed && parsed.length > 0 ? parsed : undefined;
+      } catch {
+        // Ignore malformed persisted token usage.
+      }
+    }
 
     logger.debug(`[GenerationJobManager] getResumeState:`, {
       streamId,
       runStepsLength: runSteps.length,
       aggregatedContentLength: aggregatedContent.length,
+      collectedUsageLength: collectedUsage?.length ?? 0,
     });
 
     return {
@@ -1190,7 +1491,12 @@ class GenerationJobManagerClass {
       responseMessageId: jobData.responseMessageId,
       conversationId: jobData.conversationId,
       sender: jobData.sender,
+      iconURL: jobData.iconURL,
+      model: jobData.model,
       titleEvent,
+      replayEvents,
+      collectedUsage,
+      contextUsage,
     };
   }
 
@@ -1407,10 +1713,12 @@ class GenerationJobManagerClass {
     this.runningJobs.clear();
     this.syncRunningJobMetrics();
     this.runStepBuffers?.clear();
+    this.replayEventWriteQueues.clear();
+    this.tokenUsageWriteQueues.clear();
 
     logger.debug('[GenerationJobManager] Destroyed');
   }
 }
 
-export const GenerationJobManager = new GenerationJobManagerClass();
+export const GenerationJobManager: GenerationJobManagerClass = new GenerationJobManagerClass();
 export { GenerationJobManagerClass };
diff --git a/packages/api/src/stream/__tests__/GenerationJobManager.resumeReplay.spec.ts b/packages/api/src/stream/__tests__/GenerationJobManager.resumeReplay.spec.ts
new file mode 100644
index 00000000000..c9721efc000
--- /dev/null
+++ b/packages/api/src/stream/__tests__/GenerationJobManager.resumeReplay.spec.ts
@@ -0,0 +1,218 @@
+import type { ServerSentEvent } from '~/types';
+import { InMemoryEventTransport } from '~/stream/implementations/InMemoryEventTransport';
+import { InMemoryJobStore } from '~/stream/implementations/InMemoryJobStore';
+import { GenerationJobManagerClass } from '~/stream/GenerationJobManager';
+
+jest.spyOn(console, 'log').mockImplementation();
+
+function createInMemoryManager(): GenerationJobManagerClass {
+  const manager = new GenerationJobManagerClass();
+  manager.configure({
+    jobStore: new InMemoryJobStore({ ttlAfterComplete: 60000 }),
+    eventTransport: new InMemoryEventTransport(),
+    isRedis: false,
+  });
+  manager.initialize();
+  return manager;
+}
+
+class SnapshotReplayJobStore extends InMemoryJobStore {
+  async getJob(streamId: string) {
+    const job = await super.getJob(streamId);
+    return job ? { ...job } : null;
+  }
+
+  async updateJob(streamId: string, updates: Parameters<InMemoryJobStore['updateJob']>[1]) {
+    if (updates.replayEvents) {
+      await new Promise((resolve) => setTimeout(resolve, 5));
+    }
+    await super.updateJob(streamId, updates);
+  }
+}
+
+function createSnapshotReplayManager(): GenerationJobManagerClass {
+  const manager = new GenerationJobManagerClass();
+  manager.configure({
+    jobStore: new SnapshotReplayJobStore({ ttlAfterComplete: 60000 }),
+    eventTransport: new InMemoryEventTransport(),
+    isRedis: false,
+  });
+  manager.initialize();
+  return manager;
+}
+
+describe('GenerationJobManager resume replay events', () => {
+  let manager: GenerationJobManagerClass | undefined;
+
+  afterEach(async () => {
+    await manager?.destroy();
+    manager = undefined;
+  });
+
+  test('includes OAuth run step and delta replay events in resume state', async () => {
+    manager = createInMemoryManager();
+    const streamId = `oauth-delta-resume-${Date.now()}`;
+    await manager.createJob(streamId, 'user-1', streamId);
+
+    const runStepEvent = {
+      event: 'on_run_step',
+      data: {
+        id: 'step-oauth',
+        runId: 'USE_PRELIM_RESPONSE_MESSAGE_ID',
+        index: 0,
+        stepDetails: {
+          type: 'tool_calls',
+          tool_calls: [{ id: 'call-oauth', name: 'oauth_mcp_Google-Workspace', args: '' }],
+        },
+      },
+    } satisfies ServerSentEvent;
+    const authEvent = {
+      event: 'on_run_step_delta',
+      data: {
+        id: 'step-oauth',
+        delta: {
+          type: 'tool_calls',
+          tool_calls: [{ name: 'oauth_mcp_Google-Workspace', args: '' }],
+          auth: 'https://auth.example.com/oauth',
+          expires_at: 1780791946,
+        },
+      },
+    } satisfies ServerSentEvent;
+
+    await manager.emitChunk(streamId, runStepEvent);
+    await manager.emitChunk(streamId, authEvent);
+    await manager.emitChunk(streamId, {
+      event: 'on_run_step',
+      data: {
+        id: 'step-regular',
+        runId: 'response-1',
+        index: 1,
+        stepDetails: {
+          type: 'tool_calls',
+          tool_calls: [{ id: 'call-regular', name: 'regular-tool', args: '{}' }],
+        },
+      },
+    });
+    await manager.emitChunk(streamId, {
+      event: 'on_run_step_delta',
+      data: {
+        id: 'step-no-auth',
+        delta: {
+          type: 'tool_calls',
+          tool_calls: [{ name: 'regular-tool', args: '{}' }],
+        },
+      },
+    });
+
+    const resumeState = await manager.getResumeState(streamId);
+
+    expect(resumeState?.replayEvents).toEqual([runStepEvent, authEvent]);
+  });
+
+  test('replaces OAuth replay event for the same step id', async () => {
+    manager = createInMemoryManager();
+    const streamId = `oauth-delta-replace-${Date.now()}`;
+    await manager.createJob(streamId, 'user-1', streamId);
+
+    await manager.emitChunk(streamId, {
+      event: 'on_run_step_delta',
+      data: {
+        id: 'step-oauth',
+        delta: {
+          tool_calls: [{ name: 'oauth_mcp_Google-Workspace', args: '' }],
+          auth: 'https://auth.example.com/first',
+          expires_at: 1780791946,
+        },
+      },
+    });
+
+    const replacementEvent = {
+      event: 'on_run_step_delta',
+      data: {
+        id: 'step-oauth',
+        delta: {
+          tool_calls: [{ name: 'oauth_mcp_Google-Workspace', args: '' }],
+          auth: 'https://auth.example.com/latest',
+          expires_at: 1780792000,
+        },
+      },
+    } satisfies ServerSentEvent;
+
+    await manager.emitChunk(streamId, replacementEvent);
+
+    const resumeState = await manager.getResumeState(streamId);
+
+    expect(resumeState?.replayEvents).toEqual([replacementEvent]);
+  });
+
+  test('does not replay non-MCP action auth deltas', async () => {
+    manager = createInMemoryManager();
+    const streamId = `action-auth-delta-${Date.now()}`;
+    await manager.createJob(streamId, 'user-1', streamId);
+
+    await manager.emitChunk(streamId, {
+      event: 'on_run_step_delta',
+      data: {
+        id: 'step-action-auth',
+        delta: {
+          type: 'tool_calls',
+          tool_calls: [{ name: 'google_calendar_action_api_example_com', args: '' }],
+          auth: 'https://auth.example.com/action',
+          expires_at: 1780791946,
+        },
+      },
+    });
+
+    const resumeState = await manager.getResumeState(streamId);
+
+    expect(resumeState?.replayEvents).toBeUndefined();
+  });
+
+  test('serializes replay event updates for concurrent MCP OAuth prompts', async () => {
+    manager = createSnapshotReplayManager();
+    const streamId = `oauth-delta-concurrent-${Date.now()}`;
+    await manager.createJob(streamId, 'user-1', streamId);
+
+    const createRunStepEvent = (serverName: string, index: number) =>
+      ({
+        event: 'on_run_step',
+        data: {
+          id: `step-oauth-${serverName}`,
+          runId: 'USE_PRELIM_RESPONSE_MESSAGE_ID',
+          index,
+          stepDetails: {
+            type: 'tool_calls',
+            tool_calls: [{ id: `call-${serverName}`, name: `oauth_mcp_${serverName}`, args: '' }],
+          },
+        },
+      }) satisfies ServerSentEvent;
+
+    const createAuthEvent = (serverName: string) =>
+      ({
+        event: 'on_run_step_delta',
+        data: {
+          id: `step-oauth-${serverName}`,
+          delta: {
+            type: 'tool_calls',
+            tool_calls: [{ name: `oauth_mcp_${serverName}`, args: '' }],
+            auth: `https://auth.example.com/${serverName}`,
+            expires_at: 1780791946,
+          },
+        },
+      }) satisfies ServerSentEvent;
+
+    const events = [
+      createRunStepEvent('Google-Workspace', 0),
+      createAuthEvent('Google-Workspace'),
+      createRunStepEvent('clickhouse-docs', 1),
+      createAuthEvent('clickhouse-docs'),
+    ];
+
+    await Promise.all(events.map((event) => manager!.emitChunk(streamId, event)));
+
+    const resumeState = await manager.getResumeState(streamId);
+
+    expect(resumeState?.replayEvents).toHaveLength(events.length);
+    expect(resumeState?.replayEvents).toEqual(expect.arrayContaining(events));
+  });
+});
diff --git a/packages/api/src/stream/__tests__/GenerationJobManager.stream_integration.spec.ts b/packages/api/src/stream/__tests__/GenerationJobManager.stream_integration.spec.ts
index a994f6c11bd..3e34d155d5d 100644
--- a/packages/api/src/stream/__tests__/GenerationJobManager.stream_integration.spec.ts
+++ b/packages/api/src/stream/__tests__/GenerationJobManager.stream_integration.spec.ts
@@ -1,6 +1,11 @@
 /* eslint jest/no-standalone-expect: ["error", { "additionalTestBlockFunctions": ["testRedis"] }] */
 import type { Redis, Cluster } from 'ioredis';
 import type { ServerSentEvent, StreamEvent, CreatedEvent } from '~/types';
+import {
+  ioredisClient as staticRedisClient,
+  keyvRedisClient as staticKeyvClient,
+  keyvRedisClientReady,
+} from '~/cache/redisClients';
 import { InMemoryEventTransport } from '~/stream/implementations/InMemoryEventTransport';
 import { RedisEventTransport } from '~/stream/implementations/RedisEventTransport';
 import { InMemoryJobStore } from '~/stream/implementations/InMemoryJobStore';
@@ -8,11 +13,6 @@ import { GenerationJobManagerClass } from '~/stream/GenerationJobManager';
 import { RedisJobStore } from '~/stream/implementations/RedisJobStore';
 import { createStreamServices } from '~/stream/createStreamServices';
 import { GenerationJobManager } from '~/stream/GenerationJobManager';
-import {
-  ioredisClient as staticRedisClient,
-  keyvRedisClient as staticKeyvClient,
-  keyvRedisClientReady,
-} from '~/cache/redisClients';
 
 /** Suppress winston Console transport output (survives jest.resetModules) */
 jest.spyOn(console, 'log').mockImplementation();
@@ -404,11 +404,21 @@ describe('GenerationJobManager Integration Tests', () => {
         await GenerationJobManager.updateMetadata(streamId, {
           sender: 'ConsistencyAgent',
           responseMessageId: 'resp-123',
+          iconURL: 'https://example.com/spec-icon.png',
+          model: 'gpt-4.1',
         });
 
         const updated = await GenerationJobManager.getJob(streamId);
         expect(updated?.metadata?.sender).toBe('ConsistencyAgent');
         expect(updated?.metadata?.responseMessageId).toBe('resp-123');
+        expect(updated?.metadata?.iconURL).toBe('https://example.com/spec-icon.png');
+        expect(updated?.metadata?.model).toBe('gpt-4.1');
+
+        const resumeState = await GenerationJobManager.getResumeState(streamId);
+        expect(resumeState?.sender).toBe('ConsistencyAgent');
+        expect(resumeState?.responseMessageId).toBe('resp-123');
+        expect(resumeState?.iconURL).toBe('https://example.com/spec-icon.png');
+        expect(resumeState?.model).toBe('gpt-4.1');
 
         await GenerationJobManager.completeJob(streamId);
 
diff --git a/packages/api/src/stream/__tests__/collectedUsage.spec.ts b/packages/api/src/stream/__tests__/collectedUsage.spec.ts
index 635eba3aa43..30f70c2090a 100644
--- a/packages/api/src/stream/__tests__/collectedUsage.spec.ts
+++ b/packages/api/src/stream/__tests__/collectedUsage.spec.ts
@@ -282,6 +282,188 @@ describe('AbortJob - Text and CollectedUsage', () => {
     await GenerationJobManager.destroy();
   });
 
+  it('should treat OAuth-only content as an early abort', async () => {
+    const { GenerationJobManager } = await import('../GenerationJobManager');
+    const { InMemoryJobStore } = await import('../implementations/InMemoryJobStore');
+    const { InMemoryEventTransport } = await import('../implementations/InMemoryEventTransport');
+
+    GenerationJobManager.configure({
+      jobStore: new InMemoryJobStore(),
+      eventTransport: new InMemoryEventTransport(),
+      isRedis: false,
+      cleanupOnComplete: false,
+    });
+
+    GenerationJobManager.initialize();
+
+    const streamId = `oauth-abort-${Date.now()}`;
+    await GenerationJobManager.createJob(streamId, 'user-1');
+
+    GenerationJobManager.setContentParts(streamId, [
+      {
+        type: 'tool_call',
+        tool_call: {
+          type: 'tool_call',
+          id: 'oauth-call-1',
+          name: 'oauth_mcp_Google-Workspace',
+          args: '',
+          auth: 'https://auth.example.com/oauth',
+        },
+      },
+    ] as never);
+
+    const abortResult = await GenerationJobManager.abortJob(streamId);
+
+    expect(abortResult.success).toBe(true);
+    expect(abortResult.content).toEqual([]);
+    expect(abortResult.text).toBe('');
+    expect(abortResult.finalEvent).toEqual(
+      expect.objectContaining({
+        earlyAbort: true,
+        responseMessage: null,
+      }),
+    );
+
+    await GenerationJobManager.destroy();
+  });
+
+  it('should keep post-created OAuth-only aborts tied to the created turn', async () => {
+    const { GenerationJobManager } = await import('../GenerationJobManager');
+    const { InMemoryJobStore } = await import('../implementations/InMemoryJobStore');
+    const { InMemoryEventTransport } = await import('../implementations/InMemoryEventTransport');
+
+    GenerationJobManager.configure({
+      jobStore: new InMemoryJobStore(),
+      eventTransport: new InMemoryEventTransport(),
+      isRedis: false,
+      cleanupOnComplete: false,
+    });
+
+    GenerationJobManager.initialize();
+
+    const streamId = `created-oauth-abort-${Date.now()}`;
+    await GenerationJobManager.createJob(streamId, 'user-1');
+    await GenerationJobManager.updateMetadata(streamId, {
+      responseMessageId: 'response-message-1',
+      endpoint: 'agents',
+      iconURL: 'https://example.com/spec-icon.png',
+      model: 'gpt-4.1',
+      userMessage: {
+        messageId: 'user-message-1',
+        parentMessageId: 'parent-message-1',
+        conversationId: streamId,
+        text: 'Use Google Workspace',
+      },
+    });
+    await GenerationJobManager.emitChunk(streamId, {
+      created: true,
+      streamId,
+      message: {
+        messageId: 'user-message-1',
+        parentMessageId: 'parent-message-1',
+        conversationId: streamId,
+        text: 'Use Google Workspace',
+        sender: 'User',
+        isCreatedByUser: true,
+      },
+    });
+
+    GenerationJobManager.setContentParts(streamId, [
+      {
+        type: 'tool_call',
+        tool_call: {
+          type: 'tool_call',
+          id: 'oauth-call-1',
+          name: 'oauth_mcp_Google-Workspace',
+          args: '',
+          auth: 'https://auth.example.com/oauth',
+        },
+      },
+    ] as never);
+
+    const abortResult = await GenerationJobManager.abortJob(streamId);
+
+    expect(abortResult.success).toBe(true);
+    expect(abortResult.content).toEqual([]);
+    expect(abortResult.text).toBe('');
+    expect(abortResult.finalEvent).toEqual(
+      expect.objectContaining({
+        earlyAbort: false,
+        conversation: { conversationId: streamId },
+        requestMessage: expect.objectContaining({
+          messageId: 'user-message-1',
+        }),
+        responseMessage: expect.objectContaining({
+          messageId: 'response-message-1',
+          content: [],
+          endpoint: 'agents',
+          iconURL: 'https://example.com/spec-icon.png',
+          model: 'gpt-4.1',
+        }),
+      }),
+    );
+
+    await GenerationJobManager.destroy();
+  });
+
+  it('should strip OAuth prompts but persist real abort content', async () => {
+    const { GenerationJobManager } = await import('../GenerationJobManager');
+    const { InMemoryJobStore } = await import('../implementations/InMemoryJobStore');
+    const { InMemoryEventTransport } = await import('../implementations/InMemoryEventTransport');
+
+    GenerationJobManager.configure({
+      jobStore: new InMemoryJobStore(),
+      eventTransport: new InMemoryEventTransport(),
+      isRedis: false,
+      cleanupOnComplete: false,
+    });
+
+    GenerationJobManager.initialize();
+
+    const streamId = `mixed-oauth-abort-${Date.now()}`;
+    await GenerationJobManager.createJob(streamId, 'user-1');
+    await GenerationJobManager.updateMetadata(streamId, {
+      responseMessageId: 'response-message-1',
+      userMessage: {
+        messageId: 'user-message-1',
+        parentMessageId: 'parent-message-1',
+        conversationId: streamId,
+        text: 'Use Google Workspace',
+      },
+    });
+
+    const textPart = { type: 'text', text: 'Partial response...' };
+    GenerationJobManager.setContentParts(streamId, [
+      {
+        type: 'tool_call',
+        tool_call: {
+          type: 'tool_call',
+          id: 'oauth-call-1',
+          name: 'oauth_mcp_Google-Workspace',
+          args: '',
+          auth: 'https://auth.example.com/oauth',
+        },
+      },
+      textPart,
+    ] as never);
+
+    const abortResult = await GenerationJobManager.abortJob(streamId);
+
+    expect(abortResult.success).toBe(true);
+    expect(abortResult.content).toEqual([textPart]);
+    expect(abortResult.text).toBe('Partial response...');
+    expect(abortResult.finalEvent).toEqual(
+      expect.objectContaining({
+        earlyAbort: false,
+        responseMessage: expect.objectContaining({
+          content: [textPart],
+        }),
+      }),
+    );
+
+    await GenerationJobManager.destroy();
+  });
+
   it('should return both text and collectedUsage on abort', async () => {
     const { GenerationJobManager } = await import('../GenerationJobManager');
     const { InMemoryJobStore } = await import('../implementations/InMemoryJobStore');
diff --git a/packages/api/src/stream/__tests__/usageResume.spec.ts b/packages/api/src/stream/__tests__/usageResume.spec.ts
new file mode 100644
index 00000000000..59564730f9c
--- /dev/null
+++ b/packages/api/src/stream/__tests__/usageResume.spec.ts
@@ -0,0 +1,96 @@
+import { InMemoryEventTransport } from '~/stream/implementations/InMemoryEventTransport';
+import { InMemoryJobStore } from '~/stream/implementations/InMemoryJobStore';
+import { GenerationJobManagerClass } from '~/stream/GenerationJobManager';
+
+jest.spyOn(console, 'log').mockImplementation();
+
+function createInMemoryManager(): GenerationJobManagerClass {
+  const manager = new GenerationJobManagerClass();
+  manager.configure({
+    jobStore: new InMemoryJobStore({ ttlAfterComplete: 60000 }),
+    eventTransport: new InMemoryEventTransport(),
+    isRedis: false,
+  });
+  manager.initialize();
+  return manager;
+}
+
+describe('GenerationJobManager usage resume state', () => {
+  let manager: GenerationJobManagerClass | undefined;
+
+  afterEach(async () => {
+    await manager?.destroy();
+    manager = undefined;
+  });
+
+  test('accumulates persisted token usage events in resume state', async () => {
+    manager = createInMemoryManager();
+    const streamId = `usage-resume-${Date.now()}`;
+    await manager.createJob(streamId, 'user-1', streamId);
+
+    const firstUsage = {
+      input_tokens: 1200,
+      output_tokens: 300,
+      input_token_details: { cache_creation: 100, cache_read: 800 },
+      model: 'claude-3-5-sonnet',
+      provider: 'anthropic',
+    };
+    const secondUsage = {
+      input_tokens: 1600,
+      output_tokens: 120,
+      model: 'claude-3-5-sonnet',
+      provider: 'anthropic',
+      usage_type: 'summarization',
+    };
+
+    await manager.emitChunk(streamId, { event: 'on_token_usage', data: firstUsage });
+    await manager.emitChunk(streamId, { event: 'on_token_usage', data: secondUsage });
+
+    const resumeState = await manager.getResumeState(streamId);
+    expect(resumeState?.collectedUsage).toEqual([firstUsage, secondUsage]);
+  });
+
+  test('omits collected usage when none was recorded', async () => {
+    manager = createInMemoryManager();
+    const streamId = `usage-resume-empty-${Date.now()}`;
+    await manager.createJob(streamId, 'user-1', streamId);
+
+    const resumeState = await manager.getResumeState(streamId);
+    expect(resumeState?.collectedUsage).toBeUndefined();
+    expect(resumeState?.contextUsage).toBeUndefined();
+  });
+
+  test('persists the latest context usage snapshot for resume', async () => {
+    manager = createInMemoryManager();
+    const streamId = `context-resume-${Date.now()}`;
+    await manager.createJob(streamId, 'user-1', streamId);
+
+    const makeSnapshot = (messageTokens: number) => ({
+      runId: 'run-1',
+      agentId: 'agent-1',
+      breakdown: {
+        maxContextTokens: 200000,
+        instructionTokens: 1500,
+        systemMessageTokens: 1000,
+        dynamicInstructionTokens: 0,
+        toolSchemaTokens: 500,
+        summaryTokens: 0,
+        toolCount: 3,
+        messageCount: 4,
+        messageTokens,
+        availableForMessages: 188500,
+      },
+      contextBudget: 190000,
+      effectiveInstructionTokens: 1500,
+      prePruneContextTokens: messageTokens,
+      remainingContextTokens: 190000 - 1500 - messageTokens,
+      calibrationRatio: 1.05,
+    });
+
+    await manager.emitChunk(streamId, { event: 'on_context_usage', data: makeSnapshot(4000) });
+    await manager.emitChunk(streamId, { event: 'on_context_usage', data: makeSnapshot(9000) });
+
+    const resumeState = await manager.getResumeState(streamId);
+    expect(resumeState?.contextUsage).toEqual(makeSnapshot(9000));
+  });
+});
diff --git a/packages/api/src/stream/abortContent.ts b/packages/api/src/stream/abortContent.ts
new file mode 100644
index 00000000000..a9177a9ff81
--- /dev/null
+++ b/packages/api/src/stream/abortContent.ts
@@ -0,0 +1,80 @@
+import { Constants, ContentTypes } from 'librechat-data-provider';
+import type { Agents, TMessageContentParts } from 'librechat-data-provider';
+
+const OAUTH_TOOL_CALL_PREFIX = `oauth${Constants.mcp_delimiter}`;
+
+type PersistableAbortContentPart = Agents.MessageContentComplex | TMessageContentParts;
+type AbortContentPart = PersistableAbortContentPart | null | undefined;
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return value != null && typeof value === 'object';
+}
+
+function getTextValue(value: unknown): string {
+  if (typeof value === 'string') {
+    return value;
+  }
+  if (isRecord(value) && typeof value.value === 'string') {
+    return value.value;
+  }
+  return '';
+}
+
+function getToolCall(part: Record<string, unknown>): Record<string, unknown> | null {
+  if (isRecord(part.tool_call)) {
+    return part.tool_call;
+  }
+
+  const keyedToolCall = part[ContentTypes.TOOL_CALL];
+  return isRecord(keyedToolCall) ? keyedToolCall : null;
+}
+
+function isOAuthPromptContentPart(part: AbortContentPart): boolean {
+  if (!isRecord(part) || part.type !== ContentTypes.TOOL_CALL) {
+    return false;
+  }
+
+  const partRecord = part as Record<string, unknown>;
+  const toolCall = getToolCall(partRecord);
+  if (!toolCall) {
+    return false;
+  }
+
+  const auth = typeof toolCall.auth === 'string' ? toolCall.auth : partRecord.auth;
+  if (typeof auth === 'string' && auth.trim().length > 0) {
+    return true;
+  }
+
+  const name = toolCall.name;
+  return typeof name === 'string' && name.startsWith(OAUTH_TOOL_CALL_PREFIX);
+}
+
+function isPersistableAbortContentPart(
+  part: AbortContentPart,
+): part is PersistableAbortContentPart {
+  if (!isRecord(part)) {
+    return false;
+  }
+
+  if (isOAuthPromptContentPart(part)) {
+    return false;
+  }
+
+  if (part.type === ContentTypes.TEXT) {
+    return getTextValue(part.text).trim().length > 0;
+  }
+
+  if (part.type === ContentTypes.THINK) {
+    return getTextValue(part.think).trim().length > 0;
+  }
+
+  return Object.keys(part).length > 0;
+}
+
+export function hasPersistableAbortContent(content: unknown): boolean {
+  return filterPersistableAbortContent(content).length > 0;
+}
+
+export function filterPersistableAbortContent(content: unknown): PersistableAbortContentPart[] {
+  return Array.isArray(content) ? content.filter(isPersistableAbortContentPart) : [];
+}
diff --git a/packages/api/src/stream/implementations/RedisJobStore.ts b/packages/api/src/stream/implementations/RedisJobStore.ts
index f2c4dd46618..a00eeba6b41 100644
--- a/packages/api/src/stream/implementations/RedisJobStore.ts
+++ b/packages/api/src/stream/implementations/RedisJobStore.ts
@@ -913,6 +913,7 @@ export class RedisJobStore implements IJobStore {
       error: data.error || undefined,
       userMessage: data.userMessage ? JSON.parse(data.userMessage) : undefined,
       responseMessageId: data.responseMessageId || undefined,
+      createdEventEmitted: data.createdEventEmitted === '1',
       sender: data.sender || undefined,
       syncSent: data.syncSent === '1',
       finalEvent: data.finalEvent || undefined,
@@ -920,6 +921,10 @@ export class RedisJobStore implements IJobStore {
       iconURL: data.iconURL || undefined,
       model: data.model || undefined,
       promptTokens: data.promptTokens ? parseInt(data.promptTokens, 10) : undefined,
+      titleEvent: data.titleEvent || undefined,
+      replayEvents: data.replayEvents || undefined,
+      contextUsage: data.contextUsage || undefined,
+      tokenUsage: data.tokenUsage || undefined,
     };
   }
 }
diff --git a/packages/api/src/stream/index.ts b/packages/api/src/stream/index.ts
index 74c13a2bf01..708a94c3d49 100644
--- a/packages/api/src/stream/index.ts
+++ b/packages/api/src/stream/index.ts
@@ -15,6 +15,7 @@ export type {
 
 export { createStreamServices } from './createStreamServices';
 export type { StreamServicesConfig, StreamServices } from './createStreamServices';
+export { filterPersistableAbortContent, hasPersistableAbortContent } from './abortContent';
 
 // Implementations (for advanced use cases)
 export { InMemoryJobStore } from './implementations/InMemoryJobStore';
diff --git a/packages/api/src/stream/interfaces/IJobStore.ts b/packages/api/src/stream/interfaces/IJobStore.ts
index 29de91f1b7f..fcb472c7cdc 100644
--- a/packages/api/src/stream/interfaces/IJobStore.ts
+++ b/packages/api/src/stream/interfaces/IJobStore.ts
@@ -1,5 +1,5 @@
-import type { Agents } from 'librechat-data-provider';
 import type { StandardGraph } from '@librechat/agents';
+import type { Agents } from 'librechat-data-provider';
 
 /**
  * Job status enum
@@ -30,6 +30,9 @@ export interface SerializableJobData {
   /** Response message ID for reconnection */
   responseMessageId?: string;
 
+  /** Whether the user-message created event has been emitted */
+  createdEventEmitted?: boolean;
+
   /** Sender name for UI display */
   sender?: string;
 
@@ -42,6 +45,15 @@ export interface SerializableJobData {
   /** Serialized title event for replay during active-stream resume */
   titleEvent?: string;
 
+  /** Serialized replay-only stream events for active-stream resume */
+  replayEvents?: string;
+
+  /** Serialized latest context usage snapshot for active-stream resume */
+  contextUsage?: string;
+
+  /** Serialized token usage events for active-stream resume (cross-replica safe) */
+  tokenUsage?: string;
+
   /** Endpoint metadata for abort handling - avoids storing functions */
   endpoint?: string;
   iconURL?: string;
@@ -70,7 +82,7 @@ export interface SerializableJobData {
  */
 export interface UsageMetadata {
   /** Logical usage bucket for accounting/reporting. Defaults to model response usage. */
-  usage_type?: 'message' | 'summarization';
+  usage_type?: 'message' | 'summarization' | 'subagent' | 'sequential';
   /** Total input tokens (prompt tokens) */
   input_tokens?: number;
   /** Total output tokens (completion tokens) */
@@ -81,6 +93,9 @@ export interface UsageMetadata {
   model?: string;
   /** Provider identifier that generated this usage */
   provider?: string;
+  /** Agent that produced this usage (graph agent id / subagent agent id). Lets
+   *  multi-endpoint graphs price each call with its own endpoint token config. */
+  agentId?: string;
   /**
    * OpenAI-style cache token details.
    * Present for OpenAI models (GPT-4, o1, etc.)
@@ -142,6 +157,8 @@ export interface ResumeState {
   responseMessageId?: string;
   conversationId?: string;
   sender?: string;
+  iconURL?: string;
+  model?: string;
   titleEvent?: {
     event: 'title';
     data?: {
@@ -149,6 +166,11 @@ export interface ResumeState {
       title?: string;
     };
   };
+  replayEvents?: Array<{
+    event: string;
+    data?: unknown;
+    [key: string]: unknown;
+  }>;
 }
 
 /**
diff --git a/packages/api/src/telemetry.ts b/packages/api/src/telemetry.ts
new file mode 100644
index 00000000000..c75db96f117
--- /dev/null
+++ b/packages/api/src/telemetry.ts
@@ -0,0 +1,6 @@
+/**
+ * Build entry shim for the `@librechat/api/telemetry` subpath export.
+ * Re-exports the telemetry barrel under a unique basename so the bundler emits
+ * stable `dist/telemetry.*` output (see tsdown.config.mjs for details).
+ */
+export * from './telemetry/index';
diff --git a/packages/api/src/telemetry/config.spec.ts b/packages/api/src/telemetry/config.spec.ts
index 128f07a5a32..2e87f9cb800 100644
--- a/packages/api/src/telemetry/config.spec.ts
+++ b/packages/api/src/telemetry/config.spec.ts
@@ -8,6 +8,7 @@ describe('getTelemetryConfig', () => {
     expect(config.sdkDisabled).toBe(false);
     expect(config.serviceName).toBe('librechat');
     expect(config.healthPath).toBe('/health');
+    expect(config.ioredisTracingEnabled).toBe(false);
   });
 
   it('enables tracing only when OTEL_TRACING_ENABLED is true', () => {
@@ -43,4 +44,12 @@ describe('getTelemetryConfig', () => {
 
     expect(config.serviceVersion).toBe('0.8.5');
   });
+
+  it('enables ioredis instrumentation only when explicitly configured', () => {
+    const config = getTelemetryConfig({
+      OTEL_IOREDIS_TRACING_ENABLED: 'true',
+    });
+
+    expect(config.ioredisTracingEnabled).toBe(true);
+  });
 });
diff --git a/packages/api/src/telemetry/config.ts b/packages/api/src/telemetry/config.ts
index 340197aa655..4848bf3be30 100644
--- a/packages/api/src/telemetry/config.ts
+++ b/packages/api/src/telemetry/config.ts
@@ -6,6 +6,7 @@ export type TelemetryStatus = 'disabled' | 'failed' | 'started' | 'starting' | '
 export interface TelemetryConfig {
   enabled: boolean;
   healthPath: string;
+  ioredisTracingEnabled: boolean;
   sdkDisabled: boolean;
   serviceName: string;
   serviceVersion?: string;
@@ -32,10 +33,12 @@ export function getTelemetryConfig(env: NodeJS.ProcessEnv = process.env): Teleme
   const serviceName = normalizeEnvValue(env.OTEL_SERVICE_NAME) ?? DEFAULT_SERVICE_NAME;
   const serviceVersion =
     normalizeEnvValue(env.OTEL_SERVICE_VERSION) ?? normalizeEnvValue(env.npm_package_version);
+  const ioredisTracingEnabled = isTruthy(env.OTEL_IOREDIS_TRACING_ENABLED);
 
   return {
     enabled,
     serviceName,
+    ioredisTracingEnabled,
     sdkDisabled,
     serviceVersion,
     healthPath: DEFAULT_HEALTH_PATH,
diff --git a/packages/api/src/telemetry/sdk.spec.ts b/packages/api/src/telemetry/sdk.spec.ts
index 9e79a49d9c9..c361a6cd5cc 100644
--- a/packages/api/src/telemetry/sdk.spec.ts
+++ b/packages/api/src/telemetry/sdk.spec.ts
@@ -1,8 +1,8 @@
 import { Socket } from 'node:net';
 import { IncomingMessage } from 'node:http';
 import { Agent as HttpsAgent } from 'node:https';
-import type { Span } from '@opentelemetry/api';
 import type { RequestOptions } from 'node:http';
+import type { Span } from '@opentelemetry/api';
 
 interface HttpInstrumentationOptions {
   requestHook?: (span: Span, request: object) => void;
@@ -191,6 +191,20 @@ describe('telemetry SDK lifecycle', () => {
     expect(mockExpressInstrumentation).toHaveBeenCalledTimes(1);
     expect(mockMongoDBInstrumentation).toHaveBeenCalledTimes(1);
     expect(mockMongooseInstrumentation).toHaveBeenCalledTimes(1);
+    expect(mockIORedisInstrumentation).not.toHaveBeenCalled();
+    expect(mockUndiciInstrumentation).toHaveBeenCalledTimes(1);
+  });
+
+  it('enables ioredis instrumentation when explicitly configured', () => {
+    initializeTelemetry({
+      OTEL_IOREDIS_TRACING_ENABLED: 'true',
+      OTEL_TRACING_ENABLED: 'true',
+    });
+
+    expect(mockMongooseInstrumentation).toHaveBeenCalledTimes(1);
+    expect(mockHttpInstrumentation).toHaveBeenCalledTimes(1);
+    expect(mockExpressInstrumentation).toHaveBeenCalledTimes(1);
+    expect(mockMongoDBInstrumentation).toHaveBeenCalledTimes(1);
     expect(mockIORedisInstrumentation).toHaveBeenCalledTimes(1);
     expect(mockUndiciInstrumentation).toHaveBeenCalledTimes(1);
   });
diff --git a/packages/api/src/telemetry/sdk.ts b/packages/api/src/telemetry/sdk.ts
index ea5e0a3de21..c3fb90b852d 100644
--- a/packages/api/src/telemetry/sdk.ts
+++ b/packages/api/src/telemetry/sdk.ts
@@ -12,8 +12,8 @@ import type { NodeSDKConfiguration } from '@opentelemetry/sdk-node';
 import type { Span, Attributes } from '@opentelemetry/api';
 import type { RequestOptions } from 'node:http';
 import type { TelemetryConfig, TelemetryStatus } from './config';
-import { getTelemetryConfig } from './config';
 import { registerShutdownTask } from '../app/shutdown';
+import { getTelemetryConfig } from './config';
 
 export interface TelemetryController {
   readonly enabled: boolean;
@@ -297,34 +297,39 @@ function getResourceAttributes(config: TelemetryConfig): Attributes {
 }
 
 function createSdk(config: TelemetryConfig): NodeSDK {
+  const instrumentations: NodeSDKConfiguration['instrumentations'] = [
+    new HttpInstrumentation({
+      headersToSpanAttributes: {
+        client: { requestHeaders: [], responseHeaders: [] },
+        server: { requestHeaders: [], responseHeaders: [] },
+      },
+      requestHook: (span: Span, request: object) => {
+        if (request instanceof IncomingMessage) {
+          requestSpans.set(request, span);
+        }
+      },
+      startIncomingSpanHook: (request: IncomingMessage) =>
+        getSanitizedIncomingUrlAttributes(request, config.healthPath),
+      startOutgoingSpanHook: (request: RequestOptions) =>
+        getSanitizedOutgoingHttpUrlAttributes(request),
+      ignoreIncomingRequestHook: (request: IncomingMessage) =>
+        shouldIgnoreIncomingRequest(request, config.healthPath),
+    }),
+    new ExpressInstrumentation(),
+    new MongoDBInstrumentation(),
+    new MongooseInstrumentation(),
+    new UndiciInstrumentation({
+      startSpanHook: (request: UndiciRequestInfo) => getSanitizedUndiciUrlAttributes(request),
+    }),
+  ];
+
+  if (config.ioredisTracingEnabled) {
+    instrumentations.push(new IORedisInstrumentation());
+  }
+
   const sdkConfig: Partial<NodeSDKConfiguration> = {
     resource: resourceFromAttributes(getResourceAttributes(config)),
-    instrumentations: [
-      new HttpInstrumentation({
-        headersToSpanAttributes: {
-          client: { requestHeaders: [], responseHeaders: [] },
-          server: { requestHeaders: [], responseHeaders: [] },
-        },
-        requestHook: (span: Span, request: object) => {
-          if (request instanceof IncomingMessage) {
-            requestSpans.set(request, span);
-          }
-        },
-        startIncomingSpanHook: (request: IncomingMessage) =>
-          getSanitizedIncomingUrlAttributes(request, config.healthPath),
-        startOutgoingSpanHook: (request: RequestOptions) =>
-          getSanitizedOutgoingHttpUrlAttributes(request),
-        ignoreIncomingRequestHook: (request: IncomingMessage) =>
-          shouldIgnoreIncomingRequest(request, config.healthPath),
-      }),
-      new ExpressInstrumentation(),
-      new MongoDBInstrumentation(),
-      new MongooseInstrumentation(),
-      new IORedisInstrumentation(),
-      new UndiciInstrumentation({
-        startSpanHook: (request: UndiciRequestInfo) => getSanitizedUndiciUrlAttributes(request),
-      }),
-    ],
+    instrumentations,
   };
 
   return new NodeSDK(sdkConfig);
diff --git a/packages/api/src/tools/definitions.spec.ts b/packages/api/src/tools/definitions.spec.ts
index 139fdfac3a6..316bfcf44de 100644
--- a/packages/api/src/tools/definitions.spec.ts
+++ b/packages/api/src/tools/definitions.spec.ts
@@ -1,11 +1,12 @@
-import { loadToolDefinitions } from './definitions';
-import { toolkitExpansion, toolkitParent } from './toolkits/mapping';
-import { getToolDefinition } from './registry/definitions';
+import { Providers } from '@librechat/agents';
 import type {
   LoadToolDefinitionsParams,
   LoadToolDefinitionsDeps,
   ActionToolDefinition,
 } from './definitions';
+import { toolkitExpansion, toolkitParent } from './toolkits/mapping';
+import { getToolDefinition } from './registry/definitions';
+import { loadToolDefinitions } from './definitions';
 
 describe('definitions.ts', () => {
   const mockGetOrFetchMCPServerTools = jest.fn().mockResolvedValue(null);
@@ -428,6 +429,69 @@ describe('definitions.ts', () => {
         expect(getItemDef?.description).toBe('Get a specific item');
       });
 
+      it('union-flattens MCP tool schemas for Google, but preserves unions otherwise', async () => {
+        const mockServerTools = {
+          issue_write_mcp_github: {
+            function: {
+              name: 'issue_write_mcp_github',
+              description: 'Write an issue',
+              parameters: {
+                type: 'object',
+                properties: {
+                  repo: { type: 'string' },
+                  payload: {
+                    anyOf: [
+                      {
+                        type: 'object',
+                        properties: { action: { const: 'create' }, title: { type: 'string' } },
+                      },
+                      {
+                        type: 'object',
+                        properties: { action: { const: 'update' }, number: { type: 'number' } },
+                      },
+                    ],
+                  },
+                },
+                required: ['repo'],
+              },
+            },
+          },
+        };
+        mockGetOrFetchMCPServerTools.mockResolvedValue(mockServerTools);
+
+        const deps: LoadToolDefinitionsDeps = {
+          getOrFetchMCPServerTools: mockGetOrFetchMCPServerTools,
+          isBuiltInTool: mockIsBuiltInTool,
+        };
+
+        const googleResult = await loadToolDefinitions(
+          {
+            userId: 'user-123',
+            agentId: 'agent-123',
+            tools: ['issue_write_mcp_github'],
+            provider: Providers.GOOGLE,
+          },
+          deps,
+        );
+        const googleDef = googleResult.toolDefinitions.find(
+          (d) => d.name === 'issue_write_mcp_github',
+        );
+        expect(JSON.stringify(googleDef?.parameters)).not.toContain('anyOf');
+        expect(
+          (googleDef?.parameters as { properties: Record<string, { properties: object }> })
+            .properties.payload.properties,
+        ).toEqual({ action: { type: 'string', enum: ['create'] }, title: { type: 'string' } });
+
+        const defaultResult = await loadToolDefinitions(
+          { userId: 'user-123', agentId: 'agent-123', tools: ['issue_write_mcp_github'] },
+          deps,
+        );
+        const defaultDef = defaultResult.toolDefinitions.find(
+          (d) => d.name === 'issue_write_mcp_github',
+        );
+        expect(JSON.stringify(defaultDef?.parameters)).toContain('anyOf');
+      });
+
       it('should load MCP tools with hyphenated server names (server-one)', async () => {
         const mockServerTools = {
           'list_items_mcp_server-one': {
diff --git a/packages/api/src/tools/definitions.ts b/packages/api/src/tools/definitions.ts
index bdb501e9d35..4babe3ed81f 100644
--- a/packages/api/src/tools/definitions.ts
+++ b/packages/api/src/tools/definitions.ts
@@ -5,11 +5,12 @@
  * @module packages/api/src/tools/definitions
  */
 
+import { Providers } from '@librechat/agents';
 import { Constants, isActionTool } from 'librechat-data-provider';
-import type { AgentToolOptions } from 'librechat-data-provider';
 import type { LCToolRegistry, JsonSchemaType, LCTool, GenericTool } from '@librechat/agents';
+import type { AgentToolOptions } from 'librechat-data-provider';
 import type { ToolDefinition } from './classification';
-import { resolveJsonSchemaRefs, normalizeJsonSchema } from '~/mcp/zod';
+import { resolveJsonSchemaRefs, normalizeJsonSchema, sanitizeGeminiSchema } from '~/mcp/zod';
 import { buildToolClassification } from './classification';
 import { getToolDefinition } from './registry/definitions';
 import { toolkitExpansion } from './toolkits/mapping';
@@ -39,6 +40,8 @@ export interface LoadToolDefinitionsParams {
   programmaticToolsEnabled?: boolean;
   /** Whether code execution is enabled and requested by this agent */
   codeExecutionEnabled?: boolean;
+  /** Agent provider — Gemini/Vertex tool schemas get union-flattened for compatibility */
+  provider?: Providers;
 }
 
 export interface ActionToolDefinition {
@@ -83,9 +86,21 @@ export async function loadToolDefinitions(
     deferredToolsEnabled = false,
     programmaticToolsEnabled = false,
     codeExecutionEnabled = false,
+    provider,
   } = params;
   const { getOrFetchMCPServerTools, isBuiltInTool, getActionToolDefinitions } = deps;
 
+  const isGoogle = provider === Providers.GOOGLE || provider === Providers.VERTEXAI;
+
+  /** Normalizes MCP tool params, additionally union-flattening for the Gemini/Vertex path. */
+  const buildMcpParameters = (mcpParams?: JsonSchemaType): JsonSchemaType | undefined => {
+    if (!mcpParams) {
+      return undefined;
+    }
+    const normalized = normalizeJsonSchema(resolveJsonSchemaRefs(mcpParams));
+    return isGoogle ? sanitizeGeminiSchema(normalized) : normalized;
+  };
+
   const emptyResult: LoadToolDefinitionsResult = {
     toolDefinitions: [],
     toolRegistry: new Map(),
@@ -159,9 +174,7 @@ export async function loadToolDefinitions(
           mcpToolDefs.push({
             name: actualToolName,
             description: toolDef.function.description || undefined,
-            parameters: toolDef.function.parameters
-              ? normalizeJsonSchema(resolveJsonSchemaRefs(toolDef.function.parameters))
-              : undefined,
+            parameters: buildMcpParameters(toolDef.function.parameters),
             serverName,
           });
         }
@@ -174,9 +187,7 @@ export async function loadToolDefinitions(
       mcpToolDefs.push({
         name: toolName,
         description: toolDef.function.description || undefined,
-        parameters: toolDef.function.parameters
-          ? normalizeJsonSchema(resolveJsonSchemaRefs(toolDef.function.parameters))
-          : undefined,
+        parameters: buildMcpParameters(toolDef.function.parameters),
         serverName,
       });
     }
diff --git a/packages/api/src/tools/toolkits/gemini.ts b/packages/api/src/tools/toolkits/gemini.ts
index 5eb0cec9fd8..d147ed6f564 100644
--- a/packages/api/src/tools/toolkits/gemini.ts
+++ b/packages/api/src/tools/toolkits/gemini.ts
@@ -75,7 +75,15 @@ const geminiImageGenJsonSchema: ExtendedJsonSchema = {
   required: ['prompt'],
 };
 
-export const geminiToolkit = {
+export const geminiToolkit: {
+  readonly gemini_image_gen: {
+    readonly name: 'gemini_image_gen';
+    readonly description: string;
+    readonly description_for_model: 'Use this tool to generate images from text descriptions using Vertex AI Gemini.\n1. Prompts should be detailed and specific for best results.\n2. One image per function call. Create only 1 image per request.\n3. IMPORTANT: When user asks to "edit", "modify", "change", or "swap" elements in an existing image:\n   - ALWAYS include the original image ID in the image_ids array\n   - Describe the desired changes clearly in the prompt\n   - The tool will generate a new image based on the original image context + your prompt\n4. IMPORTANT: For editing requests, use DIRECT editing instructions:\n   - User says "remove the gun" → prompt should be "remove the gun from this image"\n   - User says "make it blue" → prompt should be "make this image blue"\n   - User says "add sunglasses" → prompt should be "add sunglasses to this image"\n   - DO NOT reconstruct or modify the original prompt - use the user\'s editing instruction directly\n   - ALWAYS include the image being edited in image_ids array\n5. OPTIONAL: Use image_ids to provide context images that will influence the generation:\n   - Include any relevant image IDs from the conversation in the image_ids array\n   - These images will be used as visual context/inspiration for the new generation\n   - For "editing" requests, always include the image being "edited"\n6. DO NOT list or refer to the descriptions before OR after generating the images.\n7. Always mention the image type (photo, oil painting, watercolor painting, illustration, cartoon, drawing, vector, render, etc.) at the beginning of the prompt.\n8. Use aspectRatio to control the shape of the image:\n   - 16:9 or 3:2 for landscape/wide images\n   - 9:16 or 2:3 for portrait/tall images\n   - 21:9 for ultra-wide/cinematic images\n   - 1:1 for square images (default)\n9. Use imageSize to control the resolution: 1K (standard), 2K (high), 4K (maximum quality).\n\nThe prompt should be a detailed paragraph describing every part of the image in concrete, objective detail.';
+    readonly schema: ExtendedJsonSchema;
+    readonly responseFormat: 'content_and_artifact';
+  };
+} = {
   gemini_image_gen: {
     name: 'gemini_image_gen' as const,
     description: getGeminiImageGenDescription(),
diff --git a/packages/api/src/tools/toolkits/mapping.ts b/packages/api/src/tools/toolkits/mapping.ts
index e6cb14d9bcf..fc657b98e26 100644
--- a/packages/api/src/tools/toolkits/mapping.ts
+++ b/packages/api/src/tools/toolkits/mapping.ts
@@ -3,7 +3,9 @@
  * When a toolkit key appears in an agent's tool list,
  * these extra tools should also be included.
  */
-export const toolkitExpansion = {
+export const toolkitExpansion: {
+  readonly image_gen_oai: readonly ['image_edit_oai'];
+} = {
   image_gen_oai: ['image_edit_oai'],
 } as const satisfies Readonly<Record<string, readonly string[]>>;
 
diff --git a/packages/api/src/tools/toolkits/oai.ts b/packages/api/src/tools/toolkits/oai.ts
index 9786b0571de..65c00891243 100644
--- a/packages/api/src/tools/toolkits/oai.ts
+++ b/packages/api/src/tools/toolkits/oai.ts
@@ -131,7 +131,20 @@ Guidelines:
   required: ['image_ids', 'prompt'],
 };
 
-export const oaiToolkit = {
+export const oaiToolkit: {
+  readonly image_gen_oai: {
+    readonly name: 'image_gen_oai';
+    readonly description: string;
+    readonly schema: ExtendedJsonSchema;
+    readonly responseFormat: 'content_and_artifact';
+  };
+  readonly image_edit_oai: {
+    readonly name: 'image_edit_oai';
+    readonly description: string;
+    readonly schema: ExtendedJsonSchema;
+    readonly responseFormat: 'content_and_artifact';
+  };
+} = {
   image_gen_oai: {
     name: 'image_gen_oai' as const,
     description: getImageGenDescription(),
diff --git a/packages/api/src/types/anthropic.ts b/packages/api/src/types/anthropic.ts
index 7f62a149747..ca19482f3b1 100644
--- a/packages/api/src/types/anthropic.ts
+++ b/packages/api/src/types/anthropic.ts
@@ -1,10 +1,10 @@
 import { z } from 'zod';
 import { Dispatcher } from 'undici';
 import { AuthKeys, anthropicSchema, TVertexAISchema } from 'librechat-data-provider';
-import type { AnthropicClientOptions } from '@librechat/agents';
 import type { ThinkingDisplayWireValue } from 'librechat-data-provider';
-import type { LLMConfigResult } from './openai';
+import type { AnthropicClientOptions } from '@librechat/agents';
 import type { GoogleServiceKey } from '../utils/key';
+import type { LLMConfigResult } from './openai';
 
 export type AnthropicParameters = z.infer<typeof anthropicSchema>;
 
@@ -86,6 +86,11 @@ export interface AnthropicConfigOptions {
   addParams?: Record<string, unknown>;
   /** Parameters to drop/exclude from the configuration */
   dropParams?: string[];
+  /**
+   * Admin-configured custom request headers (with unresolved placeholders).
+   * Merged beneath provider-managed headers and resolved at request time.
+   */
+  headers?: Record<string, string>;
   /** Vertex AI specific options for Google Cloud configuration */
   vertexOptions?: VertexAIClientOptions;
   /** Full Vertex AI configuration including model mappings from YAML config */
diff --git a/packages/api/src/types/google.ts b/packages/api/src/types/google.ts
index c6a53f961aa..bf26f23a47f 100644
--- a/packages/api/src/types/google.ts
+++ b/packages/api/src/types/google.ts
@@ -27,4 +27,8 @@ export interface GoogleConfigOptions {
   streamRate?: number;
   /** Model to use for title generation */
   titleModel?: string;
+  /** Force Vertex AI auth semantics even when a Google API key is configured */
+  forceVertex?: boolean;
+  /** GCP project id for Vertex AI ADC/service-account authentication */
+  projectId?: string;
 }
diff --git a/packages/api/src/utils/axios.ts b/packages/api/src/utils/axios.ts
index bab5242d8e2..918e841d9e5 100644
--- a/packages/api/src/utils/axios.ts
+++ b/packages/api/src/utils/axios.ts
@@ -1,5 +1,5 @@
-import { Buffer } from 'buffer';
 import axios from 'axios';
+import { Buffer } from 'buffer';
 import { logger } from '@librechat/data-schemas';
 import type { AxiosInstance, AxiosProxyConfig, AxiosError } from 'axios';
 
@@ -45,7 +45,7 @@ export const logAxiosError = ({
 }: {
   message: string;
   error: AxiosError | Error | unknown;
-}) => {
+}): string => {
   let logMessage = message;
   try {
     const stack =
diff --git a/packages/api/src/utils/code.ts b/packages/api/src/utils/code.ts
index 9ac814a52b7..4293ef7f052 100644
--- a/packages/api/src/utils/code.ts
+++ b/packages/api/src/utils/code.ts
@@ -7,5 +7,5 @@ import https from 'https';
  * on Node 19+ (keepAlive: true by default), tainted sockets re-enter the global pool
  * and kill unrelated requests (e.g., node-fetch in CodeExecutor) after the idle timeout.
  */
-export const codeServerHttpAgent = new http.Agent({ keepAlive: false });
-export const codeServerHttpsAgent = new https.Agent({ keepAlive: false });
+export const codeServerHttpAgent: http.Agent = new http.Agent({ keepAlive: false });
+export const codeServerHttpsAgent: https.Agent = new https.Agent({ keepAlive: false });
diff --git a/packages/api/src/utils/env.spec.ts b/packages/api/src/utils/env.spec.ts
index 52013d943d6..ccfe42c93dd 100644
--- a/packages/api/src/utils/env.spec.ts
+++ b/packages/api/src/utils/env.spec.ts
@@ -1126,6 +1126,42 @@ describe('processMCPEnv', () => {
     });
   });
 
+  it('should process user placeholders in oauth_headers', () => {
+    const user = createTestUser({ id: 'user-123', email: 'test@example.com' });
+    const options: MCPOptions = {
+      type: 'streamable-http',
+      url: 'https://mcp.example.com/api',
+      oauth_headers: {
+        'X-User-Id': '{{LIBRECHAT_USER_ID}}',
+        'X-Static': 'static-value',
+      },
+    };
+
+    const result = processMCPEnv({ options, user });
+
+    expect('oauth_headers' in result! && result.oauth_headers).toEqual({
+      'X-User-Id': 'user-123',
+      'X-Static': 'static-value',
+    });
+  });
+
+  it('should NOT resolve user placeholders in oauth_headers when dbSourced', () => {
+    const user = createTestUser({ id: 'user-123' });
+    const options: MCPOptions = {
+      type: 'streamable-http',
+      url: 'https://mcp.example.com/api',
+      oauth_headers: {
+        'X-User-Id': '{{LIBRECHAT_USER_ID}}',
+      },
+    };
+
+    const result = processMCPEnv({ options, user, dbSourced: true });
+
+    expect('oauth_headers' in result! && result.oauth_headers).toEqual({
+      'X-User-Id': '{{LIBRECHAT_USER_ID}}',
+    });
+  });
+
   it('should process user field placeholders in all fields', () => {
     const user = createTestUser({
       id: 'user-123',
diff --git a/packages/api/src/utils/env.ts b/packages/api/src/utils/env.ts
index 61c308682be..7d331ada95a 100644
--- a/packages/api/src/utils/env.ts
+++ b/packages/api/src/utils/env.ts
@@ -379,6 +379,22 @@ export function processMCPEnv(params: {
     newObj.headers = processedHeaders;
   }
 
+  // Process OAuth headers if they exist; sent on OAuth discovery/token requests
+  if ('oauth_headers' in newObj && newObj.oauth_headers) {
+    const processedOAuthHeaders: Record<string, string> = {};
+    for (const [key, originalValue] of Object.entries(newObj.oauth_headers)) {
+      processedOAuthHeaders[key] = processSingleValue({
+        user,
+        body,
+        dbSourced,
+        originalValue,
+        customUserVars,
+        isHeader: true,
+      });
+    }
+    newObj.oauth_headers = processedOAuthHeaders;
+  }
+
   // Process URL if it exists (for WebSocket, SSE, StreamableHTTP types)
   if ('url' in newObj && newObj.url) {
     newObj.url = processSingleValue({
@@ -503,7 +519,7 @@ export function resolveHeaders(options?: {
   user?: Partial<IUser> | { id: string };
   body?: RequestBody;
   customUserVars?: Record<string, string>;
-}) {
+}): Record<string, string> {
   const { headers, user, body, customUserVars } = options ?? {};
   const inputHeaders = headers ?? {};
 
diff --git a/packages/api/src/utils/generators.ts b/packages/api/src/utils/generators.ts
index 902721df34b..29ececd4c4d 100644
--- a/packages/api/src/utils/generators.ts
+++ b/packages/api/src/utils/generators.ts
@@ -46,19 +46,23 @@ export function createFetch({
  * @param res - The response object to send events to
  * @returns Object containing handler functions
  */
-export function createStreamEventHandlers(res: ServerResponse) {
+export function createStreamEventHandlers(res: ServerResponse): {
+  on_run_step: (event: ServerSentEvent) => void;
+  on_message_delta: (event: ServerSentEvent) => void;
+  on_reasoning_delta: (event: ServerSentEvent) => void;
+} {
   return {
-    [GraphEvents.ON_RUN_STEP]: function (event: ServerSentEvent) {
+    [GraphEvents.ON_RUN_STEP]: function (event: ServerSentEvent): void {
       if (res) {
         sendEvent(res, event);
       }
     },
-    [GraphEvents.ON_MESSAGE_DELTA]: function (event: ServerSentEvent) {
+    [GraphEvents.ON_MESSAGE_DELTA]: function (event: ServerSentEvent): void {
       if (res) {
         sendEvent(res, event);
       }
     },
-    [GraphEvents.ON_REASONING_DELTA]: function (event: ServerSentEvent) {
+    [GraphEvents.ON_REASONING_DELTA]: function (event: ServerSentEvent): void {
       if (res) {
         sendEvent(res, event);
       }
@@ -67,7 +71,7 @@ export function createStreamEventHandlers(res: ServerResponse) {
 }
 
 export function createHandleLLMNewToken(streamRate: number) {
-  return async function () {
+  return async function (): Promise<void> {
     if (streamRate) {
       await sleep(streamRate);
     }
diff --git a/packages/api/src/utils/graph.ts b/packages/api/src/utils/graph.ts
index 3bb3d2bf4c3..3bce8ee4687 100644
--- a/packages/api/src/utils/graph.ts
+++ b/packages/api/src/utils/graph.ts
@@ -13,6 +13,15 @@ import {
  */
 const GRAPH_TOKEN_REGEX = new RegExp(GRAPH_TOKEN_PLACEHOLDER.replace(/[{}]/g, '\\$&'), 'g');
 
+type GraphTokenResolvable =
+  | string
+  | string[]
+  | boolean
+  | number
+  | null
+  | undefined
+  | Record<string, string | string[] | boolean | number | null | undefined>;
+
 /**
  * Response from a Graph API token exchange.
  */
@@ -67,26 +76,48 @@ export function recordContainsGraphTokenPlaceholder(
   return Object.values(record).some(containsGraphTokenPlaceholder);
 }
 
+function valueContainsGraphTokenPlaceholder(value: GraphTokenResolvable): boolean {
+  if (typeof value === 'string') {
+    return containsGraphTokenPlaceholder(value);
+  }
+  if (Array.isArray(value)) {
+    return value.some(containsGraphTokenPlaceholder);
+  }
+  if (value == null || typeof value !== 'object') {
+    return false;
+  }
+  return Object.values(value).some(valueContainsGraphTokenPlaceholder);
+}
+
 /**
- * Checks if MCP options contain the Graph token placeholder in headers, env, or url.
+ * Checks if MCP options contain the Graph token placeholder in connection fields.
  * @param options - The MCP options object
  * @returns True if any field contains the placeholder
  */
 export function mcpOptionsContainGraphTokenPlaceholder(options: {
+  args?: string[];
   headers?: Record<string, string>;
   env?: Record<string, string>;
+  oauth?: Record<string, string | string[] | boolean | number | null | undefined>;
+  oauth_headers?: Record<string, string>;
   url?: string;
 }): boolean {
   if (options.url && containsGraphTokenPlaceholder(options.url)) {
     return true;
   }
+  if (options.args?.some(containsGraphTokenPlaceholder)) {
+    return true;
+  }
   if (recordContainsGraphTokenPlaceholder(options.headers)) {
     return true;
   }
   if (recordContainsGraphTokenPlaceholder(options.env)) {
     return true;
   }
-  return false;
+  if (recordContainsGraphTokenPlaceholder(options.oauth_headers)) {
+    return true;
+  }
+  return valueContainsGraphTokenPlaceholder(options.oauth);
 }
 
 /**
@@ -176,6 +207,42 @@ export async function resolveGraphTokensInRecord(
   return resolved;
 }
 
+async function resolveGraphTokensInArray(
+  values: string[] | undefined,
+  options: GraphTokenOptions,
+): Promise<string[] | undefined> {
+  if (!values || !values.some(containsGraphTokenPlaceholder)) {
+    return values;
+  }
+
+  const resolved: string[] = [];
+  for (const value of values) {
+    resolved.push(await resolveGraphTokenPlaceholder(value, options));
+  }
+  return resolved;
+}
+
+async function resolveGraphTokensInOAuth(
+  oauth: Record<string, string | string[] | boolean | number | null | undefined> | undefined,
+  options: GraphTokenOptions,
+): Promise<Record<string, string | string[] | boolean | number | null | undefined> | undefined> {
+  if (!oauth || !valueContainsGraphTokenPlaceholder(oauth)) {
+    return oauth;
+  }
+
+  const resolved: Record<string, string | string[] | boolean | number | null | undefined> = {};
+  for (const [key, value] of Object.entries(oauth)) {
+    if (typeof value === 'string') {
+      resolved[key] = await resolveGraphTokenPlaceholder(value, options);
+    } else if (Array.isArray(value)) {
+      resolved[key] = await resolveGraphTokensInArray(value, options);
+    } else {
+      resolved[key] = value;
+    }
+  }
+  return resolved;
+}
+
 /**
  * Pre-processes MCP options to resolve Graph token placeholders.
  * This must be called before processMCPEnv since Graph token resolution is async.
@@ -186,8 +253,11 @@ export async function resolveGraphTokensInRecord(
  */
 export async function preProcessGraphTokens<
   T extends {
+    args?: string[];
     headers?: Record<string, string>;
     env?: Record<string, string>;
+    oauth?: Record<string, string | string[] | boolean | number | null | undefined>;
+    oauth_headers?: Record<string, string>;
     url?: string;
   },
 >(options: T, graphOptions: GraphTokenOptions): Promise<T> {
@@ -201,6 +271,10 @@ export async function preProcessGraphTokens<
     result.url = await resolveGraphTokenPlaceholder(result.url, graphOptions);
   }
 
+  if (result.args) {
+    result.args = await resolveGraphTokensInArray(result.args, graphOptions);
+  }
+
   if (result.headers) {
     result.headers = await resolveGraphTokensInRecord(result.headers, graphOptions);
   }
@@ -209,5 +283,13 @@ export async function preProcessGraphTokens<
     result.env = await resolveGraphTokensInRecord(result.env, graphOptions);
   }
 
+  if (result.oauth_headers) {
+    result.oauth_headers = await resolveGraphTokensInRecord(result.oauth_headers, graphOptions);
+  }
+
+  if (result.oauth) {
+    result.oauth = await resolveGraphTokensInOAuth(result.oauth, graphOptions);
+  }
+
   return result;
 }
diff --git a/packages/api/src/utils/headers.spec.ts b/packages/api/src/utils/headers.spec.ts
new file mode 100644
index 00000000000..ca5cdd8c10c
--- /dev/null
+++ b/packages/api/src/utils/headers.spec.ts
@@ -0,0 +1,155 @@
+import type { RunLLMConfig } from '~/types';
+import { mergeHeaders, resolveConfigHeaders } from './headers';
+
+describe('mergeHeaders', () => {
+  it('returns undefined when neither side has headers', () => {
+    expect(mergeHeaders(undefined, undefined)).toBeUndefined();
+  });
+
+  it('returns a copy of the side that is present', () => {
+    expect(mergeHeaders({ a: '1' }, undefined)).toEqual({ a: '1' });
+    expect(mergeHeaders(undefined, { b: '2' })).toEqual({ b: '2' });
+  });
+
+  it('lets override win on key collisions', () => {
+    expect(mergeHeaders({ a: 'base', b: 'base' }, { b: 'override' })).toEqual({
+      a: 'base',
+      b: 'override',
+    });
+  });
+
+  it('comma-unions anthropic-beta values from both sides (deduped)', () => {
+    const merged = mergeHeaders(
+      { 'anthropic-beta': 'custom-beta, shared' },
+      { 'anthropic-beta': 'shared,managed-beta' },
+    );
+    expect(merged?.['anthropic-beta']).toBe('custom-beta,shared,managed-beta');
+  });
+
+  it('does not mutate the input objects', () => {
+    const base = { a: '1' };
+    const override = { b: '2' };
+    mergeHeaders(base, override);
+    expect(base).toEqual({ a: '1' });
+    expect(override).toEqual({ b: '2' });
+  });
+
+  it('replaces a case-variant base key with the override (no duplicate header names)', () => {
+    const merged = mergeHeaders({ authorization: 'custom' }, { Authorization: 'Bearer managed' });
+    expect(merged).toEqual({ Authorization: 'Bearer managed' });
+  });
+
+  it('unions anthropic-beta case-insensitively, keeping the override casing', () => {
+    const merged = mergeHeaders(
+      { 'anthropic-beta': 'custom-beta' },
+      { 'Anthropic-Beta': 'managed-beta' },
+    );
+    expect(merged).toEqual({ 'Anthropic-Beta': 'custom-beta,managed-beta' });
+  });
+});
+
+describe('resolveConfigHeaders', () => {
+  const user = { id: 'user-123', email: 'person@example.com' };
+  const body = { conversationId: 'convo-abc' };
+
+  it('is a no-op when llmConfig is null/undefined', () => {
+    expect(() => resolveConfigHeaders({ llmConfig: null, user, body })).not.toThrow();
+    expect(() => resolveConfigHeaders({ llmConfig: undefined, user, body })).not.toThrow();
+  });
+
+  it('resolves OpenAI-style configuration.defaultHeaders', () => {
+    const llmConfig = {
+      configuration: {
+        defaultHeaders: {
+          'X-Conversation-Id': '{{LIBRECHAT_BODY_CONVERSATIONID}}',
+          'X-User-Id': '{{LIBRECHAT_USER_ID}}',
+        },
+      },
+    } as unknown as RunLLMConfig;
+
+    resolveConfigHeaders({ llmConfig, user, body });
+
+    expect(llmConfig.configuration?.defaultHeaders).toEqual({
+      'X-Conversation-Id': 'convo-abc',
+      'X-User-Id': 'user-123',
+    });
+  });
+
+  it('resolves Anthropic-style clientOptions.defaultHeaders while preserving non-placeholder values', () => {
+    const llmConfig = {
+      clientOptions: {
+        defaultHeaders: {
+          'anthropic-beta': 'fine-grained-tool-streaming-2025-05-14',
+          'cf-aig-metadata': '{"conversation_id":"{{LIBRECHAT_BODY_CONVERSATIONID}}"}',
+        },
+      },
+    } as unknown as RunLLMConfig;
+
+    resolveConfigHeaders({ llmConfig, user, body });
+
+    const clientOptions = (
+      llmConfig as unknown as { clientOptions: { defaultHeaders: Record<string, string> } }
+    ).clientOptions;
+    expect(clientOptions.defaultHeaders).toEqual({
+      'anthropic-beta': 'fine-grained-tool-streaming-2025-05-14',
+      'cf-aig-metadata': '{"conversation_id":"convo-abc"}',
+    });
+  });
+
+  it('leaves Google customHeaders untouched (resolved at init, not request time)', () => {
+    const llmConfig = {
+      customHeaders: {
+        'X-Conversation-Id': '{{LIBRECHAT_BODY_CONVERSATIONID}}',
+        Authorization: 'Bearer ${SOME_KEY}',
+      },
+    } as unknown as RunLLMConfig;
+
+    resolveConfigHeaders({ llmConfig, user, body });
+
+    // Native Google headers are resolved in initializeGoogle; resolveConfigHeaders
+    // must not re-process them (keeps the key-derived auth out of env expansion).
+    expect(
+      (llmConfig as unknown as { customHeaders: Record<string, string> }).customHeaders,
+    ).toEqual({
+      'X-Conversation-Id': '{{LIBRECHAT_BODY_CONVERSATIONID}}',
+      Authorization: 'Bearer ${SOME_KEY}',
+    });
+  });
+
+  it('resolves each header map only once across repeated calls (idempotent under reuse)', () => {
+    process.env.HEADERS_SPEC_IDEMPOTENT = 'env-value';
+    const reusedUser = { id: 'u', name: '${HEADERS_SPEC_IDEMPOTENT}' };
+    const llmConfig = {
+      configuration: { defaultHeaders: { 'X-Name': '{{LIBRECHAT_USER_NAME}}' } },
+    } as unknown as RunLLMConfig;
+
+    resolveConfigHeaders({ llmConfig, user: reusedUser, body });
+    // Second pass must NOT re-expand the now-substituted ${...} from the user name
+    resolveConfigHeaders({ llmConfig, user: reusedUser, body });
+
+    expect(llmConfig.configuration?.defaultHeaders).toEqual({
+      'X-Name': '${HEADERS_SPEC_IDEMPOTENT}',
+    });
+    delete process.env.HEADERS_SPEC_IDEMPOTENT;
+  });
+
+  it('resolves env-var placeholders in header values', () => {
+    process.env.HEADERS_SPEC_GATEWAY_KEY = 'secret-key';
+    const llmConfig = {
+      configuration: {
+        defaultHeaders: { 'X-Gateway-Key': '${HEADERS_SPEC_GATEWAY_KEY}' },
+      },
+    } as unknown as RunLLMConfig;
+
+    resolveConfigHeaders({ llmConfig, user, body });
+
+    expect(llmConfig.configuration?.defaultHeaders).toEqual({ 'X-Gateway-Key': 'secret-key' });
+    delete process.env.HEADERS_SPEC_GATEWAY_KEY;
+  });
+
+  it('leaves configs without header maps untouched', () => {
+    const llmConfig = { model: 'gpt-4o', configuration: {} } as unknown as RunLLMConfig;
+    expect(() => resolveConfigHeaders({ llmConfig, user, body })).not.toThrow();
+    expect(llmConfig.configuration).toEqual({});
+  });
+});
diff --git a/packages/api/src/utils/headers.ts b/packages/api/src/utils/headers.ts
new file mode 100644
index 00000000000..37ddd571ce6
--- /dev/null
+++ b/packages/api/src/utils/headers.ts
@@ -0,0 +1,128 @@
+import type { AnthropicClientOptions } from '@librechat/agents';
+import type { IUser } from '@librechat/data-schemas';
+import type { RequestBody, RunLLMConfig } from '~/types';
+import { resolveHeaders } from './env';
+
+/** Comma-unions two header values (deduped, trimmed), e.g. `anthropic-beta`. */
+function unionCsv(a: string, b: string): string {
+  const values = [a, b]
+    .flatMap((value) => value.split(','))
+    .map((value) => value.trim())
+    .filter(Boolean);
+  return Array.from(new Set(values)).join(',');
+}
+
+/**
+ * Merges two header maps, with `override` winning on key collisions. Matching is
+ * case-insensitive (HTTP header names are), so an `override` key replaces any
+ * case variant from `base` rather than leaving both names in the output (which
+ * clients may collapse, breaking auth or protocol headers); the `override`
+ * casing is kept. The `anthropic-beta` header is special-cased: values from both
+ * sides are comma-unioned (deduped) so a custom beta coexists with
+ * provider-managed betas instead of clobbering them.
+ *
+ * Used both to layer endpoint headers over global (`endpoints.all`) headers and
+ * to attach admin-configured custom headers beneath provider-managed headers
+ * (auth/version/beta), so the provider integration's own headers always win.
+ *
+ * @returns the merged map, or `undefined` when neither side has any headers.
+ */
+export function mergeHeaders(
+  base?: Record<string, string>,
+  override?: Record<string, string>,
+): Record<string, string> | undefined {
+  if (!base && !override) {
+    return undefined;
+  }
+
+  const merged: Record<string, string> = { ...(base ?? {}) };
+  if (!override) {
+    return merged;
+  }
+
+  const baseKeyByLower = new Map<string, string>(
+    Object.keys(merged).map((key) => [key.toLowerCase(), key]),
+  );
+
+  for (const [key, value] of Object.entries(override)) {
+    const lower = key.toLowerCase();
+    const existingKey = baseKeyByLower.get(lower);
+    const nextValue =
+      lower === 'anthropic-beta' && existingKey != null
+        ? unionCsv(merged[existingKey], value)
+        : value;
+
+    if (existingKey != null && existingKey !== key) {
+      delete merged[existingKey];
+    }
+    merged[key] = nextValue;
+    baseKeyByLower.set(lower, key);
+  }
+
+  return merged;
+}
+
+type DefaultHeadersContainer = { defaultHeaders?: Record<string, string> };
+
+/**
+ * Header maps already resolved by `resolveConfigHeaders`. `resolveConfigHeaders`
+ * mutates config objects in place, and the same initialized agent (hence the same
+ * nested header objects) can flow through `buildAgentInput` more than once (root +
+ * subagent, multiple parents). Resolving twice would run env expansion over values
+ * already substituted with user/body data, violating the env-before-user invariant
+ * documented in `resolveHeaders`. Tracking resolved maps makes resolution
+ * idempotent across reuse. Keyed by object identity (per-request fresh objects), so
+ * nothing carries across requests.
+ */
+const resolvedHeaderMaps = new WeakSet<object>();
+
+/**
+ * Resolves placeholder templates in the outbound request headers of a built LLM
+ * config, mutating it in place. Handles the OpenAI-compatible
+ * `configuration.defaultHeaders` (OpenAI / Azure / custom) and the native
+ * Anthropic `clientOptions.defaultHeaders` (including Vertex) carriers. Native
+ * Google `customHeaders` are intentionally NOT handled here — they are resolved
+ * once at init in `initializeGoogle`, so the provider-managed `Authorization`
+ * header (built from a possibly user-provided key) never passes through env
+ * expansion.
+ *
+ * Resolution runs at request time so request-body placeholders (e.g.
+ * `{{LIBRECHAT_BODY_CONVERSATIONID}}`) resolve against the live request. It is a
+ * no-op for header values without placeholders, and idempotent under config reuse.
+ */
+export function resolveConfigHeaders({
+  llmConfig,
+  user,
+  body,
+  customUserVars,
+}: {
+  llmConfig?: RunLLMConfig | null;
+  user?: Partial<IUser> | { id: string };
+  body?: RequestBody;
+  customUserVars?: Record<string, string>;
+}): void {
+  if (llmConfig == null) {
+    return;
+  }
+
+  const resolveOnce = (headers: Record<string, string>): Record<string, string> => {
+    if (resolvedHeaderMaps.has(headers)) {
+      return headers;
+    }
+    const resolved = resolveHeaders({ headers, user, body, customUserVars });
+    resolvedHeaderMaps.add(resolved);
+    return resolved;
+  };
+
+  const configuration = llmConfig.configuration as DefaultHeadersContainer | undefined;
+  if (configuration?.defaultHeaders != null) {
+    configuration.defaultHeaders = resolveOnce(configuration.defaultHeaders);
+  }
+
+  const clientOptions = (llmConfig as AnthropicClientOptions).clientOptions as
+    | DefaultHeadersContainer
+    | undefined;
+  if (clientOptions?.defaultHeaders != null) {
+    clientOptions.defaultHeaders = resolveOnce(clientOptions.defaultHeaders);
+  }
+}
diff --git a/packages/api/src/utils/http.ts b/packages/api/src/utils/http.ts
index e9f1d622815..9a0b39080b2 100644
--- a/packages/api/src/utils/http.ts
+++ b/packages/api/src/utils/http.ts
@@ -5,7 +5,10 @@
 export function normalizeHttpError(
   err: Error | { status?: number; message?: string } | unknown,
   fallbackStatus = 400,
-) {
+): {
+  status: number;
+  message: string;
+} {
   let status = fallbackStatus;
   if (err && typeof err === 'object' && 'status' in err && typeof err.status === 'number') {
     status = err.status;
diff --git a/packages/api/src/utils/index.ts b/packages/api/src/utils/index.ts
index bc78f784a0c..a23592bd37d 100644
--- a/packages/api/src/utils/index.ts
+++ b/packages/api/src/utils/index.ts
@@ -11,6 +11,7 @@ export * from './image';
 export * from './import';
 export * from './generators';
 export * from './graph';
+export * from './headers';
 export * from './path';
 export * from './key';
 export * from './latex';
@@ -19,6 +20,7 @@ export * from './math';
 export * from './oidc';
 export * from './openid';
 export * from './promise';
+export * from './proxy';
 export * from './ports';
 export * from './sanitizeTitle';
 export * from './text';
diff --git a/packages/api/src/utils/memory.ts b/packages/api/src/utils/memory.ts
index 214548d14be..4ab8318624e 100644
--- a/packages/api/src/utils/memory.ts
+++ b/packages/api/src/utils/memory.ts
@@ -1,6 +1,6 @@
 import { logger } from '@librechat/data-schemas';
-import { GenerationJobManager } from '~/stream';
 import { OAuthReconnectionManager } from '~/mcp/oauth/OAuthReconnectionManager';
+import { GenerationJobManager } from '~/stream';
 import { MCPManager } from '~/mcp/MCPManager';
 
 type ConnectionStats = ReturnType<InstanceType<typeof MCPManager>['getConnectionStats']>;
@@ -147,4 +147,10 @@ function stop(): void {
   logger.info('[MemDiag] Stopped memory diagnostics');
 }
 
-export const memoryDiagnostics = { start, stop, forceGC, getSnapshots, collectSnapshot };
+export const memoryDiagnostics: {
+  start: typeof start;
+  stop: typeof stop;
+  forceGC: typeof forceGC;
+  getSnapshots: typeof getSnapshots;
+  collectSnapshot: typeof collectSnapshot;
+} = { start, stop, forceGC, getSnapshots, collectSnapshot };
diff --git a/packages/api/src/utils/message.spec.ts b/packages/api/src/utils/message.spec.ts
index b1dcc6ea020..3cc6c4b2f6f 100644
--- a/packages/api/src/utils/message.spec.ts
+++ b/packages/api/src/utils/message.spec.ts
@@ -4,6 +4,8 @@ import {
   sanitizeFileForTransmit,
   buildMessageFiles,
   getThreadData,
+  isPreliminaryMessageId,
+  isUnpersistedPreliminaryParent,
 } from './message';
 
 /** Cast to string for type compatibility with ThreadMessage */
@@ -130,6 +132,55 @@ describe('sanitizeMessageForTransmit', () => {
   });
 });
 
+describe('isUnpersistedPreliminaryParent', () => {
+  it('returns false without querying for non-preliminary parent ids', async () => {
+    const getMessages = jest.fn();
+
+    await expect(
+      isUnpersistedPreliminaryParent({
+        userId: 'user-123',
+        conversationId: 'conversation-123',
+        parentMessageId: 'persisted-response',
+        getMessages,
+      }),
+    ).resolves.toBe(false);
+
+    expect(isPreliminaryMessageId('persisted-response')).toBe(false);
+    expect(getMessages).not.toHaveBeenCalled();
+  });
+
+  it('returns true when the underscore-suffixed parent is not persisted', async () => {
+    const getMessages = jest.fn().mockResolvedValue([]);
+
+    await expect(
+      isUnpersistedPreliminaryParent({
+        userId: 'user-123',
+        conversationId: 'conversation-123',
+        parentMessageId: 'pending-response_',
+        getMessages,
+      }),
+    ).resolves.toBe(true);
+
+    expect(getMessages).toHaveBeenCalledWith(
+      { user: 'user-123', messageId: 'pending-response_', conversationId: 'conversation-123' },
+      '_id',
+    );
+  });
+
+  it('returns false when the underscore-suffixed parent is already persisted', async () => {
+    const getMessages = jest.fn().mockResolvedValue([{ _id: 'persisted-parent' }]);
+
+    await expect(
+      isUnpersistedPreliminaryParent({
+        userId: 'user-123',
+        conversationId: 'conversation-123',
+        parentMessageId: 'persisted-response_',
+        getMessages,
+      }),
+    ).resolves.toBe(false);
+  });
+});
+
 describe('buildMessageFiles', () => {
   const baseAttachment = {
     file_id: 'file-1',
diff --git a/packages/api/src/utils/message.ts b/packages/api/src/utils/message.ts
index 732884c0f05..55d068577a7 100644
--- a/packages/api/src/utils/message.ts
+++ b/packages/api/src/utils/message.ts
@@ -4,6 +4,11 @@ import type { TFile, TMessage } from 'librechat-data-provider';
 /** Minimal shape for request file entries (from `req.body.files`) */
 type RequestFile = { file_id?: string };
 
+type GetMessagesByParentId = (
+  filter: { user: string; messageId: string; conversationId?: string },
+  select: '_id',
+) => Promise<unknown[]>;
+
 /** Fields to strip from files before client transmission */
 const FILE_STRIP_FIELDS = ['text', '_id', '__v'] as const;
 
@@ -92,6 +97,37 @@ export function sanitizeMessageForTransmit<T extends Partial<TMessage>>(
   return sanitized;
 }
 
+export function isPreliminaryMessageId(messageId: unknown): messageId is string {
+  return typeof messageId === 'string' && messageId.endsWith('_');
+}
+
+export async function isUnpersistedPreliminaryParent({
+  userId,
+  conversationId,
+  parentMessageId,
+  getMessages,
+}: {
+  userId: string;
+  conversationId?: string | null;
+  parentMessageId?: string | null;
+  getMessages: GetMessagesByParentId;
+}): Promise<boolean> {
+  if (!isPreliminaryMessageId(parentMessageId)) {
+    return false;
+  }
+
+  const filter: { user: string; messageId: string; conversationId?: string } = {
+    user: userId,
+    messageId: parentMessageId,
+  };
+  if (conversationId && conversationId !== Constants.NEW_CONVO) {
+    filter.conversationId = conversationId;
+  }
+
+  const messages = await getMessages(filter, '_id');
+  return messages.length === 0;
+}
+
 /** Minimal message shape for thread traversal.
  *
  * Both `files` and `attachments` carry `file_id` references, but they
diff --git a/packages/api/src/utils/proxy.spec.ts b/packages/api/src/utils/proxy.spec.ts
new file mode 100644
index 00000000000..774dd627e09
--- /dev/null
+++ b/packages/api/src/utils/proxy.spec.ts
@@ -0,0 +1,199 @@
+import { HttpsProxyAgent } from 'https-proxy-agent';
+import { EnvHttpProxyAgent, ProxyAgent } from 'undici';
+import {
+  applyAxiosProxyConfig,
+  getEnvProxyDispatcher,
+  getHttpsProxyAgent,
+  getProxyDispatcher,
+  getProxyEnvConfig,
+  getProxyUrlForUrl,
+  shouldBypassProxy,
+} from './proxy';
+
+jest.mock('https-proxy-agent', () => ({
+  HttpsProxyAgent: jest.fn(),
+}));
+
+jest.mock('undici', () => ({
+  EnvHttpProxyAgent: jest.fn(),
+  ProxyAgent: jest.fn(),
+}));
+
+const MockEnvHttpProxyAgent = EnvHttpProxyAgent as jest.MockedClass<typeof EnvHttpProxyAgent>;
+const MockProxyAgent = ProxyAgent as jest.MockedClass<typeof ProxyAgent>;
+const MockHttpsProxyAgent = HttpsProxyAgent as jest.MockedClass<typeof HttpsProxyAgent>;
+
+describe('proxy helpers', () => {
+  const originalEnv = process.env;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    process.env = { ...originalEnv };
+    delete process.env.PROXY;
+    delete process.env.proxy;
+    delete process.env.HTTP_PROXY;
+    delete process.env.HTTPS_PROXY;
+    delete process.env.NO_PROXY;
+    delete process.env.http_proxy;
+    delete process.env.https_proxy;
+    delete process.env.no_proxy;
+  });
+
+  afterAll(() => {
+    process.env = originalEnv;
+  });
+
+  it('returns undefined when no proxy env is configured', () => {
+    expect(getProxyEnvConfig()).toBeUndefined();
+    expect(getEnvProxyDispatcher()).toBeUndefined();
+    expect(MockEnvHttpProxyAgent).not.toHaveBeenCalled();
+  });
+
+  it('uses PROXY for both protocols and passes no_proxy through to undici', () => {
+    process.env.PROXY = 'http://corporate-proxy:8080';
+    process.env.no_proxy = 'localhost,.internal.example';
+
+    expect(getProxyEnvConfig()).toEqual({
+      httpProxy: 'http://corporate-proxy:8080',
+      httpsProxy: 'http://corporate-proxy:8080',
+      noProxy: 'localhost,.internal.example',
+    });
+
+    expect(getEnvProxyDispatcher()).toBeInstanceOf(EnvHttpProxyAgent);
+    expect(MockEnvHttpProxyAgent).toHaveBeenCalledWith({
+      httpProxy: 'http://corporate-proxy:8080',
+      httpsProxy: 'http://corporate-proxy:8080',
+      noProxy: 'localhost,.internal.example',
+    });
+  });
+
+  it('uses lowercase standard proxy env before uppercase values', () => {
+    process.env.HTTP_PROXY = 'http://upper-http:8080';
+    process.env.HTTPS_PROXY = 'http://upper-https:8080';
+    process.env.NO_PROXY = 'upper.example';
+    process.env.http_proxy = 'http://lower-http:8080';
+    process.env.https_proxy = 'http://lower-https:8080';
+    process.env.no_proxy = 'lower.example';
+
+    expect(getProxyEnvConfig()).toEqual({
+      httpProxy: 'http://lower-http:8080',
+      httpsProxy: 'http://lower-https:8080',
+      noProxy: 'lower.example',
+    });
+  });
+
+  it('reuses the env dispatcher until proxy env changes', () => {
+    process.env.PROXY = 'http://corporate-proxy-reuse:8080';
+    process.env.NO_PROXY = 'localhost';
+
+    const first = getEnvProxyDispatcher();
+    const second = getEnvProxyDispatcher();
+
+    expect(second).toBe(first);
+    expect(MockEnvHttpProxyAgent).toHaveBeenCalledTimes(1);
+
+    process.env.NO_PROXY = 'localhost,.internal.example';
+    getEnvProxyDispatcher();
+
+    expect(MockEnvHttpProxyAgent).toHaveBeenCalledTimes(2);
+  });
+
+  it('creates explicit proxy dispatchers when a non-env proxy is provided', () => {
+    const first = getProxyDispatcher('http://explicit-proxy:8080');
+    const second = getProxyDispatcher('http://explicit-proxy:8080');
+
+    expect(second).toBe(first);
+    expect(MockProxyAgent).toHaveBeenCalledTimes(1);
+    expect(MockProxyAgent).toHaveBeenCalledWith('http://explicit-proxy:8080');
+  });
+
+  it('uses the env dispatcher when the explicit proxy matches PROXY', () => {
+    process.env.PROXY = 'http://matching-proxy:8080';
+
+    getProxyDispatcher('http://matching-proxy:8080');
+
+    expect(MockEnvHttpProxyAgent).toHaveBeenCalledWith({
+      httpProxy: 'http://matching-proxy:8080',
+      httpsProxy: 'http://matching-proxy:8080',
+      noProxy: undefined,
+    });
+    expect(MockProxyAgent).not.toHaveBeenCalled();
+  });
+
+  it('matches NO_PROXY wildcard, domains, host ports, and whitespace separators', () => {
+    const noProxy = 'localhost, .internal.example api.example.com:8443 *.service.local *wild.local';
+
+    expect(shouldBypassProxy('https://localhost/login', noProxy)).toBe(true);
+    expect(shouldBypassProxy('https://sso.internal.example/login', noProxy)).toBe(true);
+    expect(shouldBypassProxy('https://api.example.com:8443/models', noProxy)).toBe(true);
+    expect(shouldBypassProxy('https://api.example.com/models', noProxy)).toBe(false);
+    expect(shouldBypassProxy('https://foo.service.local/search', noProxy)).toBe(true);
+    expect(shouldBypassProxy('https://api.wild.local/search', noProxy)).toBe(true);
+    expect(shouldBypassProxy('https://example.com', '*')).toBe(true);
+  });
+
+  it('resolves target-aware proxy URLs and respects NO_PROXY for axios-style agents', () => {
+    process.env.HTTP_PROXY = 'http://http-proxy:8080';
+    process.env.HTTPS_PROXY = 'http://https-proxy:8080';
+    process.env.NO_PROXY = 'internal.example';
+
+    expect(getProxyUrlForUrl('http://api.external.example/models')).toBe('http://http-proxy:8080');
+    expect(getProxyUrlForUrl('https://api.external.example/models')).toBe(
+      'http://https-proxy:8080',
+    );
+    expect(getProxyUrlForUrl('https://sso.internal.example/login')).toBeUndefined();
+  });
+
+  it('falls back to HTTP_PROXY for HTTPS axios-style agents', () => {
+    process.env.HTTP_PROXY = 'http://single-proxy:8080';
+
+    expect(getProxyUrlForUrl('https://api.external.example/models')).toBe(
+      'http://single-proxy:8080',
+    );
+
+    const config = applyAxiosProxyConfig({}, 'https://api.external.example/models');
+
+    expect(config).toEqual({
+      httpsAgent: expect.any(Object),
+      proxy: false,
+    });
+    expect(MockHttpsProxyAgent).toHaveBeenCalledWith('http://single-proxy:8080');
+  });
+
+  it('applies cached HttpsProxyAgent and disables axios native proxy handling', () => {
+    process.env.HTTPS_PROXY = 'http://https-proxy:8080';
+
+    const config = applyAxiosProxyConfig({}, 'https://api.external.example/models');
+    const agent = getHttpsProxyAgent('https://api.external.example/models');
+
+    expect(config).toEqual({
+      httpsAgent: agent,
+      proxy: false,
+    });
+    expect(MockHttpsProxyAgent).toHaveBeenCalledTimes(1);
+    expect(MockHttpsProxyAgent).toHaveBeenCalledWith('http://https-proxy:8080');
+  });
+
+  it('disables axios native proxy handling for NO_PROXY targets', () => {
+    process.env.proxy = 'http://axios-default-proxy:8080';
+    process.env.NO_PROXY = 'internal.example';
+
+    expect(applyAxiosProxyConfig({}, 'https://sso.internal.example/login')).toEqual({
+      proxy: false,
+    });
+    expect(MockHttpsProxyAgent).not.toHaveBeenCalled();
+  });
+
+  it('applies axios native proxy config to plain HTTP targets', () => {
+    process.env.HTTP_PROXY = 'http://http-proxy:8080';
+
+    expect(applyAxiosProxyConfig({}, 'http://api.external.example/models')).toEqual({
+      proxy: {
+        host: 'http-proxy',
+        port: 8080,
+        protocol: 'http',
+      },
+    });
+    expect(MockHttpsProxyAgent).not.toHaveBeenCalled();
+  });
+});
diff --git a/packages/api/src/utils/proxy.ts b/packages/api/src/utils/proxy.ts
new file mode 100644
index 00000000000..bb227ee942e
--- /dev/null
+++ b/packages/api/src/utils/proxy.ts
@@ -0,0 +1,237 @@
+import { HttpsProxyAgent } from 'https-proxy-agent';
+import { EnvHttpProxyAgent, ProxyAgent } from 'undici';
+import type { AxiosRequestConfig, AxiosProxyConfig } from 'axios';
+import type { Dispatcher } from 'undici';
+
+export type ProxyEnvConfig = {
+  httpProxy?: string;
+  httpsProxy?: string;
+  noProxy?: string;
+};
+
+type HttpsProxyAgentInstance = InstanceType<typeof HttpsProxyAgent>;
+type ProxyResolution = {
+  proxyUrl?: string;
+  bypassed: boolean;
+};
+
+let envProxyDispatcher: EnvHttpProxyAgent | undefined;
+let envProxyDispatcherKey: string | undefined;
+const explicitDispatchers = new Map<string, ProxyAgent>();
+const httpsProxyAgents = new Map<string, HttpsProxyAgentInstance>();
+
+function getTrimmedEnv(...keys: string[]): string | undefined {
+  for (const key of keys) {
+    const value = process.env[key]?.trim();
+    if (value) return value;
+  }
+  return undefined;
+}
+
+export function getProxyEnvConfig(): ProxyEnvConfig | undefined {
+  const proxy = getTrimmedEnv('PROXY', 'proxy');
+  const noProxy = getTrimmedEnv('no_proxy', 'NO_PROXY');
+
+  if (proxy) {
+    return { httpProxy: proxy, httpsProxy: proxy, noProxy };
+  }
+
+  const httpProxy = getTrimmedEnv('http_proxy', 'HTTP_PROXY');
+  const httpsProxy = getTrimmedEnv('https_proxy', 'HTTPS_PROXY');
+  if (!httpProxy && !httpsProxy) return undefined;
+
+  return { httpProxy, httpsProxy, noProxy };
+}
+
+function getProxyConfigKey(config: ProxyEnvConfig): string {
+  return [config.httpProxy ?? '', config.httpsProxy ?? '', config.noProxy ?? ''].join('|');
+}
+
+export function getEnvProxyDispatcher(): Dispatcher | undefined {
+  const proxyConfig = getProxyEnvConfig();
+  if (!proxyConfig) return undefined;
+
+  const key = getProxyConfigKey(proxyConfig);
+  if (!envProxyDispatcher || envProxyDispatcherKey !== key) {
+    envProxyDispatcher = new EnvHttpProxyAgent(proxyConfig);
+    envProxyDispatcherKey = key;
+  }
+
+  return envProxyDispatcher;
+}
+
+function getExplicitProxyDispatcher(proxyUrl: string): Dispatcher {
+  const cached = explicitDispatchers.get(proxyUrl);
+  if (cached) return cached;
+
+  const dispatcher = new ProxyAgent(proxyUrl);
+  explicitDispatchers.set(proxyUrl, dispatcher);
+  return dispatcher;
+}
+
+export function getProxyDispatcher(proxyUrl?: string | null): Dispatcher | undefined {
+  const trimmedProxy = proxyUrl?.trim();
+  if (!trimmedProxy) return getEnvProxyDispatcher();
+
+  const proxyConfig = getProxyEnvConfig();
+  if (proxyConfig?.httpProxy === trimmedProxy && proxyConfig?.httpsProxy === trimmedProxy) {
+    return getEnvProxyDispatcher();
+  }
+
+  return getExplicitProxyDispatcher(trimmedProxy);
+}
+
+function parseUrl(value: string | URL | undefined): URL | undefined {
+  if (!value) return undefined;
+  if (value instanceof URL) return value;
+  try {
+    return new URL(value);
+  } catch {
+    return undefined;
+  }
+}
+
+function normalizeHostname(value: string): string {
+  return value
+    .trim()
+    .toLowerCase()
+    .replace(/^\[|\]$/g, '')
+    .replace(/\.$/, '');
+}
+
+function getDefaultPort(protocol: string): number {
+  if (protocol === 'http:' || protocol === 'ws:') return 80;
+  if (protocol === 'https:' || protocol === 'wss:') return 443;
+  return 0;
+}
+
+function getNoProxyEntry(entry: string): { host: string; port: number } {
+  const trimmed = entry.trim();
+  const bracketed = trimmed.match(/^\[([^\]]+)\](?::(\d+))?$/);
+  if (bracketed) {
+    return {
+      host: normalizeHostname(bracketed[1]),
+      port: bracketed[2] ? Number.parseInt(bracketed[2], 10) : 0,
+    };
+  }
+
+  const parsed = (trimmed.match(/:/g) ?? []).length === 1 ? trimmed.match(/^(.+):(\d+)$/) : null;
+  const host = normalizeHostname(parsed ? parsed[1] : trimmed);
+  return {
+    host: host === '*' ? host : host.replace(/^\*\.?/, '.'),
+    port: parsed ? Number.parseInt(parsed[2], 10) : 0,
+  };
+}
+
+function hostMatchesNoProxy(hostname: string, entryHost: string): boolean {
+  if (!entryHost) return false;
+  if (entryHost === '*') return true;
+
+  const normalizedEntry = entryHost.startsWith('.') ? entryHost.slice(1) : entryHost;
+  return hostname === normalizedEntry || hostname.endsWith(`.${normalizedEntry}`);
+}
+
+export function shouldBypassProxy(targetUrl: string | URL, noProxy?: string): boolean {
+  if (!noProxy?.trim()) return false;
+
+  const url = parseUrl(targetUrl);
+  if (!url) return false;
+
+  const hostname = normalizeHostname(url.hostname);
+  const port = Number.parseInt(url.port, 10) || getDefaultPort(url.protocol);
+
+  return noProxy
+    .split(/[\s,]+/)
+    .filter(Boolean)
+    .some((entry) => {
+      const parsed = getNoProxyEntry(entry);
+      return parsed.port > 0 && parsed.port !== port
+        ? false
+        : hostMatchesNoProxy(hostname, parsed.host);
+    });
+}
+
+function getProxyResolution(targetUrl?: string | URL): ProxyResolution {
+  const proxyConfig = getProxyEnvConfig();
+  if (!proxyConfig) return { bypassed: false };
+
+  const url = parseUrl(targetUrl);
+  if (url && shouldBypassProxy(url, proxyConfig.noProxy)) {
+    return { bypassed: true };
+  }
+
+  if (!url) return { proxyUrl: proxyConfig.httpsProxy ?? proxyConfig.httpProxy, bypassed: false };
+  if (url.protocol === 'http:' || url.protocol === 'ws:') {
+    return { proxyUrl: proxyConfig.httpProxy, bypassed: false };
+  }
+  if (url.protocol === 'https:' || url.protocol === 'wss:') {
+    return { proxyUrl: proxyConfig.httpsProxy ?? proxyConfig.httpProxy, bypassed: false };
+  }
+  return { bypassed: false };
+}
+
+export function getProxyUrlForUrl(targetUrl?: string | URL): string | undefined {
+  return getProxyResolution(targetUrl).proxyUrl;
+}
+
+export function getHttpsProxyAgent(targetUrl?: string | URL): HttpsProxyAgentInstance | undefined {
+  const url = parseUrl(targetUrl);
+  if (url && url.protocol !== 'https:' && url.protocol !== 'wss:') return undefined;
+
+  const proxyUrl = getProxyUrlForUrl(targetUrl);
+  if (!proxyUrl) return undefined;
+
+  const cached = httpsProxyAgents.get(proxyUrl);
+  if (cached) return cached;
+
+  const agent = new HttpsProxyAgent(proxyUrl);
+  httpsProxyAgents.set(proxyUrl, agent);
+  return agent;
+}
+
+function getAxiosProxyConfig(proxyUrl: string): AxiosProxyConfig {
+  const url = new URL(proxyUrl);
+  const proxyConfig: Partial<AxiosProxyConfig> = {
+    host: url.hostname.replace(/^\[|\]$/g, ''),
+    protocol: url.protocol.replace(':', ''),
+  };
+
+  if (url.port) {
+    proxyConfig.port = Number.parseInt(url.port, 10);
+  }
+
+  if (url.username || url.password) {
+    proxyConfig.auth = {
+      username: decodeURIComponent(url.username),
+      password: decodeURIComponent(url.password),
+    };
+  }
+
+  return proxyConfig as AxiosProxyConfig;
+}
+
+export function applyAxiosProxyConfig(
+  config: AxiosRequestConfig,
+  targetUrl?: string | URL,
+): AxiosRequestConfig {
+  const resolution = getProxyResolution(targetUrl);
+  if (resolution.bypassed) {
+    config.proxy = false;
+    return config;
+  }
+
+  const url = parseUrl(targetUrl);
+  if (url && (url.protocol === 'http:' || url.protocol === 'ws:') && resolution.proxyUrl) {
+    config.proxy = getAxiosProxyConfig(resolution.proxyUrl);
+    return config;
+  }
+
+  const agent = getHttpsProxyAgent(targetUrl);
+  if (!agent) return config;
+
+  config.httpsAgent = agent;
+  config.proxy = false;
+  return config;
+}
+
+export const getOpenIdProxyDispatcher: () => Dispatcher | undefined = getEnvProxyDispatcher;
diff --git a/packages/api/src/utils/text.spec.ts b/packages/api/src/utils/text.spec.ts
index 30185f9da7c..cbafb25af77 100644
--- a/packages/api/src/utils/text.spec.ts
+++ b/packages/api/src/utils/text.spec.ts
@@ -222,6 +222,24 @@ describe('processTextWithTokenLimit', () => {
       expect(syncResult.wasTruncated).toBe(asyncResult.wasTruncated);
       expect(syncResult.text.length).toBe(asyncResult.text.length);
     });
+
+    it('should preserve the end of text when requested', async () => {
+      const { tokenCountFn } = createMockTokenCounter();
+      const text = `${'a'.repeat(200)}LATEST_MEMORY_REQUEST`;
+      const tokenLimit = 10;
+
+      const result = await processTextWithTokenLimit({
+        text,
+        tokenLimit,
+        tokenCountFn,
+        preserve: 'end',
+      });
+
+      expect(result.wasTruncated).toBe(true);
+      expect(result.tokenCount).toBeLessThanOrEqual(tokenLimit);
+      expect(result.text).toContain('LATEST_MEMORY_REQUEST');
+      expect(result.text).not.toContain('aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa');
+    });
   });
 
   describe('when text is under the token limit', () => {
diff --git a/packages/api/src/utils/text.ts b/packages/api/src/utils/text.ts
index 3099c2bbc4a..5273670e10c 100644
--- a/packages/api/src/utils/text.ts
+++ b/packages/api/src/utils/text.ts
@@ -39,10 +39,12 @@ export async function processTextWithTokenLimit({
   text,
   tokenLimit,
   tokenCountFn,
+  preserve = 'start',
 }: {
   text: string;
   tokenLimit: number;
   tokenCountFn: TokenCountFn;
+  preserve?: 'start' | 'end';
 }): Promise<{ text: string; tokenCount: number; wasTruncated: boolean }> {
   const originalTokenCount = await tokenCountFn(text);
 
@@ -61,7 +63,14 @@ export async function processTextWithTokenLimit({
   const ratio = tokenLimit / originalTokenCount;
   let charPosition = Math.floor(text.length * ratio * TRUNCATION_SAFETY_BUFFER);
 
-  let truncatedText = text.substring(0, charPosition);
+  const sliceText = (position: number) => {
+    if (position <= 0) {
+      return '';
+    }
+    return preserve === 'end' ? text.slice(-position) : text.substring(0, position);
+  };
+
+  let truncatedText = sliceText(charPosition);
   let tokenCount = await tokenCountFn(truncatedText);
 
   const maxIterations = 5;
@@ -70,7 +79,7 @@ export async function processTextWithTokenLimit({
   while (tokenCount > tokenLimit && iterations < maxIterations && charPosition > 0) {
     const overageRatio = tokenLimit / tokenCount;
     charPosition = Math.floor(charPosition * overageRatio * TRUNCATION_SAFETY_BUFFER);
-    truncatedText = text.substring(0, charPosition);
+    truncatedText = sliceText(charPosition);
     tokenCount = await tokenCountFn(truncatedText);
     iterations++;
   }
diff --git a/packages/api/src/utils/tokenizer.ts b/packages/api/src/utils/tokenizer.ts
index 4c638c948e1..d66908712a7 100644
--- a/packages/api/src/utils/tokenizer.ts
+++ b/packages/api/src/utils/tokenizer.ts
@@ -45,7 +45,7 @@ class Tokenizer {
   }
 }
 
-const TokenizerSingleton = new Tokenizer();
+const TokenizerSingleton: Tokenizer = new Tokenizer();
 
 /**
  * Counts the number of tokens in a given text using ai-tokenizer with o200k_base encoding.
diff --git a/packages/api/src/utils/tokens.spec.ts b/packages/api/src/utils/tokens.spec.ts
new file mode 100644
index 00000000000..0931c248156
--- /dev/null
+++ b/packages/api/src/utils/tokens.spec.ts
@@ -0,0 +1,33 @@
+import { EModelEndpoint } from 'librechat-data-provider';
+import type { EndpointTokenConfig } from '~/types';
+import { getModelMaxTokens, getModelMaxOutputTokens } from './tokens';
+
+describe('getModelMaxTokens partial-override fallback', () => {
+  const partialOverride: EndpointTokenConfig = {
+    'custom-model': { prompt: 1, completion: 2, context: 32000, output: 4096 },
+  };
+
+  it('uses the override for a listed model', () => {
+    expect(getModelMaxTokens('custom-model', EModelEndpoint.openAI, partialOverride)).toBe(32000);
+  });
+
+  it('falls back to the built-in map for a model absent from a partial override', () => {
+    const fallback = getModelMaxTokens('gpt-4o', EModelEndpoint.openAI, partialOverride);
+    const builtin = getModelMaxTokens('gpt-4o', EModelEndpoint.openAI);
+    expect(fallback).toBe(builtin);
+    expect(fallback).toBeGreaterThan(100000);
+  });
+});
+
+describe('getModelMaxOutputTokens partial-override fallback', () => {
+  const partialOverride: EndpointTokenConfig = {
+    'custom-model': { prompt: 1, completion: 2, context: 32000, output: 4096 },
+  };
+
+  it('falls back to the built-in map for a model absent from a partial override', () => {
+    const fallback = getModelMaxOutputTokens('gpt-4o', EModelEndpoint.openAI, partialOverride);
+    const builtin = getModelMaxOutputTokens('gpt-4o', EModelEndpoint.openAI);
+    expect(fallback).toBe(builtin);
+    expect(fallback).toBeGreaterThan(0);
+  });
+});
diff --git a/packages/api/src/utils/tokens.ts b/packages/api/src/utils/tokens.ts
index fadec1ffe21..b9e248bbcae 100644
--- a/packages/api/src/utils/tokens.ts
+++ b/packages/api/src/utils/tokens.ts
@@ -55,10 +55,13 @@ const openAIModels = {
   'gpt-5.1': 400000,
   'gpt-5.2': 400000,
   'gpt-5.3': 400000,
-  'gpt-5.4': 272000, // standard context; 1M experimental available via API opt-in (2x rate)
-  'gpt-5.4-pro': 272000, // same window as gpt-5.4
+  'gpt-5.4': 1050000, // >272K input prices at the long-context tier (2x input, 1.5x output)
+  'gpt-5.4-pro': 1050000,
+  'gpt-5.4-mini': 400000,
+  'gpt-5.4-nano': 400000,
   'gpt-5.5': 1050000,
   'gpt-5.5-pro': 1050000,
+  'chat-latest': 400000,
   'gpt-5-mini': 400000,
   'gpt-5-nano': 400000,
   'gpt-5-pro': 400000,
@@ -156,6 +159,8 @@ const anthropicModels = {
   'claude-opus-4-6': 1000000,
   'claude-opus-4-7': 1000000,
   'claude-opus-4-8': 1000000,
+  'claude-fable-5': 1000000,
+  'claude-mythos-5': 1000000,
 };
 
 const deepseekModels = {
@@ -361,7 +366,7 @@ const aggregateModels = {
   ...openAIModels,
 };
 
-export const maxTokensMap = {
+export const maxTokensMap: Record<string, Record<string, number>> = {
   [EModelEndpoint.azureOpenAI]: openAIModels,
   [EModelEndpoint.openAI]: aggregateModels,
   [EModelEndpoint.agents]: aggregateModels,
@@ -381,8 +386,11 @@ export const modelMaxOutputs = {
   'gpt-5.3': 128000,
   'gpt-5.4': 128000,
   'gpt-5.4-pro': 128000,
+  'gpt-5.4-mini': 128000,
+  'gpt-5.4-nano': 128000,
   'gpt-5.5': 128000,
   'gpt-5.5-pro': 128000,
+  'chat-latest': 128000,
   'gpt-5-mini': 128000,
   'gpt-5-nano': 128000,
   'gpt-5-pro': 128000,
@@ -405,6 +413,8 @@ const anthropicMaxOutputs = {
   'claude-opus-4-6': 128000,
   'claude-opus-4-7': 128000,
   'claude-opus-4-8': 128000,
+  'claude-fable-5': 128000,
+  'claude-mythos-5': 128000,
   'claude-3.5-sonnet': 8192,
   'claude-3-5-sonnet': 8192,
   'claude-3.7-sonnet': 128000,
@@ -421,7 +431,7 @@ const deepseekMaxOutputs = {
   'deepseek.r1': 64000,
 };
 
-export const maxOutputTokensMap = {
+export const maxOutputTokensMap: Record<string, Record<string, number>> = {
   [EModelEndpoint.anthropic]: anthropicMaxOutputs,
   [EModelEndpoint.azureOpenAI]: modelMaxOutputs,
   [EModelEndpoint.openAI]: { ...modelMaxOutputs, ...deepseekMaxOutputs },
@@ -506,11 +516,19 @@ export function getModelTokenValue(
  */
 export function getModelMaxTokens(
   modelName: string,
-  endpoint = EModelEndpoint.openAI,
+  endpoint: EModelEndpoint = EModelEndpoint.openAI,
   endpointTokenConfig?: EndpointTokenConfig,
 ): number | undefined {
-  const tokensMap = endpointTokenConfig ?? maxTokensMap[endpoint as keyof typeof maxTokensMap];
-  return getModelTokenValue(modelName, tokensMap);
+  /** A partial override only covers the models it lists; fall back to the
+   *  built-in map for unlisted models instead of dropping to the default
+   *  budget (matches buildTokenConfigMap and getMultiplier). */
+  if (endpointTokenConfig != null) {
+    const overrideValue = getModelTokenValue(modelName, endpointTokenConfig);
+    if (overrideValue != null) {
+      return overrideValue;
+    }
+  }
+  return getModelTokenValue(modelName, maxTokensMap[endpoint as keyof typeof maxTokensMap]);
 }
 
 /**
@@ -523,12 +541,21 @@ export function getModelMaxTokens(
  */
 export function getModelMaxOutputTokens(
   modelName: string,
-  endpoint = EModelEndpoint.openAI,
+  endpoint: EModelEndpoint = EModelEndpoint.openAI,
   endpointTokenConfig?: EndpointTokenConfig,
 ): number | undefined {
-  const tokensMap =
-    endpointTokenConfig ?? maxOutputTokensMap[endpoint as keyof typeof maxOutputTokensMap];
-  return getModelTokenValue(modelName, tokensMap, 'output');
+  /** Partial override fallback — see getModelMaxTokens */
+  if (endpointTokenConfig != null) {
+    const overrideValue = getModelTokenValue(modelName, endpointTokenConfig, 'output');
+    if (overrideValue != null) {
+      return overrideValue;
+    }
+  }
+  return getModelTokenValue(
+    modelName,
+    maxOutputTokensMap[endpoint as keyof typeof maxOutputTokensMap],
+    'output',
+  );
 }
 
 /**
@@ -546,7 +573,7 @@ export function getModelMaxOutputTokens(
  */
 export function matchModelName(
   modelName: string,
-  endpoint = EModelEndpoint.openAI,
+  endpoint: EModelEndpoint = EModelEndpoint.openAI,
 ): string | undefined {
   if (typeof modelName !== 'string') {
     return undefined;
@@ -565,7 +592,29 @@ export function matchModelName(
   return matchedPattern || modelName;
 }
 
-export const modelSchema = z.object({
+export const modelSchema: z.ZodObject<
+  {
+    id: z.ZodString;
+    pricing: z.ZodObject<
+      {
+        prompt: z.ZodString;
+        completion: z.ZodString;
+      },
+      'strip',
+      z.ZodTypeAny,
+      {
+        prompt: string;
+        completion: string;
+      },
+      {
+        prompt: string;
+        completion: string;
+      }
+    >;
+    context_length: z.ZodNumber;
+  },
+  'strip'
+> = z.object({
   id: z.string(),
   pricing: z.object({
     prompt: z.string(),
@@ -574,7 +623,54 @@ export const modelSchema = z.object({
   context_length: z.number(),
 });
 
-export const inputSchema = z.object({
+export const inputSchema: z.ZodObject<
+  {
+    data: z.ZodArray<
+      z.ZodObject<
+        {
+          id: z.ZodString;
+          pricing: z.ZodObject<
+            {
+              prompt: z.ZodString;
+              completion: z.ZodString;
+            },
+            'strip',
+            z.ZodTypeAny,
+            {
+              prompt: string;
+              completion: string;
+            },
+            {
+              prompt: string;
+              completion: string;
+            }
+          >;
+          context_length: z.ZodNumber;
+        },
+        'strip',
+        z.ZodTypeAny,
+        {
+          id: string;
+          pricing: {
+            prompt: string;
+            completion: string;
+          };
+          context_length: number;
+        },
+        {
+          id: string;
+          pricing: {
+            prompt: string;
+            completion: string;
+          };
+          context_length: number;
+        }
+      >,
+      'many'
+    >;
+  },
+  'strip'
+> = z.object({
   data: z.array(modelSchema),
 });
 
diff --git a/packages/api/src/utils/yaml.ts b/packages/api/src/utils/yaml.ts
index 50ea0bd4de2..ed237b81dd8 100644
--- a/packages/api/src/utils/yaml.ts
+++ b/packages/api/src/utils/yaml.ts
@@ -1,7 +1,7 @@
 import fs from 'fs';
 import yaml from 'js-yaml';
 
-export function loadYaml(filepath: string) {
+export function loadYaml(filepath: string): unknown {
   try {
     const fileContents = fs.readFileSync(filepath, 'utf8');
     return yaml.load(fileContents);
diff --git a/packages/api/tsdown.config.mjs b/packages/api/tsdown.config.mjs
new file mode 100644
index 00000000000..3a4202e9ec7
--- /dev/null
+++ b/packages/api/tsdown.config.mjs
@@ -0,0 +1,21 @@
+import path from 'node:path';
+import { defineConfig } from 'tsdown';
+
+export default defineConfig({
+  // The telemetry entry is a thin shim (`src/telemetry.ts`) rather than the
+  // `src/telemetry/index.ts` barrel: oxc emits declarations flat into outDir keyed
+  // by source basename, so two `index.ts` entries would collide (index.d.cts +
+  // index2.d.cts). Distinct basenames yield stable `index.*` / `telemetry.*` output.
+  entry: ['src/index.ts', 'src/telemetry.ts'],
+  format: ['cjs'],
+  platform: 'node',
+  dts: { oxc: true },
+  outDir: 'dist',
+  sourcemap: true,
+  // Externalize every third-party dependency (consumers provide the peers) and bundle
+  // only first-party code: relative imports and the `~/*` tsconfig alias (-> src).
+  // `neverBundle` is the 0.22 replacement for the deprecated `external` option.
+  deps: {
+    neverBundle: (id) => !id.startsWith('.') && !id.startsWith('~') && !path.isAbsolute(id),
+  },
+});
diff --git a/packages/client/package.json b/packages/client/package.json
index cd60bedb182..17674b9cc40 100644
--- a/packages/client/package.json
+++ b/packages/client/package.json
@@ -1,20 +1,27 @@
 {
   "name": "@librechat/client",
-  "version": "0.4.60",
+  "version": "0.4.61",
   "description": "React components for LibreChat",
   "repository": {
     "type": "git",
     "url": "https://github.com/danny-avila/LibreChat"
   },
-  "main": "dist/index.js",
-  "module": "dist/index.es.js",
-  "types": "dist/types/index.d.ts",
+  "main": "dist/index.cjs",
+  "module": "dist/index.mjs",
+  "types": "./dist/index.d.cts",
   "exports": {
     ".": {
-      "import": "./dist/index.es.js",
-      "require": "./dist/index.js",
-      "types": "./dist/types/index.d.ts"
-    }
+      "import": {
+        "types": "./dist/index.d.mts",
+        "default": "./dist/index.mjs"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    },
+    "./style.css": "./dist/style.css",
+    "./package.json": "./package.json"
   },
   "files": [
     "dist"
@@ -22,11 +29,11 @@
   "scripts": {
     "clean": "rimraf dist",
     "b:clean": "bun run rimraf dist",
-    "build": "npm run clean && rollup -c --bundleConfigAsCjs",
-    "build:dev": "npm run clean && NODE_ENV=development rollup -c --bundleConfigAsCjs",
-    "b:build": "bun run b:clean && bun run rollup -c --silent --bundleConfigAsCjs",
-    "build:watch": "rollup -c -w --bundleConfigAsCjs",
-    "dev": "rollup -c -w --bundleConfigAsCjs"
+    "build": "npm run clean && tsdown",
+    "build:dev": "npm run clean && NODE_ENV=development tsdown",
+    "b:build": "bun run b:clean && bun run tsdown",
+    "build:watch": "tsdown --watch",
+    "dev": "tsdown --watch"
   },
   "peerDependencies": {
     "@ariakit/react": "^0.4.16",
@@ -59,7 +66,7 @@
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "dompurify": "^3.4.0",
-    "framer-motion": "^12.23.6",
+    "framer-motion": "^12.40.0",
     "i18next": "^24.2.2 || ^25.3.2",
     "i18next-browser-languagedetector": "^8.2.0",
     "input-otp": "^1.4.2",
@@ -90,6 +97,7 @@
     "@tanstack/react-virtual": "^3.13.13",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^14.0.0",
+    "@tsdown/css": "^0.22.2",
     "@types/jest": "^29.5.14",
     "@types/react": "^18.2.11",
     "@types/react-dom": "^18.2.4",
@@ -112,6 +120,7 @@
     "rollup-plugin-postcss": "^4.0.2",
     "rollup-plugin-typescript2": "^0.37.0",
     "tailwindcss-radix": "^2.8.0",
-    "typescript": "^5.0.0"
+    "tsdown": "^0.22.2",
+    "typescript": "^5.9.3"
   }
 }
diff --git a/packages/client/rollup.config.js b/packages/client/rollup.config.js
deleted file mode 100644
index 149545f6269..00000000000
--- a/packages/client/rollup.config.js
+++ /dev/null
@@ -1,82 +0,0 @@
-// ESM bundler config for React components
-import { fileURLToPath } from 'url';
-import alias from '@rollup/plugin-alias';
-import postcss from 'rollup-plugin-postcss';
-import replace from '@rollup/plugin-replace';
-import commonjs from '@rollup/plugin-commonjs';
-import resolve from '@rollup/plugin-node-resolve';
-import typescript from 'rollup-plugin-typescript2';
-import { dirname, resolve as pathResolve } from 'path';
-import peerDepsExternal from 'rollup-plugin-peer-deps-external';
-import pkg from './package.json';
-
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-
-const plugins = [
-  peerDepsExternal(),
-  alias({
-    entries: [{ find: '~', replacement: pathResolve(__dirname, 'src') }],
-  }),
-  resolve({
-    extensions: ['.js', '.jsx', '.ts', '.tsx'],
-    browser: true,
-    preferBuiltins: false,
-  }),
-  replace({
-    'process.env.NODE_ENV': JSON.stringify(process.env.NODE_ENV || 'production'),
-    'process.env.VITE_ENABLE_LOGGER': JSON.stringify(process.env.VITE_ENABLE_LOGGER || 'false'),
-    'process.env.VITE_LOGGER_FILTER': JSON.stringify(process.env.VITE_LOGGER_FILTER || ''),
-    preventAssignment: true,
-  }),
-  commonjs(),
-  postcss({
-    extract: false,
-    inject: true,
-    minimize: process.env.NODE_ENV === 'production',
-    modules: false,
-    config: {
-      path: './postcss.config.js',
-    },
-  }),
-  typescript({
-    tsconfig: './tsconfig.json',
-    useTsconfigDeclarationDir: true,
-    clean: true,
-    check: false,
-  }),
-];
-
-const isDev = process.env.NODE_ENV !== 'production';
-
-export default {
-  input: 'src/index.ts',
-  output: [
-    {
-      file: pkg.main,
-      format: 'cjs',
-      sourcemap: isDev ? 'inline' : true,
-      exports: 'named',
-    },
-    {
-      file: pkg.module,
-      format: 'esm',
-      sourcemap: isDev ? 'inline' : true,
-      exports: 'named',
-    },
-  ],
-  external: [
-    ...Object.keys(pkg.peerDependencies || {}),
-    'react/jsx-runtime',
-    'react/jsx-dev-runtime',
-  ],
-  preserveSymlinks: true,
-  plugins,
-  onwarn(warning, warn) {
-    // Ignore "use client" directive warnings
-    if (warning.code === 'MODULE_LEVEL_DIRECTIVE') {
-      return;
-    }
-    warn(warning);
-  },
-};
diff --git a/packages/client/src/Providers/ToastContext.tsx b/packages/client/src/Providers/ToastContext.tsx
index afe24995d23..6a34228588d 100644
--- a/packages/client/src/Providers/ToastContext.tsx
+++ b/packages/client/src/Providers/ToastContext.tsx
@@ -1,4 +1,5 @@
-import { createContext, useContext, ReactNode } from 'react';
+import { createContext, useContext, ReactNode, Context } from 'react';
+import { JSX } from 'react/jsx-runtime';
 import type { TShowToast } from '~/common';
 import useToast from '~/hooks/useToast';
 
@@ -6,15 +7,15 @@ type ToastContextType = {
   showToast: ({ message, severity, showIcon, duration }: TShowToast) => void;
 };
 
-export const ToastContext = createContext<ToastContextType>({
+export const ToastContext: Context<ToastContextType> = createContext<ToastContextType>({
   showToast: () => ({}),
 });
 
-export function useToastContext() {
+export function useToastContext(): ToastContextType {
   return useContext(ToastContext);
 }
 
-export default function ToastProvider({ children }: { children: ReactNode }) {
+export default function ToastProvider({ children }: { children: ReactNode }): JSX.Element {
   const { showToast } = useToast();
 
   return <ToastContext.Provider value={{ showToast }}>{children}</ToastContext.Provider>;
diff --git a/packages/client/src/components/Accordion.tsx b/packages/client/src/components/Accordion.tsx
index 813cf4fa029..b013d0378f0 100644
--- a/packages/client/src/components/Accordion.tsx
+++ b/packages/client/src/components/Accordion.tsx
@@ -1,11 +1,17 @@
 import * as React from 'react';
-import * as AccordionPrimitive from '@radix-ui/react-accordion';
 import { ChevronDownIcon } from '@radix-ui/react-icons';
+import * as AccordionPrimitive from '@radix-ui/react-accordion';
 import { cn } from '~/utils';
 
-const Accordion = AccordionPrimitive.Root;
+const Accordion: React.ForwardRefExoticComponent<
+  (AccordionPrimitive.AccordionSingleProps | AccordionPrimitive.AccordionMultipleProps) &
+    React.RefAttributes<HTMLDivElement>
+> = AccordionPrimitive.Root;
 
-const AccordionItem = React.forwardRef<
+const AccordionItem: React.ForwardRefExoticComponent<
+  Omit<AccordionPrimitive.AccordionItemProps & React.RefAttributes<HTMLDivElement>, 'ref'> &
+    React.RefAttributes<HTMLDivElement>
+> = React.forwardRef<
   React.ElementRef<typeof AccordionPrimitive.Item>,
   React.ComponentPropsWithoutRef<typeof AccordionPrimitive.Item>
 >(({ className = '', ...props }, ref) => (
@@ -13,7 +19,10 @@ const AccordionItem = React.forwardRef<
 ));
 AccordionItem.displayName = 'AccordionItem';
 
-const AccordionTrigger = React.forwardRef<
+const AccordionTrigger: React.ForwardRefExoticComponent<
+  Omit<AccordionPrimitive.AccordionTriggerProps & React.RefAttributes<HTMLButtonElement>, 'ref'> &
+    React.RefAttributes<HTMLButtonElement>
+> = React.forwardRef<
   React.ElementRef<typeof AccordionPrimitive.Trigger>,
   React.ComponentPropsWithoutRef<typeof AccordionPrimitive.Trigger>
 >(({ className = '', children, ...props }, ref) => (
@@ -33,7 +42,10 @@ const AccordionTrigger = React.forwardRef<
 ));
 AccordionTrigger.displayName = AccordionPrimitive.Trigger.displayName;
 
-const AccordionContent = React.forwardRef<
+const AccordionContent: React.ForwardRefExoticComponent<
+  Omit<AccordionPrimitive.AccordionContentProps & React.RefAttributes<HTMLDivElement>, 'ref'> &
+    React.RefAttributes<HTMLDivElement>
+> = React.forwardRef<
   React.ElementRef<typeof AccordionPrimitive.Content>,
   React.ComponentPropsWithoutRef<typeof AccordionPrimitive.Content>
 >(({ className = '', children, ...props }, ref) => (
diff --git a/packages/client/src/components/AlertDialog.tsx b/packages/client/src/components/AlertDialog.tsx
index 4e78fda2111..3de8f592423 100644
--- a/packages/client/src/components/AlertDialog.tsx
+++ b/packages/client/src/components/AlertDialog.tsx
@@ -1,10 +1,13 @@
 import * as React from 'react';
+import { JSX } from 'react/jsx-runtime';
 import * as AlertDialogPrimitive from '@radix-ui/react-alert-dialog';
 import { cn } from '~/utils';
 
-const AlertDialog = AlertDialogPrimitive.Root;
+const AlertDialog: React.FC<AlertDialogPrimitive.AlertDialogProps> = AlertDialogPrimitive.Root;
 
-const AlertDialogTrigger = AlertDialogPrimitive.Trigger;
+const AlertDialogTrigger: React.ForwardRefExoticComponent<
+  AlertDialogPrimitive.AlertDialogTriggerProps & React.RefAttributes<HTMLButtonElement>
+> = AlertDialogPrimitive.Trigger;
 
 type AlertPortalProps = AlertDialogPrimitive.AlertDialogPortalProps & { className?: string };
 
@@ -32,7 +35,10 @@ const AlertDialogOverlay = React.forwardRef<
 ));
 AlertDialogOverlay.displayName = AlertDialogPrimitive.Overlay.displayName;
 
-const AlertDialogContent = React.forwardRef<
+const AlertDialogContent: React.ForwardRefExoticComponent<
+  Omit<AlertDialogPrimitive.AlertDialogContentProps & React.RefAttributes<HTMLDivElement>, 'ref'> &
+    React.RefAttributes<HTMLDivElement>
+> = React.forwardRef<
   React.ElementRef<typeof AlertDialogPrimitive.Content>,
   React.ComponentPropsWithoutRef<typeof AlertDialogPrimitive.Content>
 >(({ className = '', ...props }, ref) => (
@@ -51,12 +57,18 @@ const AlertDialogContent = React.forwardRef<
 ));
 AlertDialogContent.displayName = AlertDialogPrimitive.Content.displayName;
 
-const AlertDialogHeader = ({ className = '', ...props }: React.HTMLAttributes<HTMLDivElement>) => (
+const AlertDialogHeader: {
+  ({ className, ...props }: React.HTMLAttributes<HTMLDivElement>): JSX.Element;
+  displayName: string;
+} = ({ className = '', ...props }: React.HTMLAttributes<HTMLDivElement>): JSX.Element => (
   <div className={cn('flex flex-col space-y-2 text-center sm:text-left', className)} {...props} />
 );
 AlertDialogHeader.displayName = 'AlertDialogHeader';
 
-const AlertDialogFooter = ({ className = '', ...props }: React.HTMLAttributes<HTMLDivElement>) => (
+const AlertDialogFooter: {
+  ({ className, ...props }: React.HTMLAttributes<HTMLDivElement>): JSX.Element;
+  displayName: string;
+} = ({ className = '', ...props }: React.HTMLAttributes<HTMLDivElement>): JSX.Element => (
   <div
     className={cn('flex flex-col-reverse sm:flex-row sm:justify-end sm:space-x-2', className)}
     {...props}
@@ -64,7 +76,13 @@ const AlertDialogFooter = ({ className = '', ...props }: React.HTMLAttributes<HT
 );
 AlertDialogFooter.displayName = 'AlertDialogFooter';
 
-const AlertDialogTitle = React.forwardRef<
+const AlertDialogTitle: React.ForwardRefExoticComponent<
+  Omit<
+    AlertDialogPrimitive.AlertDialogTitleProps & React.RefAttributes<HTMLHeadingElement>,
+    'ref'
+  > &
+    React.RefAttributes<HTMLHeadingElement>
+> = React.forwardRef<
   React.ElementRef<typeof AlertDialogPrimitive.Title>,
   React.ComponentPropsWithoutRef<typeof AlertDialogPrimitive.Title>
 >(({ className = '', ...props }, ref) => (
@@ -76,7 +94,13 @@ const AlertDialogTitle = React.forwardRef<
 ));
 AlertDialogTitle.displayName = AlertDialogPrimitive.Title.displayName;
 
-const AlertDialogDescription = React.forwardRef<
+const AlertDialogDescription: React.ForwardRefExoticComponent<
+  Omit<
+    AlertDialogPrimitive.AlertDialogDescriptionProps & React.RefAttributes<HTMLParagraphElement>,
+    'ref'
+  > &
+    React.RefAttributes<HTMLParagraphElement>
+> = React.forwardRef<
   React.ElementRef<typeof AlertDialogPrimitive.Description>,
   React.ComponentPropsWithoutRef<typeof AlertDialogPrimitive.Description>
 >(({ className = '', ...props }, ref) => (
@@ -88,7 +112,13 @@ const AlertDialogDescription = React.forwardRef<
 ));
 AlertDialogDescription.displayName = AlertDialogPrimitive.Description.displayName;
 
-const AlertDialogAction = React.forwardRef<
+const AlertDialogAction: React.ForwardRefExoticComponent<
+  Omit<
+    AlertDialogPrimitive.AlertDialogActionProps & React.RefAttributes<HTMLButtonElement>,
+    'ref'
+  > &
+    React.RefAttributes<HTMLButtonElement>
+> = React.forwardRef<
   React.ElementRef<typeof AlertDialogPrimitive.Action>,
   React.ComponentPropsWithoutRef<typeof AlertDialogPrimitive.Action>
 >(({ className = '', ...props }, ref) => (
@@ -103,7 +133,13 @@ const AlertDialogAction = React.forwardRef<
 ));
 AlertDialogAction.displayName = AlertDialogPrimitive.Action.displayName;
 
-const AlertDialogCancel = React.forwardRef<
+const AlertDialogCancel: React.ForwardRefExoticComponent<
+  Omit<
+    AlertDialogPrimitive.AlertDialogCancelProps & React.RefAttributes<HTMLButtonElement>,
+    'ref'
+  > &
+    React.RefAttributes<HTMLButtonElement>
+> = React.forwardRef<
   React.ElementRef<typeof AlertDialogPrimitive.Cancel>,
   React.ComponentPropsWithoutRef<typeof AlertDialogPrimitive.Cancel>
 >(({ className = '', ...props }, ref) => (
diff --git a/packages/client/src/components/AnimatedSearchInput.tsx b/packages/client/src/components/AnimatedSearchInput.tsx
index 9e3411d1d71..1a07d728540 100644
--- a/packages/client/src/components/AnimatedSearchInput.tsx
+++ b/packages/client/src/components/AnimatedSearchInput.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
 import { Search } from 'lucide-react';
-import { TranslationKeys, useLocalize } from '~/hooks';
+import { JSX } from 'react/jsx-runtime';
+import { useLocalize } from '~/hooks';
 import { cn } from '~/utils';
 
 const AnimatedSearchInput = ({
@@ -13,7 +14,7 @@ const AnimatedSearchInput = ({
   onChange: (e: React.ChangeEvent<HTMLInputElement>) => void;
   isSearching?: boolean;
   placeholder: string;
-}) => {
+}): JSX.Element => {
   const isSearching = searching === true;
   const hasValue = value != null && value.length > 0;
   const localize = useLocalize();
diff --git a/packages/client/src/components/AnimatedTabs.tsx b/packages/client/src/components/AnimatedTabs.tsx
index 131d871aaf6..3d5eab05dea 100644
--- a/packages/client/src/components/AnimatedTabs.tsx
+++ b/packages/client/src/components/AnimatedTabs.tsx
@@ -1,8 +1,9 @@
-import * as Ariakit from '@ariakit/react';
 import { forwardRef, useEffect, useRef } from 'react';
+import * as Ariakit from '@ariakit/react';
 import type { ElementRef } from 'react';
 import { cn } from '~/utils';
 import './AnimatedTabs.css';
+import { JSX } from 'react/jsx-runtime';
 
 export interface TabItem {
   id?: string;
@@ -89,7 +90,7 @@ export function AnimatedTabs({
   containerClassName = '',
   tabListProps = {},
   defaultSelectedId,
-}: AnimatedTabsProps) {
+}: AnimatedTabsProps): JSX.Element {
   const tabIds = tabs.map((tab, index) => tab.id || `tab-${index}`);
   const firstTabId = defaultSelectedId || tabIds[0];
   const tabListRef = useRef<HTMLDivElement | null>(null);
diff --git a/packages/client/src/components/Badge.tsx b/packages/client/src/components/Badge.tsx
index 0a92d16c698..8a645fc1a3f 100644
--- a/packages/client/src/components/Badge.tsx
+++ b/packages/client/src/components/Badge.tsx
@@ -1,8 +1,9 @@
-import type React from 'react';
 import { X, Plus } from 'lucide-react';
 import { motion } from 'framer-motion';
+import { JSX } from 'react/jsx-runtime';
 import type { ButtonHTMLAttributes } from 'react';
 import type { LucideIcon } from 'lucide-react';
+import type React from 'react';
 import { cn } from '~/utils';
 
 interface BadgeProps
@@ -35,7 +36,7 @@ export default function Badge({
   onToggle,
   className,
   ...props
-}: BadgeProps) {
+}: BadgeProps): JSX.Element {
   const isMoveable = isEditing && isAvailable;
   const isDisabled = id === '1' && isInChat;
 
diff --git a/packages/client/src/components/Breadcrumb.tsx b/packages/client/src/components/Breadcrumb.tsx
index f1026a83052..09e0e5e9afc 100644
--- a/packages/client/src/components/Breadcrumb.tsx
+++ b/packages/client/src/components/Breadcrumb.tsx
@@ -1,9 +1,14 @@
 import * as React from 'react';
+import { JSX } from 'react/jsx-runtime';
 import { Slot } from '@radix-ui/react-slot';
 import { ChevronRight, MoreHorizontal } from 'lucide-react';
 import { cn } from '~/utils';
 
-const Breadcrumb = React.forwardRef<
+const Breadcrumb: React.ForwardRefExoticComponent<
+  Omit<React.DetailedHTMLProps<React.HTMLAttributes<HTMLElement>, HTMLElement>, 'ref'> & {
+    separator?: React.ReactNode;
+  } & React.RefAttributes<HTMLElement>
+> = React.forwardRef<
   HTMLElement,
   React.ComponentPropsWithoutRef<'nav'> & {
     separator?: React.ReactNode;
@@ -11,7 +16,10 @@ const Breadcrumb = React.forwardRef<
 >(({ ...props }, ref) => <nav ref={ref} aria-label="breadcrumb" {...props} />);
 Breadcrumb.displayName = 'Breadcrumb';
 
-const BreadcrumbList = React.forwardRef<HTMLOListElement, React.ComponentPropsWithoutRef<'ol'>>(
+const BreadcrumbList: React.ForwardRefExoticComponent<
+  Omit<React.DetailedHTMLProps<React.OlHTMLAttributes<HTMLOListElement>, HTMLOListElement>, 'ref'> &
+    React.RefAttributes<HTMLOListElement>
+> = React.forwardRef<HTMLOListElement, React.ComponentPropsWithoutRef<'ol'>>(
   ({ className, ...props }, ref) => (
     <ol
       ref={ref}
@@ -25,14 +33,24 @@ const BreadcrumbList = React.forwardRef<HTMLOListElement, React.ComponentPropsWi
 );
 BreadcrumbList.displayName = 'BreadcrumbList';
 
-const BreadcrumbItem = React.forwardRef<HTMLLIElement, React.ComponentPropsWithoutRef<'li'>>(
+const BreadcrumbItem: React.ForwardRefExoticComponent<
+  Omit<React.DetailedHTMLProps<React.LiHTMLAttributes<HTMLLIElement>, HTMLLIElement>, 'ref'> &
+    React.RefAttributes<HTMLLIElement>
+> = React.forwardRef<HTMLLIElement, React.ComponentPropsWithoutRef<'li'>>(
   ({ className, ...props }, ref) => (
     <li ref={ref} className={cn('inline-flex items-center gap-1.5', className)} {...props} />
   ),
 );
 BreadcrumbItem.displayName = 'BreadcrumbItem';
 
-const BreadcrumbLink = React.forwardRef<
+const BreadcrumbLink: React.ForwardRefExoticComponent<
+  Omit<
+    React.DetailedHTMLProps<React.AnchorHTMLAttributes<HTMLAnchorElement>, HTMLAnchorElement>,
+    'ref'
+  > & {
+    asChild?: boolean;
+  } & React.RefAttributes<HTMLAnchorElement>
+> = React.forwardRef<
   HTMLAnchorElement,
   React.ComponentPropsWithoutRef<'a'> & {
     asChild?: boolean;
@@ -50,7 +68,10 @@ const BreadcrumbLink = React.forwardRef<
 });
 BreadcrumbLink.displayName = 'BreadcrumbLink';
 
-const BreadcrumbPage = React.forwardRef<HTMLSpanElement, React.ComponentPropsWithoutRef<'span'>>(
+const BreadcrumbPage: React.ForwardRefExoticComponent<
+  Omit<React.DetailedHTMLProps<React.HTMLAttributes<HTMLSpanElement>, HTMLSpanElement>, 'ref'> &
+    React.RefAttributes<HTMLSpanElement>
+> = React.forwardRef<HTMLSpanElement, React.ComponentPropsWithoutRef<'span'>>(
   ({ className, ...props }, ref) => (
     <span
       ref={ref}
@@ -64,7 +85,10 @@ const BreadcrumbPage = React.forwardRef<HTMLSpanElement, React.ComponentPropsWit
 );
 BreadcrumbPage.displayName = 'BreadcrumbPage';
 
-const BreadcrumbSeparator = ({ children, className, ...props }: React.ComponentProps<'li'>) => (
+const BreadcrumbSeparator: {
+  ({ children, className, ...props }: React.ComponentProps<'li'>): JSX.Element;
+  displayName: string;
+} = ({ children, className, ...props }: React.ComponentProps<'li'>): JSX.Element => (
   <li
     role="presentation"
     aria-hidden="true"
@@ -76,7 +100,10 @@ const BreadcrumbSeparator = ({ children, className, ...props }: React.ComponentP
 );
 BreadcrumbSeparator.displayName = 'BreadcrumbSeparator';
 
-const BreadcrumbEllipsis = ({ className, ...props }: React.ComponentProps<'span'>) => (
+const BreadcrumbEllipsis: {
+  ({ className, ...props }: React.ComponentProps<'span'>): JSX.Element;
+  displayName: string;
+} = ({ className, ...props }: React.ComponentProps<'span'>): JSX.Element => (
   <span
     role="presentation"
     aria-hidden="true"
diff --git a/packages/client/src/components/Button.tsx b/packages/client/src/components/Button.tsx
index b7d9701e5bc..53150bde5ac 100644
--- a/packages/client/src/components/Button.tsx
+++ b/packages/client/src/components/Button.tsx
@@ -1,9 +1,26 @@
 import * as React from 'react';
 import { Slot } from '@radix-ui/react-slot';
+import { ClassProp } from 'class-variance-authority/types';
 import { cva, type VariantProps } from 'class-variance-authority';
 import { cn } from '~/utils';
 
-const buttonVariants = cva(
+const buttonVariants: (
+  props?:
+    | ({
+        variant?:
+          | 'default'
+          | 'link'
+          | 'submit'
+          | 'outline'
+          | 'destructive'
+          | 'secondary'
+          | 'ghost'
+          | null
+          | undefined;
+        size?: 'default' | 'icon' | 'sm' | 'lg' | null | undefined;
+      } & ClassProp)
+    | undefined,
+) => string = cva(
   'inline-flex items-center justify-center gap-2 whitespace-nowrap rounded-lg text-sm font-medium ring-offset-background transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:pointer-events-none disabled:opacity-50',
   {
     variants: {
@@ -39,7 +56,9 @@ export interface ButtonProps
   asChild?: boolean;
 }
 
-const Button = React.forwardRef<HTMLButtonElement, ButtonProps>(
+const Button: React.ForwardRefExoticComponent<
+  ButtonProps & React.RefAttributes<HTMLButtonElement>
+> = React.forwardRef<HTMLButtonElement, ButtonProps>(
   ({ className, variant, size, asChild = false, type = 'button', ...props }, ref) => {
     const Comp = asChild ? Slot : 'button';
     return (
diff --git a/packages/client/src/components/Checkbox.tsx b/packages/client/src/components/Checkbox.tsx
index 38d94dd74df..b4b45c221c0 100644
--- a/packages/client/src/components/Checkbox.tsx
+++ b/packages/client/src/components/Checkbox.tsx
@@ -20,7 +20,9 @@ export type CheckboxProps =
       'aria-label'?: never;
     });
 
-const Checkbox = React.forwardRef<React.ElementRef<typeof CheckboxPrimitive.Root>, CheckboxProps>(
+const Checkbox: React.ForwardRefExoticComponent<
+  CheckboxProps & React.RefAttributes<HTMLButtonElement>
+> = React.forwardRef<React.ElementRef<typeof CheckboxPrimitive.Root>, CheckboxProps>(
   ({ className = '', ...props }, ref) => (
     <CheckboxPrimitive.Root
       ref={ref}
diff --git a/packages/client/src/components/CheckboxButton.tsx b/packages/client/src/components/CheckboxButton.tsx
index 1858b7b68d8..e91e7e0efef 100644
--- a/packages/client/src/components/CheckboxButton.tsx
+++ b/packages/client/src/components/CheckboxButton.tsx
@@ -3,7 +3,20 @@ import { useEffect } from 'react';
 import { Checkbox, useStoreState, useCheckboxStore } from '@ariakit/react';
 import { cn } from '~/utils';
 
-const CheckboxButton = React.forwardRef<
+const CheckboxButton: React.ForwardRefExoticComponent<
+  {
+    icon?: React.ReactNode;
+    label: string;
+    className?: string;
+    checked?: boolean;
+    defaultChecked?: boolean;
+    isCheckedClassName?: string;
+    setValue?: (values: {
+      e?: React.ChangeEvent<HTMLInputElement>;
+      value: boolean | string;
+    }) => void;
+  } & React.RefAttributes<HTMLInputElement>
+> = React.forwardRef<
   HTMLInputElement,
   {
     icon?: React.ReactNode;
diff --git a/packages/client/src/components/Collapsible.tsx b/packages/client/src/components/Collapsible.tsx
index 9605c4e41ab..a91c0b36dbc 100644
--- a/packages/client/src/components/Collapsible.tsx
+++ b/packages/client/src/components/Collapsible.tsx
@@ -1,9 +1,16 @@
+import { ForwardRefExoticComponent, RefAttributes } from 'react';
 import * as CollapsiblePrimitive from '@radix-ui/react-collapsible';
 
-const Collapsible = CollapsiblePrimitive.Root;
+const Collapsible: ForwardRefExoticComponent<
+  CollapsiblePrimitive.CollapsibleProps & RefAttributes<HTMLDivElement>
+> = CollapsiblePrimitive.Root;
 
-const CollapsibleTrigger = CollapsiblePrimitive.CollapsibleTrigger;
+const CollapsibleTrigger: ForwardRefExoticComponent<
+  CollapsiblePrimitive.CollapsibleTriggerProps & RefAttributes<HTMLButtonElement>
+> = CollapsiblePrimitive.CollapsibleTrigger;
 
-const CollapsibleContent = CollapsiblePrimitive.CollapsibleContent;
+const CollapsibleContent: ForwardRefExoticComponent<
+  CollapsiblePrimitive.CollapsibleContentProps & RefAttributes<HTMLDivElement>
+> = CollapsiblePrimitive.CollapsibleContent;
 
 export { Collapsible, CollapsibleTrigger, CollapsibleContent };
diff --git a/packages/client/src/components/Combobox.tsx b/packages/client/src/components/Combobox.tsx
index 147d3c19391..793a8af7de1 100644
--- a/packages/client/src/components/Combobox.tsx
+++ b/packages/client/src/components/Combobox.tsx
@@ -1,4 +1,5 @@
 import { startTransition } from 'react';
+import { JSX } from 'react/jsx-runtime';
 import { Search as SearchIcon } from 'lucide-react';
 import * as RadixSelect from '@radix-ui/react-select';
 import { CheckIcon, ChevronDownIcon } from '@radix-ui/react-icons';
@@ -34,7 +35,7 @@ export default function ComboboxComponent({
   setValue: (value: string) => void;
   isCollapsed: boolean;
   SelectIcon?: React.ReactNode;
-}) {
+}): JSX.Element {
   const options: OptionWithIcon[] = (items ?? []).map((option: string | OptionWithIcon) => {
     if (typeof option === 'string') {
       return { label: option, value: option };
diff --git a/packages/client/src/components/ControlCombobox.tsx b/packages/client/src/components/ControlCombobox.tsx
index 8c6ca3d8bf3..d7e9aaa65b3 100644
--- a/packages/client/src/components/ControlCombobox.tsx
+++ b/packages/client/src/components/ControlCombobox.tsx
@@ -1,10 +1,11 @@
+import { useMemo, useState, useRef, memo, useEffect, MemoExoticComponent } from 'react';
 import * as Ariakit from '@ariakit/react';
 import { matchSorter } from 'match-sorter';
 import { Search, ChevronDown } from 'lucide-react';
-import { useMemo, useState, useRef, memo, useEffect } from 'react';
 import { SelectRenderer } from '@ariakit/react-core/select/select-renderer';
 import type { OptionWithIcon } from '~/common';
 import './AnimatePopover.css';
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
 
 interface ControlComboboxProps {
@@ -24,6 +25,7 @@ interface ControlComboboxProps {
   disabled?: boolean;
   iconSide?: 'left' | 'right';
   selectId?: string;
+  placement?: Ariakit.SelectStoreProps['placement'];
 }
 
 const ROW_HEIGHT = 36;
@@ -45,7 +47,8 @@ function ControlCombobox({
   iconClassName,
   iconSide = 'left',
   selectId,
-}: ControlComboboxProps) {
+  placement,
+}: ControlComboboxProps): JSX.Element {
   const [searchValue, setSearchValue] = useState('');
   const buttonRef = useRef<HTMLButtonElement>(null);
   const [buttonWidth, setButtonWidth] = useState<number | null>(null);
@@ -69,6 +72,7 @@ function ControlCombobox({
     defaultItems: items.map(getItem),
     value: selectedValue,
     setValue,
+    placement,
   });
 
   const matches = useMemo(() => {
@@ -201,4 +205,5 @@ function ControlCombobox({
   );
 }
 
-export default memo(ControlCombobox);
+const ControlComboboxMemo: MemoExoticComponent<typeof ControlCombobox> = memo(ControlCombobox);
+export default ControlComboboxMemo;
diff --git a/packages/client/src/components/DataTable.tsx b/packages/client/src/components/DataTable.tsx
index 6a26e31d765..09136ac33a5 100644
--- a/packages/client/src/components/DataTable.tsx
+++ b/packages/client/src/components/DataTable.tsx
@@ -1,4 +1,5 @@
 import React, { useCallback, useEffect, useRef, useState, memo, useMemo } from 'react';
+import { JSX } from 'react/jsx-runtime';
 import { useVirtualizer } from '@tanstack/react-virtual';
 import {
   Row,
@@ -222,7 +223,7 @@ export default function DataTable<TData, TValue>({
   filterValue,
   isLoading,
   enableSearch = true,
-}: DataTableProps<TData, TValue>) {
+}: DataTableProps<TData, TValue>): JSX.Element {
   const localize = useLocalize();
   const isSmallScreen = useMediaQuery('(max-width: 768px)');
   const tableContainerRef = useRef<HTMLDivElement>(null);
diff --git a/packages/client/src/components/DataTable/DataTable.hooks.ts b/packages/client/src/components/DataTable/DataTable.hooks.ts
index d2941fb4387..ed062f0b4cb 100644
--- a/packages/client/src/components/DataTable/DataTable.hooks.ts
+++ b/packages/client/src/components/DataTable/DataTable.hooks.ts
@@ -1,7 +1,7 @@
-import { useState, useEffect, useMemo } from 'react';
+import { useState, useEffect, useMemo, SetStateAction, Dispatch, CSSProperties } from 'react';
 import type { TableColumn } from './DataTable.types';
 
-export function useDebounced<T>(value: T, delay: number) {
+export function useDebounced<T>(value: T, delay: number): T {
   const [debounced, setDebounced] = useState(value);
 
   useEffect(() => {
@@ -12,7 +12,9 @@ export function useDebounced<T>(value: T, delay: number) {
   return debounced;
 }
 
-export const useOptimizedRowSelection = (initialSelection: Record<string, boolean> = {}) => {
+export const useOptimizedRowSelection = (
+  initialSelection: Record<string, boolean> = {},
+): readonly [Record<string, boolean>, Dispatch<SetStateAction<Record<string, boolean>>>] => {
   const [selection, setSelection] = useState(initialSelection);
   return [selection, setSelection] as const;
 };
@@ -21,7 +23,7 @@ export const useColumnStyles = <TData, TValue>(
   columns: TableColumn<TData, TValue>[],
   isSmallScreen: boolean,
   containerRef: React.RefObject<HTMLDivElement>,
-) => {
+): Record<string, CSSProperties> => {
   const [containerWidth, setContainerWidth] = useState(0);
 
   useEffect(() => {
@@ -83,13 +85,20 @@ export const useColumnStyles = <TData, TValue>(
   }, [columns, containerWidth, isSmallScreen]);
 };
 
-export const useDynamicColumnWidths = useColumnStyles;
+export const useDynamicColumnWidths: <TData, TValue>(
+  columns: TableColumn<TData, TValue>[],
+  isSmallScreen: boolean,
+  containerRef: React.RefObject<HTMLDivElement>,
+) => Record<string, CSSProperties> = useColumnStyles;
 
 export const useKeyboardNavigation = (
   tableRef: React.RefObject<HTMLDivElement>,
   rowCount: number,
   onRowSelect?: (index: number) => void,
-) => {
+): {
+  focusedRowIndex: number;
+  setFocusedRowIndex: Dispatch<SetStateAction<number>>;
+} => {
   const [focusedRowIndex, setFocusedRowIndex] = useState<number>(-1);
 
   useEffect(() => {
diff --git a/packages/client/src/components/DataTable/DataTable.tsx b/packages/client/src/components/DataTable/DataTable.tsx
index 4320b86db3e..2c11155e0ae 100644
--- a/packages/client/src/components/DataTable/DataTable.tsx
+++ b/packages/client/src/components/DataTable/DataTable.tsx
@@ -1,4 +1,5 @@
 import React, { useRef, useState, useEffect, useMemo, useCallback } from 'react';
+import { JSX } from 'react/jsx-runtime';
 import { useVirtualizer } from '@tanstack/react-virtual';
 import { ArrowUp, ArrowDown, ArrowDownUp } from 'lucide-react';
 import {
@@ -37,7 +38,7 @@ function DataTable<TData extends Record<string, unknown>, TValue>({
   sorting,
   onSortingChange,
   customActionsRenderer,
-}: DataTableProps<TData, TValue>) {
+}: DataTableProps<TData, TValue>): JSX.Element {
   const localize = useLocalize();
   const isSmallScreen = useMediaQuery('(max-width: 768px)');
 
@@ -140,6 +141,10 @@ function DataTable<TData extends Record<string, unknown>, TValue>({
       }
     });
     return newVisibility;
+    /* isSmallScreen is intentionally a dependency: it forces a fresh result
+       reference when the viewport crosses the mobile breakpoint so the effect
+       below re-applies column visibility, even though the body doesn't read it. */
+    // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [isSmallScreen, columns]);
 
   useEffect(() => {
@@ -510,15 +515,24 @@ function DataTable<TData extends Record<string, unknown>, TValue>({
 
                   const metaWidth = (header.column.columnDef.meta as { width?: number } | undefined)
                     ?.width;
-                  const widthStyle = isSelectHeader
-                    ? { width: '32px', maxWidth: '32px', minWidth: '32px' }
-                    : metaWidth && metaWidth >= 1 && metaWidth <= 100
-                      ? {
-                          width: `${metaWidth}%`,
-                          maxWidth: `${metaWidth}%`,
-                          minWidth: `${metaWidth}%`,
-                        }
-                      : {};
+                  let widthStyle: React.CSSProperties = {};
+                  if (isSelectHeader) {
+                    widthStyle = { width: '32px', maxWidth: '32px', minWidth: '32px' };
+                  } else if (metaWidth != null && metaWidth >= 1 && metaWidth <= 100) {
+                    widthStyle = {
+                      width: `${metaWidth}%`,
+                      maxWidth: `${metaWidth}%`,
+                      minWidth: `${metaWidth}%`,
+                    };
+                  }
+
+                  const sortDirection = header.column.getIsSorted();
+                  let ariaSort: 'ascending' | 'descending' | undefined;
+                  if (sortDirection === 'asc') {
+                    ariaSort = 'ascending';
+                  } else if (sortDirection === 'desc') {
+                    ariaSort = 'descending';
+                  }
                   return (
                     <TableHead
                       key={header.id}
@@ -537,13 +551,7 @@ function DataTable<TData extends Record<string, unknown>, TValue>({
                       role={canSort ? 'button' : undefined}
                       tabIndex={canSort ? 0 : undefined}
                       aria-label={sortAriaLabel}
-                      aria-sort={
-                        header.column.getIsSorted() === 'asc'
-                          ? 'ascending'
-                          : header.column.getIsSorted() === 'desc'
-                            ? 'descending'
-                            : undefined
-                      }
+                      aria-sort={ariaSort}
                     >
                       {isSelectHeader ? (
                         flexRender(header.column.columnDef.header, header.getContext())
diff --git a/packages/client/src/components/DataTable/DataTableComponents.tsx b/packages/client/src/components/DataTable/DataTableComponents.tsx
index d058ad409b0..830c05d4cc3 100644
--- a/packages/client/src/components/DataTable/DataTableComponents.tsx
+++ b/packages/client/src/components/DataTable/DataTableComponents.tsx
@@ -1,13 +1,24 @@
 import React, { memo, forwardRef } from 'react';
+import { JSX } from 'react/jsx-runtime';
 import { flexRender } from '@tanstack/react-table';
-import type { TableColumn } from './DataTable.types';
 import type { Row } from '@tanstack/react-table';
+import type { TableColumn } from './DataTable.types';
 import { TableCell, TableRow, TableRowHeader } from '../Table';
 import { Checkbox } from '../Checkbox';
 import { Skeleton } from '../Skeleton';
 import { cn } from '~/utils';
 
-export const SelectionCheckbox = memo(
+export const SelectionCheckbox: React.MemoExoticComponent<
+  ({
+    checked,
+    onChange,
+    ariaLabel,
+  }: {
+    checked: boolean;
+    onChange: (value: boolean) => void;
+    ariaLabel: string;
+  }) => JSX.Element
+> = memo(
   ({
     checked,
     onChange,
@@ -16,7 +27,7 @@ export const SelectionCheckbox = memo(
     checked: boolean;
     onChange: (value: boolean) => void;
     ariaLabel: string;
-  }) => (
+  }): JSX.Element => (
     <div
       role="button"
       tabIndex={0}
@@ -70,16 +81,16 @@ const TableRowComponent = <TData extends Record<string, unknown>>(
         const isDesktopOnly = meta?.desktopOnly;
         const isRowHeader = meta?.isRowHeader;
         const percent = meta?.width;
-        const widthStyle =
-          cell.column.id === 'select'
-            ? { width: '32px', maxWidth: '32px', minWidth: '32px' }
-            : percent
-              ? {
-                  width: `${percent}%`,
-                  maxWidth: `${percent}%`,
-                  minWidth: `${percent}%`, // Don't shrink on mobile
-                }
-              : undefined;
+        let widthStyle: React.CSSProperties | undefined;
+        if (cell.column.id === 'select') {
+          widthStyle = { width: '32px', maxWidth: '32px', minWidth: '32px' };
+        } else if (percent) {
+          widthStyle = {
+            width: `${percent}%`,
+            maxWidth: `${percent}%`,
+            minWidth: `${percent}%`, // Don't shrink on mobile
+          };
+        }
 
         const CellComponent = isRowHeader ? TableRowHeader : TableCell;
 
@@ -124,20 +135,29 @@ interface GenericRowProps {
   selected: boolean;
 }
 
-export const MemoizedTableRow = memo(
-  ForwardTableRowComponent as (props: GenericRowProps) => JSX.Element,
-  (prev: GenericRowProps, next: GenericRowProps) =>
-    prev.row.original === next.row.original && prev.selected === next.selected,
-);
+export const MemoizedTableRow: React.MemoExoticComponent<(props: GenericRowProps) => JSX.Element> =
+  memo(
+    ForwardTableRowComponent as (props: GenericRowProps) => JSX.Element,
+    (prev: GenericRowProps, next: GenericRowProps) =>
+      prev.row.original === next.row.original && prev.selected === next.selected,
+  );
 
-export const SkeletonRows = memo(
+export const SkeletonRows: React.MemoExoticComponent<
+  <TData extends Record<string, unknown>, TValue>({
+    count,
+    columns,
+  }: {
+    count?: number;
+    columns: TableColumn<TData, TValue>[];
+  }) => JSX.Element
+> = memo(
   <TData extends Record<string, unknown>, TValue>({
     count = 10,
     columns,
   }: {
     count?: number;
     columns: TableColumn<TData, TValue>[];
-  }) => (
+  }): JSX.Element => (
     <>
       {Array.from({ length: count }, (_, index) => (
         <TableRow key={`skeleton-${index}`} className="h-[56px] border-b border-border-light">
diff --git a/packages/client/src/components/DataTable/DataTableErrorBoundary.tsx b/packages/client/src/components/DataTable/DataTableErrorBoundary.tsx
index aa6dd2294f5..6d47cdafc5e 100644
--- a/packages/client/src/components/DataTable/DataTableErrorBoundary.tsx
+++ b/packages/client/src/components/DataTable/DataTableErrorBoundary.tsx
@@ -1,8 +1,9 @@
 import { Component, ErrorInfo, ReactNode, createRef } from 'react';
+import { JSX } from 'react/jsx-runtime';
 import { RefreshCw } from 'lucide-react';
+import { useLocalize } from '~/hooks';
 import { Button } from '../Button';
 import { logger } from '~/utils';
-import { useLocalize } from '~/hooks';
 
 /**
  * Error boundary specifically for DataTable component.
@@ -114,7 +115,7 @@ class DataTableErrorBoundaryInner extends Component<
   }
 }
 
-export function DataTableErrorBoundary(props: DataTableErrorBoundaryProps) {
+export function DataTableErrorBoundary(props: DataTableErrorBoundaryProps): JSX.Element {
   const localize = useLocalize();
   return <DataTableErrorBoundaryInner {...props} localize={localize} />;
 }
diff --git a/packages/client/src/components/DataTable/DataTableSearch.tsx b/packages/client/src/components/DataTable/DataTableSearch.tsx
index 30ced61cbe2..f269d0a1542 100644
--- a/packages/client/src/components/DataTable/DataTableSearch.tsx
+++ b/packages/client/src/components/DataTable/DataTableSearch.tsx
@@ -1,12 +1,21 @@
-import { memo } from 'react';
 import { startTransition } from 'react';
+import { memo, MemoExoticComponent } from 'react';
+import { JSX } from 'react/jsx-runtime';
 import type { DataTableSearchProps } from './DataTable.types';
 import { useLocalize } from '~/hooks';
 import { Input } from '../Input';
 import { cn } from '~/utils';
 
-export const DataTableSearch = memo(
-  ({ value, onChange, placeholder, className, disabled = false }: DataTableSearchProps) => {
+export const DataTableSearch: MemoExoticComponent<
+  ({ value, onChange, placeholder, className, disabled }: DataTableSearchProps) => JSX.Element
+> = memo(
+  ({
+    value,
+    onChange,
+    placeholder,
+    className,
+    disabled = false,
+  }: DataTableSearchProps): JSX.Element => {
     const localize = useLocalize();
 
     return (
diff --git a/packages/client/src/components/DelayedRender.tsx b/packages/client/src/components/DelayedRender.tsx
index 0899d1dd32b..e15a71f8dfa 100644
--- a/packages/client/src/components/DelayedRender.tsx
+++ b/packages/client/src/components/DelayedRender.tsx
@@ -6,7 +6,7 @@ interface DelayedRenderProps {
   children: React.ReactNode;
 }
 
-const DelayedRender = ({ delay, children }: DelayedRenderProps) =>
+const DelayedRender = ({ delay, children }: DelayedRenderProps): React.ReactNode =>
   useDelayedRender(delay)(() => children);
 
 export default DelayedRender;
diff --git a/packages/client/src/components/Dialog.tsx b/packages/client/src/components/Dialog.tsx
index 572faf91005..c5b97cc2e6a 100644
--- a/packages/client/src/components/Dialog.tsx
+++ b/packages/client/src/components/Dialog.tsx
@@ -1,13 +1,16 @@
 import * as React from 'react';
+import { X } from 'lucide-react';
+import { JSX } from 'react/jsx-runtime';
 import * as DialogPrimitive from '@radix-ui/react-dialog';
+import { Button, ButtonProps } from './Button';
 import { useMediaQuery } from '~/hooks';
-import { Button } from './Button';
-import { X } from 'lucide-react';
 import { cn } from '~/utils';
 
-const Dialog = DialogPrimitive.Root;
+const Dialog: React.FC<DialogPrimitive.DialogProps> = DialogPrimitive.Root;
 
-const DialogTrigger = DialogPrimitive.Trigger;
+const DialogTrigger: React.ForwardRefExoticComponent<
+  DialogPrimitive.DialogTriggerProps & React.RefAttributes<HTMLButtonElement>
+> = DialogPrimitive.Trigger;
 
 type DialogPortalProps = DialogPrimitive.DialogPortalProps & { className?: string };
 
@@ -40,10 +43,12 @@ type DialogContentProps = React.ComponentPropsWithoutRef<typeof DialogPrimitive.
   disableScroll?: boolean;
 };
 
-const DialogContent = React.forwardRef<
-  React.ElementRef<typeof DialogPrimitive.Content>,
-  DialogContentProps
->(
+const DialogContent: React.ForwardRefExoticComponent<
+  Omit<DialogPrimitive.DialogContentProps & React.RefAttributes<HTMLDivElement>, 'ref'> & {
+    showCloseButton?: boolean;
+    disableScroll?: boolean;
+  } & React.RefAttributes<HTMLDivElement>
+> = React.forwardRef<React.ElementRef<typeof DialogPrimitive.Content>, DialogContentProps>(
   (
     { className, children = true, showCloseButton = true, disableScroll = false, ...props },
     ref,
@@ -79,7 +84,10 @@ const DialogContent = React.forwardRef<
 );
 DialogContent.displayName = DialogPrimitive.Content.displayName;
 
-const DialogHeader = ({ className, ...props }: React.HTMLAttributes<HTMLDivElement>) => (
+const DialogHeader: {
+  ({ className, ...props }: React.HTMLAttributes<HTMLDivElement>): JSX.Element;
+  displayName: string;
+} = ({ className, ...props }: React.HTMLAttributes<HTMLDivElement>): JSX.Element => (
   <div
     className={cn(
       'flex flex-col space-y-2 border-b border-black/10 p-6 pb-4 text-left dark:border-white/10',
@@ -90,7 +98,10 @@ const DialogHeader = ({ className, ...props }: React.HTMLAttributes<HTMLDivEleme
 );
 DialogHeader.displayName = 'DialogHeader';
 
-const DialogFooter = ({ className, ...props }: React.HTMLAttributes<HTMLDivElement>) => (
+const DialogFooter: {
+  ({ className, ...props }: React.HTMLAttributes<HTMLDivElement>): JSX.Element;
+  displayName: string;
+} = ({ className, ...props }: React.HTMLAttributes<HTMLDivElement>): JSX.Element => (
   <div
     className={cn('flex flex-row justify-between space-x-2 px-6 py-4', className ?? '')}
     {...props}
@@ -98,7 +109,10 @@ const DialogFooter = ({ className, ...props }: React.HTMLAttributes<HTMLDivEleme
 );
 DialogFooter.displayName = 'DialogFooter';
 
-const DialogTitle = React.forwardRef<
+const DialogTitle: React.ForwardRefExoticComponent<
+  Omit<DialogPrimitive.DialogTitleProps & React.RefAttributes<HTMLHeadingElement>, 'ref'> &
+    React.RefAttributes<HTMLHeadingElement>
+> = React.forwardRef<
   React.ElementRef<typeof DialogPrimitive.Title>,
   React.ComponentPropsWithoutRef<typeof DialogPrimitive.Title>
 >(({ className, ...props }, ref) => (
@@ -110,7 +124,10 @@ const DialogTitle = React.forwardRef<
 ));
 DialogTitle.displayName = DialogPrimitive.Title.displayName;
 
-const DialogDescription = React.forwardRef<
+const DialogDescription: React.ForwardRefExoticComponent<
+  Omit<DialogPrimitive.DialogDescriptionProps & React.RefAttributes<HTMLParagraphElement>, 'ref'> &
+    React.RefAttributes<HTMLParagraphElement>
+> = React.forwardRef<
   React.ElementRef<typeof DialogPrimitive.Description>,
   React.ComponentPropsWithoutRef<typeof DialogPrimitive.Description>
 >(({ className, ...props }, ref) => (
@@ -122,7 +139,10 @@ const DialogDescription = React.forwardRef<
 ));
 DialogDescription.displayName = DialogPrimitive.Description.displayName;
 
-const DialogClose = React.forwardRef<
+const DialogClose: React.ForwardRefExoticComponent<
+  Omit<DialogPrimitive.DialogCloseProps & React.RefAttributes<HTMLButtonElement>, 'ref'> &
+    React.RefAttributes<HTMLButtonElement>
+> = React.forwardRef<
   React.ElementRef<typeof DialogPrimitive.Close>,
   React.ComponentPropsWithoutRef<typeof DialogPrimitive.Close>
 >(({ className, ...props }, ref) => (
@@ -139,7 +159,10 @@ const DialogClose = React.forwardRef<
 ));
 DialogClose.displayName = DialogPrimitive.Title.displayName;
 
-const DialogButton = React.forwardRef<
+const DialogButton: React.ForwardRefExoticComponent<
+  Omit<ButtonProps & React.RefAttributes<HTMLButtonElement>, 'ref'> &
+    React.RefAttributes<HTMLButtonElement>
+> = React.forwardRef<
   React.ElementRef<typeof Button>,
   React.ComponentPropsWithoutRef<typeof Button>
 >(({ className, ...props }, ref) => (
diff --git a/packages/client/src/components/DialogTemplate.tsx b/packages/client/src/components/DialogTemplate.tsx
index d3ee806641c..6a286cbdff2 100644
--- a/packages/client/src/components/DialogTemplate.tsx
+++ b/packages/client/src/components/DialogTemplate.tsx
@@ -1,4 +1,4 @@
-import { forwardRef, ReactNode, Ref } from 'react';
+import { forwardRef, ForwardRefExoticComponent, ReactNode, Ref, RefAttributes } from 'react';
 import {
   DialogClose,
   DialogContent,
@@ -29,7 +29,9 @@ type DialogTemplateProps = {
   showCancelButton?: boolean;
 };
 
-const DialogTemplate = forwardRef((props: DialogTemplateProps, ref: Ref<HTMLDivElement>) => {
+const DialogTemplate: ForwardRefExoticComponent<
+  DialogTemplateProps & RefAttributes<HTMLDivElement>
+> = forwardRef((props: DialogTemplateProps, ref: Ref<HTMLDivElement>) => {
   const {
     title,
     description,
diff --git a/packages/client/src/components/DropdownMenu.tsx b/packages/client/src/components/DropdownMenu.tsx
index 013301bc6ac..a73fe6e7c1c 100644
--- a/packages/client/src/components/DropdownMenu.tsx
+++ b/packages/client/src/components/DropdownMenu.tsx
@@ -1,21 +1,24 @@
 import * as React from 'react';
+import { JSX } from 'react/jsx-runtime';
 import * as DropdownMenuPrimitive from '@radix-ui/react-dropdown-menu';
 import { CheckIcon, ChevronRightIcon, CircleIcon } from 'lucide-react';
 import { cn } from '~/utils';
 
-function DropdownMenu({ ...props }: React.ComponentProps<typeof DropdownMenuPrimitive.Root>) {
+function DropdownMenu({
+  ...props
+}: React.ComponentProps<typeof DropdownMenuPrimitive.Root>): JSX.Element {
   return <DropdownMenuPrimitive.Root data-slot="dropdown-menu" {...props} />;
 }
 
 function DropdownMenuPortal({
   ...props
-}: React.ComponentProps<typeof DropdownMenuPrimitive.Portal>) {
+}: React.ComponentProps<typeof DropdownMenuPrimitive.Portal>): JSX.Element {
   return <DropdownMenuPrimitive.Portal data-slot="dropdown-menu-portal" {...props} />;
 }
 
 function DropdownMenuTrigger({
   ...props
-}: React.ComponentProps<typeof DropdownMenuPrimitive.Trigger>) {
+}: React.ComponentProps<typeof DropdownMenuPrimitive.Trigger>): JSX.Element {
   return <DropdownMenuPrimitive.Trigger data-slot="dropdown-menu-trigger" {...props} />;
 }
 
@@ -23,7 +26,7 @@ function DropdownMenuContent({
   className,
   sideOffset = 4,
   ...props
-}: React.ComponentProps<typeof DropdownMenuPrimitive.Content>) {
+}: React.ComponentProps<typeof DropdownMenuPrimitive.Content>): JSX.Element {
   return (
     <DropdownMenuPrimitive.Portal>
       <DropdownMenuPrimitive.Content
@@ -39,7 +42,9 @@ function DropdownMenuContent({
   );
 }
 
-function DropdownMenuGroup({ ...props }: React.ComponentProps<typeof DropdownMenuPrimitive.Group>) {
+function DropdownMenuGroup({
+  ...props
+}: React.ComponentProps<typeof DropdownMenuPrimitive.Group>): JSX.Element {
   return <DropdownMenuPrimitive.Group data-slot="dropdown-menu-group" {...props} />;
 }
 
@@ -51,7 +56,7 @@ function DropdownMenuItem({
 }: React.ComponentProps<typeof DropdownMenuPrimitive.Item> & {
   inset?: boolean;
   variant?: 'default' | 'destructive';
-}) {
+}): JSX.Element {
   return (
     <DropdownMenuPrimitive.Item
       data-slot="dropdown-menu-item"
@@ -71,7 +76,7 @@ function DropdownMenuCheckboxItem({
   children,
   checked,
   ...props
-}: React.ComponentProps<typeof DropdownMenuPrimitive.CheckboxItem>) {
+}: React.ComponentProps<typeof DropdownMenuPrimitive.CheckboxItem>): JSX.Element {
   return (
     <DropdownMenuPrimitive.CheckboxItem
       data-slot="dropdown-menu-checkbox-item"
@@ -94,7 +99,7 @@ function DropdownMenuCheckboxItem({
 
 function DropdownMenuRadioGroup({
   ...props
-}: React.ComponentProps<typeof DropdownMenuPrimitive.RadioGroup>) {
+}: React.ComponentProps<typeof DropdownMenuPrimitive.RadioGroup>): JSX.Element {
   return <DropdownMenuPrimitive.RadioGroup data-slot="dropdown-menu-radio-group" {...props} />;
 }
 
@@ -102,7 +107,7 @@ function DropdownMenuRadioItem({
   className,
   children,
   ...props
-}: React.ComponentProps<typeof DropdownMenuPrimitive.RadioItem>) {
+}: React.ComponentProps<typeof DropdownMenuPrimitive.RadioItem>): JSX.Element {
   return (
     <DropdownMenuPrimitive.RadioItem
       data-slot="dropdown-menu-radio-item"
@@ -128,7 +133,7 @@ function DropdownMenuLabel({
   ...props
 }: React.ComponentProps<typeof DropdownMenuPrimitive.Label> & {
   inset?: boolean;
-}) {
+}): JSX.Element {
   return (
     <DropdownMenuPrimitive.Label
       data-slot="dropdown-menu-label"
@@ -142,7 +147,7 @@ function DropdownMenuLabel({
 function DropdownMenuSeparator({
   className,
   ...props
-}: React.ComponentProps<typeof DropdownMenuPrimitive.Separator>) {
+}: React.ComponentProps<typeof DropdownMenuPrimitive.Separator>): JSX.Element {
   return (
     <DropdownMenuPrimitive.Separator
       data-slot="dropdown-menu-separator"
@@ -152,7 +157,7 @@ function DropdownMenuSeparator({
   );
 }
 
-function DropdownMenuShortcut({ className, ...props }: React.ComponentProps<'span'>) {
+function DropdownMenuShortcut({ className, ...props }: React.ComponentProps<'span'>): JSX.Element {
   return (
     <span
       data-slot="dropdown-menu-shortcut"
@@ -162,7 +167,9 @@ function DropdownMenuShortcut({ className, ...props }: React.ComponentProps<'spa
   );
 }
 
-function DropdownMenuSub({ ...props }: React.ComponentProps<typeof DropdownMenuPrimitive.Sub>) {
+function DropdownMenuSub({
+  ...props
+}: React.ComponentProps<typeof DropdownMenuPrimitive.Sub>): JSX.Element {
   return <DropdownMenuPrimitive.Sub data-slot="dropdown-menu-sub" {...props} />;
 }
 
@@ -173,7 +180,7 @@ function DropdownMenuSubTrigger({
   ...props
 }: React.ComponentProps<typeof DropdownMenuPrimitive.SubTrigger> & {
   inset?: boolean;
-}) {
+}): JSX.Element {
   return (
     <DropdownMenuPrimitive.SubTrigger
       data-slot="dropdown-menu-sub-trigger"
@@ -193,7 +200,7 @@ function DropdownMenuSubTrigger({
 function DropdownMenuSubContent({
   className,
   ...props
-}: React.ComponentProps<typeof DropdownMenuPrimitive.SubContent>) {
+}: React.ComponentProps<typeof DropdownMenuPrimitive.SubContent>): JSX.Element {
   return (
     <DropdownMenuPrimitive.SubContent
       data-slot="dropdown-menu-sub-content"
diff --git a/packages/client/src/components/FileUpload.tsx b/packages/client/src/components/FileUpload.tsx
index 3481a36e8ed..c0cec6b032c 100644
--- a/packages/client/src/components/FileUpload.tsx
+++ b/packages/client/src/components/FileUpload.tsx
@@ -7,22 +7,22 @@ type FileUploadProps = {
   handleFileChange: (event: React.ChangeEvent<HTMLInputElement>) => void;
 };
 
-const FileUpload = forwardRef<HTMLInputElement, FileUploadProps>(
-  ({ children, handleFileChange }, ref) => {
-    return (
-      <>
-        {children}
-        <input
-          ref={ref}
-          multiple
-          type="file"
-          style={{ display: 'none' }}
-          onChange={handleFileChange}
-        />
-      </>
-    );
-  },
-);
+const FileUpload: React.ForwardRefExoticComponent<
+  FileUploadProps & React.RefAttributes<HTMLInputElement>
+> = forwardRef<HTMLInputElement, FileUploadProps>(({ children, handleFileChange }, ref) => {
+  return (
+    <>
+      {children}
+      <input
+        ref={ref}
+        multiple
+        type="file"
+        style={{ display: 'none' }}
+        onChange={handleFileChange}
+      />
+    </>
+  );
+});
 
 FileUpload.displayName = 'FileUpload';
 
diff --git a/packages/client/src/components/FilterInput.tsx b/packages/client/src/components/FilterInput.tsx
index 04f5fe33a17..273894e68d8 100644
--- a/packages/client/src/components/FilterInput.tsx
+++ b/packages/client/src/components/FilterInput.tsx
@@ -23,7 +23,9 @@ export interface FilterInputProps
  *   onChange={(e) => setSearchQuery(e.target.value)}
  * />
  */
-const FilterInput = React.forwardRef<HTMLInputElement, FilterInputProps>(
+const FilterInput: React.ForwardRefExoticComponent<
+  FilterInputProps & React.RefAttributes<HTMLInputElement>
+> = React.forwardRef<HTMLInputElement, FilterInputProps>(
   ({ className, label, inputId, containerClassName, ...props }, ref) => {
     return (
       <div className={cn('relative', containerClassName)}>
diff --git a/packages/client/src/components/FormInput.tsx b/packages/client/src/components/FormInput.tsx
index 2d6c55e348d..c1dc0f3982e 100644
--- a/packages/client/src/components/FormInput.tsx
+++ b/packages/client/src/components/FormInput.tsx
@@ -1,4 +1,5 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 import type { ControllerRenderProps, FieldValues, FieldPath } from 'react-hook-form';
 import { Label } from './Label';
 import { Input } from './Input';
@@ -25,7 +26,7 @@ export default function FormInput<
   containerClass?: string;
   type?: 'string' | 'number';
   labelAdjacent?: React.ReactNode;
-}) {
+}): JSX.Element {
   const handleChange = (e: React.ChangeEvent<HTMLInputElement>) => {
     const value = e.target.value;
 
diff --git a/packages/client/src/components/HoverCard.tsx b/packages/client/src/components/HoverCard.tsx
index 5b64adbfa1e..ba389711cd4 100644
--- a/packages/client/src/components/HoverCard.tsx
+++ b/packages/client/src/components/HoverCard.tsx
@@ -2,13 +2,20 @@ import * as React from 'react';
 import * as HoverCardPrimitive from '@radix-ui/react-hover-card';
 import { cn } from '~/utils';
 
-const HoverCard = HoverCardPrimitive.Root;
+const HoverCard: React.FC<HoverCardPrimitive.HoverCardProps> = HoverCardPrimitive.Root;
 
-const HoverCardTrigger = HoverCardPrimitive.Trigger;
+const HoverCardTrigger: React.ForwardRefExoticComponent<
+  HoverCardPrimitive.HoverCardTriggerProps & React.RefAttributes<HTMLAnchorElement>
+> = HoverCardPrimitive.Trigger;
 
-const HoverCardPortal = HoverCardPrimitive.Portal;
+const HoverCardPortal: React.FC<HoverCardPrimitive.HoverCardPortalProps> =
+  HoverCardPrimitive.Portal;
 
-const HoverCardContent = React.forwardRef<
+const HoverCardContent: React.ForwardRefExoticComponent<
+  Omit<HoverCardPrimitive.HoverCardContentProps & React.RefAttributes<HTMLDivElement>, 'ref'> & {
+    disabled?: boolean;
+  } & React.RefAttributes<HTMLDivElement>
+> = React.forwardRef<
   React.ElementRef<typeof HoverCardPrimitive.Content>,
   React.ComponentPropsWithoutRef<typeof HoverCardPrimitive.Content> & { disabled?: boolean }
 >(({ className = '', align = 'center', sideOffset = 6, disabled = false, ...props }, ref) => {
diff --git a/packages/client/src/components/InfoHoverCard.tsx b/packages/client/src/components/InfoHoverCard.tsx
index 5b56beb5f2e..a87f52d323f 100644
--- a/packages/client/src/components/InfoHoverCard.tsx
+++ b/packages/client/src/components/InfoHoverCard.tsx
@@ -1,4 +1,5 @@
 import { useState } from 'react';
+import { JSX } from 'react/jsx-runtime';
 import { CircleHelpIcon } from 'lucide-react';
 import { HoverCard, HoverCardTrigger, HoverCardPortal, HoverCardContent } from './HoverCard';
 import { ESide } from '~/common';
@@ -8,7 +9,7 @@ type InfoHoverCardProps = {
   text: string;
 };
 
-const InfoHoverCard = ({ side, text }: InfoHoverCardProps) => {
+const InfoHoverCard = ({ side, text }: InfoHoverCardProps): JSX.Element => {
   const [isOpen, setIsOpen] = useState(false);
 
   return (
diff --git a/packages/client/src/components/Input.tsx b/packages/client/src/components/Input.tsx
index 7b4fa5c9466..6f502e08aaa 100644
--- a/packages/client/src/components/Input.tsx
+++ b/packages/client/src/components/Input.tsx
@@ -3,18 +3,19 @@ import { cn } from '~/utils';
 
 export type InputProps = React.InputHTMLAttributes<HTMLInputElement>;
 
-const Input = React.forwardRef<HTMLInputElement, InputProps>(({ className, ...props }, ref) => {
-  return (
-    <input
-      className={cn(
-        'flex h-10 w-full rounded-lg border border-border-light bg-transparent px-3 py-2 text-sm ring-offset-background placeholder:text-muted-foreground focus-visible:outline-none disabled:cursor-not-allowed disabled:opacity-50',
-        className ?? '',
-      )}
-      ref={ref}
-      {...props}
-    />
-  );
-});
+const Input: React.ForwardRefExoticComponent<InputProps & React.RefAttributes<HTMLInputElement>> =
+  React.forwardRef<HTMLInputElement, InputProps>(({ className, ...props }, ref) => {
+    return (
+      <input
+        className={cn(
+          'flex h-10 w-full rounded-lg border border-border-light bg-transparent px-3 py-2 text-sm ring-offset-background placeholder:text-muted-foreground focus-visible:outline-none disabled:cursor-not-allowed disabled:opacity-50',
+          className ?? '',
+        )}
+        ref={ref}
+        {...props}
+      />
+    );
+  });
 
 Input.displayName = 'Input';
 
diff --git a/packages/client/src/components/InputNumber.tsx b/packages/client/src/components/InputNumber.tsx
index 7f32a298ece..0102eb4d427 100644
--- a/packages/client/src/components/InputNumber.tsx
+++ b/packages/client/src/components/InputNumber.tsx
@@ -5,26 +5,28 @@ import * as React from 'react';
 import RCInputNumber from 'rc-input-number';
 import * as InputNumberPrimitive from 'rc-input-number';
 import { cn } from '~/utils';
+import { ValueType } from '@rc-component/mini-decimal';
 
 // TODO help needed
 // React.ElementRef<typeof LabelPrimitive.Root>,
 // React.ComponentPropsWithoutRef<typeof LabelPrimitive.Root>
 
-const InputNumber = React.forwardRef<
-  React.ElementRef<typeof RCInputNumber>,
-  InputNumberPrimitive.InputNumberProps
->(({ className, ...props }, ref) => {
-  return (
-    <RCInputNumber
-      className={cn(
-        'flex max-h-5 w-full rounded-md border border-gray-300 bg-transparent px-3 py-2 text-sm placeholder:text-gray-400 focus:outline-none disabled:cursor-not-allowed disabled:opacity-50 dark:border-gray-700 dark:text-gray-50',
-        className ?? '',
-      )}
-      ref={ref}
-      {...props}
-    />
-  );
-});
+const InputNumber: React.ForwardRefExoticComponent<
+  InputNumberPrimitive.InputNumberProps<ValueType> & React.RefAttributes<HTMLInputElement>
+> = React.forwardRef<React.ElementRef<typeof RCInputNumber>, InputNumberPrimitive.InputNumberProps>(
+  ({ className, ...props }, ref) => {
+    return (
+      <RCInputNumber
+        className={cn(
+          'flex max-h-5 w-full rounded-md border border-gray-300 bg-transparent px-3 py-2 text-sm placeholder:text-gray-400 focus:outline-none disabled:cursor-not-allowed disabled:opacity-50 dark:border-gray-700 dark:text-gray-50',
+          className ?? '',
+        )}
+        ref={ref}
+        {...props}
+      />
+    );
+  },
+);
 InputNumber.displayName = 'Input';
 
 // console.log(_InputNumber);
diff --git a/packages/client/src/components/InputOTP.tsx b/packages/client/src/components/InputOTP.tsx
index 32b8ba08f49..59e6454ac32 100644
--- a/packages/client/src/components/InputOTP.tsx
+++ b/packages/client/src/components/InputOTP.tsx
@@ -1,9 +1,69 @@
 import * as React from 'react';
-import { OTPInput, OTPInputContext } from 'input-otp';
 import { Minus } from 'lucide-react';
+import { OTPInput, OTPInputContext, RenderProps } from 'input-otp';
 import { cn } from '~/utils';
 
-const InputOTP = React.forwardRef<
+const InputOTP: React.ForwardRefExoticComponent<
+  (
+    | Omit<
+        Omit<
+          React.InputHTMLAttributes<HTMLInputElement>,
+          | 'value'
+          | 'onChange'
+          | 'maxLength'
+          | 'containerClassName'
+          | 'textAlign'
+          | 'onComplete'
+          | 'pushPasswordManagerStrategy'
+          | 'pasteTransformer'
+          | 'noScriptCSSFallback'
+        > & {
+          value?: string;
+          onChange?: (newValue: string) => unknown;
+          maxLength: number;
+          textAlign?: 'left' | 'center' | 'right';
+          onComplete?: (...args: unknown[]) => unknown;
+          pushPasswordManagerStrategy?: 'increase-width' | 'none';
+          pasteTransformer?: (pasted: string) => string;
+          containerClassName?: string;
+          noScriptCSSFallback?: string | null;
+        } & {
+          render: (props: RenderProps) => React.ReactNode;
+          children?: never;
+        } & React.RefAttributes<HTMLInputElement>,
+        'ref'
+      >
+    | Omit<
+        Omit<
+          React.InputHTMLAttributes<HTMLInputElement>,
+          | 'value'
+          | 'onChange'
+          | 'maxLength'
+          | 'containerClassName'
+          | 'textAlign'
+          | 'onComplete'
+          | 'pushPasswordManagerStrategy'
+          | 'pasteTransformer'
+          | 'noScriptCSSFallback'
+        > & {
+          value?: string;
+          onChange?: (newValue: string) => unknown;
+          maxLength: number;
+          textAlign?: 'left' | 'center' | 'right';
+          onComplete?: (...args: unknown[]) => unknown;
+          pushPasswordManagerStrategy?: 'increase-width' | 'none';
+          pasteTransformer?: (pasted: string) => string;
+          containerClassName?: string;
+          noScriptCSSFallback?: string | null;
+        } & {
+          render?: never;
+          children: React.ReactNode;
+        } & React.RefAttributes<HTMLInputElement>,
+        'ref'
+      >
+  ) &
+    React.RefAttributes<HTMLInputElement>
+> = React.forwardRef<
   React.ElementRef<typeof OTPInput>,
   React.ComponentPropsWithoutRef<typeof OTPInput>
 >(({ className, containerClassName, ...props }, ref) => (
@@ -19,15 +79,21 @@ const InputOTP = React.forwardRef<
 ));
 InputOTP.displayName = 'InputOTP';
 
-const InputOTPGroup = React.forwardRef<
-  React.ElementRef<'div'>,
-  React.ComponentPropsWithoutRef<'div'>
->(({ className, ...props }, ref) => (
-  <div ref={ref} className={cn('flex items-center', className)} {...props} />
-));
+const InputOTPGroup: React.ForwardRefExoticComponent<
+  Omit<React.DetailedHTMLProps<React.HTMLAttributes<HTMLDivElement>, HTMLDivElement>, 'ref'> &
+    React.RefAttributes<HTMLDivElement>
+> = React.forwardRef<React.ElementRef<'div'>, React.ComponentPropsWithoutRef<'div'>>(
+  ({ className, ...props }, ref) => (
+    <div ref={ref} className={cn('flex items-center', className)} {...props} />
+  ),
+);
 InputOTPGroup.displayName = 'InputOTPGroup';
 
-const InputOTPSlot = React.forwardRef<
+const InputOTPSlot: React.ForwardRefExoticComponent<
+  Omit<React.DetailedHTMLProps<React.HTMLAttributes<HTMLDivElement>, HTMLDivElement>, 'ref'> & {
+    index: number;
+  } & React.RefAttributes<HTMLDivElement>
+> = React.forwardRef<
   React.ElementRef<'div'>,
   React.ComponentPropsWithoutRef<'div'> & { index: number }
 >(({ index, className, ...props }, ref) => {
@@ -60,14 +126,16 @@ const InputOTPSlot = React.forwardRef<
 });
 InputOTPSlot.displayName = 'InputOTPSlot';
 
-const InputOTPSeparator = React.forwardRef<
-  React.ElementRef<'div'>,
-  React.ComponentPropsWithoutRef<'div'>
->(({ ...props }, ref) => (
-  <div ref={ref} role="separator" {...props}>
-    <Minus />
-  </div>
-));
+const InputOTPSeparator: React.ForwardRefExoticComponent<
+  Omit<React.DetailedHTMLProps<React.HTMLAttributes<HTMLDivElement>, HTMLDivElement>, 'ref'> &
+    React.RefAttributes<HTMLDivElement>
+> = React.forwardRef<React.ElementRef<'div'>, React.ComponentPropsWithoutRef<'div'>>(
+  ({ ...props }, ref) => (
+    <div ref={ref} role="separator" {...props}>
+      <Minus />
+    </div>
+  ),
+);
 InputOTPSeparator.displayName = 'InputOTPSeparator';
 
 export { InputOTP, InputOTPGroup, InputOTPSlot, InputOTPSeparator };
diff --git a/packages/client/src/components/InputWithDropDown.tsx b/packages/client/src/components/InputWithDropDown.tsx
index da7829a11a4..0af4de87214 100644
--- a/packages/client/src/components/InputWithDropDown.tsx
+++ b/packages/client/src/components/InputWithDropDown.tsx
@@ -7,7 +7,12 @@ export type InputWithDropdownProps = React.InputHTMLAttributes<HTMLInputElement>
   onSelect?: (value: string) => void;
 };
 
-const InputWithDropdown = React.forwardRef<HTMLInputElement, InputWithDropdownProps>(
+const InputWithDropdown: React.ForwardRefExoticComponent<
+  React.InputHTMLAttributes<HTMLInputElement> & {
+    options: string[];
+    onSelect?: (value: string) => void;
+  } & React.RefAttributes<HTMLInputElement>
+> = React.forwardRef<HTMLInputElement, InputWithDropdownProps>(
   ({ className, options, onSelect, ...props }, ref) => {
     const [isOpen, setIsOpen] = React.useState(false);
     const [inputValue, setInputValue] = React.useState((props.value as string) || '');
diff --git a/packages/client/src/components/Label.tsx b/packages/client/src/components/Label.tsx
index d250e47e3fb..ef15f3051ce 100644
--- a/packages/client/src/components/Label.tsx
+++ b/packages/client/src/components/Label.tsx
@@ -2,7 +2,11 @@ import * as React from 'react';
 import * as LabelPrimitive from '@radix-ui/react-label';
 import { cn } from '~/utils';
 
-const Label = React.forwardRef<
+const Label: React.ForwardRefExoticComponent<
+  Omit<LabelPrimitive.LabelProps & React.RefAttributes<HTMLLabelElement>, 'ref'> & {
+    className?: string;
+  } & React.RefAttributes<HTMLLabelElement>
+> = React.forwardRef<
   React.ElementRef<typeof LabelPrimitive.Root>,
   React.ComponentPropsWithoutRef<typeof LabelPrimitive.Root> & {
     className?: string;
diff --git a/packages/client/src/components/MultiSearch.tsx b/packages/client/src/components/MultiSearch.tsx
index 56d1843e713..d0b9e8b26b7 100644
--- a/packages/client/src/components/MultiSearch.tsx
+++ b/packages/client/src/components/MultiSearch.tsx
@@ -1,5 +1,6 @@
-import { Search, X } from 'lucide-react';
 import React, { useState, useMemo, useCallback, useRef } from 'react';
+import { JSX } from 'react/jsx-runtime';
+import { Search, X } from 'lucide-react';
 import { cn } from '~/utils';
 
 /** This is a generic that can be added to Menu and Select components */
@@ -13,7 +14,7 @@ export default function MultiSearch({
   onChange: (filter: string) => void;
   placeholder?: string;
   className?: string;
-}) {
+}): JSX.Element {
   const inputRef = useRef<HTMLInputElement>(null);
 
   const onChangeHandler: React.ChangeEventHandler<HTMLInputElement> = useCallback(
diff --git a/packages/client/src/components/MultiSelect.tsx b/packages/client/src/components/MultiSelect.tsx
index bb48841468a..5275cb572da 100644
--- a/packages/client/src/components/MultiSelect.tsx
+++ b/packages/client/src/components/MultiSelect.tsx
@@ -9,6 +9,7 @@ import {
   SelectProvider,
 } from '@ariakit/react';
 import './AnimatePopover.css';
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
 
 type MultiSelectItem<T extends string> = T | { label: string; value: T };
@@ -84,7 +85,7 @@ export default function MultiSelect<T extends string>({
   selectedValues = [],
   setSelectedValues,
   renderItemContent,
-}: MultiSelectProps<T>) {
+}: MultiSelectProps<T>): JSX.Element {
   const selectRef = useRef<HTMLButtonElement>(null);
   const [isPopoverOpen, setIsPopoverOpen] = useState(false);
 
diff --git a/packages/client/src/components/OGDialogTemplate.tsx b/packages/client/src/components/OGDialogTemplate.tsx
index 2414915a4b5..5fd9a581fe9 100644
--- a/packages/client/src/components/OGDialogTemplate.tsx
+++ b/packages/client/src/components/OGDialogTemplate.tsx
@@ -1,4 +1,11 @@
-import { forwardRef, isValidElement, ReactNode, Ref } from 'react';
+import {
+  forwardRef,
+  ForwardRefExoticComponent,
+  isValidElement,
+  ReactNode,
+  Ref,
+  RefAttributes,
+} from 'react';
 import {
   OGDialogTitle,
   OGDialogClose,
@@ -62,7 +69,9 @@ type DialogTemplateProps = {
   onClose?: () => void;
 };
 
-const OGDialogTemplate = forwardRef((props: DialogTemplateProps, ref: Ref<HTMLDivElement>) => {
+const OGDialogTemplate: ForwardRefExoticComponent<
+  DialogTemplateProps & RefAttributes<HTMLDivElement>
+> = forwardRef((props: DialogTemplateProps, ref: Ref<HTMLDivElement>) => {
   const localize = useLocalize();
   const {
     title,
diff --git a/packages/client/src/components/OriginalDialog.tsx b/packages/client/src/components/OriginalDialog.tsx
index e870cbc8c0c..70a19e3433a 100644
--- a/packages/client/src/components/OriginalDialog.tsx
+++ b/packages/client/src/components/OriginalDialog.tsx
@@ -1,6 +1,7 @@
 import * as React from 'react';
-import * as DialogPrimitive from '@radix-ui/react-dialog';
 import { X } from 'lucide-react';
+import { JSX } from 'react/jsx-runtime';
+import * as DialogPrimitive from '@radix-ui/react-dialog';
 import { cn } from '~/utils';
 
 const DialogDepthContext = React.createContext(0);
@@ -10,47 +11,55 @@ interface OGDialogProps extends DialogPrimitive.DialogProps {
   triggerRefs?: React.RefObject<HTMLButtonElement | HTMLInputElement | HTMLDivElement | null>[];
 }
 
-const Dialog = React.forwardRef<HTMLDivElement, OGDialogProps>(
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  ({ children, triggerRef, triggerRefs, onOpenChange, ...props }, ref) => {
-    const parentDepth = React.useContext(DialogDepthContext);
-    const currentDepth = parentDepth + 1;
-
-    const handleOpenChange = (open: boolean) => {
-      if (!open && triggerRef?.current) {
-        setTimeout(() => {
-          triggerRef.current?.focus();
-        }, 0);
-      }
-      if (triggerRefs?.length) {
-        triggerRefs.forEach((ref) => {
-          if (ref?.current) {
-            setTimeout(() => {
-              ref.current?.focus();
-            }, 0);
-          }
-        });
-      }
-      onOpenChange?.(open);
-    };
-
-    return (
-      <DialogDepthContext.Provider value={currentDepth}>
-        <DialogPrimitive.Root {...props} onOpenChange={handleOpenChange}>
-          {children}
-        </DialogPrimitive.Root>
-      </DialogDepthContext.Provider>
-    );
-  },
-);
+const Dialog: React.ForwardRefExoticComponent<OGDialogProps & React.RefAttributes<HTMLDivElement>> =
+  React.forwardRef<HTMLDivElement, OGDialogProps>(
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    ({ children, triggerRef, triggerRefs, onOpenChange, ...props }, ref) => {
+      const parentDepth = React.useContext(DialogDepthContext);
+      const currentDepth = parentDepth + 1;
+
+      const handleOpenChange = (open: boolean) => {
+        if (!open && triggerRef?.current) {
+          setTimeout(() => {
+            triggerRef.current?.focus();
+          }, 0);
+        }
+        if (triggerRefs?.length) {
+          triggerRefs.forEach((ref) => {
+            if (ref?.current) {
+              setTimeout(() => {
+                ref.current?.focus();
+              }, 0);
+            }
+          });
+        }
+        onOpenChange?.(open);
+      };
+
+      return (
+        <DialogDepthContext.Provider value={currentDepth}>
+          <DialogPrimitive.Root {...props} onOpenChange={handleOpenChange}>
+            {children}
+          </DialogPrimitive.Root>
+        </DialogDepthContext.Provider>
+      );
+    },
+  );
 
-const DialogTrigger = DialogPrimitive.Trigger;
+const DialogTrigger: React.ForwardRefExoticComponent<
+  DialogPrimitive.DialogTriggerProps & React.RefAttributes<HTMLButtonElement>
+> = DialogPrimitive.Trigger;
 
-const DialogPortal = DialogPrimitive.Portal;
+const DialogPortal: React.FC<DialogPrimitive.DialogPortalProps> = DialogPrimitive.Portal;
 
-const DialogClose = DialogPrimitive.Close;
+const DialogClose: React.ForwardRefExoticComponent<
+  DialogPrimitive.DialogCloseProps & React.RefAttributes<HTMLButtonElement>
+> = DialogPrimitive.Close;
 
-export const DialogOverlay = React.forwardRef<
+export const DialogOverlay: React.ForwardRefExoticComponent<
+  Omit<DialogPrimitive.DialogOverlayProps & React.RefAttributes<HTMLDivElement>, 'ref'> &
+    React.RefAttributes<HTMLDivElement>
+> = React.forwardRef<
   React.ElementRef<typeof DialogPrimitive.Overlay>,
   React.ComponentPropsWithoutRef<typeof DialogPrimitive.Overlay>
 >(({ className, style, ...props }, ref) => {
@@ -77,10 +86,13 @@ type DialogContentProps = React.ComponentPropsWithoutRef<typeof DialogPrimitive.
   overlayClassName?: string;
 };
 
-const DialogContent = React.forwardRef<
-  React.ElementRef<typeof DialogPrimitive.Content>,
-  DialogContentProps
->(
+const DialogContent: React.ForwardRefExoticComponent<
+  Omit<DialogPrimitive.DialogContentProps & React.RefAttributes<HTMLDivElement>, 'ref'> & {
+    showCloseButton?: boolean;
+    disableScroll?: boolean;
+    overlayClassName?: string;
+  } & React.RefAttributes<HTMLDivElement>
+> = React.forwardRef<React.ElementRef<typeof DialogPrimitive.Content>, DialogContentProps>(
   (
     {
       className,
@@ -161,12 +173,18 @@ const DialogContent = React.forwardRef<
 );
 DialogContent.displayName = DialogPrimitive.Content.displayName;
 
-const DialogHeader = ({ className, ...props }: React.HTMLAttributes<HTMLDivElement>) => (
+const DialogHeader: {
+  ({ className, ...props }: React.HTMLAttributes<HTMLDivElement>): JSX.Element;
+  displayName: string;
+} = ({ className, ...props }: React.HTMLAttributes<HTMLDivElement>): JSX.Element => (
   <div className={cn('flex flex-col space-y-1.5 text-center sm:text-left', className)} {...props} />
 );
 DialogHeader.displayName = 'DialogHeader';
 
-const DialogFooter = ({ className, ...props }: React.HTMLAttributes<HTMLDivElement>) => (
+const DialogFooter: {
+  ({ className, ...props }: React.HTMLAttributes<HTMLDivElement>): JSX.Element;
+  displayName: string;
+} = ({ className, ...props }: React.HTMLAttributes<HTMLDivElement>): JSX.Element => (
   <div
     className={cn('flex flex-col-reverse sm:flex-row sm:justify-end sm:space-x-2', className)}
     {...props}
@@ -174,7 +192,10 @@ const DialogFooter = ({ className, ...props }: React.HTMLAttributes<HTMLDivEleme
 );
 DialogFooter.displayName = 'DialogFooter';
 
-const DialogTitle = React.forwardRef<
+const DialogTitle: React.ForwardRefExoticComponent<
+  Omit<DialogPrimitive.DialogTitleProps & React.RefAttributes<HTMLHeadingElement>, 'ref'> &
+    React.RefAttributes<HTMLHeadingElement>
+> = React.forwardRef<
   React.ElementRef<typeof DialogPrimitive.Title>,
   React.ComponentPropsWithoutRef<typeof DialogPrimitive.Title>
 >(({ className, ...props }, ref) => (
@@ -186,7 +207,10 @@ const DialogTitle = React.forwardRef<
 ));
 DialogTitle.displayName = DialogPrimitive.Title.displayName;
 
-const DialogDescription = React.forwardRef<
+const DialogDescription: React.ForwardRefExoticComponent<
+  Omit<DialogPrimitive.DialogDescriptionProps & React.RefAttributes<HTMLParagraphElement>, 'ref'> &
+    React.RefAttributes<HTMLParagraphElement>
+> = React.forwardRef<
   React.ElementRef<typeof DialogPrimitive.Description>,
   React.ComponentPropsWithoutRef<typeof DialogPrimitive.Description>
 >(({ className, ...props }, ref) => (
diff --git a/packages/client/src/components/Pagination.tsx b/packages/client/src/components/Pagination.tsx
index 815befacccd..259cc5bbec1 100644
--- a/packages/client/src/components/Pagination.tsx
+++ b/packages/client/src/components/Pagination.tsx
@@ -1,9 +1,13 @@
 import * as React from 'react';
+import { JSX } from 'react/jsx-runtime';
 import { ChevronLeft, ChevronRight, MoreHorizontal } from 'lucide-react';
 import { ButtonProps, buttonVariants } from './Button';
 import { cn } from '~/utils';
 
-const Pagination = ({ className, ...props }: React.ComponentProps<'nav'>) => (
+const Pagination: {
+  ({ className, ...props }: React.ComponentProps<'nav'>): JSX.Element;
+  displayName: string;
+} = ({ className, ...props }: React.ComponentProps<'nav'>): JSX.Element => (
   <nav
     role="navigation"
     aria-label="pagination"
@@ -13,16 +17,22 @@ const Pagination = ({ className, ...props }: React.ComponentProps<'nav'>) => (
 );
 Pagination.displayName = 'Pagination';
 
-const PaginationContent = React.forwardRef<HTMLUListElement, React.ComponentProps<'ul'>>(
+const PaginationContent: React.ForwardRefExoticComponent<
+  Omit<React.DetailedHTMLProps<React.HTMLAttributes<HTMLUListElement>, HTMLUListElement>, 'ref'> &
+    React.RefAttributes<HTMLUListElement>
+> = React.forwardRef<HTMLUListElement, React.ComponentProps<'ul'>>(
   ({ className, ...props }, ref) => (
     <ul ref={ref} className={cn('flex flex-row items-center gap-1', className)} {...props} />
   ),
 );
 PaginationContent.displayName = 'PaginationContent';
 
-const PaginationItem = React.forwardRef<HTMLLIElement, React.ComponentProps<'li'>>(
-  ({ className, ...props }, ref) => <li ref={ref} className={cn('', className)} {...props} />,
-);
+const PaginationItem: React.ForwardRefExoticComponent<
+  Omit<React.DetailedHTMLProps<React.LiHTMLAttributes<HTMLLIElement>, HTMLLIElement>, 'ref'> &
+    React.RefAttributes<HTMLLIElement>
+> = React.forwardRef<HTMLLIElement, React.ComponentProps<'li'>>(({ className, ...props }, ref) => (
+  <li ref={ref} className={cn('', className)} {...props} />
+));
 PaginationItem.displayName = 'PaginationItem';
 
 type PaginationLinkProps = {
@@ -30,13 +40,16 @@ type PaginationLinkProps = {
 } & Pick<ButtonProps, 'size'> &
   React.ComponentProps<'a'>;
 
-const PaginationLink = ({
+const PaginationLink: {
+  ({ className, isActive, size, children, ...props }: PaginationLinkProps): JSX.Element;
+  displayName: string;
+} = ({
   className,
   isActive = false,
   size = 'icon',
   children,
   ...props
-}: PaginationLinkProps) => (
+}: PaginationLinkProps): JSX.Element => (
   <a
     aria-current={isActive ? 'page' : undefined}
     className={cn(
@@ -53,10 +66,10 @@ const PaginationLink = ({
 );
 PaginationLink.displayName = 'PaginationLink';
 
-const PaginationPrevious = ({
-  className,
-  ...props
-}: React.ComponentProps<typeof PaginationLink>) => (
+const PaginationPrevious: {
+  ({ className, ...props }: React.ComponentProps<typeof PaginationLink>): JSX.Element;
+  displayName: string;
+} = ({ className, ...props }: React.ComponentProps<typeof PaginationLink>): JSX.Element => (
   <PaginationLink
     aria-label="Go to previous page"
     size="default"
@@ -69,7 +82,10 @@ const PaginationPrevious = ({
 );
 PaginationPrevious.displayName = 'PaginationPrevious';
 
-const PaginationNext = ({ className, ...props }: React.ComponentProps<typeof PaginationLink>) => (
+const PaginationNext: {
+  ({ className, ...props }: React.ComponentProps<typeof PaginationLink>): JSX.Element;
+  displayName: string;
+} = ({ className, ...props }: React.ComponentProps<typeof PaginationLink>): JSX.Element => (
   <PaginationLink
     aria-label="Go to next page"
     size="default"
@@ -82,7 +98,10 @@ const PaginationNext = ({ className, ...props }: React.ComponentProps<typeof Pag
 );
 PaginationNext.displayName = 'PaginationNext';
 
-const PaginationEllipsis = ({ className, ...props }: React.ComponentProps<'span'>) => (
+const PaginationEllipsis: {
+  ({ className, ...props }: React.ComponentProps<'span'>): JSX.Element;
+  displayName: string;
+} = ({ className, ...props }: React.ComponentProps<'span'>): JSX.Element => (
   <span
     aria-hidden
     className={cn('flex h-9 w-9 items-center justify-center', className)}
diff --git a/packages/client/src/components/PixelCard.tsx b/packages/client/src/components/PixelCard.tsx
index c1f3d8971aa..904e2fc05b5 100644
--- a/packages/client/src/components/PixelCard.tsx
+++ b/packages/client/src/components/PixelCard.tsx
@@ -1,4 +1,5 @@
 import { useEffect, useRef, useCallback } from 'react';
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
 
 class Pixel {
@@ -169,7 +170,7 @@ export default function PixelCard({
   randomness = 0.3,
   width,
   height,
-}: PixelCardProps) {
+}: PixelCardProps): JSX.Element {
   const containerRef = useRef<HTMLDivElement>(null);
   const canvasRef = useRef<HTMLCanvasElement>(null);
   const pixelsRef = useRef<Pixel[]>([]);
diff --git a/packages/client/src/components/Progress.tsx b/packages/client/src/components/Progress.tsx
index e8e0b0f6b2d..64c45d45e13 100644
--- a/packages/client/src/components/Progress.tsx
+++ b/packages/client/src/components/Progress.tsx
@@ -2,7 +2,10 @@ import * as React from 'react';
 import * as ProgressPrimitive from '@radix-ui/react-progress';
 import { cn } from '~/utils';
 
-const Progress = React.forwardRef<
+const Progress: React.ForwardRefExoticComponent<
+  Omit<ProgressPrimitive.ProgressProps & React.RefAttributes<HTMLDivElement>, 'ref'> &
+    React.RefAttributes<HTMLDivElement>
+> = React.forwardRef<
   React.ElementRef<typeof ProgressPrimitive.Root>,
   React.ComponentPropsWithoutRef<typeof ProgressPrimitive.Root>
 >(({ className, value, ...props }, ref) => (
diff --git a/packages/client/src/components/QuestionMark.tsx b/packages/client/src/components/QuestionMark.tsx
index f018226f19d..b01bb0d7914 100644
--- a/packages/client/src/components/QuestionMark.tsx
+++ b/packages/client/src/components/QuestionMark.tsx
@@ -1,6 +1,11 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
 
-export const QuestionMark = ({ className = '' }) => {
+export const QuestionMark = ({
+  className = '',
+}: {
+  className?: string | undefined;
+}): JSX.Element => {
   return (
     <span>
       <div
diff --git a/packages/client/src/components/Radio.tsx b/packages/client/src/components/Radio.tsx
index 6f1a4736170..0115c6b9d5a 100644
--- a/packages/client/src/components/Radio.tsx
+++ b/packages/client/src/components/Radio.tsx
@@ -18,7 +18,7 @@ interface RadioProps {
   'aria-labelledby'?: string;
 }
 
-const Radio = memo(function Radio({
+const Radio: React.NamedExoticComponent<RadioProps> = memo(function Radio({
   options,
   value,
   onChange,
diff --git a/packages/client/src/components/Resizable.tsx b/packages/client/src/components/Resizable.tsx
index 817f860313d..cc6eea00bb0 100644
--- a/packages/client/src/components/Resizable.tsx
+++ b/packages/client/src/components/Resizable.tsx
@@ -1,13 +1,17 @@
+import { JSX } from 'react/jsx-runtime';
 import { GripVertical } from 'lucide-react';
 import { Group, Panel, Separator } from 'react-resizable-panels';
 import type { ComponentProps } from 'react';
 import { cn } from '~/utils';
 
-const ResizablePanelGroup = ({ className = '', ...props }: ComponentProps<typeof Group>) => (
+const ResizablePanelGroup = ({
+  className = '',
+  ...props
+}: ComponentProps<typeof Group>): JSX.Element => (
   <Group className={cn('h-full w-full', className)} {...props} />
 );
 
-const ResizablePanel = Panel;
+const ResizablePanel: typeof Panel = Panel;
 
 const ResizableHandle = ({
   withHandle,
@@ -15,7 +19,7 @@ const ResizableHandle = ({
   ...props
 }: ComponentProps<typeof Separator> & {
   withHandle?: boolean;
-}) => (
+}): JSX.Element => (
   <Separator
     className={cn(
       'relative flex w-px items-center justify-center bg-border after:absolute after:inset-y-0 after:left-1/2 after:w-1 after:-translate-x-1/2 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring focus-visible:ring-offset-1',
@@ -37,7 +41,7 @@ const ResizableHandleAlt = ({
   ...props
 }: ComponentProps<typeof Separator> & {
   withHandle?: boolean;
-}) => (
+}): JSX.Element => (
   <Separator
     className={cn(
       'group relative flex w-px items-center justify-center bg-border after:absolute after:inset-y-0 after:left-1/2 after:w-1 after:-translate-x-1/2 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring focus-visible:ring-offset-1',
diff --git a/packages/client/src/components/SecretInput.tsx b/packages/client/src/components/SecretInput.tsx
index 33e018f1e95..57b718a9c48 100644
--- a/packages/client/src/components/SecretInput.tsx
+++ b/packages/client/src/components/SecretInput.tsx
@@ -19,7 +19,9 @@ export interface SecretInputProps
   controlsOnHover?: boolean;
 }
 
-const SecretInput = React.forwardRef<HTMLInputElement, SecretInputProps>(
+const SecretInput: React.ForwardRefExoticComponent<
+  SecretInputProps & React.RefAttributes<HTMLInputElement>
+> = React.forwardRef<HTMLInputElement, SecretInputProps>(
   (
     {
       id,
diff --git a/packages/client/src/components/Select.tsx b/packages/client/src/components/Select.tsx
index 51671c0782c..1cdc604e44f 100644
--- a/packages/client/src/components/Select.tsx
+++ b/packages/client/src/components/Select.tsx
@@ -4,15 +4,22 @@ import { CaretSortIcon, CheckIcon, ChevronDownIcon, ChevronUpIcon } from '@radix
 import { cn } from '~/utils';
 
 // @ts-ignore - Radix UI type conflicts with React types
-const Select = SelectPrimitive.Root;
+const Select: React.FC<SelectPrimitive.SelectProps> = SelectPrimitive.Root;
 
 // @ts-ignore - Radix UI type conflicts with React types
-const SelectGroup = SelectPrimitive.Group;
+const SelectGroup: React.ForwardRefExoticComponent<
+  SelectPrimitive.SelectGroupProps & React.RefAttributes<HTMLDivElement>
+> = SelectPrimitive.Group;
 
-const SelectValue = SelectPrimitive.Value;
+const SelectValue: React.ForwardRefExoticComponent<
+  SelectPrimitive.SelectValueProps & React.RefAttributes<HTMLSpanElement>
+> = SelectPrimitive.Value;
 
 // @ts-ignore - Radix UI type conflicts with React types
-const SelectTrigger = React.forwardRef<
+const SelectTrigger: React.ForwardRefExoticComponent<
+  Omit<SelectPrimitive.SelectTriggerProps & React.RefAttributes<HTMLButtonElement>, 'ref'> &
+    React.RefAttributes<HTMLButtonElement>
+> = React.forwardRef<
   React.ElementRef<typeof SelectPrimitive.Trigger>,
   React.ComponentPropsWithoutRef<typeof SelectPrimitive.Trigger>
 >(({ className = '', children, ...props }, ref) => (
@@ -33,7 +40,10 @@ const SelectTrigger = React.forwardRef<
 ));
 SelectTrigger.displayName = SelectPrimitive.Trigger.displayName;
 
-const SelectScrollUpButton = React.forwardRef<
+const SelectScrollUpButton: React.ForwardRefExoticComponent<
+  Omit<SelectPrimitive.SelectScrollUpButtonProps & React.RefAttributes<HTMLDivElement>, 'ref'> &
+    React.RefAttributes<HTMLDivElement>
+> = React.forwardRef<
   React.ElementRef<typeof SelectPrimitive.ScrollUpButton>,
   React.ComponentPropsWithoutRef<typeof SelectPrimitive.ScrollUpButton>
 >(({ className = '', ...props }, ref) => (
@@ -50,7 +60,10 @@ const SelectScrollUpButton = React.forwardRef<
 ));
 SelectScrollUpButton.displayName = SelectPrimitive.ScrollUpButton.displayName;
 
-const SelectScrollDownButton = React.forwardRef<
+const SelectScrollDownButton: React.ForwardRefExoticComponent<
+  Omit<SelectPrimitive.SelectScrollDownButtonProps & React.RefAttributes<HTMLDivElement>, 'ref'> &
+    React.RefAttributes<HTMLDivElement>
+> = React.forwardRef<
   React.ElementRef<typeof SelectPrimitive.ScrollDownButton>,
   React.ComponentPropsWithoutRef<typeof SelectPrimitive.ScrollDownButton>
 >(({ className = '', ...props }, ref) => (
@@ -67,7 +80,10 @@ const SelectScrollDownButton = React.forwardRef<
 ));
 SelectScrollDownButton.displayName = SelectPrimitive.ScrollDownButton.displayName;
 
-const SelectContent = React.forwardRef<
+const SelectContent: React.ForwardRefExoticComponent<
+  Omit<SelectPrimitive.SelectContentProps & React.RefAttributes<HTMLDivElement>, 'ref'> &
+    React.RefAttributes<HTMLDivElement>
+> = React.forwardRef<
   React.ElementRef<typeof SelectPrimitive.Content>,
   React.ComponentPropsWithoutRef<typeof SelectPrimitive.Content>
 >(({ className = '', children, position = 'popper', ...props }, ref) => (
@@ -101,7 +117,10 @@ const SelectContent = React.forwardRef<
 ));
 SelectContent.displayName = SelectPrimitive.Content.displayName;
 
-const SelectLabel = React.forwardRef<
+const SelectLabel: React.ForwardRefExoticComponent<
+  Omit<SelectPrimitive.SelectLabelProps & React.RefAttributes<HTMLDivElement>, 'ref'> &
+    React.RefAttributes<HTMLDivElement>
+> = React.forwardRef<
   React.ElementRef<typeof SelectPrimitive.Label>,
   React.ComponentPropsWithoutRef<typeof SelectPrimitive.Label>
 >(({ className = '', ...props }, ref) => (
@@ -113,7 +132,10 @@ const SelectLabel = React.forwardRef<
 ));
 SelectLabel.displayName = SelectPrimitive.Label.displayName;
 
-const SelectItem = React.forwardRef<
+const SelectItem: React.ForwardRefExoticComponent<
+  Omit<SelectPrimitive.SelectItemProps & React.RefAttributes<HTMLDivElement>, 'ref'> &
+    React.RefAttributes<HTMLDivElement>
+> = React.forwardRef<
   React.ElementRef<typeof SelectPrimitive.Item>,
   React.ComponentPropsWithoutRef<typeof SelectPrimitive.Item>
 >(({ className = '', children, ...props }, ref) => (
@@ -136,7 +158,10 @@ const SelectItem = React.forwardRef<
 ));
 SelectItem.displayName = SelectPrimitive.Item.displayName;
 
-const SelectSeparator = React.forwardRef<
+const SelectSeparator: React.ForwardRefExoticComponent<
+  Omit<SelectPrimitive.SelectSeparatorProps & React.RefAttributes<HTMLDivElement>, 'ref'> &
+    React.RefAttributes<HTMLDivElement>
+> = React.forwardRef<
   React.ElementRef<typeof SelectPrimitive.Separator>,
   React.ComponentPropsWithoutRef<typeof SelectPrimitive.Separator>
 >(({ className = '', ...props }, ref) => (
diff --git a/packages/client/src/components/SelectDropDown.tsx b/packages/client/src/components/SelectDropDown.tsx
index e9a6027bc17..c73d8856f13 100644
--- a/packages/client/src/components/SelectDropDown.tsx
+++ b/packages/client/src/components/SelectDropDown.tsx
@@ -1,4 +1,5 @@
 import React, { useRef } from 'react';
+import { JSX } from 'react/jsx-runtime';
 import {
   Label,
   Listbox,
@@ -73,7 +74,7 @@ function SelectDropDown({
   searchClassName,
   searchPlaceholder,
   showOptionIcon = false,
-}: SelectDropDownProps) {
+}: SelectDropDownProps): JSX.Element {
   const transitionProps = { className: 'top-full mt-3' };
   if (showAbove) {
     transitionProps.className = 'bottom-full mb-3';
diff --git a/packages/client/src/components/Separator.tsx b/packages/client/src/components/Separator.tsx
index 7ba6d380960..e6281145745 100644
--- a/packages/client/src/components/Separator.tsx
+++ b/packages/client/src/components/Separator.tsx
@@ -3,7 +3,11 @@ import * as SeparatorPrimitive from '@radix-ui/react-separator';
 
 import { cn } from '~/utils';
 
-const Separator = React.forwardRef<
+const Separator: React.ForwardRefExoticComponent<
+  Omit<SeparatorPrimitive.SeparatorProps & React.RefAttributes<HTMLDivElement>, 'ref'> & {
+    className?: string;
+  } & React.RefAttributes<HTMLDivElement>
+> = React.forwardRef<
   React.ElementRef<typeof SeparatorPrimitive.Root>,
   React.ComponentPropsWithoutRef<typeof SeparatorPrimitive.Root> & {
     className?: string;
diff --git a/packages/client/src/components/Skeleton.tsx b/packages/client/src/components/Skeleton.tsx
index a903db77a02..90da649ae59 100644
--- a/packages/client/src/components/Skeleton.tsx
+++ b/packages/client/src/components/Skeleton.tsx
@@ -1,6 +1,7 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
 
-function Skeleton({ className, ...props }: React.HTMLAttributes<HTMLDivElement>) {
+function Skeleton({ className, ...props }: React.HTMLAttributes<HTMLDivElement>): JSX.Element {
   return (
     <div
       className={cn(
diff --git a/packages/client/src/components/Slider.tsx b/packages/client/src/components/Slider.tsx
index 3845b8901fa..4cf13a5f26d 100644
--- a/packages/client/src/components/Slider.tsx
+++ b/packages/client/src/components/Slider.tsx
@@ -12,46 +12,47 @@ type SliderProps = React.ComponentPropsWithoutRef<typeof SliderPrimitive.Root> &
     | { 'aria-label': string; 'aria-labelledby': string }
   );
 
-const Slider = React.forwardRef<React.ElementRef<typeof SliderPrimitive.Root>, SliderProps>(
-  (
-    {
-      className,
-      onDoubleClick,
-      'aria-labelledby': ariaLabelledBy,
-      'aria-label': ariaLabel,
-      'aria-describedby': ariaDescribedBy,
-      ...props
-    },
-    ref,
-  ) => (
-    <SliderPrimitive.Root
-      ref={ref}
-      {...props}
-      {...{
-        className: cn(
-          'relative flex w-full cursor-pointer touch-none select-none items-center',
-          className,
-        ),
+const Slider: React.ForwardRefExoticComponent<SliderProps & React.RefAttributes<HTMLSpanElement>> =
+  React.forwardRef<React.ElementRef<typeof SliderPrimitive.Root>, SliderProps>(
+    (
+      {
+        className,
         onDoubleClick,
-      }}
-    >
-      <SliderPrimitive.Track
-        {...{ className: 'relative h-2 w-full grow overflow-hidden rounded-full bg-secondary' }}
-      >
-        <SliderPrimitive.Range {...{ className: 'absolute h-full bg-primary' }} />
-      </SliderPrimitive.Track>
-      <SliderPrimitive.Thumb
+        'aria-labelledby': ariaLabelledBy,
+        'aria-label': ariaLabel,
+        'aria-describedby': ariaDescribedBy,
+        ...props
+      },
+      ref,
+    ) => (
+      <SliderPrimitive.Root
+        ref={ref}
+        {...props}
         {...{
-          className:
-            'block h-5 w-5 rounded-full border-2 border-primary bg-background ring-offset-background transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:pointer-events-none disabled:opacity-50',
-          'aria-labelledby': ariaLabelledBy,
-          'aria-label': ariaLabel,
-          'aria-describedby': ariaDescribedBy,
+          className: cn(
+            'relative flex w-full cursor-pointer touch-none select-none items-center',
+            className,
+          ),
+          onDoubleClick,
         }}
-      />
-    </SliderPrimitive.Root>
-  ),
-);
+      >
+        <SliderPrimitive.Track
+          {...{ className: 'relative h-2 w-full grow overflow-hidden rounded-full bg-secondary' }}
+        >
+          <SliderPrimitive.Range {...{ className: 'absolute h-full bg-primary' }} />
+        </SliderPrimitive.Track>
+        <SliderPrimitive.Thumb
+          {...{
+            className:
+              'block h-5 w-5 rounded-full border-2 border-primary bg-background ring-offset-background transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:pointer-events-none disabled:opacity-50',
+            'aria-labelledby': ariaLabelledBy,
+            'aria-label': ariaLabel,
+            'aria-describedby': ariaDescribedBy,
+          }}
+        />
+      </SliderPrimitive.Root>
+    ),
+  );
 Slider.displayName = SliderPrimitive.Root.displayName;
 
 export { Slider };
diff --git a/packages/client/src/components/Switch.tsx b/packages/client/src/components/Switch.tsx
index 42c8c561e70..66d1e1508ce 100644
--- a/packages/client/src/components/Switch.tsx
+++ b/packages/client/src/components/Switch.tsx
@@ -17,7 +17,9 @@ type SwitchProps =
       'aria-label'?: never;
     });
 
-const Switch = React.forwardRef<React.ElementRef<typeof SwitchPrimitives.Root>, SwitchProps>(
+const Switch: React.ForwardRefExoticComponent<
+  SwitchProps & React.RefAttributes<HTMLButtonElement>
+> = React.forwardRef<React.ElementRef<typeof SwitchPrimitives.Root>, SwitchProps>(
   ({ className, ...props }, ref) => (
     <SwitchPrimitives.Root
       className={cn(
diff --git a/packages/client/src/components/Table.tsx b/packages/client/src/components/Table.tsx
index a14ac3a8ac8..662ac5bae9e 100644
--- a/packages/client/src/components/Table.tsx
+++ b/packages/client/src/components/Table.tsx
@@ -5,50 +5,56 @@ interface TableProps extends React.HTMLAttributes<HTMLTableElement> {
   unwrapped?: boolean;
 }
 
-const Table = React.forwardRef<HTMLTableElement, TableProps>(
-  ({ className, unwrapped = false, ...props }, ref) => {
-    const tableElement = (
-      <table ref={ref} className={cn('w-full caption-bottom text-sm', className)} {...props} />
-    );
+const Table: React.ForwardRefExoticComponent<TableProps & React.RefAttributes<HTMLTableElement>> =
+  React.forwardRef<HTMLTableElement, TableProps>(
+    ({ className, unwrapped = false, ...props }, ref) => {
+      const tableElement = (
+        <table ref={ref} className={cn('w-full caption-bottom text-sm', className)} {...props} />
+      );
 
-    if (unwrapped) {
-      return tableElement;
-    }
+      if (unwrapped) {
+        return tableElement;
+      }
 
-    return <div className="relative w-full overflow-auto">{tableElement}</div>;
-  },
-);
+      return <div className="relative w-full overflow-auto">{tableElement}</div>;
+    },
+  );
 Table.displayName = 'Table';
 
-const TableHeader = React.forwardRef<
-  HTMLTableSectionElement,
-  React.HTMLAttributes<HTMLTableSectionElement>
->(({ className, ...props }, ref) => (
-  <thead ref={ref} className={cn('[&_tr]:border-b', className)} {...props} />
-));
+const TableHeader: React.ForwardRefExoticComponent<
+  React.HTMLAttributes<HTMLTableSectionElement> & React.RefAttributes<HTMLTableSectionElement>
+> = React.forwardRef<HTMLTableSectionElement, React.HTMLAttributes<HTMLTableSectionElement>>(
+  ({ className, ...props }, ref) => (
+    <thead ref={ref} className={cn('[&_tr]:border-b', className)} {...props} />
+  ),
+);
 TableHeader.displayName = 'TableHeader';
 
-const TableBody = React.forwardRef<
-  HTMLTableSectionElement,
-  React.HTMLAttributes<HTMLTableSectionElement>
->(({ className, ...props }, ref) => (
-  <tbody ref={ref} className={cn('[&_tr:last-child]:border-0', className)} {...props} />
-));
+const TableBody: React.ForwardRefExoticComponent<
+  React.HTMLAttributes<HTMLTableSectionElement> & React.RefAttributes<HTMLTableSectionElement>
+> = React.forwardRef<HTMLTableSectionElement, React.HTMLAttributes<HTMLTableSectionElement>>(
+  ({ className, ...props }, ref) => (
+    <tbody ref={ref} className={cn('[&_tr:last-child]:border-0', className)} {...props} />
+  ),
+);
 TableBody.displayName = 'TableBody';
 
-const TableFooter = React.forwardRef<
-  HTMLTableSectionElement,
-  React.HTMLAttributes<HTMLTableSectionElement>
->(({ className, ...props }, ref) => (
-  <tfoot
-    ref={ref}
-    className={cn('border-t bg-muted/50 font-medium [&>tr]:last:border-b-0', className)}
-    {...props}
-  />
-));
+const TableFooter: React.ForwardRefExoticComponent<
+  React.HTMLAttributes<HTMLTableSectionElement> & React.RefAttributes<HTMLTableSectionElement>
+> = React.forwardRef<HTMLTableSectionElement, React.HTMLAttributes<HTMLTableSectionElement>>(
+  ({ className, ...props }, ref) => (
+    <tfoot
+      ref={ref}
+      className={cn('border-t bg-muted/50 font-medium [&>tr]:last:border-b-0', className)}
+      {...props}
+    />
+  ),
+);
 TableFooter.displayName = 'TableFooter';
 
-const TableRow = React.forwardRef<HTMLTableRowElement, React.HTMLAttributes<HTMLTableRowElement>>(
+const TableRow: React.ForwardRefExoticComponent<
+  React.HTMLAttributes<HTMLTableRowElement> & React.RefAttributes<HTMLTableRowElement>
+> = React.forwardRef<HTMLTableRowElement, React.HTMLAttributes<HTMLTableRowElement>>(
   ({ className, ...props }, ref) => (
     <tr
       ref={ref}
@@ -62,55 +68,59 @@ const TableRow = React.forwardRef<HTMLTableRowElement, React.HTMLAttributes<HTML
 );
 TableRow.displayName = 'TableRow';
 
-const TableHead = React.forwardRef<
-  HTMLTableCellElement,
-  React.ThHTMLAttributes<HTMLTableCellElement>
->(({ className, ...props }, ref) => (
-  <th
-    ref={ref}
-    className={cn(
-      'h-12 px-4 text-left align-middle font-medium text-muted-foreground [&:has([role=checkbox])]:pr-0',
-      className,
-    )}
-    {...props}
-  />
-));
+const TableHead: React.ForwardRefExoticComponent<
+  React.ThHTMLAttributes<HTMLTableCellElement> & React.RefAttributes<HTMLTableCellElement>
+> = React.forwardRef<HTMLTableCellElement, React.ThHTMLAttributes<HTMLTableCellElement>>(
+  ({ className, ...props }, ref) => (
+    <th
+      ref={ref}
+      className={cn(
+        'h-12 px-4 text-left align-middle font-medium text-muted-foreground [&:has([role=checkbox])]:pr-0',
+        className,
+      )}
+      {...props}
+    />
+  ),
+);
 TableHead.displayName = 'TableHead';
 
-const TableCell = React.forwardRef<
-  HTMLTableCellElement,
-  React.TdHTMLAttributes<HTMLTableCellElement>
->(({ className, ...props }, ref) => (
-  <td
-    ref={ref}
-    className={cn('p-4 align-middle [&:has([role=checkbox])]:pr-0', className)}
-    {...props}
-  />
-));
+const TableCell: React.ForwardRefExoticComponent<
+  React.TdHTMLAttributes<HTMLTableCellElement> & React.RefAttributes<HTMLTableCellElement>
+> = React.forwardRef<HTMLTableCellElement, React.TdHTMLAttributes<HTMLTableCellElement>>(
+  ({ className, ...props }, ref) => (
+    <td
+      ref={ref}
+      className={cn('p-4 align-middle [&:has([role=checkbox])]:pr-0', className)}
+      {...props}
+    />
+  ),
+);
 TableCell.displayName = 'TableCell';
 
-const TableRowHeader = React.forwardRef<
-  HTMLTableCellElement,
-  React.ThHTMLAttributes<HTMLTableCellElement>
->(({ className, ...props }, ref) => (
-  <th
-    ref={ref}
-    scope="row"
-    className={cn(
-      'p-4 text-left align-middle font-medium [&:has([role=checkbox])]:pr-0',
-      className,
-    )}
-    {...props}
-  />
-));
+const TableRowHeader: React.ForwardRefExoticComponent<
+  React.ThHTMLAttributes<HTMLTableCellElement> & React.RefAttributes<HTMLTableCellElement>
+> = React.forwardRef<HTMLTableCellElement, React.ThHTMLAttributes<HTMLTableCellElement>>(
+  ({ className, ...props }, ref) => (
+    <th
+      ref={ref}
+      scope="row"
+      className={cn(
+        'p-4 text-left align-middle font-medium [&:has([role=checkbox])]:pr-0',
+        className,
+      )}
+      {...props}
+    />
+  ),
+);
 TableRowHeader.displayName = 'TableRowHeader';
 
-const TableCaption = React.forwardRef<
-  HTMLTableCaptionElement,
-  React.HTMLAttributes<HTMLTableCaptionElement>
->(({ className, ...props }, ref) => (
-  <caption ref={ref} className={cn('mt-4 text-sm text-muted-foreground', className)} {...props} />
-));
+const TableCaption: React.ForwardRefExoticComponent<
+  React.HTMLAttributes<HTMLTableCaptionElement> & React.RefAttributes<HTMLTableCaptionElement>
+> = React.forwardRef<HTMLTableCaptionElement, React.HTMLAttributes<HTMLTableCaptionElement>>(
+  ({ className, ...props }, ref) => (
+    <caption ref={ref} className={cn('mt-4 text-sm text-muted-foreground', className)} {...props} />
+  ),
+);
 TableCaption.displayName = 'TableCaption';
 
 export {
diff --git a/packages/client/src/components/Tabs.tsx b/packages/client/src/components/Tabs.tsx
index b4bc2a901c4..81658ab0726 100644
--- a/packages/client/src/components/Tabs.tsx
+++ b/packages/client/src/components/Tabs.tsx
@@ -2,9 +2,14 @@ import * as React from 'react';
 import * as TabsPrimitive from '@radix-ui/react-tabs';
 import { cn } from '~/utils';
 
-const Tabs = TabsPrimitive.Root;
+const Tabs: React.ForwardRefExoticComponent<
+  TabsPrimitive.TabsProps & React.RefAttributes<HTMLDivElement>
+> = TabsPrimitive.Root;
 
-const TabsList = React.forwardRef<
+const TabsList: React.ForwardRefExoticComponent<
+  Omit<TabsPrimitive.TabsListProps & React.RefAttributes<HTMLDivElement>, 'ref'> &
+    React.RefAttributes<HTMLDivElement>
+> = React.forwardRef<
   React.ElementRef<typeof TabsPrimitive.List>,
   React.ComponentPropsWithoutRef<typeof TabsPrimitive.List>
 >(({ className = '', ...props }, ref) => (
@@ -19,7 +24,10 @@ const TabsList = React.forwardRef<
 ));
 TabsList.displayName = TabsPrimitive.List.displayName;
 
-const TabsTrigger = React.forwardRef<
+const TabsTrigger: React.ForwardRefExoticComponent<
+  Omit<TabsPrimitive.TabsTriggerProps & React.RefAttributes<HTMLButtonElement>, 'ref'> &
+    React.RefAttributes<HTMLButtonElement>
+> = React.forwardRef<
   React.ElementRef<typeof TabsPrimitive.Trigger>,
   React.ComponentPropsWithoutRef<typeof TabsPrimitive.Trigger>
 >(({ className = '', ...props }, ref) => (
@@ -34,7 +42,10 @@ const TabsTrigger = React.forwardRef<
 ));
 TabsTrigger.displayName = TabsPrimitive.Trigger.displayName;
 
-const TabsContent = React.forwardRef<
+const TabsContent: React.ForwardRefExoticComponent<
+  Omit<TabsPrimitive.TabsContentProps & React.RefAttributes<HTMLDivElement>, 'ref'> &
+    React.RefAttributes<HTMLDivElement>
+> = React.forwardRef<
   React.ElementRef<typeof TabsPrimitive.Content>,
   React.ComponentPropsWithoutRef<typeof TabsPrimitive.Content>
 >(({ className = '', ...props }, ref) => (
diff --git a/packages/client/src/components/Tag.tsx b/packages/client/src/components/Tag.tsx
index 1ae58b5cc19..012eb25a3ae 100644
--- a/packages/client/src/components/Tag.tsx
+++ b/packages/client/src/components/Tag.tsx
@@ -47,4 +47,14 @@ const TagPrimitiveRoot = React.forwardRef<HTMLDivElement, TagProps>(
 
 TagPrimitiveRoot.displayName = 'Tag';
 
-export const Tag = React.memo(TagPrimitiveRoot);
+export const Tag: React.MemoExoticComponent<
+  React.ForwardRefExoticComponent<
+    Omit<React.DetailedHTMLProps<React.HTMLAttributes<HTMLDivElement>, HTMLDivElement>, 'ref'> & {
+      label: string;
+      labelClassName?: string;
+      CancelButton?: React.ReactNode;
+      LabelNode?: React.ReactNode;
+      onRemove?: (e: React.MouseEvent<HTMLButtonElement>) => void;
+    } & React.RefAttributes<HTMLDivElement>
+  >
+> = React.memo(TagPrimitiveRoot);
diff --git a/packages/client/src/components/Textarea.tsx b/packages/client/src/components/Textarea.tsx
index f9167e91c15..0ad61c8786e 100644
--- a/packages/client/src/components/Textarea.tsx
+++ b/packages/client/src/components/Textarea.tsx
@@ -5,20 +5,20 @@ import { cn } from '~/utils';
 
 export interface TextareaProps extends React.TextareaHTMLAttributes<HTMLTextAreaElement> {}
 
-const Textarea = React.forwardRef<HTMLTextAreaElement, TextareaProps>(
-  ({ className = '', ...props }, ref) => {
-    return (
-      <textarea
-        className={cn(
-          'flex h-20 w-full resize-none rounded-md border border-gray-300 bg-transparent px-3 py-2 text-sm placeholder:text-gray-400 focus:outline-none focus:ring-2 focus:ring-gray-400 focus:ring-offset-2 disabled:cursor-not-allowed disabled:opacity-50 dark:border-gray-700 dark:text-gray-50 dark:focus:ring-gray-400 dark:focus:ring-offset-gray-900',
-          className,
-        )}
-        ref={ref}
-        {...props}
-      />
-    );
-  },
-);
+const Textarea: React.ForwardRefExoticComponent<
+  TextareaProps & React.RefAttributes<HTMLTextAreaElement>
+> = React.forwardRef<HTMLTextAreaElement, TextareaProps>(({ className = '', ...props }, ref) => {
+  return (
+    <textarea
+      className={cn(
+        'flex h-20 w-full resize-none rounded-md border border-gray-300 bg-transparent px-3 py-2 text-sm placeholder:text-gray-400 focus:outline-none focus:ring-2 focus:ring-gray-400 focus:ring-offset-2 disabled:cursor-not-allowed disabled:opacity-50 dark:border-gray-700 dark:text-gray-50 dark:focus:ring-gray-400 dark:focus:ring-offset-gray-900',
+        className,
+      )}
+      ref={ref}
+      {...props}
+    />
+  );
+});
 Textarea.displayName = 'Textarea';
 
 export { Textarea };
diff --git a/packages/client/src/components/TextareaAutosize.tsx b/packages/client/src/components/TextareaAutosize.tsx
index d85ccbbf61e..3d5c3622ffe 100644
--- a/packages/client/src/components/TextareaAutosize.tsx
+++ b/packages/client/src/components/TextareaAutosize.tsx
@@ -1,5 +1,11 @@
+import {
+  forwardRef,
+  RefAttributes,
+  ForwardRefExoticComponent,
+  useLayoutEffect,
+  useState,
+} from 'react';
 import { useAtomValue } from 'jotai';
-import { forwardRef, useLayoutEffect, useState } from 'react';
 import ReactTextareaAutosize from 'react-textarea-autosize';
 import type { TextareaAutosizeProps } from 'react-textarea-autosize';
 import { chatDirectionAtom } from '~/store';
@@ -16,11 +22,11 @@ export type TextareaAutosizePropsWithAria =
       'aria-label'?: never;
     });
 
-export const TextareaAutosize = forwardRef<HTMLTextAreaElement, TextareaAutosizePropsWithAria>(
-  (props, ref) => {
-    const [, setIsRerendered] = useState(false);
-    const chatDirection = useAtomValue(chatDirectionAtom).toLowerCase();
-    useLayoutEffect(() => setIsRerendered(true), []);
-    return <ReactTextareaAutosize dir={chatDirection} {...props} ref={ref} />;
-  },
-);
+export const TextareaAutosize: ForwardRefExoticComponent<
+  TextareaAutosizePropsWithAria & RefAttributes<HTMLTextAreaElement>
+> = forwardRef<HTMLTextAreaElement, TextareaAutosizePropsWithAria>((props, ref) => {
+  const [, setIsRerendered] = useState(false);
+  const chatDirection = useAtomValue(chatDirectionAtom).toLowerCase();
+  useLayoutEffect(() => setIsRerendered(true), []);
+  return <ReactTextareaAutosize dir={chatDirection} {...props} ref={ref} />;
+});
diff --git a/packages/client/src/components/ThemeSelector.tsx b/packages/client/src/components/ThemeSelector.tsx
index 5956e87b397..ebe110b58cd 100644
--- a/packages/client/src/components/ThemeSelector.tsx
+++ b/packages/client/src/components/ThemeSelector.tsx
@@ -1,4 +1,5 @@
 import { useContext, useCallback, useEffect, useState } from 'react';
+import { JSX } from 'react/jsx-runtime';
 import { Sun, Moon, Monitor } from 'lucide-react';
 import { ThemeContext, isDark } from '../theme';
 import { useLocalize } from '../hooks';
@@ -54,7 +55,7 @@ const Theme = ({ theme, onChange }: { theme: string; onChange: (value: string) =
   );
 };
 
-const ThemeSelector = ({ returnThemeOnly }: { returnThemeOnly?: boolean }) => {
+const ThemeSelector = ({ returnThemeOnly }: { returnThemeOnly?: boolean }): JSX.Element => {
   const { theme, setTheme } = useContext(ThemeContext);
   const [announcement, setAnnouncement] = useState('');
   const localize = useLocalize();
diff --git a/packages/client/src/components/Toast.tsx b/packages/client/src/components/Toast.tsx
index f78b6d5aaa3..7c47ef5d2fe 100644
--- a/packages/client/src/components/Toast.tsx
+++ b/packages/client/src/components/Toast.tsx
@@ -1,8 +1,9 @@
+import { JSX } from 'react/jsx-runtime';
 import * as RadixToast from '@radix-ui/react-toast';
 import { NotificationSeverity } from '~/common';
 import { useToast } from '~/hooks';
 
-export function Toast() {
+export function Toast(): JSX.Element {
   const { toast, onOpenChange } = useToast();
   const severityClassName = {
     /* Going up by 100 units in terms of darkness (eg bg-green-500 to bg-green-600) for
diff --git a/packages/client/src/components/Tooltip.tsx b/packages/client/src/components/Tooltip.tsx
index ddcdeef6c9a..21457c9435d 100644
--- a/packages/client/src/components/Tooltip.tsx
+++ b/packages/client/src/components/Tooltip.tsx
@@ -1,6 +1,13 @@
+import {
+  memo,
+  forwardRef,
+  useCallback,
+  useMemo,
+  RefAttributes,
+  ForwardRefExoticComponent,
+} from 'react';
 import DOMPurify from 'dompurify';
 import * as Ariakit from '@ariakit/react';
-import { memo, forwardRef, useCallback, useMemo } from 'react';
 import { AnimatePresence, motion } from 'framer-motion';
 import { cn } from '~/utils';
 import './Tooltip.css';
@@ -104,7 +111,9 @@ const TooltipPopup = memo(function TooltipPopup({
   );
 });
 
-export const TooltipAnchor = forwardRef<HTMLDivElement, TooltipAnchorProps>(function TooltipAnchor(
+export const TooltipAnchor: ForwardRefExoticComponent<
+  Omit<TooltipAnchorProps, 'ref'> & RefAttributes<HTMLDivElement>
+> = forwardRef<HTMLDivElement, TooltipAnchorProps>(function TooltipAnchor(
   { description, side = 'top', className, role, enableHTML = false, ...props },
   ref,
 ) {
diff --git a/packages/client/src/hooks/ThemeContext.old.tsx b/packages/client/src/hooks/ThemeContext.old.tsx
index 74516fcab0a..d026868b765 100644
--- a/packages/client/src/hooks/ThemeContext.old.tsx
+++ b/packages/client/src/hooks/ThemeContext.old.tsx
@@ -1,7 +1,8 @@
 //ThemeContext.js
 // source: https://plainenglish.io/blog/light-and-dark-mode-in-react-web-application-with-tailwind-css-89674496b942
-import { useSetAtom } from 'jotai';
 import React, { createContext, useState, useEffect } from 'react';
+import { useSetAtom } from 'jotai';
+import { JSX } from 'react/jsx-runtime';
 import { getInitialTheme, applyFontSize } from '~/utils';
 import { fontSizeAtom } from '~/store';
 
@@ -24,7 +25,8 @@ export const isDark = (theme: string): boolean => {
   return theme === 'dark';
 };
 
-export const ThemeContext = createContext<ProviderValue>(defaultContextValue);
+export const ThemeContext: React.Context<ProviderValue> =
+  createContext<ProviderValue>(defaultContextValue);
 
 export const ThemeProvider = ({
   initialTheme,
@@ -32,7 +34,7 @@ export const ThemeProvider = ({
 }: {
   initialTheme?: string;
   children: React.ReactNode;
-}) => {
+}): JSX.Element => {
   const [theme, setTheme] = useState(getInitialTheme);
   const setFontSize = useSetAtom(fontSizeAtom);
 
diff --git a/packages/client/src/hooks/useAvatar.ts b/packages/client/src/hooks/useAvatar.ts
index 8b183bb276d..c57b058efa3 100644
--- a/packages/client/src/hooks/useAvatar.ts
+++ b/packages/client/src/hooks/useAvatar.ts
@@ -5,7 +5,7 @@ import type { TUser } from 'librechat-data-provider';
 
 const avatarCache: Record<string, string> = {};
 
-const useAvatar = (user: TUser | undefined) => {
+const useAvatar = (user: TUser | undefined): string => {
   return useMemo(() => {
     const { username, name } = user ?? {};
     const seed = name || username;
diff --git a/packages/client/src/hooks/useCombobox.ts b/packages/client/src/hooks/useCombobox.ts
index 3282f2b7e86..90eeb8b9ac7 100644
--- a/packages/client/src/hooks/useCombobox.ts
+++ b/packages/client/src/hooks/useCombobox.ts
@@ -1,4 +1,4 @@
-import { useMemo, useState } from 'react';
+import { SetStateAction, Dispatch, useMemo, useState } from 'react';
 import { matchSorter } from 'match-sorter';
 import type { OptionWithIcon, MentionOption } from '~/common';
 
@@ -8,7 +8,13 @@ export default function useCombobox({
 }: {
   value: string;
   options: Array<OptionWithIcon | MentionOption>;
-}) {
+}): {
+  open: boolean;
+  setOpen: Dispatch<SetStateAction<boolean>>;
+  searchValue: string;
+  setSearchValue: Dispatch<SetStateAction<string>>;
+  matches: (OptionWithIcon | MentionOption)[];
+} {
   const [open, setOpen] = useState(false);
   const [searchValue, setSearchValue] = useState('');
 
diff --git a/packages/client/src/hooks/useDelayedRender.tsx b/packages/client/src/hooks/useDelayedRender.tsx
index 6524f47aed8..ddb14af2756 100644
--- a/packages/client/src/hooks/useDelayedRender.tsx
+++ b/packages/client/src/hooks/useDelayedRender.tsx
@@ -26,7 +26,7 @@ const useDelayedRender = (delay: number) => {
     };
   }, [delay, delayed]);
 
-  return (fn: () => ReactNode) => {
+  return (fn: () => ReactNode): ReactNode => {
     if (delayed && timerPromiseRef.current) {
       throw timerPromiseRef.current;
     }
diff --git a/packages/client/src/hooks/useLocalize.ts b/packages/client/src/hooks/useLocalize.ts
index cab3dd6547b..0035f53e83b 100644
--- a/packages/client/src/hooks/useLocalize.ts
+++ b/packages/client/src/hooks/useLocalize.ts
@@ -1,12 +1,11 @@
 import { useCallback } from 'react';
 import { TOptions } from 'i18next';
 import { useTranslation } from 'react-i18next';
-import { resources } from '~/locales/i18n';
 
-export type TranslationKeys = keyof typeof resources.en.translation;
+export type TranslationKeys = string;
 
 /** Language lifecycle is managed by the host app — do not add i18n.changeLanguage() calls here. */
-export default function useLocalize() {
+export default function useLocalize(): (phraseKey: TranslationKeys, options?: TOptions) => string {
   const { t } = useTranslation();
 
   return useCallback(
diff --git a/packages/client/src/hooks/useMediaQuery.tsx b/packages/client/src/hooks/useMediaQuery.tsx
index 74c6362b9a7..067474c9649 100644
--- a/packages/client/src/hooks/useMediaQuery.tsx
+++ b/packages/client/src/hooks/useMediaQuery.tsx
@@ -1,6 +1,6 @@
 import { useEffect, useState } from 'react';
 
-export default function useMediaQuery(query: string) {
+export default function useMediaQuery(query: string): boolean {
   const [matches, setMatches] = useState(false);
 
   useEffect(() => {
diff --git a/packages/client/src/hooks/useToast.ts b/packages/client/src/hooks/useToast.ts
index 9937c640dd3..fe9adf316e9 100644
--- a/packages/client/src/hooks/useToast.ts
+++ b/packages/client/src/hooks/useToast.ts
@@ -1,10 +1,14 @@
-import { useAtom } from 'jotai';
 import { useRef, useEffect } from 'react';
+import { useAtom } from 'jotai';
 import type { TShowToast } from '~/common';
-import { NotificationSeverity } from '~/common';
 import { toastState, type ToastState } from '~/store';
+import { NotificationSeverity } from '~/common';
 
-export default function useToast(showDelay = 100) {
+export default function useToast(showDelay = 100): {
+  toast: ToastState;
+  onOpenChange: (open: boolean) => void;
+  showToast: ({ message, severity, showIcon, duration, status }: TShowToast) => void;
+} {
   const [toast, setToast] = useAtom(toastState);
   const showTimerRef = useRef<number | null>(null);
   const hideTimerRef = useRef<number | null>(null);
@@ -26,7 +30,7 @@ export default function useToast(showDelay = 100) {
     showIcon = true,
     duration = 3000, // default duration for the toast to be visible
     status,
-  }: TShowToast) => {
+  }: TShowToast): void => {
     // Clear existing timeouts
     if (showTimerRef.current !== null) {
       clearTimeout(showTimerRef.current);
@@ -52,7 +56,7 @@ export default function useToast(showDelay = 100) {
 
   return {
     toast,
-    onOpenChange: (open: boolean) => setToast({ ...toast, open }),
+    onOpenChange: (open: boolean): void => setToast({ ...toast, open }),
     showToast,
   };
 }
diff --git a/packages/client/src/locales/i18n.ts b/packages/client/src/locales/i18n.ts
index f463723a4f2..42ec38b2eae 100644
--- a/packages/client/src/locales/i18n.ts
+++ b/packages/client/src/locales/i18n.ts
@@ -1,7 +1,10 @@
 import i18n from 'i18next';
 import { initReactI18next } from 'react-i18next';
 import LanguageDetector from 'i18next-browser-languagedetector';
-
+import translationZh_Hans from './zh-Hans/translation.json';
+import translationZh_Hant from './zh-Hant/translation.json';
+import translationPt_BR from './pt-BR/translation.json';
+import translationPt_PT from './pt-PT/translation.json';
 import translationEn from './en/translation.json';
 import translationAr from './ar/translation.json';
 import translationCa from './ca/translation.json';
@@ -14,8 +17,6 @@ import translationFa from './fa/translation.json';
 import translationFr from './fr/translation.json';
 import translationIt from './it/translation.json';
 import translationPl from './pl/translation.json';
-import translationPt_BR from './pt-BR/translation.json';
-import translationPt_PT from './pt-PT/translation.json';
 import translationRu from './ru/translation.json';
 import translationJa from './ja/translation.json';
 import translationKa from './ka/translation.json';
@@ -29,12 +30,185 @@ import translationId from './id/translation.json';
 import translationHe from './he/translation.json';
 import translationHu from './hu/translation.json';
 import translationFi from './fi/translation.json';
-import translationZh_Hans from './zh-Hans/translation.json';
-import translationZh_Hant from './zh-Hant/translation.json';
 
 export const defaultNS = 'translation';
 
-export const resources = {
+export const resources: {
+  readonly en: {
+    readonly translation: {
+      com_ui_cancel: string;
+      com_ui_no_options: string;
+      com_ui_delete_selected_items: string;
+      com_ui_filter_by: string;
+      com_ui_cancel_dialog: string;
+      com_ui_no_results_found: string;
+      com_ui_select_all: string;
+      com_ui_no_selection: string;
+      com_ui_confirm_bulk_delete: string;
+      com_ui_delete_success: string;
+      com_ui_retry: string;
+      com_ui_selected_count: string;
+      com_ui_data_table: string;
+      com_ui_no_data: string;
+      com_ui_delete_selected: string;
+      com_ui_search: string;
+      com_ui_search_table: string;
+      com_ui_search_table_description: string;
+      com_ui_data_table_scroll_area: string;
+      com_ui_select_row: string;
+      com_ui_loading_more_data: string;
+      com_ui_no_search_results: string;
+      com_ui_table_error: string;
+      com_ui_table_error_description: string;
+      com_ui_error_details: string;
+      com_ui_enabled: string;
+      com_ui_disabled: string;
+      com_ui_toggle_theme: string;
+      com_ui_dark_theme_enabled: string;
+      com_ui_light_theme_enabled: string;
+    };
+  };
+  readonly ar: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly ca: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly cs: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly 'zh-Hans': {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly 'zh-Hant': {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly da: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly de: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly es: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly et: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly fa: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly fr: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly it: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly pl: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly 'pt-BR': {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly 'pt-PT': {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly ru: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly ja: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly ka: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly sv: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly ko: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly th: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly tr: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly vi: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly nl: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly id: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly he: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly hu: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+  readonly fi: {
+    readonly translation: {
+      com_ui_cancel: string;
+    };
+  };
+} = {
   en: { translation: translationEn },
   ar: { translation: translationAr },
   ca: { translation: translationCa },
diff --git a/packages/client/src/store.ts b/packages/client/src/store.ts
index 36a3f05844c..9b1d49e22aa 100644
--- a/packages/client/src/store.ts
+++ b/packages/client/src/store.ts
@@ -1,8 +1,12 @@
-import { atom } from 'jotai';
+import { atom, PrimitiveAtom } from 'jotai';
 import { NotificationSeverity } from '~/common';
 
-export const chatDirectionAtom = atom<string>('ltr');
-export const fontSizeAtom = atom<string>('text-base');
+export const chatDirectionAtom: PrimitiveAtom<string> & {
+  init: string;
+} = atom<string>('ltr');
+export const fontSizeAtom: PrimitiveAtom<string> & {
+  init: string;
+} = atom<string>('text-base');
 
 export type ToastState = {
   open: boolean;
@@ -11,7 +15,9 @@ export type ToastState = {
   showIcon: boolean;
 };
 
-export const toastState = atom<ToastState>({
+export const toastState: PrimitiveAtom<ToastState> & {
+  init: ToastState;
+} = atom<ToastState>({
   open: false,
   message: '',
   severity: NotificationSeverity.SUCCESS,
diff --git a/packages/client/src/svgs/AnthropicIcon.tsx b/packages/client/src/svgs/AnthropicIcon.tsx
index d634bd01183..fee9b793334 100644
--- a/packages/client/src/svgs/AnthropicIcon.tsx
+++ b/packages/client/src/svgs/AnthropicIcon.tsx
@@ -1,3 +1,4 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
 export default function AnthropicIcon({
   size = 25,
@@ -5,7 +6,7 @@ export default function AnthropicIcon({
 }: {
   size?: number;
   className?: string;
-}) {
+}): JSX.Element {
   return (
     <svg
       viewBox="0 0 24 16"
diff --git a/packages/client/src/svgs/AnthropicMinimalIcon.tsx b/packages/client/src/svgs/AnthropicMinimalIcon.tsx
index dea61ef6cae..d50d77d4ad1 100644
--- a/packages/client/src/svgs/AnthropicMinimalIcon.tsx
+++ b/packages/client/src/svgs/AnthropicMinimalIcon.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
-export default function AnthropicMinimalIcon() {
+export default function AnthropicMinimalIcon(): JSX.Element {
   return (
     <svg
       stroke="currentColor"
diff --git a/packages/client/src/svgs/AppleIcon.tsx b/packages/client/src/svgs/AppleIcon.tsx
index 9994ca5f88b..bffdf3f52ad 100644
--- a/packages/client/src/svgs/AppleIcon.tsx
+++ b/packages/client/src/svgs/AppleIcon.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
-export default function AppleIcon() {
+export default function AppleIcon(): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/ArchiveIcon.tsx b/packages/client/src/svgs/ArchiveIcon.tsx
index cf85d69cc55..a6e76de6905 100644
--- a/packages/client/src/svgs/ArchiveIcon.tsx
+++ b/packages/client/src/svgs/ArchiveIcon.tsx
@@ -1,4 +1,10 @@
-export default function ArchiveIcon({ className = 'icon-md' }) {
+import { JSX } from 'react/jsx-runtime';
+
+export default function ArchiveIcon({
+  className = 'icon-md',
+}: {
+  className?: string | undefined;
+}): JSX.Element {
   return (
     <svg
       width="18"
diff --git a/packages/client/src/svgs/AssistantIcon.tsx b/packages/client/src/svgs/AssistantIcon.tsx
index 05233817f18..c8514f3f2aa 100644
--- a/packages/client/src/svgs/AssistantIcon.tsx
+++ b/packages/client/src/svgs/AssistantIcon.tsx
@@ -1,3 +1,4 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
 
 export default function AssistantIcon({
@@ -6,7 +7,7 @@ export default function AssistantIcon({
 }: {
   className?: string;
   size?: string | number;
-}) {
+}): JSX.Element {
   const unit = 24;
   const height = size;
   const width = size;
diff --git a/packages/client/src/svgs/AttachmentIcon.tsx b/packages/client/src/svgs/AttachmentIcon.tsx
index 51aa489d7ed..2a6035bacbf 100644
--- a/packages/client/src/svgs/AttachmentIcon.tsx
+++ b/packages/client/src/svgs/AttachmentIcon.tsx
@@ -1,4 +1,10 @@
-export default function AttachmentIcon({ className = '' }) {
+import { JSX } from 'react/jsx-runtime';
+
+export default function AttachmentIcon({
+  className = '',
+}: {
+  className?: string | undefined;
+}): JSX.Element {
   return (
     <svg
       width="24"
diff --git a/packages/client/src/svgs/AudioPaths.tsx b/packages/client/src/svgs/AudioPaths.tsx
index 874f54328d3..51d2569efce 100644
--- a/packages/client/src/svgs/AudioPaths.tsx
+++ b/packages/client/src/svgs/AudioPaths.tsx
@@ -1,4 +1,6 @@
-export default function AudioPaths() {
+import { JSX } from 'react/jsx-runtime';
+
+export default function AudioPaths(): JSX.Element {
   return (
     <>
       <path
diff --git a/packages/client/src/svgs/AzureMinimalIcon.tsx b/packages/client/src/svgs/AzureMinimalIcon.tsx
index e51d7aca321..a3ba7af85cf 100644
--- a/packages/client/src/svgs/AzureMinimalIcon.tsx
+++ b/packages/client/src/svgs/AzureMinimalIcon.tsx
@@ -1,3 +1,4 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils/';
 
 export default function AzureMinimalIcon({
@@ -6,7 +7,7 @@ export default function AzureMinimalIcon({
 }: {
   size?: number;
   className?: string;
-}) {
+}): JSX.Element {
   const height = size;
   const width = size;
 
diff --git a/packages/client/src/svgs/BedrockIcon.tsx b/packages/client/src/svgs/BedrockIcon.tsx
index ec69f3c4e09..bb6efd63d94 100644
--- a/packages/client/src/svgs/BedrockIcon.tsx
+++ b/packages/client/src/svgs/BedrockIcon.tsx
@@ -1,3 +1,4 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
 
 export default function BedrockIcon({
@@ -6,7 +7,7 @@ export default function BedrockIcon({
 }: {
   size?: number;
   className?: string;
-}) {
+}): JSX.Element {
   return (
     <svg
       width={size}
diff --git a/packages/client/src/svgs/BirthdayIcon.tsx b/packages/client/src/svgs/BirthdayIcon.tsx
index b0567778bd7..0566894178f 100644
--- a/packages/client/src/svgs/BirthdayIcon.tsx
+++ b/packages/client/src/svgs/BirthdayIcon.tsx
@@ -1,7 +1,12 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils/';
 
-export default function BirthdayIcon({ className = '' }) {
+export default function BirthdayIcon({
+  className = '',
+}: {
+  className?: string | undefined;
+}): JSX.Element {
   return (
     <svg
       version="1.1"
diff --git a/packages/client/src/svgs/Blocks.tsx b/packages/client/src/svgs/Blocks.tsx
index 6c3aab213b9..000ef3305d2 100644
--- a/packages/client/src/svgs/Blocks.tsx
+++ b/packages/client/src/svgs/Blocks.tsx
@@ -1,5 +1,6 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
-export default function Blocks({ className = '' }: { className?: string }) {
+export default function Blocks({ className = '' }: { className?: string }): JSX.Element {
   return (
     <svg
       width="24"
diff --git a/packages/client/src/svgs/CautionIcon.tsx b/packages/client/src/svgs/CautionIcon.tsx
index b8adae79a3c..97372c33da7 100644
--- a/packages/client/src/svgs/CautionIcon.tsx
+++ b/packages/client/src/svgs/CautionIcon.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
-export default function CautionIcon() {
+export default function CautionIcon(): JSX.Element {
   return (
     <svg
       stroke="currentColor"
diff --git a/packages/client/src/svgs/ChatGPTMinimalIcon.tsx b/packages/client/src/svgs/ChatGPTMinimalIcon.tsx
index 80d7c862bcd..3c28e715ac7 100644
--- a/packages/client/src/svgs/ChatGPTMinimalIcon.tsx
+++ b/packages/client/src/svgs/ChatGPTMinimalIcon.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
-export default function ChatGPTMinimalIcon() {
+export default function ChatGPTMinimalIcon(): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/ChatIcon.tsx b/packages/client/src/svgs/ChatIcon.tsx
index de14015d480..1f275e96023 100644
--- a/packages/client/src/svgs/ChatIcon.tsx
+++ b/packages/client/src/svgs/ChatIcon.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
-export default function ChatIcon() {
+export default function ChatIcon(): JSX.Element {
   return (
     <svg
       stroke="currentColor"
diff --git a/packages/client/src/svgs/CheckMark.tsx b/packages/client/src/svgs/CheckMark.tsx
index 75921475b77..144f326c821 100644
--- a/packages/client/src/svgs/CheckMark.tsx
+++ b/packages/client/src/svgs/CheckMark.tsx
@@ -1,6 +1,7 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
 
-export default function CheckMark({ className = '' }: { className?: string }) {
+export default function CheckMark({ className = '' }: { className?: string }): JSX.Element {
   return (
     <svg
       fill="none"
diff --git a/packages/client/src/svgs/CircleHelpIcon.tsx b/packages/client/src/svgs/CircleHelpIcon.tsx
index 1f0265b50d7..296c4ea3790 100644
--- a/packages/client/src/svgs/CircleHelpIcon.tsx
+++ b/packages/client/src/svgs/CircleHelpIcon.tsx
@@ -1,6 +1,13 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils/';
 
-export default function CircleHelpIcon({ className = 'icon-md-heavy', size = '1em' }) {
+export default function CircleHelpIcon({
+  className = 'icon-md-heavy',
+  size = '1em',
+}: {
+  className?: string | undefined;
+  size?: string | undefined;
+}): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/Clipboard.tsx b/packages/client/src/svgs/Clipboard.tsx
index a7c1fda81ab..d68b13244c0 100644
--- a/packages/client/src/svgs/Clipboard.tsx
+++ b/packages/client/src/svgs/Clipboard.tsx
@@ -1,6 +1,13 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils/';
 
-export default function Clipboard({ className = 'icon-md-heavy', size = '1em' }) {
+export default function Clipboard({
+  className = 'icon-md-heavy',
+  size = '1em',
+}: {
+  className?: string | undefined;
+  size?: string | undefined;
+}): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/CodePaths.tsx b/packages/client/src/svgs/CodePaths.tsx
index adddb42ec32..aec617275c4 100644
--- a/packages/client/src/svgs/CodePaths.tsx
+++ b/packages/client/src/svgs/CodePaths.tsx
@@ -1,4 +1,6 @@
-export default function CodePaths() {
+import { JSX } from 'react/jsx-runtime';
+
+export default function CodePaths(): JSX.Element {
   return (
     <>
       <path
diff --git a/packages/client/src/svgs/CodeyIcon.tsx b/packages/client/src/svgs/CodeyIcon.tsx
index 1a40cfe647f..286170d456b 100644
--- a/packages/client/src/svgs/CodeyIcon.tsx
+++ b/packages/client/src/svgs/CodeyIcon.tsx
@@ -1,3 +1,4 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
 export default function CodeyIcon({
   size = 25,
@@ -5,7 +6,7 @@ export default function CodeyIcon({
 }: {
   size?: number;
   className?: string;
-}) {
+}): JSX.Element {
   return (
     <svg
       // width="100%"
diff --git a/packages/client/src/svgs/ContinueIcon.tsx b/packages/client/src/svgs/ContinueIcon.tsx
index b4dcd5c7e19..69181cc579c 100644
--- a/packages/client/src/svgs/ContinueIcon.tsx
+++ b/packages/client/src/svgs/ContinueIcon.tsx
@@ -1,6 +1,7 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
 
-export default function ContinueIcon({ className = '' }: { className?: string }) {
+export default function ContinueIcon({ className = '' }: { className?: string }): JSX.Element {
   return (
     <svg
       stroke="currentColor"
diff --git a/packages/client/src/svgs/ConvoIcon.tsx b/packages/client/src/svgs/ConvoIcon.tsx
index edd9fd4148f..cf3dd314ac2 100644
--- a/packages/client/src/svgs/ConvoIcon.tsx
+++ b/packages/client/src/svgs/ConvoIcon.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
-export default function ConvoIcon() {
+export default function ConvoIcon(): JSX.Element {
   return (
     <svg
       data-testid="convo-icon"
diff --git a/packages/client/src/svgs/CrossIcon.tsx b/packages/client/src/svgs/CrossIcon.tsx
index 635f2c7cc00..b52b65d03b2 100644
--- a/packages/client/src/svgs/CrossIcon.tsx
+++ b/packages/client/src/svgs/CrossIcon.tsx
@@ -1,7 +1,12 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils/';
 
-export default function CrossIcon({ className = '' }) {
+export default function CrossIcon({
+  className = '',
+}: {
+  className?: string | undefined;
+}): JSX.Element {
   return (
     <svg
       stroke="currentColor"
diff --git a/packages/client/src/svgs/CustomMinimalIcon.tsx b/packages/client/src/svgs/CustomMinimalIcon.tsx
index dabe8f62005..85d3fb3f1dd 100644
--- a/packages/client/src/svgs/CustomMinimalIcon.tsx
+++ b/packages/client/src/svgs/CustomMinimalIcon.tsx
@@ -1,3 +1,4 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
 export default function CustomMinimalIcon({
   size = 25,
@@ -5,7 +6,7 @@ export default function CustomMinimalIcon({
 }: {
   size?: number;
   className?: string;
-}) {
+}): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/DarkModeIcon.tsx b/packages/client/src/svgs/DarkModeIcon.tsx
index 3b91f0842a9..3575aecd2e4 100644
--- a/packages/client/src/svgs/DarkModeIcon.tsx
+++ b/packages/client/src/svgs/DarkModeIcon.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
-export default function DarkModeIcon() {
+export default function DarkModeIcon(): JSX.Element {
   return (
     <svg
       stroke="currentColor"
diff --git a/packages/client/src/svgs/DataIcon.tsx b/packages/client/src/svgs/DataIcon.tsx
index 92a445b96e1..935473b6ffa 100644
--- a/packages/client/src/svgs/DataIcon.tsx
+++ b/packages/client/src/svgs/DataIcon.tsx
@@ -1,4 +1,6 @@
-export default function DataIcon({ className = 'icon-sm' }: { className?: string }) {
+import { JSX } from 'react/jsx-runtime';
+
+export default function DataIcon({ className = 'icon-sm' }: { className?: string }): JSX.Element {
   return (
     <svg
       width="18"
diff --git a/packages/client/src/svgs/DiscordIcon.tsx b/packages/client/src/svgs/DiscordIcon.tsx
index af4ae0f12f3..09cab0d68d4 100644
--- a/packages/client/src/svgs/DiscordIcon.tsx
+++ b/packages/client/src/svgs/DiscordIcon.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
-export default function DiscordIcon() {
+export default function DiscordIcon(): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/DislikeIcon.tsx b/packages/client/src/svgs/DislikeIcon.tsx
index 40a23ad0ea7..589b4cec12b 100644
--- a/packages/client/src/svgs/DislikeIcon.tsx
+++ b/packages/client/src/svgs/DislikeIcon.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
-export default function DislikeIcon() {
+export default function DislikeIcon(): JSX.Element {
   return (
     <svg
       stroke="currentColor"
diff --git a/packages/client/src/svgs/DotsIcon.tsx b/packages/client/src/svgs/DotsIcon.tsx
index b0f9f00da0e..854e1448bbe 100644
--- a/packages/client/src/svgs/DotsIcon.tsx
+++ b/packages/client/src/svgs/DotsIcon.tsx
@@ -1,10 +1,11 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
 export default function DotsIcon({
   className = 'h-4 w-4 flex-shrink-0 text-gray-500',
 }: {
   className?: string;
-}) {
+}): JSX.Element {
   return (
     <svg
       stroke="currentColor"
diff --git a/packages/client/src/svgs/EditIcon.tsx b/packages/client/src/svgs/EditIcon.tsx
index ae28655633e..2f75243e8f5 100644
--- a/packages/client/src/svgs/EditIcon.tsx
+++ b/packages/client/src/svgs/EditIcon.tsx
@@ -6,30 +6,31 @@ type IconProps = {
   size?: string;
 };
 
-const EditIcon = React.forwardRef<SVGSVGElement, IconProps>((props: IconProps, ref) => {
-  const { className = 'icon-md', size = '1.2em' } = props;
-  return (
-    <svg
-      ref={ref}
-      fill="none"
-      strokeWidth="2"
-      xmlns="http://www.w3.org/2000/svg"
-      viewBox="0 0 24 24"
-      strokeLinecap="round"
-      strokeLinejoin="round"
-      height={size}
-      width={size}
-      className={cn(className)}
-      aria-hidden="true"
-    >
-      <path
-        fillRule="evenodd"
-        clipRule="evenodd"
-        d="M13.2929 4.29291C15.0641 2.52167 17.9359 2.52167 19.7071 4.2929C21.4783 6.06414 21.4783 8.93588 19.7071 10.7071L18.7073 11.7069L11.1603 19.2539C10.7182 19.696 10.1489 19.989 9.53219 20.0918L4.1644 20.9864C3.84584 21.0395 3.52125 20.9355 3.29289 20.7071C3.06453 20.4788 2.96051 20.1542 3.0136 19.8356L3.90824 14.4678C4.01103 13.8511 4.30396 13.2818 4.7461 12.8397L13.2929 4.29291ZM13 7.41422L6.16031 14.2539C6.01293 14.4013 5.91529 14.591 5.88102 14.7966L5.21655 18.7835L9.20339 18.119C9.40898 18.0847 9.59872 17.9871 9.7461 17.8397L16.5858 11L13 7.41422ZM18 9.5858L14.4142 6.00001L14.7071 5.70712C15.6973 4.71693 17.3027 4.71693 18.2929 5.70712C19.2831 6.69731 19.2831 8.30272 18.2929 9.29291L18 9.5858Z"
-        fill="currentColor"
-      ></path>
-    </svg>
-  );
-});
+const EditIcon: React.ForwardRefExoticComponent<IconProps & React.RefAttributes<SVGSVGElement>> =
+  React.forwardRef<SVGSVGElement, IconProps>((props: IconProps, ref) => {
+    const { className = 'icon-md', size = '1.2em' } = props;
+    return (
+      <svg
+        ref={ref}
+        fill="none"
+        strokeWidth="2"
+        xmlns="http://www.w3.org/2000/svg"
+        viewBox="0 0 24 24"
+        strokeLinecap="round"
+        strokeLinejoin="round"
+        height={size}
+        width={size}
+        className={cn(className)}
+        aria-hidden="true"
+      >
+        <path
+          fillRule="evenodd"
+          clipRule="evenodd"
+          d="M13.2929 4.29291C15.0641 2.52167 17.9359 2.52167 19.7071 4.2929C21.4783 6.06414 21.4783 8.93588 19.7071 10.7071L18.7073 11.7069L11.1603 19.2539C10.7182 19.696 10.1489 19.989 9.53219 20.0918L4.1644 20.9864C3.84584 21.0395 3.52125 20.9355 3.29289 20.7071C3.06453 20.4788 2.96051 20.1542 3.0136 19.8356L3.90824 14.4678C4.01103 13.8511 4.30396 13.2818 4.7461 12.8397L13.2929 4.29291ZM13 7.41422L6.16031 14.2539C6.01293 14.4013 5.91529 14.591 5.88102 14.7966L5.21655 18.7835L9.20339 18.119C9.40898 18.0847 9.59872 17.9871 9.7461 17.8397L16.5858 11L13 7.41422ZM18 9.5858L14.4142 6.00001L14.7071 5.70712C15.6973 4.71693 17.3027 4.71693 18.2929 5.70712C19.2831 6.69731 19.2831 8.30272 18.2929 9.29291L18 9.5858Z"
+          fill="currentColor"
+        ></path>
+      </svg>
+    );
+  });
 
 export default EditIcon;
diff --git a/packages/client/src/svgs/ExperimentIcon.tsx b/packages/client/src/svgs/ExperimentIcon.tsx
index 476e925ff44..212d90b6a09 100644
--- a/packages/client/src/svgs/ExperimentIcon.tsx
+++ b/packages/client/src/svgs/ExperimentIcon.tsx
@@ -1,4 +1,6 @@
-export default function ExperimentIcon() {
+import { JSX } from 'react/jsx-runtime';
+
+export default function ExperimentIcon(): JSX.Element {
   return (
     <svg
       width="24"
diff --git a/packages/client/src/svgs/FacebookIcon.tsx b/packages/client/src/svgs/FacebookIcon.tsx
index 54680776a69..b77c6378787 100644
--- a/packages/client/src/svgs/FacebookIcon.tsx
+++ b/packages/client/src/svgs/FacebookIcon.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
-export default function FacebookIcon() {
+export default function FacebookIcon(): JSX.Element {
   return (
     <svg viewBox="0 0 40 40" width="25" height="25" aria-hidden="true">
       <linearGradient
diff --git a/packages/client/src/svgs/FileIcon.tsx b/packages/client/src/svgs/FileIcon.tsx
index b02976bbf45..3baf630374a 100644
--- a/packages/client/src/svgs/FileIcon.tsx
+++ b/packages/client/src/svgs/FileIcon.tsx
@@ -1,3 +1,4 @@
+import { JSX } from 'react/jsx-runtime';
 import type { TFile } from 'librechat-data-provider';
 
 export default function FileIcon({
@@ -10,7 +11,7 @@ export default function FileIcon({
     paths: React.FC;
     title: string;
   };
-}) {
+}): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/FilePaths.tsx b/packages/client/src/svgs/FilePaths.tsx
index 29341ebeb92..94de953a58a 100644
--- a/packages/client/src/svgs/FilePaths.tsx
+++ b/packages/client/src/svgs/FilePaths.tsx
@@ -1,4 +1,6 @@
-export default function FilePaths() {
+import { JSX } from 'react/jsx-runtime';
+
+export default function FilePaths(): JSX.Element {
   return (
     <>
       <path
diff --git a/packages/client/src/svgs/GPTIcon.tsx b/packages/client/src/svgs/GPTIcon.tsx
index 477882be6e9..7c343eddd93 100644
--- a/packages/client/src/svgs/GPTIcon.tsx
+++ b/packages/client/src/svgs/GPTIcon.tsx
@@ -1,3 +1,4 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils/';
 
 export default function GPTIcon({
@@ -6,7 +7,7 @@ export default function GPTIcon({
 }: {
   size?: number;
   className?: string;
-}) {
+}): JSX.Element {
   const unit = '41';
   const height = size;
   const width = size;
diff --git a/packages/client/src/svgs/GeminiIcon.tsx b/packages/client/src/svgs/GeminiIcon.tsx
index 4835e6e58f3..0e50a0a81d8 100644
--- a/packages/client/src/svgs/GeminiIcon.tsx
+++ b/packages/client/src/svgs/GeminiIcon.tsx
@@ -1,10 +1,12 @@
+import { JSX } from 'react/jsx-runtime';
+
 export default function GeminiIcon({
   size = 25,
   className = '',
 }: {
   size?: number;
   className?: string;
-}) {
+}): JSX.Element {
   return (
     <svg
       width={size}
diff --git a/packages/client/src/svgs/GithubIcon.tsx b/packages/client/src/svgs/GithubIcon.tsx
index 089692a7702..e637d3ad3cf 100644
--- a/packages/client/src/svgs/GithubIcon.tsx
+++ b/packages/client/src/svgs/GithubIcon.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
-export default function GithubIcon() {
+export default function GithubIcon(): JSX.Element {
   return (
     <svg xmlns="http://www.w3.org/2000/svg" width="25" height="25" fill="none" aria-hidden="true">
       <path
diff --git a/packages/client/src/svgs/GoogleIcon.tsx b/packages/client/src/svgs/GoogleIcon.tsx
index 0dcafc29422..306435700fd 100644
--- a/packages/client/src/svgs/GoogleIcon.tsx
+++ b/packages/client/src/svgs/GoogleIcon.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
-export default function GoogleIcon() {
+export default function GoogleIcon(): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/GoogleIconChat.tsx b/packages/client/src/svgs/GoogleIconChat.tsx
index 5e4da789e7e..0ec7a741a4d 100644
--- a/packages/client/src/svgs/GoogleIconChat.tsx
+++ b/packages/client/src/svgs/GoogleIconChat.tsx
@@ -1,15 +1,12 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils/';
 
 export default function Google({
-  size = 25,
   className = '',
 }: {
   size?: number;
   className?: string;
-}) {
-  const unit = '41';
-  const height = size;
-  const width = size;
+}): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/GoogleMinimalIcon.tsx b/packages/client/src/svgs/GoogleMinimalIcon.tsx
index 9c7e3aad3e1..26aba74fe37 100644
--- a/packages/client/src/svgs/GoogleMinimalIcon.tsx
+++ b/packages/client/src/svgs/GoogleMinimalIcon.tsx
@@ -1,5 +1,6 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
-export default function GoogleMinimalIcon({ className = '' }: { className?: string }) {
+export default function GoogleMinimalIcon({ className = '' }: { className?: string }): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/LightModeIcon.tsx b/packages/client/src/svgs/LightModeIcon.tsx
index ab58472a006..f3c6031a007 100644
--- a/packages/client/src/svgs/LightModeIcon.tsx
+++ b/packages/client/src/svgs/LightModeIcon.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
-export default function LightModeIcon() {
+export default function LightModeIcon(): JSX.Element {
   return (
     <svg
       stroke="currentColor"
diff --git a/packages/client/src/svgs/LightningIcon.tsx b/packages/client/src/svgs/LightningIcon.tsx
index a9b7b633bf7..ee7880c9cbe 100644
--- a/packages/client/src/svgs/LightningIcon.tsx
+++ b/packages/client/src/svgs/LightningIcon.tsx
@@ -1,6 +1,11 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
 
-export default function LightningIcon({ className = '' }) {
+export default function LightningIcon({
+  className = '',
+}: {
+  className?: string | undefined;
+}): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/LikeIcon.tsx b/packages/client/src/svgs/LikeIcon.tsx
index 8e3b7ba5bfc..a430fc5e584 100644
--- a/packages/client/src/svgs/LikeIcon.tsx
+++ b/packages/client/src/svgs/LikeIcon.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
-export default function LikeIcon() {
+export default function LikeIcon(): JSX.Element {
   return (
     <svg
       stroke="currentColor"
diff --git a/packages/client/src/svgs/LinkIcon.tsx b/packages/client/src/svgs/LinkIcon.tsx
index 79935df032f..30f1039a7a2 100644
--- a/packages/client/src/svgs/LinkIcon.tsx
+++ b/packages/client/src/svgs/LinkIcon.tsx
@@ -1,4 +1,6 @@
-export default function LinkIcon() {
+import { JSX } from 'react/jsx-runtime';
+
+export default function LinkIcon(): JSX.Element {
   return (
     <svg
       width="18"
diff --git a/packages/client/src/svgs/ListeningIcon.tsx b/packages/client/src/svgs/ListeningIcon.tsx
index 1bdc7fb8941..074a2c6e298 100644
--- a/packages/client/src/svgs/ListeningIcon.tsx
+++ b/packages/client/src/svgs/ListeningIcon.tsx
@@ -1,10 +1,11 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils/';
 
 type ListeningIconProps = {
   className?: string;
 };
 
-export default function ListeningIcon({ className }: ListeningIconProps) {
+export default function ListeningIcon({ className }: ListeningIconProps): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/LockIcon.tsx b/packages/client/src/svgs/LockIcon.tsx
index efcf5052883..3ac81a38168 100644
--- a/packages/client/src/svgs/LockIcon.tsx
+++ b/packages/client/src/svgs/LockIcon.tsx
@@ -1,4 +1,6 @@
-export default function LockIcon() {
+import { JSX } from 'react/jsx-runtime';
+
+export default function LockIcon(): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/LogOutIcon.tsx b/packages/client/src/svgs/LogOutIcon.tsx
index 754ea10a774..de5a5eb299f 100644
--- a/packages/client/src/svgs/LogOutIcon.tsx
+++ b/packages/client/src/svgs/LogOutIcon.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
-export default function LogOutIcon() {
+export default function LogOutIcon(): JSX.Element {
   return (
     <svg
       width="18"
diff --git a/packages/client/src/svgs/MCPIcon.tsx b/packages/client/src/svgs/MCPIcon.tsx
index f5db9df9409..558b75508c1 100644
--- a/packages/client/src/svgs/MCPIcon.tsx
+++ b/packages/client/src/svgs/MCPIcon.tsx
@@ -1,4 +1,6 @@
-export default function MCPIcon({ className }: { className?: string }) {
+import { JSX } from 'react/jsx-runtime';
+
+export default function MCPIcon({ className }: { className?: string }): JSX.Element {
   return (
     <svg
       width="195"
diff --git a/packages/client/src/svgs/MessagesSquared.tsx b/packages/client/src/svgs/MessagesSquared.tsx
index 58582d0e4fa..939d355481f 100644
--- a/packages/client/src/svgs/MessagesSquared.tsx
+++ b/packages/client/src/svgs/MessagesSquared.tsx
@@ -1,6 +1,7 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils/';
 
-export default function MessagesSquared({ className }: { className?: string }) {
+export default function MessagesSquared({ className }: { className?: string }): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/MinimalPlugin.tsx b/packages/client/src/svgs/MinimalPlugin.tsx
index d38a3180e0f..ef9b712f82b 100644
--- a/packages/client/src/svgs/MinimalPlugin.tsx
+++ b/packages/client/src/svgs/MinimalPlugin.tsx
@@ -1,10 +1,12 @@
+import { JSX } from 'react/jsx-runtime';
+
 export default function MinimalPlugin({
   size,
   className = 'icon-md',
 }: {
   size?: number;
   className?: string;
-}) {
+}): JSX.Element {
   return (
     <svg
       width={size}
diff --git a/packages/client/src/svgs/MobileSidebar.tsx b/packages/client/src/svgs/MobileSidebar.tsx
index 999de0b91c4..a9e4e0703d7 100644
--- a/packages/client/src/svgs/MobileSidebar.tsx
+++ b/packages/client/src/svgs/MobileSidebar.tsx
@@ -1,4 +1,6 @@
-export default function MobileSidebar({ className }: { className?: string }) {
+import { JSX } from 'react/jsx-runtime';
+
+export default function MobileSidebar({ className }: { className?: string }): JSX.Element {
   return (
     <svg
       width="24"
diff --git a/packages/client/src/svgs/MoonshotIcon.tsx b/packages/client/src/svgs/MoonshotIcon.tsx
index 599de9f058e..821174e5ac8 100644
--- a/packages/client/src/svgs/MoonshotIcon.tsx
+++ b/packages/client/src/svgs/MoonshotIcon.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
-export default function MoonshotIcon({ className = '' }: { className?: string }) {
+export default function MoonshotIcon({ className = '' }: { className?: string }): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/NewChatIcon.tsx b/packages/client/src/svgs/NewChatIcon.tsx
index 20ae52863dd..ac0a2537b4e 100644
--- a/packages/client/src/svgs/NewChatIcon.tsx
+++ b/packages/client/src/svgs/NewChatIcon.tsx
@@ -1,5 +1,6 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
-export default function NewChatIcon({ className = '' }: { className?: string }) {
+export default function NewChatIcon({ className = '' }: { className?: string }): JSX.Element {
   return (
     <svg
       width="16"
diff --git a/packages/client/src/svgs/OpenAIMinimalIcon.tsx b/packages/client/src/svgs/OpenAIMinimalIcon.tsx
index 36dd2bc5173..ecb8f8e1672 100644
--- a/packages/client/src/svgs/OpenAIMinimalIcon.tsx
+++ b/packages/client/src/svgs/OpenAIMinimalIcon.tsx
@@ -1,4 +1,10 @@
-export default function OpenAIMinimalIcon({ className = 'h-4 w-4' }) {
+import { JSX } from 'react/jsx-runtime';
+
+export default function OpenAIMinimalIcon({
+  className = 'h-4 w-4',
+}: {
+  className?: string | undefined;
+}): JSX.Element {
   return (
     <svg
       stroke="currentColor"
diff --git a/packages/client/src/svgs/OpenIDIcon.tsx b/packages/client/src/svgs/OpenIDIcon.tsx
index 88702c19d0a..aaae6b58529 100644
--- a/packages/client/src/svgs/OpenIDIcon.tsx
+++ b/packages/client/src/svgs/OpenIDIcon.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
-export default function OpenIDIcon() {
+export default function OpenIDIcon(): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/PaLMIcon.tsx b/packages/client/src/svgs/PaLMIcon.tsx
index 90358c4ba7d..5d58b101c08 100644
--- a/packages/client/src/svgs/PaLMIcon.tsx
+++ b/packages/client/src/svgs/PaLMIcon.tsx
@@ -1,10 +1,12 @@
+import { JSX } from 'react/jsx-runtime';
+
 export default function PaLMIcon({
   size = 25,
   className = '',
 }: {
   size?: number;
   className?: string;
-}) {
+}): JSX.Element {
   return (
     <svg
       // width="100%"
diff --git a/packages/client/src/svgs/PaLMinimalIcon.tsx b/packages/client/src/svgs/PaLMinimalIcon.tsx
index 5cfb9091679..e236ef7d68f 100644
--- a/packages/client/src/svgs/PaLMinimalIcon.tsx
+++ b/packages/client/src/svgs/PaLMinimalIcon.tsx
@@ -1,5 +1,6 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
-export default function PaLMinimalIcon({ className = '' }: { className?: string }) {
+export default function PaLMinimalIcon({ className = '' }: { className?: string }): JSX.Element {
   return (
     <svg
       stroke="currentColor"
diff --git a/packages/client/src/svgs/PersonalizationIcon.tsx b/packages/client/src/svgs/PersonalizationIcon.tsx
index a40dcbc86ad..54f8914bc34 100644
--- a/packages/client/src/svgs/PersonalizationIcon.tsx
+++ b/packages/client/src/svgs/PersonalizationIcon.tsx
@@ -1,4 +1,10 @@
-export default function PersonalizationIcon({ className = '' }: { className?: string }) {
+import { JSX } from 'react/jsx-runtime';
+
+export default function PersonalizationIcon({
+  className = '',
+}: {
+  className?: string;
+}): JSX.Element {
   return (
     <svg
       width="24"
diff --git a/packages/client/src/svgs/PinIcon.tsx b/packages/client/src/svgs/PinIcon.tsx
index 322268e5082..458ea8814cb 100644
--- a/packages/client/src/svgs/PinIcon.tsx
+++ b/packages/client/src/svgs/PinIcon.tsx
@@ -1,4 +1,6 @@
-export default function PinIcon({ unpin = false }: { unpin?: boolean }) {
+import { JSX } from 'react/jsx-runtime';
+
+export default function PinIcon({ unpin = false }: { unpin?: boolean }): JSX.Element {
   if (unpin) {
     return (
       <svg
diff --git a/packages/client/src/svgs/Plugin.tsx b/packages/client/src/svgs/Plugin.tsx
index 37fdea05c85..ab0f55a00ee 100644
--- a/packages/client/src/svgs/Plugin.tsx
+++ b/packages/client/src/svgs/Plugin.tsx
@@ -1,6 +1,8 @@
+import { JSX } from 'react/jsx-runtime';
+import type { SVGProps } from 'react';
 import { cn } from '~/utils/';
 
-export default function Plugin({ className = '', ...props }) {
+export default function Plugin({ className = '', ...props }: SVGProps<SVGSVGElement>): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/RegenerateIcon.tsx b/packages/client/src/svgs/RegenerateIcon.tsx
index d7ca1cbbe48..078ec217988 100644
--- a/packages/client/src/svgs/RegenerateIcon.tsx
+++ b/packages/client/src/svgs/RegenerateIcon.tsx
@@ -1,6 +1,13 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
 
-export default function RegenerateIcon({ className = '', size = '1em' }) {
+export default function RegenerateIcon({
+  className = '',
+  size = '1em',
+}: {
+  className?: string | undefined;
+  size?: string | undefined;
+}): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/RenameIcon.tsx b/packages/client/src/svgs/RenameIcon.tsx
index 4dc5f7cfed3..4fd2d051184 100644
--- a/packages/client/src/svgs/RenameIcon.tsx
+++ b/packages/client/src/svgs/RenameIcon.tsx
@@ -1,4 +1,6 @@
-export default function RenameIcon() {
+import { JSX } from 'react/jsx-runtime';
+
+export default function RenameIcon(): JSX.Element {
   return (
     <svg
       fill="none"
diff --git a/packages/client/src/svgs/SamlIcon.tsx b/packages/client/src/svgs/SamlIcon.tsx
index eac9c9d7d57..7cee28801c4 100644
--- a/packages/client/src/svgs/SamlIcon.tsx
+++ b/packages/client/src/svgs/SamlIcon.tsx
@@ -8,8 +8,9 @@
  *  - AUTHOR: HashiCorp
  */
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
-export default function SamlIcon() {
+export default function SamlIcon(): JSX.Element {
   return (
     <svg
       width="800px"
diff --git a/packages/client/src/svgs/SaveIcon.tsx b/packages/client/src/svgs/SaveIcon.tsx
index 737889cc904..ca32cb7d361 100644
--- a/packages/client/src/svgs/SaveIcon.tsx
+++ b/packages/client/src/svgs/SaveIcon.tsx
@@ -1,9 +1,11 @@
+import { JSX } from 'react/jsx-runtime';
+
 type SaveIconProps = {
   size?: string | number;
   className?: string;
 };
 
-export default function SaveIcon({ size = '1em', className }: SaveIconProps) {
+export default function SaveIcon({ size = '1em', className }: SaveIconProps): JSX.Element {
   return (
     <svg
       viewBox="64 64 896 896"
diff --git a/packages/client/src/svgs/SendIcon.tsx b/packages/client/src/svgs/SendIcon.tsx
index 703c645f0bf..f68ee176e98 100644
--- a/packages/client/src/svgs/SendIcon.tsx
+++ b/packages/client/src/svgs/SendIcon.tsx
@@ -1,6 +1,13 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
 
-export default function SendIcon({ size = 24, className = '' }) {
+export default function SendIcon({
+  size = 24,
+  className = '',
+}: {
+  size?: number | undefined;
+  className?: string | undefined;
+}): JSX.Element {
   return (
     <svg
       width={size}
diff --git a/packages/client/src/svgs/SendMessageIcon.tsx b/packages/client/src/svgs/SendMessageIcon.tsx
index a48c868bdbe..3aef3c976df 100644
--- a/packages/client/src/svgs/SendMessageIcon.tsx
+++ b/packages/client/src/svgs/SendMessageIcon.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
-export default function SendMessageIcon() {
+export default function SendMessageIcon(): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/SharePointIcon.tsx b/packages/client/src/svgs/SharePointIcon.tsx
index 5764a27a1c9..caa77ee6379 100644
--- a/packages/client/src/svgs/SharePointIcon.tsx
+++ b/packages/client/src/svgs/SharePointIcon.tsx
@@ -1,5 +1,10 @@
 import React from 'react';
-export default function SharePointIcon({ className = '' }) {
+import { JSX } from 'react/jsx-runtime';
+export default function SharePointIcon({
+  className = '',
+}: {
+  className?: string | undefined;
+}): JSX.Element {
   return (
     <svg
       fill="currentColor"
diff --git a/packages/client/src/svgs/SheetPaths.tsx b/packages/client/src/svgs/SheetPaths.tsx
index a98e14cae3c..1902a56bc75 100644
--- a/packages/client/src/svgs/SheetPaths.tsx
+++ b/packages/client/src/svgs/SheetPaths.tsx
@@ -1,4 +1,6 @@
-export default function SheetPaths() {
+import { JSX } from 'react/jsx-runtime';
+
+export default function SheetPaths(): JSX.Element {
   return (
     <>
       <path
diff --git a/packages/client/src/svgs/Sidebar.tsx b/packages/client/src/svgs/Sidebar.tsx
index 910343cfb23..17b155d22c7 100644
--- a/packages/client/src/svgs/Sidebar.tsx
+++ b/packages/client/src/svgs/Sidebar.tsx
@@ -1,4 +1,6 @@
-export default function Sidebar({ className }: { className?: string }) {
+import { JSX } from 'react/jsx-runtime';
+
+export default function Sidebar({ className }: { className?: string }): JSX.Element {
   return (
     <svg
       width="24"
diff --git a/packages/client/src/svgs/Sparkles.tsx b/packages/client/src/svgs/Sparkles.tsx
index 8b1604dd845..dd8582b79ea 100644
--- a/packages/client/src/svgs/Sparkles.tsx
+++ b/packages/client/src/svgs/Sparkles.tsx
@@ -1,6 +1,13 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
 
-export default function Sparkles({ className = '', size = 24 }) {
+export default function Sparkles({
+  className = '',
+  size = 24,
+}: {
+  className?: string | undefined;
+  size?: number | undefined;
+}): JSX.Element {
   return (
     <svg
       width={size}
diff --git a/packages/client/src/svgs/SpeechIcon.tsx b/packages/client/src/svgs/SpeechIcon.tsx
index f3e74f3e662..abc8f37173d 100644
--- a/packages/client/src/svgs/SpeechIcon.tsx
+++ b/packages/client/src/svgs/SpeechIcon.tsx
@@ -1,10 +1,11 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils/';
 
 type SpeechIconProps = {
   className?: string;
 };
 
-export default function SpeechIcon({ className }: SpeechIconProps) {
+export default function SpeechIcon({ className }: SpeechIconProps): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/Spinner.tsx b/packages/client/src/svgs/Spinner.tsx
index 84fbf8f3279..b61af9d1190 100644
--- a/packages/client/src/svgs/Spinner.tsx
+++ b/packages/client/src/svgs/Spinner.tsx
@@ -1,3 +1,4 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils/';
 
 interface SpinnerProps {
@@ -14,7 +15,7 @@ export default function Spinner({
   color = 'currentColor',
   bgOpacity = 0.1,
   speed = 0.75,
-}: SpinnerProps) {
+}: SpinnerProps): JSX.Element {
   const cssVars = {
     '--spinner-speed': `${speed}s`,
   } as React.CSSProperties;
diff --git a/packages/client/src/svgs/SquirclePlusIcon.tsx b/packages/client/src/svgs/SquirclePlusIcon.tsx
index c7548f2c7d0..ce2837bba1b 100644
--- a/packages/client/src/svgs/SquirclePlusIcon.tsx
+++ b/packages/client/src/svgs/SquirclePlusIcon.tsx
@@ -1,4 +1,6 @@
-export default function SquirclePlusIcon() {
+import { JSX } from 'react/jsx-runtime';
+
+export default function SquirclePlusIcon(): JSX.Element {
   return (
     <svg
       stroke="currentColor"
diff --git a/packages/client/src/svgs/StopGeneratingIcon.tsx b/packages/client/src/svgs/StopGeneratingIcon.tsx
index 35d19ca02ec..fd3155146f7 100644
--- a/packages/client/src/svgs/StopGeneratingIcon.tsx
+++ b/packages/client/src/svgs/StopGeneratingIcon.tsx
@@ -1,6 +1,11 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
 
-export default function StopGeneratingIcon({ className = '' }: { className?: string }) {
+export default function StopGeneratingIcon({
+  className = '',
+}: {
+  className?: string;
+}): JSX.Element {
   return (
     <svg
       stroke="currentColor"
diff --git a/packages/client/src/svgs/SunIcon.tsx b/packages/client/src/svgs/SunIcon.tsx
index b0842d346a2..eeb69d364d9 100644
--- a/packages/client/src/svgs/SunIcon.tsx
+++ b/packages/client/src/svgs/SunIcon.tsx
@@ -1,6 +1,7 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
-export default function SunIcon() {
+export default function SunIcon(): JSX.Element {
   return (
     <svg
       stroke="currentColor"
diff --git a/packages/client/src/svgs/SwitchIcon.tsx b/packages/client/src/svgs/SwitchIcon.tsx
index e97cf24f3b5..582bb8e8449 100644
--- a/packages/client/src/svgs/SwitchIcon.tsx
+++ b/packages/client/src/svgs/SwitchIcon.tsx
@@ -1,9 +1,11 @@
+import { JSX } from 'react/jsx-runtime';
+
 type SwitchIconProps = {
   size?: string | number;
   className?: string;
 };
 
-export default function SwitchIcon({ size = '1em', className }: SwitchIconProps) {
+export default function SwitchIcon({ size = '1em', className }: SwitchIconProps): JSX.Element {
   return (
     <svg
       viewBox="64 64 896 896"
diff --git a/packages/client/src/svgs/TextPaths.tsx b/packages/client/src/svgs/TextPaths.tsx
index 89d7353b6da..04d4521b296 100644
--- a/packages/client/src/svgs/TextPaths.tsx
+++ b/packages/client/src/svgs/TextPaths.tsx
@@ -1,4 +1,6 @@
-export default function TextPaths() {
+import { JSX } from 'react/jsx-runtime';
+
+export default function TextPaths(): JSX.Element {
   return (
     <>
       <path
diff --git a/packages/client/src/svgs/ThumbDownIcon.tsx b/packages/client/src/svgs/ThumbDownIcon.tsx
index 581222ee0dd..92027b2328a 100644
--- a/packages/client/src/svgs/ThumbDownIcon.tsx
+++ b/packages/client/src/svgs/ThumbDownIcon.tsx
@@ -1,4 +1,14 @@
-export default function ThumbDownIcon({ className = '', size = '1em', bold = false }) {
+import { JSX } from 'react/jsx-runtime';
+
+export default function ThumbDownIcon({
+  className = '',
+  size = '1em',
+  bold = false,
+}: {
+  className?: string | undefined;
+  size?: string | undefined;
+  bold?: boolean | undefined;
+}): JSX.Element {
   return bold ? (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/ThumbUpIcon.tsx b/packages/client/src/svgs/ThumbUpIcon.tsx
index 33f1495dcb9..7a86e98602c 100644
--- a/packages/client/src/svgs/ThumbUpIcon.tsx
+++ b/packages/client/src/svgs/ThumbUpIcon.tsx
@@ -1,4 +1,14 @@
-export default function ThumbUpIcon({ className = '', size = '1em', bold = false }) {
+import { JSX } from 'react/jsx-runtime';
+
+export default function ThumbUpIcon({
+  className = '',
+  size = '1em',
+  bold = false,
+}: {
+  className?: string | undefined;
+  size?: string | undefined;
+  bold?: boolean | undefined;
+}): JSX.Element {
   return bold ? (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/TrashIcon.tsx b/packages/client/src/svgs/TrashIcon.tsx
index fcab75beedd..85c94ee6674 100644
--- a/packages/client/src/svgs/TrashIcon.tsx
+++ b/packages/client/src/svgs/TrashIcon.tsx
@@ -1,10 +1,11 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
 
 type TrashIconProps = {
   className?: string;
 };
 
-export default function TrashIcon({ className = '' }: TrashIconProps) {
+export default function TrashIcon({ className = '' }: TrashIconProps): JSX.Element {
   return (
     <svg
       fill="none"
diff --git a/packages/client/src/svgs/UserIcon.tsx b/packages/client/src/svgs/UserIcon.tsx
index 1003f082226..928dc982829 100644
--- a/packages/client/src/svgs/UserIcon.tsx
+++ b/packages/client/src/svgs/UserIcon.tsx
@@ -1,4 +1,6 @@
-export default function UserIcon() {
+import { JSX } from 'react/jsx-runtime';
+
+export default function UserIcon(): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/svgs/VectorIcon.tsx b/packages/client/src/svgs/VectorIcon.tsx
index 57aaa363ee4..3889680f649 100644
--- a/packages/client/src/svgs/VectorIcon.tsx
+++ b/packages/client/src/svgs/VectorIcon.tsx
@@ -1,4 +1,6 @@
-export default function VectorIcon({ className }: { className?: string }) {
+import { JSX } from 'react/jsx-runtime';
+
+export default function VectorIcon({ className }: { className?: string }): JSX.Element {
   return (
     <svg
       width="20"
diff --git a/packages/client/src/svgs/VideoPaths.tsx b/packages/client/src/svgs/VideoPaths.tsx
index 6876824e42d..9a28e1dd4ea 100644
--- a/packages/client/src/svgs/VideoPaths.tsx
+++ b/packages/client/src/svgs/VideoPaths.tsx
@@ -1,4 +1,6 @@
-export default function VideoPaths() {
+import { JSX } from 'react/jsx-runtime';
+
+export default function VideoPaths(): JSX.Element {
   return (
     <>
       {/* Video container - rounded rectangle (not filled) */}
diff --git a/packages/client/src/svgs/VolumeIcon.tsx b/packages/client/src/svgs/VolumeIcon.tsx
index f08784e8846..42e043a499b 100644
--- a/packages/client/src/svgs/VolumeIcon.tsx
+++ b/packages/client/src/svgs/VolumeIcon.tsx
@@ -1,6 +1,13 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
 
-export default function VolumeIcon({ className = '', size = '1em' }) {
+export default function VolumeIcon({
+  className = '',
+  size = '1em',
+}: {
+  className?: string | undefined;
+  size?: string | undefined;
+}): JSX.Element {
   return (
     <svg
       viewBox="0 0 24 24"
diff --git a/packages/client/src/svgs/VolumeMuteIcon.tsx b/packages/client/src/svgs/VolumeMuteIcon.tsx
index 29a9954503f..6f6aa8f0b5f 100644
--- a/packages/client/src/svgs/VolumeMuteIcon.tsx
+++ b/packages/client/src/svgs/VolumeMuteIcon.tsx
@@ -1,6 +1,13 @@
+import { JSX } from 'react/jsx-runtime';
 import { cn } from '~/utils';
 
-export default function VolumeMuteIcon({ className = '', size = '1em' }) {
+export default function VolumeMuteIcon({
+  className = '',
+  size = '1em',
+}: {
+  className?: string | undefined;
+  size?: string | undefined;
+}): JSX.Element {
   return (
     <svg
       viewBox="0 0 24 24"
diff --git a/packages/client/src/svgs/XAIcon.tsx b/packages/client/src/svgs/XAIcon.tsx
index 2ee679dcd3f..ea4a1fc8b56 100644
--- a/packages/client/src/svgs/XAIcon.tsx
+++ b/packages/client/src/svgs/XAIcon.tsx
@@ -1,6 +1,11 @@
 import React from 'react';
+import { JSX } from 'react/jsx-runtime';
 
-export default function XAIcon({ className = '' }) {
+export default function XAIcon({
+  className = '',
+}: {
+  className?: string | undefined;
+}): JSX.Element {
   return (
     <svg
       xmlns="http://www.w3.org/2000/svg"
diff --git a/packages/client/src/theme/atoms/themeAtoms.ts b/packages/client/src/theme/atoms/themeAtoms.ts
index 0babc4036b7..5923b181839 100644
--- a/packages/client/src/theme/atoms/themeAtoms.ts
+++ b/packages/client/src/theme/atoms/themeAtoms.ts
@@ -1,36 +1,49 @@
 // This file is kept for backward compatibility but is no longer used internally.
 // Theme state is now managed via React useState + localStorage in ThemeProvider.
 
-import { atomWithStorage } from 'jotai/utils';
+import { WritableAtom } from 'jotai';
+import { atomWithStorage, RESET } from 'jotai/utils';
 import { IThemeRGB } from '../types';
 
 /**
  * @deprecated Use ThemeContext instead. This atom is no longer used internally.
  */
-export const themeModeAtom = atomWithStorage<string>('color-theme', 'system', undefined, {
+export const themeModeAtom: WritableAtom<
+  string,
+  [string | typeof RESET | ((prev: string) => string | typeof RESET)],
+  void
+> = atomWithStorage<string>('color-theme', 'system', undefined, {
   getOnInit: true,
 });
 
 /**
  * @deprecated Use ThemeContext instead. This atom is no longer used internally.
  */
-export const themeColorsAtom = atomWithStorage<IThemeRGB | undefined>(
-  'theme-colors',
-  undefined,
-  undefined,
-  {
-    getOnInit: true,
-  },
-);
+export const themeColorsAtom: WritableAtom<
+  IThemeRGB | undefined,
+  [
+    | IThemeRGB
+    | typeof RESET
+    | ((prev: IThemeRGB | undefined) => IThemeRGB | typeof RESET | undefined)
+    | undefined,
+  ],
+  void
+> = atomWithStorage<IThemeRGB | undefined>('theme-colors', undefined, undefined, {
+  getOnInit: true,
+});
 
 /**
  * @deprecated Use ThemeContext instead. This atom is no longer used internally.
  */
-export const themeNameAtom = atomWithStorage<string | undefined>(
-  'theme-name',
-  undefined,
-  undefined,
-  {
-    getOnInit: true,
-  },
-);
+export const themeNameAtom: WritableAtom<
+  string | undefined,
+  [
+    | string
+    | typeof RESET
+    | ((prev: string | undefined) => string | typeof RESET | undefined)
+    | undefined,
+  ],
+  void
+> = atomWithStorage<string | undefined>('theme-name', undefined, undefined, {
+  getOnInit: true,
+});
diff --git a/packages/client/src/theme/context/ThemeProvider.tsx b/packages/client/src/theme/context/ThemeProvider.tsx
index 4e654b04642..8872fd62108 100644
--- a/packages/client/src/theme/context/ThemeProvider.tsx
+++ b/packages/client/src/theme/context/ThemeProvider.tsx
@@ -7,8 +7,9 @@ import React, {
   useState,
   useRef,
 } from 'react';
-import { IThemeRGB } from '../types';
+import { JSX } from 'react/jsx-runtime';
 import applyTheme from '../utils/applyTheme';
+import { IThemeRGB } from '../types';
 
 const THEME_KEY = 'color-theme';
 const THEME_COLORS_KEY = 'theme-colors';
@@ -25,7 +26,7 @@ type ThemeContextType = {
 };
 
 // Export ThemeContext so it can be imported from hooks
-export const ThemeContext = createContext<ThemeContextType>({
+export const ThemeContext: React.Context<ThemeContextType> = createContext<ThemeContextType>({
   theme: 'system',
   setTheme: () => undefined,
   setThemeRGB: () => undefined,
@@ -123,7 +124,7 @@ export function ThemeProvider({
   themeRGB: propThemeRGB,
   themeName: propThemeName,
   initialTheme,
-}: ThemeProviderProps) {
+}: ThemeProviderProps): JSX.Element {
   const [theme, setThemeState] = useState<string>(getInitialTheme);
   const [themeRGB, setThemeRGBState] = useState<IThemeRGB | undefined>(getInitialThemeColors);
   const [themeName, setThemeNameState] = useState<string | undefined>(getInitialThemeName);
@@ -254,7 +255,7 @@ export function ThemeProvider({
 /**
  * Hook to access the current theme context
  */
-export function useTheme() {
+export function useTheme(): ThemeContextType {
   const context = useContext(ThemeContext);
   if (!context) {
     throw new Error('useTheme must be used within a ThemeProvider');
diff --git a/packages/client/src/theme/utils/applyTheme.ts b/packages/client/src/theme/utils/applyTheme.ts
index f98db54dd8c..b3fc4514b8c 100644
--- a/packages/client/src/theme/utils/applyTheme.ts
+++ b/packages/client/src/theme/utils/applyTheme.ts
@@ -93,7 +93,7 @@ function mapTheme(rgb: IThemeRGB): Partial<IThemeVariables> {
  * Applies theme to the document root
  * Sets CSS variables as rgb() values for compatibility with existing CSS
  */
-export default function applyTheme(themeRGB?: IThemeRGB) {
+export default function applyTheme(themeRGB?: IThemeRGB): void {
   if (!themeRGB) return;
 
   const themeObject = mapTheme(themeRGB);
diff --git a/packages/client/src/utils/logger.ts b/packages/client/src/utils/logger.ts
index 73e4fac5a5f..4830ba7fe46 100644
--- a/packages/client/src/utils/logger.ts
+++ b/packages/client/src/utils/logger.ts
@@ -24,7 +24,14 @@ const createLogFunction = (
   };
 };
 
-const logger = {
+const logger: {
+  log: LogFunction;
+  dir: LogFunction;
+  warn: LogFunction;
+  info: LogFunction;
+  error: LogFunction;
+  debug: LogFunction;
+} = {
   log: createLogFunction(console.log, 'log'),
   dir: createLogFunction(console.dir, 'dir'),
   warn: createLogFunction(console.warn, 'warn'),
diff --git a/packages/client/src/utils/theme.ts b/packages/client/src/utils/theme.ts
index a5bc645a07a..e84e05f45ce 100644
--- a/packages/client/src/utils/theme.ts
+++ b/packages/client/src/utils/theme.ts
@@ -1,4 +1,4 @@
-export const applyFontSize = (val: string) => {
+export const applyFontSize = (val: string): void => {
   const root = document.documentElement;
   const size = val.split('-')[1]; // This will be 'xs', 'sm', 'base', 'lg', or 'xl'
 
@@ -21,7 +21,7 @@ export const applyFontSize = (val: string) => {
   }
 };
 
-export const getInitialTheme = () => {
+export const getInitialTheme = (): string => {
   if (typeof window !== 'undefined' && window.localStorage) {
     const storedPrefs = window.localStorage.getItem('color-theme');
     if (typeof storedPrefs === 'string') {
diff --git a/packages/client/tsconfig.json b/packages/client/tsconfig.json
index e15bc2ab53d..65b1eb1f72b 100644
--- a/packages/client/tsconfig.json
+++ b/packages/client/tsconfig.json
@@ -8,6 +8,7 @@
     "declaration": true,
     "declarationMap": true,
     "declarationDir": "./dist/types",
+    "isolatedDeclarations": true,
     "sourceMap": true,
     "esModuleInterop": true,
     "allowSyntheticDefaultImports": true,
diff --git a/packages/client/tsdown.config.mjs b/packages/client/tsdown.config.mjs
new file mode 100644
index 00000000000..a027189ce6a
--- /dev/null
+++ b/packages/client/tsdown.config.mjs
@@ -0,0 +1,33 @@
+import path from 'node:path';
+import { defineConfig } from 'tsdown';
+
+// Mirror the prior Rollup `@rollup/plugin-replace` substitutions: only these three are
+// baked at lib-build time. `import.meta.env.MODE` and `REACT_APP_*` are intentionally left
+// intact so the consuming Vite app resolves them at app-build time.
+const define = {
+  'process.env.NODE_ENV': JSON.stringify(process.env.NODE_ENV || 'production'),
+  'process.env.VITE_ENABLE_LOGGER': JSON.stringify(process.env.VITE_ENABLE_LOGGER || 'false'),
+  'process.env.VITE_LOGGER_FILTER': JSON.stringify(process.env.VITE_LOGGER_FILTER || ''),
+};
+
+export default defineConfig({
+  entry: ['src/index.ts'],
+  format: ['esm', 'cjs'],
+  platform: 'browser',
+  dts: { oxc: true },
+  outDir: 'dist',
+  sourcemap: true,
+  // Force .mjs/.cjs (and .d.mts/.d.cts) regardless of package `type`, so the package can stay
+  // CommonJS (jest.config.js / babel.config.js are CJS) while still shipping dual ESM/CJS.
+  fixedExtension: true,
+  define,
+  // Extract all component CSS into a single `dist/style.css` (no import left in the JS, so the
+  // CJS output stays valid CommonJS). Consumers import `@librechat/client/style.css` once.
+  css: { inject: false },
+  // Externalize every third-party import (consumers provide the peers + react/jsx-runtime);
+  // bundle only relative, `~`-aliased, and absolute sources.
+  deps: {
+    neverBundle: (id) => !id.startsWith('.') && !id.startsWith('~') && !path.isAbsolute(id),
+    onlyBundle: false,
+  },
+});
diff --git a/packages/data-provider/package.json b/packages/data-provider/package.json
index bb597b3b33a..bfa064e6dd7 100644
--- a/packages/data-provider/package.json
+++ b/packages/data-provider/package.json
@@ -1,19 +1,19 @@
 {
   "name": "librechat-data-provider",
-  "version": "0.8.503",
+  "version": "0.8.505",
   "description": "data services for librechat apps",
   "main": "dist/index.js",
-  "module": "dist/index.es.js",
+  "module": "dist/index.mjs",
   "types": "./dist/types/index.d.ts",
   "sideEffects": false,
   "exports": {
     ".": {
-      "import": "./dist/index.es.js",
+      "import": "./dist/index.mjs",
       "require": "./dist/index.js",
       "types": "./dist/types/index.d.ts"
     },
     "./react-query": {
-      "import": "./dist/react-query/index.es.js",
+      "import": "./dist/react-query/index.mjs",
       "require": "./dist/react-query/index.js",
       "types": "./dist/types/react-query/index.d.ts"
     }
@@ -23,14 +23,14 @@
   ],
   "scripts": {
     "clean": "rimraf dist",
-    "build": "npm run clean && rollup -c --silent --bundleConfigAsCjs",
-    "build:watch": "rollup -c -w",
+    "build": "npm run clean && tsdown && tsc -p tsconfig.build.json",
+    "build:watch": "tsdown --watch",
     "rollup:api": "npx rollup -c server-rollup.config.js --bundleConfigAsCjs",
     "test": "jest --coverage --watch",
     "test:ci": "jest --coverage --ci --logHeapUsage",
     "verify": "npm run test:ci",
     "b:clean": "bun run rimraf dist",
-    "b:build": "bun run b:clean && bun run rollup -c --silent --bundleConfigAsCjs"
+    "b:build": "bun run b:clean && bun run tsdown && bun run tsc -p tsconfig.build.json"
   },
   "repository": {
     "type": "git",
@@ -57,20 +57,18 @@
     "@rollup/plugin-json": "^6.1.0",
     "@rollup/plugin-node-resolve": "^15.1.0",
     "@rollup/plugin-replace": "^5.0.5",
-    "@rollup/plugin-terser": "^1.0.0",
     "@types/jest": "^29.5.2",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^24.12.4",
     "@types/react": "^18.2.18",
     "@types/winston": "^2.4.4",
     "jest": "^30.2.0",
-    "jest-junit": "^16.0.0",
+    "jest-junit": "^17.0.0",
     "openapi-types": "^12.1.3",
     "rimraf": "^6.1.3",
     "rollup": "^4.34.9",
-    "rollup-plugin-peer-deps-external": "^2.2.4",
-    "rollup-plugin-typescript2": "^0.37.0",
-    "typescript": "^5.0.4"
+    "tsdown": "^0.22.2",
+    "typescript": "^5.9.3"
   },
   "peerDependencies": {
     "@tanstack/react-query": "^4.28.0"
diff --git a/packages/data-provider/rollup.config.js b/packages/data-provider/rollup.config.js
deleted file mode 100644
index 8eb655cc41d..00000000000
--- a/packages/data-provider/rollup.config.js
+++ /dev/null
@@ -1,84 +0,0 @@
-import typescript from 'rollup-plugin-typescript2';
-import resolve from '@rollup/plugin-node-resolve';
-import pkg from './package.json';
-import rootPkg from '../../package.json';
-import peerDepsExternal from 'rollup-plugin-peer-deps-external';
-import commonjs from '@rollup/plugin-commonjs';
-import replace from '@rollup/plugin-replace';
-import terser from '@rollup/plugin-terser';
-
-const plugins = [
-  peerDepsExternal(),
-  resolve(),
-  // NOTE: `__LIBRECHAT_VERSION__` is only ever used inside a string literal
-  // (e.g. `VERSION = '__LIBRECHAT_VERSION__'` in `src/config.ts`), so substring
-  // replacement produces valid JS without needing `JSON.stringify`. Do not
-  // repurpose this token as a bare identifier without switching to a quoted
-  // replacement value.
-  replace({
-    preventAssignment: true,
-    values: {
-      __IS_DEV__: process.env.NODE_ENV === 'development',
-      __LIBRECHAT_VERSION__: rootPkg.version,
-    },
-  }),
-  commonjs(),
-  typescript({
-    tsconfig: './tsconfig.json',
-    useTsconfigDeclarationDir: true,
-  }),
-  terser(),
-];
-
-export default [
-  {
-    input: 'src/index.ts',
-    output: [
-      {
-        file: pkg.main,
-        format: 'cjs',
-        sourcemap: true,
-        exports: 'named',
-      },
-      {
-        file: pkg.module,
-        format: 'esm',
-        sourcemap: true,
-        exports: 'named',
-      },
-    ],
-    ...{
-      external: [
-        ...Object.keys(pkg.dependencies || {}),
-        ...Object.keys(pkg.devDependencies || {}),
-        ...Object.keys(pkg.peerDependencies || {}),
-        'react',
-        'react-dom',
-      ],
-      preserveSymlinks: true,
-      plugins,
-    },
-  },
-  // Separate bundle for react-query related part
-  {
-    input: 'src/react-query/index.ts',
-    output: [
-      {
-        file: 'dist/react-query/index.es.js',
-        format: 'esm',
-        exports: 'named',
-        sourcemap: true,
-      },
-    ],
-    external: [
-      ...Object.keys(pkg.dependencies || {}),
-      ...Object.keys(pkg.devDependencies || {}),
-      ...Object.keys(pkg.peerDependencies || {}),
-      'react',
-      'react-dom',
-      // 'librechat-data-provider', // Marking main part as external
-    ],
-    preserveSymlinks: true,
-    plugins,
-  },
-];
diff --git a/packages/data-provider/specs/bedrock.spec.ts b/packages/data-provider/specs/bedrock.spec.ts
index d54e5c504e8..f8dfd7f22ae 100644
--- a/packages/data-provider/specs/bedrock.spec.ts
+++ b/packages/data-provider/specs/bedrock.spec.ts
@@ -1,4 +1,4 @@
-import { ThinkingDisplay } from '../src/schemas';
+import { ThinkingDisplay, isMythosClassModel, MYTHOS_CLASS_FAMILIES } from '../src/schemas';
 import {
   BEDROCK_OUTPUT_128K_BETA,
   supportsAdaptiveThinking,
@@ -14,6 +14,23 @@ import {
 
 const BEDROCK_CLAUDE_4_BETAS = [BEDROCK_OUTPUT_128K_BETA, BEDROCK_FINE_GRAINED_TOOL_STREAMING_BETA];
 
+describe('isMythosClassModel (single source of truth for Fable/Mythos)', () => {
+  test('matches every declared family across naming variants', () => {
+    MYTHOS_CLASS_FAMILIES.forEach((family) => {
+      expect(isMythosClassModel(`claude-${family}-5`)).toBe(true);
+      expect(isMythosClassModel(`anthropic.claude-${family}-5`)).toBe(true);
+      expect(isMythosClassModel(`us.anthropic.claude-${family}-5`)).toBe(true);
+      expect(isMythosClassModel(`claude-${family}-5-20260609`)).toBe(true);
+    });
+  });
+
+  test('does not match opus/sonnet/haiku or unrelated models', () => {
+    ['claude-opus-4-8', 'claude-sonnet-4-6', 'claude-haiku-4-5', 'gpt-4o', ''].forEach((model) => {
+      expect(isMythosClassModel(model)).toBe(false);
+    });
+  });
+});
+
 describe('supportsAdaptiveThinking', () => {
   test('should return true for claude-opus-4-6', () => {
     expect(supportsAdaptiveThinking('claude-opus-4-6')).toBe(true);
@@ -43,6 +60,13 @@ describe('supportsAdaptiveThinking', () => {
     expect(supportsAdaptiveThinking('claude-sonnet-6')).toBe(true);
   });
 
+  test('should return true for Mythos-class models (Fable / Mythos)', () => {
+    expect(supportsAdaptiveThinking('claude-fable-5')).toBe(true);
+    expect(supportsAdaptiveThinking('claude-mythos-5')).toBe(true);
+    expect(supportsAdaptiveThinking('anthropic.claude-fable-5')).toBe(true);
+    expect(supportsAdaptiveThinking('us.anthropic.claude-fable-5')).toBe(true);
+  });
+
   test('should return false for claude-opus-4-5', () => {
     expect(supportsAdaptiveThinking('claude-opus-4-5')).toBe(false);
   });
@@ -161,6 +185,12 @@ describe('supportsContext1m', () => {
     expect(supportsContext1m('claude-opus-5')).toBe(true);
   });
 
+  test('should return true for Mythos-class models (Fable / Mythos)', () => {
+    expect(supportsContext1m('claude-fable-5')).toBe(true);
+    expect(supportsContext1m('claude-mythos-5')).toBe(true);
+    expect(supportsContext1m('anthropic.claude-fable-5')).toBe(true);
+  });
+
   test('should return false for claude-opus-4-5', () => {
     expect(supportsContext1m('claude-opus-4-5')).toBe(false);
   });
@@ -235,6 +265,12 @@ describe('omitsThinkingByDefault', () => {
     expect(omitsThinkingByDefault('claude-opus-9')).toBe(true);
   });
 
+  test('returns true for Mythos-class models (Fable / Mythos)', () => {
+    expect(omitsThinkingByDefault('claude-fable-5')).toBe(true);
+    expect(omitsThinkingByDefault('claude-mythos-5')).toBe(true);
+    expect(omitsThinkingByDefault('anthropic.claude-fable-5')).toBe(true);
+  });
+
   test('returns false for claude-opus-4-6 (adaptive but pre-4.7)', () => {
     expect(omitsThinkingByDefault('claude-opus-4-6')).toBe(false);
   });
@@ -285,6 +321,19 @@ describe('omitsSamplingParameters', () => {
     });
   });
 
+  test('returns true for Mythos-class models (Fable / Mythos)', () => {
+    const models = [
+      'claude-fable-5',
+      'claude-mythos-5',
+      'anthropic.claude-fable-5',
+      'us.anthropic.claude-fable-5',
+    ];
+
+    models.forEach((model) => {
+      expect(omitsSamplingParameters(model)).toBe(true);
+    });
+  });
+
   test('returns false for older Opus and non-Opus models', () => {
     const models = [
       'claude-opus-4-20250514',
@@ -618,6 +667,34 @@ describe('bedrockInputParser', () => {
       expect(additionalFields.top_k).toBe(40);
     });
 
+    test('should set adaptive thinking and strip sampling params for Fable 5 Bedrock models', () => {
+      const input = {
+        model: 'anthropic.claude-fable-5',
+        effort: 'high',
+        temperature: 0.7,
+        topP: 0.9,
+        topK: 40,
+        top_p: 0.8,
+        additionalModelRequestFields: {
+          custom_flag: true,
+          temperature: 0.5,
+          top_k: 20,
+        },
+      };
+      const result = bedrockInputParser.parse(input) as Record<string, unknown>;
+      const additionalFields = result.additionalModelRequestFields as Record<string, unknown>;
+      expect(result.temperature).toBeUndefined();
+      expect(result.topP).toBeUndefined();
+      expect(additionalFields.temperature).toBeUndefined();
+      expect(additionalFields.top_p).toBeUndefined();
+      expect(additionalFields.top_k).toBeUndefined();
+      expect(additionalFields.custom_flag).toBe(true);
+      expect(additionalFields.thinking).toEqual({ type: 'adaptive', display: 'summarized' });
+      expect(additionalFields.output_config).toEqual({ effort: 'high' });
+      /** Mythos-class models do not receive the legacy output-128k / fine-grained-tool-streaming betas. */
+      expect(additionalFields.anthropic_beta).toBeUndefined();
+    });
+
     test('should set thinking.display to "summarized" so Opus 4.7 returns reasoning blocks', () => {
       const input = {
         model: 'anthropic.claude-opus-4-7',
diff --git a/packages/data-provider/specs/config-schemas.spec.ts b/packages/data-provider/specs/config-schemas.spec.ts
index 33ee6db279b..e7a3f3dc533 100644
--- a/packages/data-provider/specs/config-schemas.spec.ts
+++ b/packages/data-provider/specs/config-schemas.spec.ts
@@ -8,8 +8,10 @@ import {
   interfaceSchema,
   fileStorageSchema,
   fileStrategiesSchema,
+  SKILL_SYNC_MAX_INTERVAL_MINUTES,
   summarizationTriggerSchema,
   summarizationConfigSchema,
+  MAX_SUBAGENTS,
 } from '../src/config';
 import {
   tModelSpecPresetSchema,
@@ -680,6 +682,294 @@ describe('configSchema fileStrategy', () => {
   });
 });
 
+describe('configSchema skillSync', () => {
+  it('accepts a GitHub skill sync source with explicit paths and credential key', () => {
+    const result = configSchema.safeParse({
+      version: '1.3.11',
+      skillSync: {
+        github: {
+          enabled: true,
+          intervalMinutes: 60,
+          runOnStartup: true,
+          sources: [
+            {
+              id: 'librechat-skills',
+              owner: 'LibreChat',
+              repo: 'skills',
+              ref: 'main',
+              paths: ['skills', '.'],
+              credentialKey: 'github-skills-prod',
+            },
+          ],
+        },
+      },
+    });
+    expect(result.success).toBe(true);
+    expect(result.data?.skillSync?.github?.sources[0]?.paths).toEqual(['skills', '']);
+    expect(result.data?.skillSync?.github?.sources[0]?.skillDiscoveryDepth).toBeUndefined();
+  });
+
+  it('accepts a GitHub skill sync source with an env-backed token and discovery depth', () => {
+    const result = configSchema.safeParse({
+      version: '1.3.11',
+      skillSync: {
+        github: {
+          enabled: true,
+          sources: [
+            {
+              id: 'mattpocock-skills',
+              owner: 'mattpocock',
+              repo: 'skills',
+              paths: ['skills'],
+              skillDiscoveryDepth: 3,
+              token: '${GITHUB_SKILLS_TOKEN}',
+            },
+          ],
+        },
+      },
+    });
+    expect(result.success).toBe(true);
+    expect(result.data?.skillSync?.github?.sources[0]?.token).toBe('${GITHUB_SKILLS_TOKEN}');
+    expect(result.data?.skillSync?.github?.sources[0]?.skillDiscoveryDepth).toBe(3);
+  });
+
+  it('accepts an optional tenantId on a GitHub skill sync source', () => {
+    const result = configSchema.safeParse({
+      version: '1.3.11',
+      skillSync: {
+        github: {
+          enabled: true,
+          sources: [
+            {
+              id: 'librechat-skills',
+              owner: 'LibreChat',
+              repo: 'skills',
+              paths: ['skills'],
+              credentialKey: 'github-skills-prod',
+              tenantId: 'tenant-a',
+            },
+          ],
+        },
+      },
+    });
+    expect(result.success).toBe(true);
+    expect(result.data?.skillSync?.github?.sources[0]?.tenantId).toBe('tenant-a');
+  });
+
+  it('rejects the reserved system tenant id on a GitHub skill sync source', () => {
+    const result = configSchema.safeParse({
+      version: '1.3.11',
+      skillSync: {
+        github: {
+          enabled: true,
+          sources: [
+            {
+              id: 'librechat-skills',
+              owner: 'LibreChat',
+              repo: 'skills',
+              paths: ['skills'],
+              credentialKey: 'github-skills-prod',
+              tenantId: '__SYSTEM__',
+            },
+          ],
+        },
+      },
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it('rejects enabled GitHub skill sync without sources', () => {
+    const result = configSchema.safeParse({
+      version: '1.3.11',
+      skillSync: {
+        github: {
+          enabled: true,
+          sources: [],
+        },
+      },
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it('rejects GitHub skill sync intervals below five minutes', () => {
+    const result = configSchema.safeParse({
+      version: '1.3.11',
+      skillSync: {
+        github: {
+          enabled: true,
+          intervalMinutes: 4,
+          sources: [
+            {
+              id: 'librechat-skills',
+              owner: 'LibreChat',
+              repo: 'skills',
+              paths: ['skills'],
+              credentialKey: 'github-skills-prod',
+            },
+          ],
+        },
+      },
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it('rejects GitHub skill sync intervals above the Node timer limit', () => {
+    const result = configSchema.safeParse({
+      version: '1.3.11',
+      skillSync: {
+        github: {
+          enabled: true,
+          intervalMinutes: SKILL_SYNC_MAX_INTERVAL_MINUTES + 1,
+          sources: [
+            {
+              id: 'librechat-skills',
+              owner: 'LibreChat',
+              repo: 'skills',
+              paths: ['skills'],
+              credentialKey: 'github-skills-prod',
+            },
+          ],
+        },
+      },
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it('rejects unsafe GitHub skill sync paths and credential keys', () => {
+    const result = configSchema.safeParse({
+      version: '1.3.11',
+      skillSync: {
+        github: {
+          enabled: true,
+          sources: [
+            {
+              id: 'librechat-skills',
+              owner: 'LibreChat',
+              repo: 'skills',
+              paths: ['../skills'],
+              credentialKey: '../token',
+            },
+          ],
+        },
+      },
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it('rejects GitHub skill sync sources without credentials or with literal tokens', () => {
+    const missingCredential = configSchema.safeParse({
+      version: '1.3.11',
+      skillSync: {
+        github: {
+          enabled: true,
+          sources: [
+            {
+              id: 'librechat-skills',
+              owner: 'LibreChat',
+              repo: 'skills',
+              paths: ['skills'],
+            },
+          ],
+        },
+      },
+    });
+    const literalToken = configSchema.safeParse({
+      version: '1.3.11',
+      skillSync: {
+        github: {
+          enabled: true,
+          sources: [
+            {
+              id: 'librechat-skills',
+              owner: 'LibreChat',
+              repo: 'skills',
+              paths: ['skills'],
+              token: 'github_pat_secret',
+            },
+          ],
+        },
+      },
+    });
+    const duplicateCredentialSources = configSchema.safeParse({
+      version: '1.3.11',
+      skillSync: {
+        github: {
+          enabled: true,
+          sources: [
+            {
+              id: 'librechat-skills',
+              owner: 'LibreChat',
+              repo: 'skills',
+              paths: ['skills'],
+              credentialKey: 'github-skills-prod',
+              token: '${GITHUB_SKILLS_TOKEN}',
+            },
+          ],
+        },
+      },
+    });
+    expect(missingCredential.success).toBe(false);
+    expect(literalToken.success).toBe(false);
+    expect(duplicateCredentialSources.success).toBe(false);
+  });
+
+  it('rejects GitHub skill sync discovery depths outside the allowed range', () => {
+    const result = configSchema.safeParse({
+      version: '1.3.11',
+      skillSync: {
+        github: {
+          enabled: true,
+          sources: [
+            {
+              id: 'librechat-skills',
+              owner: 'LibreChat',
+              repo: 'skills',
+              paths: ['skills'],
+              credentialKey: 'github-skills-prod',
+              skillDiscoveryDepth: 11,
+            },
+          ],
+        },
+      },
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it('rejects malformed GitHub skill sync refs during config validation', () => {
+    const invalidRefs = [
+      'feature branch',
+      'release:2026',
+      'bad?ref',
+      'bad*ref',
+      '[bad]',
+      '@{upstream}',
+      'main.lock',
+    ];
+
+    for (const ref of invalidRefs) {
+      const result = configSchema.safeParse({
+        version: '1.3.11',
+        skillSync: {
+          github: {
+            enabled: true,
+            sources: [
+              {
+                id: 'librechat-skills',
+                owner: 'LibreChat',
+                repo: 'skills',
+                ref,
+                paths: ['skills'],
+                credentialKey: 'github-skills-prod',
+              },
+            ],
+          },
+        },
+      });
+      expect(result.success).toBe(false);
+    }
+  });
+});
+
 describe('interfaceSchema', () => {
   it('silently strips removed legacy fields', () => {
     const result = interfaceSchema.parse({
@@ -836,13 +1126,21 @@ describe('specsConfigSchema', () => {
           name: 'spec-1',
           label: 'Spec 1',
           hideBadgeRow: true,
+          softDefault: true,
           preset: { endpoint: EModelEndpoint.openAI },
+          subagents: { enabled: true, allowSelf: true, agent_ids: ['agent_researcher'] },
         },
       ],
     });
     expect(result.success).toBe(true);
     if (result.success) {
       expect(result.data.list[0].hideBadgeRow).toBe(true);
+      expect(result.data.list[0].softDefault).toBe(true);
+      expect(result.data.list[0].subagents).toEqual({
+        enabled: true,
+        allowSelf: true,
+        agent_ids: ['agent_researcher'],
+      });
     }
   });
 
@@ -850,4 +1148,19 @@ describe('specsConfigSchema', () => {
     const result = specsConfigSchema.safeParse({ list: null });
     expect(result.success).toBe(false);
   });
+
+  it('rejects model spec subagent ids above the shared cap', () => {
+    const oversized = Array.from({ length: MAX_SUBAGENTS + 1 }, (_, i) => `agent_${i}`);
+    const result = specsConfigSchema.safeParse({
+      list: [
+        {
+          name: 'spec-1',
+          label: 'Spec 1',
+          preset: { endpoint: EModelEndpoint.openAI },
+          subagents: { enabled: true, agent_ids: oversized },
+        },
+      ],
+    });
+    expect(result.success).toBe(false);
+  });
 });
diff --git a/packages/data-provider/specs/mcp.spec.ts b/packages/data-provider/specs/mcp.spec.ts
index e5b7d6566ab..a52e2f59e95 100644
--- a/packages/data-provider/specs/mcp.spec.ts
+++ b/packages/data-provider/specs/mcp.spec.ts
@@ -73,6 +73,115 @@ describe('MCP schemas', () => {
     });
   });
 
+  describe('OAuth URL env variable resolution (admin schema)', () => {
+    const OAUTH_AUTH_URL = 'https://auth.example.com/authorize';
+    const OAUTH_TOKEN_URL = 'https://auth.example.com/token';
+    const OAUTH_REDIRECT_URI = 'https://app.example.com/callback';
+    const OAUTH_REVOCATION_URL = 'https://auth.example.com/revoke';
+
+    beforeEach(() => {
+      process.env.OAUTH_AUTH_URL = OAUTH_AUTH_URL;
+      process.env.OAUTH_TOKEN_URL = OAUTH_TOKEN_URL;
+      process.env.OAUTH_REDIRECT_URI = OAUTH_REDIRECT_URI;
+      process.env.OAUTH_REVOCATION_URL = OAUTH_REVOCATION_URL;
+    });
+
+    afterEach(() => {
+      delete process.env.OAUTH_AUTH_URL;
+      delete process.env.OAUTH_TOKEN_URL;
+      delete process.env.OAUTH_REDIRECT_URI;
+      delete process.env.OAUTH_REVOCATION_URL;
+    });
+
+    it('should resolve env vars in authorization_url and token_url', () => {
+      const result = MCPOptionsSchema.safeParse({
+        type: 'streamable-http',
+        url: 'https://mcp-server.com/http',
+        oauth: {
+          authorization_url: '${OAUTH_AUTH_URL}',
+          token_url: '${OAUTH_TOKEN_URL}',
+          client_id: 'my-client',
+        },
+      });
+      expect(result.success).toBe(true);
+      if (result.success && result.data.oauth) {
+        expect(result.data.oauth.authorization_url).toBe(OAUTH_AUTH_URL);
+        expect(result.data.oauth.token_url).toBe(OAUTH_TOKEN_URL);
+      }
+    });
+
+    it('should resolve env vars in redirect_uri', () => {
+      const result = MCPOptionsSchema.safeParse({
+        type: 'sse',
+        url: 'https://mcp-server.com/sse',
+        oauth: {
+          redirect_uri: '${OAUTH_REDIRECT_URI}',
+        },
+      });
+      expect(result.success).toBe(true);
+      if (result.success && result.data.oauth) {
+        expect(result.data.oauth.redirect_uri).toBe(OAUTH_REDIRECT_URI);
+      }
+    });
+
+    it('should resolve env vars in revocation_endpoint', () => {
+      const result = MCPOptionsSchema.safeParse({
+        type: 'streamable-http',
+        url: 'https://mcp-server.com/http',
+        oauth: {
+          revocation_endpoint: '${OAUTH_REVOCATION_URL}',
+        },
+      });
+      expect(result.success).toBe(true);
+      if (result.success && result.data.oauth) {
+        expect(result.data.oauth.revocation_endpoint).toBe(OAUTH_REVOCATION_URL);
+      }
+    });
+
+    it('should accept plain OAuth URLs without env vars', () => {
+      const result = MCPOptionsSchema.safeParse({
+        type: 'streamable-http',
+        url: 'https://mcp-server.com/http',
+        oauth: {
+          authorization_url: 'https://auth.direct.com/authorize',
+          token_url: 'https://auth.direct.com/token',
+          redirect_uri: 'https://app.direct.com/callback',
+          revocation_endpoint: 'https://auth.direct.com/revoke',
+          client_id: 'my-client',
+        },
+      });
+      expect(result.success).toBe(true);
+    });
+
+    it('should reject invalid URLs after env var resolution', () => {
+      process.env.OAUTH_BAD_URL = 'not-a-url';
+      const result = MCPOptionsSchema.safeParse({
+        type: 'streamable-http',
+        url: 'https://mcp-server.com/http',
+        oauth: {
+          authorization_url: '${OAUTH_BAD_URL}',
+        },
+      });
+      expect(result.success).toBe(false);
+      delete process.env.OAUTH_BAD_URL;
+    });
+
+    it('should pass through undefined when OAuth URL fields are omitted', () => {
+      const result = MCPOptionsSchema.safeParse({
+        type: 'streamable-http',
+        url: 'https://mcp-server.com/http',
+        oauth: { scope: 'openid' },
+      });
+      expect(result.success).toBe(true);
+      if (result.success && result.data.oauth) {
+        expect(result.data.oauth.authorization_url).toBeUndefined();
+        expect(result.data.oauth.token_url).toBeUndefined();
+        expect(result.data.oauth.redirect_uri).toBeUndefined();
+        expect(result.data.oauth.revocation_endpoint).toBeUndefined();
+      }
+    });
+  });
+
   describe('env variable rejection', () => {
     it('should reject SSE URLs containing env variable patterns', () => {
       const result = MCPServerUserInputSchema.safeParse({
@@ -97,6 +206,58 @@ describe('MCP schemas', () => {
       });
       expect(result.success).toBe(false);
     });
+
+    it('should reject OAuth authorization_url containing env variable patterns', () => {
+      process.env.FAKE_SECRET = 'leaked-secret-value';
+      const result = MCPServerUserInputSchema.safeParse({
+        type: 'streamable-http',
+        url: 'https://mcp-server.com/http',
+        oauth: {
+          authorization_url: 'https://attacker.example/authorize?k=${FAKE_SECRET}',
+        },
+      });
+      expect(result.success).toBe(false);
+      delete process.env.FAKE_SECRET;
+    });
+
+    it('should reject OAuth token_url containing env variable patterns', () => {
+      process.env.FAKE_SECRET = 'leaked-secret-value';
+      const result = MCPServerUserInputSchema.safeParse({
+        type: 'streamable-http',
+        url: 'https://mcp-server.com/http',
+        oauth: {
+          token_url: 'https://attacker.example/token?k=${FAKE_SECRET}',
+        },
+      });
+      expect(result.success).toBe(false);
+      delete process.env.FAKE_SECRET;
+    });
+
+    it('should reject OAuth redirect_uri containing env variable patterns', () => {
+      process.env.FAKE_SECRET = 'leaked-secret-value';
+      const result = MCPServerUserInputSchema.safeParse({
+        type: 'streamable-http',
+        url: 'https://mcp-server.com/http',
+        oauth: {
+          redirect_uri: 'https://attacker.example/callback?k=${FAKE_SECRET}',
+        },
+      });
+      expect(result.success).toBe(false);
+      delete process.env.FAKE_SECRET;
+    });
+
+    it('should reject OAuth revocation_endpoint containing env variable patterns', () => {
+      process.env.FAKE_SECRET = 'leaked-secret-value';
+      const result = MCPServerUserInputSchema.safeParse({
+        type: 'streamable-http',
+        url: 'https://mcp-server.com/http',
+        oauth: {
+          revocation_endpoint: 'https://attacker.example/revoke?k=${FAKE_SECRET}',
+        },
+      });
+      expect(result.success).toBe(false);
+      delete process.env.FAKE_SECRET;
+    });
   });
 
   describe('proxy field restrictions', () => {
diff --git a/packages/data-provider/specs/request-interceptor.spec.ts b/packages/data-provider/specs/request-interceptor.spec.ts
index b5e43736cce..8de8d541a18 100644
--- a/packages/data-provider/specs/request-interceptor.spec.ts
+++ b/packages/data-provider/specs/request-interceptor.spec.ts
@@ -2,6 +2,7 @@
  * @jest-environment @happy-dom/jest-environment
  */
 import axios from 'axios';
+import type { InternalAxiosRequestConfig } from 'axios';
 import { setTokenHeader } from '../src/headers-helpers';
 
 /**
@@ -20,6 +21,55 @@ const mockAdapter = jest.fn();
 let originalAdapter: typeof axios.defaults.adapter;
 let savedLocation: Location;
 
+type RetryableAdapterConfig = InternalAxiosRequestConfig & { _retry?: boolean };
+
+function createAdapterResponse(config: InternalAxiosRequestConfig, data: unknown = {}) {
+  return Promise.resolve({
+    data,
+    status: 200,
+    headers: {},
+    config,
+  });
+}
+
+function create401Error(config: InternalAxiosRequestConfig) {
+  return Promise.reject({
+    response: { status: 401 },
+    config,
+  });
+}
+
+function getCallsForUrl(urlPart: string) {
+  return mockAdapter.mock.calls.filter(([config]) => config.url?.includes(urlPart) === true);
+}
+
+function createDeferred<T>() {
+  let resolve!: (value: T) => void;
+  let reject!: (reason?: unknown) => void;
+  const promise = new Promise<T>((res, rej) => {
+    resolve = res;
+    reject = rej;
+  });
+  return { promise, resolve, reject };
+}
+
+async function waitForAdapterCall(urlPart: string) {
+  for (let i = 0; i < 10; i++) {
+    if (getCallsForUrl(urlPart).length > 0) {
+      return;
+    }
+    await new Promise((resolve) => setTimeout(resolve, 0));
+  }
+  throw new Error(`Adapter was not called for ${urlPart}`);
+}
+
+function createJwt(expiresAtMs: number) {
+  const payload = Buffer.from(JSON.stringify({ exp: Math.floor(expiresAtMs / 1000) })).toString(
+    'base64url',
+  );
+  return `header.${payload}.signature`;
+}
+
 beforeAll(async () => {
   originalAdapter = axios.defaults.adapter;
   axios.defaults.adapter = mockAdapter;
@@ -38,6 +88,8 @@ afterAll(() => {
 
 afterEach(() => {
   delete axios.defaults.headers.common['Authorization'];
+  window.localStorage.clear();
+  delete (window as Window & { __librechatAuthRecovery?: unknown }).__librechatAuthRecovery;
   Object.defineProperty(window, 'location', {
     value: savedLocation,
     writable: true,
@@ -53,6 +105,27 @@ function setWindowLocation(overrides: Partial<Location>) {
   });
 }
 
+function setTrackedWindowLocation(overrides: Partial<Location>) {
+  let href = overrides.href ?? window.location.href;
+  const hrefWrites: string[] = [];
+  Object.defineProperty(window, 'location', {
+    value: {
+      ...window.location,
+      ...overrides,
+      get href() {
+        return href;
+      },
+      set href(value: string) {
+        hrefWrites.push(value);
+        href = value;
+      },
+    },
+    writable: true,
+    configurable: true,
+  });
+  return hrefWrites;
+}
+
 describe('axios 401 interceptor — Authorization header guard', () => {
   it('skips refresh and rejects when Authorization header is cleared', async () => {
     expect.assertions(1);
@@ -301,4 +374,160 @@ describe('axios 401 interceptor — Authorization header guard', () => {
     const refreshCall = mockAdapter.mock.calls[1];
     expect(refreshCall[0].url).toContain('api/auth/refresh');
   });
+
+  it('coalesces concurrent 401 responses into one refresh and retries with the new token', async () => {
+    expect.assertions(3);
+    setTokenHeader('expired-token');
+
+    mockAdapter.mockImplementation((config: RetryableAdapterConfig) => {
+      if (config.url?.includes('/api/auth/refresh') === true) {
+        return createAdapterResponse(config, { token: 'new-token' });
+      }
+      if (config._retry === true) {
+        return createAdapterResponse(config, { ok: true });
+      }
+      return create401Error(config);
+    });
+
+    const responses = await Promise.all([
+      axios.get('/api/messages'),
+      axios.get('/api/convos'),
+      axios.get('/api/files'),
+    ]);
+
+    expect(responses.map((response) => response.data)).toEqual([
+      { ok: true },
+      { ok: true },
+      { ok: true },
+    ]);
+
+    expect(getCallsForUrl('/api/auth/refresh')).toHaveLength(1);
+    expect(
+      mockAdapter.mock.calls
+        .filter(([config]) => (config as RetryableAdapterConfig)._retry === true)
+        .every(([config]) => config.headers?.Authorization === 'Bearer new-token'),
+    ).toBe(true);
+  });
+
+  it('holds new requests behind an in-flight auth recovery', async () => {
+    expect.assertions(4);
+    setTokenHeader('expired-token');
+    const refresh = createDeferred<string>();
+
+    mockAdapter.mockImplementation((config: RetryableAdapterConfig) => {
+      if (config.url?.includes('/api/auth/refresh') === true) {
+        return refresh.promise.then((token) => createAdapterResponse(config, { token }));
+      }
+      if (config.url === '/api/messages' && config._retry !== true) {
+        return create401Error(config);
+      }
+      return createAdapterResponse(config, { ok: true });
+    });
+
+    const firstRequest = axios.get('/api/messages');
+    await waitForAdapterCall('/api/auth/refresh');
+
+    const secondRequest = axios.get('/api/projects');
+    await Promise.resolve();
+
+    expect(getCallsForUrl('/api/projects')).toHaveLength(0);
+
+    refresh.resolve('new-token');
+    const responses = await Promise.all([firstRequest, secondRequest]);
+    expect(responses.map((response) => response.data)).toEqual([{ ok: true }, { ok: true }]);
+
+    expect(getCallsForUrl('/api/auth/refresh')).toHaveLength(1);
+    expect(getCallsForUrl('/api/projects')[0][0].headers?.Authorization).toBe('Bearer new-token');
+  });
+
+  it('redirects once when a burst of 401s cannot refresh a token', async () => {
+    expect.assertions(3);
+    setTokenHeader('expired-token');
+    const hrefWrites = setTrackedWindowLocation({
+      href: 'http://localhost/c/race',
+      pathname: '/c/race',
+      search: '',
+      hash: '',
+    } as Partial<Location>);
+
+    mockAdapter.mockImplementation((config: InternalAxiosRequestConfig) => {
+      if (config.url?.includes('/api/auth/refresh') === true) {
+        return createAdapterResponse(config, { token: '' });
+      }
+      return create401Error(config);
+    });
+
+    await Promise.allSettled([
+      axios.get('/api/messages'),
+      axios.get('/api/convos'),
+      axios.get('/api/files'),
+    ]);
+
+    expect(getCallsForUrl('/api/auth/refresh')).toHaveLength(1);
+    expect(hrefWrites).toHaveLength(1);
+    expect(hrefWrites[0]).toBe('/login?redirect_to=%2Fc%2Frace');
+  });
+
+  it('keeps redirect deduping when the storage timestamp is corrupted', async () => {
+    expect.assertions(2);
+    setTokenHeader('expired-token');
+    const hrefWrites = setTrackedWindowLocation({
+      href: 'http://localhost/c/race',
+      pathname: '/c/race',
+      search: '',
+      hash: '',
+    } as Partial<Location>);
+
+    mockAdapter.mockImplementation((config: InternalAxiosRequestConfig) => {
+      if (config.url?.includes('/api/auth/refresh') === true) {
+        return createAdapterResponse(config, { token: '' });
+      }
+      return create401Error(config);
+    });
+
+    await axios.get('/api/messages').catch(() => undefined);
+    window.localStorage.setItem('librechat.auth.redirect.startedAt', 'not-a-number');
+    await axios.get('/api/convos').catch(() => undefined);
+
+    expect(getCallsForUrl('/api/auth/refresh')).toHaveLength(1);
+    expect(hrefWrites).toEqual(['/login?redirect_to=%2Fc%2Frace']);
+  });
+
+  it('refreshes a near-expiry bearer token before sending a request', async () => {
+    expect.assertions(4);
+    setTokenHeader(createJwt(Date.now() + 60_000));
+
+    mockAdapter.mockImplementation((config: InternalAxiosRequestConfig) => {
+      if (config.url?.includes('/api/auth/refresh') === true) {
+        return createAdapterResponse(config, { token: 'fresh-token' });
+      }
+      return createAdapterResponse(config, { ok: true });
+    });
+
+    const response = await axios.get('/api/messages');
+
+    expect(response.data).toEqual({ ok: true });
+
+    expect(mockAdapter.mock.calls[0][0].url).toContain('/api/auth/refresh');
+    expect(mockAdapter.mock.calls[1][0].url).toBe('/api/messages');
+    expect(mockAdapter.mock.calls[1][0].headers?.Authorization).toBe('Bearer fresh-token');
+  });
+
+  it('does not wait on the in-flight recovery when the refresh request itself fails', async () => {
+    expect.assertions(3);
+    setTokenHeader(createJwt(Date.now() + 60_000));
+
+    mockAdapter.mockImplementation((config: InternalAxiosRequestConfig) => {
+      if (config.url?.includes('/api/auth/refresh') === true) {
+        return create401Error(config);
+      }
+      return createAdapterResponse(config, { ok: true });
+    });
+
+    const response = await axios.get('/api/messages');
+
+    expect(response.data).toEqual({ ok: true });
+    expect(getCallsForUrl('/api/auth/refresh')).toHaveLength(1);
+    expect(getCallsForUrl('/api/messages')).toHaveLength(1);
+  });
 });
diff --git a/packages/data-provider/src/accessPermissions.ts b/packages/data-provider/src/accessPermissions.ts
index 8047f14b79c..88f6ef954ba 100644
--- a/packages/data-provider/src/accessPermissions.ts
+++ b/packages/data-provider/src/accessPermissions.ts
@@ -48,6 +48,7 @@ export enum ResourceType {
   MCPSERVER = 'mcpServer',
   REMOTE_AGENT = 'remoteAgent',
   SKILL = 'skill',
+  SHARED_LINK = 'sharedLink',
 }
 
 /**
@@ -83,6 +84,8 @@ export enum AccessRoleIds {
   SKILL_VIEWER = 'skill_viewer',
   SKILL_EDITOR = 'skill_editor',
   SKILL_OWNER = 'skill_owner',
+  SHARED_LINK_VIEWER = 'sharedLink_viewer',
+  SHARED_LINK_OWNER = 'sharedLink_owner',
 }
 
 // ===== ZOD SCHEMAS =====
@@ -145,7 +148,7 @@ export const resourcePermissionsResponseSchema = z.object({
 export const updateResourcePermissionsRequestSchema = z.object({
   updated: principalSchema.array(),
   removed: principalSchema.array(),
-  public: z.boolean(),
+  public: z.boolean().optional(),
   publicAccessRoleId: z.string().optional(),
 });
 
@@ -157,7 +160,7 @@ export const updateResourcePermissionsResponseSchema = z.object({
   message: z.string(),
   results: z.object({
     principals: principalSchema.array(),
-    public: z.boolean(),
+    public: z.boolean().optional(),
     publicAccessRoleId: z.string().optional(),
   }),
 });
@@ -322,6 +325,7 @@ export function accessRoleToPermBits(accessRoleId: string): number {
     case AccessRoleIds.MCPSERVER_VIEWER:
     case AccessRoleIds.REMOTE_AGENT_VIEWER:
     case AccessRoleIds.SKILL_VIEWER:
+    case AccessRoleIds.SHARED_LINK_VIEWER:
       return PermissionBits.VIEW;
     case AccessRoleIds.AGENT_EDITOR:
     case AccessRoleIds.PROMPTGROUP_EDITOR:
@@ -334,6 +338,7 @@ export function accessRoleToPermBits(accessRoleId: string): number {
     case AccessRoleIds.MCPSERVER_OWNER:
     case AccessRoleIds.REMOTE_AGENT_OWNER:
     case AccessRoleIds.SKILL_OWNER:
+    case AccessRoleIds.SHARED_LINK_OWNER:
       return (
         PermissionBits.VIEW | PermissionBits.EDIT | PermissionBits.DELETE | PermissionBits.SHARE
       );
diff --git a/packages/data-provider/src/api-endpoints.ts b/packages/data-provider/src/api-endpoints.ts
index 16516888acc..73f45096bcc 100644
--- a/packages/data-provider/src/api-endpoints.ts
+++ b/packages/data-provider/src/api-endpoints.ts
@@ -1,7 +1,7 @@
 import type { StartupConfigContext } from './config';
 import type { AssistantsEndpoint } from './schemas';
-import * as q from './types/queries';
 import { ResourceType } from './accessPermissions';
+import * as q from './types/queries';
 
 let BASE_URL = '';
 if (
@@ -74,13 +74,12 @@ export const shareMessages = (shareId: string) => `${shareRoot}/${shareId}`;
 export const getSharedLink = (conversationId: string) => `${shareRoot}/link/${conversationId}`;
 export const getSharedLinks = (
   pageSize: number,
-  isPublic: boolean,
   sortBy: 'title' | 'createdAt',
   sortDirection: 'asc' | 'desc',
   search?: string,
   cursor?: string,
 ) =>
-  `${shareRoot}?pageSize=${pageSize}&isPublic=${isPublic}&sortBy=${sortBy}&sortDirection=${sortDirection}${
+  `${shareRoot}?pageSize=${pageSize}&sortBy=${sortBy}&sortDirection=${sortDirection}${
     search ? `&search=${search}` : ''
   }${cursor ? `&cursor=${cursor}` : ''}`;
 export const createSharedLink = (conversationId: string) => `${shareRoot}/${conversationId}`;
@@ -127,6 +126,17 @@ export const forkConversation = () => `${conversationsRoot}/fork`;
 
 export const duplicateConversation = () => `${conversationsRoot}/duplicate`;
 
+export const projectsRoot = `${BASE_URL}/api/projects`;
+
+export const projects = (params: q.ProjectListParams = {}) => {
+  return `${projectsRoot}${buildQuery(params)}`;
+};
+
+export const projectById = (id: string) => `${projectsRoot}/${encodeURIComponent(id)}`;
+
+export const projectConversation = (conversationId: string) =>
+  `${projectsRoot}/conversations/${encodeURIComponent(conversationId)}`;
+
 export const search = (q: string, cursor?: string | null) =>
   `${BASE_URL}/api/search?q=${q}${cursor ? `&cursor=${cursor}` : ''}`;
 
@@ -138,6 +148,10 @@ export const deletePreset = () => `${BASE_URL}/api/presets/delete`;
 
 export const aiEndpoints = () => `${BASE_URL}/api/endpoints`;
 
+export const tokenConfig = () => `${BASE_URL}/api/endpoints/token-config`;
+
+export const contextProjection = () => `${BASE_URL}/api/endpoints/context-projection`;
+
 export const models = () => `${BASE_URL}/api/models`;
 
 export const tokenizer = () => `${BASE_URL}/api/tokenizer`;
@@ -394,6 +408,12 @@ export const skillFiles = (id: string) => `${getSkill(id)}/files`;
 export const skillFile = (id: string, relativePath: string) =>
   `${skillFiles(id)}/${encodeURIComponent(relativePath)}`;
 
+export const adminSkillsSync = () => `${BASE_URL}/api/admin/skills/sync`;
+export const adminSkillsSyncStatus = () => `${adminSkillsSync()}/status`;
+export const adminSkillsSyncRun = () => `${adminSkillsSync()}/run`;
+export const adminSkillsSyncCredential = (credentialKey: string) =>
+  `${adminSkillsSync()}/credentials/${encodeURIComponent(credentialKey)}`;
+
 /**
  * Skill filesystem tree (phase 2). URL shape mirrors the original UI PR so
  * the tree hooks keep their call surface. `path` is pre-encoded by the
diff --git a/packages/data-provider/src/bedrock.ts b/packages/data-provider/src/bedrock.ts
index a52da9a26f0..84ec3708dc5 100644
--- a/packages/data-provider/src/bedrock.ts
+++ b/packages/data-provider/src/bedrock.ts
@@ -105,7 +105,13 @@ function parseSonnetVersion(model: string): { major: number; minor: number } | n
   return null;
 }
 
-/** Checks if a model supports adaptive thinking (Opus 4.6+, Sonnet 4.6+) */
+/**
+ * Mythos-class detection (Claude Fable / Mythos) lives in `schemas.ts` as
+ * `isMythosClassModel` — the single source of truth for the family names.
+ * The helpers below OR it in alongside the `opus`/`sonnet` version parsers.
+ */
+
+/** Checks if a model supports adaptive thinking (Opus 4.6+, Sonnet 4.6+, Fable/Mythos) */
 export function supportsAdaptiveThinking(model: string): boolean {
   const opus = parseOpusVersion(model);
   if (opus && (opus.major > 4 || (opus.major === 4 && opus.minor >= 6))) {
@@ -115,6 +121,9 @@ export function supportsAdaptiveThinking(model: string): boolean {
   if (sonnet != null && (sonnet.major > 4 || (sonnet.major === 4 && sonnet.minor >= 6))) {
     return true;
   }
+  if (s.isMythosClassModel(model)) {
+    return true;
+  }
   return false;
 }
 
@@ -133,6 +142,9 @@ export function omitsThinkingByDefault(model: string): boolean {
   if (opus && (opus.major > 4 || (opus.major === 4 && opus.minor >= 7))) {
     return true;
   }
+  if (s.isMythosClassModel(model)) {
+    return true;
+  }
   return false;
 }
 
@@ -141,10 +153,13 @@ export function omitsSamplingParameters(model: string): boolean {
   if (opus && (opus.major > 4 || (opus.major === 4 && opus.minor >= 7))) {
     return true;
   }
+  if (s.isMythosClassModel(model)) {
+    return true;
+  }
   return false;
 }
 
-/** Checks if a model has a 1M context window (Sonnet 4.6+, Opus 4.6+, Opus 5+) */
+/** Checks if a model has a 1M context window (Sonnet 4.6+, Opus 4.6+, Opus 5+, Fable/Mythos) */
 export function supportsContext1m(model: string): boolean {
   const sonnet = parseSonnetVersion(model);
   if (sonnet != null && (sonnet.major > 4 || (sonnet.major === 4 && sonnet.minor >= 6))) {
@@ -154,6 +169,9 @@ export function supportsContext1m(model: string): boolean {
   if (opus && (opus.major > 4 || (opus.major === 4 && opus.minor >= 6))) {
     return true;
   }
+  if (s.isMythosClassModel(model)) {
+    return true;
+  }
   return false;
 }
 
@@ -167,6 +185,8 @@ export function supportsContext1m(model: string): boolean {
 function getBedrockAnthropicBetaHeaders(model: string): string[] {
   const betaHeaders: string[] = [];
 
+  /** Mythos-class (Fable/Mythos) is intentionally not matched: these betas are built-in/no-op for the
+   * 4.7+ generation (Fable has native 128K output), so omitting them on Bedrock is lossless. */
   const isClaude4PlusModel =
     /anthropic\.claude-(?:[4-9](?:\.\d+)?(?:-\d+)?-(?:sonnet|opus|haiku)|(?:sonnet|opus|haiku)-[4-9])/.test(
       model,
@@ -212,6 +232,7 @@ function mergeBedrockAnthropicBetaHeaders(existing: unknown, generated: string[]
 export const bedrockInputSchema = s.tConversationSchema
   .pick({
     /* LibreChat params; optionType: 'conversation' */
+    chatProjectId: true,
     modelLabel: true,
     promptPrefix: true,
     resendFiles: true,
@@ -268,6 +289,7 @@ export type BedrockConverseInput = z.infer<typeof bedrockInputSchema>;
 export const bedrockInputParser = s.tConversationSchema
   .pick({
     /* LibreChat params; optionType: 'conversation' */
+    chatProjectId: true,
     modelLabel: true,
     promptPrefix: true,
     resendFiles: true,
@@ -297,6 +319,7 @@ export const bedrockInputParser = s.tConversationSchema
   .catchall(z.any())
   .transform((data) => {
     const knownKeys = [
+      'chatProjectId',
       'modelLabel',
       'promptPrefix',
       'resendFiles',
@@ -331,13 +354,14 @@ export const bedrockInputParser = s.tConversationSchema
       }
     });
 
-    /** Default thinking and thinkingBudget for 'anthropic.claude-3-7-sonnet' models, if not defined */
+    /** Configure thinking for Bedrock Anthropic models: 3.7 Sonnet, Claude 4+ (opus/sonnet/haiku), and Mythos-class (Fable/Mythos). */
     if (
       typeof typedData.model === 'string' &&
       (typedData.model.includes('anthropic.claude-3-7-sonnet') ||
         /anthropic\.claude-(?:[4-9](?:\.\d+)?(?:-\d+)?-(?:sonnet|opus|haiku)|(?:sonnet|opus|haiku)-[4-9])/.test(
           typedData.model,
-        ))
+        ) ||
+        s.isMythosClassModel(typedData.model))
     ) {
       const isAdaptive = supportsAdaptiveThinking(typedData.model as string);
 
diff --git a/packages/data-provider/src/config.ts b/packages/data-provider/src/config.ts
index f6d0d0272c0..cbf91b72446 100644
--- a/packages/data-provider/src/config.ts
+++ b/packages/data-provider/src/config.ts
@@ -10,14 +10,17 @@ import {
 } from './schemas';
 import { ComponentTypes, SettingTypes, OptionTypes } from './generate';
 import { specsConfigSchema, TSpecsConfig } from './models';
+import { REFILL_INTERVAL_UNITS } from './balance';
 import { fileConfigSchema } from './file-config';
 import { apiBaseUrl } from './api-endpoints';
 import { FileSources } from './types/files';
 import { MCPServersSchema } from './mcp';
-import { REFILL_INTERVAL_UNITS } from './balance';
+export { MAX_SUBAGENTS } from './limits';
 
 export const defaultSocialLogins = ['google', 'facebook', 'openid', 'github', 'discord', 'saml'];
 
+export const BASE_ONLY_CONFIG_SECTIONS = [] as const;
+
 export const defaultRetrievalModels = [
   'gpt-4o',
   'o1-preview-2024-09-12',
@@ -63,6 +66,7 @@ export const excludedKeys = new Set([
   'files',
   'spec',
   'disableParams',
+  'chatProjectId',
 ]);
 
 export enum SettingsViews {
@@ -242,6 +246,192 @@ export const cloudfrontConfigSchema = z
 
 export type CloudFrontConfig = z.infer<typeof cloudfrontConfigSchema>;
 
+const skillSyncIdentifierSchema = z
+  .string()
+  .min(1)
+  .max(64)
+  .regex(/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/, {
+    message:
+      'must start with a letter or digit and contain only letters, digits, underscores, or hyphens',
+  });
+
+export const SKILL_SYNC_MIN_INTERVAL_MINUTES = 5;
+export const SKILL_SYNC_MAX_INTERVAL_MINUTES = Math.floor(2147483647 / 60_000);
+export const SKILL_SYNC_DEFAULT_DISCOVERY_DEPTH = 2;
+export const SKILL_SYNC_MAX_DISCOVERY_DEPTH = 10;
+
+const skillSyncGitHubOwnerSchema = z
+  .string()
+  .min(1)
+  .max(39)
+  .regex(/^[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?$/, {
+    message: 'must be a valid GitHub owner name',
+  });
+
+const skillSyncGitHubRepoSchema = z
+  .string()
+  .min(1)
+  .max(100)
+  .regex(/^[a-zA-Z0-9._-]+$/, {
+    message: 'must be a valid GitHub repository name',
+  });
+
+const invalidGitRefChars = new Set(['~', '^', ':', '?', '*', '[']);
+
+function hasInvalidGitRefCharacter(value: string): boolean {
+  for (const char of value) {
+    const code = char.charCodeAt(0);
+    if (code <= 32 || code === 127 || invalidGitRefChars.has(char)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+const skillSyncGitHubRefSchema = z
+  .string()
+  .min(1)
+  .max(255)
+  .refine((value) => !value.startsWith('/') && !value.endsWith('/'), {
+    message: 'must not start or end with a slash',
+  })
+  .refine((value) => !value.includes('..') && !value.includes('//') && !value.includes('\\'), {
+    message: 'must not contain traversal segments, empty path segments, or backslashes',
+  })
+  .refine((value) => !value.includes('@{') && value !== '@', {
+    message: 'must not contain invalid Git ref syntax',
+  })
+  .refine((value) => !value.endsWith('.'), {
+    message: 'must not end with a dot',
+  })
+  .refine((value) => !hasInvalidGitRefCharacter(value), {
+    message: 'must not contain invalid Git ref characters',
+  })
+  .refine(
+    (value) =>
+      value
+        .split('/')
+        .every((segment) => segment && !segment.startsWith('.') && !segment.endsWith('.lock')),
+    {
+      message: 'must contain valid Git ref path segments',
+    },
+  );
+
+const skillSyncPathSchema = z
+  .string()
+  .max(500)
+  .refine((value) => value.trim().length > 0, { message: 'must not be empty' })
+  .transform((value) => {
+    const trimmed = value.trim().replace(/^\/+|\/+$/g, '');
+    return trimmed === '.' ? '' : trimmed;
+  })
+  .refine((value) => !value.includes('\\') && !value.includes('..'), {
+    message: 'must not contain traversal segments or backslashes',
+  })
+  .refine((value) => value === '' || /^[a-zA-Z0-9._\-/]+$/.test(value), {
+    message: 'must contain only letters, digits, dots, underscores, hyphens, and slashes',
+  })
+  .refine(
+    (value) =>
+      value === '' || value.split('/').every((segment) => segment.length > 0 && segment !== '.'),
+    {
+      message: 'must not contain empty or dot path segments',
+    },
+  );
+
+const skillSyncTokenReferenceSchema = z
+  .string()
+  .trim()
+  .regex(/^\$\{[A-Za-z_][A-Za-z0-9_]*\}$/, {
+    message: 'must be an environment variable reference like ${GITHUB_SKILLS_TOKEN}',
+  });
+
+/**
+ * Tenant that owns the skills mirrored from a source. When set, the sync runner
+ * executes that source's database writes inside the tenant's async context so
+ * synced skills are created, listed, and shared within the tenant under strict
+ * tenant isolation. Mirrors the request tenant-id contract: no reserved system id.
+ */
+const skillSyncTenantIdSchema = z
+  .string()
+  .max(128)
+  .refine((value) => /^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(value), {
+    message: 'must be a valid tenant id',
+  })
+  .refine((value) => value !== '__SYSTEM__', {
+    message: 'must not be the reserved system tenant id',
+  });
+
+export const skillSyncGitHubSourceSchema = z
+  .object({
+    id: skillSyncIdentifierSchema,
+    owner: skillSyncGitHubOwnerSchema,
+    repo: skillSyncGitHubRepoSchema,
+    ref: skillSyncGitHubRefSchema.default('main'),
+    paths: z.array(skillSyncPathSchema).min(1),
+    skillDiscoveryDepth: z.number().int().min(0).max(SKILL_SYNC_MAX_DISCOVERY_DEPTH).optional(),
+    credentialKey: skillSyncIdentifierSchema.optional(),
+    token: skillSyncTokenReferenceSchema.optional(),
+    tenantId: skillSyncTenantIdSchema.optional(),
+  })
+  .superRefine((source, ctx) => {
+    if (!source.credentialKey && !source.token) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ['credentialKey'],
+        message: 'Either credentialKey or token is required',
+      });
+    }
+    if (source.credentialKey && source.token) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ['token'],
+        message: 'Use either credentialKey or token, not both',
+      });
+    }
+  });
+
+export const skillSyncConfigSchema = z
+  .object({
+    github: z
+      .object({
+        enabled: z.boolean().default(false),
+        intervalMinutes: z
+          .number()
+          .int()
+          .min(SKILL_SYNC_MIN_INTERVAL_MINUTES)
+          .max(SKILL_SYNC_MAX_INTERVAL_MINUTES)
+          .default(60),
+        runOnStartup: z.boolean().default(false),
+        sources: z.array(skillSyncGitHubSourceSchema).default([]),
+      })
+      .superRefine((github, ctx) => {
+        if (github.enabled && github.sources.length === 0) {
+          ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ['sources'],
+            message: 'At least one GitHub source is required when skill sync is enabled',
+          });
+        }
+        const seen = new Set<string>();
+        for (const source of github.sources) {
+          if (seen.has(source.id)) {
+            ctx.addIssue({
+              code: z.ZodIssueCode.custom,
+              path: ['sources'],
+              message: `Duplicate GitHub skill sync source id "${source.id}"`,
+            });
+          }
+          seen.add(source.id);
+        }
+      })
+      .optional(),
+  })
+  .optional();
+
+export type SkillSyncConfig = z.infer<typeof skillSyncConfigSchema>;
+export type SkillSyncGitHubSourceConfig = z.infer<typeof skillSyncGitHubSourceSchema>;
+
 // Helper type to extract the shape of the Zod object schema
 type SchemaShape<T> = T extends z.ZodObject<infer U> ? U : never;
 
@@ -396,6 +586,15 @@ export const defaultAssistantsVersion = {
 export const baseEndpointSchema = z.object({
   streamRate: z.number().optional(),
   baseURL: z.string().optional(),
+  /**
+   * Custom request headers forwarded to the provider on every request. Values
+   * support the same placeholder resolution as custom endpoints — env vars
+   * (`${VAR}`), user fields (`{{LIBRECHAT_USER_*}}`), and request-body fields
+   * (`{{LIBRECHAT_BODY_CONVERSATIONID}}`). Primarily for routing built-in
+   * providers through an AI gateway / reverse proxy that consumes metadata
+   * headers (provider-native request shaping is preserved).
+   */
+  headers: z.record(z.string()).optional(),
   titlePrompt: z.string().optional(),
   titleModel: z.string().optional(),
   titleConvo: z.boolean().optional(),
@@ -573,6 +772,11 @@ export const agentsEndpointSchema = baseEndpointSchema
         .array(z.nativeEnum(AgentCapabilities))
         .optional()
         .default(defaultAgentCapabilities),
+      skills: z
+        .object({
+          maxCatalogSkills: z.number().int().min(1).max(100).optional(),
+        })
+        .optional(),
       remoteApi: remoteApiSchema.optional(),
     }),
   )
@@ -639,6 +843,14 @@ export const endpointSchema = baseEndpointSchema.merge(
     }),
     iconURL: z.string().optional(),
     modelDisplayLabel: z.string().optional(),
+    /**
+     * Forces the endpoint to use a provider's native client / request format
+     * instead of the default OpenAI-compatible client. Currently supports
+     * `anthropic`, for endpoints that speak the Anthropic `/v1/messages` API
+     * (Anthropic itself or Anthropic-compatible gateways). Omit for
+     * OpenAI-compatible endpoints.
+     */
+    provider: z.literal(EModelEndpoint.anthropic).optional(),
     headers: z.record(z.string()).optional(),
     addParams: addParamsSchema.optional(),
     dropParams: z.array(z.string()).optional(),
@@ -653,6 +865,18 @@ export const endpointSchema = baseEndpointSchema.merge(
       .optional(),
     directEndpoint: z.boolean().optional(),
     titleMessageRole: z.enum(['system', 'user', 'assistant']).optional(),
+    /** Static per-model token config: context window and per-million-token rates */
+    tokenConfig: z
+      .record(
+        z.object({
+          prompt: z.number(),
+          completion: z.number(),
+          context: z.number(),
+          cacheRead: z.number().optional(),
+          cacheWrite: z.number().optional(),
+        }),
+      )
+      .optional(),
   }),
 );
 
@@ -974,6 +1198,14 @@ export const interfaceSchema = z
     retainAgentFiles: z.boolean().optional(),
     runCode: z.boolean().optional(),
     webSearch: z.boolean().optional(),
+    contextUsage: z.boolean().optional(),
+    contextCost: z.boolean().optional(),
+    currency: z
+      .object({
+        code: z.string(),
+        rate: z.number().positive(),
+      })
+      .optional(),
     peoplePicker: z
       .object({
         users: z.boolean().optional(),
@@ -1009,6 +1241,16 @@ export const interfaceSchema = z
         }),
       ])
       .optional(),
+    sharedLinks: z
+      .union([
+        z.boolean(),
+        z.object({
+          create: z.boolean().optional(),
+          share: z.boolean().optional(),
+          public: z.boolean().optional(),
+        }),
+      ])
+      .optional(),
   })
   .default({
     modelSelect: true,
@@ -1033,6 +1275,8 @@ export const interfaceSchema = z
     autoSubmitFromUrl: true,
     runCode: true,
     webSearch: true,
+    contextUsage: true,
+    contextCost: false,
     peoplePicker: {
       users: true,
       groups: true,
@@ -1063,6 +1307,11 @@ export const interfaceSchema = z
       public: false,
       defaultActiveOnShare: false,
     },
+    sharedLinks: {
+      create: true,
+      share: true,
+      public: true,
+    },
   });
 
 export type TInterfaceConfig = z.infer<typeof interfaceSchema>;
@@ -1334,11 +1583,14 @@ export const transactionsSchema = z.object({
   enabled: z.boolean().optional().default(true),
 });
 
+export const DEFAULT_MEMORY_MAX_INPUT_TOKENS = 12000;
+
 export const memorySchema = z.object({
   disabled: z.boolean().optional(),
   validKeys: z.array(z.string()).optional(),
   tokenLimit: z.number().optional(),
   charLimit: z.number().optional().default(10000),
+  maxInputTokens: z.number().int().positive().optional().default(DEFAULT_MEMORY_MAX_INPUT_TOKENS),
   personalize: z.boolean().default(true),
   messageWindowSize: z.number().optional().default(5),
   agent: z
@@ -1400,6 +1652,38 @@ export type SummarizationConfig = z.infer<typeof summarizationConfigSchema>;
 
 const customEndpointsSchema = z.array(endpointSchema.partial()).optional();
 
+const messageFilterPiiCustomPatternSchema = z.object({
+  id: z.string().min(1),
+  label: z.string().min(1),
+  regex: z
+    .string()
+    .min(1)
+    .refine(
+      (value) => {
+        try {
+          new RegExp(value, 'g');
+          return true;
+        } catch {
+          return false;
+        }
+      },
+      { message: 'Invalid regex' },
+    ),
+});
+
+export const messageFilterPiiSchema = z.object({
+  starterPatterns: z.array(z.string()).optional(),
+  customPatterns: z.array(messageFilterPiiCustomPatternSchema).optional(),
+});
+
+export type MessageFilterPiiConfig = z.infer<typeof messageFilterPiiSchema>;
+
+export const messageFilterSchema = z.object({
+  pii: messageFilterPiiSchema.optional(),
+});
+
+export type MessageFilterConfig = z.infer<typeof messageFilterSchema>;
+
 export const configSchema = z.object({
   version: z.string(),
   cache: z.boolean().default(true),
@@ -1407,6 +1691,7 @@ export const configSchema = z.object({
   webSearch: webSearchSchema.optional(),
   memory: memorySchema.optional(),
   summarization: summarizationConfigSchema.optional(),
+  skillSync: skillSyncConfigSchema,
   secureImageLinks: z.boolean().optional(),
   imageOutputType: z.nativeEnum(EImageOutputType).default(EImageOutputType.PNG),
   includedTools: z.array(z.string()).optional(),
@@ -1447,6 +1732,7 @@ export const configSchema = z.object({
   rateLimits: rateLimitSchema.optional(),
   fileConfig: fileConfigSchema.optional(),
   modelSpecs: specsConfigSchema.optional(),
+  messageFilter: messageFilterSchema.optional(),
   endpoints: z
     .object({
       allowedAddresses: allowedAddressesSchema,
@@ -1555,43 +1841,31 @@ export const alternateName = {
 };
 
 const sharedOpenAIModels = [
+  'gpt-5.5',
+  'gpt-5.5-pro',
+  'chat-latest',
   'gpt-5.4',
-  // TODO: gpt-5.4-thinking may have separate reasoning token pricing — verify before release
-  'gpt-5.4-thinking',
   'gpt-5.4-pro',
+  'gpt-5.4-mini',
+  'gpt-5.4-nano',
+  'gpt-5.3-codex',
+  'gpt-5.2',
   'gpt-5.1',
-  'gpt-5.1-chat-latest',
   'gpt-5.1-codex',
+  'gpt-5.1-codex-max',
   'gpt-5.1-codex-mini',
   'gpt-5',
   'gpt-5-mini',
   'gpt-5-nano',
-  'gpt-5-chat-latest',
   'gpt-4.1',
   'gpt-4.1-mini',
   'gpt-4.1-nano',
   'gpt-4o-mini',
   'gpt-4o',
-  'gpt-4.5-preview',
-  'gpt-4.5-preview-2025-02-27',
-  'gpt-3.5-turbo',
-  'gpt-3.5-turbo-0125',
-  'gpt-4-turbo',
-  'gpt-4-turbo-2024-04-09',
-  'gpt-4-0125-preview',
-  'gpt-4-turbo-preview',
-  'gpt-4-1106-preview',
-  'gpt-3.5-turbo-1106',
-  'gpt-3.5-turbo-16k-0613',
-  'gpt-3.5-turbo-16k',
-  'gpt-4',
-  'gpt-4-0314',
-  'gpt-4-32k-0314',
-  'gpt-4-0613',
-  'gpt-3.5-turbo-0613',
 ];
 
 const sharedAnthropicModels = [
+  'claude-fable-5',
   'claude-opus-4-8',
   'claude-opus-4-7',
   'claude-sonnet-4-6',
@@ -1616,6 +1890,7 @@ const sharedAnthropicModels = [
 ];
 
 export const bedrockModels = [
+  'anthropic.claude-fable-5',
   'anthropic.claude-opus-4-8',
   'anthropic.claude-opus-4-7',
   'anthropic.claude-sonnet-4-6',
@@ -2215,7 +2490,7 @@ export enum Constants {
    */
   VERSION = '__LIBRECHAT_VERSION__',
   /** Key for the Custom Config's version (librechat.yaml). */
-  CONFIG_VERSION = '1.3.12',
+  CONFIG_VERSION = '1.3.13',
   /** Standard value for the first message's `parentMessageId` value, to indicate no parent exists. */
   NO_PARENT = '00000000-0000-0000-0000-000000000000',
   /** Standard value to use whatever the submission prelim. `responseMessageId` is */
@@ -2269,9 +2544,6 @@ export enum Constants {
   SUBAGENT = 'subagent',
 }
 
-/** Maximum number of explicit subagents per parent agent. UI + Zod schema share this. */
-export const MAX_SUBAGENTS = 10;
-
 /** Maximum explicit subagent hops allowed from any root agent at runtime. */
 export const MAX_SUBAGENT_DEPTH = 5;
 
diff --git a/packages/data-provider/src/data-service.ts b/packages/data-provider/src/data-service.ts
index 732d5041fee..d9fa692cec1 100644
--- a/packages/data-provider/src/data-service.ts
+++ b/packages/data-provider/src/data-service.ts
@@ -1,18 +1,20 @@
 import type { AxiosResponse } from 'axios';
+import type { TContextProjectionRequest, TContextUsageEvent } from './types/runs';
+import type { TFileConfig } from './file-config';
 import type * as t from './types';
+import * as permissions from './accessPermissions';
 import * as endpoints from './api-endpoints';
+import * as mcp from './types/mcpServers';
 import * as a from './types/assistants';
-import * as ag from './types/agents';
 import * as m from './types/mutations';
+import * as ag from './types/agents';
 import * as q from './types/queries';
-import * as f from './types/files';
 import * as sk from './types/skills';
-import * as mcp from './types/mcpServers';
+import * as f from './types/files';
 import * as config from './config';
 import request from './request';
 import * as s from './schemas';
 import * as r from './roles';
-import * as permissions from './accessPermissions';
 
 export function revokeUserKey(name: string): Promise<unknown> {
   return request.delete(endpoints.revokeUserKey(name));
@@ -65,11 +67,9 @@ export function getSharedMessages(shareId: string): Promise<t.TSharedMessagesRes
 export const listSharedLinks = async (
   params: q.SharedLinksListParams,
 ): Promise<q.SharedLinksResponse> => {
-  const { pageSize, isPublic, sortBy, sortDirection, search, cursor } = params;
+  const { pageSize, sortBy, sortDirection, search, cursor } = params;
 
-  return request.get(
-    endpoints.getSharedLinks(pageSize, isPublic, sortBy, sortDirection, search, cursor),
-  );
+  return request.get(endpoints.getSharedLinks(pageSize, sortBy, sortDirection, search, cursor));
 };
 
 export function getSharedLink(conversationId: string): Promise<t.TSharedLinkGetResponse> {
@@ -246,6 +246,16 @@ export const getAIEndpoints = (): Promise<t.TEndpointsConfig> => {
   return request.get(endpoints.aiEndpoints());
 };
 
+export const getTokenConfig = (): Promise<t.TTokenConfigMap> => {
+  return request.get(endpoints.tokenConfig());
+};
+
+export const getContextProjection = (
+  payload: TContextProjectionRequest,
+): Promise<TContextUsageEvent | null> => {
+  return request.post(endpoints.contextProjection(), payload);
+};
+
 export const getModels = async (): Promise<t.TModelsConfig> => {
   return request.get(endpoints.models());
 };
@@ -431,7 +441,7 @@ export const getAgentFiles = (agentId: string): Promise<f.TFile[]> => {
   return request.get(endpoints.agentFiles(agentId));
 };
 
-export const getFileConfig = (): Promise<f.FileConfig> => {
+export const getFileConfig = (): Promise<TFileConfig> => {
   return request.get(`${endpoints.files()}/config`);
 };
 
@@ -796,6 +806,34 @@ export function archiveConversation(
   return request.post(endpoints.archiveConversation(), { arg: payload });
 }
 
+export function listProjects(params?: q.ProjectListParams): Promise<q.ProjectListResponse> {
+  return request.get(endpoints.projects(params ?? {}));
+}
+
+export function createProject(payload: t.TCreateChatProjectRequest): Promise<t.TChatProject> {
+  return request.post(endpoints.projects(), payload);
+}
+
+export function getProjectById(projectId: string): Promise<t.TChatProject> {
+  return request.get(endpoints.projectById(projectId));
+}
+
+export function updateProject(payload: t.TUpdateChatProjectRequest): Promise<t.TChatProject> {
+  const { projectId, ...data } = payload;
+  return request.patch(endpoints.projectById(projectId), data);
+}
+
+export function deleteProject(projectId: string): Promise<t.TDeleteChatProjectResponse> {
+  return request.delete(endpoints.projectById(projectId));
+}
+
+export function assignConversationToProject(
+  payload: t.TAssignConversationToProjectRequest,
+): Promise<t.TAssignConversationToProjectResponse> {
+  const { conversationId, projectId } = payload;
+  return request.put(endpoints.projectConversation(conversationId), { projectId });
+}
+
 export function genTitle(payload: m.TGenTitleRequest): Promise<m.TGenTitleResponse> {
   return request.get(endpoints.genTitle(payload.conversationId));
 }
@@ -1053,6 +1091,29 @@ export const updateSkillNodeContent = (variables: {
   });
 };
 
+export function getGitHubSkillSyncStatus(): Promise<sk.TGitHubSkillSyncStatusResponse> {
+  return request.get(endpoints.adminSkillsSyncStatus());
+}
+
+export function runGitHubSkillSync(): Promise<sk.TGitHubSkillSyncManualRunResponse> {
+  return request.post(endpoints.adminSkillsSyncRun());
+}
+
+export function setGitHubSkillSyncCredential(variables: {
+  credentialKey: string;
+  token: string;
+}): Promise<sk.TGitHubSkillSyncCredentialSummary> {
+  return request.put(endpoints.adminSkillsSyncCredential(variables.credentialKey), {
+    token: variables.token,
+  } satisfies sk.TGitHubSkillSyncCredentialUpdateRequest);
+}
+
+export function deleteGitHubSkillSyncCredential(
+  credentialKey: string,
+): Promise<{ credentialKey: string; deleted: boolean }> {
+  return request.delete(endpoints.adminSkillsSyncCredential(credentialKey));
+}
+
 /* Roles */
 export function listRoles(): Promise<q.ListRolesResponse> {
   return request.get(`${endpoints.adminRoles()}?limit=200`);
diff --git a/packages/data-provider/src/file-config.spec.ts b/packages/data-provider/src/file-config.spec.ts
index f5973538762..b564f5a9137 100644
--- a/packages/data-provider/src/file-config.spec.ts
+++ b/packages/data-provider/src/file-config.spec.ts
@@ -23,6 +23,10 @@ describe('inferMimeType', () => {
     expect(inferMimeType('test.md', 'text/x-markdown')).toBe('text/markdown');
   });
 
+  it('should normalize application/x-zip-compressed to application/zip', () => {
+    expect(inferMimeType('archive.zip', 'application/x-zip-compressed')).toBe('application/zip');
+  });
+
   it('should return a type that matches textMimeTypes after normalization', () => {
     const normalized = inferMimeType('test.py', 'text/x-python-script');
     expect(textMimeTypes.test(normalized)).toBe(true);
@@ -36,6 +40,7 @@ describe('inferMimeType', () => {
   it('should infer from extension when browser type is empty', () => {
     expect(inferMimeType('test.py', '')).toBe('text/x-python');
     expect(inferMimeType('code.js', '')).toBe('text/javascript');
+    expect(inferMimeType('archive.zip', '')).toBe('application/zip');
     expect(inferMimeType('photo.heic', '')).toBe('image/heic');
     expect(inferMimeType('Main.java', '')).toBe('text/x-java');
   });
@@ -82,6 +87,7 @@ describe('applicationMimeTypes', () => {
     'application/msword',
     'application/xml',
     'application/zip',
+    'application/x-zip-compressed',
     'application/epub+zip',
     'application/x-tar',
     'application/x-sh',
diff --git a/packages/data-provider/src/file-config.ts b/packages/data-provider/src/file-config.ts
index 457c4950ccd..06f6b4806d3 100644
--- a/packages/data-provider/src/file-config.ts
+++ b/packages/data-provider/src/file-config.ts
@@ -61,6 +61,7 @@ export const fullMimeTypesList = [
   'application/vnd.coffeescript',
   'application/xml',
   'application/zip',
+  'application/x-zip-compressed',
   'application/x-parquet',
   'application/vnd.oasis.opendocument.text',
   'application/vnd.oasis.opendocument.spreadsheet',
@@ -121,6 +122,7 @@ export const codeInterpreterMimeTypesList = [
   'application/typescript',
   'application/xml',
   'application/zip',
+  'application/x-zip-compressed',
   'application/x-parquet',
   ...excelFileTypes,
 ];
@@ -185,7 +187,7 @@ export const textMimeTypes =
   /^(text\/(x-c|x-csharp|tab-separated-values|x-c\+\+|x-h|x-java|html|markdown|x-php|x-python|x-script\.python|x-ruby|x-tex|plain|css|vtt|javascript|csv|xml|calendar))$/;
 
 export const applicationMimeTypes =
-  /^(application\/(epub\+zip|csv|json|msword|pdf|x-tar|x-sh|typescript|sql|yaml|x-parquet|vnd\.apache\.parquet|vnd\.coffeescript|vnd\.openxmlformats-officedocument\.(wordprocessingml\.document|presentationml\.presentation|spreadsheetml\.sheet)|vnd\.oasis\.opendocument\.(text|spreadsheet|presentation|graphics)|xml|zip))$/;
+  /^(application\/(epub\+zip|csv|json|msword|pdf|x-tar|x-sh|x-zip-compressed|typescript|sql|yaml|x-parquet|vnd\.apache\.parquet|vnd\.coffeescript|vnd\.openxmlformats-officedocument\.(wordprocessingml\.document|presentationml\.presentation|spreadsheetml\.sheet)|vnd\.oasis\.opendocument\.(text|spreadsheet|presentation|graphics)|xml|zip))$/;
 
 export const imageMimeTypes = /^image\/(jpeg|gif|png|webp|heic|heif)$/;
 
@@ -367,6 +369,7 @@ export const imageTypeMapping: { [key: string]: string } = {
 
 /** Normalizes non-standard MIME types that browsers may report to their canonical forms */
 export const mimeTypeAliases: Readonly<Record<string, string>> = {
+  'application/x-zip-compressed': 'application/zip',
   'text/x-python-script': 'text/x-python',
   'text/x-markdown': 'text/markdown',
 };
diff --git a/packages/data-provider/src/keys.ts b/packages/data-provider/src/keys.ts
index 36f42866175..0f15a7d05f0 100644
--- a/packages/data-provider/src/keys.ts
+++ b/packages/data-provider/src/keys.ts
@@ -12,6 +12,8 @@ export enum QueryKeys {
   models = 'models',
   balance = 'balance',
   endpoints = 'endpoints',
+  tokenConfig = 'tokenConfig',
+  contextProjection = 'contextProjection',
   presets = 'presets',
   searchResults = 'searchResults',
   tokenCount = 'tokenCount',
@@ -42,6 +44,9 @@ export enum QueryKeys {
   promptGroups = 'promptGroups',
   allPromptGroups = 'allPromptGroups',
   promptGroup = 'promptGroup',
+  projects = 'projects',
+  project = 'project',
+  projectConversations = 'projectConversations',
   categories = 'categories',
   randomPrompts = 'randomPrompts',
   agentCategories = 'agentCategories',
@@ -112,6 +117,10 @@ export enum MutationKeys {
   enableTwoFactor = 'enableTwoFactor',
   verifyTwoFactor = 'verifyTwoFactor',
   updateMemoryPreferences = 'updateMemoryPreferences',
+  createProject = 'createProject',
+  updateProject = 'updateProject',
+  deleteProject = 'deleteProject',
+  assignConversationToProject = 'assignConversationToProject',
   /* Skill mutations from the original UI PR — tree/node operations are
    * phase 2 and currently stubbed in the data-service layer. */
   createSkillNode = 'createSkillNode',
diff --git a/packages/data-provider/src/limits.ts b/packages/data-provider/src/limits.ts
new file mode 100644
index 00000000000..7dbabf6d2ce
--- /dev/null
+++ b/packages/data-provider/src/limits.ts
@@ -0,0 +1,2 @@
+/** Maximum number of explicit subagents per parent agent. UI + Zod schema share this. */
+export const MAX_SUBAGENTS = 10;
diff --git a/packages/data-provider/src/mcp.ts b/packages/data-provider/src/mcp.ts
index 430cd4332b0..bf9953d51c6 100644
--- a/packages/data-provider/src/mcp.ts
+++ b/packages/data-provider/src/mcp.ts
@@ -30,9 +30,17 @@ const validateOAuthClientCredentials = (
 
 const OAuthOptionsBaseSchema = z.object({
   /** OAuth authorization endpoint (optional - can be auto-discovered) */
-  authorization_url: z.string().url().optional(),
+  authorization_url: z
+    .string()
+    .transform((val) => extractEnvVariable(val))
+    .pipe(z.string().url())
+    .optional(),
   /** OAuth token endpoint (optional - can be auto-discovered) */
-  token_url: z.string().url().optional(),
+  token_url: z
+    .string()
+    .transform((val) => extractEnvVariable(val))
+    .pipe(z.string().url())
+    .optional(),
   /** OAuth client ID (optional - can use dynamic registration) */
   client_id: z.string().optional(),
   /** OAuth client secret (requires explicit authorization and token endpoints) */
@@ -40,7 +48,11 @@ const OAuthOptionsBaseSchema = z.object({
   /** OAuth scopes to request */
   scope: z.string().optional(),
   /** OAuth redirect URI (defaults to /api/mcp/{serverName}/oauth/callback) */
-  redirect_uri: z.string().url().optional(),
+  redirect_uri: z
+    .string()
+    .transform((val) => extractEnvVariable(val))
+    .pipe(z.string().url())
+    .optional(),
   /** Token exchange method */
   token_exchange_method: z.nativeEnum(TokenExchangeMethodEnum).optional(),
   /** Supported grant types (defaults to ['authorization_code', 'refresh_token']) */
@@ -91,7 +103,11 @@ const OAuthOptionsBaseSchema = z.object({
    */
   forward_audience_on_refresh: z.boolean().optional(),
   /** OAuth revocation endpoint (optional - can be auto-discovered) */
-  revocation_endpoint: z.string().url().optional(),
+  revocation_endpoint: z
+    .string()
+    .transform((val) => extractEnvVariable(val))
+    .pipe(z.string().url())
+    .optional(),
   /** OAuth revocation endpoint authentication methods supported (optional - can be auto-discovered) */
   revocation_endpoint_auth_methods_supported: z.array(z.string()).optional(),
 });
@@ -99,10 +115,14 @@ const OAuthOptionsBaseSchema = z.object({
 const OAuthOptionsSchema = OAuthOptionsBaseSchema.superRefine(validateOAuthClientCredentials);
 
 const BLOCKED_USER_OAUTH_ENDPOINT_PARAMS = ['audience', 'resource'] as const;
+const envVarPattern = /\$\{[^}]+\}/;
 
 const userOAuthEndpointUrlSchema = z
   .string()
-  .url()
+  .refine((val) => !envVarPattern.test(val), {
+    message: 'Environment variable references are not allowed in URLs',
+  })
+  .pipe(z.string().url())
   .refine(
     (value) => {
       try {
@@ -122,6 +142,8 @@ const UserOAuthOptionsSchema = OAuthOptionsBaseSchema.omit({
   .extend({
     authorization_url: userOAuthEndpointUrlSchema.optional(),
     token_url: userOAuthEndpointUrlSchema.optional(),
+    redirect_uri: userOAuthEndpointUrlSchema.optional(),
+    revocation_endpoint: userOAuthEndpointUrlSchema.optional(),
     audience: z.never().optional(),
     forward_audience_on_refresh: z.never().optional(),
   })
@@ -374,7 +396,6 @@ const userManagedServerFields = <T extends z.ZodObject<z.ZodRawShape>>(schema: T
     oauth: UserOAuthOptionsSchema.optional(),
   });
 
-const envVarPattern = /\$\{[^}]+\}/;
 const isWsProtocol = (val: string): boolean => /^wss?:/i.test(val);
 const isHttpProtocol = (val: string): boolean => /^https?:/i.test(val);
 
diff --git a/packages/data-provider/src/models.ts b/packages/data-provider/src/models.ts
index 85f455fe170..b34d51feb3f 100644
--- a/packages/data-provider/src/models.ts
+++ b/packages/data-provider/src/models.ts
@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import type { AgentSubagentsConfig } from './types/assistants';
 import type { TModelSpecPreset } from './schemas';
 import {
   EModelEndpoint,
@@ -7,6 +8,7 @@ import {
   AuthType,
   authTypeSchema,
 } from './schemas';
+import { MAX_SUBAGENTS } from './limits';
 
 export type TModelSpec = {
   name: string;
@@ -14,6 +16,7 @@ export type TModelSpec = {
   preset: TModelSpecPreset;
   order?: number;
   default?: boolean;
+  softDefault?: boolean;
   description?: string;
   /**
    * Optional group name for organizing specs in the UI selector.
@@ -30,6 +33,10 @@ export type TModelSpec = {
   groupIcon?: string | EModelEndpoint;
   showIconInMenu?: boolean;
   showIconInHeader?: boolean;
+  /** Show this spec's label and description on the chat landing in place of the greeting. */
+  showOnLanding?: boolean;
+  /** Conversation starter prompts shown on the chat landing while this spec is active. */
+  conversation_starters?: string[];
   iconURL?: string | EModelEndpoint; // Allow using project-included icons
   authType?: AuthType;
   /** Hide the chat input tool badge row while this model spec is active. */
@@ -39,19 +46,30 @@ export type TModelSpec = {
   executeCode?: boolean;
   artifacts?: string | boolean;
   mcpServers?: string[];
+  skills?: boolean | string[];
+  subagents?: AgentSubagentsConfig;
 };
 
+export const modelSpecSubagentsSchema = z.object({
+  enabled: z.boolean().optional(),
+  allowSelf: z.boolean().optional(),
+  agent_ids: z.array(z.string()).max(MAX_SUBAGENTS).optional(),
+});
+
 export const tModelSpecSchema = z.object({
   name: z.string(),
   label: z.string(),
   preset: tModelSpecPresetSchema,
   order: z.number().optional(),
   default: z.boolean().optional(),
+  softDefault: z.boolean().optional(),
   description: z.string().optional(),
   group: z.string().optional(),
   groupIcon: z.union([z.string(), eModelEndpointSchema]).optional(),
   showIconInMenu: z.boolean().optional(),
   showIconInHeader: z.boolean().optional(),
+  showOnLanding: z.boolean().optional(),
+  conversation_starters: z.array(z.string()).optional(),
   iconURL: z.union([z.string(), eModelEndpointSchema]).optional(),
   authType: authTypeSchema.optional(),
   hideBadgeRow: z.boolean().optional(),
@@ -60,6 +78,8 @@ export const tModelSpecSchema = z.object({
   executeCode: z.boolean().optional(),
   artifacts: z.union([z.string(), z.boolean()]).optional(),
   mcpServers: z.array(z.string()).optional(),
+  skills: z.union([z.boolean(), z.array(z.string())]).optional(),
+  subagents: modelSpecSubagentsSchema.optional(),
 });
 
 export const specsConfigSchema = z.object({
diff --git a/packages/data-provider/src/permissions.ts b/packages/data-provider/src/permissions.ts
index 340f599a498..08f2c7953db 100644
--- a/packages/data-provider/src/permissions.ts
+++ b/packages/data-provider/src/permissions.ts
@@ -64,6 +64,10 @@ export enum PermissionTypes {
    * Type for Skill Permissions
    */
   SKILLS = 'SKILLS',
+  /**
+   * Type for Shared Link Permissions
+   */
+  SHARED_LINKS = 'SHARED_LINKS',
 }
 
 /**
@@ -87,6 +91,7 @@ export const PERMISSION_TYPE_INTERFACE_FIELDS: Record<PermissionTypes, string> =
   [PermissionTypes.MCP_SERVERS]: 'mcpServers',
   [PermissionTypes.REMOTE_AGENTS]: 'remoteAgents',
   [PermissionTypes.SKILLS]: 'skills',
+  [PermissionTypes.SHARED_LINKS]: 'sharedLinks',
 };
 
 /** Set of interface config field names that correspond to role permissions. */
@@ -240,6 +245,13 @@ export const skillPermissionsSchema = z.object({
 });
 export type TSkillPermissions = z.infer<typeof skillPermissionsSchema>;
 
+export const sharedLinksPermissionsSchema = z.object({
+  [Permissions.CREATE]: z.boolean().default(true),
+  [Permissions.SHARE]: z.boolean().default(true),
+  [Permissions.SHARE_PUBLIC]: z.boolean().default(false),
+});
+export type TSharedLinksPermissions = z.infer<typeof sharedLinksPermissionsSchema>;
+
 // Define a single permissions schema that holds all permission types.
 export const permissionsSchema = z.object({
   [PermissionTypes.PROMPTS]: promptPermissionsSchema,
@@ -257,4 +269,5 @@ export const permissionsSchema = z.object({
   [PermissionTypes.MCP_SERVERS]: mcpServersPermissionsSchema,
   [PermissionTypes.REMOTE_AGENTS]: remoteAgentsPermissionsSchema,
   [PermissionTypes.SKILLS]: skillPermissionsSchema,
+  [PermissionTypes.SHARED_LINKS]: sharedLinksPermissionsSchema,
 });
diff --git a/packages/data-provider/src/react-query/react-query-service.ts b/packages/data-provider/src/react-query/react-query-service.ts
index b865ab3841b..59430c78d19 100644
--- a/packages/data-provider/src/react-query/react-query-service.ts
+++ b/packages/data-provider/src/react-query/react-query-service.ts
@@ -4,17 +4,17 @@ import type {
   UseMutationResult,
   QueryObserverResult,
 } from '@tanstack/react-query';
+import { MCPServerConnectionStatusResponse } from '../types/queries';
 import { Constants, initialModelsConfig } from '../config';
 import { defaultOrderQuery } from '../types/assistants';
-import { MCPServerConnectionStatusResponse } from '../types/queries';
+import * as permissions from '../accessPermissions';
+import { ResourceType } from '../accessPermissions';
 import * as dataService from '../data-service';
 import * as m from '../types/mutations';
 import * as q from '../types/queries';
 import { QueryKeys } from '../keys';
 import * as s from '../schemas';
 import * as t from '../types';
-import * as permissions from '../accessPermissions';
-import { ResourceType } from '../accessPermissions';
 
 export { hasPermissions } from '../accessPermissions';
 
@@ -122,6 +122,8 @@ export const useUpdateUserKeysMutation = (): UseMutationResult<
     onSuccess: (data, variables) => {
       queryClient.invalidateQueries([QueryKeys.name, variables.name]);
       queryClient.invalidateQueries([QueryKeys.models]);
+      /** token-config is derived from the same per-user model fetch */
+      queryClient.invalidateQueries([QueryKeys.tokenConfig]);
     },
   });
 };
@@ -141,6 +143,7 @@ export const useRevokeUserKeyMutation = (name: string): UseMutationResult<unknow
     onSuccess: () => {
       queryClient.invalidateQueries([QueryKeys.name, name]);
       queryClient.invalidateQueries([QueryKeys.models]);
+      queryClient.invalidateQueries([QueryKeys.tokenConfig]);
       if (s.isAssistantsEndpoint(name)) {
         queryClient.invalidateQueries([QueryKeys.assistants, name, defaultOrderQuery]);
         queryClient.invalidateQueries([QueryKeys.assistantDocs]);
@@ -159,6 +162,7 @@ export const useRevokeAllUserKeysMutation = (): UseMutationResult<unknown> => {
   return useMutation(() => dataService.revokeAllUserKeys(), {
     onSuccess: () => {
       queryClient.invalidateQueries([QueryKeys.name]);
+      queryClient.invalidateQueries([QueryKeys.tokenConfig]);
       queryClient.invalidateQueries([
         QueryKeys.assistants,
         s.EModelEndpoint.assistants,
diff --git a/packages/data-provider/src/request.ts b/packages/data-provider/src/request.ts
index 5021b150e37..d6a1a85deab 100644
--- a/packages/data-provider/src/request.ts
+++ b/packages/data-provider/src/request.ts
@@ -1,8 +1,8 @@
 /* eslint-disable @typescript-eslint/no-explicit-any */
-import axios, { AxiosError, AxiosRequestConfig } from 'axios';
+import axios, { AxiosRequestConfig } from 'axios';
+import type * as t from './types';
 import { setTokenHeader } from './headers-helpers';
 import * as endpoints from './api-endpoints';
-import type * as t from './types';
 
 async function _get<T>(url: string, options?: AxiosRequestConfig): Promise<T> {
   const response = await axios.get(url, { ...options });
@@ -61,41 +61,215 @@ async function _patch(url: string, data?: any) {
   return response.data;
 }
 
-let isRefreshing = false;
-let failedQueue: { resolve: (value?: any) => void; reject: (reason?: any) => void }[] = [];
+const AUTH_RECOVERY_EVENT = 'authRecovery';
+const AUTH_REDIRECT_EVENT = 'authRedirectStarted';
+const AUTH_REDIRECT_STORAGE_KEY = 'librechat.auth.redirect.startedAt';
+const AUTH_REDIRECT_DEDUPE_MS = 15_000;
+const TOKEN_REFRESH_BUFFER_MS = 2 * 60 * 1000;
+
+type RetryableAxiosRequestConfig = AxiosRequestConfig & { _retry?: boolean };
+
+type AuthRecoveryState = {
+  lastRedirectStartedAt: number;
+  refreshPromise: Promise<string | null> | null;
+};
+
+type AuthRecoveryWindow = Window & {
+  __librechatAuthRecovery?: AuthRecoveryState;
+};
 
 const refreshToken = (retry?: boolean): Promise<t.TRefreshTokenResponse | undefined> =>
   _post(endpoints.refreshToken(retry));
 
 const dispatchTokenUpdatedEvent = (token: string) => {
   setTokenHeader(token);
+  clearAuthRedirectStartedAt();
   window.dispatchEvent(new CustomEvent('tokenUpdated', { detail: token }));
 };
 
-const processQueue = (error: AxiosError | null, token: string | null = null) => {
-  failedQueue.forEach((prom) => {
-    if (error) {
-      prom.reject(error);
-    } else {
-      prom.resolve(token);
-    }
-  });
-  failedQueue = [];
+const getAuthRecoveryState = (): AuthRecoveryState => {
+  const browserWindow = window as AuthRecoveryWindow;
+  browserWindow.__librechatAuthRecovery ??= {
+    lastRedirectStartedAt: 0,
+    refreshPromise: null,
+  };
+  return browserWindow.__librechatAuthRecovery;
+};
+
+const getAuthRedirectStartedAt = () => {
+  const state = getAuthRecoveryState();
+  try {
+    const startedAt = window.localStorage.getItem(AUTH_REDIRECT_STORAGE_KEY);
+    const storedStartedAt = startedAt != null ? Number(startedAt) : 0;
+    const finiteStartedAt = Number.isFinite(storedStartedAt) ? storedStartedAt : 0;
+    return Math.max(finiteStartedAt, state.lastRedirectStartedAt);
+  } catch {
+    return state.lastRedirectStartedAt;
+  }
+};
+
+const setAuthRedirectStartedAt = () => {
+  const state = getAuthRecoveryState();
+  state.lastRedirectStartedAt = Date.now();
+  try {
+    window.localStorage.setItem(AUTH_REDIRECT_STORAGE_KEY, String(state.lastRedirectStartedAt));
+  } catch {
+    // localStorage can be blocked in embedded/private contexts.
+  }
+};
+
+const clearAuthRedirectStartedAt = () => {
+  const state = getAuthRecoveryState();
+  state.lastRedirectStartedAt = 0;
+  try {
+    window.localStorage.removeItem(AUTH_REDIRECT_STORAGE_KEY);
+  } catch {
+    // Ignore unavailable storage.
+  }
+};
+
+const isAuthRedirectInProgress = () => {
+  const startedAt = getAuthRedirectStartedAt();
+  return (
+    Number.isFinite(startedAt) && startedAt > 0 && Date.now() - startedAt < AUTH_REDIRECT_DEDUPE_MS
+  );
+};
+
+const dispatchAuthRecoveryEvent = (state: 'started' | 'finished') => {
+  window.dispatchEvent(new CustomEvent(AUTH_RECOVERY_EVENT, { detail: { state } }));
+};
+
+const setRequestAuthorizationHeader = (config: AxiosRequestConfig, token: string) => {
+  const headers = (config.headers ?? {}) as Record<string, string>;
+  headers['Authorization'] = `Bearer ${token}`;
+  config.headers = headers;
+};
+
+const isAuthRecoveryEndpoint = (url?: string) =>
+  url?.includes('/api/auth/2fa') === true ||
+  url?.includes('/api/auth/logout') === true ||
+  url?.includes('/api/auth/refresh') === true;
+
+const startAuthRecovery = (retryRefresh?: boolean) => {
+  const state = getAuthRecoveryState();
+  if (state.refreshPromise) {
+    return state.refreshPromise;
+  }
+
+  dispatchAuthRecoveryEvent('started');
+  state.refreshPromise = refreshToken(retryRefresh)
+    .then((response) => {
+      const token = response?.token ?? '';
+      if (!token) {
+        return null;
+      }
+      dispatchTokenUpdatedEvent(token);
+      return token;
+    })
+    .finally(() => {
+      state.refreshPromise = null;
+      dispatchAuthRecoveryEvent('finished');
+    });
+
+  return state.refreshPromise;
+};
+
+const redirectToLoginOnce = () => {
+  if (isAuthRedirectInProgress()) {
+    return;
+  }
+
+  const href = endpoints.apiBaseUrl() + endpoints.buildLoginRedirectUrl();
+  setAuthRedirectStartedAt();
+  window.dispatchEvent(new CustomEvent(AUTH_REDIRECT_EVENT, { detail: { href } }));
+  window.location.href = href;
+};
+
+const getBearerToken = () => {
+  const authorization = axios.defaults.headers.common['Authorization'];
+  if (typeof authorization !== 'string' || !authorization.startsWith('Bearer ')) {
+    return null;
+  }
+  return authorization.slice('Bearer '.length);
+};
+
+const getJwtExpiryMs = (token: string) => {
+  const payload = token.split('.')[1];
+  if (!payload) {
+    return null;
+  }
+
+  try {
+    const normalizedPayload = payload.replace(/-/g, '+').replace(/_/g, '/');
+    const paddedPayload = normalizedPayload.padEnd(
+      normalizedPayload.length + ((4 - (normalizedPayload.length % 4)) % 4),
+      '=',
+    );
+    const decodedPayload = JSON.parse(window.atob(paddedPayload)) as { exp?: number };
+    return typeof decodedPayload.exp === 'number' ? decodedPayload.exp * 1000 : null;
+  } catch {
+    return null;
+  }
+};
+
+const shouldRefreshBeforeRequest = (url?: string) => {
+  if (isAuthRecoveryEndpoint(url) || isAuthRedirectInProgress()) {
+    return false;
+  }
+
+  const token = getBearerToken();
+  if (!token) {
+    return false;
+  }
+
+  const expiresAt = getJwtExpiryMs(token);
+  if (expiresAt == null) {
+    return false;
+  }
+
+  const timeUntilExpiry = expiresAt - Date.now();
+  return timeUntilExpiry > 0 && timeUntilExpiry <= TOKEN_REFRESH_BUFFER_MS;
 };
 
 if (typeof window !== 'undefined') {
+  axios.interceptors.request.use(async (config) => {
+    const state = getAuthRecoveryState();
+    if (state.refreshPromise && !isAuthRecoveryEndpoint(config.url)) {
+      const token = await state.refreshPromise.catch(() => null);
+      if (token) {
+        setRequestAuthorizationHeader(config, token);
+      }
+      return config;
+    }
+
+    if (!shouldRefreshBeforeRequest(config.url)) {
+      return config;
+    }
+
+    const token = await startAuthRecovery(false).catch(() => null);
+    if (token) {
+      setRequestAuthorizationHeader(config, token);
+    }
+    return config;
+  });
+
   axios.interceptors.response.use(
     (response) => response,
     async (error) => {
-      const originalRequest = error.config;
+      const originalRequest = error.config as RetryableAxiosRequestConfig | undefined;
       if (!error.response) {
         return Promise.reject(error);
       }
+      if (!originalRequest) {
+        return Promise.reject(error);
+      }
 
-      if (originalRequest.url?.includes('/api/auth/2fa') === true) {
+      const isRefreshRequest = originalRequest.url?.includes('/api/auth/refresh') === true;
+      if (isAuthRecoveryEndpoint(originalRequest.url) && !isRefreshRequest) {
         return Promise.reject(error);
       }
-      if (originalRequest.url?.includes('/api/auth/logout') === true) {
+
+      if (isRefreshRequest && getAuthRecoveryState().refreshPromise) {
         return Promise.reject(error);
       }
 
@@ -108,46 +282,32 @@ if (typeof window !== 'undefined') {
         return Promise.reject(error);
       }
 
-      if (error.response.status === 401 && !originalRequest._retry) {
-        console.warn('401 error, refreshing token');
-        originalRequest._retry = true;
+      if (isAuthRedirectInProgress()) {
+        return Promise.reject(error);
+      }
 
-        if (isRefreshing) {
-          try {
-            const token = await new Promise((resolve, reject) => {
-              failedQueue.push({ resolve, reject });
-            });
-            originalRequest.headers['Authorization'] = 'Bearer ' + token;
-            return await axios(originalRequest);
-          } catch (err) {
-            return Promise.reject(err);
-          }
+      if (error.response.status === 401 && !originalRequest._retry) {
+        const hasActiveRecovery = getAuthRecoveryState().refreshPromise != null;
+        if (!hasActiveRecovery) {
+          console.warn('401 error, refreshing token');
         }
-
-        isRefreshing = true;
+        originalRequest._retry = true;
 
         try {
-          const response = await refreshToken(
+          const token = await startAuthRecovery(
             // Handle edge case where we get a blank screen if the initial 401 error is from a refresh token request
-            originalRequest.url?.includes('api/auth/refresh') === true ? true : false,
+            isRefreshRequest,
           );
 
-          const token = response?.token ?? '';
-
           if (token) {
-            originalRequest.headers['Authorization'] = 'Bearer ' + token;
-            dispatchTokenUpdatedEvent(token);
-            processQueue(null, token);
+            setRequestAuthorizationHeader(originalRequest, token);
             return await axios(originalRequest);
-          } else {
-            processQueue(error, null);
-            window.location.href = endpoints.apiBaseUrl() + endpoints.buildLoginRedirectUrl();
           }
+
+          redirectToLoginOnce();
+          return Promise.reject(error);
         } catch (err) {
-          processQueue(err as AxiosError, null);
           return Promise.reject(err);
-        } finally {
-          isRefreshing = false;
         }
       }
 
diff --git a/packages/data-provider/src/roles.spec.ts b/packages/data-provider/src/roles.spec.ts
index 6b5603522a1..3cc1740e47f 100644
--- a/packages/data-provider/src/roles.spec.ts
+++ b/packages/data-provider/src/roles.spec.ts
@@ -89,7 +89,8 @@ describe('roleDefaults', () => {
           permType === PermissionTypes.MEMORIES ||
           permType === PermissionTypes.PROMPTS ||
           permType === PermissionTypes.AGENTS ||
-          permType === PermissionTypes.SKILLS;
+          permType === PermissionTypes.SKILLS ||
+          permType === PermissionTypes.SHARED_LINKS;
 
         expect({
           permType,
diff --git a/packages/data-provider/src/roles.ts b/packages/data-provider/src/roles.ts
index 6d5f9978085..42ce28ce1fc 100644
--- a/packages/data-provider/src/roles.ts
+++ b/packages/data-provider/src/roles.ts
@@ -13,6 +13,7 @@ import {
   fileSearchPermissionsSchema,
   multiConvoPermissionsSchema,
   mcpServersPermissionsSchema,
+  sharedLinksPermissionsSchema,
   peoplePickerPermissionsSchema,
   remoteAgentsPermissionsSchema,
   temporaryChatPermissionsSchema,
@@ -111,6 +112,11 @@ const defaultRolesSchema = z.object({
         [Permissions.SHARE]: z.boolean().default(true),
         [Permissions.SHARE_PUBLIC]: z.boolean().default(true),
       }),
+      [PermissionTypes.SHARED_LINKS]: sharedLinksPermissionsSchema.extend({
+        [Permissions.CREATE]: z.boolean().default(true),
+        [Permissions.SHARE]: z.boolean().default(true),
+        [Permissions.SHARE_PUBLIC]: z.boolean().default(true),
+      }),
     }),
   }),
   [SystemRoles.USER]: roleSchema.extend({
@@ -200,6 +206,11 @@ export const roleDefaults = defaultRolesSchema.parse({
         [Permissions.SHARE]: true,
         [Permissions.SHARE_PUBLIC]: true,
       },
+      [PermissionTypes.SHARED_LINKS]: {
+        [Permissions.CREATE]: true,
+        [Permissions.SHARE]: true,
+        [Permissions.SHARE_PUBLIC]: true,
+      },
     },
   },
   [SystemRoles.USER]: {
@@ -252,6 +263,11 @@ export const roleDefaults = defaultRolesSchema.parse({
         [Permissions.SHARE]: false,
         [Permissions.SHARE_PUBLIC]: false,
       },
+      [PermissionTypes.SHARED_LINKS]: {
+        [Permissions.CREATE]: true,
+        [Permissions.SHARE]: true,
+        [Permissions.SHARE_PUBLIC]: true,
+      },
     },
   },
 });
diff --git a/packages/data-provider/src/schemas.spec.ts b/packages/data-provider/src/schemas.spec.ts
index 1ce3a596fc4..2e1f00532fd 100644
--- a/packages/data-provider/src/schemas.spec.ts
+++ b/packages/data-provider/src/schemas.spec.ts
@@ -463,6 +463,14 @@ describe('googleSettings', () => {
       });
       expect(result.maxOutputTokens).toBeUndefined();
     });
+
+    it('preserves chat project membership metadata', () => {
+      const result = compactGoogleSchema.parse({
+        model: 'gemini-2.5-pro',
+        chatProjectId: 'project-1',
+      });
+      expect(result.chatProjectId).toBe('project-1');
+    });
   });
 });
 
diff --git a/packages/data-provider/src/schemas.ts b/packages/data-provider/src/schemas.ts
index aeea35974e1..604591dbd97 100644
--- a/packages/data-provider/src/schemas.ts
+++ b/packages/data-provider/src/schemas.ts
@@ -1,9 +1,9 @@
 import { z } from 'zod';
-import { Tools } from './types/assistants';
 import type { TMessageContentParts, FunctionTool, FunctionToolCall } from './types/assistants';
-import { TFeedback, feedbackSchema } from './feedback';
 import type { SearchResultData } from './types/web';
 import type { TFile } from './types/files';
+import { TFeedback, feedbackSchema } from './feedback';
+import { Tools } from './types/assistants';
 
 export const isUUID = z.string().uuid();
 
@@ -79,6 +79,33 @@ export const isOpenAILikeProvider = (provider?: string | null): boolean => {
   return openAILikeProviders.has(provider ?? '');
 };
 
+/**
+ * Providers whose `usage_metadata.input_tokens` ALREADY INCLUDES cached tokens
+ * (`input_token_details.cache_*` is a subset, not an additional charge):
+ * Google/Vertex (`promptTokenCount`), OpenAI/Azure (`prompt_tokens`), and the
+ * OpenAI-compatible family. `@librechat/agents`' `getAnthropicUsageMetadata`
+ * folds `cache_creation` + `cache_read` into `input_tokens`, so Anthropic is a
+ * subset provider too; without this the cache portion is billed twice. Bedrock
+ * stays additive — its Converse path passes AWS `inputTokens` through unmodified.
+ * Single source of truth shared by the backend billing path
+ * (`packages/api/src/agents/usage.ts`) and the client usage normalization.
+ */
+export const cacheSubsetProviders = new Set<string>([
+  Providers.OPENAI,
+  Providers.AZURE,
+  Providers.GOOGLE,
+  Providers.VERTEXAI,
+  Providers.XAI,
+  Providers.DEEPSEEK,
+  Providers.OPENROUTER,
+  Providers.MOONSHOT,
+  Providers.ANTHROPIC,
+]);
+
+export const inputTokensIncludesCache = (provider?: string | null): boolean => {
+  return cacheSubsetProviders.has(provider ?? '');
+};
+
 export const isDocumentSupportedProvider = (provider?: string | null): boolean => {
   return documentSupportedProviders.has(provider ?? '');
 };
@@ -459,6 +486,27 @@ const CLAUDE_4_64K_MAX_OUTPUT = 64000 as const;
 const CLAUDE_32K_MAX_OUTPUT = 32000 as const;
 const DEFAULT_MAX_OUTPUT = 8192 as const;
 const LEGACY_ANTHROPIC_MAX_OUTPUT = 4096 as const;
+
+/**
+ * Claude "Mythos-class" model families — new top-level classes (peers of
+ * `opus`/`sonnet`/`haiku`) that ship with the post-Opus-4.7 modern profile:
+ * adaptive thinking always on, raw thinking omitted by default (summarized
+ * opt-in), sampling parameters rejected, and a 1M context window. The tier
+ * word is the class name itself, so the `opus`/`sonnet` version parsers don't
+ * cover them.
+ *
+ * Single source of truth: add a future sibling class name here and every
+ * Mythos-class gate (adaptive thinking, sampling omission, prompt caching, 1M
+ * context, 128K output) picks it up.
+ */
+export const MYTHOS_CLASS_FAMILIES = ['fable', 'mythos'] as const;
+const MYTHOS_CLASS_PATTERN = new RegExp(`claude-(?:${MYTHOS_CLASS_FAMILIES.join('|')})[-.]?\\d`);
+
+/** Whether the model is a Claude Mythos-class model (e.g. `claude-fable-5`). */
+export function isMythosClassModel(model: string): boolean {
+  return MYTHOS_CLASS_PATTERN.test(model);
+}
+
 export const anthropicSettings = {
   model: {
     default: 'claude-3-5-sonnet-latest' as const,
@@ -487,6 +535,10 @@ export const anthropicSettings = {
     step: 1 as const,
     default: DEFAULT_MAX_OUTPUT,
     reset: (modelName: string) => {
+      if (isMythosClassModel(modelName)) {
+        return ANTHROPIC_MAX_OUTPUT;
+      }
+
       if (/claude-opus[-.]?(?:4[-.]?(?:[6-9]|\d{2,})|[5-9]|\d{2,})/.test(modelName)) {
         return ANTHROPIC_MAX_OUTPUT;
       }
@@ -506,6 +558,13 @@ export const anthropicSettings = {
       return DEFAULT_MAX_OUTPUT;
     },
     set: (value: number, modelName: string) => {
+      if (isMythosClassModel(modelName)) {
+        if (value > ANTHROPIC_MAX_OUTPUT) {
+          return ANTHROPIC_MAX_OUTPUT;
+        }
+        return value;
+      }
+
       if (/claude-opus[-.]?(?:4[-.]?(?:[6-9]|\d{2,})|[5-9]|\d{2,})/.test(modelName)) {
         if (value > ANTHROPIC_MAX_OUTPUT) {
           return ANTHROPIC_MAX_OUTPUT;
@@ -717,6 +776,8 @@ export const tMessageSchema = z.object({
   feedback: feedbackSchema.optional(),
   /** metadata */
   metadata: z.record(z.unknown()).optional(),
+  /** Output tokens for assistant messages, calibrated prompt-side estimate for user messages */
+  tokenCount: z.number().optional(),
   contextMeta: z
     .object({
       calibrationRatio: z
@@ -861,6 +922,7 @@ export const tConversationSchema = z.object({
   examples: z.array(tExampleSchema).optional(),
   /* DB */
   tags: z.array(z.string()).optional(),
+  chatProjectId: z.string().nullable().optional(),
   createdAt: z.string(),
   updatedAt: z.string(),
   /* Files */
@@ -916,6 +978,7 @@ export const tConversationSchema = z.object({
 export const tPresetSchema = tConversationSchema
   .omit({
     conversationId: true,
+    chatProjectId: true,
     createdAt: true,
     updatedAt: true,
     title: true,
@@ -1076,7 +1139,6 @@ export const tSharedLinkSchema = z.object({
   shareId: z.string(),
   targetMessageId: z.string().optional(),
   messages: z.array(z.string()),
-  isPublic: z.boolean(),
   title: z.string(),
   createdAt: z.string(),
   updatedAt: z.string(),
@@ -1097,6 +1159,7 @@ export const tConversationTagSchema = z.object({
 export type TConversationTag = z.infer<typeof tConversationTagSchema>;
 
 export const googleBaseSchema = tConversationSchema.pick({
+  chatProjectId: true,
   model: true,
   modelLabel: true,
   promptPrefix: true,
@@ -1168,6 +1231,7 @@ export function removeNullishValues<T extends Record<string, unknown>>(
 }
 
 const assistantBaseSchema = tConversationSchema.pick({
+  chatProjectId: true,
   model: true,
   assistant_id: true,
   instructions: true,
@@ -1203,6 +1267,7 @@ export const assistantSchema = assistantBaseSchema
   }));
 
 const compactAssistantBaseSchema = tConversationSchema.pick({
+  chatProjectId: true,
   model: true,
   assistant_id: true,
   instructions: true,
@@ -1218,6 +1283,7 @@ export const compactAssistantSchema = compactAssistantBaseSchema
   .catch(() => ({}));
 
 export const agentsBaseSchema = tConversationSchema.pick({
+  chatProjectId: true,
   model: true,
   modelLabel: true,
   temperature: true,
@@ -1271,6 +1337,7 @@ export const agentsSchema = agentsBaseSchema
   }));
 
 export const openAIBaseSchema = tConversationSchema.pick({
+  chatProjectId: true,
   model: true,
   modelLabel: true,
   chatGptLabel: true,
@@ -1327,6 +1394,7 @@ export const compactGoogleSchema = googleBaseSchema
   .catch(() => ({}));
 
 export const anthropicBaseSchema = tConversationSchema.pick({
+  chatProjectId: true,
   model: true,
   modelLabel: true,
   promptPrefix: true,
@@ -1368,6 +1436,7 @@ export const tBannerSchema = z.object({
 export type TBanner = z.infer<typeof tBannerSchema>;
 
 export const compactAgentsBaseSchema = tConversationSchema.pick({
+  chatProjectId: true,
   spec: true,
   // model: true,
   iconURL: true,
diff --git a/packages/data-provider/src/types.ts b/packages/data-provider/src/types.ts
index d46ba52bef2..fb2f890adff 100644
--- a/packages/data-provider/src/types.ts
+++ b/packages/data-provider/src/types.ts
@@ -71,6 +71,7 @@ export type TEndpointOption = Pick<
   | 'file_ids'
   // System field
   | 'system'
+  | 'chatProjectId'
   // Google examples
   | 'examples'
   // Context
@@ -147,6 +148,8 @@ export type TSubmission = {
   isContinued?: boolean;
   isTemporary: boolean;
   messages: TMessage[];
+  /** Client-only full message context used to restore branch siblings after scoped regenerate. */
+  regenerateMessages?: TMessage[];
   isRegenerate?: boolean;
   initialResponse?: TMessage;
   conversation: Partial<TConversation>;
@@ -288,6 +291,43 @@ export type TUpdateConversationRequest = {
 
 export type TUpdateConversationResponse = TConversation;
 
+export type TChatProject = {
+  _id: string;
+  name: string;
+  description?: string;
+  user?: string;
+  conversationCount: number;
+  lastConversationAt?: string | null;
+  lastConversationId?: string | null;
+  createdAt: string;
+  updatedAt: string;
+};
+
+export type TCreateChatProjectRequest = {
+  name: string;
+  description?: string;
+};
+
+export type TUpdateChatProjectRequest = Partial<TCreateChatProjectRequest> & {
+  projectId: string;
+};
+
+export type TDeleteChatProjectResponse = {
+  deletedCount: number;
+  modifiedCount: number;
+};
+
+export type TAssignConversationToProjectRequest = {
+  conversationId: string;
+  projectId: string | null;
+};
+
+export type TAssignConversationToProjectResponse = {
+  conversation: TConversation;
+  previousProjectId: string | null;
+  projectId: string | null;
+};
+
 export type TDeleteConversationRequest = {
   conversationId?: string;
   thread_id?: string;
@@ -321,7 +361,9 @@ export type TUpdateShareLinkRequest = Pick<TSharedLink, 'shareId' | 'targetMessa
 
 export type TSharedLinkResponse = Pick<TSharedLink, 'shareId'> &
   Pick<TSharedLink, 'targetMessageId'> &
-  Pick<TConversation, 'conversationId'>;
+  Pick<TConversation, 'conversationId'> & {
+    _id?: string;
+  };
 
 export type TSharedLinkGetResponse = Omit<TSharedLinkResponse, 'shareId'> & {
   shareId: string | null;
@@ -413,6 +455,18 @@ export type TEndpointsConfig =
 
 export type TModelsConfig = Record<string, string[]>;
 
+/** Server-resolved context window and pricing for one model. Rates are USD per 1M tokens. */
+export type TModelTokenomics = {
+  context?: number;
+  prompt?: number;
+  completion?: number;
+  cacheWrite?: number;
+  cacheRead?: number;
+};
+
+/** endpoint → model → resolved tokenomics, from GET /api/endpoints/token-config */
+export type TTokenConfigMap = Record<string, Record<string, TModelTokenomics>>;
+
 export type TUpdateTokenCountResponse = {
   count: number;
 };
diff --git a/packages/data-provider/src/types/agents.ts b/packages/data-provider/src/types/agents.ts
index d4aae9101de..0dc96fb6ccf 100644
--- a/packages/data-provider/src/types/agents.ts
+++ b/packages/data-provider/src/types/agents.ts
@@ -1,7 +1,8 @@
 /* eslint-disable @typescript-eslint/no-namespace */
-import { StepTypes, ContentTypes, ToolCallTypes } from './runs';
 import type { FunctionToolCall, SummaryContentPart } from './assistants';
+import type { TTokenUsageEvent, TContextUsageEvent } from './runs';
 import type { TAttachment, TPlugin } from 'src/schemas';
+import { StepTypes, ContentTypes, ToolCallTypes } from './runs';
 
 export namespace Agents {
   export type MessageType = 'human' | 'ai' | 'generic' | 'system' | 'function' | 'tool' | 'remove';
@@ -217,6 +218,8 @@ export namespace Agents {
     responseMessageId?: string;
     conversationId?: string;
     sender?: string;
+    iconURL?: string;
+    model?: string;
     titleEvent?: {
       event: 'title';
       data?: {
@@ -224,6 +227,15 @@ export namespace Agents {
         title?: string;
       };
     };
+    replayEvents?: Array<{
+      event: string;
+      data?: unknown;
+      [key: string]: unknown;
+    }>;
+    /** Cumulative provider-reported usage for the run; backfills usage totals on resume */
+    collectedUsage?: TTokenUsageEvent[];
+    /** Latest context window snapshot; restores the usage gauge on resume */
+    contextUsage?: TContextUsageEvent;
   }
   /**
    * Represents a run step delta i.e. any changed fields on a run step during
diff --git a/packages/data-provider/src/types/queries.ts b/packages/data-provider/src/types/queries.ts
index 323090f2508..abe773fce2d 100644
--- a/packages/data-provider/src/types/queries.ts
+++ b/packages/data-provider/src/types/queries.ts
@@ -19,11 +19,12 @@ export type ConversationListParams = {
   sortDirection?: 'asc' | 'desc';
   tags?: string[];
   search?: string;
+  projectId?: string;
 };
 
 export type MinimalConversation = Pick<
   s.TConversation,
-  'conversationId' | 'endpoint' | 'title' | 'createdAt' | 'updatedAt' | 'user'
+  'conversationId' | 'endpoint' | 'title' | 'createdAt' | 'updatedAt' | 'user' | 'chatProjectId'
 >;
 
 export type ConversationListResponse = {
@@ -37,6 +38,21 @@ export type ConversationUpdater = (
   conversation: s.TConversation,
 ) => ConversationData;
 
+export type ProjectListParams = {
+  cursor?: string;
+  limit?: number;
+  sortBy?: 'name' | 'createdAt' | 'lastConversationAt';
+  sortDirection?: 'asc' | 'desc';
+  search?: string;
+};
+
+export type ProjectListResponse = {
+  projects: t.TChatProject[];
+  nextCursor: string | null;
+};
+
+export type ProjectData = InfiniteData<ProjectListResponse>;
+
 /* Messages */
 export type MessagesListParams = {
   cursor?: string | null;
@@ -60,7 +76,6 @@ export type SharedMessagesResponse = Omit<s.TSharedLink, 'messages'> & {
 
 export interface SharedLinksListParams {
   pageSize: number;
-  isPublic: boolean;
   sortBy: 'title' | 'createdAt';
   sortDirection: 'asc' | 'desc';
   search?: string;
@@ -70,7 +85,6 @@ export interface SharedLinksListParams {
 export type SharedLinkItem = {
   shareId: string;
   title: string;
-  isPublic: boolean;
   createdAt: Date;
   conversationId: string;
 };
@@ -187,6 +201,8 @@ export interface MCPServerStatus {
 export interface MCPConnectionStatusResponse {
   success: boolean;
   connectionStatus: Record<string, MCPServerStatus>;
+  /** Server-configured OAuth completion window in ms (`MCP_OAUTH_HANDLING_TIMEOUT`) */
+  oauthTimeout?: number;
 }
 
 export interface MCPServerConnectionStatusResponse {
diff --git a/packages/data-provider/src/types/runs.spec.ts b/packages/data-provider/src/types/runs.spec.ts
new file mode 100644
index 00000000000..f4058d1c7be
--- /dev/null
+++ b/packages/data-provider/src/types/runs.spec.ts
@@ -0,0 +1,121 @@
+import type { TContextUsageEvent, TTokenUsageEvent } from './runs';
+import { promptTokensFromUsage, reconcileContextUsage } from './runs';
+
+describe('promptTokensFromUsage', () => {
+  it('adds cache reads/writes for additive providers (Bedrock)', () => {
+    const event: TTokenUsageEvent = {
+      input_tokens: 53702,
+      input_token_details: { cache_read: 2071, cache_creation: 0 },
+      provider: 'bedrock',
+    };
+    expect(promptTokensFromUsage(event)).toBe(55773);
+  });
+
+  it('treats input_tokens as the full prompt for Anthropic (cache-inclusive)', () => {
+    const event: TTokenUsageEvent = {
+      input_tokens: 55773,
+      input_token_details: { cache_read: 2071, cache_creation: 0 },
+      provider: 'anthropic',
+    };
+    expect(promptTokensFromUsage(event)).toBe(55773);
+  });
+
+  it('treats input_tokens as the full prompt for subset providers (OpenAI)', () => {
+    const event: TTokenUsageEvent = {
+      input_tokens: 1000,
+      input_token_details: { cache_read: 200, cache_creation: 100 },
+      provider: 'openAI',
+    };
+    expect(promptTokensFromUsage(event)).toBe(1000);
+  });
+
+  it('handles missing fields', () => {
+    expect(promptTokensFromUsage({ provider: 'anthropic' })).toBe(0);
+  });
+
+  it('uses the magnitude heuristic when the provider is absent (cache ≤ input ⇒ included)', () => {
+    /** OpenAI-compatible/custom payload with no provider: cache already folded
+     *  into input_tokens, so it must NOT be re-added. */
+    const event: TTokenUsageEvent = {
+      input_tokens: 1000,
+      input_token_details: { cache_read: 400, cache_creation: 0 },
+    };
+    expect(promptTokensFromUsage(event)).toBe(1000);
+  });
+
+  it('adds cache when provider is absent and cache exceeds input (additive shape)', () => {
+    const event: TTokenUsageEvent = {
+      input_tokens: 100,
+      input_token_details: { cache_read: 900, cache_creation: 0 },
+    };
+    expect(promptTokensFromUsage(event)).toBe(1000);
+  });
+});
+
+describe('reconcileContextUsage', () => {
+  /** The exact over-reporting case from a real web-search + summarization turn:
+   *  calibrationRatio pinned at 5 inflated messageTokens to 187471 → used 213375,
+   *  while the provider's real prompt for that call was 55773. */
+  const inflatedSnapshot: TContextUsageEvent = {
+    runId: 'run-1',
+    breakdown: {
+      maxContextTokens: 250000,
+      instructionTokens: 4205,
+      systemMessageTokens: 384,
+      dynamicInstructionTokens: 1525,
+      toolSchemaTokens: 2296,
+      summaryTokens: 1938,
+      toolCount: 1,
+      messageCount: 2,
+      messageTokens: 187471,
+      availableForMessages: 233295,
+    },
+    contextBudget: 237500,
+    remainingContextTokens: 24125,
+    calibrationRatio: 5,
+  };
+
+  it('reconciles the inflated estimate to the real prompt tokens', () => {
+    const result = reconcileContextUsage(inflatedSnapshot, 55773);
+    /** used = budget − remaining = real prompt, down from the inflated 213375 */
+    expect(237500 - (result.remainingContextTokens ?? 0)).toBe(55773);
+    /** only messageTokens is corrected; instructions/summary stay raw */
+    expect(result.breakdown.messageTokens).toBe(55773 - 4205 - 1938);
+    expect(result.breakdown.instructionTokens).toBe(4205);
+    expect(result.breakdown.summaryTokens).toBe(1938);
+    /** rows still sum to the real total */
+    expect(
+      result.breakdown.messageTokens +
+        result.breakdown.instructionTokens +
+        result.breakdown.summaryTokens,
+    ).toBe(55773);
+  });
+
+  it('clamps messageTokens to zero when the prompt is smaller than the overhead', () => {
+    const result = reconcileContextUsage(inflatedSnapshot, 3000);
+    expect(result.breakdown.messageTokens).toBe(0);
+    expect(result.remainingContextTokens).toBe(237500 - 3000);
+  });
+
+  it('is a no-op for an unusable prompt count', () => {
+    expect(reconcileContextUsage(inflatedSnapshot, 0)).toBe(inflatedSnapshot);
+    expect(reconcileContextUsage(inflatedSnapshot, -5)).toBe(inflatedSnapshot);
+    expect(reconcileContextUsage(inflatedSnapshot, NaN)).toBe(inflatedSnapshot);
+  });
+
+  it('end-to-end: promptTokensFromUsage feeds reconcileContextUsage (followup turn)', () => {
+    const followupSnapshot: TContextUsageEvent = {
+      ...inflatedSnapshot,
+      breakdown: { ...inflatedSnapshot.breakdown, messageTokens: 30480 },
+      remainingContextTokens: 202815,
+    };
+    const usage: TTokenUsageEvent = {
+      input_tokens: 9875, // cache-inclusive (Anthropic): 7804 fresh + 2071 read
+      input_token_details: { cache_read: 2071, cache_creation: 0 },
+      provider: 'anthropic',
+    };
+    const result = reconcileContextUsage(followupSnapshot, promptTokensFromUsage(usage));
+    expect(237500 - (result.remainingContextTokens ?? 0)).toBe(9875);
+    expect(result.breakdown.messageTokens).toBe(9875 - 4205 - 1938);
+  });
+});
diff --git a/packages/data-provider/src/types/runs.ts b/packages/data-provider/src/types/runs.ts
index 706c380c6f6..8e1033c07fe 100644
--- a/packages/data-provider/src/types/runs.ts
+++ b/packages/data-provider/src/types/runs.ts
@@ -1,3 +1,5 @@
+import { inputTokensIncludesCache } from '../schemas';
+
 export enum ContentTypes {
   TEXT = 'text',
   THINK = 'think',
@@ -40,6 +42,166 @@ export enum StepEvents {
   ON_SUBAGENT_UPDATE = 'on_subagent_update',
 }
 
+/** Token-tracking event names streamed to the client (separate from StepEvents dispatch). */
+export enum UsageEvents {
+  ON_CONTEXT_USAGE = 'on_context_usage',
+  ON_TOKEN_USAGE = 'on_token_usage',
+}
+
+/** Mirrors TokenBudgetBreakdown from @librechat/agents (data-provider cannot import it). */
+export type TTokenBudgetBreakdown = {
+  maxContextTokens: number;
+  instructionTokens: number;
+  systemMessageTokens: number;
+  dynamicInstructionTokens: number;
+  toolSchemaTokens: number;
+  summaryTokens: number;
+  toolCount: number;
+  messageCount: number;
+  messageTokens: number;
+  availableForMessages: number;
+  /** Per-tool schema token counts (post-multiplier), keyed by tool name */
+  toolTokenCounts?: Record<string, number>;
+  /** Names of counted tools that are deferred (`defer_loading`) and discovered */
+  deferredToolNames?: string[];
+};
+
+/** Per-model-call context snapshot, dispatched after pruning and before the LLM call. */
+export type TContextUsageEvent = {
+  runId?: string;
+  agentId?: string;
+  breakdown: TTokenBudgetBreakdown;
+  /** Usable budget this call: maxContextTokens minus output reserve */
+  contextBudget?: number;
+  /** Calibrated instruction overhead actually applied this call */
+  effectiveInstructionTokens?: number;
+  /** Calibrated message tokens before pruning (excluding instructions) */
+  prePruneContextTokens?: number;
+  /** Tokens still free after instructions + pruned messages */
+  remainingContextTokens?: number;
+  calibrationRatio?: number;
+  /** Output tokens of the response's final model call (the call this pre-invoke
+   *  snapshot precedes). Populated only on the persisted `metadata.contextUsage`
+   *  blob so a reloaded multi-call turn adds the same post-snapshot delta the
+   *  live finalizer did — not the full response `tokenCount`, which the snapshot
+   *  already includes for earlier steps. */
+  completedOutputTokens?: number;
+};
+
+/**
+ * Request payload for a server-side context-usage projection: "what context
+ * would the next call send for this branch under this config", computed by the
+ * agents SDK without invoking the model. Powers the gauge in states the live
+ * snapshot can't cover (page load of a snapshot-less branch, window/model
+ * switch). `messageId` is the viewed branch's tail; the server walks its parent
+ * chain.
+ */
+export type TContextProjectionRequest = {
+  conversationId: string;
+  messageId: string;
+  endpoint: string;
+  model?: string;
+  agentId?: string;
+  spec?: string;
+  maxContextTokens?: number;
+  /** Provider-calibrated ratio from a prior snapshot, applied as a static seed. */
+  calibrationRatio?: number;
+  /** Client-only cache-bust: a branch content revision so a message edit
+   *  (which keeps the same tail id) refetches. The server ignores it. */
+  revision?: number;
+};
+
+/**
+ * Per-response usage rollup persisted on `responseMessage.metadata.usage`, in
+ * display units (input excludes cache; output includes repaired completion).
+ * Normalized per-event on the backend before summing so a reloaded conversation
+ * reproduces the live branch/total usage exactly, even for mixed-provider turns
+ * (summarization/subagent calls on a different provider than the primary).
+ */
+export type TResponseUsage = {
+  input: number;
+  output: number;
+  cacheWrite: number;
+  cacheRead: number;
+  /** Authoritative USD cost; present only when `interface.contextCost` was on at save */
+  cost?: number;
+};
+
+/** Provider-reported usage for a single completed model call. */
+export type TTokenUsageEvent = {
+  input_tokens?: number;
+  output_tokens?: number;
+  total_tokens?: number;
+  input_token_details?: {
+    cache_creation?: number;
+    cache_read?: number;
+  };
+  model?: string;
+  provider?: string;
+  /** Non-primary buckets fold into session cost/totals but not the live
+   *  context gauge: hidden sequential-agent calls (`sequential`), summary
+   *  passes (`summarization`), and isolated subagent runs (`subagent`) */
+  usage_type?: 'summarization' | 'subagent' | 'sequential';
+  runId?: string;
+  /** Per-run emission sequence; keeps identical payloads from distinct model calls unique */
+  seq?: number;
+  /** Authoritative USD cost of this call from the backend (premium tiers, cache
+   *  rates); present only when `interface.contextCost` is enabled. Clients sum
+   *  this rather than re-deriving cost from base rates. */
+  cost?: number;
+};
+
+/**
+ * Full prompt token count for one completed model call — the EXACT context the
+ * model saw, provider-aware: additive providers (Bedrock) report `input_tokens`
+ * excluding cache, so cache reads/writes are added back; subset providers
+ * (Anthropic, OpenAI, …) already fold cache into `input_tokens`. When the
+ * provider is absent (custom/OpenAI-compatible payloads), fall back to the same
+ * magnitude heuristic `normalizeUsageUnits` uses — cache ≤ input means it's
+ * already included — so cached events aren't re-inflated. The ground truth the
+ * gauge reconciles its calibrated estimate to.
+ */
+export const promptTokensFromUsage = (event: TTokenUsageEvent): number => {
+  const input = event.input_tokens ?? 0;
+  const details = event.input_token_details ?? {};
+  const cacheRead = details.cache_read ?? 0;
+  const cacheCreation = details.cache_creation ?? 0;
+  const includesCache =
+    event.provider != null
+      ? inputTokensIncludesCache(event.provider)
+      : cacheRead + cacheCreation <= input;
+  return includesCache ? input : input + cacheRead + cacheCreation;
+};
+
+/**
+ * Reconciles a pre-invoke context snapshot's CALIBRATED estimate to a call's
+ * ACTUAL prompt tokens. The SDK's calibration multiplier scales only
+ * `messageTokens` (instructions/summary are raw tiktoken counts), and it can
+ * over-shoot badly when a provider injects server-side content the SDK never
+ * counted (e.g. Anthropic web search) — pinning the gauge several× too high and
+ * persisting it. Trust the provider's own prompt count: keep the raw
+ * instruction/summary rows, set `messageTokens` to the remainder, and recompute
+ * the free space. No-op when `promptTokens` is unusable.
+ */
+export const reconcileContextUsage = (
+  snapshot: TContextUsageEvent,
+  promptTokens: number,
+): TContextUsageEvent => {
+  if (!Number.isFinite(promptTokens) || promptTokens <= 0) {
+    return snapshot;
+  }
+  const { breakdown } = snapshot;
+  const budget = snapshot.contextBudget ?? breakdown.maxContextTokens;
+  const nonMessageTokens = (breakdown.instructionTokens ?? 0) + (breakdown.summaryTokens ?? 0);
+  const messageTokens = Math.max(0, promptTokens - nonMessageTokens);
+  return {
+    ...snapshot,
+    breakdown: { ...breakdown, messageTokens },
+    remainingContextTokens:
+      budget != null ? Math.max(0, budget - promptTokens) : snapshot.remainingContextTokens,
+  };
+};
+
 /** Lifecycle phase carried on subagent-progress envelopes (mirrors SDK SubagentUpdatePhase). */
 export type SubagentUpdatePhase =
   | 'start'
diff --git a/packages/data-provider/src/types/skills.ts b/packages/data-provider/src/types/skills.ts
index 3552629a80f..487edc29dc3 100644
--- a/packages/data-provider/src/types/skills.ts
+++ b/packages/data-provider/src/types/skills.ts
@@ -25,9 +25,11 @@ export const SKILL_NAME_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
 /**
  * Source of a skill — where its canonical definition came from.
  * `inline` means the skill was authored directly in LibreChat.
- * `github` / `notion` are reserved for future sync integrations.
+ * `deployment` means the skill was loaded from the server's configured
+ * deployment skill directory and is not persisted as a Skill document.
+ * `github` is populated by admin-configured GitHub skill sync; `notion` is reserved.
  */
-export type SkillSource = 'inline' | 'github' | 'notion';
+export type SkillSource = 'inline' | 'deployment' | 'github' | 'notion';
 
 /**
  * Category inferred from a skill file's top-level directory prefix.
@@ -58,11 +60,25 @@ export type SkillFrontmatter = {
  * Provenance metadata for skills that originated from an external source
  * (e.g. a GitHub commit SHA or a Notion page id).
  *
- * Reserved for phase 2+ external sync — no code path currently populates this
- * in phase 1, but the column exists so a future sync worker can use it
- * without a schema migration.
+ * Populated by external sync workers with upstream identifiers such as source
+ * ids, paths, and commit/blob SHAs.
  */
-export type SkillSourceMetadata = Record<string, string | number | boolean>;
+export type SkillSourceMetadata =
+  | Record<string, string | number | boolean>
+  | {
+      provider: 'github';
+      sourceId: string;
+      upstreamId: string;
+      owner: string;
+      repo: string;
+      ref: string;
+      skillPath: string;
+      commitSha?: string;
+      skillBlobSha?: string;
+      syncedAt?: string;
+      syncStatus?: 'synced' | 'failed';
+      error?: string;
+    };
 
 /**
  * A non-blocking coaching hint surfaced alongside a successful create/update
@@ -92,8 +108,8 @@ export type TSkillWarning = {
  * - `frontmatter` is the structured YAML bag minus `name`/`description`
  *   (those live as top-level columns). Validated strictly against a known
  *   key set server-side.
- * - `source`/`sourceMetadata` are reserved for phase 2+ external sync and
- *   always `'inline'` / absent in phase 1.
+ * - `source`/`sourceMetadata` identify whether the row is user-authored,
+ *   deployment-provided, or mirrored from an external source such as GitHub.
  */
 export type TSkill = {
   _id: string;
@@ -181,6 +197,7 @@ export type TSkillFile = {
   isExecutable: boolean;
   author: string;
   tenantId?: string;
+  sourceMetadata?: Record<string, string | number | boolean>;
   /** Lazily cached text content (≤ 512 KB). Excluded from list responses. */
   content?: string;
   /** Set on first read. `true` prevents repeated storage reads for non-text files. */
@@ -189,6 +206,59 @@ export type TSkillFile = {
   updatedAt: string;
 };
 
+export type TGitHubSkillSyncCredentialSummary = {
+  provider: 'github';
+  credentialKey: string;
+  credentialPresent: boolean;
+  tokenFingerprint?: string;
+  updatedAt?: string;
+  createdAt?: string;
+};
+
+export type TGitHubSkillSyncSourceStatus = {
+  provider: 'github';
+  sourceId: string;
+  tenantId?: string;
+  status: 'idle' | 'running' | 'succeeded' | 'failed' | 'skipped';
+  credentialKey?: string;
+  credentialPresent: boolean;
+  owner?: string;
+  repo?: string;
+  ref?: string;
+  paths?: string[];
+  startedAt?: string;
+  finishedAt?: string;
+  lastSuccessAt?: string;
+  lastFailureAt?: string;
+  errorCode?: string;
+  errorMessage?: string;
+  syncedSkillCount: number;
+  syncedFileCount: number;
+  deletedSkillCount: number;
+  deletedFileCount: number;
+  updatedAt?: string;
+  createdAt?: string;
+};
+
+export type TGitHubSkillSyncStatusResponse = {
+  enabled: boolean;
+  intervalMinutes: number;
+  runOnStartup: boolean;
+  sources: TGitHubSkillSyncSourceStatus[];
+  credentials: TGitHubSkillSyncCredentialSummary[];
+  fineGrainedTokenRecommendation: string;
+};
+
+export type TGitHubSkillSyncCredentialUpdateRequest = {
+  token: string;
+};
+
+export type TGitHubSkillSyncManualRunResponse = {
+  status: 'started' | 'skipped' | 'completed' | 'failed';
+  message?: string;
+  sources?: TGitHubSkillSyncSourceStatus[];
+};
+
 /** Request body for POST `/api/skills`. */
 export type TCreateSkill = {
   name: string;
@@ -197,7 +267,7 @@ export type TCreateSkill = {
   body: string;
   frontmatter?: Partial<SkillFrontmatter>;
   category?: string;
-  /** When `true`, the skill auto-primes into every turn (mirrors `always-apply` frontmatter). */
+  /** When `true`, the skill auto-primes into every turn (mirrors always-apply frontmatter). */
   alwaysApply?: boolean;
 };
 
diff --git a/packages/data-provider/tsconfig.build.json b/packages/data-provider/tsconfig.build.json
new file mode 100644
index 00000000000..689e9bced3e
--- /dev/null
+++ b/packages/data-provider/tsconfig.build.json
@@ -0,0 +1,12 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "noEmit": false,
+    "declaration": true,
+    "emitDeclarationOnly": true,
+    "declarationDir": "./dist/types",
+    "outDir": "./dist/types"
+  },
+  "include": ["src/**/*"],
+  "exclude": ["node_modules", "dist", "**/*.spec.ts", "**/*.test.ts"]
+}
diff --git a/packages/data-provider/tsdown.config.mjs b/packages/data-provider/tsdown.config.mjs
new file mode 100644
index 00000000000..a870e0aa439
--- /dev/null
+++ b/packages/data-provider/tsdown.config.mjs
@@ -0,0 +1,36 @@
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import replace from '@rollup/plugin-replace';
+import { defineConfig } from 'tsdown';
+
+const require = createRequire(import.meta.url);
+const rootPkg = require('../../package.json');
+
+export default defineConfig({
+  entry: ['src/index.ts', 'src/react-query/index.ts'],
+  format: ['cjs', 'esm'],
+  platform: 'neutral',
+  // Declarations are emitted separately by `tsc -p tsconfig.build.json` (see the
+  // `build` script). This package's zod schemas aren't `isolatedDeclarations`-clean,
+  // so oxc/bundled-dts isn't viable; plain tsc keeps the rich types and is the only
+  // slow step (~2s), while rolldown bundles the JS in ~0.2s.
+  dts: false,
+  outDir: 'dist',
+  sourcemap: true,
+  deps: {
+    // Match the prior Rollup build: bundle nothing third-party. Externalize every
+    // bare import (deps, peers, and node built-ins like `crypto`); bundle only the
+    // package's own relative/aliased modules.
+    neverBundle: (id) => !id.startsWith('.') && !path.isAbsolute(id) && !id.startsWith('src/'),
+    onlyBundle: false,
+  },
+  plugins: [
+    replace({
+      preventAssignment: true,
+      values: {
+        __IS_DEV__: process.env.NODE_ENV === 'development',
+        __LIBRECHAT_VERSION__: rootPkg.version,
+      },
+    }),
+  ],
+});
diff --git a/packages/data-schemas/package.json b/packages/data-schemas/package.json
index b9afab139f4..a3c76db9a94 100644
--- a/packages/data-schemas/package.json
+++ b/packages/data-schemas/package.json
@@ -1,22 +1,32 @@
 {
   "name": "@librechat/data-schemas",
-  "version": "0.0.52",
+  "version": "0.0.53",
   "description": "Mongoose schemas and models for LibreChat",
   "type": "module",
   "main": "dist/index.cjs",
-  "module": "dist/index.es.js",
-  "types": "./dist/types/index.d.ts",
+  "module": "dist/index.mjs",
+  "types": "./dist/index.d.cts",
   "sideEffects": false,
   "exports": {
     ".": {
-      "import": "./dist/index.es.js",
-      "require": "./dist/index.cjs",
-      "types": "./dist/types/index.d.ts"
+      "import": {
+        "types": "./dist/index.d.mts",
+        "default": "./dist/index.mjs"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
     },
     "./capabilities": {
-      "import": "./dist/admin/capabilities.es.js",
-      "require": "./dist/admin/capabilities.cjs",
-      "types": "./dist/types/admin/capabilities.d.ts"
+      "import": {
+        "types": "./dist/capabilities.d.mts",
+        "default": "./dist/admin/capabilities.mjs"
+      },
+      "require": {
+        "types": "./dist/capabilities.d.cts",
+        "default": "./dist/admin/capabilities.cjs"
+      }
     }
   },
   "files": [
@@ -24,13 +34,13 @@
   ],
   "scripts": {
     "clean": "rimraf dist",
-    "build": "npm run clean && rollup -c --silent --bundleConfigAsCjs",
-    "build:watch": "rollup -c -w",
+    "build": "npm run clean && tsdown",
+    "build:watch": "tsdown --watch",
     "test": "jest --coverage --watch",
     "test:ci": "jest --coverage --ci",
     "verify": "npm run test:ci",
     "b:clean": "bun run rimraf dist",
-    "b:build": "bun run b:clean && bun run rollup -c --silent --bundleConfigAsCjs"
+    "b:build": "bun run b:clean && bun run tsdown"
   },
   "repository": {
     "type": "git",
@@ -54,14 +64,15 @@
     "@types/jest": "^29.5.2",
     "@types/node": "^24.12.4",
     "jest": "^30.2.0",
-    "jest-junit": "^16.0.0",
+    "jest-junit": "^17.0.0",
     "mongodb-memory-server": "^11.0.1",
     "rimraf": "^6.1.3",
     "rollup": "^4.34.9",
     "rollup-plugin-peer-deps-external": "^2.2.4",
     "rollup-plugin-typescript2": "^0.37.0",
     "ts-node": "^10.9.2",
-    "typescript": "^5.0.4"
+    "tsdown": "^0.22.2",
+    "typescript": "^5.9.3"
   },
   "peerDependencies": {
     "jsonwebtoken": "^9.0.2",
diff --git a/packages/data-schemas/rollup.config.js b/packages/data-schemas/rollup.config.js
deleted file mode 100644
index 703630e1214..00000000000
--- a/packages/data-schemas/rollup.config.js
+++ /dev/null
@@ -1,46 +0,0 @@
-import json from '@rollup/plugin-json';
-import typescript from '@rollup/plugin-typescript';
-import commonjs from '@rollup/plugin-commonjs';
-import nodeResolve from '@rollup/plugin-node-resolve';
-import peerDepsExternal from 'rollup-plugin-peer-deps-external';
-
-export default {
-  input: 'src/index.ts',
-  output: [
-    {
-      dir: 'dist',
-      format: 'es',
-      sourcemap: true,
-      preserveModules: true,
-      preserveModulesRoot: 'src',
-      entryFileNames: '[name].es.js',
-    },
-    {
-      dir: 'dist',
-      format: 'cjs',
-      sourcemap: true,
-      preserveModules: true,
-      preserveModulesRoot: 'src',
-      entryFileNames: '[name].cjs',
-    },
-  ],
-  plugins: [
-    // Allow importing JSON files
-    json(),
-    // Automatically externalize peer dependencies
-    peerDepsExternal(),
-    // Resolve modules from node_modules
-    nodeResolve(),
-    // Convert CommonJS modules to ES6
-    commonjs(),
-    // Compile TypeScript files and generate type declarations
-    typescript({
-      tsconfig: './tsconfig.build.json',
-      declaration: true,
-      declarationDir: 'dist/types',
-      rootDir: 'src',
-    }),
-  ],
-  // Do not bundle these external dependencies
-  external: ['mongoose'],
-};
diff --git a/packages/data-schemas/src/admin/capabilities.ts b/packages/data-schemas/src/admin/capabilities.ts
index 0284fb55864..7a966c0062a 100644
--- a/packages/data-schemas/src/admin/capabilities.ts
+++ b/packages/data-schemas/src/admin/capabilities.ts
@@ -37,6 +37,8 @@ export const SystemCapabilities = {
   MANAGE_PROMPTS: 'manage:prompts',
   READ_SKILLS: 'read:skills',
   MANAGE_SKILLS: 'manage:skills',
+  READ_SHARED_LINKS: 'read:sharedlinks',
+  MANAGE_SHARED_LINKS: 'manage:sharedlinks',
   /** Reserved — not yet enforced by any middleware. */
   READ_ASSISTANTS: 'read:assistants',
   MANAGE_ASSISTANTS: 'manage:assistants',
@@ -55,6 +57,7 @@ export const CapabilityImplications: Partial<Record<BaseSystemCapability, BaseSy
     [SystemCapabilities.MANAGE_AGENTS]: [SystemCapabilities.READ_AGENTS],
     [SystemCapabilities.MANAGE_PROMPTS]: [SystemCapabilities.READ_PROMPTS],
     [SystemCapabilities.MANAGE_SKILLS]: [SystemCapabilities.READ_SKILLS],
+    [SystemCapabilities.MANAGE_SHARED_LINKS]: [SystemCapabilities.READ_SHARED_LINKS],
     [SystemCapabilities.MANAGE_ASSISTANTS]: [SystemCapabilities.READ_ASSISTANTS],
   };
 
@@ -143,6 +146,7 @@ export const ResourceCapabilityMap: Record<ResourceType, SystemCapability> = {
   [ResourceType.MCPSERVER]: SystemCapabilities.MANAGE_MCP_SERVERS,
   [ResourceType.REMOTE_AGENT]: SystemCapabilities.MANAGE_AGENTS,
   [ResourceType.SKILL]: SystemCapabilities.MANAGE_SKILLS,
+  [ResourceType.SHARED_LINK]: SystemCapabilities.MANAGE_SHARED_LINKS,
 };
 
 /**
@@ -213,6 +217,8 @@ export const CAPABILITY_CATEGORIES: CapabilityCategory[] = [
       SystemCapabilities.MANAGE_ASSISTANTS,
       SystemCapabilities.READ_ASSISTANTS,
       SystemCapabilities.MANAGE_MCP_SERVERS,
+      SystemCapabilities.MANAGE_SHARED_LINKS,
+      SystemCapabilities.READ_SHARED_LINKS,
     ],
   },
   {
diff --git a/packages/data-schemas/src/app/endpoints.ts b/packages/data-schemas/src/app/endpoints.ts
index 1c8ed5b5d0e..70a5376528e 100644
--- a/packages/data-schemas/src/app/endpoints.ts
+++ b/packages/data-schemas/src/app/endpoints.ts
@@ -1,10 +1,15 @@
 import { EModelEndpoint } from 'librechat-data-provider';
-import type { TCustomConfig, TAgentsEndpoint, TAnthropicEndpoint } from 'librechat-data-provider';
+import type {
+  TEndpoint,
+  TCustomConfig,
+  TAgentsEndpoint,
+  TAnthropicEndpoint,
+} from 'librechat-data-provider';
 import type { AppConfig } from '~/types';
 import { azureAssistantsDefaults, assistantsConfigSetup } from './assistants';
 import { agentsConfigSetup } from './agents';
-import { azureConfigSetup } from './azure';
 import { vertexConfigSetup } from './vertex';
+import { azureConfigSetup } from './azure';
 
 /**
  * Loads custom config endpoints
@@ -14,7 +19,21 @@ import { vertexConfigSetup } from './vertex';
 export const loadEndpoints = (
   config: Partial<TCustomConfig>,
   agentsDefaults?: Partial<TAgentsEndpoint>,
-) => {
+): {
+  allowedAddresses?: string[];
+  openAI?: Partial<import('librechat-data-provider').TEndpoint>;
+  google?: Partial<import('librechat-data-provider').TEndpoint>;
+  bedrock?: Partial<import('librechat-data-provider').TEndpoint>;
+  anthropic?: Partial<TAnthropicEndpoint> & {
+    vertexConfig?: import('librechat-data-provider').TVertexAIConfig;
+  };
+  azureOpenAI?: import('librechat-data-provider').TAzureConfig;
+  assistants?: Partial<import('librechat-data-provider').TAssistantEndpoint>;
+  azureAssistants?: Partial<import('librechat-data-provider').TAssistantEndpoint>;
+  all?: Partial<import('librechat-data-provider').TEndpoint>;
+  agents?: Partial<TAgentsEndpoint>;
+  custom?: import('librechat-data-provider').TCustomEndpoints;
+} => {
   const loadedEndpoints: AppConfig['endpoints'] = {};
   const endpoints = config?.endpoints;
 
@@ -74,7 +93,12 @@ export const loadEndpoints = (
   });
 
   if (endpoints?.all) {
-    loadedEndpoints.all = endpoints.all;
+    /**
+     * `DeepPartial<TCustomConfig>` widens record values to `string | undefined`
+     * (e.g. `headers`), so cast to the concrete endpoint type — mirrors the
+     * `anthropicConfig as TAnthropicEndpoint` cast above.
+     */
+    loadedEndpoints.all = endpoints.all as Partial<TEndpoint>;
   }
 
   if (endpoints?.allowedAddresses) {
diff --git a/packages/data-schemas/src/app/interface.spec.ts b/packages/data-schemas/src/app/interface.spec.ts
index 5dbb82f5a07..d9f1adccbe9 100644
--- a/packages/data-schemas/src/app/interface.spec.ts
+++ b/packages/data-schemas/src/app/interface.spec.ts
@@ -27,6 +27,108 @@ describe('loadDefaultInterface', () => {
     expect(interfaceConfig?.autoSubmitFromUrl).toBe(false);
   });
 
+  it('preserves a disabled build info flag', async () => {
+    const config: Partial<TCustomConfig> = {
+      interface: {
+        buildInfo: false,
+      },
+    };
+
+    const interfaceConfig = await loadDefaultInterface({
+      config,
+      configDefaults: getConfigDefaults(),
+    });
+
+    expect(interfaceConfig?.buildInfo).toBe(false);
+  });
+
+  it('uses the schema default for build info when not configured', async () => {
+    const interfaceConfig = await loadDefaultInterface({
+      config: {},
+      configDefaults: getConfigDefaults(),
+    });
+
+    expect(interfaceConfig?.buildInfo).toBe(true);
+  });
+
+  it('preserves enabled build info config', async () => {
+    const config: Partial<TCustomConfig> = {
+      interface: {
+        buildInfo: true,
+      },
+    };
+
+    const interfaceConfig = await loadDefaultInterface({
+      config,
+      configDefaults: getConfigDefaults(),
+    });
+
+    expect(interfaceConfig?.buildInfo).toBe(true);
+  });
+
+  it('disables context cost by default', async () => {
+    const interfaceConfig = await loadDefaultInterface({
+      config: {},
+      configDefaults: getConfigDefaults(),
+    });
+
+    expect(interfaceConfig?.contextCost).toBe(false);
+  });
+
+  it('preserves a disabled context cost flag', async () => {
+    const config: Partial<TCustomConfig> = {
+      interface: {
+        contextCost: false,
+      },
+    };
+
+    const interfaceConfig = await loadDefaultInterface({
+      config,
+      configDefaults: getConfigDefaults(),
+    });
+
+    expect(interfaceConfig?.contextCost).toBe(false);
+  });
+
+  it('preserves enabled context cost config', async () => {
+    const config: Partial<TCustomConfig> = {
+      interface: {
+        contextCost: true,
+      },
+    };
+
+    const interfaceConfig = await loadDefaultInterface({
+      config,
+      configDefaults: getConfigDefaults(),
+    });
+
+    expect(interfaceConfig?.contextCost).toBe(true);
+  });
+
+  it('passes through a configured display currency', async () => {
+    const config: Partial<TCustomConfig> = {
+      interface: {
+        currency: { code: 'EUR', rate: 0.92 },
+      },
+    };
+
+    const interfaceConfig = await loadDefaultInterface({
+      config,
+      configDefaults: getConfigDefaults(),
+    });
+
+    expect(interfaceConfig?.currency).toEqual({ code: 'EUR', rate: 0.92 });
+  });
+
+  it('omits currency when it is not configured', async () => {
+    const interfaceConfig = await loadDefaultInterface({
+      config: {},
+      configDefaults: getConfigDefaults(),
+    });
+
+    expect(interfaceConfig?.currency).toBeUndefined();
+  });
+
   it('preserves enabled URL auto-submit config', async () => {
     const config: Partial<TCustomConfig> = {
       interface: {
diff --git a/packages/data-schemas/src/app/interface.ts b/packages/data-schemas/src/app/interface.ts
index ece570f6bde..ba6c6bed960 100644
--- a/packages/data-schemas/src/app/interface.ts
+++ b/packages/data-schemas/src/app/interface.ts
@@ -39,6 +39,10 @@ export async function loadDefaultInterface({
     mcpServers: interfaceConfig?.mcpServers ?? defaults.mcpServers,
     customWelcome: interfaceConfig?.customWelcome ?? defaults.customWelcome,
     autoSubmitFromUrl: interfaceConfig?.autoSubmitFromUrl ?? defaults.autoSubmitFromUrl,
+    buildInfo: interfaceConfig?.buildInfo ?? defaults.buildInfo,
+    contextUsage: interfaceConfig?.contextUsage ?? defaults.contextUsage,
+    contextCost: interfaceConfig?.contextCost ?? defaults.contextCost,
+    currency: interfaceConfig?.currency ?? defaults.currency,
 
     // Permissions and related settings - only include if explicitly configured
     bookmarks: interfaceConfig?.bookmarks,
@@ -58,6 +62,7 @@ export async function loadDefaultInterface({
     marketplace: interfaceConfig?.marketplace,
     remoteAgents: interfaceConfig?.remoteAgents,
     skills: interfaceConfig?.skills,
+    sharedLinks: interfaceConfig?.sharedLinks,
   });
 
   return loadedInterface;
diff --git a/packages/data-schemas/src/app/memory.ts b/packages/data-schemas/src/app/memory.ts
index a3b89176db4..ee298db9399 100644
--- a/packages/data-schemas/src/app/memory.ts
+++ b/packages/data-schemas/src/app/memory.ts
@@ -1,4 +1,4 @@
-import { memorySchema } from 'librechat-data-provider';
+import { DEFAULT_MEMORY_MAX_INPUT_TOKENS, memorySchema } from 'librechat-data-provider';
 
 import type { TCustomConfig, TMemoryConfig } from 'librechat-data-provider';
 
@@ -23,8 +23,11 @@ export function loadMemoryConfig(config: TCustomConfig['memory']): TMemoryConfig
   }
 
   const charLimit = memorySchema.shape.charLimit.safeParse(config.charLimit).data ?? 10000;
+  const maxInputTokens =
+    memorySchema.shape.maxInputTokens.safeParse(config.maxInputTokens).data ??
+    DEFAULT_MEMORY_MAX_INPUT_TOKENS;
 
-  return { ...config, charLimit };
+  return { ...config, charLimit, maxInputTokens };
 }
 
 export function isMemoryEnabled(config: TMemoryConfig | undefined): boolean {
diff --git a/packages/data-schemas/src/app/resolution.spec.ts b/packages/data-schemas/src/app/resolution.spec.ts
index b751e0bbcf0..d3020c07074 100644
--- a/packages/data-schemas/src/app/resolution.spec.ts
+++ b/packages/data-schemas/src/app/resolution.spec.ts
@@ -1,8 +1,12 @@
 import { INTERFACE_PERMISSION_FIELDS, PermissionTypes } from 'librechat-data-provider';
-import { mergeConfigOverrides } from './resolution';
 import type { AppConfig, IConfig } from '~/types';
+import { mergeConfigOverrides } from './resolution';
 
-function fakeConfig(overrides: Record<string, unknown>, priority: number): IConfig {
+function fakeConfig(
+  overrides: Record<string, unknown>,
+  priority: number,
+  tombstones?: string[],
+): IConfig {
   return {
     _id: 'fake',
     principalType: 'role',
@@ -10,6 +14,7 @@ function fakeConfig(overrides: Record<string, unknown>, priority: number): IConf
     principalModel: 'Role',
     priority,
     overrides,
+    tombstones,
     isActive: true,
     configVersion: 1,
   } as unknown as IConfig;
@@ -342,6 +347,66 @@ describe('mergeConfigOverrides', () => {
     expect(iface.parameters).toBe(true);
   });
 
+  it('merges skillSync config sections from DB overrides', () => {
+    const base = {
+      skillSync: {
+        github: {
+          enabled: true,
+          intervalMinutes: 60,
+          runOnStartup: false,
+          sources: [
+            {
+              id: 'base-source',
+              owner: 'LibreChat',
+              repo: 'skills',
+              ref: 'main',
+              paths: ['skills'],
+              token: '${GITHUB_SKILLS_TOKEN}',
+            },
+          ],
+        },
+      },
+      interfaceConfig: { modelSelect: true },
+    } as unknown as AppConfig;
+
+    const configs = [
+      fakeConfig(
+        {
+          skillSync: {
+            github: {
+              enabled: false,
+              sources: [
+                {
+                  id: 'override-source',
+                  owner: 'other',
+                  repo: 'skills',
+                  paths: ['skills'],
+                  token: '${OTHER_TOKEN}',
+                },
+              ],
+            },
+          },
+          interface: { modelSelect: false },
+        },
+        10,
+      ),
+    ];
+
+    const result = mergeConfigOverrides(base, configs);
+
+    expect(result.skillSync?.github?.enabled).toBe(false);
+    expect(result.skillSync?.github?.sources).toEqual([
+      {
+        id: 'override-source',
+        owner: 'other',
+        repo: 'skills',
+        paths: ['skills'],
+        token: '${OTHER_TOKEN}',
+      },
+    ]);
+    expect(result.interfaceConfig?.modelSelect).toBe(false);
+  });
+
   it('preserves UI sub-keys in composite permission fields like mcpServers', () => {
     const base = {
       interfaceConfig: {},
@@ -426,6 +491,67 @@ describe('mergeConfigOverrides', () => {
     });
     expect(result.mcpServers).toBeUndefined();
   });
+
+  it('applies tombstones after remapping YAML paths to AppConfig paths', () => {
+    const base = {
+      mcpConfig: {
+        github: { type: 'streamable-http', url: 'https://github.example.com' },
+        slack: { type: 'streamable-http', url: 'https://slack.example.com' },
+      },
+    } as unknown as AppConfig;
+
+    const result = mergeConfigOverrides(base, [
+      fakeConfig({}, 10, ['mcpServers.github']),
+    ]) as unknown as Record<string, unknown>;
+    const mcpConfig = result.mcpConfig as Record<string, unknown>;
+
+    expect(mcpConfig.github).toBeUndefined();
+    expect(mcpConfig.slack).toEqual({
+      type: 'streamable-http',
+      url: 'https://slack.example.com',
+    });
+
+    const baseMcpConfig = (base as unknown as Record<string, unknown>).mcpConfig as Record<
+      string,
+      unknown
+    >;
+    expect(baseMcpConfig.github).toEqual({
+      type: 'streamable-http',
+      url: 'https://github.example.com',
+    });
+  });
+
+  it('lets a higher-priority override recreate a lower-priority tombstoned path', () => {
+    const base = {
+      mcpConfig: {
+        github: { type: 'streamable-http', url: 'https://github.example.com' },
+      },
+    } as unknown as AppConfig;
+
+    const result = mergeConfigOverrides(base, [
+      fakeConfig({}, 10, ['mcpServers.github']),
+      fakeConfig({ mcpServers: { github: { url: 'https://scoped.example.com' } } }, 100),
+    ]) as unknown as Record<string, unknown>;
+    const mcpConfig = result.mcpConfig as Record<string, unknown>;
+
+    expect(mcpConfig.github).toEqual({
+      url: 'https://scoped.example.com',
+    });
+  });
+
+  it('lets a higher-priority tombstone suppress a lower-priority override', () => {
+    const base = {
+      mcpConfig: {},
+    } as unknown as AppConfig;
+
+    const result = mergeConfigOverrides(base, [
+      fakeConfig({ mcpServers: { github: { url: 'https://role.example.com' } } }, 10),
+      fakeConfig({}, 100, ['mcpServers.github']),
+    ]) as unknown as Record<string, unknown>;
+    const mcpConfig = result.mcpConfig as Record<string, unknown>;
+
+    expect(mcpConfig.github).toBeUndefined();
+  });
 });
 
 describe('INTERFACE_PERMISSION_FIELDS', () => {
diff --git a/packages/data-schemas/src/app/resolution.ts b/packages/data-schemas/src/app/resolution.ts
index cc1e11cb821..4f17acac2ce 100644
--- a/packages/data-schemas/src/app/resolution.ts
+++ b/packages/data-schemas/src/app/resolution.ts
@@ -1,4 +1,8 @@
-import { INTERFACE_PERMISSION_FIELDS, PERMISSION_SUB_KEYS } from 'librechat-data-provider';
+import {
+  BASE_ONLY_CONFIG_SECTIONS,
+  INTERFACE_PERMISSION_FIELDS,
+  PERMISSION_SUB_KEYS,
+} from 'librechat-data-provider';
 import type { TCustomConfig } from 'librechat-data-provider';
 import type { AppConfig, IConfig } from '~/types';
 
@@ -6,6 +10,7 @@ type AnyObject = { [key: string]: unknown };
 
 const MAX_MERGE_DEPTH = 10;
 const UNSAFE_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+const BASE_ONLY_OVERRIDE_SECTIONS = new Set<string>(BASE_ONLY_CONFIG_SECTIONS);
 
 /**
  * Paths within the config tree where arrays of objects should be merged by
@@ -36,6 +41,50 @@ const OVERRIDE_KEY_MAP: Partial<Record<keyof TCustomConfig, keyof AppConfig>> =
   turnstile: 'turnstileConfig',
 };
 
+function isSafePath(path: string): boolean {
+  const segments = path.split('.');
+  if (
+    path.length === 0 ||
+    path.startsWith('.') ||
+    path.endsWith('.') ||
+    path.includes('..') ||
+    segments.some((segment) => segment.length === 0 || UNSAFE_KEYS.has(segment))
+  ) {
+    return false;
+  }
+  return true;
+}
+
+function remapOverridePath(path: string): string {
+  const [first, ...rest] = path.split('.');
+  const mappedFirst = OVERRIDE_KEY_MAP[first as keyof typeof OVERRIDE_KEY_MAP] ?? first;
+  return [mappedFirst, ...rest].join('.');
+}
+
+function deletePath<T extends AnyObject>(target: T, path: string): T {
+  if (!isSafePath(path)) {
+    return target;
+  }
+
+  const segments = path.split('.');
+  const result = { ...target } as AnyObject;
+  let cursor: AnyObject = result;
+
+  for (let index = 0; index < segments.length - 1; index++) {
+    const segment = segments[index];
+    const value = cursor[segment];
+    if (value == null || typeof value !== 'object' || Array.isArray(value)) {
+      return result as T;
+    }
+    const cloned = { ...(value as AnyObject) };
+    cursor[segment] = cloned;
+    cursor = cloned;
+  }
+
+  delete cursor[segments[segments.length - 1]];
+  return result as T;
+}
+
 function mergeArrayByKey(
   target: AnyObject[],
   source: AnyObject[],
@@ -144,9 +193,20 @@ export function mergeConfigOverrides(baseConfig: AppConfig, configs: IConfig[]):
 
   let merged = { ...baseConfig };
   for (const config of sorted) {
+    if (Array.isArray(config.tombstones)) {
+      for (const path of config.tombstones) {
+        if (typeof path === 'string') {
+          merged = deletePath(merged, remapOverridePath(path));
+        }
+      }
+    }
+
     if (config.overrides && typeof config.overrides === 'object') {
       const remapped: AnyObject = {};
       for (const [key, value] of Object.entries(config.overrides)) {
+        if (BASE_ONLY_OVERRIDE_SECTIONS.has(key)) {
+          continue;
+        }
         const mappedKey = OVERRIDE_KEY_MAP[key as keyof typeof OVERRIDE_KEY_MAP] ?? key;
         if (
           key === 'interface' &&
diff --git a/packages/data-schemas/src/app/service.ts b/packages/data-schemas/src/app/service.ts
index 19fec9f5a17..fe3ae1b0073 100644
--- a/packages/data-schemas/src/app/service.ts
+++ b/packages/data-schemas/src/app/service.ts
@@ -1,6 +1,7 @@
 import {
   EModelEndpoint,
   getConfigDefaults,
+  skillSyncConfigSchema,
   summarizationConfigSchema,
 } from 'librechat-data-provider';
 import type { TCustomConfig, FileSources, DeepPartial } from 'librechat-data-provider';
@@ -51,6 +52,21 @@ export function loadSummarizationConfig(
   };
 }
 
+export function loadSkillSyncConfig(config: DeepPartial<TCustomConfig>): AppConfig['skillSync'] {
+  const raw = config.skillSync;
+  if (!raw || typeof raw !== 'object') {
+    return undefined;
+  }
+
+  const parsed = skillSyncConfigSchema.safeParse(raw);
+  if (!parsed.success) {
+    logger.warn('[AppService] Invalid skill sync config', parsed.error.flatten());
+    return undefined;
+  }
+
+  return parsed.data;
+}
+
 export type Paths = {
   root: string;
   uploads: string;
@@ -83,6 +99,7 @@ export const AppService = async (params?: {
   const webSearch = loadWebSearchConfig(config.webSearch);
   const memory = loadMemoryConfig(config.memory);
   const summarization = loadSummarizationConfig(config);
+  const skillSync = loadSkillSyncConfig(config);
   const filteredTools = config.filteredTools;
   const includedTools = config.includedTools;
   const fileStrategy = (config.fileStrategy ?? configDefaults.fileStrategy) as
@@ -110,6 +127,7 @@ export const AppService = async (params?: {
   const interfaceConfig = await loadDefaultInterface({ config, configDefaults });
   const turnstileConfig = loadTurnstileConfig(config, configDefaults);
   const speech = config.speech;
+  const messageFilter = config.messageFilter;
 
   const defaultConfig = {
     ocr,
@@ -117,15 +135,17 @@ export const AppService = async (params?: {
     config,
     memory,
     speech,
-    balance,
     actions,
+    balance,
+    skillSync,
     webSearch,
     mcpSettings,
-    transactions,
     fileStrategy,
     registration,
+    transactions,
     filteredTools,
     includedTools,
+    messageFilter,
     summarization,
     availableTools,
     imageOutputType,
diff --git a/packages/data-schemas/src/app/vertex.ts b/packages/data-schemas/src/app/vertex.ts
index 92c71c370be..c773729bedd 100644
--- a/packages/data-schemas/src/app/vertex.ts
+++ b/packages/data-schemas/src/app/vertex.ts
@@ -1,4 +1,3 @@
-import logger from '~/config/winston';
 import {
   EModelEndpoint,
   extractEnvVariable,
@@ -12,12 +11,13 @@ import type {
   TAnthropicEndpoint,
   TVertexModelConfig,
 } from 'librechat-data-provider';
+import logger from '~/config/winston';
 
 /**
  * Default Vertex AI models available through Google Cloud
  * These are the standard Anthropic model names as served by Vertex AI
  */
-export const defaultVertexModels = [
+export const defaultVertexModels: string[] = [
   'claude-sonnet-4-6',
   'claude-3-7-sonnet-20250219',
   'claude-3-5-sonnet-v2@20241022',
diff --git a/packages/data-schemas/src/common/enum.ts b/packages/data-schemas/src/common/enum.ts
index 6fdce9c2bc9..191191ecdf5 100644
--- a/packages/data-schemas/src/common/enum.ts
+++ b/packages/data-schemas/src/common/enum.ts
@@ -1,15 +1,28 @@
 import { PermissionBits } from 'librechat-data-provider';
 
 /**
- * Common role combinations
+ * Common role combinations. Values mirror unions of `PermissionBits` flags;
+ * literals are required by `--isolatedDeclarations` (cross-file enum refs
+ * aren't computable). The guard below fails fast on any drift.
  */
 export enum RoleBits {
-  /** 0001 = 1 */
-  VIEWER = PermissionBits.VIEW,
-  /** 0011 = 3 */
-  EDITOR = PermissionBits.VIEW | PermissionBits.EDIT,
-  /** 0111 = 7 */
-  MANAGER = PermissionBits.VIEW | PermissionBits.EDIT | PermissionBits.DELETE,
-  /** 1111 = 15 */
-  OWNER = PermissionBits.VIEW | PermissionBits.EDIT | PermissionBits.DELETE | PermissionBits.SHARE,
+  /** VIEW */
+  VIEWER = 1,
+  /** VIEW | EDIT */
+  EDITOR = 3,
+  /** VIEW | EDIT | DELETE */
+  MANAGER = 7,
+  /** VIEW | EDIT | DELETE | SHARE */
+  OWNER = 15,
+}
+
+if (
+  (RoleBits.VIEWER as number) !== PermissionBits.VIEW ||
+  (RoleBits.EDITOR as number) !== (PermissionBits.VIEW | PermissionBits.EDIT) ||
+  (RoleBits.MANAGER as number) !==
+    (PermissionBits.VIEW | PermissionBits.EDIT | PermissionBits.DELETE) ||
+  (RoleBits.OWNER as number) !==
+    (PermissionBits.VIEW | PermissionBits.EDIT | PermissionBits.DELETE | PermissionBits.SHARE)
+) {
+  throw new Error('RoleBits is out of sync with PermissionBits');
 }
diff --git a/packages/data-schemas/src/config/meiliLogger.ts b/packages/data-schemas/src/config/meiliLogger.ts
index 243b3bed691..46cff165fa4 100644
--- a/packages/data-schemas/src/config/meiliLogger.ts
+++ b/packages/data-schemas/src/config/meiliLogger.ts
@@ -72,7 +72,7 @@ transports.push(
   }),
 );
 
-const logger = winston.createLogger({
+const logger: winston.Logger = winston.createLogger({
   level: level(),
   levels,
   transports,
diff --git a/packages/data-schemas/src/config/parsers.spec.ts b/packages/data-schemas/src/config/parsers.spec.ts
index 188f42db3cc..b008c0aeb95 100644
--- a/packages/data-schemas/src/config/parsers.spec.ts
+++ b/packages/data-schemas/src/config/parsers.spec.ts
@@ -1,4 +1,5 @@
-import { debugTraverse } from './parsers';
+import winston from 'winston';
+import { debugTraverse, redactFormat, redactMessage } from './parsers';
 
 const SPLAT_SYMBOL = Symbol.for('splat');
 const MESSAGE_SYMBOL = Symbol.for('message');
@@ -9,6 +10,20 @@ type FormatterInfo = Record<string | symbol, unknown> & {
   timestamp: string;
 };
 
+type RedactInfo = Record<string | symbol, unknown> & {
+  level: string;
+  message: unknown;
+};
+
+function runRedactFormat(info: RedactInfo): RedactInfo {
+  return (redactFormat().transform(info) || info) as RedactInfo;
+}
+
+function runRedactSplatFormat(info: RedactInfo): RedactInfo {
+  const format = winston.format.combine(redactFormat(), winston.format.splat());
+  return (format.transform(info) || info) as RedactInfo;
+}
+
 function runFormatter(info: FormatterInfo): string {
   const transformed = debugTraverse.transform(info);
   if (transformed && typeof transformed === 'object') {
@@ -28,6 +43,240 @@ function buildInfo(level: string, meta: Record<string, unknown>): FormatterInfo
   };
 }
 
+describe('redactMessage', () => {
+  it('redacts sensitive token patterns anywhere in a message', () => {
+    expect(redactMessage('token: sk-abc123def')).toBe('token: sk-[REDACTED]');
+    expect(redactMessage('auth Bearer secretvalue')).toBe('auth Bearer [REDACTED]');
+    expect(redactMessage('api-key: secretvalue')).toBe('api-key: [REDACTED]');
+    expect(redactMessage('https://example.test/?key=secretvalue&next=true')).toBe(
+      'https://example.test/?key=[REDACTED]&next=true',
+    );
+    expect(redactMessage('https://example.test/?api_key=secretvalue&next=true')).toBe(
+      'https://example.test/?api_key=[REDACTED]&next=true',
+    );
+  });
+
+  it('does not redact ordinary words containing sensitive prefixes', () => {
+    expect(redactMessage('task-runner failed')).toBe('task-runner failed');
+    expect(redactMessage('mask-value computed')).toBe('mask-value computed');
+    expect(redactMessage('monkey=10 bananas')).toBe('monkey=10 bananas');
+  });
+});
+
+describe('redactFormat', () => {
+  it.each(['error', 'warn', 'info', 'debug'])('redacts info.message for %s level', (level) => {
+    const info = runRedactFormat({ level, message: 'Bearer secretvalue' });
+    expect(info.message).toBe('Bearer [REDACTED]');
+  });
+
+  it('redacts the winston message symbol', () => {
+    const info = runRedactFormat({
+      level: 'info',
+      message: 'visible',
+      [MESSAGE_SYMBOL]: 'token: sk-abc123def',
+    });
+
+    expect(info[MESSAGE_SYMBOL]).toBe('token: sk-[REDACTED]');
+  });
+
+  it('redacts splat arguments before winston interpolates them', () => {
+    const info = runRedactSplatFormat({
+      level: 'info',
+      message: 'token %s',
+      [SPLAT_SYMBOL]: ['sk-abc123def'],
+    });
+
+    expect(info.message).toBe('token sk-[REDACTED]');
+  });
+
+  it('redacts string values in splat metadata', () => {
+    const metadata = {
+      auth: 'Bearer secretvalue',
+      nested: { url: 'https://example.test/?key=secretvalue&next=true' },
+    };
+    const info = runRedactFormat({
+      level: 'info',
+      message: 'visible',
+      [SPLAT_SYMBOL]: [metadata],
+    });
+    const splat = info[SPLAT_SYMBOL] as Array<{ auth: string; nested: { url: string } }>;
+
+    expect(splat[0].auth).toBe('Bearer [REDACTED]');
+    expect(splat[0].nested.url).toBe('https://example.test/?key=[REDACTED]&next=true');
+    expect(metadata.auth).toBe('Bearer secretvalue');
+    expect(metadata.nested.url).toBe('https://example.test/?key=secretvalue&next=true');
+  });
+
+  it('redacts values under sensitive splat metadata keys', () => {
+    const metadata = {
+      apiKey: 'secretvalue',
+      authorization: 'secretvalue',
+      nested: { token: 'secretvalue' },
+      safe: 'secretvalue',
+      'x-api-key': 'secretvalue',
+    };
+    const info = runRedactFormat({
+      level: 'info',
+      message: 'visible',
+      [SPLAT_SYMBOL]: [metadata],
+    });
+    const splat = info[SPLAT_SYMBOL] as Array<typeof metadata>;
+
+    expect(splat[0].apiKey).toBe('[REDACTED]');
+    expect(splat[0].authorization).toBe('[REDACTED]');
+    expect(splat[0].nested.token).toBe('[REDACTED]');
+    expect(splat[0]['x-api-key']).toBe('[REDACTED]');
+    expect(splat[0].safe).toBe('secretvalue');
+    expect(metadata.apiKey).toBe('secretvalue');
+    expect(metadata.nested.token).toBe('secretvalue');
+  });
+
+  it('redacts object messages before serialization', () => {
+    const message = {
+      apiKey: 'secretvalue',
+      nested: { url: 'https://example.test/?api_key=secretvalue&next=true' },
+    };
+    const info = runRedactFormat({
+      level: 'debug',
+      message,
+    });
+
+    expect(info.message).toEqual({
+      apiKey: '[REDACTED]',
+      nested: { url: 'https://example.test/?api_key=[REDACTED]&next=true' },
+    });
+    expect(message.apiKey).toBe('secretvalue');
+    expect(message.nested.url).toBe('https://example.test/?api_key=secretvalue&next=true');
+  });
+
+  it('redacts serializable non-plain splat values before interpolation', () => {
+    const info = runRedactSplatFormat({
+      level: 'info',
+      message: 'values %s %s',
+      [SPLAT_SYMBOL]: [
+        new URL('https://example.test/?api_key=secretvalue&next=true'),
+        Buffer.from('sk-abc123def'),
+      ],
+    });
+
+    expect(info.message).toBe(
+      'values https://example.test/?api_key=[REDACTED]&next=true sk-[REDACTED]',
+    );
+  });
+
+  it('summarizes large buffer splats instead of scanning the whole payload', () => {
+    const buffer = Buffer.concat([Buffer.alloc(9000, 'a'), Buffer.from('sk-abc123def')]);
+
+    const info = runRedactSplatFormat({
+      level: 'info',
+      message: 'payload %s',
+      [SPLAT_SYMBOL]: [buffer],
+    });
+
+    expect(info.message).toBe(`payload [REDACTED Buffer ${buffer.length} bytes]`);
+    expect(info.message).not.toContain('sk-abc123def');
+  });
+
+  it('bounds large object and array redaction work', () => {
+    const metadata: Record<string, unknown> = {};
+    Array.from({ length: 60 }).forEach((_, index) => {
+      metadata[`field${index}`] = index === 59 ? 'sk-abc123def' : `safe-${index}`;
+    });
+
+    const info = runRedactFormat({
+      level: 'info',
+      message: 'visible',
+      [SPLAT_SYMBOL]: [[metadata, ...Array.from({ length: 60 }, (_, index) => `safe-${index}`)]],
+    });
+    const splat = info[SPLAT_SYMBOL] as Array<Array<Record<string, unknown> | string>>;
+    const redactedObject = splat[0][0] as Record<string, unknown>;
+
+    expect(Object.keys(redactedObject)).toHaveLength(51);
+    expect(redactedObject.field49).toBe('safe-49');
+    expect(redactedObject.field59).toBeUndefined();
+    expect(redactedObject.__redaction_truncated__).toBe('Additional object properties omitted');
+    expect(splat[0]).toHaveLength(51);
+    expect(splat[0][50]).toBe('Additional array values omitted');
+    expect(JSON.stringify(splat)).not.toContain('sk-abc123def');
+  });
+
+  it('redacts over-deep object subtrees instead of traversing indefinitely', () => {
+    const root: Record<string, unknown> = {};
+    let current = root;
+    Array.from({ length: 12 }).forEach((_, index) => {
+      current.child = { label: `level-${index}` };
+      current = current.child as Record<string, unknown>;
+    });
+    current.apiKey = 'secretvalue';
+
+    const info = runRedactFormat({
+      level: 'info',
+      message: root,
+    });
+
+    const serialized = JSON.stringify(info.message);
+    expect(serialized).toContain('[REDACTED]');
+    expect(serialized).not.toContain('secretvalue');
+  });
+
+  it('redacts error splat arguments without mutating the original error', () => {
+    const error = new Error('Bearer secretvalue');
+    error.stack = 'Error: Bearer secretvalue\n    at request';
+
+    const info = runRedactFormat({
+      level: 'warn',
+      message: 'request failed',
+      [SPLAT_SYMBOL]: [error],
+    });
+    const splat = info[SPLAT_SYMBOL] as Error[];
+
+    expect(splat[0]).toBeInstanceOf(Error);
+    expect(splat[0]).not.toBe(error);
+    expect(splat[0].message).toBe('Bearer [REDACTED]');
+    expect(splat[0].stack).toContain('Bearer [REDACTED]');
+    expect(Object.prototype.propertyIsEnumerable.call(splat[0], 'message')).toBe(false);
+    expect(Object.prototype.propertyIsEnumerable.call(splat[0], 'stack')).toBe(false);
+    expect(error.message).toBe('Bearer secretvalue');
+    expect(error.stack).toContain('Bearer secretvalue');
+  });
+
+  it('preserves contextual messages when redacting error splat arguments', () => {
+    const error = new Error('Bearer secretvalue');
+
+    const info = runRedactSplatFormat({
+      level: 'warn',
+      message: 'request failed',
+      [SPLAT_SYMBOL]: [error],
+    });
+
+    expect(info.message).toBe('request failed');
+  });
+
+  it('preserves and redacts non-enumerable error causes when cloning errors', () => {
+    const cause = new Error('Bearer cause-secret');
+    const error = new Error('outer');
+    Object.defineProperty(error, 'cause', {
+      value: cause,
+      writable: true,
+      enumerable: false,
+      configurable: true,
+    });
+
+    const info = runRedactFormat({
+      level: 'warn',
+      message: 'request failed',
+      [SPLAT_SYMBOL]: [error],
+    });
+    const splat = info[SPLAT_SYMBOL] as Array<Error & { cause?: Error }>;
+
+    expect(splat[0].cause).toBeInstanceOf(Error);
+    expect(splat[0].cause).not.toBe(cause);
+    expect(splat[0].cause?.message).toBe('Bearer [REDACTED]');
+    expect(Object.prototype.propertyIsEnumerable.call(splat[0], 'cause')).toBe(false);
+    expect(cause.message).toBe('Bearer cause-secret');
+  });
+});
+
 describe('debugTraverse request context', () => {
   it('appends request context metadata for non-debug lines', () => {
     const out = runFormatter(
diff --git a/packages/data-schemas/src/config/parsers.ts b/packages/data-schemas/src/config/parsers.ts
index e21927a72b3..ad12f2cfe55 100644
--- a/packages/data-schemas/src/config/parsers.ts
+++ b/packages/data-schemas/src/config/parsers.ts
@@ -1,8 +1,8 @@
 import { klona } from 'klona';
 import winston from 'winston';
-import traverse from '../utils/object-traverse';
-import { SYSTEM_TENANT_ID } from './tenantContext';
 import type { TraverseContext } from '../utils/object-traverse';
+import { SYSTEM_TENANT_ID } from './tenantContext';
+import traverse from '../utils/object-traverse';
 
 const SPLAT_SYMBOL = Symbol.for('splat');
 const MESSAGE_SYMBOL = Symbol.for('message');
@@ -10,27 +10,28 @@ const CONSOLE_JSON_STRING_LENGTH: number =
   parseInt(process.env.CONSOLE_JSON_STRING_LENGTH || '', 10) || 255;
 const DEBUG_MESSAGE_LENGTH: number = parseInt(process.env.DEBUG_MESSAGE_LENGTH || '', 10) || 150;
 const LOG_CONTEXT_KEYS = ['tenantId', 'userId', 'requestId'] as const;
+const REDACTED_VALUE = '[REDACTED]';
+const REDACTION_TRUNCATED_KEY = '__redaction_truncated__';
+const MAX_REDACTION_DEPTH = 8;
+const MAX_REDACTION_ENTRIES = 50;
+const DEFAULT_REDACTION_STRING_LENGTH = 8192;
+const MAX_REDACTION_STRING_LENGTH = Math.max(
+  CONSOLE_JSON_STRING_LENGTH,
+  DEFAULT_REDACTION_STRING_LENGTH,
+);
+const MAX_REDACTION_BUFFER_BYTES = MAX_REDACTION_STRING_LENGTH;
 
 const sensitiveKeys: RegExp[] = [
-  /^(sk-)[^\s]+/, // OpenAI API key pattern
-  /(Bearer )[^\s]+/, // Header: Bearer token pattern
-  /(api-key:? )[^\s]+/, // Header: API key pattern
-  /(key=)[^\s]+/, // URL query param: sensitive key pattern (Google)
+  /\b(sk-)[a-zA-Z0-9_-]+/g, // OpenAI API key pattern
+  /\b(Bearer )[^\s"']+/g, // Header: Bearer token pattern
+  /\b(api-key:? )[^\s"']+/gi, // Header: API key pattern
+  /\b(api_key=)[^\s"'&]+/gi, // URL query param: API key pattern
+  /\b(key=)[^\s"'&]+/g, // URL query param: sensitive key pattern
 ];
 
-/**
- * Determines if a given value string is sensitive and returns matching regex patterns.
- *
- * @param valueStr - The value string to check.
- * @returns An array of regex patterns that match the value string.
- */
-function getMatchingSensitivePatterns(valueStr: string): RegExp[] {
-  if (valueStr) {
-    // Filter and return all regex patterns that match the value string
-    return sensitiveKeys.filter((regex) => regex.test(valueStr));
-  }
-  return [];
-}
+const sensitiveMetadataKey =
+  /^(authorization|proxy-authorization|x-api-key|api[-_]?key|access[-_]?token|refresh[-_]?token|id[-_]?token|token|secret|password)$/i;
+const errorStringProperties = new Set(['name', 'message', 'stack']);
 
 /**
  * Redacts sensitive information from a console message and trims it to a specified length if provided.
@@ -43,39 +44,311 @@ function redactMessage(str: string, trimLength?: number): string {
     return '';
   }
 
-  const patterns = getMatchingSensitivePatterns(str);
-  patterns.forEach((pattern) => {
-    str = str.replace(pattern, '$1[REDACTED]');
+  const redacted = sensitiveKeys.reduce(
+    (currentMessage, pattern) => currentMessage.replace(pattern, '$1[REDACTED]'),
+    str,
+  );
+
+  if (trimLength !== undefined && redacted.length > trimLength) {
+    return `${redacted.substring(0, trimLength)}...`;
+  }
+
+  return redacted;
+}
+
+function redactLogString(str: string): string {
+  if (str.length <= MAX_REDACTION_STRING_LENGTH) {
+    return redactMessage(str);
+  }
+
+  const redacted = redactMessage(str.substring(0, MAX_REDACTION_STRING_LENGTH));
+  return `${redacted}... [truncated ${str.length - MAX_REDACTION_STRING_LENGTH} chars]`;
+}
+
+function isPlainRecord(value: object): value is Record<string, unknown> {
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+
+function isSensitiveMetadataKey(key: string): boolean {
+  return sensitiveMetadataKey.test(key);
+}
+
+function redactRecordValue(
+  key: string,
+  value: unknown,
+  seen: WeakMap<object, unknown>,
+  depth: number,
+): unknown {
+  return isSensitiveMetadataKey(key) ? REDACTED_VALUE : redactLogValue(value, seen, depth);
+}
+
+function defineRedactedErrorProperty(
+  error: Error & Record<string, unknown>,
+  key: 'name' | 'message' | 'stack',
+  value: string | undefined,
+): void {
+  if (value === undefined) {
+    return;
+  }
+
+  Object.defineProperty(error, key, {
+    value: redactLogString(value),
+    writable: true,
+    enumerable: false,
+    configurable: true,
+  });
+}
+
+function defineRedactedDescriptor(
+  target: Error & Record<string, unknown>,
+  key: string | symbol,
+  descriptor: PropertyDescriptor,
+  seen: WeakMap<object, unknown>,
+  depth: number,
+): void {
+  if (!('value' in descriptor)) {
+    Object.defineProperty(target, key, descriptor);
+    return;
+  }
+
+  Object.defineProperty(target, key, {
+    ...descriptor,
+    value:
+      typeof key === 'string'
+        ? redactRecordValue(key, descriptor.value, seen, depth)
+        : redactLogValue(descriptor.value, seen, depth),
+  });
+}
+
+function redactErrorValue(error: Error, seen: WeakMap<object, unknown>, depth: number): Error {
+  const redacted = Object.create(Object.getPrototypeOf(error)) as Error & Record<string, unknown>;
+  seen.set(error, redacted);
+
+  defineRedactedErrorProperty(redacted, 'name', error.name);
+  defineRedactedErrorProperty(redacted, 'message', error.message);
+  defineRedactedErrorProperty(redacted, 'stack', error.stack);
+
+  Reflect.ownKeys(error).forEach((key) => {
+    if (typeof key === 'string' && errorStringProperties.has(key)) {
+      return;
+    }
+    const descriptor = Object.getOwnPropertyDescriptor(error, key);
+    if (descriptor === undefined) {
+      return;
+    }
+    defineRedactedDescriptor(redacted, key, descriptor, seen, depth + 1);
   });
+  return redacted;
+}
+
+function isBufferValue(value: object): value is Buffer {
+  return typeof Buffer !== 'undefined' && Buffer.isBuffer(value);
+}
+
+function getJsonValue(value: object): unknown {
+  const toJSON = (value as { toJSON?: unknown }).toJSON;
+  if (typeof toJSON !== 'function') {
+    return undefined;
+  }
+
+  try {
+    const jsonValue = toJSON.call(value);
+    return jsonValue === value ? undefined : jsonValue;
+  } catch {
+    return undefined;
+  }
+}
+
+function getCustomStringValue(value: object): string | undefined {
+  const toString = (value as { toString?: unknown }).toString;
+  if (typeof toString !== 'function' || toString === Object.prototype.toString) {
+    return undefined;
+  }
+
+  try {
+    const stringValue = toString.call(value);
+    return typeof stringValue === 'string' ? stringValue : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function redactMapValue(
+  value: Map<unknown, unknown>,
+  seen: WeakMap<object, unknown>,
+  depth: number,
+): Map<unknown, unknown> {
+  const redacted = new Map<unknown, unknown>();
+  seen.set(value, redacted);
+  let count = 0;
+  for (const [mapKey, mapValue] of value) {
+    if (count >= MAX_REDACTION_ENTRIES) {
+      redacted.set(REDACTION_TRUNCATED_KEY, 'Additional map entries omitted');
+      break;
+    }
+    redacted.set(
+      mapKey,
+      typeof mapKey === 'string'
+        ? redactRecordValue(mapKey, mapValue, seen, depth + 1)
+        : redactLogValue(mapValue, seen, depth + 1),
+    );
+    count += 1;
+  }
+  return redacted;
+}
+
+function redactSetValue(
+  value: Set<unknown>,
+  seen: WeakMap<object, unknown>,
+  depth: number,
+): Set<unknown> {
+  const redacted = new Set<unknown>();
+  seen.set(value, redacted);
+  let count = 0;
+  for (const setValue of value) {
+    if (count >= MAX_REDACTION_ENTRIES) {
+      redacted.add('Additional set values omitted');
+      break;
+    }
+    redacted.add(redactLogValue(setValue, seen, depth + 1));
+    count += 1;
+  }
+  return redacted;
+}
+
+function redactObjectEntries(
+  value: object,
+  seen: WeakMap<object, unknown>,
+  depth: number,
+): Record<string, unknown> | undefined {
+  const record = value as Record<string, unknown>;
+  let redacted: Record<string, unknown> | undefined;
+  let count = 0;
+
+  for (const key in record) {
+    if (!Object.prototype.hasOwnProperty.call(record, key)) {
+      continue;
+    }
+    if (redacted === undefined) {
+      redacted = {};
+      seen.set(value, redacted);
+    }
+    if (count >= MAX_REDACTION_ENTRIES) {
+      redacted[REDACTION_TRUNCATED_KEY] = 'Additional object properties omitted';
+      break;
+    }
+    redacted[key] = redactRecordValue(key, record[key], seen, depth + 1);
+    count += 1;
+  }
+
+  return redacted;
+}
+
+function redactNonPlainValue(
+  value: object,
+  seen: WeakMap<object, unknown>,
+  depth: number,
+): unknown {
+  if (isBufferValue(value)) {
+    return value.length > MAX_REDACTION_BUFFER_BYTES
+      ? `[REDACTED Buffer ${value.length} bytes]`
+      : redactLogString(value.toString('utf8'));
+  }
+
+  if (value instanceof URL || value instanceof URLSearchParams) {
+    return redactLogString(value.toString());
+  }
+
+  if (value instanceof Map) {
+    return redactMapValue(value, seen, depth);
+  }
+
+  if (value instanceof Set) {
+    return redactSetValue(value, seen, depth);
+  }
+
+  const jsonValue = getJsonValue(value);
+  if (jsonValue !== undefined) {
+    return redactLogValue(jsonValue, seen, depth + 1);
+  }
+
+  const redactedEntries = redactObjectEntries(value, seen, depth);
+  if (redactedEntries !== undefined) {
+    return redactedEntries;
+  }
+
+  const stringValue = getCustomStringValue(value);
+  return stringValue !== undefined ? redactLogString(stringValue) : value;
+}
+
+function redactLogValue(value: unknown, seen = new WeakMap<object, unknown>(), depth = 0): unknown {
+  if (typeof value === 'string') {
+    return redactLogString(value);
+  }
+
+  if (value === null || typeof value !== 'object') {
+    return value;
+  }
+
+  const cached = seen.get(value);
+  if (cached !== undefined) {
+    return cached;
+  }
+
+  if (depth >= MAX_REDACTION_DEPTH) {
+    return REDACTED_VALUE;
+  }
+
+  if (Array.isArray(value)) {
+    const redacted: unknown[] = [];
+    seen.set(value, redacted);
+    const length = Math.min(value.length, MAX_REDACTION_ENTRIES);
+    for (let index = 0; index < length; index++) {
+      redacted.push(redactLogValue(value[index], seen, depth + 1));
+    }
+    if (value.length > MAX_REDACTION_ENTRIES) {
+      redacted.push('Additional array values omitted');
+    }
+    return redacted;
+  }
+
+  if (value instanceof Error) {
+    return redactErrorValue(value, seen, depth);
+  }
 
-  if (trimLength !== undefined && str.length > trimLength) {
-    return `${str.substring(0, trimLength)}...`;
+  if (!isPlainRecord(value)) {
+    return redactNonPlainValue(value, seen, depth);
   }
 
-  return str;
+  return redactObjectEntries(value, seen, depth) ?? {};
 }
 
 /**
- * Redacts sensitive information from log messages if the log level is 'error'.
+ * Redacts sensitive information from log messages at every level.
  * Note: Intentionally mutates the object.
  * @param info - The log information object.
  * @returns The modified log information object.
  */
-const redactFormat = winston.format((info: winston.Logform.TransformableInfo) => {
-  if (info.level === 'error') {
-    // Type guard to ensure message is a string
-    if (typeof info.message === 'string') {
-      info.message = redactMessage(info.message);
+const redactFormat: winston.Logform.FormatWrap = winston.format(
+  (info: winston.Logform.TransformableInfo) => {
+    const infoRecord = info as Record<string | symbol, unknown>;
+
+    if (info.message !== undefined) {
+      info.message = redactLogValue(info.message);
     }
 
-    // Handle MESSAGE_SYMBOL with type safety
-    const symbolValue = (info as Record<string | symbol, unknown>)[MESSAGE_SYMBOL];
-    if (typeof symbolValue === 'string') {
-      (info as Record<string | symbol, unknown>)[MESSAGE_SYMBOL] = redactMessage(symbolValue);
+    const symbolValue = infoRecord[MESSAGE_SYMBOL];
+    if (symbolValue !== undefined) {
+      infoRecord[MESSAGE_SYMBOL] = redactLogValue(symbolValue);
     }
-  }
-  return info;
-});
+
+    if (infoRecord[SPLAT_SYMBOL] !== undefined) {
+      infoRecord[SPLAT_SYMBOL] = redactLogValue(infoRecord[SPLAT_SYMBOL]);
+    }
+    return info;
+  },
+);
 
 /**
  * Truncates long strings, especially base64 image data, within log messages.
@@ -129,13 +402,13 @@ function appendRequestContext(line: string, metadata: Record<string, unknown>):
  * Formats log messages for debugging purposes.
  * - Truncates long strings within log messages.
  * - Condenses arrays by truncating long strings and objects as strings within array items.
- * - Redacts sensitive information from log messages if the log level is 'error'.
+ * - Message redaction is applied by redactFormat before this formatter.
  * - Converts log information object to a formatted string.
  *
  * @param options - The options for formatting log messages.
  * @returns The formatted log message.
  */
-const debugTraverse = winston.format.printf(
+const debugTraverse: winston.Logform.Format = winston.format.printf(
   ({ level, message, timestamp, ...metadata }: Record<string, unknown>) => {
     if (!message) {
       return `${timestamp} ${level}`;
@@ -236,41 +509,43 @@ const debugTraverse = winston.format.printf(
  * Truncates long string values in JSON log objects.
  * Prevents outputting extremely long values (e.g., base64, blobs).
  */
-const jsonTruncateFormat = winston.format((info: winston.Logform.TransformableInfo) => {
-  const truncateLongStrings = (str: string, maxLength: number): string =>
-    str.length > maxLength ? str.substring(0, maxLength) + '...' : str;
-
-  const seen = new WeakSet<object>();
+const jsonTruncateFormat: winston.Logform.FormatWrap = winston.format(
+  (info: winston.Logform.TransformableInfo) => {
+    const truncateLongStrings = (str: string, maxLength: number): string =>
+      str.length > maxLength ? str.substring(0, maxLength) + '...' : str;
 
-  const truncateObject = (obj: unknown): unknown => {
-    if (typeof obj !== 'object' || obj === null) {
-      return obj;
-    }
+    const seen = new WeakSet<object>();
 
-    // Handle circular references - now with proper object type
-    if (seen.has(obj)) {
-      return '[Circular]';
-    }
-    seen.add(obj);
+    const truncateObject = (obj: unknown): unknown => {
+      if (typeof obj !== 'object' || obj === null) {
+        return obj;
+      }
 
-    if (Array.isArray(obj)) {
-      return obj.map((item) => truncateObject(item));
-    }
+      // Handle circular references - now with proper object type
+      if (seen.has(obj)) {
+        return '[Circular]';
+      }
+      seen.add(obj);
 
-    // We know this is an object at this point
-    const objectRecord = obj as Record<string, unknown>;
-    const newObj: Record<string, unknown> = {};
-    Object.entries(objectRecord).forEach(([key, value]) => {
-      if (typeof value === 'string') {
-        newObj[key] = truncateLongStrings(value, CONSOLE_JSON_STRING_LENGTH);
-      } else {
-        newObj[key] = truncateObject(value);
+      if (Array.isArray(obj)) {
+        return obj.map((item) => truncateObject(item));
       }
-    });
-    return newObj;
-  };
 
-  return truncateObject(info) as winston.Logform.TransformableInfo;
-});
+      // We know this is an object at this point
+      const objectRecord = obj as Record<string, unknown>;
+      const newObj: Record<string, unknown> = {};
+      Object.entries(objectRecord).forEach(([key, value]) => {
+        if (typeof value === 'string') {
+          newObj[key] = truncateLongStrings(value, CONSOLE_JSON_STRING_LENGTH);
+        } else {
+          newObj[key] = truncateObject(value);
+        }
+      });
+      return newObj;
+    };
+
+    return truncateObject(info) as winston.Logform.TransformableInfo;
+  },
+);
 
 export { redactFormat, redactMessage, debugTraverse, jsonTruncateFormat };
diff --git a/packages/data-schemas/src/config/tenantContext.ts b/packages/data-schemas/src/config/tenantContext.ts
index 9dc73f972bf..00e18603d69 100644
--- a/packages/data-schemas/src/config/tenantContext.ts
+++ b/packages/data-schemas/src/config/tenantContext.ts
@@ -14,7 +14,8 @@ export const SYSTEM_TENANT_ID = '__SYSTEM__';
  * Callbacks passed to `tenantStorage.run()` must be `async` for the context to propagate
  * through Mongoose query execution. Sync callbacks returning a Mongoose thenable will lose context.
  */
-export const tenantStorage = new AsyncLocalStorage<TenantContext>();
+export const tenantStorage: AsyncLocalStorage<TenantContext> =
+  new AsyncLocalStorage<TenantContext>();
 
 /** Returns the current tenant ID from async context, or undefined if none is set */
 export function getTenantId(): string | undefined {
diff --git a/packages/data-schemas/src/config/winston.ts b/packages/data-schemas/src/config/winston.ts
index 9c4a7b78007..7b856b41fde 100644
--- a/packages/data-schemas/src/config/winston.ts
+++ b/packages/data-schemas/src/config/winston.ts
@@ -164,7 +164,7 @@ if (useDebugConsole) {
 }
 
 // Create logger
-const logger = winston.createLogger({
+const logger: winston.Logger = winston.createLogger({
   level: level(),
   levels,
   transports,
diff --git a/packages/data-schemas/src/index.ts b/packages/data-schemas/src/index.ts
index 8c95d7f9cc4..3d99b906754 100644
--- a/packages/data-schemas/src/index.ts
+++ b/packages/data-schemas/src/index.ts
@@ -14,12 +14,22 @@ export {
   cacheTokenValues,
   premiumTokenValues,
   defaultRate,
+  createTxMethods,
   permissionBitSupersets,
+  partitionIssues,
+  validateSkillName,
+  validateSkillBody,
+  validateRelativePath,
+  inferSkillFileCategory,
+  validateSkillFrontmatter,
+  validateSkillDescription,
+  deriveStructuredFrontmatterFields,
 } from './methods';
 export type * from './types';
 export type * from './methods';
 export { default as logger } from './config/winston';
 export { default as meiliLogger } from './config/meiliLogger';
+export { redactMessage } from './config/parsers';
 export {
   tenantStorage,
   getTenantId,
diff --git a/packages/data-schemas/src/methods/accessRole.spec.ts b/packages/data-schemas/src/methods/accessRole.spec.ts
index 7f62c2f8cff..ec9e97ed9bb 100644
--- a/packages/data-schemas/src/methods/accessRole.spec.ts
+++ b/packages/data-schemas/src/methods/accessRole.spec.ts
@@ -206,6 +206,8 @@ describe('AccessRole Model Tests', () => {
           AccessRoleIds.REMOTE_AGENT_EDITOR,
           AccessRoleIds.REMOTE_AGENT_OWNER,
           AccessRoleIds.REMOTE_AGENT_VIEWER,
+          AccessRoleIds.SHARED_LINK_OWNER,
+          AccessRoleIds.SHARED_LINK_VIEWER,
           AccessRoleIds.SKILL_EDITOR,
           AccessRoleIds.SKILL_OWNER,
           AccessRoleIds.SKILL_VIEWER,
diff --git a/packages/data-schemas/src/methods/accessRole.ts b/packages/data-schemas/src/methods/accessRole.ts
index 654912978de..63a49f3dba9 100644
--- a/packages/data-schemas/src/methods/accessRole.ts
+++ b/packages/data-schemas/src/methods/accessRole.ts
@@ -3,7 +3,27 @@ import type { Model, Types, DeleteResult } from 'mongoose';
 import type { IAccessRole } from '~/types';
 import { RoleBits } from '~/common';
 
-export function createAccessRoleMethods(mongoose: typeof import('mongoose')) {
+export function createAccessRoleMethods(mongoose: typeof import('mongoose')): {
+  createRole: (roleData: Partial<IAccessRole>) => Promise<IAccessRole>;
+  updateRole: (
+    accessRoleId: string | Types.ObjectId,
+    updateData: Partial<IAccessRole>,
+  ) => Promise<IAccessRole | null>;
+  deleteRole: (accessRoleId: string | Types.ObjectId) => Promise<DeleteResult>;
+  getAllRoles: () => Promise<IAccessRole[]>;
+  findRoleById: (roleId: string | Types.ObjectId) => Promise<IAccessRole | null>;
+  seedDefaultRoles: () => Promise<Record<string, IAccessRole>>;
+  findRoleByIdentifier: (accessRoleId: string | Types.ObjectId) => Promise<IAccessRole | null>;
+  getRoleForPermissions: (
+    resourceType: string,
+    permBits: PermissionBits | RoleBits,
+  ) => Promise<IAccessRole | null>;
+  findRoleByPermissions: (
+    resourceType: string,
+    permBits: PermissionBits | RoleBits,
+  ) => Promise<IAccessRole | null>;
+  findRolesByResourceType: (resourceType: string) => Promise<IAccessRole[]>;
+} {
   /**
    * Find an access role by its ID
    * @param roleId - The role ID
@@ -101,7 +121,7 @@ export function createAccessRoleMethods(mongoose: typeof import('mongoose')) {
    * Seed default roles if they don't exist
    * @returns Object containing created roles
    */
-  async function seedDefaultRoles() {
+  async function seedDefaultRoles(): Promise<Record<string, IAccessRole>> {
     const AccessRole = mongoose.models.AccessRole as Model<IAccessRole>;
     const defaultRoles = [
       {
@@ -209,6 +229,20 @@ export function createAccessRoleMethods(mongoose: typeof import('mongoose')) {
         resourceType: ResourceType.SKILL,
         permBits: RoleBits.OWNER,
       },
+      {
+        accessRoleId: AccessRoleIds.SHARED_LINK_VIEWER,
+        name: 'com_ui_role_viewer',
+        description: 'com_ui_role_viewer_desc',
+        resourceType: ResourceType.SHARED_LINK,
+        permBits: RoleBits.VIEWER,
+      },
+      {
+        accessRoleId: AccessRoleIds.SHARED_LINK_OWNER,
+        name: 'com_ui_role_owner',
+        description: 'com_ui_role_owner_desc',
+        resourceType: ResourceType.SHARED_LINK,
+        permBits: RoleBits.OWNER,
+      },
     ];
 
     const result: Record<string, IAccessRole> = {};
diff --git a/packages/data-schemas/src/methods/aclEntry.spec.ts b/packages/data-schemas/src/methods/aclEntry.spec.ts
index 62bf13ad9c9..68e23078308 100644
--- a/packages/data-schemas/src/methods/aclEntry.spec.ts
+++ b/packages/data-schemas/src/methods/aclEntry.spec.ts
@@ -1,11 +1,11 @@
 import mongoose from 'mongoose';
+import { MongoMemoryServer } from 'mongodb-memory-server';
 import {
   ResourceType,
   PrincipalType,
   PrincipalModel,
   PermissionBits,
 } from 'librechat-data-provider';
-import { MongoMemoryServer } from 'mongodb-memory-server';
 import type * as t from '~/types';
 import { createAclEntryMethods, permissionBitSupersets } from './aclEntry';
 import aclEntrySchema from '~/schema/aclEntry';
@@ -1259,14 +1259,14 @@ describe('AclEntry Model Tests', () => {
         grantedById,
       );
 
-      const results = await methods.aggregateAclEntries([
+      const results = (await methods.aggregateAclEntries([
         { $group: { _id: '$resourceType', count: { $sum: 1 } } },
         { $sort: { _id: 1 } },
-      ]);
+      ])) as Array<{ _id: string; count: number }>;
 
       expect(results).toHaveLength(2);
-      const agentResult = results.find((r: { _id: string }) => r._id === ResourceType.AGENT);
-      expect(agentResult.count).toBe(2);
+      const agentResult = results.find((r) => r._id === ResourceType.AGENT);
+      expect(agentResult?.count).toBe(2);
     });
 
     test('should return empty array for non-matching pipeline', async () => {
diff --git a/packages/data-schemas/src/methods/aclEntry.ts b/packages/data-schemas/src/methods/aclEntry.ts
index b1803918cf9..105d55a1d10 100644
--- a/packages/data-schemas/src/methods/aclEntry.ts
+++ b/packages/data-schemas/src/methods/aclEntry.ts
@@ -8,8 +8,8 @@ import type {
   Model,
 } from 'mongoose';
 import type { AclEntry, IAclEntry } from '~/types';
-import { MAX_PERM_BITS } from '~/common/permissions';
 import { tenantSafeBulkWrite } from '~/utils/tenantBulkWrite';
+import { MAX_PERM_BITS } from '~/common/permissions';
 
 /**
  * Empty frozen array shared by every rejection path. Returning a single
@@ -76,7 +76,87 @@ export function permissionBitSupersets(requiredBits: number): readonly number[]
   return frozen;
 }
 
-export function createAclEntryMethods(mongoose: typeof import('mongoose')) {
+export function createAclEntryMethods(mongoose: typeof import('mongoose')): {
+  findEntriesByPrincipal: (
+    principalType: string,
+    principalId: string | Types.ObjectId,
+    resourceType?: string,
+  ) => Promise<IAclEntry[]>;
+  findEntriesByResource: (
+    resourceType: string,
+    resourceId: string | Types.ObjectId,
+  ) => Promise<IAclEntry[]>;
+  findEntriesByPrincipalsAndResource: (
+    principalsList: Array<{ principalType: string; principalId?: string | Types.ObjectId }>,
+    resourceType: string,
+    resourceId: string | Types.ObjectId,
+  ) => Promise<IAclEntry[]>;
+  hasPermission: (
+    principalsList: Array<{ principalType: string; principalId?: string | Types.ObjectId }>,
+    resourceType: string,
+    resourceId: string | Types.ObjectId,
+    permissionBit: number,
+  ) => Promise<boolean>;
+  getEffectivePermissions: (
+    principalsList: Array<{ principalType: string; principalId?: string | Types.ObjectId }>,
+    resourceType: string,
+    resourceId: string | Types.ObjectId,
+  ) => Promise<number>;
+  getEffectivePermissionsForResources: (
+    principalsList: Array<{ principalType: string; principalId?: string | Types.ObjectId }>,
+    resourceType: string,
+    resourceIds: Array<string | Types.ObjectId>,
+  ) => Promise<Map<string, number>>;
+  grantPermission: (
+    principalType: string,
+    principalId: string | Types.ObjectId | null,
+    resourceType: string,
+    resourceId: string | Types.ObjectId,
+    permBits: number,
+    grantedBy?: string | Types.ObjectId,
+    session?: ClientSession,
+    roleId?: string | Types.ObjectId,
+    expiredAt?: Date,
+  ) => Promise<IAclEntry | null>;
+  revokePermission: (
+    principalType: string,
+    principalId: string | Types.ObjectId | null,
+    resourceType: string,
+    resourceId: string | Types.ObjectId,
+    session?: ClientSession,
+  ) => Promise<DeleteResult>;
+  modifyPermissionBits: (
+    principalType: string,
+    principalId: string | Types.ObjectId | null,
+    resourceType: string,
+    resourceId: string | Types.ObjectId,
+    addBits?: number | null,
+    removeBits?: number | null,
+    session?: ClientSession,
+  ) => Promise<IAclEntry | null>;
+  findAccessibleResources: (
+    principalsList: Array<{ principalType: string; principalId?: string | Types.ObjectId }>,
+    resourceType: string,
+    requiredPermBit: number,
+  ) => Promise<Types.ObjectId[]>;
+  deleteAclEntries: (
+    filter: Record<string, unknown>,
+    options?: { session?: ClientSession },
+  ) => Promise<DeleteResult>;
+  bulkWriteAclEntries: (
+    ops: AnyBulkWriteOperation<AclEntry>[],
+    options?: { session?: ClientSession },
+  ) => Promise<import('mongodb').BulkWriteResult>;
+  findPublicResourceIds: (
+    resourceType: string,
+    requiredPermissions: number,
+  ) => Promise<Types.ObjectId[]>;
+  aggregateAclEntries: (pipeline: PipelineStage[]) => Promise<unknown[]>;
+  getSoleOwnedResourceIds: (
+    userObjectId: Types.ObjectId,
+    resourceTypes: string | string[],
+  ) => Promise<Types.ObjectId[]>;
+} {
   /**
    * Find ACL entries for a specific principal (user or group)
    * @param principalType - The type of principal ('user', 'group')
@@ -264,9 +344,10 @@ export function createAclEntryMethods(mongoose: typeof import('mongoose')) {
     resourceType: string,
     resourceId: string | Types.ObjectId,
     permBits: number,
-    grantedBy: string | Types.ObjectId,
+    grantedBy?: string | Types.ObjectId,
     session?: ClientSession,
     roleId?: string | Types.ObjectId,
+    expiredAt?: Date,
   ): Promise<IAclEntry | null> {
     const AclEntry = mongoose.models.AclEntry as Model<IAclEntry>;
     const query: Record<string, unknown> = {
@@ -292,9 +373,10 @@ export function createAclEntryMethods(mongoose: typeof import('mongoose')) {
     const update = {
       $set: {
         permBits,
-        grantedBy,
         grantedAt: new Date(),
+        ...(grantedBy && { grantedBy }),
         ...(roleId && { roleId }),
+        ...(expiredAt && { expiredAt }),
       },
     };
 
@@ -445,7 +527,7 @@ export function createAclEntryMethods(mongoose: typeof import('mongoose')) {
   async function bulkWriteAclEntries(
     ops: AnyBulkWriteOperation<AclEntry>[],
     options?: { session?: ClientSession },
-  ) {
+  ): Promise<import('mongodb').BulkWriteResult> {
     const AclEntry = mongoose.models.AclEntry as Model<IAclEntry>;
     return tenantSafeBulkWrite(AclEntry, ops as AnyBulkWriteOperation[], options || {});
   }
@@ -472,7 +554,7 @@ export function createAclEntryMethods(mongoose: typeof import('mongoose')) {
    * Runs an aggregation pipeline on the AclEntry collection.
    * @param pipeline - MongoDB aggregation pipeline stages
    */
-  async function aggregateAclEntries(pipeline: PipelineStage[]) {
+  async function aggregateAclEntries(pipeline: PipelineStage[]): Promise<unknown[]> {
     const AclEntry = mongoose.models.AclEntry as Model<IAclEntry>;
     return AclEntry.aggregate(pipeline);
   }
diff --git a/packages/data-schemas/src/methods/action.ts b/packages/data-schemas/src/methods/action.ts
index 3dc5a2c87a6..b86509800fb 100644
--- a/packages/data-schemas/src/methods/action.ts
+++ b/packages/data-schemas/src/methods/action.ts
@@ -3,7 +3,18 @@ import type { IAction } from '~/types';
 
 const sensitiveFields = ['api_key', 'oauth_client_id', 'oauth_client_secret'] as const;
 
-export function createActionMethods(mongoose: typeof import('mongoose')) {
+export function createActionMethods(mongoose: typeof import('mongoose')): {
+  getActions: (
+    searchParams: FilterQuery<IAction>,
+    includeSensitive?: boolean,
+  ) => Promise<IAction[]>;
+  updateAction: (
+    searchParams: FilterQuery<IAction>,
+    updateData: Partial<IAction>,
+  ) => Promise<IAction | null>;
+  deleteAction: (searchParams: FilterQuery<IAction>) => Promise<IAction | null>;
+  deleteActions: (searchParams: FilterQuery<IAction>) => Promise<number>;
+} {
   /**
    * Update an action with new data without overwriting existing properties,
    * or create a new action if it doesn't exist.
diff --git a/packages/data-schemas/src/methods/agent.spec.ts b/packages/data-schemas/src/methods/agent.spec.ts
index eb5a15fedc8..82c8f6aac4d 100644
--- a/packages/data-schemas/src/methods/agent.spec.ts
+++ b/packages/data-schemas/src/methods/agent.spec.ts
@@ -558,6 +558,94 @@ describe('Agent Methods', () => {
       expect(updatedAgent!.mcpServerNames).toEqual(['authorizedServer']);
     });
 
+    test('should prune nonexistent skill ids from the allowlist on create', async () => {
+      const { agentId, authorId } = createTestIds();
+      const realSkill = await mongoose.models.Skill.create({
+        name: 'create-prune-skill',
+        description: 'Skill backing the create-time allowlist pruning test.',
+        author: authorId,
+        authorName: 'Test Author',
+      });
+      const danglingId = new mongoose.Types.ObjectId().toString();
+
+      const newAgent = await createAgent({
+        id: agentId,
+        name: 'Skill Prune Agent',
+        provider: 'test',
+        model: 'test-model',
+        author: authorId,
+        skills: [realSkill._id.toString(), danglingId],
+        skills_enabled: true,
+      });
+
+      expect(newAgent.skills).toEqual([realSkill._id.toString()]);
+    });
+
+    test('should prune nonexistent skill ids from the allowlist on update', async () => {
+      const { agentId, authorId } = createTestIds();
+      const realSkill = await mongoose.models.Skill.create({
+        name: 'update-prune-skill',
+        description: 'Skill backing the update-time allowlist pruning test.',
+        author: authorId,
+        authorName: 'Test Author',
+      });
+      const danglingId = new mongoose.Types.ObjectId().toString();
+
+      await createAgent({
+        id: agentId,
+        name: 'Skill Prune Agent',
+        provider: 'test',
+        model: 'test-model',
+        author: authorId,
+      });
+
+      const updatedAgent = await updateAgent(
+        { id: agentId },
+        { skills: [danglingId, realSkill._id.toString()], skills_enabled: true },
+      );
+
+      expect(updatedAgent!.skills).toEqual([realSkill._id.toString()]);
+      expect(updatedAgent!.skills_enabled).toBe(true);
+    });
+
+    test('should fail closed when pruning empties the allowlist on update', async () => {
+      const { agentId, authorId } = createTestIds();
+      const danglingId = new mongoose.Types.ObjectId().toString();
+
+      await createAgent({
+        id: agentId,
+        name: 'Skill Heal Agent',
+        provider: 'test',
+        model: 'test-model',
+        author: authorId,
+      });
+
+      const updatedAgent = await updateAgent(
+        { id: agentId },
+        { skills: [danglingId], skills_enabled: true },
+      );
+
+      expect(updatedAgent!.skills).toEqual([]);
+      expect(updatedAgent!.skills_enabled).toBe(false);
+    });
+
+    test('should keep full-catalog semantics for an explicit empty allowlist on update', async () => {
+      const { agentId, authorId } = createTestIds();
+
+      await createAgent({
+        id: agentId,
+        name: 'Explicit Empty Agent',
+        provider: 'test',
+        model: 'test-model',
+        author: authorId,
+      });
+
+      const updatedAgent = await updateAgent({ id: agentId }, { skills: [], skills_enabled: true });
+
+      expect(updatedAgent!.skills).toEqual([]);
+      expect(updatedAgent!.skills_enabled).toBe(true);
+    });
+
     test('should delete an agent', async () => {
       const agentId = `agent_${uuidv4()}`;
       const authorId = new mongoose.Types.ObjectId();
@@ -1741,6 +1829,38 @@ describe('Agent Methods', () => {
       expect(revertedAgent.description).toBe('Original description');
     });
 
+    test('should prune deleted skill ids when reverting to an older version', async () => {
+      const agentId = `agent_${uuidv4()}`;
+      const authorId = new mongoose.Types.ObjectId();
+      const Skill = mongoose.models.Skill;
+      const skill = await Skill.create({
+        name: 'revert-prune-skill',
+        description: 'Skill backing the revert pruning test.',
+        author: authorId,
+        authorName: 'Test Author',
+      });
+      const skillId = skill._id.toString();
+
+      await createAgent({
+        id: agentId,
+        name: 'Revert Skill Agent',
+        provider: 'test',
+        model: 'test-model',
+        author: authorId,
+        skills: [skillId],
+        skills_enabled: true,
+      });
+
+      await updateAgent({ id: agentId }, { skills: [], name: 'No Skills Anymore' });
+      await Skill.deleteOne({ _id: skill._id });
+
+      const revertedAgent = await revertAgentVersion({ id: agentId }, 0);
+
+      expect(revertedAgent.name).toBe('Revert Skill Agent');
+      expect(revertedAgent.skills).toEqual([]);
+      expect(revertedAgent.skills_enabled).toBe(false);
+    });
+
     test('should detect action metadata changes and force version update', async () => {
       const agentId = `agent_${uuidv4()}`;
       const authorId = new mongoose.Types.ObjectId();
@@ -3373,10 +3493,21 @@ describe('Support Contact Field', () => {
     });
 
     test('should omit skill configuration from the default list projection', async () => {
-      const targetSkillIds = [
-        new mongoose.Types.ObjectId().toString(),
-        new mongoose.Types.ObjectId().toString(),
-      ];
+      const skillDocs = await mongoose.models.Skill.create([
+        {
+          name: 'projection-skill-a',
+          description: 'Skill backing projection test.',
+          author: userA,
+          authorName: 'Test Author',
+        },
+        {
+          name: 'projection-skill-b',
+          description: 'Skill backing projection test.',
+          author: userA,
+          authorName: 'Test Author',
+        },
+      ]);
+      const targetSkillIds = skillDocs.map((doc) => doc._id.toString());
       const scopedAgent = await createAgent({
         id: `agent_${uuidv4().slice(0, 12)}`,
         name: 'Scoped Agent',
@@ -3399,10 +3530,21 @@ describe('Support Contact Field', () => {
     });
 
     test('should include skill configuration only when explicitly requested', async () => {
-      const targetSkillIds = [
-        new mongoose.Types.ObjectId().toString(),
-        new mongoose.Types.ObjectId().toString(),
-      ];
+      const skillDocs = await mongoose.models.Skill.create([
+        {
+          name: 'scoped-skill-a',
+          description: 'Skill backing inclusion test.',
+          author: userA,
+          authorName: 'Test Author',
+        },
+        {
+          name: 'scoped-skill-b',
+          description: 'Skill backing inclusion test.',
+          author: userA,
+          authorName: 'Test Author',
+        },
+      ]);
+      const targetSkillIds = skillDocs.map((doc) => doc._id.toString());
       const scopedAgent = await createAgent({
         id: `agent_${uuidv4().slice(0, 12)}`,
         name: 'Scoped Agent',
diff --git a/packages/data-schemas/src/methods/agent.ts b/packages/data-schemas/src/methods/agent.ts
index 8a593b4498d..f9406112f57 100644
--- a/packages/data-schemas/src/methods/agent.ts
+++ b/packages/data-schemas/src/methods/agent.ts
@@ -9,6 +9,7 @@ import {
 import type { AgentToolResources } from 'librechat-data-provider';
 import type { FilterQuery, Model, Types } from 'mongoose';
 import type { IAgent, IAclEntry } from '~/types';
+import { filterExistingSkillIds } from './skill';
 import logger from '~/config/winston';
 
 const { mcp_delimiter } = Constants;
@@ -246,7 +247,83 @@ async function generateActionMetadataHash(
   return hashHex;
 }
 
-export function createAgentMethods(mongoose: typeof import('mongoose'), deps: AgentDeps) {
+export function createAgentMethods(
+  mongoose: typeof import('mongoose'),
+  deps: AgentDeps,
+): {
+  getAgent: (searchParameter: FilterQuery<IAgent>) => Promise<IAgent | null>;
+  getAgents: (searchParameter: FilterQuery<IAgent>) => Promise<IAgent[]>;
+  createAgent: (agentData: Record<string, unknown>) => Promise<IAgent>;
+  hasAgentWithMCPServerName: ({
+    agentIds,
+    serverName,
+  }: {
+    agentIds: Types.ObjectId[];
+    serverName: string;
+  }) => Promise<boolean>;
+  getMCPServerNamesByAgentIds: (agentIds: Types.ObjectId[]) => Promise<string[]>;
+  updateAgent: (
+    searchParameter: FilterQuery<IAgent>,
+    updateData: Record<string, unknown>,
+    options?: {
+      updatingUserId?: string | null;
+      forceVersion?: boolean;
+      skipVersioning?: boolean;
+    },
+  ) => Promise<IAgent | null>;
+  deleteAgent: (searchParameter: FilterQuery<IAgent>) => Promise<IAgent | null>;
+  deleteUserAgents: (userId: string) => Promise<void>;
+  revertAgentVersion: (
+    searchParameter: FilterQuery<IAgent>,
+    versionIndex: number,
+  ) => Promise<IAgent>;
+  countPromotedAgents: () => Promise<number>;
+  addAgentResourceFile: ({
+    agent_id,
+    tool_resource,
+    file_id,
+    updatingUserId,
+  }: {
+    agent_id: string;
+    tool_resource: string;
+    file_id: string;
+    updatingUserId?: string;
+  }) => Promise<IAgent>;
+  getListAgentsByAccess: ({
+    accessibleIds,
+    otherParams,
+    limit,
+    after,
+    includeSkillConfig,
+  }: {
+    accessibleIds?: Types.ObjectId[];
+    otherParams?: Record<string, unknown>;
+    limit?: number | null;
+    after?: string | null;
+    includeSkillConfig?: boolean;
+  }) => Promise<{
+    object: string;
+    data: Array<Record<string, unknown>>;
+    first_id: string | null;
+    last_id: string | null;
+    has_more: boolean;
+    after: string | null;
+  }>;
+  removeAgentResourceFiles: ({
+    agent_id,
+    files,
+  }: {
+    agent_id: string;
+    files: Array<{ tool_resource: string; file_id: string }>;
+  }) => Promise<IAgent>;
+  generateActionMetadataHash: typeof generateActionMetadataHash;
+  removeAgentFromUserFavorites: (resourceId: string, userIds: string[]) => Promise<void>;
+  removeAgentResourceFilesFromAllAgents: ({
+    file_ids,
+  }: {
+    file_ids: string[];
+  }) => Promise<{ matchedCount: number; modifiedCount: number }>;
+} {
   const { removeAllPermissions, getActions, getSoleOwnedResourceIds } = deps;
 
   /**
@@ -254,6 +331,15 @@ export function createAgentMethods(mongoose: typeof import('mongoose'), deps: Ag
    */
   async function createAgent(agentData: Record<string, unknown>): Promise<IAgent> {
     const Agent = mongoose.models.Agent as Model<IAgent>;
+    if (Array.isArray(agentData.skills) && agentData.skills.length > 0) {
+      const prunedSkills = await filterExistingSkillIds(mongoose, agentData.skills as string[]);
+      agentData.skills = prunedSkills;
+      /** Fail closed when pruning empties a non-empty allowlist — empty +
+       *  enabled means the full catalog, and hygiene must never widen scope. */
+      if (prunedSkills.length === 0) {
+        agentData.skills_enabled = false;
+      }
+    }
     const { author: _author, ...versionData } = agentData;
     const timestamp = new Date();
     const initialAgentData = {
@@ -362,6 +448,27 @@ export function createAgentMethods(mongoose: typeof import('mongoose'), deps: Ag
       } = currentAgent.toObject() as unknown as Record<string, unknown>;
       const { $push, $pull, $addToSet, ...directUpdates } = updateData;
 
+      /** Self-heal: drop allowlist ids whose skill doc no longer exists.
+       *  A dangling id keeps the allowlist non-empty while scoping the
+       *  runtime catalog to an empty intersection — silently disabling
+       *  skills for the agent. When pruning empties a non-empty allowlist,
+       *  fail closed and disable skills: empty + enabled means the full
+       *  catalog, and hygiene must never widen scope. (An explicit user
+       *  `skills: []` submission skips this branch and keeps the
+       *  full-catalog semantics.) */
+      if (Array.isArray(directUpdates.skills) && directUpdates.skills.length > 0) {
+        const prunedSkills = await filterExistingSkillIds(
+          mongoose,
+          directUpdates.skills as string[],
+        );
+        directUpdates.skills = prunedSkills;
+        updateData.skills = prunedSkills;
+        if (prunedSkills.length === 0) {
+          directUpdates.skills_enabled = false;
+          updateData.skills_enabled = false;
+        }
+      }
+
       // Sync mcpServerNames when tools are updated
       if ((directUpdates as Record<string, unknown>).tools !== undefined) {
         const mcpServerNames = extractMCPServerNames(
@@ -834,6 +941,21 @@ export function createAgentMethods(mongoose: typeof import('mongoose'), deps: Ag
     delete revertToVersion.author;
     delete revertToVersion.updatedBy;
 
+    /** Version snapshots can predate skill deletions; restoring one verbatim
+     *  would resurrect dangling allowlist ids that scope the catalog to
+     *  nothing. Same self-heal (and fail-closed-on-empty rule) as
+     *  `createAgent`/`updateAgent`. */
+    if (Array.isArray(revertToVersion.skills) && revertToVersion.skills.length > 0) {
+      const prunedSkills = await filterExistingSkillIds(
+        mongoose,
+        revertToVersion.skills as string[],
+      );
+      revertToVersion.skills = prunedSkills;
+      if (prunedSkills.length === 0) {
+        revertToVersion.skills_enabled = false;
+      }
+    }
+
     const revertedAgent = await Agent.findOneAndUpdate(searchParameter, revertToVersion, {
       new: true,
     }).lean<IAgent>();
diff --git a/packages/data-schemas/src/methods/agentApiKey.ts b/packages/data-schemas/src/methods/agentApiKey.ts
index 3462f9ff843..c3de31f6bc2 100644
--- a/packages/data-schemas/src/methods/agentApiKey.ts
+++ b/packages/data-schemas/src/methods/agentApiKey.ts
@@ -11,7 +11,22 @@ import logger from '~/config/winston';
 const API_KEY_PREFIX = 'sk-';
 const API_KEY_LENGTH = 32;
 
-export function createAgentApiKeyMethods(mongoose: typeof import('mongoose')) {
+export function createAgentApiKeyMethods(mongoose: typeof import('mongoose')): {
+  createAgentApiKey: (data: AgentApiKeyCreateData) => Promise<AgentApiKeyCreateResult>;
+  validateAgentApiKey: (
+    apiKey: string,
+  ) => Promise<{ userId: Types.ObjectId; keyId: Types.ObjectId } | null>;
+  listAgentApiKeys: (userId: string | Types.ObjectId) => Promise<AgentApiKeyListItem[]>;
+  deleteAgentApiKey: (
+    keyId: string | Types.ObjectId,
+    userId: string | Types.ObjectId,
+  ) => Promise<boolean>;
+  deleteAllAgentApiKeys: (userId: string | Types.ObjectId) => Promise<number>;
+  getAgentApiKeyById: (
+    keyId: string | Types.ObjectId,
+    userId: string | Types.ObjectId,
+  ) => Promise<AgentApiKeyListItem | null>;
+} {
   async function generateApiKey(): Promise<{ key: string; keyHash: string; keyPrefix: string }> {
     const randomPart = await getRandomValues(API_KEY_LENGTH);
     const key = `${API_KEY_PREFIX}${randomPart}`;
diff --git a/packages/data-schemas/src/methods/agentCategory.ts b/packages/data-schemas/src/methods/agentCategory.ts
index 0a71d777db7..cb26923e238 100644
--- a/packages/data-schemas/src/methods/agentCategory.ts
+++ b/packages/data-schemas/src/methods/agentCategory.ts
@@ -2,7 +2,30 @@ import type { Model, Types } from 'mongoose';
 import type { IAgentCategory } from '~/types';
 import { tenantSafeBulkWrite } from '~/utils/tenantBulkWrite';
 
-export function createAgentCategoryMethods(mongoose: typeof import('mongoose')) {
+export function createAgentCategoryMethods(mongoose: typeof import('mongoose')): {
+  getActiveCategories: () => Promise<IAgentCategory[]>;
+  getCategoriesWithCounts: () => Promise<(IAgentCategory & { agentCount: number })[]>;
+  getValidCategoryValues: () => Promise<string[]>;
+  seedCategories: (
+    categories: Array<{
+      value: string;
+      label?: string;
+      description?: string;
+      order?: number;
+      custom?: boolean;
+    }>,
+  ) => Promise<import('mongoose').mongo.BulkWriteResult>;
+  findCategoryByValue: (value: string) => Promise<IAgentCategory | null>;
+  createCategory: (categoryData: Partial<IAgentCategory>) => Promise<IAgentCategory>;
+  updateCategory: (
+    value: string,
+    updateData: Partial<IAgentCategory>,
+  ) => Promise<IAgentCategory | null>;
+  deleteCategory: (value: string) => Promise<boolean>;
+  findCategoryById: (id: string | Types.ObjectId) => Promise<IAgentCategory | null>;
+  getAllCategories: () => Promise<IAgentCategory[]>;
+  ensureDefaultCategories: () => Promise<boolean>;
+} {
   /**
    * Get all active categories sorted by order
    * @returns Array of active categories
diff --git a/packages/data-schemas/src/methods/assistant.ts b/packages/data-schemas/src/methods/assistant.ts
index 798acb688cb..cc558ebc333 100644
--- a/packages/data-schemas/src/methods/assistant.ts
+++ b/packages/data-schemas/src/methods/assistant.ts
@@ -1,7 +1,19 @@
 import type { FilterQuery, Model } from 'mongoose';
 import type { IAssistant } from '~/types';
 
-export function createAssistantMethods(mongoose: typeof import('mongoose')) {
+export function createAssistantMethods(mongoose: typeof import('mongoose')): {
+  updateAssistantDoc: (
+    searchParams: FilterQuery<IAssistant>,
+    updateData: Partial<IAssistant>,
+  ) => Promise<IAssistant | null>;
+  deleteAssistant: (searchParams: FilterQuery<IAssistant>) => Promise<IAssistant | null>;
+  deleteAssistants: (searchParams: FilterQuery<IAssistant>) => Promise<number>;
+  getAssistants: (
+    searchParams: FilterQuery<IAssistant>,
+    select?: string | Record<string, number> | null,
+  ) => Promise<IAssistant[]>;
+  getAssistant: (searchParams: FilterQuery<IAssistant>) => Promise<IAssistant | null>;
+} {
   /**
    * Update an assistant with new data without overwriting existing properties,
    * or create a new assistant if it doesn't exist.
@@ -39,7 +51,9 @@ export function createAssistantMethods(mongoose: typeof import('mongoose')) {
   /**
    * Deletes an assistant based on the provided search params.
    */
-  async function deleteAssistant(searchParams: FilterQuery<IAssistant>) {
+  async function deleteAssistant(
+    searchParams: FilterQuery<IAssistant>,
+  ): Promise<IAssistant | null> {
     const Assistant = mongoose.models.Assistant as Model<IAssistant>;
     return await Assistant.findOneAndDelete(searchParams);
   }
diff --git a/packages/data-schemas/src/methods/banner.ts b/packages/data-schemas/src/methods/banner.ts
index 6ae4877207f..17bab9ddcd1 100644
--- a/packages/data-schemas/src/methods/banner.ts
+++ b/packages/data-schemas/src/methods/banner.ts
@@ -1,8 +1,10 @@
 import type { Model } from 'mongoose';
-import logger from '~/config/winston';
 import type { IBanner, IUser } from '~/types';
+import logger from '~/config/winston';
 
-export function createBannerMethods(mongoose: typeof import('mongoose')) {
+export function createBannerMethods(mongoose: typeof import('mongoose')): {
+  getBanner: (user?: IUser | null) => Promise<IBanner | null>;
+} {
   /**
    * Retrieves the current active banner.
    */
diff --git a/packages/data-schemas/src/methods/categories.ts b/packages/data-schemas/src/methods/categories.ts
index 4761a32c160..3fb86929437 100644
--- a/packages/data-schemas/src/methods/categories.ts
+++ b/packages/data-schemas/src/methods/categories.ts
@@ -14,7 +14,9 @@ const options = [
 
 export type CategoryOption = { label: string; value: string };
 
-export function createCategoriesMethods(_mongoose: typeof import('mongoose')) {
+export function createCategoriesMethods(_mongoose: typeof import('mongoose')): {
+  getCategories: () => Promise<CategoryOption[]>;
+} {
   /**
    * Retrieves the categories.
    */
diff --git a/packages/data-schemas/src/methods/chatProject.spec.ts b/packages/data-schemas/src/methods/chatProject.spec.ts
new file mode 100644
index 00000000000..5563f90b6ca
--- /dev/null
+++ b/packages/data-schemas/src/methods/chatProject.spec.ts
@@ -0,0 +1,293 @@
+import mongoose from 'mongoose';
+import { MongoMemoryServer } from 'mongodb-memory-server';
+import { createModels } from '~/models';
+import type { IChatProject, IConversation } from '~/types';
+import { createChatProjectMethods, type ChatProjectMethods } from './chatProject';
+
+jest.mock('~/config/winston', () => ({
+  error: jest.fn(),
+  warn: jest.fn(),
+  info: jest.fn(),
+  debug: jest.fn(),
+}));
+
+let mongoServer: InstanceType<typeof MongoMemoryServer>;
+let ChatProject: mongoose.Model<IChatProject>;
+let Conversation: mongoose.Model<IConversation>;
+let methods: ChatProjectMethods;
+let modelsToCleanup: string[] = [];
+
+beforeAll(async () => {
+  mongoServer = await MongoMemoryServer.create();
+  const mongoUri = mongoServer.getUri();
+
+  const models = createModels(mongoose);
+  modelsToCleanup = Object.keys(models);
+  Object.assign(mongoose.models, models);
+
+  ChatProject = mongoose.models.ChatProject as mongoose.Model<IChatProject>;
+  Conversation = mongoose.models.Conversation as mongoose.Model<IConversation>;
+  methods = createChatProjectMethods(mongoose);
+
+  await mongoose.connect(mongoUri);
+});
+
+afterAll(async () => {
+  await mongoose.disconnect();
+  await mongoServer.stop();
+
+  for (const modelName of modelsToCleanup) {
+    if (mongoose.models[modelName]) {
+      delete mongoose.models[modelName];
+    }
+  }
+});
+
+afterEach(async () => {
+  await ChatProject.deleteMany({});
+  await Conversation.deleteMany({});
+});
+
+async function createConversation(user: string, conversationId: string, title: string) {
+  return await Conversation.create({
+    conversationId,
+    title,
+    user,
+    endpoint: 'openAI',
+  });
+}
+
+describe('ChatProject methods', () => {
+  const user = 'user-1';
+  const otherUser = 'user-2';
+
+  it('creates, reads, updates, and lists private projects', async () => {
+    const project = await methods.createChatProject(user, {
+      name: 'Customer Alpha',
+      description: 'Support work',
+    });
+
+    expect(project.name).toBe('Customer Alpha');
+    expect(project.conversationCount).toBe(0);
+
+    const readProject = await methods.getChatProject(user, project._id!.toString());
+    expect(readProject?.description).toBe('Support work');
+
+    const updatedProject = await methods.updateChatProject(user, project._id!.toString(), {
+      name: 'Customer Alpha Updated',
+    });
+    expect(updatedProject?.name).toBe('Customer Alpha Updated');
+
+    const list = await methods.listChatProjects(user, { sortBy: 'name', sortDirection: 'asc' });
+    expect(list.projects).toHaveLength(1);
+    expect(list.projects[0].name).toBe('Customer Alpha Updated');
+  });
+
+  it('paginates projects deterministically when latest activity is null', async () => {
+    const staleProject = await methods.createChatProject(user, { name: 'Stale' });
+    await methods.createChatProject(user, { name: 'Quiet A' });
+    await methods.createChatProject(user, { name: 'Quiet B' });
+    const recentProject = await methods.createChatProject(user, { name: 'Recent' });
+
+    await ChatProject.updateOne(
+      { _id: staleProject._id },
+      { $set: { lastConversationAt: new Date('2026-01-01T00:00:00.000Z') } },
+    );
+    await ChatProject.updateOne(
+      { _id: recentProject._id },
+      { $set: { lastConversationAt: new Date('2026-02-01T00:00:00.000Z') } },
+    );
+
+    const firstPage = await methods.listChatProjects(user, {
+      sortBy: 'lastConversationAt',
+      sortDirection: 'desc',
+      limit: 3,
+    });
+    const secondPage = await methods.listChatProjects(user, {
+      sortBy: 'lastConversationAt',
+      sortDirection: 'desc',
+      limit: 3,
+      cursor: firstPage.nextCursor,
+    });
+    const names = [...firstPage.projects, ...secondPage.projects].map((project) => project.name);
+
+    expect(firstPage.projects[0].name).toBe('Recent');
+    expect(firstPage.projects[1].name).toBe('Stale');
+    expect(firstPage.nextCursor).toBeTruthy();
+    expect(secondPage.projects.every((project) => project.lastConversationAt == null)).toBe(true);
+    expect(names).toEqual(expect.arrayContaining(['Recent', 'Stale', 'Quiet A', 'Quiet B']));
+    expect(new Set(names).size).toBe(4);
+
+    const invalidCursor = Buffer.from(
+      JSON.stringify({ primary: 'not-a-date', id: recentProject._id!.toString() }),
+    ).toString('base64');
+    const invalidCursorPage = await methods.listChatProjects(user, {
+      sortBy: 'lastConversationAt',
+      sortDirection: 'desc',
+      limit: 1,
+      cursor: invalidCursor,
+    });
+
+    expect(invalidCursorPage.projects[0].name).toBe('Recent');
+  });
+
+  it('paginates chat-less projects when a page ends on the last dated project', async () => {
+    const staleProject = await methods.createChatProject(user, { name: 'Stale' });
+    await methods.createChatProject(user, { name: 'Quiet A' });
+    await methods.createChatProject(user, { name: 'Quiet B' });
+    const recentProject = await methods.createChatProject(user, { name: 'Recent' });
+
+    await ChatProject.updateOne(
+      { _id: staleProject._id },
+      { $set: { lastConversationAt: new Date('2026-01-01T00:00:00.000Z') } },
+    );
+    await ChatProject.updateOne(
+      { _id: recentProject._id },
+      { $set: { lastConversationAt: new Date('2026-02-01T00:00:00.000Z') } },
+    );
+
+    // limit equals the number of dated projects, so the cursor lands on a dated
+    // project; the null (chat-less) projects must still appear on the next page.
+    const firstPage = await methods.listChatProjects(user, {
+      sortBy: 'lastConversationAt',
+      sortDirection: 'desc',
+      limit: 2,
+    });
+    const secondPage = await methods.listChatProjects(user, {
+      sortBy: 'lastConversationAt',
+      sortDirection: 'desc',
+      limit: 2,
+      cursor: firstPage.nextCursor,
+    });
+
+    expect(firstPage.projects.map((project) => project.name)).toEqual(['Recent', 'Stale']);
+    expect(firstPage.nextCursor).toBeTruthy();
+    expect(secondPage.projects.map((project) => project.name).sort()).toEqual([
+      'Quiet A',
+      'Quiet B',
+    ]);
+    expect(secondPage.projects.every((project) => project.lastConversationAt == null)).toBe(true);
+  });
+
+  it('assigns many conversations to one project and updates stats', async () => {
+    const project = await methods.createChatProject(user, { name: 'Customer Alpha' });
+    await createConversation(user, 'convo-1', 'First');
+    await createConversation(user, 'convo-2', 'Second');
+
+    await methods.assignConversationToProject(user, 'convo-1', project._id!.toString());
+    await methods.assignConversationToProject(user, 'convo-2', project._id!.toString());
+
+    const conversations = await Conversation.find({
+      user,
+      chatProjectId: project._id!.toString(),
+    }).lean<IConversation[]>();
+    const refreshedProject = await methods.getChatProject(user, project._id!.toString());
+
+    expect(conversations).toHaveLength(2);
+    expect(refreshedProject?.conversationCount).toBe(2);
+    expect(refreshedProject?.lastConversationId).toBeDefined();
+  });
+
+  it('excludes retention-hidden conversations from project stats', async () => {
+    const project = await methods.createChatProject(user, { name: 'Visible Stats' });
+    const chatProjectId = project._id!.toString();
+    const visibleDate = new Date('2026-01-01T00:00:00.000Z');
+    const hiddenDate = new Date('2026-02-01T00:00:00.000Z');
+
+    await Conversation.collection.insertMany([
+      {
+        conversationId: 'visible-convo',
+        title: 'Visible',
+        user,
+        endpoint: 'openAI',
+        chatProjectId,
+        isTemporary: false,
+        expiredAt: null,
+        createdAt: visibleDate,
+        updatedAt: visibleDate,
+      },
+      {
+        conversationId: 'temporary-convo',
+        title: 'Temporary',
+        user,
+        endpoint: 'openAI',
+        chatProjectId,
+        isTemporary: true,
+        expiredAt: new Date('2027-03-01T00:00:00.000Z'),
+        createdAt: hiddenDate,
+        updatedAt: hiddenDate,
+      },
+      {
+        conversationId: 'expired-convo',
+        title: 'Expired',
+        user,
+        endpoint: 'openAI',
+        chatProjectId,
+        isTemporary: false,
+        expiredAt: new Date('2025-12-01T00:00:00.000Z'),
+        createdAt: hiddenDate,
+        updatedAt: hiddenDate,
+      },
+    ]);
+
+    const refreshedProject = await methods.refreshChatProjectStats(user, chatProjectId);
+
+    expect(refreshedProject?.conversationCount).toBe(1);
+    expect(refreshedProject?.lastConversationId).toBe('visible-convo');
+    expect(refreshedProject?.lastConversationAt?.toISOString()).toBe(visibleDate.toISOString());
+  });
+
+  it('enforces one project per chat when moving conversations', async () => {
+    const firstProject = await methods.createChatProject(user, { name: 'First' });
+    const secondProject = await methods.createChatProject(user, { name: 'Second' });
+    await createConversation(user, 'convo-1', 'First');
+
+    await methods.assignConversationToProject(user, 'convo-1', firstProject._id!.toString());
+    await methods.assignConversationToProject(user, 'convo-1', secondProject._id!.toString());
+
+    const movedConversation = await Conversation.findOne({
+      user,
+      conversationId: 'convo-1',
+    }).lean<IConversation>();
+    const refreshedFirst = await methods.getChatProject(user, firstProject._id!.toString());
+    const refreshedSecond = await methods.getChatProject(user, secondProject._id!.toString());
+
+    expect(movedConversation?.chatProjectId).toBe(secondProject._id!.toString());
+    expect(refreshedFirst?.conversationCount).toBe(0);
+    expect(refreshedSecond?.conversationCount).toBe(1);
+  });
+
+  it('deleting a project unassigns chats instead of deleting them', async () => {
+    const project = await methods.createChatProject(user, { name: 'Delete me' });
+    await createConversation(user, 'convo-1', 'First');
+    await methods.assignConversationToProject(user, 'convo-1', project._id!.toString());
+
+    const result = await methods.deleteChatProject(user, project._id!.toString());
+    const conversation = await Conversation.findOne({
+      user,
+      conversationId: 'convo-1',
+    }).lean<IConversation>();
+
+    expect(result.deletedCount).toBe(1);
+    expect(result.modifiedCount).toBe(1);
+    expect(conversation).not.toBeNull();
+    expect(conversation?.chatProjectId).toBeUndefined();
+  });
+
+  it('isolates projects and assignments by user', async () => {
+    const project = await methods.createChatProject(user, { name: 'Mine' });
+    await createConversation(otherUser, 'convo-1', 'Theirs');
+
+    const otherRead = await methods.getChatProject(otherUser, project._id!.toString());
+    const assignment = await methods.assignConversationToProject(
+      user,
+      'convo-1',
+      project._id!.toString(),
+    );
+    const deleteResult = await methods.deleteChatProject(otherUser, project._id!.toString());
+
+    expect(otherRead).toBeNull();
+    expect(assignment).toBeNull();
+    expect(deleteResult.deletedCount).toBe(0);
+  });
+});
diff --git a/packages/data-schemas/src/methods/chatProject.ts b/packages/data-schemas/src/methods/chatProject.ts
new file mode 100644
index 00000000000..038a6a979a1
--- /dev/null
+++ b/packages/data-schemas/src/methods/chatProject.ts
@@ -0,0 +1,463 @@
+import type { FilterQuery, Model, SortOrder, Types } from 'mongoose';
+import logger from '~/config/winston';
+import { isValidObjectIdString } from '~/utils/objectId';
+import { buildRetentionVisibilityFilter } from '~/utils/retention';
+import { escapeRegExp } from '~/utils/string';
+import type { IChatProject, IChatProjectDocument, IConversation } from '~/types';
+
+export type ChatProjectSortBy = 'name' | 'createdAt' | 'lastConversationAt';
+export type ChatProjectSortDirection = 'asc' | 'desc';
+
+export type CreateChatProjectInput = {
+  name: string;
+  description?: string | null;
+};
+
+export type UpdateChatProjectInput = Partial<CreateChatProjectInput>;
+
+export type ListChatProjectsOptions = {
+  cursor?: string | null;
+  limit?: number;
+  sortBy?: ChatProjectSortBy;
+  sortDirection?: ChatProjectSortDirection;
+  search?: string;
+};
+
+export type ListChatProjectsResult = {
+  projects: IChatProject[];
+  nextCursor: string | null;
+};
+
+export type DeleteChatProjectResult = {
+  deletedCount: number;
+  modifiedCount: number;
+};
+
+export type AssignConversationToProjectResult = {
+  conversation: IConversation;
+  previousProjectId: string | null;
+  projectId: string | null;
+};
+
+export interface ChatProjectMethods {
+  createChatProject(user: string, input: CreateChatProjectInput): Promise<IChatProject>;
+  getChatProject(user: string, projectId: string): Promise<IChatProject | null>;
+  listChatProjects(
+    user: string,
+    options?: ListChatProjectsOptions,
+  ): Promise<ListChatProjectsResult>;
+  updateChatProject(
+    user: string,
+    projectId: string,
+    input: UpdateChatProjectInput,
+  ): Promise<IChatProject | null>;
+  deleteChatProject(user: string, projectId: string): Promise<DeleteChatProjectResult>;
+  assignConversationToProject(
+    user: string,
+    conversationId: string,
+    projectId: string | null,
+  ): Promise<AssignConversationToProjectResult | null>;
+  refreshChatProjectStats(user: string, projectId: string): Promise<IChatProject | null>;
+}
+
+type ProjectCursor = {
+  primary: string | null;
+  id: string;
+};
+
+type ProjectLean = IChatProject & { _id: Types.ObjectId };
+
+const VALID_SORT_FIELDS = new Set<ChatProjectSortBy>(['name', 'createdAt', 'lastConversationAt']);
+
+function normalizeSortBy(sortBy?: string): ChatProjectSortBy {
+  return VALID_SORT_FIELDS.has(sortBy as ChatProjectSortBy)
+    ? (sortBy as ChatProjectSortBy)
+    : 'lastConversationAt';
+}
+
+function normalizeSortDirection(sortDirection?: string): ChatProjectSortDirection {
+  return sortDirection === 'asc' ? 'asc' : 'desc';
+}
+
+function normalizeLimit(limit?: number): number {
+  if (!Number.isFinite(limit) || !limit) {
+    return 25;
+  }
+  return Math.min(Math.max(Math.floor(limit), 1), 100);
+}
+
+function sanitizeProjectInput(input: CreateChatProjectInput): CreateChatProjectInput {
+  return {
+    name: input.name.trim().slice(0, 100),
+    description: input.description?.trim().slice(0, 1000) ?? '',
+  };
+}
+
+function parseCursor(cursor?: string | null): ProjectCursor | null {
+  if (!cursor) {
+    return null;
+  }
+
+  try {
+    const decoded = JSON.parse(Buffer.from(cursor, 'base64').toString()) as ProjectCursor;
+    if (!decoded.id || !isValidObjectIdString(decoded.id)) {
+      return null;
+    }
+    return {
+      primary: decoded.primary ?? null,
+      id: decoded.id,
+    };
+  } catch {
+    logger.warn('[listChatProjects] Invalid cursor format, starting from beginning');
+    return null;
+  }
+}
+
+function encodeCursor(project: ProjectLean, sortBy: ChatProjectSortBy): string {
+  let primary: string | null = null;
+  if (sortBy === 'name') {
+    primary = project.name;
+  } else {
+    const date = project[sortBy];
+    primary = date instanceof Date ? date.toISOString() : null;
+  }
+  return Buffer.from(JSON.stringify({ primary, id: project._id.toString() })).toString('base64');
+}
+
+function cursorPrimaryValue(
+  primary: string | null,
+  sortBy: ChatProjectSortBy,
+): string | Date | null | undefined {
+  if (primary == null) {
+    return sortBy === 'lastConversationAt' ? null : undefined;
+  }
+
+  if (sortBy === 'name') {
+    return primary;
+  }
+
+  const date = new Date(primary);
+  return Number.isNaN(date.getTime()) ? undefined : date;
+}
+
+function createCursorFilter(
+  mongoose: typeof import('mongoose'),
+  cursor: ProjectCursor | null,
+  sortBy: ChatProjectSortBy,
+  sortDirection: ChatProjectSortDirection,
+): FilterQuery<IChatProjectDocument> | null {
+  if (!cursor) {
+    return null;
+  }
+
+  const op = sortDirection === 'asc' ? '$gt' : '$lt';
+  const id = new mongoose.Types.ObjectId(cursor.id);
+  const primary = cursorPrimaryValue(cursor.primary, sortBy);
+
+  if (primary === undefined) {
+    logger.warn('[listChatProjects] Invalid cursor primary value, starting from beginning');
+    return null;
+  }
+
+  const branches: FilterQuery<IChatProjectDocument>[] = [
+    { [sortBy]: { [op]: primary } },
+    { [sortBy]: primary, _id: { [op]: id } },
+  ];
+
+  /**
+   * Projects with no conversations have `lastConversationAt: null`, which sorts
+   * after all dated projects in descending order. A `$lt: <date>` predicate does
+   * not match null, so once the cursor moves past the dated projects we must
+   * include the null bucket explicitly, otherwise empty projects never paginate.
+   */
+  if (sortBy === 'lastConversationAt' && sortDirection === 'desc' && primary instanceof Date) {
+    branches.push({ lastConversationAt: null } as FilterQuery<IChatProjectDocument>);
+  }
+
+  return { $or: branches } as FilterQuery<IChatProjectDocument>;
+}
+
+function visibleProjectConversationFilter(
+  user: string,
+  projectId: string,
+): FilterQuery<IConversation> {
+  return {
+    $and: [
+      { user, chatProjectId: projectId },
+      { $or: [{ isArchived: false }, { isArchived: { $exists: false } }] },
+      buildRetentionVisibilityFilter<IConversation>(),
+    ],
+  } as FilterQuery<IConversation>;
+}
+
+export async function refreshChatProjectStatsForUser(
+  mongoose: typeof import('mongoose'),
+  user: string,
+  projectId: string,
+): Promise<IChatProject | null> {
+  if (!isValidObjectIdString(projectId)) {
+    return null;
+  }
+
+  const ChatProject = mongoose.models.ChatProject as Model<IChatProjectDocument>;
+  const Conversation = mongoose.models.Conversation as Model<IConversation>;
+  const projectFilter = { _id: new mongoose.Types.ObjectId(projectId), user };
+  const conversationFilter = visibleProjectConversationFilter(user, projectId);
+
+  const [conversationCount, latestConversation] = await Promise.all([
+    Conversation.countDocuments(conversationFilter),
+    Conversation.findOne(conversationFilter)
+      .select('conversationId updatedAt createdAt')
+      .sort({ updatedAt: -1, _id: -1 })
+      .lean<IConversation>(),
+  ]);
+
+  return await ChatProject.findOneAndUpdate(
+    projectFilter,
+    {
+      $set: {
+        conversationCount,
+        lastConversationAt: latestConversation?.updatedAt ?? latestConversation?.createdAt ?? null,
+        lastConversationId: latestConversation?.conversationId ?? null,
+      },
+    },
+    { new: true },
+  ).lean<IChatProject>();
+}
+
+export async function updateChatProjectLastConversationForUser(
+  mongoose: typeof import('mongoose'),
+  user: string,
+  projectId: string,
+  conversation: Pick<IConversation, 'conversationId' | 'createdAt' | 'updatedAt'>,
+  incrementCount = false,
+): Promise<void> {
+  if (!isValidObjectIdString(projectId) || !conversation.conversationId) {
+    return;
+  }
+
+  const lastConversationAt = conversation.updatedAt ?? conversation.createdAt ?? new Date();
+  const update: Record<string, unknown> = {
+    $set: {
+      lastConversationAt,
+      lastConversationId: conversation.conversationId,
+    },
+  };
+  if (incrementCount) {
+    update.$inc = { conversationCount: 1 };
+  }
+
+  const ChatProject = mongoose.models.ChatProject as Model<IChatProjectDocument>;
+  await ChatProject.updateOne({ _id: new mongoose.Types.ObjectId(projectId), user }, update);
+}
+
+export function createChatProjectMethods(mongoose: typeof import('mongoose')): ChatProjectMethods {
+  async function createChatProject(
+    user: string,
+    input: CreateChatProjectInput,
+  ): Promise<IChatProject> {
+    const ChatProject = mongoose.models.ChatProject as Model<IChatProjectDocument>;
+    const sanitized = sanitizeProjectInput(input);
+    if (!sanitized.name) {
+      throw new Error('Project name is required');
+    }
+
+    const project = await ChatProject.create({
+      ...sanitized,
+      user,
+      conversationCount: 0,
+      lastConversationAt: null,
+      lastConversationId: null,
+    });
+    return project.toObject() as IChatProject;
+  }
+
+  async function getChatProject(user: string, projectId: string): Promise<IChatProject | null> {
+    if (!isValidObjectIdString(projectId)) {
+      return null;
+    }
+
+    const ChatProject = mongoose.models.ChatProject as Model<IChatProjectDocument>;
+    return await ChatProject.findOne({
+      _id: new mongoose.Types.ObjectId(projectId),
+      user,
+    }).lean<IChatProject>();
+  }
+
+  async function listChatProjects(
+    user: string,
+    options: ListChatProjectsOptions = {},
+  ): Promise<ListChatProjectsResult> {
+    const ChatProject = mongoose.models.ChatProject as Model<IChatProjectDocument>;
+    const limit = normalizeLimit(options.limit);
+    const sortBy = normalizeSortBy(options.sortBy);
+    const sortDirection = normalizeSortDirection(options.sortDirection);
+    const sortOrder: SortOrder = sortDirection === 'asc' ? 1 : -1;
+    const filters: FilterQuery<IChatProjectDocument>[] = [{ user }];
+
+    if (options.search?.trim()) {
+      filters.push({ name: { $regex: escapeRegExp(options.search.trim()), $options: 'i' } });
+    }
+
+    const cursorFilter = createCursorFilter(
+      mongoose,
+      parseCursor(options.cursor),
+      sortBy,
+      sortDirection,
+    );
+    if (cursorFilter) {
+      filters.push(cursorFilter);
+    }
+
+    const query =
+      filters.length === 1 ? filters[0] : ({ $and: filters } as FilterQuery<IChatProjectDocument>);
+    const projects = await ChatProject.find(query)
+      .sort({ [sortBy]: sortOrder, _id: sortOrder })
+      .limit(limit + 1)
+      .lean<ProjectLean[]>();
+
+    let nextCursor: string | null = null;
+    if (projects.length > limit) {
+      projects.pop();
+      const lastProject = projects[projects.length - 1];
+      if (lastProject) {
+        nextCursor = encodeCursor(lastProject, sortBy);
+      }
+    }
+
+    return { projects, nextCursor };
+  }
+
+  async function updateChatProject(
+    user: string,
+    projectId: string,
+    input: UpdateChatProjectInput,
+  ): Promise<IChatProject | null> {
+    if (!isValidObjectIdString(projectId)) {
+      return null;
+    }
+
+    const ChatProject = mongoose.models.ChatProject as Model<IChatProjectDocument>;
+    const update: Partial<Pick<IChatProject, 'name' | 'description'>> = {};
+    if (typeof input.name === 'string') {
+      const name = input.name.trim().slice(0, 100);
+      if (!name) {
+        throw new Error('Project name is required');
+      }
+      update.name = name;
+    }
+    if (input.description !== undefined) {
+      update.description = input.description?.trim().slice(0, 1000) ?? '';
+    }
+
+    return await ChatProject.findOneAndUpdate(
+      { _id: new mongoose.Types.ObjectId(projectId), user },
+      { $set: update },
+      { new: true, runValidators: true },
+    ).lean<IChatProject>();
+  }
+
+  async function deleteChatProject(
+    user: string,
+    projectId: string,
+  ): Promise<DeleteChatProjectResult> {
+    if (!isValidObjectIdString(projectId)) {
+      return { deletedCount: 0, modifiedCount: 0 };
+    }
+
+    const ChatProject = mongoose.models.ChatProject as Model<IChatProjectDocument>;
+    const Conversation = mongoose.models.Conversation as Model<IConversation>;
+    const projectFilter = { _id: new mongoose.Types.ObjectId(projectId), user };
+    const project = await ChatProject.findOne(projectFilter).select('_id').lean<IChatProject>();
+    if (!project) {
+      return { deletedCount: 0, modifiedCount: 0 };
+    }
+
+    const [conversationResult, deleteResult] = await Promise.all([
+      Conversation.updateMany(
+        { user, chatProjectId: projectId },
+        { $unset: { chatProjectId: '' } },
+      ),
+      ChatProject.deleteOne(projectFilter),
+    ]);
+
+    return {
+      deletedCount: deleteResult.deletedCount ?? 0,
+      modifiedCount: conversationResult.modifiedCount ?? 0,
+    };
+  }
+
+  async function assignConversationToProject(
+    user: string,
+    conversationId: string,
+    projectId: string | null,
+  ): Promise<AssignConversationToProjectResult | null> {
+    const ChatProject = mongoose.models.ChatProject as Model<IChatProjectDocument>;
+    const Conversation = mongoose.models.Conversation as Model<IConversation>;
+    const conversation = await Conversation.findOne({ user, conversationId }).lean<IConversation>();
+    if (!conversation) {
+      return null;
+    }
+
+    const normalizedProjectId = projectId || null;
+    if (normalizedProjectId) {
+      if (!isValidObjectIdString(normalizedProjectId)) {
+        throw new Error('Project not found');
+      }
+      const project = await ChatProject.findOne({
+        _id: new mongoose.Types.ObjectId(normalizedProjectId),
+        user,
+      })
+        .select('_id')
+        .lean<IChatProject>();
+      if (!project) {
+        throw new Error('Project not found');
+      }
+    }
+
+    const previousProjectId = conversation.chatProjectId ?? null;
+    const update =
+      normalizedProjectId == null
+        ? { $unset: { chatProjectId: '' } }
+        : { $set: { chatProjectId: normalizedProjectId } };
+    const updatedConversation = await Conversation.findOneAndUpdate(
+      { user, conversationId },
+      update,
+      { new: true },
+    ).lean<IConversation>();
+
+    if (!updatedConversation) {
+      return null;
+    }
+
+    const projectIds = new Set(
+      [previousProjectId, normalizedProjectId].filter((id): id is string => Boolean(id)),
+    );
+    await Promise.all(
+      [...projectIds].map((id) => refreshChatProjectStatsForUser(mongoose, user, id)),
+    );
+
+    return {
+      conversation: updatedConversation,
+      previousProjectId,
+      projectId: normalizedProjectId,
+    };
+  }
+
+  async function refreshChatProjectStats(
+    user: string,
+    projectId: string,
+  ): Promise<IChatProject | null> {
+    return await refreshChatProjectStatsForUser(mongoose, user, projectId);
+  }
+
+  return {
+    createChatProject,
+    getChatProject,
+    listChatProjects,
+    updateChatProject,
+    deleteChatProject,
+    assignConversationToProject,
+    refreshChatProjectStats,
+  };
+}
diff --git a/packages/data-schemas/src/methods/config.spec.ts b/packages/data-schemas/src/methods/config.spec.ts
index 8ab6be35eef..4d7ebfad9db 100644
--- a/packages/data-schemas/src/methods/config.spec.ts
+++ b/packages/data-schemas/src/methods/config.spec.ts
@@ -26,7 +26,7 @@ beforeEach(async () => {
   await mongoose.models.Config.deleteMany({});
 });
 
-describe('upsertConfig', () => {
+describe('upsertConfig tombstone preservation', () => {
   it('creates a new config document', async () => {
     const result = await methods.upsertConfig(
       PrincipalType.ROLE,
@@ -270,6 +270,137 @@ describe('patchConfigFields', () => {
     expect(result).toBeTruthy();
     expect(result!.principalId).toBe('newrole');
   });
+
+  it('clears tombstones for patched paths and their ancestors', async () => {
+    await methods.tombstoneConfigField(
+      PrincipalType.ROLE,
+      'admin',
+      PrincipalModel.ROLE,
+      'mcpServers.github',
+      10,
+    );
+
+    const result = await methods.patchConfigFields(
+      PrincipalType.ROLE,
+      'admin',
+      PrincipalModel.ROLE,
+      { 'mcpServers.github.url': 'https://scoped.example.com' },
+      10,
+    );
+
+    expect(result!.tombstones).not.toContain('mcpServers.github');
+  });
+
+  it('does not clear a whole-section tombstone when patching a nested path', async () => {
+    await methods.tombstoneConfigField(
+      PrincipalType.ROLE,
+      'admin',
+      PrincipalModel.ROLE,
+      'mcpServers',
+      10,
+    );
+
+    const result = await methods.patchConfigFields(
+      PrincipalType.ROLE,
+      'admin',
+      PrincipalModel.ROLE,
+      { 'mcpServers.github.url': 'https://scoped.example.com' },
+      10,
+    );
+
+    expect(result!.tombstones).toContain('mcpServers');
+  });
+});
+
+describe('tombstoneConfigField', () => {
+  it('adds a tombstone and removes the overridden subtree', async () => {
+    await methods.upsertConfig(
+      PrincipalType.ROLE,
+      'admin',
+      PrincipalModel.ROLE,
+      {
+        mcpServers: {
+          github: {
+            type: 'streamable-http',
+            url: 'https://github.example.com',
+          },
+          slack: {
+            type: 'streamable-http',
+            url: 'https://slack.example.com',
+          },
+        },
+      },
+      10,
+    );
+
+    const result = await methods.tombstoneConfigField(
+      PrincipalType.ROLE,
+      'admin',
+      PrincipalModel.ROLE,
+      'mcpServers.github',
+      10,
+    );
+    const overrides = result!.overrides as Record<string, unknown>;
+    const mcpServers = overrides.mcpServers as Record<string, unknown>;
+
+    expect(result!.tombstones).toContain('mcpServers.github');
+    expect(mcpServers.github).toBeUndefined();
+    expect(mcpServers.slack).toEqual({
+      type: 'streamable-http',
+      url: 'https://slack.example.com',
+    });
+  });
+
+  it('creates a config if none exists', async () => {
+    const result = await methods.tombstoneConfigField(
+      PrincipalType.ROLE,
+      'admin',
+      PrincipalModel.ROLE,
+      'mcpServers.github',
+      10,
+    );
+
+    expect(result).toBeTruthy();
+    expect(result!.tombstones).toContain('mcpServers.github');
+  });
+
+  it('preserves inactive configs when adding a tombstone', async () => {
+    await methods.upsertConfig(PrincipalType.ROLE, 'admin', PrincipalModel.ROLE, {}, 10);
+    await methods.toggleConfigActive(PrincipalType.ROLE, 'admin', false);
+
+    const result = await methods.tombstoneConfigField(
+      PrincipalType.ROLE,
+      'admin',
+      PrincipalModel.ROLE,
+      'mcpServers.github',
+      10,
+    );
+
+    expect(result!.isActive).toBe(false);
+    expect(result!.tombstones).toContain('mcpServers.github');
+  });
+});
+
+describe('upsertConfig', () => {
+  it('preserves tombstones when replacing overrides', async () => {
+    await methods.tombstoneConfigField(
+      PrincipalType.ROLE,
+      'admin',
+      PrincipalModel.ROLE,
+      'mcpServers.github',
+      10,
+    );
+
+    const result = await methods.upsertConfig(
+      PrincipalType.ROLE,
+      'admin',
+      PrincipalModel.ROLE,
+      { interface: { modelSelect: false } },
+      10,
+    );
+
+    expect(result!.tombstones).toContain('mcpServers.github');
+  });
 });
 
 describe('unsetConfigField', () => {
@@ -297,6 +428,20 @@ describe('unsetConfigField', () => {
     const result = await methods.unsetConfigField(PrincipalType.ROLE, 'ghost', 'a.b');
     expect(result).toBeNull();
   });
+
+  it('clears tombstones for the reset path and descendants', async () => {
+    await methods.tombstoneConfigField(
+      PrincipalType.ROLE,
+      'admin',
+      PrincipalModel.ROLE,
+      'mcpServers.github',
+      10,
+    );
+
+    const result = await methods.unsetConfigField(PrincipalType.ROLE, 'admin', 'mcpServers.github');
+
+    expect(result!.tombstones).not.toContain('mcpServers.github');
+  });
 });
 
 describe('deleteConfig', () => {
diff --git a/packages/data-schemas/src/methods/config.ts b/packages/data-schemas/src/methods/config.ts
index 68deed3ae01..ca7bf015fd1 100644
--- a/packages/data-schemas/src/methods/config.ts
+++ b/packages/data-schemas/src/methods/config.ts
@@ -1,11 +1,77 @@
 import { Types } from 'mongoose';
 import { PrincipalType, PrincipalModel } from 'librechat-data-provider';
-import { BASE_CONFIG_PRINCIPAL_ID } from '~/admin/capabilities';
 import type { TCustomConfig } from 'librechat-data-provider';
 import type { Model, ClientSession } from 'mongoose';
 import type { IConfig } from '~/types';
+import { BASE_CONFIG_PRINCIPAL_ID } from '~/admin/capabilities';
+import { escapeRegExp } from '~/utils/string';
+
+function getTombstonePathsToClear(fieldPath: string): string[] {
+  const parts = fieldPath.split('.');
+  if (parts.length <= 1) {
+    return [fieldPath];
+  }
+  return parts.slice(1).map((_, index) => parts.slice(0, index + 2).join('.'));
+}
 
-export function createConfigMethods(mongoose: typeof import('mongoose')) {
+function getPathAndDescendantsRegex(fieldPath: string): RegExp {
+  return new RegExp(`^${escapeRegExp(fieldPath)}(?:\\.|$)`);
+}
+
+export function createConfigMethods(mongoose: typeof import('mongoose')): {
+  listAllConfigs: (filter?: { isActive?: boolean }, session?: ClientSession) => Promise<IConfig[]>;
+  findConfigByPrincipal: (
+    principalType: PrincipalType,
+    principalId: string | Types.ObjectId,
+    options?: { includeInactive?: boolean },
+    session?: ClientSession,
+  ) => Promise<IConfig | null>;
+  getApplicableConfigs: (
+    principals?: Array<{ principalType: string; principalId?: string | Types.ObjectId }>,
+    session?: ClientSession,
+  ) => Promise<IConfig[]>;
+  upsertConfig: (
+    principalType: PrincipalType,
+    principalId: string | Types.ObjectId,
+    principalModel: PrincipalModel,
+    overrides: Partial<TCustomConfig>,
+    priority: number,
+    session?: ClientSession,
+  ) => Promise<IConfig | null>;
+  patchConfigFields: (
+    principalType: PrincipalType,
+    principalId: string | Types.ObjectId,
+    principalModel: PrincipalModel,
+    fields: Record<string, unknown>,
+    priority: number,
+    session?: ClientSession,
+  ) => Promise<IConfig | null>;
+  tombstoneConfigField: (
+    principalType: PrincipalType,
+    principalId: string | Types.ObjectId,
+    principalModel: PrincipalModel,
+    fieldPath: string,
+    priority: number,
+    session?: ClientSession,
+  ) => Promise<IConfig | null>;
+  unsetConfigField: (
+    principalType: PrincipalType,
+    principalId: string | Types.ObjectId,
+    fieldPath: string,
+    session?: ClientSession,
+  ) => Promise<IConfig | null>;
+  deleteConfig: (
+    principalType: PrincipalType,
+    principalId: string | Types.ObjectId,
+    session?: ClientSession,
+  ) => Promise<IConfig | null>;
+  toggleConfigActive: (
+    principalType: PrincipalType,
+    principalId: string | Types.ObjectId,
+    isActive: boolean,
+    session?: ClientSession,
+  ) => Promise<IConfig | null>;
+} {
   async function findConfigByPrincipal(
     principalType: PrincipalType,
     principalId: string | Types.ObjectId,
@@ -139,6 +205,40 @@ export function createConfigMethods(mongoose: typeof import('mongoose')) {
       setPayload[`overrides.${path}`] = value;
     }
 
+    const tombstonesToClear = [...new Set(Object.keys(fields).flatMap(getTombstonePathsToClear))];
+
+    const options = {
+      upsert: true,
+      new: true,
+      setDefaultsOnInsert: true,
+      ...(session ? { session } : {}),
+    };
+
+    const update: Record<string, unknown> = {
+      $set: setPayload,
+      $inc: { configVersion: 1 },
+    };
+    if (tombstonesToClear.length > 0) {
+      update.$pull = { tombstones: { $in: tombstonesToClear } };
+    }
+
+    return await Config.findOneAndUpdate(
+      { principalType, principalId: principalId.toString() },
+      update,
+      options,
+    );
+  }
+
+  async function tombstoneConfigField(
+    principalType: PrincipalType,
+    principalId: string | Types.ObjectId,
+    principalModel: PrincipalModel,
+    fieldPath: string,
+    priority: number,
+    session?: ClientSession,
+  ): Promise<IConfig | null> {
+    const Config = mongoose.models.Config as Model<IConfig>;
+
     const options = {
       upsert: true,
       new: true,
@@ -148,7 +248,15 @@ export function createConfigMethods(mongoose: typeof import('mongoose')) {
 
     return await Config.findOneAndUpdate(
       { principalType, principalId: principalId.toString() },
-      { $set: setPayload, $inc: { configVersion: 1 } },
+      {
+        $set: {
+          principalModel,
+          priority,
+        },
+        $unset: { [`overrides.${fieldPath}`]: '' },
+        $addToSet: { tombstones: fieldPath },
+        $inc: { configVersion: 1 },
+      },
       options,
     );
   }
@@ -168,7 +276,11 @@ export function createConfigMethods(mongoose: typeof import('mongoose')) {
 
     return await Config.findOneAndUpdate(
       { principalType, principalId: principalId.toString() },
-      { $unset: { [`overrides.${fieldPath}`]: '' }, $inc: { configVersion: 1 } },
+      {
+        $unset: { [`overrides.${fieldPath}`]: '' },
+        $pull: { tombstones: { $regex: getPathAndDescendantsRegex(fieldPath) } },
+        $inc: { configVersion: 1 },
+      },
       options,
     );
   }
@@ -206,6 +318,7 @@ export function createConfigMethods(mongoose: typeof import('mongoose')) {
     getApplicableConfigs,
     upsertConfig,
     patchConfigFields,
+    tombstoneConfigField,
     unsetConfigField,
     deleteConfig,
     toggleConfigActive,
diff --git a/packages/data-schemas/src/methods/conversation.spec.ts b/packages/data-schemas/src/methods/conversation.spec.ts
index 5646d7dfff2..94a677b113d 100644
--- a/packages/data-schemas/src/methods/conversation.spec.ts
+++ b/packages/data-schemas/src/methods/conversation.spec.ts
@@ -1,7 +1,7 @@
 import mongoose from 'mongoose';
 import { v4 as uuidv4 } from 'uuid';
 import { EModelEndpoint, RetentionMode } from 'librechat-data-provider';
-import type { IConversation } from '../types';
+import type { IChatProject, IConversation } from '../types';
 import { MongoMemoryServer } from 'mongodb-memory-server';
 import { ConversationMethods, createConversationMethods } from './conversation';
 import { tenantStorage, runAsSystem } from '~/config/tenantContext';
@@ -16,6 +16,7 @@ jest.mock('~/config/winston', () => ({
 
 let mongoServer: InstanceType<typeof MongoMemoryServer>;
 let Conversation: mongoose.Model<IConversation>;
+let ChatProject: mongoose.Model<IChatProject>;
 let modelsToCleanup: string[] = [];
 
 // Mock message methods (same as original test mocking ./Message)
@@ -32,6 +33,7 @@ beforeAll(async () => {
   modelsToCleanup = Object.keys(models);
   Object.assign(mongoose.models, models);
   Conversation = mongoose.models.Conversation as mongoose.Model<IConversation>;
+  ChatProject = mongoose.models.ChatProject as mongoose.Model<IChatProject>;
 
   methods = createConversationMethods(mongoose, { getMessages, deleteMessages });
 
@@ -91,6 +93,7 @@ describe('Conversation Operations', () => {
   beforeEach(async () => {
     // Clear database
     await Conversation.deleteMany({});
+    await ChatProject.deleteMany({});
 
     // Reset mocks
     jest.clearAllMocks();
@@ -153,6 +156,155 @@ describe('Conversation Operations', () => {
       expect(result?.conversationId).toBe(newConversationId);
     });
 
+    it('refreshes project stats when archiving a project conversation', async () => {
+      const project = await ChatProject.create({
+        user: mockCtx.userId,
+        name: 'Project Stats',
+        conversationCount: 0,
+        lastConversationAt: null,
+        lastConversationId: null,
+      });
+      const firstConversationId = uuidv4();
+      const secondConversationId = uuidv4();
+      const chatProjectId = project._id!.toString();
+
+      await saveConvo(mockCtx, {
+        conversationId: firstConversationId,
+        title: 'First',
+        endpoint: EModelEndpoint.openAI,
+        chatProjectId,
+      });
+      await saveConvo(mockCtx, {
+        conversationId: secondConversationId,
+        title: 'Second',
+        endpoint: EModelEndpoint.openAI,
+        chatProjectId,
+      });
+
+      await saveConvo(mockCtx, {
+        conversationId: secondConversationId,
+        isArchived: true,
+      });
+
+      const refreshedProject = await ChatProject.findById(project._id).lean<IChatProject>();
+      expect(refreshedProject?.conversationCount).toBe(1);
+      expect(refreshedProject?.lastConversationId).toBe(firstConversationId);
+    });
+
+    it('bulkSaveConvos keeps owned project ids and strips orphan ones', async () => {
+      const project = await ChatProject.create({
+        user: mockCtx.userId,
+        name: 'Bulk Project',
+        conversationCount: 0,
+        lastConversationAt: null,
+        lastConversationId: null,
+      });
+      const ownedId = project._id!.toString();
+      const orphanId = new mongoose.Types.ObjectId().toString();
+      const ownedConvoId = uuidv4();
+      const orphanConvoId = uuidv4();
+
+      await methods.bulkSaveConvos([
+        {
+          conversationId: ownedConvoId,
+          user: mockCtx.userId,
+          endpoint: EModelEndpoint.openAI,
+          chatProjectId: ownedId,
+        },
+        {
+          conversationId: orphanConvoId,
+          user: mockCtx.userId,
+          endpoint: EModelEndpoint.openAI,
+          chatProjectId: orphanId,
+        },
+      ]);
+
+      const ownedConvo = await Conversation.findOne({
+        conversationId: ownedConvoId,
+      }).lean<IConversation>();
+      const orphanConvo = await Conversation.findOne({
+        conversationId: orphanConvoId,
+      }).lean<IConversation>();
+
+      expect(ownedConvo?.chatProjectId).toBe(ownedId);
+      expect(orphanConvo?.chatProjectId == null).toBe(true);
+
+      const refreshedProject = await ChatProject.findById(project._id).lean<IChatProject>();
+      expect(refreshedProject?.conversationCount).toBe(1);
+    });
+
+    it('refreshes both projects when a save moves a conversation between them', async () => {
+      const projectA = await ChatProject.create({
+        user: mockCtx.userId,
+        name: 'Project A',
+        conversationCount: 0,
+      });
+      const projectB = await ChatProject.create({
+        user: mockCtx.userId,
+        name: 'Project B',
+        conversationCount: 0,
+      });
+      const conversationId = uuidv4();
+      const projectAId = projectA._id!.toString();
+      const projectBId = projectB._id!.toString();
+
+      await saveConvo(mockCtx, {
+        conversationId,
+        title: 'Moving',
+        endpoint: EModelEndpoint.openAI,
+        chatProjectId: projectAId,
+      });
+      // A stale tab re-submits with the new project id, moving the chat A -> B.
+      await saveConvo(mockCtx, {
+        conversationId,
+        endpoint: EModelEndpoint.openAI,
+        chatProjectId: projectBId,
+      });
+
+      const refreshedA = await ChatProject.findById(projectA._id).lean<IChatProject>();
+      const refreshedB = await ChatProject.findById(projectB._id).lean<IChatProject>();
+      expect(refreshedA?.conversationCount).toBe(0);
+      expect(refreshedA?.lastConversationId == null).toBe(true);
+      expect(refreshedB?.conversationCount).toBe(1);
+      expect(refreshedB?.lastConversationId).toBe(conversationId);
+    });
+
+    it('bulkSaveConvos refreshes the project a conversation leaves', async () => {
+      const projectA = await ChatProject.create({
+        user: mockCtx.userId,
+        name: 'Bulk Project A',
+        conversationCount: 0,
+      });
+      const projectB = await ChatProject.create({
+        user: mockCtx.userId,
+        name: 'Bulk Project B',
+        conversationCount: 0,
+      });
+      const conversationId = uuidv4();
+      const projectAId = projectA._id!.toString();
+      const projectBId = projectB._id!.toString();
+
+      await saveConvo(mockCtx, {
+        conversationId,
+        title: 'Bulk Moving',
+        endpoint: EModelEndpoint.openAI,
+        chatProjectId: projectAId,
+      });
+      await methods.bulkSaveConvos([
+        {
+          conversationId,
+          user: mockCtx.userId,
+          endpoint: EModelEndpoint.openAI,
+          chatProjectId: projectBId,
+        },
+      ]);
+
+      const refreshedA = await ChatProject.findById(projectA._id).lean<IChatProject>();
+      const refreshedB = await ChatProject.findById(projectB._id).lean<IChatProject>();
+      expect(refreshedA?.conversationCount).toBe(0);
+      expect(refreshedB?.conversationCount).toBe(1);
+    });
+
     it('should not create a conversation when noUpsert is true and conversation does not exist', async () => {
       const nonExistentId = uuidv4();
       const result = await saveConvo(
@@ -1170,5 +1322,34 @@ describe('Conversation Operations', () => {
       expect(doc?.title).toBe('Updated');
       expect(doc?.tenantId).toBe('real-tenant');
     });
+
+    it('bulkSaveConvos refreshes stats for cloned project conversations', async () => {
+      const project = await ChatProject.create({
+        user: 'user123',
+        name: 'Bulk Project',
+        conversationCount: 0,
+        lastConversationAt: null,
+        lastConversationId: null,
+      });
+      const conversationId = uuidv4();
+      const createdAt = new Date('2026-01-01T00:00:00.000Z');
+
+      await methods.bulkSaveConvos([
+        {
+          conversationId,
+          user: 'user123',
+          title: 'Cloned Project Chat',
+          endpoint: EModelEndpoint.openAI,
+          chatProjectId: project._id!.toString(),
+          createdAt,
+          updatedAt: createdAt,
+        },
+      ]);
+
+      const refreshedProject = await ChatProject.findById(project._id).lean<IChatProject>();
+      expect(refreshedProject?.conversationCount).toBe(1);
+      expect(refreshedProject?.lastConversationId).toBe(conversationId);
+      expect(refreshedProject?.lastConversationAt?.toISOString()).toBe(createdAt.toISOString());
+    });
   });
 });
diff --git a/packages/data-schemas/src/methods/conversation.ts b/packages/data-schemas/src/methods/conversation.ts
index c46487e519c..e65843a1a58 100644
--- a/packages/data-schemas/src/methods/conversation.ts
+++ b/packages/data-schemas/src/methods/conversation.ts
@@ -1,10 +1,15 @@
 import type { FilterQuery, Model, SortOrder } from 'mongoose';
 import { RetentionMode } from 'librechat-data-provider';
+import { isValidObjectIdString } from '~/utils/objectId';
 import { createTempChatExpirationDate } from '~/utils/tempChatRetention';
 import { buildRetentionVisibilityFilter, createFallbackRetentionDate } from '~/utils/retention';
 import { tenantSafeBulkWrite } from '~/utils/tenantBulkWrite';
 import logger from '~/config/winston';
-import type { AppConfig, IConversation } from '~/types';
+import type { AppConfig, IChatProjectDocument, IConversation } from '~/types';
+import {
+  refreshChatProjectStatsForUser,
+  updateChatProjectLastConversationForUser,
+} from './chatProject';
 import type { MessageMethods } from './message';
 import type { DeleteResult } from 'mongoose';
 
@@ -36,6 +41,7 @@ export interface ConversationMethods {
       search?: string;
       sortBy?: string;
       sortDirection?: string;
+      projectId?: string;
     },
   ): Promise<{ conversations: IConversation[]; nextCursor: string | null }>;
   getConvosQueried(
@@ -208,6 +214,38 @@ export function createConversationMethods(
 
       const messages = await getMessages({ conversationId, user: userId }, '_id');
       const update: Record<string, unknown> = { ...convo, messages, user: userId };
+      const unsetFields: Record<string, number> = { ...(metadata?.unsetFields ?? {}) };
+
+      if (Object.prototype.hasOwnProperty.call(update, 'chatProjectId') && update.chatProjectId) {
+        const chatProjectId = typeof update.chatProjectId === 'string' ? update.chatProjectId : '';
+        let isValidChatProject = isValidObjectIdString(chatProjectId);
+
+        if (isValidChatProject) {
+          const ChatProject = mongoose.models.ChatProject as Model<IChatProjectDocument>;
+          const project = await ChatProject.exists({
+            _id: new mongoose.Types.ObjectId(chatProjectId),
+            user: userId,
+          });
+          isValidChatProject = project != null;
+        }
+
+        if (!isValidChatProject) {
+          delete update.chatProjectId;
+          unsetFields.chatProjectId = 1;
+        }
+      }
+
+      const mayChangeProjectMembership =
+        Object.prototype.hasOwnProperty.call(update, 'chatProjectId') ||
+        Object.prototype.hasOwnProperty.call(unsetFields, 'chatProjectId');
+      let previousChatProjectId: string | null = null;
+      if (mayChangeProjectMembership) {
+        const existing = await Conversation.findOne(
+          { conversationId, user: userId },
+          'chatProjectId',
+        ).lean<{ chatProjectId?: string | null } | null>();
+        previousChatProjectId = existing?.chatProjectId ?? null;
+      }
 
       if (newConversationId) {
         update.conversationId = newConversationId;
@@ -248,22 +286,35 @@ export function createConversationMethods(
       }
 
       const updateOperation: Record<string, unknown> = { $set: update };
-      if (metadata?.unsetFields && Object.keys(metadata.unsetFields).length > 0) {
-        updateOperation.$unset = metadata.unsetFields;
+      if (Object.keys(unsetFields).length > 0) {
+        updateOperation.$unset = unsetFields;
       }
       if (createdAtOnInsert) {
         updateOperation.$setOnInsert = { createdAt: createdAtOnInsert };
       }
 
-      const conversation = await Conversation.findOneAndUpdate(
+      const conversationResult = (await Conversation.findOneAndUpdate(
         { conversationId, user: userId },
         updateOperation,
         {
           new: true,
           upsert: metadata?.noUpsert !== true,
+          includeResultMetadata: true,
           ...(createdAtOnInsert ? { timestamps: false } : {}),
         },
-      );
+      )) as unknown as {
+        value:
+          | (IConversation & {
+              _id: unknown;
+              $isDefault: (path: string) => boolean;
+              toObject: () => IConversation;
+            })
+          | null;
+        lastErrorObject?: {
+          updatedExisting?: boolean;
+        };
+      };
+      const conversation = conversationResult.value;
 
       if (!conversation) {
         logger.debug('[saveConvo] Conversation not found, skipping update');
@@ -283,6 +334,60 @@ export function createConversationMethods(
         conversation.isTemporary = false;
       }
 
+      const newChatProjectId = conversation.chatProjectId ?? null;
+      const projectMembershipChanged = previousChatProjectId !== newChatProjectId;
+
+      /**
+       * A chat that moved between projects (e.g. a stale tab re-submitting an
+       * older project id) must fully recompute the stats of the project it left;
+       * the incremental path only ever touches the project it now belongs to.
+       */
+      if (projectMembershipChanged && previousChatProjectId) {
+        await refreshChatProjectStatsForUser(mongoose, userId, previousChatProjectId);
+      }
+
+      if (conversation.chatProjectId) {
+        const isRetentionVisibilityUpdate =
+          typeof update.isTemporary === 'boolean' ||
+          Object.prototype.hasOwnProperty.call(convo, 'expiredAt') ||
+          Object.prototype.hasOwnProperty.call(unsetFields, 'isTemporary') ||
+          Object.prototype.hasOwnProperty.call(unsetFields, 'expiredAt');
+        /**
+         * Saving a conversation that is itself archived or retention-hidden (e.g.
+         * renaming or title generation on an archived project chat) must recompute
+         * stats rather than take the incremental fast path, otherwise the project's
+         * lastConversationAt/Id would point at a chat the project workspace hides.
+         */
+        const isConversationHidden =
+          conversation.isArchived === true ||
+          conversation.isTemporary === true ||
+          (conversation.expiredAt != null &&
+            new Date(conversation.expiredAt).getTime() <= Date.now());
+        /**
+         * A move into this project (projectMembershipChanged) also needs a full
+         * refresh: the incremental path only bumps the count for brand-new inserts,
+         * so a pre-existing chat joining the project would otherwise be uncounted.
+         */
+        const shouldRefreshProjectStats =
+          projectMembershipChanged ||
+          typeof update.isArchived === 'boolean' ||
+          Object.prototype.hasOwnProperty.call(unsetFields, 'isArchived') ||
+          isRetentionVisibilityUpdate ||
+          isConversationHidden;
+
+        if (shouldRefreshProjectStats) {
+          await refreshChatProjectStatsForUser(mongoose, userId, conversation.chatProjectId);
+        } else {
+          await updateChatProjectLastConversationForUser(
+            mongoose,
+            userId,
+            conversation.chatProjectId,
+            conversation,
+            conversationResult.lastErrorObject?.updatedExisting === false,
+          );
+        }
+      }
+
       return conversation.toObject();
     } catch (error) {
       logger.error('[saveConvo] Error saving conversation', error);
@@ -299,19 +404,113 @@ export function createConversationMethods(
   async function bulkSaveConvos(conversations: Array<Record<string, unknown>>) {
     try {
       const Conversation = mongoose.models.Conversation as Model<IConversation>;
-      const bulkOps = conversations.map((convo) => ({
-        updateOne: {
-          filter: {
-            conversationId: convo.conversationId,
+      const ChatProject = mongoose.models.ChatProject as Model<IChatProjectDocument>;
+
+      /**
+       * Validate project ownership before persisting (mirrors saveConvo). Bulk
+       * paths like import/duplicate/fork can carry a chatProjectId that does not
+       * belong to the user; persisting it would create an orphan assignment that
+       * is hidden from both the project and the unassigned filter.
+       */
+      const candidatePairs = new Map<string, { user: string; projectId: string }>();
+      for (const convo of conversations) {
+        if (
+          typeof convo.user === 'string' &&
+          typeof convo.chatProjectId === 'string' &&
+          isValidObjectIdString(convo.chatProjectId)
+        ) {
+          candidatePairs.set(`${convo.user}:${convo.chatProjectId}`, {
             user: convo.user,
+            projectId: convo.chatProjectId,
+          });
+        }
+      }
+
+      const ownedProjects = new Set<string>();
+      if (candidatePairs.size > 0) {
+        const owned = await ChatProject.find({
+          $or: [...candidatePairs.values()].map(({ user, projectId }) => ({
+            _id: new mongoose.Types.ObjectId(projectId),
+            user,
+          })),
+        })
+          .select('_id user')
+          .lean<Array<{ _id: { toString: () => string }; user: string }>>();
+        for (const project of owned) {
+          ownedProjects.add(`${project.user}:${project._id.toString()}`);
+        }
+      }
+
+      /**
+       * Capture each conversation's existing project so a bulk move (import that
+       * overwrites an existing (user, conversationId), duplicate/fork) also refreshes
+       * the project it leaves, not just the one it joins. One batched read keeps this
+       * O(1) in round-trips regardless of batch size.
+       */
+      const previousProjectByConversation = new Map<string, string>();
+      const conversationPairs = conversations
+        .filter((c) => typeof c.user === 'string' && typeof c.conversationId === 'string')
+        .map((c) => ({ user: c.user as string, conversationId: c.conversationId as string }));
+      if (conversationPairs.length > 0) {
+        const existing = await Conversation.find(
+          { $or: conversationPairs },
+          'user conversationId chatProjectId',
+        ).lean<Array<{ user: string; conversationId: string; chatProjectId?: string | null }>>();
+        for (const doc of existing) {
+          if (doc.chatProjectId) {
+            previousProjectByConversation.set(
+              `${doc.user}:${doc.conversationId}`,
+              doc.chatProjectId,
+            );
+          }
+        }
+      }
+
+      const affectedProjectStats = new Map<string, { user: string; projectId: string }>();
+      const bulkOps = conversations.map((convo) => {
+        const sanitized = { ...convo };
+        if (typeof sanitized.user === 'string' && typeof sanitized.chatProjectId === 'string') {
+          if (ownedProjects.has(`${sanitized.user}:${sanitized.chatProjectId}`)) {
+            affectedProjectStats.set(`${sanitized.user}:${sanitized.chatProjectId}`, {
+              user: sanitized.user,
+              projectId: sanitized.chatProjectId,
+            });
+          } else {
+            sanitized.chatProjectId = null;
+          }
+        }
+        if (typeof sanitized.user === 'string' && typeof sanitized.conversationId === 'string') {
+          const previousProjectId = previousProjectByConversation.get(
+            `${sanitized.user}:${sanitized.conversationId}`,
+          );
+          const newProjectId =
+            typeof sanitized.chatProjectId === 'string' ? sanitized.chatProjectId : null;
+          if (previousProjectId && previousProjectId !== newProjectId) {
+            affectedProjectStats.set(`${sanitized.user}:${previousProjectId}`, {
+              user: sanitized.user,
+              projectId: previousProjectId,
+            });
+          }
+        }
+        return {
+          updateOne: {
+            filter: {
+              conversationId: sanitized.conversationId,
+              user: sanitized.user,
+            },
+            update: sanitized,
+            upsert: true,
+            timestamps: false,
           },
-          update: convo,
-          upsert: true,
-          timestamps: false,
-        },
-      }));
+        };
+      });
 
       const result = await tenantSafeBulkWrite(Conversation, bulkOps);
+      await Promise.all(
+        [...affectedProjectStats.values()].map(({ user, projectId }) =>
+          refreshChatProjectStatsForUser(mongoose, user, projectId),
+        ),
+      );
       return result;
     } catch (error) {
       logger.error('[bulkSaveConvos] Error saving conversations in bulk', error);
@@ -332,6 +531,7 @@ export function createConversationMethods(
       search,
       sortBy = 'updatedAt',
       sortDirection = 'desc',
+      projectId,
     }: {
       cursor?: string | null;
       limit?: number;
@@ -340,6 +540,7 @@ export function createConversationMethods(
       search?: string;
       sortBy?: string;
       sortDirection?: string;
+      projectId?: string;
     } = {},
   ) {
     const Conversation = mongoose.models.Conversation as Model<IConversation>;
@@ -356,6 +557,14 @@ export function createConversationMethods(
       filters.push({ tags: { $in: tags } } as FilterQuery<IConversation>);
     }
 
+    if (projectId === 'unassigned') {
+      filters.push({
+        $or: [{ chatProjectId: null }, { chatProjectId: { $exists: false } }],
+      } as FilterQuery<IConversation>);
+    } else if (projectId) {
+      filters.push({ chatProjectId: projectId } as FilterQuery<IConversation>);
+    }
+
     filters.push(getVisibleConversationRetentionFilter());
 
     if (search) {
@@ -431,7 +640,7 @@ export function createConversationMethods(
 
       const convos = await Conversation.find(query)
         .select(
-          'conversationId endpoint title createdAt updatedAt user model agent_id assistant_id spec iconURL',
+          'conversationId endpoint title createdAt updatedAt user model agent_id assistant_id spec iconURL chatProjectId',
         )
         .sort(sortObj)
         .limit(limit + 1)
@@ -538,8 +747,15 @@ export function createConversationMethods(
       const Conversation = mongoose.models.Conversation as Model<IConversation>;
       const { deleteMessages } = getMessageMethods();
       const userFilter = { ...filter, user };
-      const conversations = await Conversation.find(userFilter).select('conversationId');
+      const conversations = await Conversation.find(userFilter).select(
+        'conversationId chatProjectId',
+      );
       const conversationIds = conversations.map((c) => c.conversationId);
+      const projectIds = new Set(
+        conversations
+          .map((conversation) => conversation.chatProjectId)
+          .filter((projectId): projectId is string => Boolean(projectId)),
+      );
 
       if (!conversationIds.length) {
         throw new Error('Conversation not found or already deleted.');
@@ -552,6 +768,12 @@ export function createConversationMethods(
         user,
       });
 
+      await Promise.all(
+        [...projectIds].map((projectId) =>
+          refreshChatProjectStatsForUser(mongoose, user, projectId),
+        ),
+      );
+
       return { ...deleteConvoResult, messages: deleteMessagesResult };
     } catch (error) {
       logger.error('[deleteConvos] Error deleting conversations and messages', error);
diff --git a/packages/data-schemas/src/methods/conversationTag.ts b/packages/data-schemas/src/methods/conversationTag.ts
index 085948bab5a..c4f239c07d5 100644
--- a/packages/data-schemas/src/methods/conversationTag.ts
+++ b/packages/data-schemas/src/methods/conversationTag.ts
@@ -12,11 +12,111 @@ interface IConversationTag {
   [key: string]: unknown;
 }
 
-export function createConversationTagMethods(mongoose: typeof import('mongoose')) {
+export function createConversationTagMethods(mongoose: typeof import('mongoose')): {
+  getConversationTags: (user: string) => Promise<
+    (import('mongoose').FlattenMaps<{
+      [x: string]: unknown;
+      user: string;
+      tag: string;
+      description?: string | undefined;
+      position: number;
+      count: number;
+      createdAt?: Date | undefined;
+    }> & {
+      _id: import('mongoose').Types.ObjectId;
+    } & {
+      __v: number;
+    })[]
+  >;
+  createConversationTag: (
+    user: string,
+    data: {
+      tag: string;
+      description?: string;
+      addToConversation?: boolean;
+      conversationId?: string;
+    },
+  ) => Promise<
+    | (import('mongoose').FlattenMaps<{
+        [x: string]: unknown;
+        user: string;
+        tag: string;
+        description?: string | undefined;
+        position: number;
+        count: number;
+        createdAt?: Date | undefined;
+      }> & {
+        _id: import('mongoose').Types.ObjectId;
+      } & {
+        __v: number;
+      })
+    | null
+  >;
+  updateConversationTag: (
+    user: string,
+    oldTag: string,
+    data: { tag?: string; description?: string; position?: number },
+  ) => Promise<
+    | (import('mongoose').FlattenMaps<{
+        [x: string]: unknown;
+        user: string;
+        tag: string;
+        description?: string | undefined;
+        position: number;
+        count: number;
+        createdAt?: Date | undefined;
+      }> & {
+        _id: import('mongoose').Types.ObjectId;
+      } & {
+        __v: number;
+      })
+    | null
+  >;
+  deleteConversationTag: (
+    user: string,
+    tag: string,
+  ) => Promise<
+    | (import('mongoose').FlattenMaps<{
+        [x: string]: unknown;
+        user: string;
+        tag: string;
+        description?: string | undefined;
+        position: number;
+        count: number;
+        createdAt?: Date | undefined;
+      }> & {
+        _id: import('mongoose').Types.ObjectId;
+      } & {
+        __v: number;
+      })
+    | null
+  >;
+  deleteConversationTags: (filter: Record<string, unknown>) => Promise<number>;
+  bulkIncrementTagCounts: (user: string, tags: string[]) => Promise<void>;
+  updateTagsForConversation: (
+    user: string,
+    conversationId: string,
+    tags: string[],
+  ) => Promise<string[]>;
+} {
   /**
    * Retrieves all conversation tags for a user.
    */
-  async function getConversationTags(user: string) {
+  async function getConversationTags(user: string): Promise<
+    (import('mongoose').FlattenMaps<{
+      [x: string]: unknown;
+      user: string;
+      tag: string;
+      description?: string | undefined;
+      position: number;
+      count: number;
+      createdAt?: Date | undefined;
+    }> & {
+      _id: import('mongoose').Types.ObjectId;
+    } & {
+      __v: number;
+    })[]
+  > {
     try {
       const ConversationTag = mongoose.models.ConversationTag as Model<IConversationTag>;
       return await ConversationTag.find({ user }).sort({ position: 1 }).lean();
@@ -37,7 +137,22 @@ export function createConversationTagMethods(mongoose: typeof import('mongoose')
       addToConversation?: boolean;
       conversationId?: string;
     },
-  ) {
+  ): Promise<
+    | (import('mongoose').FlattenMaps<{
+        [x: string]: unknown;
+        user: string;
+        tag: string;
+        description?: string | undefined;
+        position: number;
+        count: number;
+        createdAt?: Date | undefined;
+      }> & {
+        _id: import('mongoose').Types.ObjectId;
+      } & {
+        __v: number;
+      })
+    | null
+  > {
     try {
       const ConversationTag = mongoose.models.ConversationTag as Model<IConversationTag>;
       const Conversation = mongoose.models.Conversation;
@@ -116,7 +231,22 @@ export function createConversationTagMethods(mongoose: typeof import('mongoose')
     user: string,
     oldTag: string,
     data: { tag?: string; description?: string; position?: number },
-  ) {
+  ): Promise<
+    | (import('mongoose').FlattenMaps<{
+        [x: string]: unknown;
+        user: string;
+        tag: string;
+        description?: string | undefined;
+        position: number;
+        count: number;
+        createdAt?: Date | undefined;
+      }> & {
+        _id: import('mongoose').Types.ObjectId;
+      } & {
+        __v: number;
+      })
+    | null
+  > {
     try {
       const ConversationTag = mongoose.models.ConversationTag as Model<IConversationTag>;
       const Conversation = mongoose.models.Conversation;
@@ -161,7 +291,25 @@ export function createConversationTagMethods(mongoose: typeof import('mongoose')
   /**
    * Deletes a conversation tag.
    */
-  async function deleteConversationTag(user: string, tag: string) {
+  async function deleteConversationTag(
+    user: string,
+    tag: string,
+  ): Promise<
+    | (import('mongoose').FlattenMaps<{
+        [x: string]: unknown;
+        user: string;
+        tag: string;
+        description?: string | undefined;
+        position: number;
+        count: number;
+        createdAt?: Date | undefined;
+      }> & {
+        _id: import('mongoose').Types.ObjectId;
+      } & {
+        __v: number;
+      })
+    | null
+  > {
     try {
       const ConversationTag = mongoose.models.ConversationTag as Model<IConversationTag>;
       const Conversation = mongoose.models.Conversation;
@@ -188,7 +336,11 @@ export function createConversationTagMethods(mongoose: typeof import('mongoose')
   /**
    * Updates tags for a specific conversation.
    */
-  async function updateTagsForConversation(user: string, conversationId: string, tags: string[]) {
+  async function updateTagsForConversation(
+    user: string,
+    conversationId: string,
+    tags: string[],
+  ): Promise<string[]> {
     try {
       const ConversationTag = mongoose.models.ConversationTag as Model<IConversationTag>;
       const Conversation = mongoose.models.Conversation;
@@ -255,7 +407,7 @@ export function createConversationTagMethods(mongoose: typeof import('mongoose')
   /**
    * Increments tag counts for existing tags only.
    */
-  async function bulkIncrementTagCounts(user: string, tags: string[]) {
+  async function bulkIncrementTagCounts(user: string, tags: string[]): Promise<void> {
     if (!tags || tags.length === 0) {
       return;
     }
diff --git a/packages/data-schemas/src/methods/file.spec.ts b/packages/data-schemas/src/methods/file.spec.ts
index 08dd02326c1..090783e2637 100644
--- a/packages/data-schemas/src/methods/file.spec.ts
+++ b/packages/data-schemas/src/methods/file.spec.ts
@@ -2,10 +2,10 @@ import mongoose from 'mongoose';
 import { v4 as uuidv4 } from 'uuid';
 import { MongoMemoryServer } from 'mongodb-memory-server';
 import { EToolResources, FileContext } from 'librechat-data-provider';
+import { _resetStrictCache } from '~/models/plugins/tenantIsolation';
+import { runAsSystem } from '~/config/tenantContext';
 import { createFileMethods } from './file';
 import { createModels } from '~/models';
-import { runAsSystem } from '~/config/tenantContext';
-import { _resetStrictCache } from '~/models/plugins/tenantIsolation';
 
 let File: mongoose.Model<unknown>;
 let fileMethods: ReturnType<typeof createFileMethods>;
@@ -660,6 +660,43 @@ describe('File Methods', () => {
       const updated2 = await fileMethods.updateFileUsage({ file_id: fileId, inc: 5 });
       expect(updated2?.usage).toBe(6);
     });
+
+    it('should skip usage and TTL mutation when the owner filter does not match', async () => {
+      const fileId = uuidv4();
+      const ownerId = new mongoose.Types.ObjectId();
+      const otherUserId = new mongoose.Types.ObjectId();
+
+      await fileMethods.createFile({
+        file_id: fileId,
+        temp_file_id: 'tmp-file',
+        user: ownerId,
+        filename: 'owned.txt',
+        filepath: '/uploads/owned.txt',
+        type: 'text/plain',
+        bytes: 100,
+        usage: 0,
+      });
+
+      const denied = await fileMethods.updateFileUsage({
+        file_id: fileId,
+        user: otherUserId.toString(),
+      });
+      const unchanged = await fileMethods.findFileById(fileId);
+
+      expect(denied).toBeNull();
+      expect(unchanged?.usage).toBe(0);
+      expect(unchanged?.temp_file_id).toBe('tmp-file');
+      expect(unchanged?.expiresAt).toBeDefined();
+
+      const allowed = await fileMethods.updateFileUsage({
+        file_id: fileId,
+        user: ownerId.toString(),
+      });
+
+      expect(allowed?.usage).toBe(1);
+      expect(allowed?.temp_file_id).toBeUndefined();
+      expect(allowed?.expiresAt).toBeUndefined();
+    });
   });
 
   describe('updateFilesUsage', () => {
@@ -789,6 +826,48 @@ describe('File Methods', () => {
       expect(updated).toHaveLength(1);
       expect((updated[0] as { usage: number }).usage).toBe(1);
     });
+
+    it('should only return and mutate files owned by the scoped user', async () => {
+      const ownerId = new mongoose.Types.ObjectId();
+      const otherUserId = new mongoose.Types.ObjectId();
+      const ownerFileId = uuidv4();
+      const otherFileId = uuidv4();
+
+      await fileMethods.createFile({
+        file_id: ownerFileId,
+        user: ownerId,
+        filename: 'owner.txt',
+        filepath: '/uploads/owner.txt',
+        type: 'text/plain',
+        bytes: 100,
+        usage: 0,
+      });
+      await fileMethods.createFile({
+        file_id: otherFileId,
+        temp_file_id: 'tmp-other',
+        user: otherUserId,
+        filename: 'other.txt',
+        filepath: '/uploads/other.txt',
+        type: 'text/plain',
+        bytes: 100,
+        usage: 0,
+        text: 'private extracted text',
+      });
+
+      const updated = await fileMethods.updateFilesUsage(
+        [{ file_id: ownerFileId }, { file_id: otherFileId }],
+        undefined,
+        { user: ownerId.toString() },
+      );
+      const otherFile = await fileMethods.findFileById(otherFileId);
+
+      expect(updated).toHaveLength(1);
+      expect(updated[0].file_id).toBe(ownerFileId);
+      expect(updated[0].usage).toBe(1);
+      expect(otherFile?.usage).toBe(0);
+      expect(otherFile?.temp_file_id).toBe('tmp-other');
+      expect(otherFile?.expiresAt).toBeDefined();
+    });
   });
 
   describe('deleteFile', () => {
diff --git a/packages/data-schemas/src/methods/file.ts b/packages/data-schemas/src/methods/file.ts
index a76cbc13155..c8d7620580d 100644
--- a/packages/data-schemas/src/methods/file.ts
+++ b/packages/data-schemas/src/methods/file.ts
@@ -1,11 +1,62 @@
-import logger from '../config/winston';
 import { EToolResources, FileContext } from 'librechat-data-provider';
 import type { FilterQuery, SortOrder, Model } from 'mongoose';
 import type { IMongoFile } from '~/types/file';
 import { tenantSafeBulkWrite } from '~/utils/tenantBulkWrite';
+import logger from '../config/winston';
 
 /** Factory function that takes mongoose instance and returns the file methods */
-export function createFileMethods(mongoose: typeof import('mongoose')) {
+export function createFileMethods(mongoose: typeof import('mongoose')): {
+  findFileById: (file_id: string, options?: Record<string, unknown>) => Promise<IMongoFile | null>;
+  getFiles: (
+    filter: FilterQuery<IMongoFile>,
+    _sortOptions?: Record<string, SortOrder> | null,
+    selectFields?: Record<string, 0 | 1> | string | null,
+  ) => Promise<IMongoFile[] | null>;
+  getExpiredFiles: (limit?: number, now?: Date) => Promise<IMongoFile[]>;
+  getToolFilesByIds: (
+    fileIds: string[],
+    toolResourceSet?: Set<EToolResources>,
+  ) => Promise<IMongoFile[]>;
+  getCodeGeneratedFiles: (
+    conversationId: string,
+    threadFileIds?: string[],
+  ) => Promise<IMongoFile[]>;
+  getUserCodeFiles: (fileIds?: string[]) => Promise<IMongoFile[]>;
+  claimCodeFile: (data: {
+    filename: string;
+    conversationId: string;
+    file_id: string;
+    user: string;
+    tenantId?: string | null;
+  }) => Promise<IMongoFile>;
+  createFile: (data: Partial<IMongoFile>, disableTTL?: boolean) => Promise<IMongoFile | null>;
+  updateFile: (
+    data: Partial<IMongoFile> & { file_id: string },
+    extraFilter?: FilterQuery<IMongoFile>,
+  ) => Promise<IMongoFile | null>;
+  updateFileUsage: (data: {
+    file_id: string;
+    inc?: number;
+    user?: string;
+  }) => Promise<IMongoFile | null>;
+  deleteFile: (file_id: string) => Promise<IMongoFile | null>;
+  deleteFiles: (file_ids: string[], user?: string) => Promise<{ deletedCount?: number }>;
+  deleteFileByFilter: (filter: FilterQuery<IMongoFile>) => Promise<IMongoFile | null>;
+  batchUpdateFiles: (
+    updates: Array<{
+      file_id: string;
+      filepath: string;
+      storageKey?: string;
+      storageRegion?: string;
+    }>,
+  ) => Promise<void>;
+  updateFilesUsage: (
+    files: Array<{ file_id: string }>,
+    fileIds?: string[],
+    options?: { user?: string },
+  ) => Promise<IMongoFile[]>;
+  sweepOrphanedPreviews: (maxAgeMs?: number) => Promise<number>;
+} {
   /**
    * Finds a file by its file_id with additional query options.
    * @param file_id - The unique identifier of the file
@@ -34,7 +85,7 @@ export function createFileMethods(mongoose: typeof import('mongoose')) {
   async function getFiles(
     filter: FilterQuery<IMongoFile>,
     _sortOptions?: Record<string, SortOrder> | null,
-    selectFields?: SelectProjection | string | null,
+    selectFields?: string | Record<string, 0 | 1> | null | undefined,
   ): Promise<IMongoFile[] | null> {
     const File = mongoose.models.File as Model<IMongoFile>;
     const sortOptions = { updatedAt: -1 as SortOrder, ..._sortOptions };
@@ -47,7 +98,7 @@ export function createFileMethods(mongoose: typeof import('mongoose')) {
     return await query.sort(sortOptions).lean<IMongoFile[]>();
   }
 
-  async function getExpiredFiles(limit = 100, now = new Date()): Promise<IMongoFile[]> {
+  async function getExpiredFiles(limit = 100, now: Date = new Date()): Promise<IMongoFile[]> {
     const File = mongoose.models.File as Model<IMongoFile>;
     return await File.find({ expiredAt: { $ne: null, $lte: now } })
       .sort({ expiredAt: 1 })
@@ -305,14 +356,17 @@ export function createFileMethods(mongoose: typeof import('mongoose')) {
   async function updateFileUsage(data: {
     file_id: string;
     inc?: number;
+    user?: string;
   }): Promise<IMongoFile | null> {
     const File = mongoose.models.File as Model<IMongoFile>;
-    const { file_id, inc = 1 } = data;
+    const { file_id, inc = 1, user } = data;
     const updateOperation = {
       $inc: { usage: inc },
       $unset: { expiresAt: '', temp_file_id: '' },
     };
-    return File.findOneAndUpdate({ file_id }, updateOperation, {
+    // Owner scoping is fail-closed: mismatches leave usage and TTL metadata unchanged.
+    const query: FilterQuery<IMongoFile> = user ? { file_id, user } : { file_id };
+    return File.findOneAndUpdate(query, updateOperation, {
       new: true,
     }).lean<IMongoFile>();
   }
@@ -400,9 +454,12 @@ export function createFileMethods(mongoose: typeof import('mongoose')) {
   async function updateFilesUsage(
     files: Array<{ file_id: string }>,
     fileIds?: string[],
+    options?: { user?: string },
   ): Promise<IMongoFile[]> {
     const promises: Promise<IMongoFile | null>[] = [];
     const seen = new Set<string>();
+    // Preserve the same owner scope for every deduped ID in this batch.
+    const user = options?.user;
 
     for (const file of files) {
       const { file_id } = file;
@@ -410,7 +467,7 @@ export function createFileMethods(mongoose: typeof import('mongoose')) {
         continue;
       }
       seen.add(file_id);
-      promises.push(updateFileUsage({ file_id }));
+      promises.push(updateFileUsage({ file_id, user }));
     }
 
     if (!fileIds) {
@@ -423,7 +480,7 @@ export function createFileMethods(mongoose: typeof import('mongoose')) {
         continue;
       }
       seen.add(file_id);
-      promises.push(updateFileUsage({ file_id }));
+      promises.push(updateFileUsage({ file_id, user }));
     }
 
     const results = await Promise.all(promises);
diff --git a/packages/data-schemas/src/methods/index.ts b/packages/data-schemas/src/methods/index.ts
index 28d3effab75..9ea9e5f1e5b 100644
--- a/packages/data-schemas/src/methods/index.ts
+++ b/packages/data-schemas/src/methods/index.ts
@@ -1,10 +1,10 @@
+import type { RoleMethods, RoleDeps } from './role';
 import { createSessionMethods, DEFAULT_REFRESH_TOKEN_EXPIRY, type SessionMethods } from './session';
+import { createUserMethods, DEFAULT_SESSION_EXPIRY, type UserMethods } from './user';
 import { createTokenMethods, type TokenMethods } from './token';
 import { createRoleMethods, RoleConflictError } from './role';
-import type { RoleMethods, RoleDeps } from './role';
-import { createUserMethods, DEFAULT_SESSION_EXPIRY, type UserMethods } from './user';
-import { createKeyMethods, type KeyMethods } from './key';
 import { createFileMethods, type FileMethods } from './file';
+import { createKeyMethods, type KeyMethods } from './key';
 /* Memories */
 import { createMemoryMethods, type MemoryMethods } from './memory';
 /* Agent Categories */
@@ -32,6 +32,17 @@ import { createPresetMethods, type PresetMethods } from './preset';
 import { createConversationTagMethods, type ConversationTagMethods } from './conversationTag';
 import { createMessageMethods, type MessageMethods } from './message';
 import { createConversationMethods, type ConversationMethods } from './conversation';
+import { createChatProjectMethods, type ChatProjectMethods } from './chatProject';
+export type {
+  AssignConversationToProjectResult,
+  ChatProjectSortBy,
+  ChatProjectSortDirection,
+  CreateChatProjectInput,
+  DeleteChatProjectResult,
+  ListChatProjectsOptions,
+  ListChatProjectsResult,
+  UpdateChatProjectInput,
+} from './chatProject';
 /* Tier 3 — Complex (heavier injection) */
 import {
   createTxMethods,
@@ -47,6 +58,14 @@ import { createSpendTokensMethods, type SpendTokensMethods } from './spendTokens
 import { createPromptMethods, type PromptMethods, type PromptDeps } from './prompt';
 import {
   createSkillMethods,
+  partitionIssues,
+  validateSkillName,
+  validateSkillBody,
+  validateRelativePath,
+  validateSkillFrontmatter,
+  validateSkillDescription,
+  deriveStructuredFrontmatterFields,
+  inferSkillFileCategory,
   type SkillMethods,
   type SkillDeps,
   type CreateSkillInput,
@@ -58,14 +77,30 @@ import {
   type UpdateSkillResult,
   type ValidationIssue,
 } from './skill';
+import { createSkillSyncMethods, type SkillSyncMethods } from './skillSync';
+import type {
+  SkillSyncStatusInput,
+  SkillSyncCredentialSummary,
+  UpsertSkillSyncCredentialInput,
+} from './skillSync';
 /* Tier 5 — Agent */
 import { createAgentMethods, type AgentMethods, type AgentDeps } from './agent';
 /* Config */
 import { createConfigMethods, type ConfigMethods } from './config';
 
 export { RoleConflictError, DEFAULT_REFRESH_TOKEN_EXPIRY, DEFAULT_SESSION_EXPIRY };
-export { tokenValues, cacheTokenValues, premiumTokenValues, defaultRate };
+export { tokenValues, cacheTokenValues, premiumTokenValues, defaultRate, createTxMethods };
 export { permissionBitSupersets };
+export {
+  partitionIssues,
+  validateSkillName,
+  validateSkillBody,
+  validateRelativePath,
+  validateSkillFrontmatter,
+  validateSkillDescription,
+  deriveStructuredFrontmatterFields,
+  inferSkillFileCategory,
+};
 
 export type AllMethods = UserMethods &
   SessionMethods &
@@ -92,11 +127,13 @@ export type AllMethods = UserMethods &
   ConversationTagMethods &
   MessageMethods &
   ConversationMethods &
+  ChatProjectMethods &
   TxMethods &
   TransactionMethods &
   SpendTokensMethods &
   PromptMethods &
   SkillMethods &
+  SkillSyncMethods &
   AgentMethods &
   ConfigMethods;
 
@@ -218,12 +255,14 @@ export function createMethods(
     ...createConversationTagMethods(mongoose),
     ...messageMethods,
     ...conversationMethods,
+    ...createChatProjectMethods(mongoose),
     /* Tier 3 */
     ...txMethods,
     ...transactionMethods,
     ...spendTokensMethods,
     ...promptMethods,
     ...skillMethods,
+    ...createSkillSyncMethods(mongoose),
     /* Tier 5 */
     ...agentMethods,
     /* Config */
@@ -257,6 +296,7 @@ export type {
   ConversationTagMethods,
   MessageMethods,
   ConversationMethods,
+  ChatProjectMethods,
   TxMethods,
   TransactionMethods,
   SpendTokensMethods,
@@ -271,6 +311,10 @@ export type {
   ListSkillsByAccessResult,
   UpdateSkillResult,
   ValidationIssue,
+  SkillSyncStatusInput,
+  SkillSyncCredentialSummary,
+  UpsertSkillSyncCredentialInput,
+  SkillSyncMethods,
   AgentMethods,
   ConfigMethods,
 };
diff --git a/packages/data-schemas/src/methods/key.ts b/packages/data-schemas/src/methods/key.ts
index 094b1f9dfcd..8a7c8a337a6 100644
--- a/packages/data-schemas/src/methods/key.ts
+++ b/packages/data-schemas/src/methods/key.ts
@@ -4,7 +4,21 @@ import { encrypt, decrypt } from '~/crypto';
 import logger from '~/config/winston';
 
 /** Factory function that takes mongoose instance and returns the key methods */
-export function createKeyMethods(mongoose: typeof import('mongoose')) {
+export function createKeyMethods(mongoose: typeof import('mongoose')): {
+  getUserKey: (params: { userId: string; name: string }) => Promise<string>;
+  updateUserKey: (params: {
+    userId: string;
+    name: string;
+    value: string;
+    expiresAt?: Date | null;
+  }) => Promise<unknown>;
+  deleteUserKey: (params: { userId: string; name?: string; all?: boolean }) => Promise<unknown>;
+  getUserKeyValues: (params: { userId: string; name: string }) => Promise<Record<string, string>>;
+  getUserKeyExpiry: (params: {
+    userId: string;
+    name: string;
+  }) => Promise<{ expiresAt: Date | 'never' | null }>;
+} {
   /**
    * Retrieves and decrypts the key value for a given user identified by userId and identifier name.
    * @param params - The parameters object
diff --git a/packages/data-schemas/src/methods/mcpServer.ts b/packages/data-schemas/src/methods/mcpServer.ts
index d48fd2a4e4e..f6d8868f62a 100644
--- a/packages/data-schemas/src/methods/mcpServer.ts
+++ b/packages/data-schemas/src/methods/mcpServer.ts
@@ -1,8 +1,8 @@
+import { nanoid } from 'nanoid';
 import type { Model, RootFilterQuery, Types } from 'mongoose';
-import type { MCPServerDocument } from '../types';
 import type { MCPOptions } from 'librechat-data-provider';
+import type { MCPServerDocument } from '../types';
 import logger from '~/config/winston';
-import { nanoid } from 'nanoid';
 
 const NORMALIZED_LIMIT_DEFAULT = 20;
 const MAX_CREATE_RETRIES = 5;
@@ -44,7 +44,39 @@ function generateServerNameFromTitle(title: string): string {
   return slug || 'mcp-server'; // Fallback if empty
 }
 
-export function createMCPServerMethods(mongoose: typeof import('mongoose')) {
+export function createMCPServerMethods(mongoose: typeof import('mongoose')): {
+  createMCPServer: (data: {
+    config: MCPOptions;
+    author: string | Types.ObjectId;
+    reservedServerNames?: Iterable<string>;
+  }) => Promise<MCPServerDocument>;
+  findMCPServerByServerName: (serverName: string) => Promise<MCPServerDocument | null>;
+  findMCPServerByObjectId: (_id: string | Types.ObjectId) => Promise<MCPServerDocument | null>;
+  findMCPServersByAuthor: (authorId: string | Types.ObjectId) => Promise<MCPServerDocument[]>;
+  getListMCPServersByIds: ({
+    ids,
+    otherParams,
+    limit,
+    after,
+  }: {
+    ids?: Types.ObjectId[];
+    otherParams?: RootFilterQuery<MCPServerDocument>;
+    limit?: number | null;
+    after?: string | null;
+  }) => Promise<{
+    data: MCPServerDocument[];
+    has_more: boolean;
+    after: string | null;
+  }>;
+  getListMCPServersByNames: ({ names }: { names: string[] }) => Promise<{
+    data: MCPServerDocument[];
+  }>;
+  updateMCPServer: (
+    serverName: string,
+    updateData: { config?: MCPOptions },
+  ) => Promise<MCPServerDocument | null>;
+  deleteMCPServer: (serverName: string) => Promise<MCPServerDocument | null>;
+} {
   /**
    * Finds the next available server name by checking DB and reserved-name collisions.
    * If baseName is taken or reserved, returns baseName-2, baseName-3, etc.
diff --git a/packages/data-schemas/src/methods/memory.ts b/packages/data-schemas/src/methods/memory.ts
index 749fbc9cf12..7c895351982 100644
--- a/packages/data-schemas/src/methods/memory.ts
+++ b/packages/data-schemas/src/methods/memory.ts
@@ -1,6 +1,6 @@
 import { Types } from 'mongoose';
-import logger from '~/config/winston';
 import type * as t from '~/types';
+import logger from '~/config/winston';
 
 /**
  * Formats a date in YYYY-MM-DD format
@@ -10,7 +10,16 @@ const formatDate = (date: Date): string => {
 };
 
 // Factory function that takes mongoose instance and returns the methods
-export function createMemoryMethods(mongoose: typeof import('mongoose')) {
+export function createMemoryMethods(mongoose: typeof import('mongoose')): {
+  setMemory: ({ userId, key, value, tokenCount }: t.SetMemoryParams) => Promise<t.MemoryResult>;
+  createMemory: ({ userId, key, value, tokenCount }: t.SetMemoryParams) => Promise<t.MemoryResult>;
+  deleteMemory: ({ userId, key }: t.DeleteMemoryParams) => Promise<t.MemoryResult>;
+  getAllUserMemories: (userId: string | Types.ObjectId) => Promise<t.IMemoryEntryLean[]>;
+  getFormattedMemories: ({
+    userId,
+  }: t.GetFormattedMemoriesParams) => Promise<t.FormattedMemoriesResult>;
+  deleteAllUserMemories: (userId: string | Types.ObjectId) => Promise<number>;
+} {
   /**
    * Creates a new memory entry for a user
    * Throws an error if a memory with the same key already exists
diff --git a/packages/data-schemas/src/methods/message.spec.ts b/packages/data-schemas/src/methods/message.spec.ts
index 98b02dd19d5..3c3986de939 100644
--- a/packages/data-schemas/src/methods/message.spec.ts
+++ b/packages/data-schemas/src/methods/message.spec.ts
@@ -3,9 +3,12 @@ import { v4 as uuidv4 } from 'uuid';
 import { RetentionMode } from 'librechat-data-provider';
 import { MongoMemoryServer } from 'mongodb-memory-server';
 import type { IMessage } from '..';
-import { createMessageMethods } from './message';
 import { tenantStorage, runAsSystem } from '~/config/tenantContext';
+import { createMessageMethods } from './message';
 import { createModels } from '../models';
+import logger from '~/config/winston';
+
+const waitForTimestampTick = () => new Promise((resolve) => setTimeout(resolve, 2));
 
 jest.mock('~/config/winston', () => ({
   error: jest.fn(),
@@ -65,6 +68,8 @@ describe('Message Operations', () => {
   };
 
   beforeEach(async () => {
+    jest.clearAllMocks();
+
     // Clear database
     await Message.deleteMany({});
 
@@ -107,6 +112,18 @@ describe('Message Operations', () => {
       const result = await saveMessage(mockCtx, mockMessageData);
       expect(result).toBeUndefined();
     });
+
+    it('should not log message params for invalid conversation IDs', async () => {
+      mockMessageData.conversationId = 'invalid-id';
+      mockMessageData.text = 'Sensitive prompt text';
+
+      await saveMessage(mockCtx, mockMessageData, { context: 'message-save-test' });
+
+      expect(logger.warn).toHaveBeenCalledWith(
+        'Invalid conversation ID: invalid-id (context: message-save-test)',
+      );
+      expect(logger.info).not.toHaveBeenCalled();
+    });
   });
 
   describe('updateMessageText', () => {
@@ -167,6 +184,8 @@ describe('Message Operations', () => {
         user: 'user123',
       });
 
+      await waitForTimestampTick();
+
       await saveMessage(mockCtx, {
         messageId: 'msg3',
         conversationId,
diff --git a/packages/data-schemas/src/methods/message.ts b/packages/data-schemas/src/methods/message.ts
index acaff7c7784..9ee15c79785 100644
--- a/packages/data-schemas/src/methods/message.ts
+++ b/packages/data-schemas/src/methods/message.ts
@@ -1,10 +1,10 @@
-import type { DeleteResult, FilterQuery, Model } from 'mongoose';
 import { RetentionMode } from 'librechat-data-provider';
-import logger from '~/config/winston';
+import type { DeleteResult, FilterQuery, Model } from 'mongoose';
+import type { AppConfig, IMessage } from '~/types';
 import { createTempChatExpirationDate } from '~/utils/tempChatRetention';
 import { createFallbackRetentionDate } from '~/utils/retention';
 import { tenantSafeBulkWrite } from '~/utils/tenantBulkWrite';
-import type { AppConfig, IMessage } from '~/types';
+import logger from '~/config/winston';
 
 /** Simple UUID v4 regex to replace zod validation */
 const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
@@ -79,9 +79,9 @@ export function createMessageMethods(mongoose: typeof import('mongoose')): Messa
 
     const conversationId = params.conversationId as string | undefined;
     if (!conversationId || !UUID_REGEX.test(conversationId)) {
-      logger.warn(`Invalid conversation ID: ${conversationId}`);
-      logger.info(`---\`saveMessage\` context: ${metadata?.context}`);
-      logger.info(`---Invalid conversation ID Params: ${JSON.stringify(params, null, 2)}`);
+      logger.warn(
+        `Invalid conversation ID: ${conversationId} (context: ${metadata?.context ?? 'n/a'})`,
+      );
       return;
     }
 
@@ -285,6 +285,7 @@ export function createMessageMethods(mongoose: typeof import('mongoose')): Messa
         isCreatedByUser: updatedMessage.isCreatedByUser,
         tokenCount: updatedMessage.tokenCount,
         feedback: updatedMessage.feedback,
+        endpoint: updatedMessage.endpoint,
       };
     } catch (err) {
       logger.error('Error updating message:', err);
diff --git a/packages/data-schemas/src/methods/pluginAuth.ts b/packages/data-schemas/src/methods/pluginAuth.ts
index e95e3123bec..3aed689ccb3 100644
--- a/packages/data-schemas/src/methods/pluginAuth.ts
+++ b/packages/data-schemas/src/methods/pluginAuth.ts
@@ -8,7 +8,30 @@ import type {
 } from '~/types';
 
 // Factory function that takes mongoose instance and returns the methods
-export function createPluginAuthMethods(mongoose: typeof import('mongoose')) {
+export function createPluginAuthMethods(mongoose: typeof import('mongoose')): {
+  findOnePluginAuth: ({
+    userId,
+    authField,
+    pluginKey,
+  }: FindPluginAuthParams) => Promise<IPluginAuth | null>;
+  findPluginAuthsByKeys: ({
+    userId,
+    pluginKeys,
+  }: FindPluginAuthsByKeysParams) => Promise<IPluginAuth[]>;
+  updatePluginAuth: ({
+    userId,
+    authField,
+    pluginKey,
+    value,
+  }: UpdatePluginAuthParams) => Promise<IPluginAuth>;
+  deletePluginAuth: ({
+    userId,
+    authField,
+    pluginKey,
+    all,
+  }: DeletePluginAuthParams) => Promise<DeleteResult>;
+  deleteAllUserPluginAuths: (userId: string) => Promise<DeleteResult>;
+} {
   /**
    * Finds a single plugin auth entry by userId and authField (and optionally pluginKey)
    */
diff --git a/packages/data-schemas/src/methods/preset.ts b/packages/data-schemas/src/methods/preset.ts
index 11af817cbde..300c96c5e89 100644
--- a/packages/data-schemas/src/methods/preset.ts
+++ b/packages/data-schemas/src/methods/preset.ts
@@ -11,11 +11,120 @@ interface IPreset {
   [key: string]: unknown;
 }
 
-export function createPresetMethods(mongoose: typeof import('mongoose')) {
+export function createPresetMethods(mongoose: typeof import('mongoose')): {
+  getPreset: (
+    user: string,
+    presetId: string,
+  ) => Promise<
+    | (import('mongoose').FlattenMaps<{
+        [x: string]: unknown;
+        user?: string | undefined;
+        presetId?: string | undefined;
+        order?: number | undefined;
+        defaultPreset?: boolean | undefined;
+        tools?:
+          | (
+              | string
+              | {
+                  pluginKey?: string | undefined;
+                }
+            )[]
+          | undefined;
+        updatedAt?: Date | undefined;
+      }> & {
+        _id: import('mongoose').Types.ObjectId;
+      } & {
+        __v: number;
+      })
+    | {
+        message: string;
+      }
+    | null
+  >;
+  getPresets: (
+    user: string,
+    filter?: Record<string, unknown>,
+  ) => Promise<
+    | (import('mongoose').FlattenMaps<{
+        [x: string]: unknown;
+        user?: string | undefined;
+        presetId?: string | undefined;
+        order?: number | undefined;
+        defaultPreset?: boolean | undefined;
+        tools?:
+          | (
+              | string
+              | {
+                  pluginKey?: string | undefined;
+                }
+            )[]
+          | undefined;
+        updatedAt?: Date | undefined;
+      }> & {
+        _id: import('mongoose').Types.ObjectId;
+      } & {
+        __v: number;
+      })[]
+    | {
+        message: string;
+      }
+  >;
+  savePreset: (
+    user: string,
+    {
+      presetId,
+      newPresetId,
+      defaultPreset,
+      ...preset
+    }: {
+      presetId?: string;
+      newPresetId?: string;
+      defaultPreset?: boolean;
+      [key: string]: unknown;
+    },
+  ) => Promise<
+    | IPreset
+    | {
+        message: string;
+      }
+  >;
+  deletePresets: (
+    user: string,
+    filter?: Record<string, unknown>,
+  ) => Promise<import('mongodb').DeleteResult>;
+} {
   /**
    * Retrieves a single preset by user and presetId.
    */
-  async function getPreset(user: string, presetId: string) {
+  async function getPreset(
+    user: string,
+    presetId: string,
+  ): Promise<
+    | (import('mongoose').FlattenMaps<{
+        [x: string]: unknown;
+        user?: string | undefined;
+        presetId?: string | undefined;
+        order?: number | undefined;
+        defaultPreset?: boolean | undefined;
+        tools?:
+          | (
+              | string
+              | {
+                  pluginKey?: string | undefined;
+                }
+            )[]
+          | undefined;
+        updatedAt?: Date | undefined;
+      }> & {
+        _id: import('mongoose').Types.ObjectId;
+      } & {
+        __v: number;
+      })
+    | {
+        message: string;
+      }
+    | null
+  > {
     try {
       const Preset = mongoose.models.Preset as Model<IPreset>;
       return await Preset.findOne({ user, presetId }).lean();
@@ -28,7 +137,34 @@ export function createPresetMethods(mongoose: typeof import('mongoose')) {
   /**
    * Retrieves all presets for a user, sorted by order then updatedAt.
    */
-  async function getPresets(user: string, filter: Record<string, unknown> = {}) {
+  async function getPresets(
+    user: string,
+    filter: Record<string, unknown> = {},
+  ): Promise<
+    | (import('mongoose').FlattenMaps<{
+        [x: string]: unknown;
+        user?: string | undefined;
+        presetId?: string | undefined;
+        order?: number | undefined;
+        defaultPreset?: boolean | undefined;
+        tools?:
+          | (
+              | string
+              | {
+                  pluginKey?: string | undefined;
+                }
+            )[]
+          | undefined;
+        updatedAt?: Date | undefined;
+      }> & {
+        _id: import('mongoose').Types.ObjectId;
+      } & {
+        __v: number;
+      })[]
+    | {
+        message: string;
+      }
+  > {
     try {
       const Preset = mongoose.models.Preset as Model<IPreset>;
       const presets = await Preset.find({ ...filter, user }).lean();
@@ -68,7 +204,12 @@ export function createPresetMethods(mongoose: typeof import('mongoose')) {
       defaultPreset?: boolean;
       [key: string]: unknown;
     },
-  ) {
+  ): Promise<
+    | IPreset
+    | {
+        message: string;
+      }
+  > {
     try {
       const Preset = mongoose.models.Preset as Model<IPreset>;
       const setter: Record<string, unknown> = { $set: {} };
@@ -115,7 +256,10 @@ export function createPresetMethods(mongoose: typeof import('mongoose')) {
   /**
    * Deletes presets matching the given filter for a user.
    */
-  async function deletePresets(user: string, filter: Record<string, unknown> = {}) {
+  async function deletePresets(
+    user: string,
+    filter: Record<string, unknown> = {},
+  ): Promise<import('mongodb').DeleteResult> {
     const Preset = mongoose.models.Preset as Model<IPreset>;
     const deleteCount = await Preset.deleteMany({ ...filter, user });
     return deleteCount;
diff --git a/packages/data-schemas/src/methods/prompt.ts b/packages/data-schemas/src/methods/prompt.ts
index 3a0bd352625..10dbd026fbe 100644
--- a/packages/data-schemas/src/methods/prompt.ts
+++ b/packages/data-schemas/src/methods/prompt.ts
@@ -16,7 +16,76 @@ export interface PromptDeps {
   ) => Promise<Types.ObjectId[]>;
 }
 
-export function createPromptMethods(mongoose: typeof import('mongoose'), deps: PromptDeps) {
+export interface PromptMethods {
+  getPromptGroups(filter: Record<string, unknown>): Promise<
+    | {
+        promptGroups: Record<string, unknown>[];
+        pageNumber: string;
+        pageSize: string;
+        pages: string;
+      }
+    | { message: string }
+  >;
+  deletePromptGroup(params: { _id: string }): Promise<{ message: string }>;
+  getAllPromptGroups(
+    filter: Record<string, unknown>,
+  ): Promise<Record<string, unknown>[] | { message: string }>;
+  getListPromptGroupsByAccess(params: {
+    accessibleIds?: Types.ObjectId[];
+    otherParams?: Record<string, unknown>;
+    limit?: number | null;
+    after?: string | null;
+  }): Promise<{
+    object: 'list';
+    data: Record<string, unknown>[];
+    first_id: string | null;
+    last_id: string | null;
+    has_more: boolean;
+    after: string | null;
+  }>;
+  incrementPromptGroupUsage(groupId: string): Promise<{ numberOfGenerations: number }>;
+  createPromptGroup(saveData: {
+    prompt: Record<string, unknown>;
+    group: Record<string, unknown>;
+    author: string;
+    authorName: string;
+  }): Promise<{ prompt: Record<string, unknown> | null; group: Record<string, unknown> }>;
+  savePrompt(saveData: {
+    prompt: Record<string, unknown>;
+    author: string | Types.ObjectId;
+  }): Promise<{ prompt: IPrompt } | { message: string }>;
+  getPrompts(
+    filter: Record<string, unknown>,
+  ): Promise<Record<string, unknown>[] | { message: string }>;
+  getPrompt(
+    filter: Record<string, unknown>,
+  ): Promise<Record<string, unknown> | null | { message: string }>;
+  getRandomPromptGroups(filter: {
+    skip: number | string;
+    limit: number | string;
+  }): Promise<{ prompts: unknown[] } | { message: string }>;
+  getPromptGroupsWithPrompts(
+    filter: Record<string, unknown>,
+  ): Promise<Record<string, unknown> | null | { message: string }>;
+  getPromptGroup(filter: Record<string, unknown>): Promise<Record<string, unknown> | null>;
+  getOwnedPromptGroupIds(author: string): Promise<Types.ObjectId[]>;
+  deletePrompt(params: {
+    promptId: string | Types.ObjectId;
+    groupId: string | Types.ObjectId;
+  }): Promise<{ prompt: string; promptGroup?: { message: string; id: string | Types.ObjectId } }>;
+  deleteUserPrompts(userId: string): Promise<void>;
+  updatePromptGroup(
+    filter: Record<string, unknown>,
+    data: Record<string, unknown>,
+  ): Promise<IPromptGroupDocument | { message: string }>;
+  makePromptProduction(promptId: string): Promise<{ message: string }>;
+  updatePromptLabels(_id: string, labels: unknown): Promise<{ message: string }>;
+}
+
+export function createPromptMethods(
+  mongoose: typeof import('mongoose'),
+  deps: PromptDeps,
+): PromptMethods {
   const { getSoleOwnedResourceIds } = deps;
   const { ObjectId } = mongoose.Types;
 
@@ -51,7 +120,12 @@ export function createPromptMethods(mongoose: typeof import('mongoose'), deps: P
   /**
    * Get all prompt groups with filters (no pagination).
    */
-  async function getAllPromptGroups(filter: Record<string, unknown>) {
+  async function getAllPromptGroups(filter: Record<string, unknown>): Promise<
+    | Record<string, unknown>[]
+    | {
+        message: string;
+      }
+  > {
     try {
       const PromptGroup = mongoose.models.PromptGroup as Model<IPromptGroupDocument>;
       const { name, ...query } = filter as {
@@ -89,7 +163,22 @@ export function createPromptMethods(mongoose: typeof import('mongoose'), deps: P
   /**
    * Get prompt groups with pagination and filters.
    */
-  async function getPromptGroups(filter: Record<string, unknown>) {
+  async function getPromptGroups(filter: Record<string, unknown>): Promise<
+    | {
+        promptGroups: Record<string, unknown>[];
+        pageNumber: string;
+        pageSize: string;
+        pages: string;
+        message?: undefined;
+      }
+    | {
+        message: string;
+        promptGroups?: undefined;
+        pageNumber?: undefined;
+        pageSize?: undefined;
+        pages?: undefined;
+      }
+  > {
     try {
       const PromptGroup = mongoose.models.PromptGroup as Model<IPromptGroupDocument>;
       const {
@@ -159,7 +248,9 @@ export function createPromptMethods(mongoose: typeof import('mongoose'), deps: P
    * check — it deletes any group by ID. Callers must gate access via
    * `canAccessPromptGroupResource` middleware before invoking this.
    */
-  async function deletePromptGroup({ _id }: { _id: string }) {
+  async function deletePromptGroup({ _id }: { _id: string }): Promise<{
+    message: string;
+  }> {
     const PromptGroup = mongoose.models.PromptGroup as Model<IPromptGroupDocument>;
     const Prompt = mongoose.models.Prompt as Model<IPrompt>;
 
@@ -199,7 +290,14 @@ export function createPromptMethods(mongoose: typeof import('mongoose'), deps: P
     otherParams?: Record<string, unknown>;
     limit?: number | null;
     after?: string | null;
-  }) {
+  }): Promise<{
+    object: 'list';
+    data: Record<string, unknown>[];
+    first_id: string | null;
+    last_id: string | null;
+    has_more: boolean;
+    after: string | null;
+  }> {
     const PromptGroup = mongoose.models.PromptGroup as Model<IPromptGroupDocument>;
     const isPaginated = limit !== null && limit !== undefined;
     const normalizedLimit = isPaginated
@@ -305,7 +403,9 @@ export function createPromptMethods(mongoose: typeof import('mongoose'), deps: P
   /**
    * Increment the numberOfGenerations counter for a prompt group.
    */
-  async function incrementPromptGroupUsage(groupId: string) {
+  async function incrementPromptGroupUsage(groupId: string): Promise<{
+    numberOfGenerations: number;
+  }> {
     if (!isValidObjectIdString(groupId)) {
       throw new Error('Invalid groupId');
     }
@@ -733,7 +833,12 @@ export function createPromptMethods(mongoose: typeof import('mongoose'), deps: P
   /**
    * Update prompt labels.
    */
-  async function updatePromptLabels(_id: string, labels: unknown) {
+  async function updatePromptLabels(
+    _id: string,
+    labels: unknown,
+  ): Promise<{
+    message: string;
+  }> {
     try {
       const Prompt = mongoose.models.Prompt as Model<IPrompt>;
       const response = await Prompt.updateOne({ _id }, { $set: { labels } });
@@ -768,5 +873,3 @@ export function createPromptMethods(mongoose: typeof import('mongoose'), deps: P
     updatePromptLabels,
   };
 }
-
-export type PromptMethods = ReturnType<typeof createPromptMethods>;
diff --git a/packages/data-schemas/src/methods/role.ts b/packages/data-schemas/src/methods/role.ts
index 8b22e4a5a0b..dea9da6fa9d 100644
--- a/packages/data-schemas/src/methods/role.ts
+++ b/packages/data-schemas/src/methods/role.ts
@@ -33,13 +33,45 @@ export interface RoleDeps {
   };
 }
 
-export function createRoleMethods(mongoose: typeof import('mongoose'), deps: RoleDeps = {}) {
+export function createRoleMethods(
+  mongoose: typeof import('mongoose'),
+  deps: RoleDeps = {},
+): {
+  listRoles: (options?: {
+    limit?: number;
+    offset?: number;
+  }) => Promise<Pick<IRole, '_id' | 'name' | 'description'>[]>;
+  countRoles: () => Promise<number>;
+  initializeRoles: () => Promise<void>;
+  getRoleByName: (roleName: string, fieldsToSelect?: string | string[] | null) => Promise<IRole>;
+  findRolesByNames: (
+    roleNames: string[],
+    fieldsToSelect?: string | string[] | null,
+  ) => Promise<IRole[]>;
+  updateRoleByName: (roleName: string, updates: Partial<IRole>) => Promise<IRole>;
+  updateAccessPermissions: (
+    roleName: string,
+    permissionsUpdate: Record<string, Record<string, boolean>>,
+    roleData?: IRole,
+  ) => Promise<void>;
+  migrateRoleSchema: (roleName?: string) => Promise<number>;
+  createRoleByName: (roleData: Partial<IRole>) => Promise<IRole>;
+  deleteRoleByName: (roleName: string) => Promise<IRole | null>;
+  updateUsersByRole: (oldRole: string, newRole: string) => Promise<void>;
+  findUserIdsByRole: (roleName: string) => Promise<string[]>;
+  updateUsersRoleByIds: (userIds: string[], newRole: string) => Promise<void>;
+  listUsersByRole: (
+    roleName: string,
+    options?: { limit?: number; offset?: number },
+  ) => Promise<IUser[]>;
+  countUsersByRole: (roleName: string) => Promise<number>;
+} {
   /**
    * Initialize default roles in the system.
    * Creates the default roles (ADMIN, USER) if they don't exist in the database.
    * Updates existing roles with new permission types if they're missing.
    */
-  async function initializeRoles() {
+  async function initializeRoles(): Promise<void> {
     const Role = mongoose.models.Role;
 
     for (const roleName of [SystemRoles.ADMIN, SystemRoles.USER]) {
@@ -92,7 +124,10 @@ export function createRoleMethods(mongoose: typeof import('mongoose'), deps: Rol
    * If the role with the given name doesn't exist and the name is a system defined role,
    * create it and return the lean version.
    */
-  async function getRoleByName(roleName: string, fieldsToSelect: string | string[] | null = null) {
+  async function getRoleByName(
+    roleName: string,
+    fieldsToSelect: string | string[] | null = null,
+  ): Promise<IRole> {
     const cache = deps.getCache?.(CacheKeys.ROLES);
     try {
       if (cache) {
@@ -137,7 +172,7 @@ export function createRoleMethods(mongoose: typeof import('mongoose'), deps: Rol
   async function findRolesByNames(
     roleNames: string[],
     fieldsToSelect: string | string[] | null = null,
-  ) {
+  ): Promise<IRole[]> {
     try {
       const uniqueRoleNames = [
         ...new Set(roleNames.map((roleName) => roleName.trim()).filter(Boolean)),
@@ -177,7 +212,7 @@ export function createRoleMethods(mongoose: typeof import('mongoose'), deps: Rol
   /**
    * Update role values by name.
    */
-  async function updateRoleByName(roleName: string, updates: Partial<IRole>) {
+  async function updateRoleByName(roleName: string, updates: Partial<IRole>): Promise<IRole> {
     const cache = deps.getCache?.(CacheKeys.ROLES);
     try {
       const Role = mongoose.models.Role;
@@ -218,7 +253,7 @@ export function createRoleMethods(mongoose: typeof import('mongoose'), deps: Rol
     roleName: string,
     permissionsUpdate: Record<string, Record<string, boolean>>,
     roleData?: IRole,
-  ) {
+  ): Promise<void> {
     const updates: Record<string, Record<string, boolean>> = {};
     for (const [permissionType, permissions] of Object.entries(permissionsUpdate)) {
       if (
diff --git a/packages/data-schemas/src/methods/session.ts b/packages/data-schemas/src/methods/session.ts
index 68c851414a7..391ef9e39fc 100644
--- a/packages/data-schemas/src/methods/session.ts
+++ b/packages/data-schemas/src/methods/session.ts
@@ -13,10 +13,29 @@ export class SessionError extends Error {
 }
 
 /** Default refresh token expiry: 7 days in milliseconds */
-export const DEFAULT_REFRESH_TOKEN_EXPIRY = 1000 * 60 * 60 * 24 * 7;
+export const DEFAULT_REFRESH_TOKEN_EXPIRY: number = 1000 * 60 * 60 * 24 * 7;
 
 // Factory function that takes mongoose instance and returns the methods
-export function createSessionMethods(mongoose: typeof import('mongoose')) {
+export function createSessionMethods(mongoose: typeof import('mongoose')): {
+  findSession: (
+    params: t.SessionSearchParams,
+    options?: t.SessionQueryOptions,
+  ) => Promise<t.ISession | null>;
+  SessionError: typeof SessionError;
+  deleteSession: (params: t.DeleteSessionParams) => Promise<{ deletedCount?: number }>;
+  createSession: (userId: string, options?: t.CreateSessionOptions) => Promise<t.SessionResult>;
+  updateExpiration: (
+    session: t.ISession | string,
+    newExpiration?: Date,
+    options?: t.UpdateExpirationOptions,
+  ) => Promise<t.ISession>;
+  countActiveSessions: (userId: string) => Promise<number>;
+  generateRefreshToken: (session: t.ISession) => Promise<string>;
+  deleteAllUserSessions: (
+    userId: string | { userId: string },
+    options?: t.DeleteAllSessionsOptions,
+  ) => Promise<{ deletedCount?: number }>;
+} {
   /**
    * Creates a new session for a user
    */
diff --git a/packages/data-schemas/src/methods/share.test.ts b/packages/data-schemas/src/methods/share.test.ts
index 60b789c3dd0..d1ffc78c835 100644
--- a/packages/data-schemas/src/methods/share.test.ts
+++ b/packages/data-schemas/src/methods/share.test.ts
@@ -27,7 +27,6 @@ describe('Share Methods', () => {
         messages: [{ type: mongoose.Schema.Types.ObjectId, ref: 'Message' }],
         shareId: { type: String, index: true },
         targetMessageId: { type: String, required: false, index: true },
-        isPublic: { type: Boolean, default: true },
         expiredAt: { type: Date },
       },
       { timestamps: true },
@@ -41,8 +40,18 @@ describe('Share Methods', () => {
         text: String,
         isCreatedByUser: Boolean,
         model: String,
+        iconURL: String,
+        endpoint: String,
+        conversationSignature: String,
+        clientId: String,
+        plugin: mongoose.Schema.Types.Mixed,
+        metadata: mongoose.Schema.Types.Mixed,
+        feedback: mongoose.Schema.Types.Mixed,
+        manualSkills: [String],
+        alwaysAppliedSkills: [String],
         parentMessageId: String,
         attachments: [mongoose.Schema.Types.Mixed],
+        files: [mongoose.Schema.Types.Mixed],
         content: [mongoose.Schema.Types.Mixed],
       },
       { timestamps: true },
@@ -116,6 +125,7 @@ describe('Share Methods', () => {
       const result = await shareMethods.createSharedLink(userId, conversationId);
 
       expect(result).toBeDefined();
+      expect(result._id).toBeDefined();
       expect(result.shareId).toBeDefined();
       expect(result.conversationId).toBe(conversationId);
 
@@ -155,7 +165,7 @@ describe('Share Methods', () => {
       );
     });
 
-    test('should ignore expired public shares when checking for duplicates', async () => {
+    test('should ignore expired shares when checking for duplicates', async () => {
       const userId = new mongoose.Types.ObjectId().toString();
       const conversationId = `conv_${nanoid()}`;
       const expiredShareId = `share_${nanoid()}`;
@@ -179,7 +189,6 @@ describe('Share Methods', () => {
         conversationId,
         user: userId,
         messages: [message._id],
-        isPublic: true,
         expiredAt: new Date(Date.now() - 60 * 60 * 1000),
       });
 
@@ -327,7 +336,6 @@ describe('Share Methods', () => {
         user: userId,
         title: 'Test Share',
         messages: messages.map((m) => m._id),
-        isPublic: true,
       });
 
       const result = await shareMethods.getSharedMessages(shareId);
@@ -342,24 +350,10 @@ describe('Share Methods', () => {
         expect(msg.messageId).toMatch(/^msg_/); // Should be anonymized with msg_ prefix
         expect(msg.messageId).not.toBe(messages[0].messageId); // Should be different from original
         expect(msg.conversationId).toBe(result.conversationId);
-        expect(msg.user).toBeUndefined(); // User should be removed
+        expect((msg as Record<string, unknown>).user).toBeUndefined(); // User should be removed
       });
     });
 
-    test('should return null for non-public share', async () => {
-      const shareId = `share_${nanoid()}`;
-
-      await SharedLink.create({
-        shareId,
-        conversationId: 'conv123',
-        user: 'user123',
-        isPublic: false,
-      });
-
-      const result = await shareMethods.getSharedMessages(shareId);
-      expect(result).toBeNull();
-    });
-
     test('should return null for non-existent share', async () => {
       const result = await shareMethods.getSharedMessages('non_existent_share');
       expect(result).toBeNull();
@@ -372,7 +366,6 @@ describe('Share Methods', () => {
         shareId,
         conversationId: 'conv123',
         user: 'user123',
-        isPublic: true,
         expiredAt: new Date(Date.now() - 60 * 60 * 1000),
       });
 
@@ -405,7 +398,6 @@ describe('Share Methods', () => {
         conversationId,
         user: userId,
         messages: [message._id],
-        isPublic: true,
       });
 
       const result = await shareMethods.getSharedMessages(shareId);
@@ -418,6 +410,106 @@ describe('Share Methods', () => {
         (result?.messages[0].attachments?.[0] as unknown as t.IMessage | undefined)?.conversationId,
       ).toBe(result?.conversationId);
     });
+
+    test('strips storage-internal fields while preserving shared render data', async () => {
+      const userId = new mongoose.Types.ObjectId().toString();
+      const conversationId = `conv_${nanoid()}`;
+      const shareId = `share_${nanoid()}`;
+
+      const message = await Message.create({
+        messageId: `msg_${nanoid()}`,
+        conversationId,
+        user: userId,
+        text: 'safe text',
+        isCreatedByUser: false,
+        model: 'gpt-4',
+        iconURL: 'https://cdn.example.com/icon.png',
+        endpoint: 'openAI',
+        conversationSignature: 'signature',
+        clientId: 'client-id',
+        plugin: { latest: 'internal' },
+        metadata: { codeEnvRef: 'internal-ref' },
+        feedback: { rating: 'thumbsDown', tag: { key: 'inaccurate' }, text: 'private note' },
+        manualSkills: ['research'],
+        alwaysAppliedSkills: ['brand-voice'],
+        files: [
+          {
+            file_id: 'file123',
+            filename: 'upload.png',
+            type: 'image/png',
+            width: 100,
+            height: 100,
+            filepath: '/images/upload.png',
+            conversationId,
+            user: userId,
+            tenantId: 'tenant-a',
+            storageKey: 'private/upload.png',
+            source: 's3',
+          },
+        ],
+        attachments: [
+          {
+            toolCallId: 'call_abc',
+            type: 'web_search',
+            web_search: { results: [{ title: 'Cited source', link: 'https://example.com' }] },
+            filename: 'result.json',
+            filepath: '/images/result.json',
+            storageKey: 'private/result.json',
+            metadata: { codeEnvRef: 'internal-ref' },
+          },
+        ],
+      });
+
+      await SharedLink.create({
+        shareId,
+        conversationId,
+        user: userId,
+        messages: [message._id],
+      });
+
+      const result = await shareMethods.getSharedMessages(shareId);
+      const shared = result?.messages[0];
+
+      expect(shared?.text).toBe('safe text');
+      // Custom message icon is render metadata and should be preserved.
+      expect(shared?.iconURL).toBe('https://cdn.example.com/icon.png');
+      // Non-assistant model and internal message fields must not be disclosed.
+      expect(shared?.model).toBeUndefined();
+      expect(shared).not.toHaveProperty('endpoint');
+      expect(shared).not.toHaveProperty('conversationSignature');
+      expect(shared).not.toHaveProperty('clientId');
+      expect(shared).not.toHaveProperty('plugin');
+      expect(shared).not.toHaveProperty('metadata');
+      // Private owner feedback is not render data and must not leak publicly.
+      expect(shared).not.toHaveProperty('feedback');
+      // Skill badges are non-sensitive UI metadata and should still render.
+      expect(shared?.manualSkills).toEqual(['research']);
+      expect(shared?.alwaysAppliedSkills).toEqual(['brand-voice']);
+
+      // User-uploaded files keep their render URL (filepath/preview) but drop storage internals.
+      const file = shared?.files?.[0];
+      expect(file).toMatchObject({ filename: 'upload.png', type: 'image/png' });
+      expect(file?.filepath).toBe('/images/upload.png');
+      expect(file).not.toHaveProperty('storageKey');
+      expect(file).not.toHaveProperty('user');
+      expect(file).not.toHaveProperty('tenantId');
+      expect(file).not.toHaveProperty('source');
+      // The file's conversation id is rewritten to the anonymized id, not the original.
+      expect(file?.conversationId).toBe(shared?.conversationId);
+      expect(file?.conversationId).not.toBe(conversationId);
+
+      // Tool-call attachments keep their correlation id, payload, and render URL so
+      // citations still render, while storage-only fields are removed.
+      const attachment = shared?.attachments?.[0];
+      expect(attachment).toMatchObject({
+        toolCallId: 'call_abc',
+        type: 'web_search',
+        web_search: { results: [{ title: 'Cited source', link: 'https://example.com' }] },
+        filepath: '/images/result.json',
+      });
+      expect(attachment).not.toHaveProperty('storageKey');
+      expect(attachment).not.toHaveProperty('metadata');
+    });
   });
 
   describe('getSharedLinks', () => {
@@ -431,7 +523,6 @@ describe('Share Methods', () => {
           conversationId: `conv_${i}`,
           user: userId,
           title: `Share ${i}`,
-          isPublic: true,
           createdAt: new Date(Date.now() - i * 1000 * 60), // Different timestamps
         }),
       );
@@ -449,36 +540,6 @@ describe('Share Methods', () => {
       expect(result.links[9].title).toBe('Share 9');
     });
 
-    test('should filter by isPublic parameter', async () => {
-      const userId = new mongoose.Types.ObjectId().toString();
-
-      await SharedLink.create([
-        {
-          shareId: 'public_share',
-          conversationId: 'conv1',
-          user: userId,
-          title: 'Public Share',
-          isPublic: true,
-        },
-        {
-          shareId: 'private_share',
-          conversationId: 'conv2',
-          user: userId,
-          title: 'Private Share',
-          isPublic: false,
-        },
-      ]);
-
-      const publicResults = await shareMethods.getSharedLinks(userId, undefined, 10, true);
-      const privateResults = await shareMethods.getSharedLinks(userId, undefined, 10, false);
-
-      expect(publicResults.links).toHaveLength(1);
-      expect(publicResults.links[0].title).toBe('Public Share');
-
-      expect(privateResults.links).toHaveLength(1);
-      expect(privateResults.links[0].title).toBe('Private Share');
-    });
-
     test('should exclude expired shares', async () => {
       const userId = new mongoose.Types.ObjectId().toString();
 
@@ -488,7 +549,6 @@ describe('Share Methods', () => {
           conversationId: 'conv1',
           user: userId,
           title: 'Active Share',
-          isPublic: true,
           expiredAt: new Date(Date.now() + 60 * 60 * 1000),
         },
         {
@@ -496,12 +556,11 @@ describe('Share Methods', () => {
           conversationId: 'conv2',
           user: userId,
           title: 'Expired Share',
-          isPublic: true,
           expiredAt: new Date(Date.now() - 60 * 60 * 1000),
         },
       ]);
 
-      const result = await shareMethods.getSharedLinks(userId, undefined, 10, true);
+      const result = await shareMethods.getSharedLinks(userId, undefined, 10);
 
       expect(result.links).toHaveLength(1);
       expect(result.links[0].shareId).toBe('active_share');
@@ -522,14 +581,12 @@ describe('Share Methods', () => {
           conversationId: 'conv1',
           user: userId,
           title: 'Matching Share',
-          isPublic: true,
         },
         {
           shareId: 'share2',
           conversationId: 'conv2',
           user: userId,
           title: 'Non-matching Share',
-          isPublic: true,
         },
       ]);
 
@@ -537,7 +594,6 @@ describe('Share Methods', () => {
         userId,
         undefined,
         10,
-        true,
         'createdAt',
         'desc',
         'search term',
@@ -592,21 +648,18 @@ describe('Share Methods', () => {
           conversationId: 'conv1',
           user: userId1,
           title: 'User 1 Share',
-          isPublic: true,
         },
         {
           shareId: 'share2',
           conversationId: 'conv2',
           user: userId2,
           title: 'User 2 Share',
-          isPublic: true,
         },
         {
           shareId: 'share3',
           conversationId: 'conv3',
           user: userId1,
           title: 'Another User 1 Share',
-          isPublic: true,
         },
       ]);
 
@@ -615,7 +668,6 @@ describe('Share Methods', () => {
         userId1,
         undefined,
         10,
-        true,
         'createdAt',
         'desc',
         'search term',
@@ -635,7 +687,6 @@ describe('Share Methods', () => {
         userId2,
         undefined,
         10,
-        true,
         'createdAt',
         'desc',
         'search term',
@@ -662,21 +713,18 @@ describe('Share Methods', () => {
           conversationId: 'conv1',
           user: userId1,
           title: 'User 1 Share',
-          isPublic: true,
         },
         {
           shareId: 'share2',
           conversationId: 'conv2',
           user: userId2,
           title: 'User 2 Share',
-          isPublic: true,
         },
         {
           shareId: 'share3',
           conversationId: 'conv3',
           user: userId1,
           title: 'Another User 1 Share',
-          isPublic: true,
         },
       ]);
 
@@ -714,7 +762,6 @@ describe('Share Methods', () => {
         conversationId,
         user: userId,
         messages: initialMessages.map((m) => m._id),
-        isPublic: true,
       });
 
       // Add new message
@@ -728,6 +775,7 @@ describe('Share Methods', () => {
 
       const result = await shareMethods.updateSharedLink(userId, oldShareId);
 
+      expect(result._id).toBeDefined();
       expect(result.shareId).not.toBe(oldShareId); // Should generate new shareId
       expect(result.conversationId).toBe(conversationId);
 
@@ -749,7 +797,6 @@ describe('Share Methods', () => {
         conversationId,
         user: userId,
         messages: [],
-        isPublic: true,
         expiredAt: expiresAt,
       });
       await Message.create({
@@ -777,7 +824,6 @@ describe('Share Methods', () => {
         conversationId,
         user: userId,
         messages: [],
-        isPublic: true,
         expiredAt: expiresAt,
       });
       await Message.create({
@@ -818,7 +864,6 @@ describe('Share Methods', () => {
         conversationId,
         user: userId,
         messages: [],
-        isPublic: true,
       });
 
       // Add messages from different users
@@ -890,7 +935,6 @@ describe('Share Methods', () => {
         user: userId,
         messages: initialMessages.map((message) => message._id),
         targetMessageId: oldAnswerId,
-        isPublic: true,
       });
 
       await Message.create([
@@ -942,7 +986,6 @@ describe('Share Methods', () => {
         user: userId,
         messages: [],
         targetMessageId,
-        isPublic: true,
       });
 
       const result = await shareMethods.updateSharedLink(userId, shareId);
@@ -964,7 +1007,6 @@ describe('Share Methods', () => {
         conversationId,
         user: ownerUserId,
         messages: [],
-        isPublic: true,
       });
 
       // Try to update as a different user
@@ -988,7 +1030,6 @@ describe('Share Methods', () => {
         shareId,
         conversationId: 'conv123',
         user: userId,
-        isPublic: true,
       });
 
       const result = await shareMethods.deleteSharedLink(userId, shareId);
@@ -1016,7 +1057,6 @@ describe('Share Methods', () => {
         shareId,
         conversationId: 'conv123',
         user: userId1,
-        isPublic: true,
       });
 
       const result = await shareMethods.deleteSharedLink(userId2, shareId);
@@ -1048,11 +1088,11 @@ describe('Share Methods', () => {
         shareId,
         conversationId,
         user: userId,
-        isPublic: true,
       });
 
       const result = await shareMethods.getSharedLink(userId, conversationId);
 
+      expect(result._id).toBeDefined();
       expect(result.success).toBe(true);
       expect(result.shareId).toBe(shareId);
     });
@@ -1072,7 +1112,6 @@ describe('Share Methods', () => {
         shareId: 'share123',
         conversationId,
         user: userId,
-        isPublic: true,
         expiredAt: new Date(Date.now() - 60 * 60 * 1000),
       });
 
@@ -1091,7 +1130,6 @@ describe('Share Methods', () => {
         shareId: 'share123',
         conversationId,
         user: userId1,
-        isPublic: true,
       });
 
       const result = await shareMethods.getSharedLink(userId2, conversationId);
@@ -1109,25 +1147,6 @@ describe('Share Methods', () => {
         'Missing required parameters',
       );
     });
-
-    test('should only return public shares', async () => {
-      const userId = new mongoose.Types.ObjectId().toString();
-      const conversationId = `conv_${nanoid()}`;
-      const shareId = `share_${nanoid()}`;
-
-      // Create a non-public share
-      await SharedLink.create({
-        shareId,
-        conversationId,
-        user: userId,
-        isPublic: false,
-      });
-
-      const result = await shareMethods.getSharedLink(userId, conversationId);
-
-      expect(result.success).toBe(false);
-      expect(result.shareId).toBeNull();
-    });
   });
 
   describe('deleteAllSharedLinks', () => {
@@ -1167,11 +1186,11 @@ describe('Share Methods', () => {
 
       // Create multiple shares for different users
       await SharedLink.create([
-        { shareId: 'share1', conversationId: 'conv1', user: userId1, isPublic: true },
-        { shareId: 'share2', conversationId: 'conv2', user: userId1, isPublic: false },
-        { shareId: 'share3', conversationId: 'conv3', user: userId2, isPublic: true },
-        { shareId: 'share4', conversationId: 'conv4', user: userId2, isPublic: true },
-        { shareId: 'share5', conversationId: 'conv5', user: userId3, isPublic: true },
+        { shareId: 'share1', conversationId: 'conv1', user: userId1 },
+        { shareId: 'share2', conversationId: 'conv2', user: userId1 },
+        { shareId: 'share3', conversationId: 'conv3', user: userId2 },
+        { shareId: 'share4', conversationId: 'conv4', user: userId2 },
+        { shareId: 'share5', conversationId: 'conv5', user: userId3 },
       ]);
 
       // Delete all shares for userId1
@@ -1199,9 +1218,9 @@ describe('Share Methods', () => {
       const conversationId2 = 'conv-to-keep';
 
       await SharedLink.create([
-        { shareId: 'share1', conversationId: conversationId1, user: userId, isPublic: true },
-        { shareId: 'share2', conversationId: conversationId1, user: userId, isPublic: false },
-        { shareId: 'share3', conversationId: conversationId2, user: userId, isPublic: true },
+        { shareId: 'share1', conversationId: conversationId1, user: userId },
+        { shareId: 'share2', conversationId: conversationId1, user: userId },
+        { shareId: 'share3', conversationId: conversationId2, user: userId },
       ]);
 
       const result = await shareMethods.deleteConvoSharedLink(userId, conversationId1);
@@ -1220,9 +1239,9 @@ describe('Share Methods', () => {
       const conversationId = 'shared-conv';
 
       await SharedLink.create([
-        { shareId: 'share1', conversationId, user: userId1, isPublic: true },
-        { shareId: 'share2', conversationId, user: userId2, isPublic: true },
-        { shareId: 'share3', conversationId: 'other-conv', user: userId1, isPublic: true },
+        { shareId: 'share1', conversationId, user: userId1 },
+        { shareId: 'share2', conversationId, user: userId2 },
+        { shareId: 'share3', conversationId: 'other-conv', user: userId1 },
       ]);
 
       const result = await shareMethods.deleteConvoSharedLink(userId1, conversationId);
@@ -1266,22 +1285,20 @@ describe('Share Methods', () => {
       const conversationId = 'conv-with-many-shares';
 
       await SharedLink.create([
-        { shareId: 'share1', conversationId, user: userId, isPublic: true },
+        { shareId: 'share1', conversationId, user: userId },
         {
           shareId: 'share2',
           conversationId,
           user: userId,
-          isPublic: true,
           targetMessageId: 'msg1',
         },
         {
           shareId: 'share3',
           conversationId,
           user: userId,
-          isPublic: true,
           targetMessageId: 'msg2',
         },
-        { shareId: 'share4', conversationId, user: userId, isPublic: false },
+        { shareId: 'share4', conversationId, user: userId },
       ]);
 
       const result = await shareMethods.deleteConvoSharedLink(userId, conversationId);
@@ -1338,7 +1355,6 @@ describe('Share Methods', () => {
         conversationId,
         user: userId,
         messages: [message._id],
-        isPublic: true,
       });
 
       const result = await shareMethods.getSharedMessages(shareId);
@@ -1449,7 +1465,6 @@ describe('Share Methods', () => {
         conversationId,
         user: userId,
         messages: messages.map((m) => m._id),
-        isPublic: true,
       });
 
       const result = await shareMethods.getSharedMessages(shareId);
@@ -1485,7 +1500,6 @@ describe('Share Methods', () => {
         conversationId,
         user: userId,
         messages: [message._id],
-        isPublic: true,
       });
 
       const result = await shareMethods.getSharedMessages(shareId);
diff --git a/packages/data-schemas/src/methods/share.ts b/packages/data-schemas/src/methods/share.ts
index 0551b349c45..88a328644b5 100644
--- a/packages/data-schemas/src/methods/share.ts
+++ b/packages/data-schemas/src/methods/share.ts
@@ -3,8 +3,8 @@ import { Constants } from 'librechat-data-provider';
 import type { FilterQuery, Model } from 'mongoose';
 import type { SchemaWithMeiliMethods } from '~/models/plugins/mongoMeili';
 import type * as t from '~/types';
-import logger from '~/config/winston';
 import { activeExpirationFilter } from '~/utils/retention';
+import logger from '~/config/winston';
 
 class ShareServiceError extends Error {
   code: string;
@@ -42,7 +42,82 @@ function anonymizeConvo(conversation: Partial<t.IConversation> & Partial<t.IShar
   return newConvo;
 }
 
-function anonymizeMessages(messages: t.IMessage[], newConvoId: string): t.IMessage[] {
+/**
+ * Storage- and identity-internal fields that must never be exposed through a
+ * public shared link. Everything else on a file/attachment — including the
+ * `filepath`/`preview` render URLs, dimensions, and tool-call payloads such as
+ * `toolCallId` and search results — is render data the shared view needs, so it
+ * is preserved. (`storageKey` is the raw object key and is dropped; `filepath`
+ * is the URL the share renderer actually loads, so it is kept.)
+ */
+const SENSITIVE_SHARED_FILE_FIELDS = new Set([
+  '_id',
+  '__v',
+  'user',
+  'tenantId',
+  'storageRegion',
+  'storageKey',
+  'temp_file_id',
+  'message',
+  'source',
+  'filterSource',
+  'context',
+  'embedded',
+  'usage',
+  'metadata',
+]);
+
+/**
+ * Strip storage/identity-internal fields from a file or attachment while keeping
+ * render-relevant data (including tool-call payloads keyed by tool name).
+ */
+function sanitizeSharedFile(value: unknown): t.SharedFile | null {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    return null;
+  }
+
+  const result: t.SharedFile = {};
+  for (const [key, fieldValue] of Object.entries(value as Record<string, unknown>)) {
+    if (!SENSITIVE_SHARED_FILE_FIELDS.has(key)) {
+      result[key] = fieldValue;
+    }
+  }
+
+  return Object.keys(result).length > 0 ? result : null;
+}
+
+function sanitizeSharedFiles(files: unknown): t.SharedFile[] | undefined {
+  if (!Array.isArray(files)) {
+    return undefined;
+  }
+
+  const sanitized = files
+    .map(sanitizeSharedFile)
+    .filter((file): file is t.SharedFile => file != null);
+
+  return sanitized.length > 0 ? sanitized : undefined;
+}
+
+/**
+ * Only surface a model name when it is an (already-anonymized) assistant id;
+ * otherwise omit it so the underlying provider/model is not disclosed.
+ */
+function anonymizeSharedModel(model?: string): string | undefined {
+  if (!model?.startsWith('asst_')) {
+    return undefined;
+  }
+  return anonymizeAssistantId(model);
+}
+
+/**
+ * Build the public, anonymized view of shared messages. An allowlist of
+ * render-relevant fields keeps internal message fields (endpoint,
+ * conversationSignature, clientId, plugin(s), metadata, etc.) out of the
+ * payload, while user files and tool-call attachments are sanitized field by
+ * field so render data (uploaded files, `toolCallId`, search results, generated
+ * outputs) is preserved without leaking storage internals.
+ */
+function anonymizeMessages(messages: t.IMessage[], newConvoId: string): t.SharedMessage[] {
   if (!Array.isArray(messages)) {
     return [];
   }
@@ -52,34 +127,43 @@ function anonymizeMessages(messages: t.IMessage[], newConvoId: string): t.IMessa
     const newMessageId = anonymizeMessageId(message.messageId);
     idMap.set(message.messageId, newMessageId);
 
-    type MessageAttachment = {
-      messageId?: string;
-      conversationId?: string;
-      [key: string]: unknown;
-    };
-
-    const anonymizedAttachments = (message.attachments as MessageAttachment[])?.map(
-      (attachment) => {
-        return {
-          ...attachment,
-          messageId: newMessageId,
-          conversationId: newConvoId,
-        };
-      },
-    );
+    const attachments = sanitizeSharedFiles(message.attachments)?.map((attachment) => ({
+      ...attachment,
+      messageId: newMessageId,
+      conversationId: newConvoId,
+    }));
+    // Persisted file records can carry the original conversation/message ids;
+    // rewrite them to the anonymized ids so shared files don't expose them.
+    const files = sanitizeSharedFiles(message.files)?.map((file) => ({
+      ...file,
+      ...(file.conversationId !== undefined && { conversationId: newConvoId }),
+      ...(file.messageId !== undefined && { messageId: newMessageId }),
+    }));
+    const model = anonymizeSharedModel(message.model);
 
     return {
-      ...message,
       messageId: newMessageId,
       parentMessageId:
         idMap.get(message.parentMessageId || '') ||
         anonymizeMessageId(message.parentMessageId || ''),
       conversationId: newConvoId,
-      model: message.model?.startsWith('asst_')
-        ? anonymizeAssistantId(message.model)
-        : message.model,
-      attachments: anonymizedAttachments,
-    } as t.IMessage;
+      sender: message.sender,
+      text: message.text,
+      content: message.content,
+      ...(message.iconURL && { iconURL: message.iconURL }),
+      ...(model && { model }),
+      isCreatedByUser: message.isCreatedByUser,
+      createdAt: message.createdAt,
+      updatedAt: message.updatedAt,
+      tokenCount: message.tokenCount,
+      unfinished: message.unfinished,
+      error: message.error,
+      finish_reason: message.finish_reason,
+      ...(message.manualSkills && { manualSkills: message.manualSkills }),
+      ...(message.alwaysAppliedSkills && { alwaysAppliedSkills: message.alwaysAppliedSkills }),
+      ...(files && { files }),
+      ...(attachments && { attachments }),
+    };
   });
 }
 
@@ -155,18 +239,55 @@ function getMessagesUpToTarget(messages: t.IMessage[], targetMessageId: string):
 }
 
 /** Factory function that takes mongoose instance and returns the methods */
-export function createShareMethods(mongoose: typeof import('mongoose')) {
+export function createShareMethods(mongoose: typeof import('mongoose')): {
+  getSharedLink: (user: string, conversationId: string) => Promise<t.GetShareLinkResult>;
+  getSharedLinks: (
+    user: string,
+    pageParam?: Date,
+    pageSize?: number,
+    sortBy?: string,
+    sortDirection?: string,
+    search?: string,
+  ) => Promise<t.SharedLinksResult>;
+  createSharedLink: (
+    user: string,
+    conversationId: string,
+    targetMessageId?: string,
+    expiredAt?: Date,
+  ) => Promise<t.CreateShareResult>;
+  updateSharedLink: (
+    user: string,
+    shareId: string,
+    targetMessageId?: string,
+    expiredAt?: Date | null,
+  ) => Promise<t.UpdateShareResult>;
+  deleteSharedLink: (user: string, shareId: string) => Promise<t.DeleteShareResult | null>;
+  getSharedMessages: (
+    shareId: string,
+    shareObjectId?: string,
+  ) => Promise<t.SharedMessagesResult | null>;
+  deleteAllSharedLinks: (
+    user: string,
+  ) => Promise<t.DeleteAllSharesResult & { deletedIds: string[] }>;
+  deleteConvoSharedLink: (
+    user: string,
+    conversationId: string,
+  ) => Promise<t.DeleteAllSharesResult & { deletedIds: string[] }>;
+} {
   /**
-   * Get shared messages for a public share link
+   * Get shared messages for a share link
    */
-  async function getSharedMessages(shareId: string): Promise<t.SharedMessagesResult | null> {
+  async function getSharedMessages(
+    shareId: string,
+    shareObjectId?: string,
+  ): Promise<t.SharedMessagesResult | null> {
     try {
       const SharedLink = mongoose.models.SharedLink as Model<t.ISharedLink>;
-      const share = (await SharedLink.findOne({
-        shareId,
-        isPublic: true,
-        ...activeExpirationFilter<t.ISharedLink>(),
-      })
+      const query = shareObjectId
+        ? SharedLink.findOne({ _id: shareObjectId, ...activeExpirationFilter<t.ISharedLink>() })
+        : SharedLink.findOne({ shareId, ...activeExpirationFilter<t.ISharedLink>() });
+
+      const share = (await query
         .populate({
           path: 'messages',
           select: '-_id -__v -user',
@@ -174,7 +295,7 @@ export function createShareMethods(mongoose: typeof import('mongoose')) {
         .select('-_id -__v -user')
         .lean()) as (t.ISharedLink & { messages: t.IMessage[] }) | null;
 
-      if (!share?.conversationId || !share.isPublic) {
+      if (!share?.conversationId) {
         return null;
       }
 
@@ -188,7 +309,6 @@ export function createShareMethods(mongoose: typeof import('mongoose')) {
       const result: t.SharedMessagesResult = {
         shareId: share.shareId || shareId,
         title: share.title,
-        isPublic: share.isPublic,
         createdAt: share.createdAt,
         updatedAt: share.updatedAt,
         conversationId: newConvoId,
@@ -212,7 +332,6 @@ export function createShareMethods(mongoose: typeof import('mongoose')) {
     user: string,
     pageParam?: Date,
     pageSize: number = 10,
-    isPublic: boolean = true,
     sortBy: string = 'createdAt',
     sortDirection: string = 'desc',
     search?: string,
@@ -222,7 +341,6 @@ export function createShareMethods(mongoose: typeof import('mongoose')) {
       const Conversation = mongoose.models.Conversation as SchemaWithMeiliMethods;
       const query: FilterQuery<t.ISharedLink> = {
         user,
-        isPublic,
         ...activeExpirationFilter<t.ISharedLink>(),
       };
 
@@ -283,7 +401,6 @@ export function createShareMethods(mongoose: typeof import('mongoose')) {
         links: links.map((link) => ({
           shareId: link.shareId || '',
           title: link?.title || 'Untitled',
-          isPublic: link.isPublic,
           createdAt: link.createdAt || new Date(),
           conversationId: link.conversationId,
         })),
@@ -302,13 +419,18 @@ export function createShareMethods(mongoose: typeof import('mongoose')) {
   /**
    * Delete all shared links for a user
    */
-  async function deleteAllSharedLinks(user: string): Promise<t.DeleteAllSharesResult> {
+  async function deleteAllSharedLinks(
+    user: string,
+  ): Promise<t.DeleteAllSharesResult & { deletedIds: string[] }> {
     try {
       const SharedLink = mongoose.models.SharedLink as Model<t.ISharedLink>;
+      const links = await SharedLink.find({ user }).select('_id').lean();
+      const ids = links.map((l) => l._id.toString());
       const result = await SharedLink.deleteMany({ user });
       return {
         message: 'All shared links deleted successfully',
         deletedCount: result.deletedCount,
+        deletedIds: ids,
       };
     } catch (error) {
       logger.error('[deleteAllSharedLinks] Error deleting shared links', {
@@ -325,17 +447,20 @@ export function createShareMethods(mongoose: typeof import('mongoose')) {
   async function deleteConvoSharedLink(
     user: string,
     conversationId: string,
-  ): Promise<t.DeleteAllSharesResult> {
+  ): Promise<t.DeleteAllSharesResult & { deletedIds: string[] }> {
     if (!user || !conversationId) {
       throw new ShareServiceError('Missing required parameters', 'INVALID_PARAMS');
     }
 
     try {
       const SharedLink = mongoose.models.SharedLink as Model<t.ISharedLink>;
+      const links = await SharedLink.find({ user, conversationId }).select('_id').lean();
+      const ids = links.map((l) => l._id.toString());
       const result = await SharedLink.deleteMany({ user, conversationId });
       return {
         message: 'Shared links deleted successfully',
         deletedCount: result.deletedCount,
+        deletedIds: ids,
       };
     } catch (error) {
       logger.error('[deleteConvoSharedLink] Error deleting shared links', {
@@ -368,7 +493,6 @@ export function createShareMethods(mongoose: typeof import('mongoose')) {
         SharedLink.findOne({
           conversationId,
           user,
-          isPublic: true,
           ...activeExpirationFilter<t.ISharedLink>(),
           ...(targetMessageId && { targetMessageId }),
         })
@@ -377,19 +501,13 @@ export function createShareMethods(mongoose: typeof import('mongoose')) {
         Message.find({ conversationId, user }).sort({ createdAt: 1 }).lean(),
       ]);
 
-      if (existingShare && existingShare.isPublic) {
+      if (existingShare) {
         logger.error('[createSharedLink] Share already exists', {
           user,
           conversationId,
           targetMessageId,
         });
         throw new ShareServiceError('Share already exists', 'SHARE_EXISTS');
-      } else if (existingShare) {
-        await SharedLink.deleteOne({
-          conversationId,
-          user,
-          ...(targetMessageId && { targetMessageId }),
-        });
       }
 
       const conversation = (await Conversation.findOne({ conversationId, user }).lean()) as {
@@ -412,7 +530,7 @@ export function createShareMethods(mongoose: typeof import('mongoose')) {
       const title = conversation.title || 'Untitled';
 
       const shareId = nanoid();
-      await SharedLink.create({
+      const created = await SharedLink.create({
         shareId,
         conversationId,
         messages: conversationMessages,
@@ -422,7 +540,7 @@ export function createShareMethods(mongoose: typeof import('mongoose')) {
         ...(expiredAt && { expiredAt }),
       });
 
-      return { shareId, conversationId, targetMessageId };
+      return { _id: created._id.toString(), shareId, conversationId, targetMessageId };
     } catch (error) {
       if (error instanceof ShareServiceError) {
         throw error;
@@ -453,18 +571,22 @@ export function createShareMethods(mongoose: typeof import('mongoose')) {
       const share = (await SharedLink.findOne({
         conversationId,
         user,
-        isPublic: true,
         ...activeExpirationFilter<t.ISharedLink>(),
       })
-        .select('shareId targetMessageId -_id')
+        .select('shareId targetMessageId _id')
         .sort({ updatedAt: -1 })
-        .lean()) as { shareId?: string; targetMessageId?: string } | null;
+        .lean()) as {
+        shareId?: string;
+        targetMessageId?: string;
+        _id?: import('mongoose').Types.ObjectId;
+      } | null;
 
       if (!share) {
         return { shareId: null, success: false };
       }
 
       return {
+        _id: share._id?.toString(),
         shareId: share.shareId || null,
         targetMessageId: share.targetMessageId,
         success: true,
@@ -534,6 +656,7 @@ export function createShareMethods(mongoose: typeof import('mongoose')) {
       anonymizeConvo(updatedShare);
 
       return {
+        _id: updatedShare._id?.toString(),
         shareId: newShareId,
         conversationId: updatedShare.conversationId,
         targetMessageId: updatedShare.targetMessageId,
@@ -571,6 +694,7 @@ export function createShareMethods(mongoose: typeof import('mongoose')) {
       }
 
       return {
+        _id: result._id?.toString(),
         success: true,
         shareId,
         message: 'Share deleted successfully',
diff --git a/packages/data-schemas/src/methods/skill.spec.ts b/packages/data-schemas/src/methods/skill.spec.ts
index 85ecf41bf81..dab78260a1d 100644
--- a/packages/data-schemas/src/methods/skill.spec.ts
+++ b/packages/data-schemas/src/methods/skill.spec.ts
@@ -1,4 +1,5 @@
 import mongoose from 'mongoose';
+import { logger, createModels } from '..';
 import { MongoMemoryServer } from 'mongodb-memory-server';
 import {
   SystemRoles,
@@ -7,7 +8,6 @@ import {
   PrincipalType,
   PermissionBits,
 } from 'librechat-data-provider';
-import { createAclEntryMethods } from './aclEntry';
 import {
   validateSkillName,
   validateSkillDescription,
@@ -15,9 +15,10 @@ import {
   validateAlwaysApply,
   validateRelativePath,
   inferSkillFileCategory,
+  filterExistingSkillIds,
   deriveStructuredFrontmatterFields,
 } from './skill';
-import { logger, createModels } from '..';
+import { createAclEntryMethods } from './aclEntry';
 import { createMethods } from './index';
 
 logger.silent = true;
@@ -107,8 +108,22 @@ afterEach(async () => {
   await Skill.deleteMany({});
   await SkillFile.deleteMany({});
   await AclEntry.deleteMany({});
+  await mongoose.models.Agent.deleteMany({});
 });
 
+function makeAgentDoc(skillIds: string[], overrides: Record<string, unknown> = {}) {
+  return {
+    id: `agent_${new mongoose.Types.ObjectId().toString()}`,
+    name: 'Allowlist Agent',
+    provider: 'openai',
+    model: 'gpt-4',
+    author: owner._id,
+    skills: skillIds,
+    skills_enabled: true,
+    ...overrides,
+  };
+}
+
 async function grantOwner(resourceId: mongoose.Types.ObjectId | string) {
   const role = (await AccessRole.findOne({ accessRoleId: AccessRoleIds.SKILL_OWNER }).lean()) as {
     _id: mongoose.Types.ObjectId;
@@ -139,6 +154,23 @@ function makeSkillInput(overrides: Record<string, unknown> = {}) {
   };
 }
 
+describe('Skill schema indexes', () => {
+  it('supports GitHub sync source metadata lookups', () => {
+    const indexSpecs = Skill.schema.indexes().map(([fields]) => fields);
+
+    expect(indexSpecs).toContainEqual({
+      source: 1,
+      'sourceMetadata.upstreamId': 1,
+      tenantId: 1,
+    });
+    expect(indexSpecs).toContainEqual({
+      source: 1,
+      'sourceMetadata.sourceId': 1,
+      tenantId: 1,
+    });
+  });
+});
+
 describe('skill validation helpers', () => {
   it('rejects names starting with reserved brand prefixes', () => {
     expect(validateSkillName('anthropic-helper').some((i) => i.code === 'RESERVED_PREFIX')).toBe(
@@ -253,7 +285,9 @@ describe('skill validation helpers', () => {
           'user-invocable': true,
           effort: 5,
           version: '1.0.0',
+          license: 'MIT',
           hooks: { 'pre-run': 'echo hi' },
+          metadata: { owner: 'data-team' },
         }),
       ).toEqual([]);
     });
@@ -281,6 +315,8 @@ describe('skill validation helpers', () => {
     it('accepts always-apply as a boolean', () => {
       expect(validateSkillFrontmatter({ 'always-apply': true })).toEqual([]);
       expect(validateSkillFrontmatter({ 'always-apply': false })).toEqual([]);
+      expect(validateSkillFrontmatter({ alwaysApply: true })).toEqual([]);
+      expect(validateSkillFrontmatter({ alwaysApply: false })).toEqual([]);
     });
 
     it('rejects always-apply with non-boolean values', () => {
@@ -292,6 +328,11 @@ describe('skill validation helpers', () => {
       expect(
         validateSkillFrontmatter({ 'always-apply': 1 }).some((i) => i.code === 'INVALID_TYPE'),
       ).toBe(true);
+      expect(
+        validateSkillFrontmatter({ alwaysApply: 'yes' }).some(
+          (i) => i.code === 'INVALID_TYPE' && i.field === 'frontmatter.alwaysApply',
+        ),
+      ).toBe(true);
     });
   });
 
@@ -507,6 +548,121 @@ describe('Skill CRUD methods', () => {
     expect(await SkillFile.countDocuments({ skillId: skill._id })).toBe(0);
   });
 
+  it('filterExistingSkillIds matches uppercase-hex candidates and returns canonical ids', async () => {
+    const { skill } = await methods.createSkill(makeSkillInput({ name: 'case-skill' }));
+    const canonical = skill._id.toString();
+
+    const filtered = await filterExistingSkillIds(mongoose, [canonical.toUpperCase()]);
+    expect(filtered).toEqual([canonical]);
+  });
+
+  it('deleteSkill prunes agent allowlists even when skill file cleanup fails', async () => {
+    const { skill } = await methods.createSkill(makeSkillInput({ name: 'flaky-files' }));
+    const Agent = mongoose.models.Agent;
+    const agent = await Agent.create(makeAgentDoc([skill._id.toString()]));
+
+    const deleteManySpy = jest
+      .spyOn(SkillFile, 'deleteMany')
+      .mockRejectedValueOnce(new Error('transient storage failure'));
+    try {
+      await expect(methods.deleteSkill(skill._id.toString())).rejects.toThrow(
+        'transient storage failure',
+      );
+    } finally {
+      deleteManySpy.mockRestore();
+    }
+
+    const agentAfter = (await Agent.findById(agent._id).lean()) as {
+      skills?: string[];
+      skills_enabled?: boolean;
+    } | null;
+    expect(agentAfter?.skills).toEqual([]);
+    expect(agentAfter?.skills_enabled).toBe(false);
+  });
+
+  it('deleteSkill disables skills when the deleted id was the entire allowlist', async () => {
+    const { skill } = await methods.createSkill(makeSkillInput({ name: 'only-skill' }));
+    const Agent = mongoose.models.Agent;
+    const agent = await Agent.create(makeAgentDoc([skill._id.toString()]));
+
+    const res = await methods.deleteSkill(skill._id.toString().toUpperCase());
+    expect(res.deleted).toBe(true);
+
+    const agentAfter = (await Agent.findById(agent._id).lean()) as {
+      skills?: string[];
+      skills_enabled?: boolean;
+    } | null;
+    expect(agentAfter?.skills).toEqual([]);
+    expect(agentAfter?.skills_enabled).toBe(false);
+  });
+
+  it('deleteSkill prunes the deleted id from agent skill allowlists', async () => {
+    const { skill: doomed } = await methods.createSkill(makeSkillInput({ name: 'doomed-skill' }));
+    const { skill: kept } = await methods.createSkill(makeSkillInput({ name: 'kept-skill' }));
+    const Agent = mongoose.models.Agent;
+    const scoped = await Agent.create(makeAgentDoc([doomed._id.toString(), kept._id.toString()]));
+    const untouched = await Agent.create(
+      makeAgentDoc([kept._id.toString()], { name: 'Untouched Agent' }),
+    );
+
+    const res = await methods.deleteSkill(doomed._id.toString());
+    expect(res.deleted).toBe(true);
+
+    const scopedAfter = (await Agent.findById(scoped._id).lean()) as {
+      skills?: string[];
+      skills_enabled?: boolean;
+    } | null;
+    expect(scopedAfter?.skills).toEqual([kept._id.toString()]);
+    expect(scopedAfter?.skills_enabled).toBe(true);
+
+    const untouchedAfter = (await Agent.findById(untouched._id).lean()) as {
+      skills?: string[];
+    } | null;
+    expect(untouchedAfter?.skills).toEqual([kept._id.toString()]);
+  });
+
+  it('findSkillBySourceIdentity searches only the requested tenant bucket', async () => {
+    const upstreamId = 'librechat-skills:skills/research';
+    const sourceMetadata = {
+      provider: 'github',
+      sourceId: 'librechat-skills',
+      upstreamId,
+    };
+    const author = new mongoose.Types.ObjectId();
+    const tenantSkill = await Skill.create({
+      name: 'research',
+      description: 'A tenant-scoped GitHub skill mirror.',
+      body: 'tenant body',
+      author,
+      authorName: 'GitHub Sync',
+      tenantId: 'tenant-a',
+      source: 'github',
+      sourceMetadata,
+    });
+    const ambientSkill = await Skill.create({
+      name: 'research',
+      description: 'An ambient GitHub skill mirror.',
+      body: 'ambient body',
+      author,
+      authorName: 'GitHub Sync',
+      source: 'github',
+      sourceMetadata,
+    });
+
+    const ambientResult = await methods.findSkillBySourceIdentity({
+      source: 'github',
+      upstreamId,
+    });
+    const tenantResult = await methods.findSkillBySourceIdentity({
+      source: 'github',
+      upstreamId,
+      tenantId: 'tenant-a',
+    });
+
+    expect(ambientResult?._id.toString()).toBe(ambientSkill._id.toString());
+    expect(tenantResult?._id.toString()).toBe(tenantSkill._id.toString());
+  });
+
   it('listSkillsByAccess returns only accessible skills and paginates by cursor', async () => {
     const ids: mongoose.Types.ObjectId[] = [];
     for (let i = 0; i < 3; i++) {
@@ -645,6 +801,55 @@ describe('Skill CRUD methods', () => {
     expect(fetched?.allowedTools).toEqual(['execute_code']);
   });
 
+  it('getAuthorSkillByName resolves only the matching author and tenant', async () => {
+    const sharedName = 'author-owned-lookup';
+    const ownerSkill = await Skill.create({
+      name: sharedName,
+      description: 'Owner tenant skill.',
+      body: 'owner body',
+      frontmatter: {},
+      author: owner._id,
+      authorName: owner.name ?? 'Skill Owner',
+      tenantId: 'tenant-a',
+      version: 1,
+      source: 'inline',
+      fileCount: 0,
+    });
+    await Skill.create({
+      name: sharedName,
+      description: 'Other author skill.',
+      body: 'other body',
+      frontmatter: {},
+      author: other._id,
+      authorName: other.name ?? 'Other',
+      tenantId: 'tenant-a',
+      version: 1,
+      source: 'inline',
+      fileCount: 0,
+    });
+    await Skill.create({
+      name: sharedName,
+      description: 'Owner different tenant skill.',
+      body: 'tenant b body',
+      frontmatter: {},
+      author: owner._id,
+      authorName: owner.name ?? 'Skill Owner',
+      tenantId: 'tenant-b',
+      version: 1,
+      source: 'inline',
+      fileCount: 0,
+    });
+
+    const fetched = await methods.getAuthorSkillByName({
+      name: sharedName,
+      author: owner._id,
+      tenantId: 'tenant-a',
+    });
+
+    expect(fetched?._id.toString()).toBe(ownerSkill._id.toString());
+    expect(fetched?.body).toBe('owner body');
+  });
+
   it('preferModelInvocable picks the model-invocable doc on same-name collision (does NOT filter on userInvocable)', async () => {
     /* Same-name collision scenario the model paths must handle: an older
        user-invocable variant and a newer model-only variant
@@ -1025,6 +1230,35 @@ describe('Skill CRUD methods', () => {
     expect(skill.alwaysApply).toBe(true);
   });
 
+  it('createSkill derives alwaysApply from the camel-case frontmatter alias', async () => {
+    const { skill } = await methods.createSkill(
+      makeSkillInput({
+        name: 'frontmatter-alias-on',
+        frontmatter: {
+          name: 'frontmatter-alias-on',
+          description: 'A small demo skill used in tests.',
+          alwaysApply: true,
+        },
+      }),
+    );
+    expect(skill.alwaysApply).toBe(true);
+  });
+
+  it('createSkill lets always-apply win when both frontmatter spellings are present', async () => {
+    const { skill } = await methods.createSkill(
+      makeSkillInput({
+        name: 'frontmatter-canonical-wins',
+        frontmatter: {
+          name: 'frontmatter-canonical-wins',
+          description: 'A small demo skill used in tests.',
+          'always-apply': false,
+          alwaysApply: true,
+        },
+      }),
+    );
+    expect(skill.alwaysApply).toBe(false);
+  });
+
   it('createSkill prefers explicit top-level alwaysApply over frontmatter', async () => {
     const { skill } = await methods.createSkill(
       makeSkillInput({
@@ -1060,6 +1294,26 @@ describe('Skill CRUD methods', () => {
     }
   });
 
+  it('updateSkill syncs alwaysApply column from the camel-case frontmatter alias', async () => {
+    const { skill } = await methods.createSkill(makeSkillInput({ name: 'sync-alias-test' }));
+    expect(skill.alwaysApply).toBe(false);
+    const result = await methods.updateSkill({
+      id: skill._id.toString(),
+      expectedVersion: skill.version,
+      update: {
+        frontmatter: {
+          name: 'sync-alias-test',
+          description: 'A small demo skill used in tests.',
+          alwaysApply: true,
+        },
+      },
+    });
+    expect(result.status).toBe('updated');
+    if (result.status === 'updated') {
+      expect(result.skill.alwaysApply).toBe(true);
+    }
+  });
+
   it('updateSkill keeps alwaysApply column untouched when the frontmatter update omits always-apply', async () => {
     const { skill } = await methods.createSkill(
       makeSkillInput({ name: 'no-flip', alwaysApply: true }),
@@ -1129,6 +1383,21 @@ describe('Skill CRUD methods', () => {
     }
   });
 
+  it('updateSkill derives alwaysApply=true from a body edit that adds `alwaysApply: true` inline', async () => {
+    const { skill } = await methods.createSkill(makeSkillInput({ name: 'body-enable-alias' }));
+    expect(skill.alwaysApply).toBe(false);
+    const newBody = `---\nname: body-enable-alias\ndescription: now opting in.\nalwaysApply: true\n---\n\n# Body`;
+    const result = await methods.updateSkill({
+      id: skill._id.toString(),
+      expectedVersion: skill.version,
+      update: { body: newBody },
+    });
+    expect(result.status).toBe('updated');
+    if (result.status === 'updated') {
+      expect(result.skill.alwaysApply).toBe(true);
+    }
+  });
+
   it('updateSkill flips alwaysApply to false when the body removes the `always-apply:` line', async () => {
     /* Regression for the “durable mismatch” case: a previously-
        always-apply skill whose SKILL.md body no longer declares the
@@ -1339,6 +1608,40 @@ describe('SkillFile methods', () => {
     expect(files[0].storageRegion).toBe('us-east-2');
   });
 
+  it('throws an explicit error when the upsert returns no saved file row', async () => {
+    const { skill } = await methods.createSkill(makeSkillInput());
+    const missingUpsert = {
+      lean: jest.fn().mockResolvedValue({
+        value: null,
+        lastErrorObject: { updatedExisting: false },
+      }),
+    } as unknown as ReturnType<typeof SkillFile.findOneAndUpdate>;
+    const findOneAndUpdateSpy = jest
+      .spyOn(SkillFile, 'findOneAndUpdate')
+      .mockReturnValueOnce(missingUpsert);
+    const bumpSpy = jest.spyOn(Skill, 'findByIdAndUpdate');
+
+    try {
+      await expect(
+        methods.upsertSkillFile({
+          skillId: skill._id,
+          relativePath: 'scripts/parse.sh',
+          file_id: 'file-1',
+          filename: 'parse.sh',
+          filepath: '/tmp/v1',
+          source: 'local',
+          mimeType: 'text/plain',
+          bytes: 10,
+          author: owner._id,
+        }),
+      ).rejects.toMatchObject({ code: 'SKILL_FILE_UPSERT_NOT_FOUND' });
+      expect(bumpSpy).not.toHaveBeenCalled();
+    } finally {
+      findOneAndUpdateSpy.mockRestore();
+      bumpSpy.mockRestore();
+    }
+  });
+
   it('clears codeEnvRef when a skill file is upserted (replacement)', async () => {
     /* A re-upload of a skill file replaces the row's contents — but the
      * cached `codeEnvRef` refers to the OLD bytes living in codeapi.
@@ -1577,4 +1880,21 @@ describe('deleteUserSkills', () => {
     expect(await Skill.countDocuments()).toBe(1);
     expect(await Skill.countDocuments({ _id: sharedId })).toBe(1);
   });
+
+  it('prunes deleted sole-owned skill ids from agent allowlists', async () => {
+    const { skill: mine } = await methods.createSkill(makeSkillInput({ name: 'mine' }));
+    await grantOwner(mine._id);
+    const Agent = mongoose.models.Agent;
+    const agent = await Agent.create(makeAgentDoc([mine._id.toString()]));
+
+    const deleted = await methods.deleteUserSkills(owner._id as mongoose.Types.ObjectId);
+    expect(deleted).toBe(1);
+
+    const agentAfter = (await Agent.findById(agent._id).lean()) as {
+      skills?: string[];
+      skills_enabled?: boolean;
+    } | null;
+    expect(agentAfter?.skills).toEqual([]);
+    expect(agentAfter?.skills_enabled).toBe(false);
+  });
 });
diff --git a/packages/data-schemas/src/methods/skill.ts b/packages/data-schemas/src/methods/skill.ts
index bc1d2260c63..764fab4b4ae 100644
--- a/packages/data-schemas/src/methods/skill.ts
+++ b/packages/data-schemas/src/methods/skill.ts
@@ -16,8 +16,9 @@ import type {
   ISkillFileDocument,
   ISkillSummary,
 } from '~/types/skill';
-import { isValidObjectIdString } from '~/utils/objectId';
+import type { IAgent } from '~/types/agent';
 import { tenantSafeBulkWrite } from '~/utils/tenantBulkWrite';
+import { isValidObjectIdString } from '~/utils/objectId';
 import { stripYamlTrailingComment } from '~/utils/yaml';
 import { escapeRegExp } from '~/utils/string';
 import logger from '~/config/winston';
@@ -42,6 +43,13 @@ export type ValidationIssue = {
   severity?: 'error' | 'warning';
 };
 
+type SkillFileUpsertResult = {
+  value: (ISkillFile & { _id: Types.ObjectId }) | null;
+  lastErrorObject?: {
+    updatedExisting?: boolean;
+  };
+};
+
 /** Partition an issue list into blocking errors and non-blocking warnings. */
 export function partitionIssues(issues: ValidationIssue[]): {
   errors: ValidationIssue[];
@@ -243,6 +251,7 @@ const ALLOWED_FRONTMATTER_KEYS = new Set<string>([
   'user-invocable',
   'disable-model-invocation',
   'always-apply',
+  'alwaysApply',
   'model',
   'effort',
   'context',
@@ -251,6 +260,7 @@ const ALLOWED_FRONTMATTER_KEYS = new Set<string>([
   'shell',
   'hooks',
   'version',
+  'license',
   'metadata',
 ]);
 
@@ -270,6 +280,7 @@ const FRONTMATTER_KIND: Record<string, FrontmatterKind | FrontmatterKind[]> = {
   'user-invocable': 'boolean',
   'disable-model-invocation': 'boolean',
   'always-apply': 'boolean',
+  alwaysApply: 'boolean',
   model: 'string',
   effort: ['string', 'number'],
   context: 'string',
@@ -277,6 +288,7 @@ const FRONTMATTER_KIND: Record<string, FrontmatterKind | FrontmatterKind[]> = {
   paths: ['string', 'stringArray'],
   shell: 'string',
   version: 'string',
+  license: 'string',
 };
 
 function isPlainObject(value: unknown): value is Record<string, unknown> {
@@ -487,6 +499,14 @@ export type UpdateSkillInput = {
   frontmatter?: Record<string, unknown>;
   category?: string;
   alwaysApply?: boolean;
+  source?: 'inline' | 'github' | 'notion';
+  sourceMetadata?: Record<string, unknown>;
+};
+
+export type GetAuthorSkillByNameParams = {
+  name: string;
+  author: Types.ObjectId | string;
+  tenantId?: string | null;
 };
 
 /**
@@ -582,6 +602,20 @@ export function backfillDerivedFromFrontmatter<
   return skill;
 }
 
+function getAlwaysApplyFrontmatterValue(
+  frontmatter: Record<string, unknown> | undefined,
+): boolean | undefined {
+  const canonical = frontmatter?.['always-apply'];
+  if (typeof canonical === 'boolean') {
+    return canonical;
+  }
+  const camelAlias = frontmatter?.alwaysApply;
+  if (typeof camelAlias === 'boolean') {
+    return camelAlias;
+  }
+  return undefined;
+}
+
 export type UpsertSkillFileInput = {
   skillId: Types.ObjectId | string;
   relativePath: string;
@@ -591,6 +625,7 @@ export type UpsertSkillFileInput = {
   storageKey?: string;
   storageRegion?: string;
   source: string;
+  sourceMetadata?: Record<string, unknown>;
   mimeType: string;
   bytes: number;
   isExecutable?: boolean;
@@ -664,14 +699,14 @@ type BodyAlwaysApplyResult =
   | { status: 'invalid' };
 
 /**
- * Extractor for the `always-apply` flag sitting inside a SKILL.md body's
+ * Extractor for the `always-apply` / `alwaysApply` flag sitting inside a SKILL.md body's
  * YAML frontmatter block. The REST edit flow lets users rewrite the full
  * SKILL.md text via `update.body` without a structured `frontmatter`
  * object, so this is the only signal we have for "user flipped
- * `always-apply:` inline in their editor".
+ * `always-apply:` or `alwaysApply:` inline in their editor".
  *
  * Returns a discriminated union so callers can tell:
- *  - `absent` — no `always-apply:` key (leave column alone; could be
+ *  - `absent` — no always-apply key (leave column alone; could be
  *    "user removed the flag" or "user hasn't written it yet" — both
  *    resolve to no-op). An empty value (`always-apply:` with nothing
  *    after the colon) is also treated as absent to allow mid-edit
@@ -682,7 +717,8 @@ type BodyAlwaysApplyResult =
  *    recognizable boolean (e.g. `tru`, `yes`, `1`). Validation rejects
  *    this rather than silently ignoring so `always-apply: tru` typos
  *    surface as 400s instead of drifting the column from what the
- *    saved SKILL.md text says.
+ *    saved SKILL.md text says. When both forms are present, the canonical
+ *    `always-apply` form wins because existing files may already rely on it.
  */
 function extractAlwaysApplyFromBody(body: string | undefined): BodyAlwaysApplyResult {
   if (typeof body !== 'string' || body.length === 0) {
@@ -698,13 +734,15 @@ function extractAlwaysApplyFromBody(body: string | undefined): BodyAlwaysApplyRe
     return { status: 'absent' };
   }
   const block = after.slice(0, closingIdx);
+  let aliasResult: BodyAlwaysApplyResult | undefined;
   for (const line of block.split('\n')) {
     const colon = line.indexOf(':');
     if (colon === -1) {
       continue;
     }
-    const key = line.slice(0, colon).trim().toLowerCase();
-    if (key !== 'always-apply') {
+    const key = line.slice(0, colon).trim();
+    const normalizedKey = key.toLowerCase();
+    if (normalizedKey !== 'always-apply' && normalizedKey !== 'alwaysapply') {
       continue;
     }
     // Strip the YAML inline comment BEFORE unquoting — a line like
@@ -713,7 +751,12 @@ function extractAlwaysApplyFromBody(body: string | undefined): BodyAlwaysApplyRe
     // the comment-strip would leave `"true"` which parses as invalid.
     let value = stripYamlTrailingComment(line.slice(colon + 1).trim()).trim();
     if (value === '') {
-      return { status: 'absent' };
+      const result: BodyAlwaysApplyResult = { status: 'absent' };
+      if (normalizedKey === 'always-apply') {
+        return result;
+      }
+      aliasResult = result;
+      continue;
     }
     if (
       value.length >= 2 &&
@@ -724,14 +767,28 @@ function extractAlwaysApplyFromBody(body: string | undefined): BodyAlwaysApplyRe
     }
     value = value.trim();
     if (value === '') {
-      return { status: 'absent' };
+      const result: BodyAlwaysApplyResult = { status: 'absent' };
+      if (normalizedKey === 'always-apply') {
+        return result;
+      }
+      aliasResult = result;
+      continue;
     }
     const lowered = value.toLowerCase();
-    if (lowered === 'true') return { status: 'valid', value: true };
-    if (lowered === 'false') return { status: 'valid', value: false };
-    return { status: 'invalid' };
+    let result: BodyAlwaysApplyResult;
+    if (lowered === 'true') {
+      result = { status: 'valid', value: true };
+    } else if (lowered === 'false') {
+      result = { status: 'valid', value: false };
+    } else {
+      result = { status: 'invalid' };
+    }
+    if (normalizedKey === 'always-apply') {
+      return result;
+    }
+    aliasResult = result;
   }
-  return { status: 'absent' };
+  return aliasResult ?? { status: 'absent' };
 }
 
 /**
@@ -745,9 +802,9 @@ function extractAlwaysApplyFromBody(body: string | undefined): BodyAlwaysApplyRe
  *
  * Precedence:
  *  1. An explicit top-level `alwaysApply` wins (caller overrides).
- *  2. Otherwise, derive from `frontmatter['always-apply']` when it is
- *     a strict boolean.
- *  3. Otherwise, parse `always-apply:` out of the SKILL.md body
+ *  2. Otherwise, derive from `frontmatter['always-apply']` or the accepted
+ *     alias `frontmatter.alwaysApply` when either is a strict boolean.
+ *  3. Otherwise, parse `always-apply:` / `alwaysApply:` out of the SKILL.md body
  *     frontmatter block (covers the UI edit flow that sends only
  *     `body` without a structured `frontmatter` object).
  *  4. Otherwise, return `fallback` (typically `false` on create, or the
@@ -767,7 +824,7 @@ function resolveAlwaysApplyFromInput(
   if (typeof explicit === 'boolean') {
     return explicit;
   }
-  const fromFrontmatter = frontmatter?.['always-apply'];
+  const fromFrontmatter = getAlwaysApplyFrontmatterValue(frontmatter);
   if (typeof fromFrontmatter === 'boolean') {
     return fromFrontmatter;
   }
@@ -778,6 +835,35 @@ function resolveAlwaysApplyFromInput(
   return fallback;
 }
 
+/**
+ * Narrows candidate skill ids to those backed by an existing Skill doc.
+ * Existence-only check (no ACL) so pruning an agent allowlist never drops
+ * skills the saving user merely can't view. Preserves input order, dedupes,
+ * and drops malformed ids — they can't reference anything. Candidates are
+ * lowercased before comparison: `isValidObjectIdString` accepts uppercase
+ * hex, but `_id.toString()` is always lowercase, and a casing mismatch
+ * would silently drop a valid id (and an emptied allowlist means the full
+ * catalog — the opposite of the configured scope).
+ */
+export async function filterExistingSkillIds(
+  mongoose: typeof import('mongoose'),
+  skillIds: string[],
+): Promise<string[]> {
+  const candidates = [
+    ...new Set(skillIds.filter(isValidObjectIdString).map((id) => id.toLowerCase())),
+  ];
+  if (candidates.length === 0) {
+    return [];
+  }
+  const Skill = mongoose.models.Skill as Model<ISkillDocument>;
+  const docs = await Skill.find(
+    { _id: { $in: candidates.map((id) => new mongoose.Types.ObjectId(id)) } },
+    { _id: 1 },
+  ).lean<Array<{ _id: Types.ObjectId }>>();
+  const existing = new Set(docs.map((doc) => doc._id.toString()));
+  return candidates.filter((id) => existing.has(id));
+}
+
 /**
  * Validate the `always-apply` value that would be derived from the
  * SKILL.md body's inline frontmatter. Only reports an issue when the
@@ -792,16 +878,97 @@ export function validateAlwaysApplyInBody(body: string | undefined): ValidationI
   if (result.status === 'invalid') {
     return [
       {
-        field: 'body.frontmatter.always-apply',
+        field: 'body.frontmatter.alwaysApply',
         code: 'INVALID_TYPE',
-        message: '"always-apply" in SKILL.md frontmatter must be a boolean (true or false)',
+        message:
+          '"always-apply" or "alwaysApply" in SKILL.md frontmatter must be a boolean (true or false)',
       },
     ];
   }
   return [];
 }
 
-export function createSkillMethods(mongoose: typeof import('mongoose'), deps: SkillDeps) {
+export function createSkillMethods(
+  mongoose: typeof import('mongoose'),
+  deps: SkillDeps,
+): {
+  createSkill: (data: CreateSkillInput) => Promise<CreateSkillResult>;
+  getSkillById: (id: string | Types.ObjectId) => Promise<(ISkill & { _id: Types.ObjectId }) | null>;
+  getSkillByName: (
+    name: string,
+    accessibleIds: Types.ObjectId[],
+    options?: {
+      /**
+       * Manual paths (`$` popover, always-apply once Phase 5 lands) set
+       * this so a same-name newer `userInvocable: false` duplicate can't
+       * shadow the older user-invocable doc the popover surfaced.
+       * Disable-model-invocation status is irrelevant here — manually-
+       * primed disabled skills are explicitly supported (iter 4).
+       */
+      preferUserInvocable?: boolean;
+      /**
+       * Model paths (`skill` / `read_file` tool handlers) set this so a
+       * same-name newer `disable-model-invocation: true` duplicate can't
+       * shadow the cataloged model-invocable doc. User-invocability is
+       * irrelevant here — `userInvocable: false` skills are model-only
+       * and remain valid model-invocation targets.
+       *
+       * Both flags fall back to the newest match when no preferred doc
+       * exists, so handlers can still fire their explicit-rejection
+       * error paths (e.g. "cannot be invoked by the model" in the
+       * disabled-only case).
+       */
+      preferModelInvocable?: boolean;
+    },
+  ) => Promise<(ISkill & { _id: Types.ObjectId }) | null>;
+  getAuthorSkillByName: (
+    params: GetAuthorSkillByNameParams,
+  ) => Promise<(ISkill & { _id: Types.ObjectId }) | null>;
+  listSkillsByAccess: (params: ListSkillsByAccessParams) => Promise<ListSkillsByAccessResult>;
+  listAlwaysApplySkills: (
+    params: ListAlwaysApplySkillsParams,
+  ) => Promise<ListAlwaysApplySkillsResult>;
+  updateSkill: (params: {
+    id: string;
+    expectedVersion: number;
+    update: UpdateSkillInput;
+  }) => Promise<UpdateSkillResult>;
+  deleteSkill: (id: string) => Promise<{ deleted: boolean }>;
+  deleteUserSkills: (userId: Types.ObjectId | string) => Promise<number>;
+  findSkillBySourceIdentity: (params: {
+    source: 'github' | 'notion';
+    upstreamId: string;
+    tenantId?: string;
+  }) => Promise<(ISkill & { _id: Types.ObjectId }) | null>;
+  listSkillsBySource: (params: {
+    source: 'github' | 'notion';
+    sourceId: string;
+  }) => Promise<Array<ISkill & { _id: Types.ObjectId }>>;
+  listSkillFiles: (
+    skillId: Types.ObjectId | string,
+  ) => Promise<Array<ISkillFile & { _id: Types.ObjectId }>>;
+  upsertSkillFile: (row: UpsertSkillFileInput) => Promise<ISkillFile & { _id: Types.ObjectId }>;
+  deleteSkillFile: (
+    skillId: Types.ObjectId | string,
+    relativePath: string,
+  ) => Promise<{ deleted: boolean }>;
+  getSkillFileByPath: (
+    skillId: Types.ObjectId | string,
+    relativePath: string,
+  ) => Promise<(ISkillFile & { _id: Types.ObjectId }) | null>;
+  updateSkillFileContent: (
+    skillId: Types.ObjectId | string,
+    relativePath: string,
+    update: { content?: string; isBinary?: boolean },
+  ) => Promise<void>;
+  updateSkillFileCodeEnvIds: (
+    updates: Array<{
+      skillId: Types.ObjectId | string;
+      relativePath: string;
+      codeEnvRef: CodeEnvRef;
+    }>,
+  ) => Promise<{ matchedCount: number; modifiedCount: number }>;
+} {
   const { ObjectId } = mongoose.Types;
 
   function buildSkillFilter(
@@ -870,18 +1037,19 @@ export function createSkillMethods(mongoose: typeof import('mongoose'), deps: Sk
        higher-precedence source won't override it (see
        `resolveAlwaysApplyFromInput` for the cascade). A caller sending
        an explicit top-level `alwaysApply` or a structured
-       `frontmatter['always-apply']` has the body value overridden at
+       an always-apply value in structured `frontmatter` has the body value overridden at
        derivation time, so rejecting them for a typo they aren't relying
        on would be user-hostile. */
     if (
       bodyAlwaysApply?.status === 'invalid' &&
       typeof data.alwaysApply !== 'boolean' &&
-      typeof data.frontmatter?.['always-apply'] !== 'boolean'
+      getAlwaysApplyFrontmatterValue(data.frontmatter) === undefined
     ) {
       issues.push({
-        field: 'body.frontmatter.always-apply',
+        field: 'body.frontmatter.alwaysApply',
         code: 'INVALID_TYPE',
-        message: '"always-apply" in SKILL.md frontmatter must be a boolean (true or false)',
+        message:
+          '"always-apply" or "alwaysApply" in SKILL.md frontmatter must be a boolean (true or false)',
       });
     }
     const { errors, warnings } = partitionIssues(issues);
@@ -1017,6 +1185,22 @@ export function createSkillMethods(mongoose: typeof import('mongoose'), deps: Sk
     return preferred ?? docs[0];
   }
 
+  async function getAuthorSkillByName(
+    params: GetAuthorSkillByNameParams,
+  ): Promise<(ISkill & { _id: Types.ObjectId }) | null> {
+    const Skill = mongoose.models.Skill as Model<ISkillDocument>;
+    const doc = await Skill.findOne({
+      name: params.name,
+      author: params.author,
+      tenantId: params.tenantId ?? null,
+    })
+      .sort({ updatedAt: -1 })
+      .lean();
+    return backfillDerivedFromFrontmatter(
+      (doc as unknown as (ISkill & { _id: Types.ObjectId }) | null) ?? null,
+    );
+  }
+
   async function listSkillsByAccess(
     params: ListSkillsByAccessParams,
   ): Promise<ListSkillsByAccessResult> {
@@ -1183,12 +1367,13 @@ export function createSkillMethods(mongoose: typeof import('mongoose'), deps: Sk
     if (
       bodyAlwaysApply?.status === 'invalid' &&
       update.alwaysApply === undefined &&
-      typeof update.frontmatter?.['always-apply'] !== 'boolean'
+      getAlwaysApplyFrontmatterValue(update.frontmatter) === undefined
     ) {
       issues.push({
-        field: 'body.frontmatter.always-apply',
+        field: 'body.frontmatter.alwaysApply',
         code: 'INVALID_TYPE',
-        message: '"always-apply" in SKILL.md frontmatter must be a boolean (true or false)',
+        message:
+          '"always-apply" or "alwaysApply" in SKILL.md frontmatter must be a boolean (true or false)',
       });
     }
     const { errors, warnings } = partitionIssues(issues);
@@ -1206,6 +1391,8 @@ export function createSkillMethods(mongoose: typeof import('mongoose'), deps: Sk
     if (update.displayTitle !== undefined) setPayload.displayTitle = update.displayTitle;
     if (update.description !== undefined) setPayload.description = update.description;
     if (update.body !== undefined) setPayload.body = update.body;
+    if (update.source !== undefined) setPayload.source = update.source;
+    if (update.sourceMetadata !== undefined) setPayload.sourceMetadata = update.sourceMetadata;
     if (update.frontmatter !== undefined) {
       setPayload.frontmatter = update.frontmatter;
       /**
@@ -1227,11 +1414,11 @@ export function createSkillMethods(mongoose: typeof import('mongoose'), deps: Sk
     /**
      * Keep the indexed `alwaysApply` column in sync with whatever the update
      * is carrying: an explicit top-level `alwaysApply` always wins; a
-     * structured `frontmatter` with `always-apply: true/false` is next; and
-     * a `body` update is scanned last for an inline `always-apply:` line
+     * structured `frontmatter` with `always-apply: true/false` or the
+     * accepted `alwaysApply` alias is next; and a `body` update is scanned last for an inline `always-apply:` line
      * inside the SKILL.md frontmatter block. The body path is load-bearing
      * for the REST edit flow — the current UI sends `body` without a
-     * parallel `frontmatter` object, so inline edits to `always-apply:`
+     * parallel `frontmatter` object, so inline edits to `always-apply:` / `alwaysApply:`
      * would otherwise leave the column stale and auto-priming / pin
      * badges would keep using the old value.
      *
@@ -1246,7 +1433,7 @@ export function createSkillMethods(mongoose: typeof import('mongoose'), deps: Sk
      * at each level, not the presence of the parent field. An API caller
      * that sends both `body` and an unrelated `frontmatter` bag (e.g.
      * editing category + rewriting SKILL.md in one PATCH) still gets the
-     * body-inline flag respected because `frontmatter['always-apply']`
+     * body-inline flag respected because no structured always-apply key
      * is absent in that payload.
      */
     let derivedAlwaysApply: boolean | undefined;
@@ -1254,7 +1441,7 @@ export function createSkillMethods(mongoose: typeof import('mongoose'), deps: Sk
       derivedAlwaysApply = update.alwaysApply;
     }
     if (derivedAlwaysApply === undefined && update.frontmatter !== undefined) {
-      const fromFrontmatter = update.frontmatter['always-apply'];
+      const fromFrontmatter = getAlwaysApplyFrontmatterValue(update.frontmatter);
       if (typeof fromFrontmatter === 'boolean') {
         derivedAlwaysApply = fromFrontmatter;
       }
@@ -1312,6 +1499,48 @@ export function createSkillMethods(mongoose: typeof import('mongoose'), deps: Sk
     };
   }
 
+  /**
+   * Removes deleted skill ids from every agent's `skills` allowlist. A dangling
+   * id is invisible in the builder yet keeps the allowlist non-empty, so the
+   * runtime scopes the catalog to an empty intersection and the agent silently
+   * loses all skills. Direct `updateMany` on purpose: hygiene, not an authored
+   * edit — no version entry, timestamps untouched.
+   *
+   * Ids are lowercased first: allowlists store canonical `_id.toString()`
+   * values, and an uppercase-but-valid id would delete the Skill doc yet
+   * leave the dangling entry behind.
+   *
+   * Agents whose ENTIRE allowlist is being deleted fail closed instead:
+   * an emptied allowlist with `skills_enabled: true` means the full
+   * accessible catalog at runtime, so a plain `$pull` would silently widen
+   * a deliberately restricted agent. Disabling skills preserves the
+   * restriction until an author makes a new explicit choice.
+   */
+  async function removeSkillsFromAgentAllowlists(skillIds: string[]): Promise<void> {
+    if (skillIds.length === 0) {
+      return;
+    }
+    const ids = skillIds.map((id) => id.toLowerCase());
+    const Agent = mongoose.models.Agent as Model<IAgent>;
+    try {
+      await Agent.updateMany(
+        { skills: { $in: ids, $not: { $elemMatch: { $nin: ids } } } },
+        { $set: { skills: [], skills_enabled: false } },
+        { timestamps: false },
+      );
+      await Agent.updateMany(
+        { skills: { $in: ids } },
+        { $pull: { skills: { $in: ids } } },
+        { timestamps: false },
+      );
+    } catch (error) {
+      logger.error(
+        '[removeSkillsFromAgentAllowlists] Error pruning agent skill allowlists:',
+        error,
+      );
+    }
+  }
+
   async function deleteSkill(id: string): Promise<{ deleted: boolean }> {
     if (!isValidObjectIdString(id)) {
       return { deleted: false };
@@ -1323,6 +1552,10 @@ export function createSkillMethods(mongoose: typeof import('mongoose'), deps: Sk
     if (!res.deletedCount) {
       return { deleted: false };
     }
+    /** Prune allowlists immediately after the Skill row is gone: if the
+     *  SkillFile cleanup below throws, a retry exits early on
+     *  `deletedCount === 0` and would never reach a later prune. */
+    await removeSkillsFromAgentAllowlists([id]);
     await SkillFile.deleteMany({ skillId: objectId });
     try {
       await deps.removeAllPermissions({ resourceType: ResourceType.SKILL, resourceId: id });
@@ -1342,6 +1575,7 @@ export function createSkillMethods(mongoose: typeof import('mongoose'), deps: Sk
     const SkillFile = mongoose.models.SkillFile as Model<ISkillFileDocument>;
     await SkillFile.deleteMany({ skillId: { $in: soleOwned } });
     const res = await Skill.deleteMany({ _id: { $in: soleOwned } });
+    await removeSkillsFromAgentAllowlists(soleOwned.map((rid) => rid.toString()));
     await Promise.allSettled(
       soleOwned.map((rid) =>
         deps
@@ -1357,6 +1591,35 @@ export function createSkillMethods(mongoose: typeof import('mongoose'), deps: Sk
     return res.deletedCount ?? 0;
   }
 
+  async function findSkillBySourceIdentity(params: {
+    source: 'github' | 'notion';
+    upstreamId: string;
+    tenantId?: string;
+  }): Promise<(ISkill & { _id: Types.ObjectId }) | null> {
+    const Skill = mongoose.models.Skill as Model<ISkillDocument>;
+    const tenantFilter: FilterQuery<ISkillDocument> = params.tenantId
+      ? { tenantId: params.tenantId }
+      : { $or: [{ tenantId: { $exists: false } }, { tenantId: null }] };
+    const doc = await Skill.findOne({
+      source: params.source,
+      'sourceMetadata.upstreamId': params.upstreamId,
+      ...tenantFilter,
+    }).lean();
+    return (doc as unknown as (ISkill & { _id: Types.ObjectId }) | null) ?? null;
+  }
+
+  async function listSkillsBySource(params: {
+    source: 'github' | 'notion';
+    sourceId: string;
+  }): Promise<Array<ISkill & { _id: Types.ObjectId }>> {
+    const Skill = mongoose.models.Skill as Model<ISkillDocument>;
+    const rows = await Skill.find({
+      source: params.source,
+      'sourceMetadata.sourceId': params.sourceId,
+    }).lean();
+    return rows as unknown as Array<ISkill & { _id: Types.ObjectId }>;
+  }
+
   /**
    * Atomically bumps `Skill.version` and adjusts `fileCount` by `delta`.
    * `delta` is `+1` when a new file is inserted, `-1` when one is deleted, and
@@ -1413,12 +1676,7 @@ export function createSkillMethods(mongoose: typeof import('mongoose'), deps: Sk
     }
     const SkillFile = mongoose.models.SkillFile as Model<ISkillFileDocument>;
     const category = inferSkillFileCategory(row.relativePath);
-    // Atomic new-vs-replace detection: with `new: false, upsert: true`,
-    // `findOneAndUpdate` returns the pre-update document (or null if the doc
-    // did not exist and was just inserted). Checking the return value replaces
-    // a non-atomic `findOne` + `upsert` pair that could double-count on
-    // concurrent uploads of the same (skillId, relativePath).
-    const previous = await SkillFile.findOneAndUpdate(
+    const result = (await SkillFile.findOneAndUpdate(
       { skillId: row.skillId, relativePath: row.relativePath },
       {
         $set: {
@@ -1430,6 +1688,7 @@ export function createSkillMethods(mongoose: typeof import('mongoose'), deps: Sk
           storageKey: row.storageKey,
           storageRegion: row.storageRegion,
           source: row.source,
+          sourceMetadata: row.sourceMetadata,
           mimeType: row.mimeType,
           bytes: row.bytes,
           category,
@@ -1439,23 +1698,17 @@ export function createSkillMethods(mongoose: typeof import('mongoose'), deps: Sk
         },
         $unset: { content: '', isBinary: '', codeEnvRef: '' },
       },
-      { new: false, upsert: true },
-    ).lean();
-    const delta = previous ? 0 : 1;
+      { new: true, upsert: true, includeResultMetadata: true },
+    ).lean()) as unknown as SkillFileUpsertResult;
+    const current = result.value;
+    if (!current) {
+      const error = new Error('Skill file upsert failed to read the saved file row');
+      (error as Error & { code?: string }).code = 'SKILL_FILE_UPSERT_NOT_FOUND';
+      throw error;
+    }
+    const delta = result.lastErrorObject?.updatedExisting === false ? 1 : 0;
     await bumpSkillVersionAndAdjustFileCount(row.skillId, delta);
-
-    // Fetch the current (post-upsert) document for the caller. This second
-    // round-trip is an intentional tradeoff for the TOCTOU-safe detection
-    // above: `new: false` is required to distinguish insert from replace
-    // atomically, which means `findOneAndUpdate` returns the pre-update
-    // document (null on insert). A separate `findOne` is the simplest way
-    // to return the authoritative post-upsert state. Performance impact is
-    // negligible compared to the file upload I/O this sits behind.
-    const current = await SkillFile.findOne({
-      skillId: row.skillId,
-      relativePath: row.relativePath,
-    }).lean();
-    return current as unknown as ISkillFile & { _id: Types.ObjectId };
+    return current;
   }
 
   async function deleteSkillFile(
@@ -1526,11 +1779,14 @@ export function createSkillMethods(mongoose: typeof import('mongoose'), deps: Sk
     createSkill,
     getSkillById,
     getSkillByName,
+    getAuthorSkillByName,
     listSkillsByAccess,
     listAlwaysApplySkills,
     updateSkill,
     deleteSkill,
     deleteUserSkills,
+    findSkillBySourceIdentity,
+    listSkillsBySource,
     listSkillFiles,
     upsertSkillFile,
     deleteSkillFile,
diff --git a/packages/data-schemas/src/methods/skillSync.spec.ts b/packages/data-schemas/src/methods/skillSync.spec.ts
new file mode 100644
index 00000000000..d384db1d7c7
--- /dev/null
+++ b/packages/data-schemas/src/methods/skillSync.spec.ts
@@ -0,0 +1,194 @@
+import mongoose from 'mongoose';
+import { MongoMemoryServer } from 'mongodb-memory-server';
+import type { ISkillSyncCredential } from '~/types/skillSync';
+import { createSkillSyncMethods } from './skillSync';
+import { encryptV2, decryptV2 } from '~/crypto';
+import { createModels } from '../models';
+
+jest.mock('~/crypto', () => ({
+  encryptV2: jest.fn(async (value: string) => `encrypted:${value}`),
+  decryptV2: jest.fn(async (value: string) => value.replace(/^encrypted:/, '')),
+}));
+
+let mongoServer: MongoMemoryServer;
+let methods: ReturnType<typeof createSkillSyncMethods>;
+
+beforeAll(async () => {
+  mongoServer = await MongoMemoryServer.create();
+  await mongoose.connect(mongoServer.getUri());
+  createModels(mongoose);
+  methods = createSkillSyncMethods(mongoose);
+});
+
+afterAll(async () => {
+  await mongoose.disconnect();
+  await mongoServer.stop();
+});
+
+beforeEach(async () => {
+  await mongoose.models.SkillSyncCredential.deleteMany({});
+  await mongoose.models.SkillSyncStatus.deleteMany({});
+  jest.clearAllMocks();
+});
+
+describe('createSkillSyncMethods', () => {
+  it('encrypts GitHub tokens and never exposes stored token material in summaries', async () => {
+    const summary = await methods.upsertSkillSyncCredential({
+      provider: 'github',
+      credentialKey: 'github-skills-prod',
+      token: 'ghp_secret',
+    });
+    expect(encryptV2).toHaveBeenCalledWith('ghp_secret');
+    expect(summary).toMatchObject({
+      provider: 'github',
+      credentialKey: 'github-skills-prod',
+      credentialPresent: true,
+    });
+    expect(JSON.stringify(summary)).not.toContain('ghp_secret');
+    expect(JSON.stringify(summary)).not.toContain('encrypted:ghp_secret');
+
+    const raw = (await mongoose.models.SkillSyncCredential.findOne({
+      provider: 'github',
+      credentialKey: 'github-skills-prod',
+    })
+      .select('+encryptedToken +tokenHash')
+      .lean()) as ISkillSyncCredential | null;
+    if (!raw) {
+      throw new Error('Expected stored skill sync credential');
+    }
+    expect(raw.encryptedToken).toBe('encrypted:ghp_secret');
+    expect(raw.tokenHash).toHaveLength(64);
+  });
+
+  it('decrypts GitHub tokens only through the token accessor', async () => {
+    await methods.upsertSkillSyncCredential({
+      provider: 'github',
+      credentialKey: 'github-skills-prod',
+      token: 'github_pat_secret',
+    });
+    const token = await methods.getSkillSyncCredentialToken('github', 'github-skills-prod');
+    expect(decryptV2).toHaveBeenCalledWith('encrypted:github_pat_secret');
+    expect(token).toBe('github_pat_secret');
+  });
+
+  it('uses the status collection as a Mongo-backed sync lock', async () => {
+    await expect(
+      methods.tryAcquireSkillSyncLock({
+        provider: 'github',
+        lockOwner: 'worker-a',
+        leaseMs: 60_000,
+      }),
+    ).resolves.toBe(true);
+    await expect(
+      methods.tryAcquireSkillSyncLock({
+        provider: 'github',
+        lockOwner: 'worker-a',
+        leaseMs: 60_000,
+      }),
+    ).resolves.toBe(false);
+    await expect(
+      methods.tryAcquireSkillSyncLock({
+        provider: 'github',
+        lockOwner: 'worker-b',
+        leaseMs: 60_000,
+      }),
+    ).resolves.toBe(false);
+    await expect(
+      methods.refreshSkillSyncLock({
+        provider: 'github',
+        lockOwner: 'worker-a',
+        leaseMs: 60_000,
+      }),
+    ).resolves.toBe(true);
+    await methods.releaseSkillSyncLock({ provider: 'github', lockOwner: 'worker-a' });
+    await expect(
+      methods.tryAcquireSkillSyncLock({
+        provider: 'github',
+        lockOwner: 'worker-b',
+        leaseMs: 60_000,
+      }),
+    ).resolves.toBe(true);
+  });
+
+  it('clears stale source errors after a successful sync status update', async () => {
+    await methods.upsertSkillSyncStatus({
+      provider: 'github',
+      sourceId: 'librechat-skills',
+      status: 'failed',
+      errorCode: 'SKILL_PARSE_FAILED',
+      errorMessage: 'bad frontmatter',
+    });
+
+    const success = await methods.upsertSkillSyncStatus({
+      provider: 'github',
+      sourceId: 'librechat-skills',
+      status: 'succeeded',
+      syncedSkillCount: 1,
+      syncedFileCount: 2,
+    });
+
+    expect(success.status).toBe('succeeded');
+    expect(success.errorCode).toBeUndefined();
+    expect(success.errorMessage).toBeUndefined();
+  });
+
+  it('keeps status rows separate for the same source id in different tenants', async () => {
+    await methods.upsertSkillSyncStatus({
+      provider: 'github',
+      sourceId: 'shared-source',
+      tenantId: 'tenant-a',
+      status: 'succeeded',
+      syncedSkillCount: 1,
+    });
+    await methods.upsertSkillSyncStatus({
+      provider: 'github',
+      sourceId: 'shared-source',
+      tenantId: 'tenant-b',
+      status: 'failed',
+      errorCode: 'TENANT_B_FAILURE',
+    });
+
+    const tenantA = await methods.getSkillSyncStatus('github', 'shared-source', 'tenant-a');
+    const tenantB = await methods.getSkillSyncStatus('github', 'shared-source', 'tenant-b');
+
+    expect(tenantA).toMatchObject({
+      sourceId: 'shared-source',
+      tenantId: 'tenant-a',
+      status: 'succeeded',
+      syncedSkillCount: 1,
+    });
+    expect(tenantB).toMatchObject({
+      sourceId: 'shared-source',
+      tenantId: 'tenant-b',
+      status: 'failed',
+      errorCode: 'TENANT_B_FAILURE',
+    });
+  });
+
+  it('keeps sync locks separate per tenant', async () => {
+    await expect(
+      methods.tryAcquireSkillSyncLock({
+        provider: 'github',
+        tenantId: 'tenant-a',
+        lockOwner: 'worker-a',
+        leaseMs: 60_000,
+      }),
+    ).resolves.toBe(true);
+    await expect(
+      methods.tryAcquireSkillSyncLock({
+        provider: 'github',
+        tenantId: 'tenant-b',
+        lockOwner: 'worker-b',
+        leaseMs: 60_000,
+      }),
+    ).resolves.toBe(true);
+    await expect(
+      methods.tryAcquireSkillSyncLock({
+        provider: 'github',
+        tenantId: 'tenant-a',
+        lockOwner: 'worker-c',
+        leaseMs: 60_000,
+      }),
+    ).resolves.toBe(false);
+  });
+});
diff --git a/packages/data-schemas/src/methods/skillSync.ts b/packages/data-schemas/src/methods/skillSync.ts
new file mode 100644
index 00000000000..87c749f4006
--- /dev/null
+++ b/packages/data-schemas/src/methods/skillSync.ts
@@ -0,0 +1,382 @@
+import { createHash } from 'crypto';
+import type { Model, Types } from 'mongoose';
+import type {
+  ISkillSyncStatus,
+  SkillSyncProvider,
+  SkillSyncRunStatus,
+  ISkillSyncStatusDocument,
+  ISkillSyncCredential,
+  ISkillSyncCredentialDocument,
+} from '~/types/skillSync';
+import { encryptV2, decryptV2 } from '~/crypto';
+
+const LOCK_SOURCE_ID = '__global_lock__';
+
+export type SkillSyncCredentialSummary = {
+  provider: SkillSyncProvider;
+  credentialKey: string;
+  credentialPresent: boolean;
+  tokenFingerprint?: string;
+  createdAt?: Date;
+  updatedAt?: Date;
+};
+
+export type UpsertSkillSyncCredentialInput = {
+  provider: SkillSyncProvider;
+  credentialKey: string;
+  token: string;
+  userId?: Types.ObjectId;
+};
+
+export type SkillSyncStatusInput = {
+  provider: SkillSyncProvider;
+  sourceId: string;
+  tenantId?: string;
+  status: SkillSyncRunStatus;
+  credentialKey?: string;
+  owner?: string;
+  repo?: string;
+  ref?: string;
+  paths?: string[];
+  startedAt?: Date;
+  finishedAt?: Date;
+  errorCode?: string;
+  errorMessage?: string;
+  syncedSkillCount?: number;
+  syncedFileCount?: number;
+  deletedSkillCount?: number;
+  deletedFileCount?: number;
+};
+
+export type SkillSyncLockInput = {
+  provider: SkillSyncProvider;
+  lockOwner: string;
+  leaseMs: number;
+  tenantId?: string;
+};
+
+export type SkillSyncReleaseLockInput = {
+  provider: SkillSyncProvider;
+  lockOwner: string;
+  tenantId?: string;
+};
+
+export type SkillSyncMethods = {
+  upsertSkillSyncCredential: (
+    input: UpsertSkillSyncCredentialInput,
+  ) => Promise<SkillSyncCredentialSummary>;
+  deleteSkillSyncCredential: (
+    provider: SkillSyncProvider,
+    credentialKey: string,
+  ) => Promise<{ deleted: boolean }>;
+  listSkillSyncCredentials: (provider: SkillSyncProvider) => Promise<SkillSyncCredentialSummary[]>;
+  getSkillSyncCredentialToken: (
+    provider: SkillSyncProvider,
+    credentialKey: string,
+  ) => Promise<string | null>;
+  getSkillSyncCredentialSummary: (
+    provider: SkillSyncProvider,
+    credentialKey: string,
+  ) => Promise<SkillSyncCredentialSummary | null>;
+  listSkillSyncStatuses: (provider: SkillSyncProvider) => Promise<ISkillSyncStatus[]>;
+  getSkillSyncStatus: (
+    provider: SkillSyncProvider,
+    sourceId: string,
+    tenantId?: string,
+  ) => Promise<ISkillSyncStatus | null>;
+  upsertSkillSyncStatus: (input: SkillSyncStatusInput) => Promise<ISkillSyncStatus>;
+  tryAcquireSkillSyncLock: (params: SkillSyncLockInput) => Promise<boolean>;
+  refreshSkillSyncLock: (params: SkillSyncLockInput) => Promise<boolean>;
+  releaseSkillSyncLock: (params: SkillSyncReleaseLockInput) => Promise<void>;
+};
+
+function hashToken(token: string): string {
+  return createHash('sha256').update(token).digest('hex');
+}
+
+function tenantStatusCondition(tenantId?: string) {
+  return tenantId ? { tenantId } : { tenantId: { $exists: false } };
+}
+
+function summarizeCredential(
+  credential: Pick<
+    ISkillSyncCredential,
+    'provider' | 'credentialKey' | 'tokenHash' | 'createdAt' | 'updatedAt'
+  >,
+): SkillSyncCredentialSummary {
+  return {
+    provider: credential.provider,
+    credentialKey: credential.credentialKey,
+    credentialPresent: true,
+    tokenFingerprint: credential.tokenHash.slice(0, 12),
+    createdAt: credential.createdAt,
+    updatedAt: credential.updatedAt,
+  };
+}
+
+export function createSkillSyncMethods(mongoose: typeof import('mongoose')): SkillSyncMethods {
+  async function upsertSkillSyncCredential(
+    input: UpsertSkillSyncCredentialInput,
+  ): Promise<SkillSyncCredentialSummary> {
+    const Credential = mongoose.models.SkillSyncCredential as Model<ISkillSyncCredentialDocument>;
+    const encryptedToken = await encryptV2(input.token);
+    const tokenHash = hashToken(input.token);
+    const update = {
+      $set: {
+        encryptedToken,
+        tokenHash,
+        updatedBy: input.userId,
+      },
+      $setOnInsert: {
+        provider: input.provider,
+        credentialKey: input.credentialKey,
+        createdBy: input.userId,
+      },
+    };
+    const credential = await Credential.findOneAndUpdate(
+      { provider: input.provider, credentialKey: input.credentialKey },
+      update,
+      { upsert: true, new: true, setDefaultsOnInsert: true },
+    )
+      .select('+tokenHash')
+      .lean();
+    return summarizeCredential(credential as ISkillSyncCredential);
+  }
+
+  async function deleteSkillSyncCredential(
+    provider: SkillSyncProvider,
+    credentialKey: string,
+  ): Promise<{ deleted: boolean }> {
+    const Credential = mongoose.models.SkillSyncCredential as Model<ISkillSyncCredentialDocument>;
+    const result = await Credential.deleteOne({ provider, credentialKey });
+    return { deleted: (result.deletedCount ?? 0) > 0 };
+  }
+
+  async function listSkillSyncCredentials(
+    provider: SkillSyncProvider,
+  ): Promise<SkillSyncCredentialSummary[]> {
+    const Credential = mongoose.models.SkillSyncCredential as Model<ISkillSyncCredentialDocument>;
+    const rows = await Credential.find({ provider })
+      .select('+tokenHash')
+      .sort({ credentialKey: 1 })
+      .lean();
+    return rows.map((row) => summarizeCredential(row as ISkillSyncCredential));
+  }
+
+  async function getSkillSyncCredentialToken(
+    provider: SkillSyncProvider,
+    credentialKey: string,
+  ): Promise<string | null> {
+    const Credential = mongoose.models.SkillSyncCredential as Model<ISkillSyncCredentialDocument>;
+    const credential = await Credential.findOne({ provider, credentialKey })
+      .select('+encryptedToken')
+      .lean();
+    if (!credential) {
+      return null;
+    }
+    return decryptV2((credential as ISkillSyncCredential).encryptedToken);
+  }
+
+  async function getSkillSyncCredentialSummary(
+    provider: SkillSyncProvider,
+    credentialKey: string,
+  ): Promise<SkillSyncCredentialSummary | null> {
+    const Credential = mongoose.models.SkillSyncCredential as Model<ISkillSyncCredentialDocument>;
+    const credential = await Credential.findOne({ provider, credentialKey })
+      .select('+tokenHash')
+      .lean();
+    if (!credential) {
+      return null;
+    }
+    return summarizeCredential(credential as ISkillSyncCredential);
+  }
+
+  async function listSkillSyncStatuses(provider: SkillSyncProvider): Promise<ISkillSyncStatus[]> {
+    const Status = mongoose.models.SkillSyncStatus as Model<ISkillSyncStatusDocument>;
+    const rows = await Status.find({ provider, sourceId: { $ne: LOCK_SOURCE_ID } })
+      .sort({ sourceId: 1 })
+      .lean<ISkillSyncStatus[]>();
+    return rows;
+  }
+
+  async function getSkillSyncStatus(
+    provider: SkillSyncProvider,
+    sourceId: string,
+    tenantId?: string,
+  ): Promise<ISkillSyncStatus | null> {
+    const Status = mongoose.models.SkillSyncStatus as Model<ISkillSyncStatusDocument>;
+    const row = await Status.findOne({
+      provider,
+      sourceId,
+      ...tenantStatusCondition(tenantId),
+    }).lean<ISkillSyncStatus | null>();
+    return row ?? null;
+  }
+
+  async function upsertSkillSyncStatus(input: SkillSyncStatusInput): Promise<ISkillSyncStatus> {
+    const Status = mongoose.models.SkillSyncStatus as Model<ISkillSyncStatusDocument>;
+    const now = new Date();
+    const success = input.status === 'succeeded';
+    const failure = input.status === 'failed';
+    const setPayload: Partial<ISkillSyncStatus> = {
+      status: input.status,
+      credentialKey: input.credentialKey,
+      owner: input.owner,
+      repo: input.repo,
+      ref: input.ref,
+      paths: input.paths,
+      startedAt: input.startedAt,
+      finishedAt: input.finishedAt,
+      syncedSkillCount: input.syncedSkillCount ?? 0,
+      syncedFileCount: input.syncedFileCount ?? 0,
+      deletedSkillCount: input.deletedSkillCount ?? 0,
+      deletedFileCount: input.deletedFileCount ?? 0,
+      ...(success ? { lastSuccessAt: input.finishedAt ?? now } : {}),
+      ...(failure ? { lastFailureAt: input.finishedAt ?? now } : {}),
+    };
+    if (failure) {
+      setPayload.errorCode = input.errorCode;
+      setPayload.errorMessage = input.errorMessage;
+    }
+    const unsetPayload = failure ? {} : { errorCode: '', errorMessage: '' };
+    const row = await Status.findOneAndUpdate(
+      {
+        provider: input.provider,
+        sourceId: input.sourceId,
+        ...tenantStatusCondition(input.tenantId),
+      },
+      {
+        $set: setPayload,
+        ...(failure ? {} : { $unset: unsetPayload }),
+        $setOnInsert: {
+          provider: input.provider,
+          sourceId: input.sourceId,
+          ...(input.tenantId ? { tenantId: input.tenantId } : {}),
+        },
+      },
+      { upsert: true, new: true, setDefaultsOnInsert: true },
+    ).lean<ISkillSyncStatus>();
+    return row;
+  }
+
+  async function tryAcquireSkillSyncLock(params: SkillSyncLockInput): Promise<boolean> {
+    const Status = mongoose.models.SkillSyncStatus as Model<ISkillSyncStatusDocument>;
+    const now = new Date();
+    const lockExpiresAt = new Date(now.getTime() + params.leaseMs);
+    const existing = await Status.findOne({
+      provider: params.provider,
+      sourceId: LOCK_SOURCE_ID,
+      ...tenantStatusCondition(params.tenantId),
+    }).lean<ISkillSyncStatus | null>();
+    if (existing?.lockOwner && existing.lockExpiresAt && existing.lockExpiresAt > now) {
+      return false;
+    }
+    if (!existing) {
+      try {
+        await Status.create({
+          provider: params.provider,
+          sourceId: LOCK_SOURCE_ID,
+          ...(params.tenantId ? { tenantId: params.tenantId } : {}),
+          status: 'running',
+          lockOwner: params.lockOwner,
+          lockExpiresAt,
+          startedAt: now,
+        });
+        return true;
+      } catch (error) {
+        if ((error as { code?: number }).code === 11000) {
+          return false;
+        }
+        throw error;
+      }
+    }
+    try {
+      const row = await Status.findOneAndUpdate(
+        {
+          provider: params.provider,
+          sourceId: LOCK_SOURCE_ID,
+          ...tenantStatusCondition(params.tenantId),
+          $or: [{ lockExpiresAt: { $exists: false } }, { lockExpiresAt: { $lte: now } }],
+        },
+        {
+          $set: {
+            status: 'running',
+            lockOwner: params.lockOwner,
+            lockExpiresAt,
+            startedAt: now,
+          },
+          $setOnInsert: {
+            provider: params.provider,
+            sourceId: LOCK_SOURCE_ID,
+            ...(params.tenantId ? { tenantId: params.tenantId } : {}),
+          },
+        },
+        { upsert: true, new: true, setDefaultsOnInsert: true },
+      ).lean();
+      return (row as ISkillSyncStatus | null)?.lockOwner === params.lockOwner;
+    } catch (error) {
+      if ((error as { code?: number }).code === 11000) {
+        return false;
+      }
+      throw error;
+    }
+  }
+
+  async function refreshSkillSyncLock(params: SkillSyncLockInput): Promise<boolean> {
+    const Status = mongoose.models.SkillSyncStatus as Model<ISkillSyncStatusDocument>;
+    const now = new Date();
+    const row = await Status.findOneAndUpdate(
+      {
+        provider: params.provider,
+        sourceId: LOCK_SOURCE_ID,
+        ...tenantStatusCondition(params.tenantId),
+        lockOwner: params.lockOwner,
+        lockExpiresAt: { $gt: now },
+      },
+      {
+        $set: {
+          status: 'running',
+          lockExpiresAt: new Date(now.getTime() + params.leaseMs),
+        },
+      },
+      { new: true },
+    ).lean<ISkillSyncStatus | null>();
+    return Boolean(row);
+  }
+
+  async function releaseSkillSyncLock(params: SkillSyncReleaseLockInput): Promise<void> {
+    const Status = mongoose.models.SkillSyncStatus as Model<ISkillSyncStatusDocument>;
+    await Status.updateOne(
+      {
+        provider: params.provider,
+        sourceId: LOCK_SOURCE_ID,
+        ...tenantStatusCondition(params.tenantId),
+        lockOwner: params.lockOwner,
+      },
+      {
+        $set: {
+          status: 'idle',
+          finishedAt: new Date(),
+        },
+        $unset: {
+          lockOwner: '',
+          lockExpiresAt: '',
+        },
+      },
+    );
+  }
+
+  return {
+    upsertSkillSyncCredential,
+    deleteSkillSyncCredential,
+    listSkillSyncCredentials,
+    getSkillSyncCredentialToken,
+    getSkillSyncCredentialSummary,
+    listSkillSyncStatuses,
+    getSkillSyncStatus,
+    upsertSkillSyncStatus,
+    tryAcquireSkillSyncLock,
+    refreshSkillSyncLock,
+    releaseSkillSyncLock,
+  };
+}
diff --git a/packages/data-schemas/src/methods/spendTokens.ts b/packages/data-schemas/src/methods/spendTokens.ts
index 4cb6167b55a..07c6d3818aa 100644
--- a/packages/data-schemas/src/methods/spendTokens.ts
+++ b/packages/data-schemas/src/methods/spendTokens.ts
@@ -1,5 +1,5 @@
-import logger from '~/config/winston';
 import type { TxData, TransactionResult } from './transaction';
+import logger from '~/config/winston';
 
 /** Base transaction context passed by callers — does not include fields added internally */
 export interface SpendTxData {
@@ -19,14 +19,29 @@ export function createSpendTokensMethods(
     createTransaction: (txData: TxData) => Promise<TransactionResult | undefined>;
     createStructuredTransaction: (txData: TxData) => Promise<TransactionResult | undefined>;
   },
-) {
+): {
+  spendTokens: (
+    txData: SpendTxData,
+    tokenUsage: { promptTokens?: number; completionTokens?: number },
+  ) => Promise<void>;
+  spendStructuredTokens: (
+    txData: SpendTxData,
+    tokenUsage: {
+      promptTokens?: { input?: number; write?: number; read?: number };
+      completionTokens?: number;
+    },
+  ) => Promise<{
+    prompt: TransactionResult | undefined;
+    completion: TransactionResult | undefined;
+  }>;
+} {
   /**
    * Creates up to two transactions to record the spending of tokens.
    */
   async function spendTokens(
     txData: SpendTxData,
     tokenUsage: { promptTokens?: number; completionTokens?: number },
-  ) {
+  ): Promise<void> {
     const { promptTokens, completionTokens } = tokenUsage;
     logger.debug(
       `[spendTokens] conversationId: ${txData.conversationId}${
@@ -81,7 +96,10 @@ export function createSpendTokensMethods(
       promptTokens?: { input?: number; write?: number; read?: number };
       completionTokens?: number;
     },
-  ) {
+  ): Promise<{
+    prompt: TransactionResult | undefined;
+    completion: TransactionResult | undefined;
+  }> {
     const { promptTokens, completionTokens } = tokenUsage;
     logger.debug(
       `[spendStructuredTokens] conversationId: ${txData.conversationId}${
diff --git a/packages/data-schemas/src/methods/systemGrant.ts b/packages/data-schemas/src/methods/systemGrant.ts
index 2e8eea80cfe..c3ef6100af7 100644
--- a/packages/data-schemas/src/methods/systemGrant.ts
+++ b/packages/data-schemas/src/methods/systemGrant.ts
@@ -46,7 +46,88 @@ function getParentCapabilities(capability: string): string[] {
   return parents;
 }
 
-export function createSystemGrantMethods(mongoose: typeof import('mongoose')) {
+export function createSystemGrantMethods(mongoose: typeof import('mongoose')): {
+  grantCapability: (
+    {
+      principalType,
+      principalId,
+      capability,
+      tenantId,
+      grantedBy,
+    }: {
+      principalType: PrincipalType;
+      principalId: string | Types.ObjectId;
+      capability: SystemCapability;
+      tenantId?: string;
+      grantedBy?: string | Types.ObjectId;
+    },
+    session?: ClientSession,
+  ) => Promise<ISystemGrant | null>;
+  seedSystemGrants: () => Promise<void>;
+  revokeCapability: (
+    {
+      principalType,
+      principalId,
+      capability,
+      tenantId,
+    }: {
+      principalType: PrincipalType;
+      principalId: string | Types.ObjectId;
+      capability: SystemCapability;
+      tenantId?: string;
+    },
+    session?: ClientSession,
+  ) => Promise<void>;
+  hasCapabilityForPrincipals: ({
+    principals,
+    capability,
+    tenantId,
+  }: {
+    principals: Array<{ principalType: PrincipalType; principalId?: string | Types.ObjectId }>;
+    capability: SystemCapability;
+    tenantId?: string;
+  }) => Promise<boolean>;
+  getHeldCapabilities: ({
+    principals,
+    capabilities,
+    tenantId,
+  }: {
+    principals: Array<{ principalType: PrincipalType; principalId?: string | Types.ObjectId }>;
+    capabilities: SystemCapability[];
+    tenantId?: string;
+  }) => Promise<Set<SystemCapability>>;
+  listGrants: (options?: {
+    tenantId?: string;
+    principalTypes?: PrincipalType[];
+    limit?: number;
+    offset?: number;
+  }) => Promise<ISystemGrant[]>;
+  countGrants: (options?: {
+    tenantId?: string;
+    principalTypes?: PrincipalType[];
+  }) => Promise<number>;
+  getCapabilitiesForPrincipal: ({
+    principalType,
+    principalId,
+    tenantId,
+  }: {
+    principalType: PrincipalType;
+    principalId: string | Types.ObjectId;
+    tenantId?: string;
+  }) => Promise<ISystemGrant[]>;
+  getCapabilitiesForPrincipals: ({
+    principals,
+    tenantId,
+  }: {
+    principals: Array<{ principalType: PrincipalType; principalId: string | Types.ObjectId }>;
+    tenantId?: string;
+  }) => Promise<ISystemGrant[]>;
+  deleteGrantsForPrincipal: (
+    principalType: PrincipalType,
+    principalId: string | Types.ObjectId,
+    options?: { tenantId?: string; session?: ClientSession },
+  ) => Promise<void>;
+} {
   function tenantCondition(tenantId?: string): FilterQuery<ISystemGrant> {
     return tenantId != null
       ? { $and: [{ $or: [{ tenantId }, { tenantId: { $exists: false } }] }] }
diff --git a/packages/data-schemas/src/methods/token.spec.ts b/packages/data-schemas/src/methods/token.spec.ts
index 87c3916bf8a..7e7c44c1855 100644
--- a/packages/data-schemas/src/methods/token.spec.ts
+++ b/packages/data-schemas/src/methods/token.spec.ts
@@ -149,6 +149,35 @@ describe('Token Methods - Detailed Tests', () => {
       expect(found?.userId.toString()).toBe(user2Id.toString());
     });
 
+    test('should find tokens with explicitly absent optional fields', async () => {
+      const legacyUserId = new mongoose.Types.ObjectId();
+      await Token.create([
+        {
+          token: 'legacy-reset-token',
+          userId: legacyUserId,
+          createdAt: new Date(),
+          expiresAt: new Date(Date.now() + 3600000),
+        },
+        {
+          token: 'legacy-identified-token',
+          userId: legacyUserId,
+          identifier: 'oauth-legacy',
+          createdAt: new Date(),
+          expiresAt: new Date(Date.now() + 3600000),
+        },
+      ]);
+
+      const found = await methods.findToken({
+        userId: legacyUserId.toString(),
+        email: null,
+        identifier: null,
+        type: null,
+      });
+
+      expect(found).toBeDefined();
+      expect(found?.token).toBe('legacy-reset-token');
+    });
+
     test('should find token by identifier', async () => {
       const found = await methods.findToken({ identifier: 'oauth-123' });
 
@@ -551,6 +580,38 @@ describe('Token Methods - Detailed Tests', () => {
       expect(remainingTokens.find((t) => t.identifier === 'oauth-identifier-456')).toBeUndefined();
     });
 
+    test('should delete tokens matching an identifier pattern', async () => {
+      await Token.create([
+        {
+          token: 'action-access-token',
+          userId: oauthUserId,
+          type: 'oauth',
+          identifier: `${oauthUserId.toString()}:action-1`,
+          createdAt: new Date(),
+          expiresAt: new Date(Date.now() + 3600000),
+        },
+        {
+          token: 'other-action-token',
+          userId: oauthUserId,
+          type: 'oauth',
+          identifier: `${oauthUserId.toString()}:action-2`,
+          createdAt: new Date(),
+          expiresAt: new Date(Date.now() + 3600000),
+        },
+      ]);
+
+      const result = await methods.deleteTokens({
+        type: 'oauth',
+        identifier: /^[^:]+:action-1$/,
+      });
+
+      expect(result.deletedCount).toBe(1);
+
+      const remaining = await Token.find({ userId: oauthUserId, type: 'oauth' });
+      expect(remaining).toHaveLength(1);
+      expect(remaining[0].identifier).toBe(`${oauthUserId.toString()}:action-2`);
+    });
+
     test('should not delete tokens when undefined fields are passed', async () => {
       // This is the critical test case for the bug fix
       const result = await methods.deleteTokens({
@@ -566,6 +627,47 @@ describe('Token Methods - Detailed Tests', () => {
       expect(remainingTokens).toHaveLength(3);
     });
 
+    test('should delete only tokens with explicitly absent optional fields', async () => {
+      const legacyUserId = new mongoose.Types.ObjectId();
+      await Token.create([
+        {
+          token: 'legacy-reset-token',
+          userId: legacyUserId,
+          createdAt: new Date(),
+          expiresAt: new Date(Date.now() + 3600000),
+        },
+        {
+          token: 'legacy-identified-token',
+          userId: legacyUserId,
+          identifier: 'oauth-legacy',
+          createdAt: new Date(),
+          expiresAt: new Date(Date.now() + 3600000),
+        },
+        {
+          token: 'typed-reset-token',
+          userId: legacyUserId,
+          type: 'password_reset',
+          createdAt: new Date(),
+          expiresAt: new Date(Date.now() + 3600000),
+        },
+      ]);
+
+      const result = await methods.deleteTokens({
+        userId: legacyUserId.toString(),
+        email: null,
+        identifier: null,
+        type: null,
+      });
+
+      expect(result.deletedCount).toBe(1);
+
+      const remainingTokens = await Token.find({ userId: legacyUserId });
+      expect(remainingTokens).toHaveLength(2);
+      expect(remainingTokens.find((t) => t.token === 'legacy-reset-token')).toBeUndefined();
+      expect(remainingTokens.find((t) => t.token === 'legacy-identified-token')).toBeDefined();
+      expect(remainingTokens.find((t) => t.token === 'typed-reset-token')).toBeDefined();
+    });
+
     test('should only delete tokens matching ALL provided fields (AND semantics)', async () => {
       await Token.create({
         token: 'extra-user2-token',
diff --git a/packages/data-schemas/src/methods/token.ts b/packages/data-schemas/src/methods/token.ts
index a5de3d2a5df..412001cfa36 100644
--- a/packages/data-schemas/src/methods/token.ts
+++ b/packages/data-schemas/src/methods/token.ts
@@ -3,7 +3,12 @@ import { IToken, TokenCreateData, TokenQuery, TokenUpdateData, TokenDeleteResult
 import logger from '~/config/winston';
 
 // Factory function that takes mongoose instance and returns the methods
-export function createTokenMethods(mongoose: typeof import('mongoose')) {
+export function createTokenMethods(mongoose: typeof import('mongoose')): {
+  findToken: (query: TokenQuery, options?: QueryOptions) => Promise<IToken | null>;
+  createToken: (tokenData: TokenCreateData) => Promise<IToken>;
+  updateToken: (query: TokenQuery, updateData: TokenUpdateData) => Promise<IToken | null>;
+  deleteTokens: (query: TokenQuery) => Promise<TokenDeleteResult>;
+} {
   /**
    * Creates a new Token instance.
    */
@@ -61,7 +66,8 @@ export function createTokenMethods(mongoose: typeof import('mongoose')) {
         conditions.push({ token: query.token });
       }
       if (query.email !== undefined) {
-        conditions.push({ email: query.email.trim().toLowerCase() });
+        const email = query.email === null ? null : query.email.trim().toLowerCase();
+        conditions.push({ email });
       }
       if (query.type !== undefined) {
         conditions.push({ type: query.type });
@@ -98,13 +104,14 @@ export function createTokenMethods(mongoose: typeof import('mongoose')) {
       if (query.token) {
         conditions.push({ token: query.token });
       }
-      if (query.email) {
-        conditions.push({ email: query.email.trim().toLowerCase() });
+      if (query.email !== undefined) {
+        const email = query.email === null ? null : query.email.trim().toLowerCase();
+        conditions.push({ email });
       }
-      if (query.type) {
+      if (query.type !== undefined) {
         conditions.push({ type: query.type });
       }
-      if (query.identifier) {
+      if (query.identifier !== undefined) {
         conditions.push({ identifier: query.identifier });
       }
 
diff --git a/packages/data-schemas/src/methods/toolCall.ts b/packages/data-schemas/src/methods/toolCall.ts
index 49dfb627e0f..5faba98a3bf 100644
--- a/packages/data-schemas/src/methods/toolCall.ts
+++ b/packages/data-schemas/src/methods/toolCall.ts
@@ -7,11 +7,76 @@ interface IToolCallData {
   [key: string]: unknown;
 }
 
-export function createToolCallMethods(mongoose: typeof import('mongoose')) {
+export function createToolCallMethods(mongoose: typeof import('mongoose')): {
+  createToolCall: (toolCallData: IToolCallData) => Promise<IToolCallData>;
+  updateToolCall: (
+    id: string,
+    updateData: Partial<IToolCallData>,
+  ) => Promise<
+    | (import('mongoose').FlattenMaps<{
+        [x: string]: unknown;
+        messageId?: string | undefined;
+        conversationId?: string | undefined;
+        user?: string | undefined;
+      }> & {
+        _id: import('mongoose').Types.ObjectId;
+      } & {
+        __v: number;
+      })
+    | null
+  >;
+  deleteToolCalls: (
+    userId: string,
+    conversationId?: string,
+  ) => Promise<import('mongodb').DeleteResult>;
+  getToolCallById: (id: string) => Promise<
+    | (import('mongoose').FlattenMaps<{
+        [x: string]: unknown;
+        messageId?: string | undefined;
+        conversationId?: string | undefined;
+        user?: string | undefined;
+      }> & {
+        _id: import('mongoose').Types.ObjectId;
+      } & {
+        __v: number;
+      })
+    | null
+  >;
+  getToolCallsByConvo: (
+    conversationId: string,
+    userId: string,
+  ) => Promise<
+    (import('mongoose').FlattenMaps<{
+      [x: string]: unknown;
+      messageId?: string | undefined;
+      conversationId?: string | undefined;
+      user?: string | undefined;
+    }> & {
+      _id: import('mongoose').Types.ObjectId;
+    } & {
+      __v: number;
+    })[]
+  >;
+  getToolCallsByMessage: (
+    messageId: string,
+    userId: string,
+  ) => Promise<
+    (import('mongoose').FlattenMaps<{
+      [x: string]: unknown;
+      messageId?: string | undefined;
+      conversationId?: string | undefined;
+      user?: string | undefined;
+    }> & {
+      _id: import('mongoose').Types.ObjectId;
+    } & {
+      __v: number;
+    })[]
+  >;
+} {
   /**
    * Create a new tool call
    */
-  async function createToolCall(toolCallData: IToolCallData) {
+  async function createToolCall(toolCallData: IToolCallData): Promise<IToolCallData> {
     try {
       const ToolCall = mongoose.models.ToolCall as Model<IToolCallData>;
       return await ToolCall.create(toolCallData);
@@ -23,7 +88,19 @@ export function createToolCallMethods(mongoose: typeof import('mongoose')) {
   /**
    * Get a tool call by ID
    */
-  async function getToolCallById(id: string) {
+  async function getToolCallById(id: string): Promise<
+    | (import('mongoose').FlattenMaps<{
+        [x: string]: unknown;
+        messageId?: string | undefined;
+        conversationId?: string | undefined;
+        user?: string | undefined;
+      }> & {
+        _id: import('mongoose').Types.ObjectId;
+      } & {
+        __v: number;
+      })
+    | null
+  > {
     try {
       const ToolCall = mongoose.models.ToolCall as Model<IToolCallData>;
       return await ToolCall.findById(id).lean();
@@ -35,7 +112,21 @@ export function createToolCallMethods(mongoose: typeof import('mongoose')) {
   /**
    * Get tool calls by message ID and user
    */
-  async function getToolCallsByMessage(messageId: string, userId: string) {
+  async function getToolCallsByMessage(
+    messageId: string,
+    userId: string,
+  ): Promise<
+    (import('mongoose').FlattenMaps<{
+      [x: string]: unknown;
+      messageId?: string | undefined;
+      conversationId?: string | undefined;
+      user?: string | undefined;
+    }> & {
+      _id: import('mongoose').Types.ObjectId;
+    } & {
+      __v: number;
+    })[]
+  > {
     try {
       const ToolCall = mongoose.models.ToolCall as Model<IToolCallData>;
       return await ToolCall.find({ messageId, user: userId }).lean();
@@ -47,7 +138,21 @@ export function createToolCallMethods(mongoose: typeof import('mongoose')) {
   /**
    * Get tool calls by conversation ID and user
    */
-  async function getToolCallsByConvo(conversationId: string, userId: string) {
+  async function getToolCallsByConvo(
+    conversationId: string,
+    userId: string,
+  ): Promise<
+    (import('mongoose').FlattenMaps<{
+      [x: string]: unknown;
+      messageId?: string | undefined;
+      conversationId?: string | undefined;
+      user?: string | undefined;
+    }> & {
+      _id: import('mongoose').Types.ObjectId;
+    } & {
+      __v: number;
+    })[]
+  > {
     try {
       const ToolCall = mongoose.models.ToolCall as Model<IToolCallData>;
       return await ToolCall.find({ conversationId, user: userId }).lean();
@@ -59,7 +164,22 @@ export function createToolCallMethods(mongoose: typeof import('mongoose')) {
   /**
    * Update a tool call
    */
-  async function updateToolCall(id: string, updateData: Partial<IToolCallData>) {
+  async function updateToolCall(
+    id: string,
+    updateData: Partial<IToolCallData>,
+  ): Promise<
+    | (import('mongoose').FlattenMaps<{
+        [x: string]: unknown;
+        messageId?: string | undefined;
+        conversationId?: string | undefined;
+        user?: string | undefined;
+      }> & {
+        _id: import('mongoose').Types.ObjectId;
+      } & {
+        __v: number;
+      })
+    | null
+  > {
     try {
       const ToolCall = mongoose.models.ToolCall as Model<IToolCallData>;
       return await ToolCall.findByIdAndUpdate(id, updateData, { new: true }).lean();
@@ -71,7 +191,10 @@ export function createToolCallMethods(mongoose: typeof import('mongoose')) {
   /**
    * Delete tool calls by user and optionally conversation
    */
-  async function deleteToolCalls(userId: string, conversationId?: string) {
+  async function deleteToolCalls(
+    userId: string,
+    conversationId?: string,
+  ): Promise<import('mongodb').DeleteResult> {
     try {
       const ToolCall = mongoose.models.ToolCall as Model<IToolCallData>;
       const query: Record<string, string> = { user: userId };
diff --git a/packages/data-schemas/src/methods/transaction.spec.ts b/packages/data-schemas/src/methods/transaction.spec.ts
index 176e7faef8e..badfdaf0146 100644
--- a/packages/data-schemas/src/methods/transaction.spec.ts
+++ b/packages/data-schemas/src/methods/transaction.spec.ts
@@ -1,9 +1,9 @@
 import mongoose from 'mongoose';
 import { MongoMemoryServer } from 'mongodb-memory-server';
+import type { IBalance } from '..';
 import type { ITransaction } from '~/schema/transaction';
 import type { TxData } from './transaction';
-import type { IBalance } from '..';
-import { createTxMethods, tokenValues, premiumTokenValues } from './tx';
+import { createTxMethods, tokenValues, premiumTokenValues, defaultRate } from './tx';
 import { matchModelName, findMatchingPattern } from './test-helpers';
 import { createSpendTokensMethods } from './spendTokens';
 import { createTransactionMethods } from './transaction';
@@ -616,6 +616,36 @@ describe('Transactions Config Tests', () => {
   });
 });
 
+describe('Partial endpointTokenConfig fallback', () => {
+  const endpointTokenConfig = {
+    'custom-model': { prompt: 1.5, completion: 4.5, read: 0.3 },
+  };
+
+  test('uses override rates for a listed model', () => {
+    expect(getMultiplier({ model: 'custom-model', tokenType: 'prompt', endpointTokenConfig })).toBe(
+      1.5,
+    );
+    expect(
+      getCacheMultiplier({ model: 'custom-model', cacheType: 'read', endpointTokenConfig }),
+    ).toBe(0.3);
+  });
+
+  test('falls back to standard tables for a model absent from the override', () => {
+    const fallbackPrompt = getMultiplier({ model: 'gpt-4', tokenType: 'prompt' });
+    expect(getMultiplier({ model: 'gpt-4', tokenType: 'prompt', endpointTokenConfig })).toBe(
+      fallbackPrompt,
+    );
+    expect(getMultiplier({ model: 'gpt-4', tokenType: 'prompt', endpointTokenConfig })).not.toBe(
+      defaultRate,
+    );
+
+    const fallbackCacheRead = getCacheMultiplier({ model: 'claude-3-5-sonnet', cacheType: 'read' });
+    expect(
+      getCacheMultiplier({ model: 'claude-3-5-sonnet', cacheType: 'read', endpointTokenConfig }),
+    ).toBe(fallbackCacheRead);
+  });
+});
+
 describe('calculateTokenValue Edge Cases', () => {
   test('should derive multiplier from model when valueKey is not provided', async () => {
     const userId = new mongoose.Types.ObjectId();
diff --git a/packages/data-schemas/src/methods/transaction.ts b/packages/data-schemas/src/methods/transaction.ts
index b71e111a799..bfd5376f713 100644
--- a/packages/data-schemas/src/methods/transaction.ts
+++ b/packages/data-schemas/src/methods/transaction.ts
@@ -1,7 +1,7 @@
-import logger from '~/config/winston';
 import type { FilterQuery, Model, Types } from 'mongoose';
 import type { IBalance, IBalanceUpdate, TransactionData } from '~/types';
 import type { ITransaction } from '~/schema/transaction';
+import logger from '~/config/winston';
 
 const cancelRate = 1.15;
 
@@ -70,7 +70,36 @@ export function createTransactionMethods(
     getMultiplier: (params: MultiplierParams) => number;
     getCacheMultiplier: (params: CacheMultiplierParams) => number | null;
   },
-) {
+): {
+  updateBalance: ({
+    user,
+    incrementValue,
+    setValues,
+  }: {
+    user: string;
+    incrementValue: number;
+    setValues?: IBalanceUpdate;
+  }) => Promise<IBalance>;
+  bulkInsertTransactions: (docs: TransactionData[]) => Promise<void>;
+  findBalanceByUser: (user: string) => Promise<IBalance | null>;
+  upsertBalanceFields: (user: string, fields: IBalanceUpdate) => Promise<IBalance | null>;
+  getTransactions: (filter: FilterQuery<ITransaction>) => Promise<ITransaction[]>;
+  deleteTransactions: (
+    filter: FilterQuery<ITransaction>,
+  ) => Promise<import('mongodb').DeleteResult>;
+  deleteBalances: (filter: FilterQuery<IBalance>) => Promise<import('mongodb').DeleteResult>;
+  createTransaction: (_txData: TxData) => Promise<TransactionResult | undefined>;
+  createAutoRefillTransaction: (txData: TxData) => Promise<
+    | {
+        rate: number;
+        user: string;
+        balance: number;
+        transaction: ITransaction;
+      }
+    | undefined
+  >;
+  createStructuredTransaction: (_txData: TxData) => Promise<TransactionResult | undefined>;
+} {
   /** Calculate and set the tokenValue for a transaction */
   function calculateTokenValue(txn: InternalTxDoc) {
     const { valueKey, tokenType, model, endpointTokenConfig, inputTokenCount } = txn;
@@ -265,7 +294,15 @@ export function createTransactionMethods(
   /**
    * Creates an auto-refill transaction that also updates balance.
    */
-  async function createAutoRefillTransaction(txData: TxData) {
+  async function createAutoRefillTransaction(txData: TxData): Promise<
+    | {
+        rate: number;
+        user: string;
+        balance: number;
+        transaction: ITransaction;
+      }
+    | undefined
+  > {
     if (txData.rawAmount != null && isNaN(txData.rawAmount)) {
       return;
     }
@@ -371,10 +408,10 @@ export function createTransactionMethods(
   /**
    * Queries and retrieves transactions based on a given filter.
    */
-  async function getTransactions(filter: FilterQuery<ITransaction>) {
+  async function getTransactions(filter: FilterQuery<ITransaction>): Promise<ITransaction[]> {
     try {
       const Transaction = mongoose.models.Transaction;
-      return await Transaction.find(filter).lean();
+      return await Transaction.find(filter).lean<ITransaction[]>();
     } catch (error) {
       logger.error('Error querying transactions:', error);
       throw error;
@@ -401,13 +438,17 @@ export function createTransactionMethods(
   }
 
   /** Deletes transactions matching a filter. */
-  async function deleteTransactions(filter: FilterQuery<ITransaction>) {
+  async function deleteTransactions(
+    filter: FilterQuery<ITransaction>,
+  ): Promise<import('mongodb').DeleteResult> {
     const Transaction = mongoose.models.Transaction;
     return Transaction.deleteMany(filter);
   }
 
   /** Deletes balance records matching a filter. */
-  async function deleteBalances(filter: FilterQuery<IBalance>) {
+  async function deleteBalances(
+    filter: FilterQuery<IBalance>,
+  ): Promise<import('mongodb').DeleteResult> {
     const Balance = mongoose.models.Balance as Model<IBalance>;
     return Balance.deleteMany(filter);
   }
diff --git a/packages/data-schemas/src/methods/tx.spec.ts b/packages/data-schemas/src/methods/tx.spec.ts
index 95882c9f80b..4c22218a2d4 100644
--- a/packages/data-schemas/src/methods/tx.spec.ts
+++ b/packages/data-schemas/src/methods/tx.spec.ts
@@ -1,5 +1,4 @@
 /** Note: No hard-coded values should be used in this file. */
-import { matchModelName, findMatchingPattern } from './test-helpers';
 import { EModelEndpoint } from 'librechat-data-provider';
 import {
   createTxMethods,
@@ -8,6 +7,7 @@ import {
   premiumTokenValues,
   defaultRate,
 } from './tx';
+import { matchModelName, findMatchingPattern } from './test-helpers';
 
 const { getValueKey, getMultiplier, getPremiumRate, getCacheMultiplier } = createTxMethods(
   {} as typeof import('mongoose'),
@@ -56,11 +56,19 @@ describe('getValueKey', () => {
 
   it('should return "gpt-5.3" for model name containing "gpt-5.3"', () => {
     expect(getValueKey('gpt-5.3')).toBe('gpt-5.3');
-    expect(getValueKey('gpt-5.3-chat-latest')).toBe('gpt-5.3');
     expect(getValueKey('gpt-5.3-codex')).toBe('gpt-5.3');
     expect(getValueKey('openai/gpt-5.3')).toBe('gpt-5.3');
   });
 
+  it('should return explicit keys for chat-latest aliases', () => {
+    expect(getValueKey('chat-latest')).toBe('chat-latest');
+    expect(getValueKey('openai/chat-latest')).toBe('chat-latest');
+    expect(getValueKey('gpt-5-chat-latest')).toBe('gpt-5-chat-latest');
+    expect(getValueKey('gpt-5.1-chat-latest')).toBe('gpt-5.1-chat-latest');
+    expect(getValueKey('gpt-5.2-chat-latest')).toBe('gpt-5.2-chat-latest');
+    expect(getValueKey('gpt-5.3-chat-latest')).toBe('gpt-5.3-chat-latest');
+  });
+
   it('should return "gpt-5.4" for model name containing "gpt-5.4"', () => {
     expect(getValueKey('gpt-5.4')).toBe('gpt-5.4');
     expect(getValueKey('gpt-5.4-thinking')).toBe('gpt-5.4');
@@ -2377,6 +2385,94 @@ describe('Claude Model Tests', () => {
       cacheTokenValues['claude-opus-4-8'].read,
     );
   });
+
+  it('should return correct prompt and completion rates for Claude Fable 5', () => {
+    expect(getMultiplier({ model: 'claude-fable-5', tokenType: 'prompt' })).toBe(
+      tokenValues['claude-fable-5'].prompt,
+    );
+    expect(getMultiplier({ model: 'claude-fable-5', tokenType: 'completion' })).toBe(
+      tokenValues['claude-fable-5'].completion,
+    );
+  });
+
+  it('should pin Claude Fable 5 pricing to $10 / $50 per MTok', () => {
+    expect(tokenValues['claude-fable-5']).toEqual({ prompt: 10, completion: 50 });
+  });
+
+  it('should handle Claude Fable 5 model name variations', () => {
+    const modelVariations = [
+      'claude-fable-5',
+      'claude-fable-5-20260609',
+      'claude-fable-5-latest',
+      'anthropic/claude-fable-5',
+      'claude-fable-5/anthropic',
+      'anthropic.claude-fable-5',
+    ];
+
+    modelVariations.forEach((model) => {
+      const valueKey = getValueKey(model);
+      expect(valueKey).toBe('claude-fable-5');
+      expect(getMultiplier({ model, tokenType: 'prompt' })).toBe(
+        tokenValues['claude-fable-5'].prompt,
+      );
+      expect(getMultiplier({ model, tokenType: 'completion' })).toBe(
+        tokenValues['claude-fable-5'].completion,
+      );
+    });
+  });
+
+  it('should return correct cache rates for Claude Fable 5', () => {
+    expect(getCacheMultiplier({ model: 'claude-fable-5', cacheType: 'write' })).toBe(
+      cacheTokenValues['claude-fable-5'].write,
+    );
+    expect(getCacheMultiplier({ model: 'claude-fable-5', cacheType: 'read' })).toBe(
+      cacheTokenValues['claude-fable-5'].read,
+    );
+  });
+
+  it('should return correct prompt and completion rates for Claude Mythos 5', () => {
+    expect(getMultiplier({ model: 'claude-mythos-5', tokenType: 'prompt' })).toBe(
+      tokenValues['claude-mythos-5'].prompt,
+    );
+    expect(getMultiplier({ model: 'claude-mythos-5', tokenType: 'completion' })).toBe(
+      tokenValues['claude-mythos-5'].completion,
+    );
+  });
+
+  it('should pin Claude Mythos 5 pricing to $10 / $50 per MTok', () => {
+    expect(tokenValues['claude-mythos-5']).toEqual({ prompt: 10, completion: 50 });
+  });
+
+  it('should handle Claude Mythos 5 model name variations', () => {
+    const modelVariations = [
+      'claude-mythos-5',
+      'claude-mythos-5-20260609',
+      'claude-mythos-5-latest',
+      'anthropic/claude-mythos-5',
+      'claude-mythos-5/anthropic',
+      'anthropic.claude-mythos-5',
+    ];
+
+    modelVariations.forEach((model) => {
+      const valueKey = getValueKey(model);
+      expect(valueKey).toBe('claude-mythos-5');
+      expect(getMultiplier({ model, tokenType: 'prompt' })).toBe(
+        tokenValues['claude-mythos-5'].prompt,
+      );
+      expect(getMultiplier({ model, tokenType: 'completion' })).toBe(
+        tokenValues['claude-mythos-5'].completion,
+      );
+    });
+  });
+
+  it('should return correct cache rates for Claude Mythos 5', () => {
+    expect(getCacheMultiplier({ model: 'claude-mythos-5', cacheType: 'write' })).toBe(
+      cacheTokenValues['claude-mythos-5'].write,
+    );
+    expect(getCacheMultiplier({ model: 'claude-mythos-5', cacheType: 'read' })).toBe(
+      cacheTokenValues['claude-mythos-5'].read,
+    );
+  });
 });
 
 describe('Premium Token Pricing', () => {
@@ -2401,6 +2497,8 @@ describe('Premium Token Pricing', () => {
       'claude-opus-4-6',
       'claude-opus-4-7',
       'claude-opus-4-8',
+      'claude-fable-5',
+      'claude-mythos-5',
       'claude-sonnet-4-6',
     ];
     claudeModels.forEach((model) => {
diff --git a/packages/data-schemas/src/methods/tx.ts b/packages/data-schemas/src/methods/tx.ts
index fdd2ace8c3e..3e77007b9fe 100644
--- a/packages/data-schemas/src/methods/tx.ts
+++ b/packages/data-schemas/src/methods/tx.ts
@@ -129,8 +129,16 @@ export const tokenValues: Record<string, { prompt: number; completion: number }>
     'gpt-5.2': { prompt: 1.75, completion: 14 },
     'gpt-5.3': { prompt: 1.75, completion: 14 },
     'gpt-5.4': { prompt: 2.5, completion: 15 },
-    // TODO: gpt-5.4-pro pricing not yet officially published — verify before release
-    'gpt-5.4-pro': { prompt: 5, completion: 30 },
+    'gpt-5.4-pro': { prompt: 30, completion: 180 },
+    'gpt-5.4-mini': { prompt: 0.75, completion: 4.5 },
+    'gpt-5.4-nano': { prompt: 0.2, completion: 1.25 },
+    'gpt-5.5': { prompt: 5, completion: 30 },
+    'gpt-5.5-pro': { prompt: 30, completion: 180 },
+    'chat-latest': { prompt: 5, completion: 30 },
+    'gpt-5-chat-latest': { prompt: 1.25, completion: 10 },
+    'gpt-5.1-chat-latest': { prompt: 1.25, completion: 10 },
+    'gpt-5.2-chat-latest': { prompt: 1.75, completion: 14 },
+    'gpt-5.3-chat-latest': { prompt: 1.75, completion: 14 },
     'gpt-5-nano': { prompt: 0.05, completion: 0.4 },
     'gpt-5-mini': { prompt: 0.25, completion: 2 },
     'gpt-5-pro': { prompt: 15, completion: 120 },
@@ -159,6 +167,8 @@ export const tokenValues: Record<string, { prompt: number; completion: number }>
     'claude-opus-4-6': { prompt: 5, completion: 25 },
     'claude-opus-4-7': { prompt: 5, completion: 25 },
     'claude-opus-4-8': { prompt: 5, completion: 25 },
+    'claude-fable-5': { prompt: 10, completion: 50 },
+    'claude-mythos-5': { prompt: 10, completion: 50 },
     'claude-sonnet-4': { prompt: 3, completion: 15 },
     'claude-sonnet-4-5': { prompt: 3, completion: 15 },
     'claude-sonnet-4-6': { prompt: 3, completion: 15 },
@@ -296,6 +306,8 @@ export const cacheTokenValues: Record<string, { write: number; read: number }> =
   'claude-opus-4-6': { write: 6.25, read: 0.5 },
   'claude-opus-4-7': { write: 6.25, read: 0.5 },
   'claude-opus-4-8': { write: 6.25, read: 0.5 },
+  'claude-fable-5': { write: 12.5, read: 1 },
+  'claude-mythos-5': { write: 12.5, read: 1 },
   'gpt-4o': { write: 2.5, read: 1.25 },
   'gpt-4o-mini': { write: 0.15, read: 0.075 },
   'gpt-4.1': { write: 2, read: 0.5 },
@@ -306,6 +318,14 @@ export const cacheTokenValues: Record<string, { write: number; read: number }> =
   'gpt-5.2': { write: 1.75, read: 0.175 },
   'gpt-5.3': { write: 1.75, read: 0.175 },
   'gpt-5.4': { write: 2.5, read: 0.25 },
+  'gpt-5.4-mini': { write: 0.75, read: 0.075 },
+  'gpt-5.4-nano': { write: 0.2, read: 0.02 },
+  'gpt-5.5': { write: 5, read: 0.5 },
+  'chat-latest': { write: 5, read: 0.5 },
+  'gpt-5-chat-latest': { write: 1.25, read: 0.125 },
+  'gpt-5.1-chat-latest': { write: 1.25, read: 0.125 },
+  'gpt-5.2-chat-latest': { write: 1.75, read: 0.175 },
+  'gpt-5.3-chat-latest': { write: 1.75, read: 0.175 },
   'gpt-5-mini': { write: 0.25, read: 0.025 },
   'gpt-5-nano': { write: 0.05, read: 0.005 },
   o1: { write: 15, read: 7.5 },
@@ -344,9 +364,74 @@ export const premiumTokenValues: Record<
   { threshold: number; prompt: number; completion: number }
 > = {
   'gemini-3.1': { threshold: 200000, prompt: 4, completion: 18 },
+  'gpt-5.4': { threshold: 272000, prompt: 5, completion: 22.5 },
+  'gpt-5.4-pro': { threshold: 272000, prompt: 60, completion: 270 },
+  'gpt-5.5': { threshold: 272000, prompt: 10, completion: 45 },
+  'gpt-5.5-pro': { threshold: 272000, prompt: 60, completion: 270 },
 };
 
-export function createTxMethods(_mongoose: typeof import('mongoose'), txDeps: TxDeps) {
+export function createTxMethods(
+  _mongoose: typeof import('mongoose'),
+  txDeps: TxDeps,
+): {
+  tokenValues: Record<
+    string,
+    {
+      prompt: number;
+      completion: number;
+    }
+  >;
+  premiumTokenValues: Record<
+    string,
+    {
+      threshold: number;
+      prompt: number;
+      completion: number;
+    }
+  >;
+  getValueKey: (model: string, endpoint?: string) => string | undefined;
+  getMultiplier: ({
+    model,
+    valueKey,
+    endpoint,
+    tokenType,
+    inputTokenCount,
+    endpointTokenConfig,
+  }: {
+    model?: string;
+    valueKey?: string;
+    endpoint?: string;
+    tokenType?: 'prompt' | 'completion';
+    inputTokenCount?: number;
+    endpointTokenConfig?: Record<string, Record<string, number>>;
+  }) => number;
+  getPremiumRate: (
+    valueKey: string,
+    tokenType: string,
+    inputTokenCount?: number | null,
+  ) => number | null;
+  getCacheMultiplier: ({
+    valueKey,
+    cacheType,
+    model,
+    endpoint,
+    endpointTokenConfig,
+  }: {
+    valueKey?: string;
+    cacheType?: 'write' | 'read';
+    model?: string;
+    endpoint?: string;
+    endpointTokenConfig?: Record<string, Record<string, number>>;
+  }) => number | null;
+  defaultRate: number;
+  cacheTokenValues: Record<
+    string,
+    {
+      write: number;
+      read: number;
+    }
+  >;
+} {
   const { matchModelName, findMatchingPattern } = txDeps;
 
   /**
@@ -425,7 +510,13 @@ export function createTxMethods(_mongoose: typeof import('mongoose'), txDeps: Tx
     endpointTokenConfig?: Record<string, Record<string, number>>;
   }): number {
     if (endpointTokenConfig && model) {
-      return endpointTokenConfig?.[model]?.[tokenType as string] ?? defaultRate;
+      const modelConfig = endpointTokenConfig[model];
+      /** A partial override only prices the models it lists; others fall
+       *  through to the standard tables so billing matches the advertised
+       *  token config instead of charging defaultRate */
+      if (modelConfig) {
+        return modelConfig[tokenType as string] ?? defaultRate;
+      }
     }
 
     if (valueKey && tokenType) {
@@ -470,7 +561,12 @@ export function createTxMethods(_mongoose: typeof import('mongoose'), txDeps: Tx
     endpointTokenConfig?: Record<string, Record<string, number>>;
   }): number | null {
     if (endpointTokenConfig && model) {
-      return endpointTokenConfig?.[model]?.[cacheType as string] ?? null;
+      const modelConfig = endpointTokenConfig[model];
+      /** Models absent from a partial override fall through to standard
+       *  cache rates rather than reporting no cache pricing */
+      if (modelConfig) {
+        return modelConfig[cacheType as string] ?? null;
+      }
     }
 
     if (valueKey && cacheType) {
diff --git a/packages/data-schemas/src/methods/user.ts b/packages/data-schemas/src/methods/user.ts
index 7573a48f6de..56ba50fae4e 100644
--- a/packages/data-schemas/src/methods/user.ts
+++ b/packages/data-schemas/src/methods/user.ts
@@ -5,10 +5,108 @@ import { escapeRegExp } from '~/utils/string';
 import { signPayload } from '~/crypto';
 
 /** Default JWT session expiry: 15 minutes in milliseconds */
-export const DEFAULT_SESSION_EXPIRY = 1000 * 60 * 15;
+export const DEFAULT_SESSION_EXPIRY: number = 1000 * 60 * 15;
 
 /** Factory function that takes mongoose instance and returns the methods */
-export function createUserMethods(mongoose: typeof import('mongoose')) {
+export function createUserMethods(mongoose: typeof import('mongoose')): {
+  findUser: (
+    searchCriteria: FilterQuery<IUser>,
+    fieldsToSelect?: string | string[] | null,
+  ) => Promise<IUser | null>;
+  findUsers: (
+    searchCriteria: FilterQuery<IUser>,
+    fieldsToSelect?: string | string[] | null,
+    options?: { limit?: number; offset?: number; sort?: Record<string, 1 | -1> },
+  ) => Promise<IUser[]>;
+  countUsers: (filter?: FilterQuery<IUser>) => Promise<number>;
+  createUser: (
+    data: CreateUserRequest,
+    balanceConfig?: BalanceConfig,
+    disableTTL?: boolean,
+    returnUser?: boolean,
+  ) => Promise<mongoose.Types.ObjectId | Partial<IUser>>;
+  updateUser: (userId: string, updateData: Partial<IUser>) => Promise<IUser | null>;
+  searchUsers: ({
+    searchPattern,
+    limit,
+    fieldsToSelect,
+  }: {
+    searchPattern: string;
+    limit?: number;
+    fieldsToSelect?: string | string[] | null;
+  }) => Promise<
+    {
+      _id: mongoose.Types.ObjectId;
+      id: string;
+      name?: string;
+      username?: string;
+      email: string;
+      emailVerified: boolean;
+      password?: string;
+      avatar?: string;
+      provider: string;
+      role?: string;
+      googleId?: string;
+      facebookId?: string;
+      openidId?: string;
+      samlId?: string;
+      ldapId?: string;
+      githubId?: string;
+      discordId?: string;
+      appleId?: string;
+      plugins?: string[];
+      openidIssuer?: string;
+      twoFactorEnabled?: boolean;
+      totpSecret?: string;
+      backupCodes?: Array<{
+        codeHash: string;
+        used: boolean;
+        usedAt?: Date | null;
+      }>;
+      pendingTotpSecret?: string;
+      pendingBackupCodes?: Array<{
+        codeHash: string;
+        used: boolean;
+        usedAt?: Date | null;
+      }>;
+      refreshToken?: Array<{
+        refreshToken: string;
+      }>;
+      expiresAt?: Date;
+      termsAccepted?: boolean;
+      personalization?: {
+        memories?: boolean;
+      };
+      favorites?: import('librechat-data-provider').TUserFavorite[];
+      skillStates?: Record<string, boolean>;
+      createdAt?: Date;
+      updatedAt?: Date;
+      idOnTheSource?: string;
+      tenantId?: string;
+      federatedTokens?: import('~/types').OIDCTokens;
+      openidTokens?: import('~/types').OIDCTokens;
+      $locals: Record<string, unknown>;
+      $op: 'save' | 'validate' | 'remove' | null;
+      $where: Record<string, unknown>;
+      baseModelName?: string;
+      collection: mongoose.Collection;
+      db: mongoose.Connection;
+      errors?: mongoose.Error.ValidationError;
+      isNew: boolean;
+      schema: mongoose.Schema;
+    }[]
+  >;
+  getUserById: (userId: string, fieldsToSelect?: string | string[] | null) => Promise<IUser | null>;
+  generateToken: (user: IUser, expiresIn?: number) => Promise<string>;
+  deleteUserById: (userId: string) => Promise<UserDeleteResult>;
+  updateUserPlugins: (
+    userId: string,
+    plugins: string[] | undefined,
+    pluginKey: string,
+    action: 'install' | 'uninstall',
+  ) => Promise<IUser | null>;
+  toggleUserMemories: (userId: string, memoriesEnabled: boolean) => Promise<IUser | null>;
+} {
   /**
    * Normalizes email fields in search criteria to lowercase and trimmed.
    * Handles both direct email fields and $or arrays containing email conditions.
@@ -255,7 +353,68 @@ export function createUserMethods(mongoose: typeof import('mongoose')) {
     searchPattern: string;
     limit?: number;
     fieldsToSelect?: string | string[] | null;
-  }) {
+  }): Promise<
+    {
+      _id: mongoose.Types.ObjectId;
+      id: string;
+      name?: string;
+      username?: string;
+      email: string;
+      emailVerified: boolean;
+      password?: string;
+      avatar?: string;
+      provider: string;
+      role?: string;
+      googleId?: string;
+      facebookId?: string;
+      openidId?: string;
+      samlId?: string;
+      ldapId?: string;
+      githubId?: string;
+      discordId?: string;
+      appleId?: string;
+      plugins?: string[];
+      openidIssuer?: string;
+      twoFactorEnabled?: boolean;
+      totpSecret?: string;
+      backupCodes?: Array<{
+        codeHash: string;
+        used: boolean;
+        usedAt?: Date | null;
+      }>;
+      pendingTotpSecret?: string;
+      pendingBackupCodes?: Array<{
+        codeHash: string;
+        used: boolean;
+        usedAt?: Date | null;
+      }>;
+      refreshToken?: Array<{
+        refreshToken: string;
+      }>;
+      expiresAt?: Date;
+      termsAccepted?: boolean;
+      personalization?: {
+        memories?: boolean;
+      };
+      favorites?: import('librechat-data-provider').TUserFavorite[];
+      skillStates?: Record<string, boolean>;
+      createdAt?: Date;
+      updatedAt?: Date;
+      idOnTheSource?: string;
+      tenantId?: string;
+      federatedTokens?: import('~/types').OIDCTokens;
+      openidTokens?: import('~/types').OIDCTokens;
+      $locals: Record<string, unknown>;
+      $op: 'save' | 'validate' | 'remove' | null;
+      $where: Record<string, unknown>;
+      baseModelName?: string;
+      collection: mongoose.Collection;
+      db: mongoose.Connection;
+      errors?: mongoose.Error.ValidationError;
+      isNew: boolean;
+      schema: mongoose.Schema;
+    }[]
+  > {
     if (!searchPattern || searchPattern.trim().length === 0) {
       return [];
     }
diff --git a/packages/data-schemas/src/methods/userGroup.ts b/packages/data-schemas/src/methods/userGroup.ts
index 31228066277..022f42d2eec 100644
--- a/packages/data-schemas/src/methods/userGroup.ts
+++ b/packages/data-schemas/src/methods/userGroup.ts
@@ -5,7 +5,117 @@ import type { Model, ClientSession, FilterQuery } from 'mongoose';
 import type { IGroup, IRole, IUser } from '~/types';
 import { escapeRegExp } from '~/utils/string';
 
-export function createUserGroupMethods(mongoose: typeof import('mongoose')) {
+export function createUserGroupMethods(mongoose: typeof import('mongoose')): {
+  findGroupById: (
+    groupId: string | Types.ObjectId,
+    projection?: Record<string, 0 | 1>,
+    session?: ClientSession,
+  ) => Promise<IGroup | null>;
+  findGroupByExternalId: (
+    idOnTheSource: string,
+    source?: 'entra' | 'local',
+    projection?: Record<string, 0 | 1>,
+    session?: ClientSession,
+  ) => Promise<IGroup | null>;
+  findGroupsByExternalIds: (
+    idsOnTheSource: string[],
+    source?: 'entra' | 'local',
+    session?: ClientSession,
+  ) => Promise<IGroup[]>;
+  findGroupsByNamePattern: (
+    namePattern: string,
+    source?: 'entra' | 'local' | null,
+    limit?: number,
+    session?: ClientSession,
+  ) => Promise<IGroup[]>;
+  findGroupsByMemberId: (
+    userId: string | Types.ObjectId,
+    session?: ClientSession,
+  ) => Promise<IGroup[]>;
+  createGroup: (groupData: Partial<IGroup>, session?: ClientSession) => Promise<IGroup>;
+  upsertGroupByExternalId: (
+    idOnTheSource: string,
+    source: 'entra' | 'local',
+    updateData: Partial<IGroup>,
+    session?: ClientSession,
+  ) => Promise<IGroup | null>;
+  addUserToGroup: (
+    userId: string | Types.ObjectId,
+    groupId: string | Types.ObjectId,
+    session?: ClientSession,
+  ) => Promise<{ user: IUser; group: IGroup | null }>;
+  removeUserFromGroup: (
+    userId: string | Types.ObjectId,
+    groupId: string | Types.ObjectId,
+    session?: ClientSession,
+  ) => Promise<{ user: IUser; group: IGroup | null }>;
+  removeUserFromAllGroups: (userId: string | Types.ObjectId) => Promise<void>;
+  findGroupByQuery: (
+    filter: Record<string, unknown>,
+    session?: ClientSession,
+  ) => Promise<IGroup | null>;
+  updateGroupById: (
+    groupId: string | Types.ObjectId,
+    data: Record<string, unknown>,
+    session?: ClientSession,
+  ) => Promise<IGroup | null>;
+  bulkUpdateGroups: (
+    filter: Record<string, unknown>,
+    update: Record<string, unknown>,
+    options?: { session?: ClientSession },
+  ) => Promise<import('mongoose').UpdateWriteOpResult>;
+  getUserGroups: (userId: string | Types.ObjectId, session?: ClientSession) => Promise<IGroup[]>;
+  getUserPrincipals: (
+    params: {
+      userId: string | Types.ObjectId;
+      role?: string | null;
+    },
+    session?: ClientSession,
+  ) => Promise<Array<{ principalType: PrincipalType; principalId?: string | Types.ObjectId }>>;
+  syncUserEntraGroups: (
+    userId: string | Types.ObjectId,
+    entraGroups: Array<{ id: string; name: string; description?: string; email?: string }>,
+    session?: ClientSession,
+  ) => Promise<{
+    user: IUser;
+    addedGroups: IGroup[];
+    removedGroups: IGroup[];
+  }>;
+  searchPrincipals: (
+    searchPattern: string,
+    limitPerType?: number,
+    typeFilter?: Array<PrincipalType.USER | PrincipalType.GROUP | PrincipalType.ROLE> | null,
+    session?: ClientSession,
+  ) => Promise<TPrincipalSearchResult[]>;
+  calculateRelevanceScore: (item: TPrincipalSearchResult, searchPattern: string) => number;
+  sortPrincipalsByRelevance: <
+    T extends { _searchScore?: number; type: string; name?: string; email?: string },
+  >(
+    results: T[],
+  ) => T[];
+  listGroups: (
+    filter?: {
+      source?: 'local' | 'entra';
+      search?: string;
+      limit?: number;
+      offset?: number;
+    },
+    session?: ClientSession,
+  ) => Promise<IGroup[]>;
+  countGroups: (
+    filter?: { source?: 'local' | 'entra'; search?: string },
+    session?: ClientSession,
+  ) => Promise<number>;
+  deleteGroup: (
+    groupId: string | Types.ObjectId,
+    session?: ClientSession,
+  ) => Promise<IGroup | null>;
+  removeMemberById: (
+    groupId: string | Types.ObjectId,
+    memberId: string,
+    session?: ClientSession,
+  ) => Promise<IGroup | null>;
+} {
   /**
    * Find a group by its ID
    * @param groupId - The group ID
@@ -680,7 +790,7 @@ export function createUserGroupMethods(mongoose: typeof import('mongoose')) {
     filter: Record<string, unknown>,
     update: Record<string, unknown>,
     options?: { session?: ClientSession },
-  ) {
+  ): Promise<import('mongoose').UpdateWriteOpResult> {
     const Group = mongoose.models.Group as Model<IGroup>;
     return Group.updateMany(filter, update, options || {});
   }
diff --git a/packages/data-schemas/src/migrations/tenantIndexes.spec.ts b/packages/data-schemas/src/migrations/tenantIndexes.spec.ts
index a2fb2fef018..986adb5ab88 100644
--- a/packages/data-schemas/src/migrations/tenantIndexes.spec.ts
+++ b/packages/data-schemas/src/migrations/tenantIndexes.spec.ts
@@ -113,6 +113,11 @@ describe('dropSupersededTenantIndexes', () => {
           { idOnTheSource: 1, source: 1 },
           { unique: true, name: 'idOnTheSource_1_source_1' },
         );
+
+      await db.createCollection('skillsyncstatuses');
+      await db
+        .collection('skillsyncstatuses')
+        .createIndex({ provider: 1, sourceId: 1 }, { unique: true, name: 'provider_1_sourceId_1' });
     });
 
     it('drops all superseded indexes', async () => {
@@ -160,6 +165,13 @@ describe('dropSupersededTenantIndexes', () => {
 
       expect(indexNames).not.toContain('conversationId_1_user_1');
     });
+
+    it('old skill sync status unique index is gone', async () => {
+      const indexes = await mongoose.connection.db!.collection('skillsyncstatuses').indexes();
+      const indexNames = indexes.map((idx) => idx.name);
+
+      expect(indexNames).not.toContain('provider_1_sourceId_1');
+    });
   });
 
   describe('multi-tenant writes after migration', () => {
@@ -287,6 +299,7 @@ describe('dropSupersededTenantIndexes', () => {
         'mcpservers',
         'files',
         'groups',
+        'skillsyncstatuses',
       ];
 
       for (const col of expectedCollections) {
diff --git a/packages/data-schemas/src/migrations/tenantIndexes.ts b/packages/data-schemas/src/migrations/tenantIndexes.ts
index e511bb17364..9a84997c5ca 100644
--- a/packages/data-schemas/src/migrations/tenantIndexes.ts
+++ b/packages/data-schemas/src/migrations/tenantIndexes.ts
@@ -35,6 +35,7 @@ const SUPERSEDED_INDEXES: Record<string, string[]> = {
   mcpservers: ['serverName_1'],
   files: ['filename_1_conversationId_1_context_1'],
   groups: ['idOnTheSource_1_source_1'],
+  skillsyncstatuses: ['provider_1_sourceId_1'],
 };
 
 interface MigrationResult {
diff --git a/packages/data-schemas/src/models/accessRole.ts b/packages/data-schemas/src/models/accessRole.ts
index cd2c8b691cd..2c3264d746a 100644
--- a/packages/data-schemas/src/models/accessRole.ts
+++ b/packages/data-schemas/src/models/accessRole.ts
@@ -1,8 +1,9 @@
-import accessRoleSchema from '~/schema/accessRole';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type * as t from '~/types';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import accessRoleSchema from '~/schema/accessRole';
 
-export function createAccessRoleModel(mongoose: typeof import('mongoose')) {
+export function createAccessRoleModel(mongoose: typeof import('mongoose')): Model<t.IAccessRole> {
   applyTenantIsolation(accessRoleSchema);
   return (
     mongoose.models.AccessRole || mongoose.model<t.IAccessRole>('AccessRole', accessRoleSchema)
diff --git a/packages/data-schemas/src/models/aclEntry.ts b/packages/data-schemas/src/models/aclEntry.ts
index 195b328438b..225e3862e38 100644
--- a/packages/data-schemas/src/models/aclEntry.ts
+++ b/packages/data-schemas/src/models/aclEntry.ts
@@ -1,8 +1,9 @@
-import aclEntrySchema from '~/schema/aclEntry';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type * as t from '~/types';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import aclEntrySchema from '~/schema/aclEntry';
 
-export function createAclEntryModel(mongoose: typeof import('mongoose')) {
+export function createAclEntryModel(mongoose: typeof import('mongoose')): Model<t.IAclEntry> {
   applyTenantIsolation(aclEntrySchema);
   return mongoose.models.AclEntry || mongoose.model<t.IAclEntry>('AclEntry', aclEntrySchema);
 }
diff --git a/packages/data-schemas/src/models/action.ts b/packages/data-schemas/src/models/action.ts
index 421610ab739..8be9dd4b1d5 100644
--- a/packages/data-schemas/src/models/action.ts
+++ b/packages/data-schemas/src/models/action.ts
@@ -1,8 +1,9 @@
-import actionSchema from '~/schema/action';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type { IAction } from '~/types';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import actionSchema from '~/schema/action';
 
-export function createActionModel(mongoose: typeof import('mongoose')) {
+export function createActionModel(mongoose: typeof import('mongoose')): Model<IAction> {
   applyTenantIsolation(actionSchema);
   return mongoose.models.Action || mongoose.model<IAction>('Action', actionSchema);
 }
diff --git a/packages/data-schemas/src/models/agent.ts b/packages/data-schemas/src/models/agent.ts
index 595d890f065..7b3327dacad 100644
--- a/packages/data-schemas/src/models/agent.ts
+++ b/packages/data-schemas/src/models/agent.ts
@@ -1,8 +1,9 @@
-import agentSchema from '~/schema/agent';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type { IAgent } from '~/types';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import agentSchema from '~/schema/agent';
 
-export function createAgentModel(mongoose: typeof import('mongoose')) {
+export function createAgentModel(mongoose: typeof import('mongoose')): Model<IAgent> {
   applyTenantIsolation(agentSchema);
   return mongoose.models.Agent || mongoose.model<IAgent>('Agent', agentSchema);
 }
diff --git a/packages/data-schemas/src/models/agentApiKey.ts b/packages/data-schemas/src/models/agentApiKey.ts
index 8251b3d7cdf..925394084e6 100644
--- a/packages/data-schemas/src/models/agentApiKey.ts
+++ b/packages/data-schemas/src/models/agentApiKey.ts
@@ -1,7 +1,8 @@
-import agentApiKeySchema, { IAgentApiKey } from '~/schema/agentApiKey';
+import { Model } from 'mongoose';
 import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import agentApiKeySchema, { IAgentApiKey } from '~/schema/agentApiKey';
 
-export function createAgentApiKeyModel(mongoose: typeof import('mongoose')) {
+export function createAgentApiKeyModel(mongoose: typeof import('mongoose')): Model<IAgentApiKey> {
   applyTenantIsolation(agentApiKeySchema);
   return (
     mongoose.models.AgentApiKey || mongoose.model<IAgentApiKey>('AgentApiKey', agentApiKeySchema)
diff --git a/packages/data-schemas/src/models/agentCategory.ts b/packages/data-schemas/src/models/agentCategory.ts
index f0f1f79d2e2..9621ce7830a 100644
--- a/packages/data-schemas/src/models/agentCategory.ts
+++ b/packages/data-schemas/src/models/agentCategory.ts
@@ -1,8 +1,11 @@
-import agentCategorySchema from '~/schema/agentCategory';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type * as t from '~/types';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import agentCategorySchema from '~/schema/agentCategory';
 
-export function createAgentCategoryModel(mongoose: typeof import('mongoose')) {
+export function createAgentCategoryModel(
+  mongoose: typeof import('mongoose'),
+): Model<t.IAgentCategory> {
   applyTenantIsolation(agentCategorySchema);
   return (
     mongoose.models.AgentCategory ||
diff --git a/packages/data-schemas/src/models/assistant.ts b/packages/data-schemas/src/models/assistant.ts
index 16c6dc2bc66..03bd52b917c 100644
--- a/packages/data-schemas/src/models/assistant.ts
+++ b/packages/data-schemas/src/models/assistant.ts
@@ -1,8 +1,9 @@
-import assistantSchema from '~/schema/assistant';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type { IAssistant } from '~/types';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import assistantSchema from '~/schema/assistant';
 
-export function createAssistantModel(mongoose: typeof import('mongoose')) {
+export function createAssistantModel(mongoose: typeof import('mongoose')): Model<IAssistant> {
   applyTenantIsolation(assistantSchema);
   return mongoose.models.Assistant || mongoose.model<IAssistant>('Assistant', assistantSchema);
 }
diff --git a/packages/data-schemas/src/models/balance.ts b/packages/data-schemas/src/models/balance.ts
index 7c1fb344780..6a531ab95d5 100644
--- a/packages/data-schemas/src/models/balance.ts
+++ b/packages/data-schemas/src/models/balance.ts
@@ -1,8 +1,9 @@
-import balanceSchema from '~/schema/balance';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type * as t from '~/types';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import balanceSchema from '~/schema/balance';
 
-export function createBalanceModel(mongoose: typeof import('mongoose')) {
+export function createBalanceModel(mongoose: typeof import('mongoose')): Model<t.IBalance> {
   applyTenantIsolation(balanceSchema);
   return mongoose.models.Balance || mongoose.model<t.IBalance>('Balance', balanceSchema);
 }
diff --git a/packages/data-schemas/src/models/banner.ts b/packages/data-schemas/src/models/banner.ts
index ac18fa72b45..0bf12bac396 100644
--- a/packages/data-schemas/src/models/banner.ts
+++ b/packages/data-schemas/src/models/banner.ts
@@ -1,8 +1,9 @@
-import bannerSchema from '~/schema/banner';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type { IBanner } from '~/types';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import bannerSchema from '~/schema/banner';
 
-export function createBannerModel(mongoose: typeof import('mongoose')) {
+export function createBannerModel(mongoose: typeof import('mongoose')): Model<IBanner> {
   applyTenantIsolation(bannerSchema);
   return mongoose.models.Banner || mongoose.model<IBanner>('Banner', bannerSchema);
 }
diff --git a/packages/data-schemas/src/models/chatProject.ts b/packages/data-schemas/src/models/chatProject.ts
new file mode 100644
index 00000000000..27134b0a067
--- /dev/null
+++ b/packages/data-schemas/src/models/chatProject.ts
@@ -0,0 +1,14 @@
+import { Model } from 'mongoose';
+import type { IChatProjectDocument } from '~/types';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import chatProjectSchema from '~/schema/chatProject';
+
+export function createChatProjectModel(
+  mongoose: typeof import('mongoose'),
+): Model<IChatProjectDocument> {
+  applyTenantIsolation(chatProjectSchema);
+  return (
+    mongoose.models.ChatProject ||
+    mongoose.model<IChatProjectDocument>('ChatProject', chatProjectSchema, 'chatprojects')
+  );
+}
diff --git a/packages/data-schemas/src/models/config.ts b/packages/data-schemas/src/models/config.ts
index 97c08ce1daa..24a796a50c7 100644
--- a/packages/data-schemas/src/models/config.ts
+++ b/packages/data-schemas/src/models/config.ts
@@ -1,8 +1,9 @@
-import configSchema from '~/schema/config';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type * as t from '~/types';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import configSchema from '~/schema/config';
 
-export function createConfigModel(mongoose: typeof import('mongoose')) {
+export function createConfigModel(mongoose: typeof import('mongoose')): Model<t.IConfig> {
   applyTenantIsolation(configSchema);
   return mongoose.models.Config || mongoose.model<t.IConfig>('Config', configSchema);
 }
diff --git a/packages/data-schemas/src/models/conversationTag.ts b/packages/data-schemas/src/models/conversationTag.ts
index a2df6459cc2..e4dcb8f50c4 100644
--- a/packages/data-schemas/src/models/conversationTag.ts
+++ b/packages/data-schemas/src/models/conversationTag.ts
@@ -1,7 +1,10 @@
+import { Model } from 'mongoose';
 import conversationTagSchema, { IConversationTag } from '~/schema/conversationTag';
 import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
 
-export function createConversationTagModel(mongoose: typeof import('mongoose')) {
+export function createConversationTagModel(
+  mongoose: typeof import('mongoose'),
+): Model<IConversationTag> {
   applyTenantIsolation(conversationTagSchema);
   return (
     mongoose.models.ConversationTag ||
diff --git a/packages/data-schemas/src/models/convo.ts b/packages/data-schemas/src/models/convo.ts
index 7cf504bf48a..d636718373b 100644
--- a/packages/data-schemas/src/models/convo.ts
+++ b/packages/data-schemas/src/models/convo.ts
@@ -1,9 +1,12 @@
+import { Model } from 'mongoose';
 import type * as t from '~/types';
 import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
 import mongoMeili from '~/models/plugins/mongoMeili';
 import convoSchema from '~/schema/convo';
 
-export function createConversationModel(mongoose: typeof import('mongoose')) {
+export function createConversationModel(
+  mongoose: typeof import('mongoose'),
+): Model<t.IConversation> {
   applyTenantIsolation(convoSchema);
   if (process.env.MEILI_HOST && process.env.MEILI_MASTER_KEY) {
     convoSchema.plugin(mongoMeili, {
diff --git a/packages/data-schemas/src/models/file.ts b/packages/data-schemas/src/models/file.ts
index da291a13e39..796e896bc5e 100644
--- a/packages/data-schemas/src/models/file.ts
+++ b/packages/data-schemas/src/models/file.ts
@@ -1,8 +1,9 @@
-import fileSchema from '~/schema/file';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type { IMongoFile } from '~/types';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import fileSchema from '~/schema/file';
 
-export function createFileModel(mongoose: typeof import('mongoose')) {
+export function createFileModel(mongoose: typeof import('mongoose')): Model<IMongoFile> {
   applyTenantIsolation(fileSchema);
   return mongoose.models.File || mongoose.model<IMongoFile>('File', fileSchema);
 }
diff --git a/packages/data-schemas/src/models/group.ts b/packages/data-schemas/src/models/group.ts
index 0396de83f11..46494c9ad66 100644
--- a/packages/data-schemas/src/models/group.ts
+++ b/packages/data-schemas/src/models/group.ts
@@ -1,8 +1,9 @@
-import groupSchema from '~/schema/group';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type * as t from '~/types';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import groupSchema from '~/schema/group';
 
-export function createGroupModel(mongoose: typeof import('mongoose')) {
+export function createGroupModel(mongoose: typeof import('mongoose')): Model<t.IGroup> {
   applyTenantIsolation(groupSchema);
   return mongoose.models.Group || mongoose.model<t.IGroup>('Group', groupSchema);
 }
diff --git a/packages/data-schemas/src/models/index.ts b/packages/data-schemas/src/models/index.ts
index dcd88f58d28..476091ec9ca 100644
--- a/packages/data-schemas/src/models/index.ts
+++ b/packages/data-schemas/src/models/index.ts
@@ -1,46 +1,86 @@
-import { createUserModel } from './user';
-import { createTokenModel } from './token';
+import { createSkillSyncCredentialModel } from './skillSyncCredential';
+import { createSkillSyncStatusModel } from './skillSyncStatus';
+import { createConversationTagModel } from './conversationTag';
+import { createAgentCategoryModel } from './agentCategory';
+import { createChatProjectModel } from './chatProject';
+import { createAgentApiKeyModel } from './agentApiKey';
+import { createTransactionModel } from './transaction';
+import { createPromptGroupModel } from './promptGroup';
+import { createSystemGrantModel } from './systemGrant';
+import { createPluginAuthModel } from './pluginAuth';
+import { createSharedLinkModel } from './sharedLink';
+import { createAccessRoleModel } from './accessRole';
+import { createMCPServerModel } from './mcpServer';
+import { createAssistantModel } from './assistant';
+import { createSkillFileModel } from './skillFile';
+import { createConversationModel } from './convo';
+import { createToolCallModel } from './toolCall';
+import { createAclEntryModel } from './aclEntry';
 import { createSessionModel } from './session';
 import { createBalanceModel } from './balance';
-import { createConversationModel } from './convo';
 import { createMessageModel } from './message';
-import { createAgentModel } from './agent';
-import { createAgentApiKeyModel } from './agentApiKey';
-import { createAgentCategoryModel } from './agentCategory';
-import { createMCPServerModel } from './mcpServer';
-import { createRoleModel } from './role';
 import { createActionModel } from './action';
-import { createAssistantModel } from './assistant';
-import { createFileModel } from './file';
 import { createBannerModel } from './banner';
-import { createKeyModel } from './key';
-import { createPluginAuthModel } from './pluginAuth';
-import { createTransactionModel } from './transaction';
 import { createPresetModel } from './preset';
 import { createPromptModel } from './prompt';
-import { createPromptGroupModel } from './promptGroup';
-import { createSkillModel } from './skill';
-import { createSkillFileModel } from './skillFile';
-import { createConversationTagModel } from './conversationTag';
-import { createSharedLinkModel } from './sharedLink';
-import { createToolCallModel } from './toolCall';
 import { createMemoryModel } from './memory';
-import { createAccessRoleModel } from './accessRole';
-import { createAclEntryModel } from './aclEntry';
-import { createSystemGrantModel } from './systemGrant';
-import { createGroupModel } from './group';
 import { createConfigModel } from './config';
+import { createTokenModel } from './token';
+import { createAgentModel } from './agent';
+import { createSkillModel } from './skill';
+import { createGroupModel } from './group';
+import { createUserModel } from './user';
+import { createRoleModel } from './role';
+import { createFileModel } from './file';
+import { createKeyModel } from './key';
 
 /**
  * Creates all database models for all collections
  */
-export function createModels(mongoose: typeof import('mongoose')) {
+export function createModels(mongoose: typeof import('mongoose')): {
+  User: ReturnType<typeof createUserModel>;
+  Token: ReturnType<typeof createTokenModel>;
+  Session: ReturnType<typeof createSessionModel>;
+  Balance: ReturnType<typeof createBalanceModel>;
+  Conversation: ReturnType<typeof createConversationModel>;
+  ChatProject: ReturnType<typeof createChatProjectModel>;
+  Message: ReturnType<typeof createMessageModel>;
+  Agent: ReturnType<typeof createAgentModel>;
+  AgentApiKey: ReturnType<typeof createAgentApiKeyModel>;
+  AgentCategory: ReturnType<typeof createAgentCategoryModel>;
+  MCPServer: ReturnType<typeof createMCPServerModel>;
+  Role: ReturnType<typeof createRoleModel>;
+  Action: ReturnType<typeof createActionModel>;
+  Assistant: ReturnType<typeof createAssistantModel>;
+  File: ReturnType<typeof createFileModel>;
+  Banner: ReturnType<typeof createBannerModel>;
+  Key: ReturnType<typeof createKeyModel>;
+  PluginAuth: ReturnType<typeof createPluginAuthModel>;
+  Transaction: ReturnType<typeof createTransactionModel>;
+  Preset: ReturnType<typeof createPresetModel>;
+  Prompt: ReturnType<typeof createPromptModel>;
+  PromptGroup: ReturnType<typeof createPromptGroupModel>;
+  Skill: ReturnType<typeof createSkillModel>;
+  SkillFile: ReturnType<typeof createSkillFileModel>;
+  SkillSyncCredential: ReturnType<typeof createSkillSyncCredentialModel>;
+  SkillSyncStatus: ReturnType<typeof createSkillSyncStatusModel>;
+  ConversationTag: ReturnType<typeof createConversationTagModel>;
+  SharedLink: ReturnType<typeof createSharedLinkModel>;
+  ToolCall: ReturnType<typeof createToolCallModel>;
+  MemoryEntry: ReturnType<typeof createMemoryModel>;
+  AccessRole: ReturnType<typeof createAccessRoleModel>;
+  AclEntry: ReturnType<typeof createAclEntryModel>;
+  SystemGrant: ReturnType<typeof createSystemGrantModel>;
+  Group: ReturnType<typeof createGroupModel>;
+  Config: ReturnType<typeof createConfigModel>;
+} {
   return {
     User: createUserModel(mongoose),
     Token: createTokenModel(mongoose),
     Session: createSessionModel(mongoose),
     Balance: createBalanceModel(mongoose),
     Conversation: createConversationModel(mongoose),
+    ChatProject: createChatProjectModel(mongoose),
     Message: createMessageModel(mongoose),
     Agent: createAgentModel(mongoose),
     AgentApiKey: createAgentApiKeyModel(mongoose),
@@ -59,6 +99,8 @@ export function createModels(mongoose: typeof import('mongoose')) {
     PromptGroup: createPromptGroupModel(mongoose),
     Skill: createSkillModel(mongoose),
     SkillFile: createSkillFileModel(mongoose),
+    SkillSyncCredential: createSkillSyncCredentialModel(mongoose),
+    SkillSyncStatus: createSkillSyncStatusModel(mongoose),
     ConversationTag: createConversationTagModel(mongoose),
     SharedLink: createSharedLinkModel(mongoose),
     ToolCall: createToolCallModel(mongoose),
diff --git a/packages/data-schemas/src/models/key.ts b/packages/data-schemas/src/models/key.ts
index d6534e870b3..1772a11e6cc 100644
--- a/packages/data-schemas/src/models/key.ts
+++ b/packages/data-schemas/src/models/key.ts
@@ -1,7 +1,8 @@
-import keySchema, { IKey } from '~/schema/key';
+import { Model } from 'mongoose';
 import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import keySchema, { IKey } from '~/schema/key';
 
-export function createKeyModel(mongoose: typeof import('mongoose')) {
+export function createKeyModel(mongoose: typeof import('mongoose')): Model<IKey> {
   applyTenantIsolation(keySchema);
   return mongoose.models.Key || mongoose.model<IKey>('Key', keySchema);
 }
diff --git a/packages/data-schemas/src/models/mcpServer.ts b/packages/data-schemas/src/models/mcpServer.ts
index 6b93754d1c6..03187911ade 100644
--- a/packages/data-schemas/src/models/mcpServer.ts
+++ b/packages/data-schemas/src/models/mcpServer.ts
@@ -1,8 +1,11 @@
-import mcpServerSchema from '~/schema/mcpServer';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type { MCPServerDocument } from '~/types';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import mcpServerSchema from '~/schema/mcpServer';
 
-export function createMCPServerModel(mongoose: typeof import('mongoose')) {
+export function createMCPServerModel(
+  mongoose: typeof import('mongoose'),
+): Model<MCPServerDocument> {
   applyTenantIsolation(mcpServerSchema);
   return (
     mongoose.models.MCPServer || mongoose.model<MCPServerDocument>('MCPServer', mcpServerSchema)
diff --git a/packages/data-schemas/src/models/memory.ts b/packages/data-schemas/src/models/memory.ts
index ad2c8cf8dcf..4ae4a7eceb9 100644
--- a/packages/data-schemas/src/models/memory.ts
+++ b/packages/data-schemas/src/models/memory.ts
@@ -1,8 +1,9 @@
-import memorySchema from '~/schema/memory';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type { IMemoryEntry } from '~/types/memory';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import memorySchema from '~/schema/memory';
 
-export function createMemoryModel(mongoose: typeof import('mongoose')) {
+export function createMemoryModel(mongoose: typeof import('mongoose')): Model<IMemoryEntry> {
   applyTenantIsolation(memorySchema);
   return mongoose.models.MemoryEntry || mongoose.model<IMemoryEntry>('MemoryEntry', memorySchema);
 }
diff --git a/packages/data-schemas/src/models/message.ts b/packages/data-schemas/src/models/message.ts
index b8b26b3e062..2dfcf66fe4f 100644
--- a/packages/data-schemas/src/models/message.ts
+++ b/packages/data-schemas/src/models/message.ts
@@ -1,9 +1,10 @@
+import { Model } from 'mongoose';
 import type * as t from '~/types';
 import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
 import mongoMeili from '~/models/plugins/mongoMeili';
 import messageSchema from '~/schema/message';
 
-export function createMessageModel(mongoose: typeof import('mongoose')) {
+export function createMessageModel(mongoose: typeof import('mongoose')): Model<t.IMessage> {
   applyTenantIsolation(messageSchema);
   if (process.env.MEILI_HOST && process.env.MEILI_MASTER_KEY) {
     messageSchema.plugin(mongoMeili, {
diff --git a/packages/data-schemas/src/models/pluginAuth.ts b/packages/data-schemas/src/models/pluginAuth.ts
index 22b46d05a8b..3d879217b38 100644
--- a/packages/data-schemas/src/models/pluginAuth.ts
+++ b/packages/data-schemas/src/models/pluginAuth.ts
@@ -1,8 +1,9 @@
-import pluginAuthSchema from '~/schema/pluginAuth';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type { IPluginAuth } from '~/types/pluginAuth';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import pluginAuthSchema from '~/schema/pluginAuth';
 
-export function createPluginAuthModel(mongoose: typeof import('mongoose')) {
+export function createPluginAuthModel(mongoose: typeof import('mongoose')): Model<IPluginAuth> {
   applyTenantIsolation(pluginAuthSchema);
   return mongoose.models.PluginAuth || mongoose.model<IPluginAuth>('PluginAuth', pluginAuthSchema);
 }
diff --git a/packages/data-schemas/src/models/plugins/mongoMeili.spec.ts b/packages/data-schemas/src/models/plugins/mongoMeili.spec.ts
index b4084fa936c..421c15c14db 100644
--- a/packages/data-schemas/src/models/plugins/mongoMeili.spec.ts
+++ b/packages/data-schemas/src/models/plugins/mongoMeili.spec.ts
@@ -1,9 +1,9 @@
-import { MongoMemoryServer } from 'mongodb-memory-server';
 import mongoose from 'mongoose';
 import { EModelEndpoint } from 'librechat-data-provider';
+import { MongoMemoryServer } from 'mongodb-memory-server';
+import mongoMeili, { type SchemaWithMeiliMethods } from '~/models/plugins/mongoMeili';
 import { createConversationModel } from '~/models/convo';
 import { createMessageModel } from '~/models/message';
-import mongoMeili, { type SchemaWithMeiliMethods } from '~/models/plugins/mongoMeili';
 
 interface DynamicMeiliDocument extends mongoose.Document {
   docId: string;
@@ -235,7 +235,9 @@ describe('Meilisearch Mongoose plugin', () => {
   });
 
   test('updating an indexed conversation calls updateDocuments with primaryKey', async () => {
-    const conversationModel = createConversationModel(mongoose);
+    const conversationModel = createConversationModel(
+      mongoose,
+    ) as unknown as SchemaWithMeiliMethods;
     const convo = await conversationModel.create({
       conversationId: new mongoose.Types.ObjectId().toString(),
       user: new mongoose.Types.ObjectId(),
@@ -295,7 +297,9 @@ describe('Meilisearch Mongoose plugin', () => {
   });
 
   test('updateDocuments receives preprocessed data with primaryKey', async () => {
-    const conversationModel = createConversationModel(mongoose);
+    const conversationModel = createConversationModel(
+      mongoose,
+    ) as unknown as SchemaWithMeiliMethods;
     const conversationId = 'abc|def|ghi';
     const convo = await conversationModel.create({
       conversationId,
@@ -316,7 +320,9 @@ describe('Meilisearch Mongoose plugin', () => {
   });
 
   test('sync w/ meili does not include TTL documents', async () => {
-    const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+    const conversationModel = createConversationModel(
+      mongoose,
+    ) as unknown as SchemaWithMeiliMethods;
     await conversationModel.create({
       conversationId: new mongoose.Types.ObjectId(),
       user: new mongoose.Types.ObjectId(),
@@ -332,7 +338,9 @@ describe('Meilisearch Mongoose plugin', () => {
   });
 
   test('sync w/ meili excludes legacy temporary conversations without isTemporary', async () => {
-    const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+    const conversationModel = createConversationModel(
+      mongoose,
+    ) as unknown as SchemaWithMeiliMethods;
     await conversationModel.deleteMany({});
     mockAddDocumentsInBatches.mockClear();
     const conversationId = new mongoose.Types.ObjectId().toString();
@@ -356,7 +364,9 @@ describe('Meilisearch Mongoose plugin', () => {
   });
 
   test('saving hydrated legacy temporary conversations without isTemporary does NOT index', async () => {
-    const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+    const conversationModel = createConversationModel(
+      mongoose,
+    ) as unknown as SchemaWithMeiliMethods;
     await conversationModel.deleteMany({});
     mockAddDocuments.mockClear();
     mockUpdateDocuments.mockClear();
@@ -386,7 +396,9 @@ describe('Meilisearch Mongoose plugin', () => {
   });
 
   test('findOneAndUpdate on legacy temporary conversations without isTemporary does NOT index', async () => {
-    const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+    const conversationModel = createConversationModel(
+      mongoose,
+    ) as unknown as SchemaWithMeiliMethods;
     await conversationModel.deleteMany({});
     mockAddDocuments.mockClear();
     mockUpdateDocuments.mockClear();
@@ -416,7 +428,7 @@ describe('Meilisearch Mongoose plugin', () => {
   });
 
   test('sync w/ meili excludes legacy temporary messages without isTemporary', async () => {
-    const messageModel = createMessageModel(mongoose) as SchemaWithMeiliMethods;
+    const messageModel = createMessageModel(mongoose) as unknown as SchemaWithMeiliMethods;
     await messageModel.deleteMany({});
     mockAddDocumentsInBatches.mockClear();
     const messageId = new mongoose.Types.ObjectId().toString();
@@ -501,7 +513,9 @@ describe('Meilisearch Mongoose plugin', () => {
   describe('estimatedDocumentCount usage in syncWithMeili', () => {
     test('syncWithMeili completes successfully with estimatedDocumentCount', async () => {
       // Clear any previous documents
-      const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+      const conversationModel = createConversationModel(
+        mongoose,
+      ) as unknown as SchemaWithMeiliMethods;
       await conversationModel.deleteMany({});
 
       // Create test documents
@@ -527,7 +541,7 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('syncWithMeili handles empty collection correctly', async () => {
-      const messageModel = createMessageModel(mongoose) as SchemaWithMeiliMethods;
+      const messageModel = createMessageModel(mongoose) as unknown as SchemaWithMeiliMethods;
       await messageModel.deleteMany({});
 
       // Verify collection is empty
@@ -539,7 +553,9 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('estimatedDocumentCount returns count for non-empty collection', async () => {
-      const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+      const conversationModel = createConversationModel(
+        mongoose,
+      ) as unknown as SchemaWithMeiliMethods;
       await conversationModel.deleteMany({});
 
       // Create documents
@@ -562,7 +578,7 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('estimatedDocumentCount is available on model', async () => {
-      const messageModel = createMessageModel(mongoose) as SchemaWithMeiliMethods;
+      const messageModel = createMessageModel(mongoose) as unknown as SchemaWithMeiliMethods;
 
       // Verify the method exists and is callable
       expect(typeof messageModel.estimatedDocumentCount).toBe('function');
@@ -574,7 +590,7 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('syncWithMeili handles mix of syncable and TTL documents correctly', async () => {
-      const messageModel = createMessageModel(mongoose) as SchemaWithMeiliMethods;
+      const messageModel = createMessageModel(mongoose) as unknown as SchemaWithMeiliMethods;
       await messageModel.deleteMany({});
       mockAddDocuments.mockClear();
 
@@ -637,7 +653,9 @@ describe('Meilisearch Mongoose plugin', () => {
 
   describe('New batch processing and retry functionality', () => {
     test('processSyncBatch uses addDocumentsInBatches', async () => {
-      const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+      const conversationModel = createConversationModel(
+        mongoose,
+      ) as unknown as SchemaWithMeiliMethods;
       await conversationModel.deleteMany({});
       mockAddDocumentsInBatches.mockClear();
       mockAddDocuments.mockClear();
@@ -661,7 +679,9 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('addObjectToMeili retries on failure', async () => {
-      const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+      const conversationModel = createConversationModel(
+        mongoose,
+      ) as unknown as SchemaWithMeiliMethods;
 
       // Mock addDocuments to fail twice then succeed
       mockAddDocuments
@@ -685,7 +705,9 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('getSyncProgress returns accurate progress information', async () => {
-      const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+      const conversationModel = createConversationModel(
+        mongoose,
+      ) as unknown as SchemaWithMeiliMethods;
       await conversationModel.deleteMany({});
 
       // Insert documents directly to control the _meiliIndex flag
@@ -715,7 +737,9 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('getSyncProgress excludes TTL documents from counts', async () => {
-      const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+      const conversationModel = createConversationModel(
+        mongoose,
+      ) as unknown as SchemaWithMeiliMethods;
       await conversationModel.deleteMany({});
 
       // Insert syncable documents (expiredAt: null)
@@ -765,7 +789,7 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('getSyncProgress shows completion when all syncable documents are indexed', async () => {
-      const messageModel = createMessageModel(mongoose) as SchemaWithMeiliMethods;
+      const messageModel = createMessageModel(mongoose) as unknown as SchemaWithMeiliMethods;
       await messageModel.deleteMany({});
 
       // All syncable documents are indexed
@@ -807,7 +831,9 @@ describe('Meilisearch Mongoose plugin', () => {
 
   describe('Error handling in processSyncBatch', () => {
     test('syncWithMeili fails when processSyncBatch encounters addDocumentsInBatches error', async () => {
-      const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+      const conversationModel = createConversationModel(
+        mongoose,
+      ) as unknown as SchemaWithMeiliMethods;
       await conversationModel.deleteMany({});
       mockAddDocumentsInBatches.mockClear();
 
@@ -839,7 +865,9 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('syncWithMeili fails when processSyncBatch encounters updateMany error', async () => {
-      const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+      const conversationModel = createConversationModel(
+        mongoose,
+      ) as unknown as SchemaWithMeiliMethods;
       await conversationModel.deleteMany({});
       mockAddDocumentsInBatches.mockClear();
 
@@ -871,7 +899,7 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('processSyncBatch logs error and throws when addDocumentsInBatches fails', async () => {
-      const messageModel = createMessageModel(mongoose) as SchemaWithMeiliMethods;
+      const messageModel = createMessageModel(mongoose) as unknown as SchemaWithMeiliMethods;
       await messageModel.deleteMany({});
 
       mockAddDocumentsInBatches.mockRejectedValueOnce(new Error('Network timeout'));
@@ -897,7 +925,9 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('processSyncBatch handles empty document array gracefully', async () => {
-      const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+      const conversationModel = createConversationModel(
+        mongoose,
+      ) as unknown as SchemaWithMeiliMethods;
       const indexMock = mockIndex();
 
       // Should not throw with empty array
@@ -908,7 +938,9 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('syncWithMeili stops processing when batch fails and does not process remaining documents', async () => {
-      const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+      const conversationModel = createConversationModel(
+        mongoose,
+      ) as unknown as SchemaWithMeiliMethods;
       await conversationModel.deleteMany({});
       mockAddDocumentsInBatches.mockClear();
 
@@ -939,7 +971,7 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('error in processSyncBatch is properly logged before being thrown', async () => {
-      const messageModel = createMessageModel(mongoose) as SchemaWithMeiliMethods;
+      const messageModel = createMessageModel(mongoose) as unknown as SchemaWithMeiliMethods;
       await messageModel.deleteMany({});
 
       const testError = new Error('Test error for logging');
@@ -962,7 +994,9 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('syncWithMeili properly propagates processSyncBatch errors', async () => {
-      const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+      const conversationModel = createConversationModel(
+        mongoose,
+      ) as unknown as SchemaWithMeiliMethods;
       await conversationModel.deleteMany({});
       mockAddDocumentsInBatches.mockClear();
 
@@ -1003,7 +1037,9 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('cleanupMeiliIndex deletes orphaned documents from MeiliSearch', async () => {
-      const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+      const conversationModel = createConversationModel(
+        mongoose,
+      ) as unknown as SchemaWithMeiliMethods;
       await conversationModel.deleteMany({});
 
       const existingConvoId = new mongoose.Types.ObjectId().toString();
@@ -1037,7 +1073,7 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('cleanupMeiliIndex handles offset correctly when documents are deleted', async () => {
-      const messageModel = createMessageModel(mongoose) as SchemaWithMeiliMethods;
+      const messageModel = createMessageModel(mongoose) as unknown as SchemaWithMeiliMethods;
       await messageModel.deleteMany({});
 
       const existingIds = [
@@ -1093,7 +1129,9 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('cleanupMeiliIndex preserves existing documents', async () => {
-      const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+      const conversationModel = createConversationModel(
+        mongoose,
+      ) as unknown as SchemaWithMeiliMethods;
       await conversationModel.deleteMany({});
 
       const existingId1 = new mongoose.Types.ObjectId().toString();
@@ -1132,7 +1170,7 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('cleanupMeiliIndex handles empty MeiliSearch index', async () => {
-      const messageModel = createMessageModel(mongoose) as SchemaWithMeiliMethods;
+      const messageModel = createMessageModel(mongoose) as unknown as SchemaWithMeiliMethods;
 
       // Mock empty MeiliSearch index
       mockGetDocuments.mockResolvedValueOnce({
@@ -1148,7 +1186,9 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('cleanupMeiliIndex stops when results.length < batchSize', async () => {
-      const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+      const conversationModel = createConversationModel(
+        mongoose,
+      ) as unknown as SchemaWithMeiliMethods;
       await conversationModel.deleteMany({});
 
       const id1 = new mongoose.Types.ObjectId().toString();
@@ -1187,7 +1227,7 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('cleanupMeiliIndex handles multiple batches correctly', async () => {
-      const messageModel = createMessageModel(mongoose) as SchemaWithMeiliMethods;
+      const messageModel = createMessageModel(mongoose) as unknown as SchemaWithMeiliMethods;
       await messageModel.deleteMany({});
 
       const existingIds = Array.from({ length: 5 }, () => new mongoose.Types.ObjectId().toString());
@@ -1243,7 +1283,9 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('cleanupMeiliIndex handles delay between batches', async () => {
-      const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+      const conversationModel = createConversationModel(
+        mongoose,
+      ) as unknown as SchemaWithMeiliMethods;
       await conversationModel.deleteMany({});
 
       const id1 = new mongoose.Types.ObjectId().toString();
@@ -1290,7 +1332,7 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('cleanupMeiliIndex handles errors gracefully', async () => {
-      const messageModel = createMessageModel(mongoose) as SchemaWithMeiliMethods;
+      const messageModel = createMessageModel(mongoose) as unknown as SchemaWithMeiliMethods;
 
       mockGetDocuments.mockRejectedValueOnce(new Error('MeiliSearch connection error'));
 
@@ -1303,7 +1345,9 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('cleanupMeiliIndex with all documents being orphaned', async () => {
-      const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+      const conversationModel = createConversationModel(
+        mongoose,
+      ) as unknown as SchemaWithMeiliMethods;
       await conversationModel.deleteMany({});
 
       const orphanedId1 = new mongoose.Types.ObjectId().toString();
@@ -1327,7 +1371,7 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('cleanupMeiliIndex adjusts offset to 0 when all batch documents are deleted', async () => {
-      const messageModel = createMessageModel(mongoose) as SchemaWithMeiliMethods;
+      const messageModel = createMessageModel(mongoose) as unknown as SchemaWithMeiliMethods;
       await messageModel.deleteMany({});
 
       const orphanedIds = Array.from({ length: 3 }, () => new mongoose.Types.ObjectId().toString());
@@ -1375,7 +1419,9 @@ describe('Meilisearch Mongoose plugin', () => {
 
   describe('processSyncBatch does not modify updatedAt timestamps', () => {
     test('syncWithMeili preserves original updatedAt on conversations', async () => {
-      const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+      const conversationModel = createConversationModel(
+        mongoose,
+      ) as unknown as SchemaWithMeiliMethods;
       await conversationModel.deleteMany({});
       mockAddDocumentsInBatches.mockClear();
 
@@ -1426,7 +1472,7 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('syncWithMeili preserves original updatedAt on messages', async () => {
-      const messageModel = createMessageModel(mongoose) as SchemaWithMeiliMethods;
+      const messageModel = createMessageModel(mongoose) as unknown as SchemaWithMeiliMethods;
       await messageModel.deleteMany({});
       mockAddDocumentsInBatches.mockClear();
 
@@ -1474,7 +1520,9 @@ describe('Meilisearch Mongoose plugin', () => {
 
   describe('Missing _meiliIndex property handling in sync process', () => {
     test('syncWithMeili includes documents with missing _meiliIndex', async () => {
-      const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+      const conversationModel = createConversationModel(
+        mongoose,
+      ) as unknown as SchemaWithMeiliMethods;
       await conversationModel.deleteMany({});
       mockAddDocumentsInBatches.mockClear();
 
@@ -1529,7 +1577,7 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('getSyncProgress counts documents with missing _meiliIndex as not indexed', async () => {
-      const messageModel = createMessageModel(mongoose) as SchemaWithMeiliMethods;
+      const messageModel = createMessageModel(mongoose) as unknown as SchemaWithMeiliMethods;
       await messageModel.deleteMany({});
 
       // Insert documents with different _meiliIndex states
@@ -1571,7 +1619,9 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('query with _meiliIndex: { $ne: true } includes missing values', async () => {
-      const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+      const conversationModel = createConversationModel(
+        mongoose,
+      ) as unknown as SchemaWithMeiliMethods;
       await conversationModel.deleteMany({});
 
       // Insert documents with different _meiliIndex states
@@ -1615,7 +1665,7 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('syncWithMeili processes all documents where _meiliIndex is not true', async () => {
-      const messageModel = createMessageModel(mongoose) as SchemaWithMeiliMethods;
+      const messageModel = createMessageModel(mongoose) as unknown as SchemaWithMeiliMethods;
       await messageModel.deleteMany({});
       mockAddDocumentsInBatches.mockClear();
 
@@ -1665,7 +1715,9 @@ describe('Meilisearch Mongoose plugin', () => {
     });
 
     test('syncWithMeili treats missing _meiliIndex same as false', async () => {
-      const conversationModel = createConversationModel(mongoose) as SchemaWithMeiliMethods;
+      const conversationModel = createConversationModel(
+        mongoose,
+      ) as unknown as SchemaWithMeiliMethods;
       await conversationModel.deleteMany({});
       mockAddDocumentsInBatches.mockClear();
 
diff --git a/packages/data-schemas/src/models/plugins/tenantIsolation.coverage.spec.ts b/packages/data-schemas/src/models/plugins/tenantIsolation.coverage.spec.ts
index 13b7af41c28..61708666f11 100644
--- a/packages/data-schemas/src/models/plugins/tenantIsolation.coverage.spec.ts
+++ b/packages/data-schemas/src/models/plugins/tenantIsolation.coverage.spec.ts
@@ -11,10 +11,12 @@ const TENANT_ISOLATION_APPLIED = Symbol.for('librechat:tenantIsolation');
 /**
  * Models that carry a `tenantId` field but intentionally do NOT use the
  * tenant-isolation plugin. SystemGrant scopes tenancy manually inside its
- * methods (see models/systemGrant). Adding an entry here must be a deliberate,
- * reviewed decision — that is the whole point of this guard.
+ * methods (see models/systemGrant). SkillSyncStatus stores both app-wide YAML
+ * status rows and tenant-scoped override rows, so its methods apply explicit
+ * tenant filters instead of ambient ALS scoping. Adding an entry here must be a
+ * deliberate, reviewed decision — that is the whole point of this guard.
  */
-const MANUAL_TENANT_SCOPING = new Set<string>(['SystemGrant']);
+const MANUAL_TENANT_SCOPING = new Set<string>(['SystemGrant', 'SkillSyncStatus']);
 
 function isPluginApplied(schema: mongoose.Schema): boolean {
   return (schema as unknown as { [key: symbol]: boolean })[TENANT_ISOLATION_APPLIED] === true;
diff --git a/packages/data-schemas/src/models/preset.ts b/packages/data-schemas/src/models/preset.ts
index dc61c6d251f..07b979b4381 100644
--- a/packages/data-schemas/src/models/preset.ts
+++ b/packages/data-schemas/src/models/preset.ts
@@ -1,7 +1,8 @@
-import presetSchema, { IPreset } from '~/schema/preset';
+import { Model } from 'mongoose';
 import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import presetSchema, { IPreset } from '~/schema/preset';
 
-export function createPresetModel(mongoose: typeof import('mongoose')) {
+export function createPresetModel(mongoose: typeof import('mongoose')): Model<IPreset> {
   applyTenantIsolation(presetSchema);
   return mongoose.models.Preset || mongoose.model<IPreset>('Preset', presetSchema);
 }
diff --git a/packages/data-schemas/src/models/prompt.ts b/packages/data-schemas/src/models/prompt.ts
index 25ff23e81af..939bd575104 100644
--- a/packages/data-schemas/src/models/prompt.ts
+++ b/packages/data-schemas/src/models/prompt.ts
@@ -1,8 +1,9 @@
-import promptSchema from '~/schema/prompt';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type { IPrompt } from '~/types/prompts';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import promptSchema from '~/schema/prompt';
 
-export function createPromptModel(mongoose: typeof import('mongoose')) {
+export function createPromptModel(mongoose: typeof import('mongoose')): Model<IPrompt> {
   applyTenantIsolation(promptSchema);
   return mongoose.models.Prompt || mongoose.model<IPrompt>('Prompt', promptSchema);
 }
diff --git a/packages/data-schemas/src/models/promptGroup.ts b/packages/data-schemas/src/models/promptGroup.ts
index 2d1d2269888..22d4b5ced0c 100644
--- a/packages/data-schemas/src/models/promptGroup.ts
+++ b/packages/data-schemas/src/models/promptGroup.ts
@@ -1,8 +1,11 @@
-import promptGroupSchema from '~/schema/promptGroup';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type { IPromptGroupDocument } from '~/types/prompts';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import promptGroupSchema from '~/schema/promptGroup';
 
-export function createPromptGroupModel(mongoose: typeof import('mongoose')) {
+export function createPromptGroupModel(
+  mongoose: typeof import('mongoose'),
+): Model<IPromptGroupDocument> {
   applyTenantIsolation(promptGroupSchema);
   return (
     mongoose.models.PromptGroup ||
diff --git a/packages/data-schemas/src/models/role.ts b/packages/data-schemas/src/models/role.ts
index 28600070441..fec17004a34 100644
--- a/packages/data-schemas/src/models/role.ts
+++ b/packages/data-schemas/src/models/role.ts
@@ -1,8 +1,9 @@
-import roleSchema from '~/schema/role';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type { IRole } from '~/types';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import roleSchema from '~/schema/role';
 
-export function createRoleModel(mongoose: typeof import('mongoose')) {
+export function createRoleModel(mongoose: typeof import('mongoose')): Model<IRole> {
   applyTenantIsolation(roleSchema);
   return mongoose.models.Role || mongoose.model<IRole>('Role', roleSchema);
 }
diff --git a/packages/data-schemas/src/models/session.ts b/packages/data-schemas/src/models/session.ts
index 746f9a74ddc..157a1ef770c 100644
--- a/packages/data-schemas/src/models/session.ts
+++ b/packages/data-schemas/src/models/session.ts
@@ -1,8 +1,9 @@
-import sessionSchema from '~/schema/session';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type * as t from '~/types';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import sessionSchema from '~/schema/session';
 
-export function createSessionModel(mongoose: typeof import('mongoose')) {
+export function createSessionModel(mongoose: typeof import('mongoose')): Model<t.ISession> {
   applyTenantIsolation(sessionSchema);
   return mongoose.models.Session || mongoose.model<t.ISession>('Session', sessionSchema);
 }
diff --git a/packages/data-schemas/src/models/sharedLink.ts b/packages/data-schemas/src/models/sharedLink.ts
index f379c4605cf..b84327431f7 100644
--- a/packages/data-schemas/src/models/sharedLink.ts
+++ b/packages/data-schemas/src/models/sharedLink.ts
@@ -1,7 +1,8 @@
-import shareSchema, { ISharedLink } from '~/schema/share';
+import { Model } from 'mongoose';
 import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import shareSchema, { ISharedLink } from '~/schema/share';
 
-export function createSharedLinkModel(mongoose: typeof import('mongoose')) {
+export function createSharedLinkModel(mongoose: typeof import('mongoose')): Model<ISharedLink> {
   applyTenantIsolation(shareSchema);
   return mongoose.models.SharedLink || mongoose.model<ISharedLink>('SharedLink', shareSchema);
 }
diff --git a/packages/data-schemas/src/models/skill.ts b/packages/data-schemas/src/models/skill.ts
index 588523f3de0..efe93f08bfa 100644
--- a/packages/data-schemas/src/models/skill.ts
+++ b/packages/data-schemas/src/models/skill.ts
@@ -1,8 +1,9 @@
-import skillSchema from '~/schema/skill';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type { ISkillDocument } from '~/types/skill';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import skillSchema from '~/schema/skill';
 
-export function createSkillModel(mongoose: typeof import('mongoose')) {
+export function createSkillModel(mongoose: typeof import('mongoose')): Model<ISkillDocument> {
   applyTenantIsolation(skillSchema);
   return mongoose.models.Skill || mongoose.model<ISkillDocument>('Skill', skillSchema);
 }
diff --git a/packages/data-schemas/src/models/skillFile.ts b/packages/data-schemas/src/models/skillFile.ts
index 230a2449106..94380d86d97 100644
--- a/packages/data-schemas/src/models/skillFile.ts
+++ b/packages/data-schemas/src/models/skillFile.ts
@@ -1,8 +1,11 @@
-import skillFileSchema from '~/schema/skillFile';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type { ISkillFileDocument } from '~/types/skill';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import skillFileSchema from '~/schema/skillFile';
 
-export function createSkillFileModel(mongoose: typeof import('mongoose')) {
+export function createSkillFileModel(
+  mongoose: typeof import('mongoose'),
+): Model<ISkillFileDocument> {
   applyTenantIsolation(skillFileSchema);
   return (
     mongoose.models.SkillFile || mongoose.model<ISkillFileDocument>('SkillFile', skillFileSchema)
diff --git a/packages/data-schemas/src/models/skillSyncCredential.ts b/packages/data-schemas/src/models/skillSyncCredential.ts
new file mode 100644
index 00000000000..4e0e636fb65
--- /dev/null
+++ b/packages/data-schemas/src/models/skillSyncCredential.ts
@@ -0,0 +1,14 @@
+import { Model } from 'mongoose';
+import type { ISkillSyncCredentialDocument } from '~/types/skillSync';
+import skillSyncCredentialSchema from '~/schema/skillSyncCredential';
+
+export function createSkillSyncCredentialModel(
+  mongoose: typeof import('mongoose'),
+): Model<ISkillSyncCredentialDocument> {
+  // GitHub skill sync is intentionally app-wide in v1; credentials are referenced by
+  // admin-managed config keys and are never returned by tenant-scoped APIs.
+  return (
+    mongoose.models.SkillSyncCredential ||
+    mongoose.model<ISkillSyncCredentialDocument>('SkillSyncCredential', skillSyncCredentialSchema)
+  );
+}
diff --git a/packages/data-schemas/src/models/skillSyncStatus.ts b/packages/data-schemas/src/models/skillSyncStatus.ts
new file mode 100644
index 00000000000..9b15c65ae68
--- /dev/null
+++ b/packages/data-schemas/src/models/skillSyncStatus.ts
@@ -0,0 +1,14 @@
+import { Model } from 'mongoose';
+import type { ISkillSyncStatusDocument } from '~/types/skillSync';
+import skillSyncStatusSchema from '~/schema/skillSyncStatus';
+
+export function createSkillSyncStatusModel(
+  mongoose: typeof import('mongoose'),
+): Model<ISkillSyncStatusDocument> {
+  // GitHub skill sync status supports app-wide YAML sources and tenant-scoped
+  // resolved config sources from admin overrides.
+  return (
+    mongoose.models.SkillSyncStatus ||
+    mongoose.model<ISkillSyncStatusDocument>('SkillSyncStatus', skillSyncStatusSchema)
+  );
+}
diff --git a/packages/data-schemas/src/models/systemGrant.ts b/packages/data-schemas/src/models/systemGrant.ts
index e30b444c654..057e1cff793 100644
--- a/packages/data-schemas/src/models/systemGrant.ts
+++ b/packages/data-schemas/src/models/systemGrant.ts
@@ -1,3 +1,4 @@
+import { Model } from 'mongoose';
 import type * as t from '~/types';
 import systemGrantSchema from '~/schema/systemGrant';
 
@@ -7,7 +8,7 @@ import systemGrantSchema from '~/schema/systemGrant';
  * Do NOT apply tenant isolation plugin here; it would inject a hard tenantId equality
  * filter that conflicts with the $and/$or logic in hasCapabilityForPrincipals.
  */
-export function createSystemGrantModel(mongoose: typeof import('mongoose')) {
+export function createSystemGrantModel(mongoose: typeof import('mongoose')): Model<t.ISystemGrant> {
   return (
     mongoose.models.SystemGrant || mongoose.model<t.ISystemGrant>('SystemGrant', systemGrantSchema)
   );
diff --git a/packages/data-schemas/src/models/token.ts b/packages/data-schemas/src/models/token.ts
index 0cdefab0d92..5e187d2a621 100644
--- a/packages/data-schemas/src/models/token.ts
+++ b/packages/data-schemas/src/models/token.ts
@@ -1,8 +1,9 @@
-import tokenSchema from '~/schema/token';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type * as t from '~/types';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import tokenSchema from '~/schema/token';
 
-export function createTokenModel(mongoose: typeof import('mongoose')) {
+export function createTokenModel(mongoose: typeof import('mongoose')): Model<t.IToken> {
   applyTenantIsolation(tokenSchema);
   return mongoose.models.Token || mongoose.model<t.IToken>('Token', tokenSchema);
 }
diff --git a/packages/data-schemas/src/models/toolCall.ts b/packages/data-schemas/src/models/toolCall.ts
index 262aade342a..1917f519819 100644
--- a/packages/data-schemas/src/models/toolCall.ts
+++ b/packages/data-schemas/src/models/toolCall.ts
@@ -1,7 +1,8 @@
-import toolCallSchema, { IToolCallData } from '~/schema/toolCall';
+import { Model } from 'mongoose';
 import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import toolCallSchema, { IToolCallData } from '~/schema/toolCall';
 
-export function createToolCallModel(mongoose: typeof import('mongoose')) {
+export function createToolCallModel(mongoose: typeof import('mongoose')): Model<IToolCallData> {
   applyTenantIsolation(toolCallSchema);
   return mongoose.models.ToolCall || mongoose.model<IToolCallData>('ToolCall', toolCallSchema);
 }
diff --git a/packages/data-schemas/src/models/transaction.ts b/packages/data-schemas/src/models/transaction.ts
index 358ead23a72..4e2392e1d81 100644
--- a/packages/data-schemas/src/models/transaction.ts
+++ b/packages/data-schemas/src/models/transaction.ts
@@ -1,7 +1,8 @@
-import transactionSchema, { ITransaction } from '~/schema/transaction';
+import { Model } from 'mongoose';
 import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import transactionSchema, { ITransaction } from '~/schema/transaction';
 
-export function createTransactionModel(mongoose: typeof import('mongoose')) {
+export function createTransactionModel(mongoose: typeof import('mongoose')): Model<ITransaction> {
   applyTenantIsolation(transactionSchema);
   return (
     mongoose.models.Transaction || mongoose.model<ITransaction>('Transaction', transactionSchema)
diff --git a/packages/data-schemas/src/models/user.ts b/packages/data-schemas/src/models/user.ts
index 18a1da2b0ba..5908018299c 100644
--- a/packages/data-schemas/src/models/user.ts
+++ b/packages/data-schemas/src/models/user.ts
@@ -1,8 +1,9 @@
-import userSchema from '~/schema/user';
-import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import { Model } from 'mongoose';
 import type * as t from '~/types';
+import { applyTenantIsolation } from '~/models/plugins/tenantIsolation';
+import userSchema from '~/schema/user';
 
-export function createUserModel(mongoose: typeof import('mongoose')) {
+export function createUserModel(mongoose: typeof import('mongoose')): Model<t.IUser> {
   applyTenantIsolation(userSchema);
   return mongoose.models.User || mongoose.model<t.IUser>('User', userSchema);
 }
diff --git a/packages/data-schemas/src/schema/accessRole.ts b/packages/data-schemas/src/schema/accessRole.ts
index 9b5bd490102..b0a07a7c3e4 100644
--- a/packages/data-schemas/src/schema/accessRole.ts
+++ b/packages/data-schemas/src/schema/accessRole.ts
@@ -1,7 +1,7 @@
 import { Schema } from 'mongoose';
 import type { IAccessRole } from '~/types';
 
-const accessRoleSchema = new Schema<IAccessRole>(
+const accessRoleSchema: Schema<IAccessRole> = new Schema<IAccessRole>(
   {
     accessRoleId: {
       type: String,
@@ -15,7 +15,16 @@ const accessRoleSchema = new Schema<IAccessRole>(
     description: String,
     resourceType: {
       type: String,
-      enum: ['agent', 'project', 'file', 'promptGroup', 'mcpServer', 'remoteAgent', 'skill'],
+      enum: [
+        'agent',
+        'project',
+        'file',
+        'promptGroup',
+        'mcpServer',
+        'remoteAgent',
+        'skill',
+        'sharedLink',
+      ],
       required: true,
       default: 'agent',
     },
diff --git a/packages/data-schemas/src/schema/aclEntry.ts b/packages/data-schemas/src/schema/aclEntry.ts
index 8fe6b9f4ef5..562d4e5b211 100644
--- a/packages/data-schemas/src/schema/aclEntry.ts
+++ b/packages/data-schemas/src/schema/aclEntry.ts
@@ -3,7 +3,7 @@ import { PrincipalType, PrincipalModel, ResourceType } from 'librechat-data-prov
 import type { IAclEntry } from '~/types';
 import { MAX_PERM_BITS } from '~/common/permissions';
 
-const aclEntrySchema = new Schema<IAclEntry>(
+const aclEntrySchema: Schema<IAclEntry> = new Schema<IAclEntry>(
   {
     principalType: {
       type: String,
@@ -62,6 +62,9 @@ const aclEntrySchema = new Schema<IAclEntry>(
       type: Date,
       default: Date.now,
     },
+    expiredAt: {
+      type: Date,
+    },
     tenantId: {
       type: String,
       index: true,
@@ -81,5 +84,6 @@ aclEntrySchema.index({ resourceId: 1, principalType: 1, principalId: 1, tenantId
 aclEntrySchema.index({ principalId: 1, permBits: 1, resourceType: 1, tenantId: 1 });
 /** Covers `findPublicResourceIds` and the public branch of `findAccessibleResources`. */
 aclEntrySchema.index({ principalType: 1, resourceType: 1, permBits: 1, resourceId: 1 });
+aclEntrySchema.index({ expiredAt: 1 }, { expireAfterSeconds: 0 });
 
 export default aclEntrySchema;
diff --git a/packages/data-schemas/src/schema/action.ts b/packages/data-schemas/src/schema/action.ts
index 5cde2ad6fca..771b0301f1b 100644
--- a/packages/data-schemas/src/schema/action.ts
+++ b/packages/data-schemas/src/schema/action.ts
@@ -16,7 +16,7 @@ const AuthSchema = new Schema(
   { _id: false },
 );
 
-const Action = new Schema<IAction>({
+const Action: mongoose.Schema<IAction> = new Schema<IAction>({
   user: {
     type: mongoose.Schema.Types.ObjectId,
     ref: 'User',
diff --git a/packages/data-schemas/src/schema/agent.ts b/packages/data-schemas/src/schema/agent.ts
index 33e1a92d6f5..5ef6a9cf0d7 100644
--- a/packages/data-schemas/src/schema/agent.ts
+++ b/packages/data-schemas/src/schema/agent.ts
@@ -1,7 +1,7 @@
 import { Schema } from 'mongoose';
 import type { IAgent } from '~/types';
 
-const agentSchema = new Schema<IAgent>(
+const agentSchema: Schema<IAgent> = new Schema<IAgent>(
   {
     id: {
       type: String,
diff --git a/packages/data-schemas/src/schema/agentCategory.ts b/packages/data-schemas/src/schema/agentCategory.ts
index 2922042129f..e8d611fb05d 100644
--- a/packages/data-schemas/src/schema/agentCategory.ts
+++ b/packages/data-schemas/src/schema/agentCategory.ts
@@ -1,7 +1,7 @@
 import { Schema } from 'mongoose';
 import type { IAgentCategory } from '~/types';
 
-const agentCategorySchema = new Schema<IAgentCategory>(
+const agentCategorySchema: Schema<IAgentCategory> = new Schema<IAgentCategory>(
   {
     value: {
       type: String,
diff --git a/packages/data-schemas/src/schema/assistant.ts b/packages/data-schemas/src/schema/assistant.ts
index 3fc052d4584..da2c86b7620 100644
--- a/packages/data-schemas/src/schema/assistant.ts
+++ b/packages/data-schemas/src/schema/assistant.ts
@@ -1,7 +1,7 @@
 import { Schema } from 'mongoose';
 import type { IAssistant } from '~/types';
 
-const assistantSchema = new Schema<IAssistant>(
+const assistantSchema: Schema<IAssistant> = new Schema<IAssistant>(
   {
     user: {
       type: Schema.Types.ObjectId,
diff --git a/packages/data-schemas/src/schema/balance.ts b/packages/data-schemas/src/schema/balance.ts
index 07c94b71f8e..4314d1f2cf9 100644
--- a/packages/data-schemas/src/schema/balance.ts
+++ b/packages/data-schemas/src/schema/balance.ts
@@ -2,7 +2,7 @@ import { Schema } from 'mongoose';
 import { REFILL_INTERVAL_UNITS } from 'librechat-data-provider';
 import type * as t from '~/types';
 
-const balanceSchema = new Schema<t.IBalance>({
+const balanceSchema: Schema<t.IBalance> = new Schema<t.IBalance>({
   user: {
     type: Schema.Types.ObjectId,
     ref: 'User',
diff --git a/packages/data-schemas/src/schema/banner.ts b/packages/data-schemas/src/schema/banner.ts
index 73baa92b2fe..6c369c199de 100644
--- a/packages/data-schemas/src/schema/banner.ts
+++ b/packages/data-schemas/src/schema/banner.ts
@@ -11,7 +11,7 @@ export interface IBanner extends Document {
   tenantId?: string;
 }
 
-const bannerSchema = new Schema<IBanner>(
+const bannerSchema: Schema<IBanner> = new Schema<IBanner>(
   {
     bannerId: {
       type: String,
diff --git a/packages/data-schemas/src/schema/categories.ts b/packages/data-schemas/src/schema/categories.ts
index 94832b54de8..6fa3ab1e6b0 100644
--- a/packages/data-schemas/src/schema/categories.ts
+++ b/packages/data-schemas/src/schema/categories.ts
@@ -6,7 +6,7 @@ export interface ICategory extends Document {
   tenantId?: string;
 }
 
-const categoriesSchema = new Schema<ICategory>({
+const categoriesSchema: Schema<ICategory> = new Schema<ICategory>({
   label: {
     type: String,
     required: true,
diff --git a/packages/data-schemas/src/schema/chatProject.ts b/packages/data-schemas/src/schema/chatProject.ts
new file mode 100644
index 00000000000..837a68b3e72
--- /dev/null
+++ b/packages/data-schemas/src/schema/chatProject.ts
@@ -0,0 +1,50 @@
+import { Schema } from 'mongoose';
+import type { IChatProjectDocument } from '~/types';
+
+const chatProjectSchema: Schema<IChatProjectDocument> = new Schema<IChatProjectDocument>(
+  {
+    name: {
+      type: String,
+      required: true,
+      trim: true,
+      maxlength: 100,
+      index: true,
+    },
+    description: {
+      type: String,
+      default: '',
+      trim: true,
+      maxlength: 1000,
+    },
+    user: {
+      type: String,
+      required: true,
+      index: true,
+    },
+    conversationCount: {
+      type: Number,
+      default: 0,
+      min: 0,
+    },
+    lastConversationAt: {
+      type: Date,
+      default: null,
+      index: true,
+    },
+    lastConversationId: {
+      type: String,
+      default: null,
+    },
+    tenantId: {
+      type: String,
+      index: true,
+    },
+  },
+  { timestamps: true },
+);
+
+chatProjectSchema.index({ user: 1, name: 1, _id: 1 });
+chatProjectSchema.index({ user: 1, createdAt: -1, _id: -1 });
+chatProjectSchema.index({ user: 1, lastConversationAt: -1, _id: -1 });
+
+export default chatProjectSchema;
diff --git a/packages/data-schemas/src/schema/config.ts b/packages/data-schemas/src/schema/config.ts
index be3784d55e2..bc8654e9dfe 100644
--- a/packages/data-schemas/src/schema/config.ts
+++ b/packages/data-schemas/src/schema/config.ts
@@ -2,7 +2,7 @@ import { Schema } from 'mongoose';
 import { PrincipalType, PrincipalModel } from 'librechat-data-provider';
 import type { IConfig } from '~/types';
 
-const configSchema = new Schema<IConfig>(
+const configSchema: Schema<IConfig> = new Schema<IConfig>(
   {
     principalType: {
       type: String,
@@ -30,6 +30,10 @@ const configSchema = new Schema<IConfig>(
       type: Schema.Types.Mixed,
       default: {},
     },
+    tombstones: {
+      type: [String],
+      default: [],
+    },
     isActive: {
       type: Boolean,
       default: true,
diff --git a/packages/data-schemas/src/schema/conversationTag.ts b/packages/data-schemas/src/schema/conversationTag.ts
index 6b37257121b..f3d0c8c0efb 100644
--- a/packages/data-schemas/src/schema/conversationTag.ts
+++ b/packages/data-schemas/src/schema/conversationTag.ts
@@ -9,7 +9,7 @@ export interface IConversationTag extends Document {
   tenantId?: string;
 }
 
-const conversationTag = new Schema<IConversationTag>(
+const conversationTag: Schema<IConversationTag> = new Schema<IConversationTag>(
   {
     tag: {
       type: String,
diff --git a/packages/data-schemas/src/schema/convo.ts b/packages/data-schemas/src/schema/convo.ts
index 24915af8a56..aad324fa7a1 100644
--- a/packages/data-schemas/src/schema/convo.ts
+++ b/packages/data-schemas/src/schema/convo.ts
@@ -34,6 +34,11 @@ const convoSchema: Schema<IConversation> = new Schema(
       default: [],
       meiliIndex: true,
     },
+    chatProjectId: {
+      type: String,
+      default: null,
+      index: true,
+    },
     files: {
       type: [String],
     },
@@ -51,6 +56,8 @@ const convoSchema: Schema<IConversation> = new Schema(
 convoSchema.index({ expiredAt: 1 }, { expireAfterSeconds: 0 });
 convoSchema.index({ createdAt: 1, updatedAt: 1 });
 convoSchema.index({ conversationId: 1, user: 1, tenantId: 1 }, { unique: true });
+convoSchema.index({ user: 1, chatProjectId: 1, updatedAt: -1, _id: -1 });
+convoSchema.index({ user: 1, chatProjectId: 1, createdAt: -1, _id: -1 });
 
 convoSchema.index({ user: 1, isTemporary: 1, expiredAt: 1 });
 // index for MeiliSearch sync operations
diff --git a/packages/data-schemas/src/schema/defaults.ts b/packages/data-schemas/src/schema/defaults.ts
index 9b50bceb1d9..148a2b5f425 100644
--- a/packages/data-schemas/src/schema/defaults.ts
+++ b/packages/data-schemas/src/schema/defaults.ts
@@ -1,7 +1,186 @@
 import { Schema } from 'mongoose';
 
 // @ts-ignore
-export const conversationPreset = {
+export const conversationPreset: {
+  endpoint: {
+    type: StringConstructor;
+    default: null;
+    required: boolean;
+  };
+  endpointType: {
+    type: StringConstructor;
+  };
+  // for azureOpenAI, openAI only
+  model: {
+    type: StringConstructor;
+    required: boolean;
+  };
+  // for bedrock only
+  region: {
+    type: StringConstructor;
+    required: boolean;
+  };
+  // for azureOpenAI, openAI only
+  chatGptLabel: {
+    type: StringConstructor;
+    required: boolean;
+  };
+  // for google only
+  examples: {
+    type: {
+      type: typeof Schema.Types.Mixed;
+    }[];
+    default: undefined;
+  };
+  modelLabel: {
+    type: StringConstructor;
+    required: boolean;
+  };
+  promptPrefix: {
+    type: StringConstructor;
+    required: boolean;
+  };
+  temperature: {
+    type: NumberConstructor;
+    required: boolean;
+  };
+  top_p: {
+    type: NumberConstructor;
+    required: boolean;
+  };
+  // for google only
+  topP: {
+    type: NumberConstructor;
+    required: boolean;
+  };
+  topK: {
+    type: NumberConstructor;
+    required: boolean;
+  };
+  maxOutputTokens: {
+    type: NumberConstructor;
+    required: boolean;
+  };
+  maxTokens: {
+    type: NumberConstructor;
+    required: boolean;
+  };
+  presence_penalty: {
+    type: NumberConstructor;
+    required: boolean;
+  };
+  frequency_penalty: {
+    type: NumberConstructor;
+    required: boolean;
+  };
+  file_ids: {
+    type: {
+      type: StringConstructor;
+    }[];
+    default: undefined;
+  };
+  // deprecated
+  resendImages: {
+    type: BooleanConstructor;
+  };
+  /* Anthropic only */
+  promptCache: {
+    type: BooleanConstructor;
+  };
+  thinking: {
+    type: BooleanConstructor;
+  };
+  thinkingBudget: {
+    type: NumberConstructor;
+  };
+  thinkingLevel: {
+    type: StringConstructor;
+  };
+  effort: {
+    type: StringConstructor;
+  };
+  system: {
+    type: StringConstructor;
+  };
+  // files
+  resendFiles: {
+    type: BooleanConstructor;
+  };
+  imageDetail: {
+    type: StringConstructor;
+  };
+  /* agents */
+  agent_id: {
+    type: StringConstructor;
+  };
+  /* assistants */
+  assistant_id: {
+    type: StringConstructor;
+  };
+  instructions: {
+    type: StringConstructor;
+  };
+  stop: {
+    type: {
+      type: StringConstructor;
+    }[];
+    default: undefined;
+  };
+  isArchived: {
+    type: BooleanConstructor;
+    default: boolean;
+  };
+  /* UI Components */
+  iconURL: {
+    type: StringConstructor;
+  };
+  greeting: {
+    type: StringConstructor;
+  };
+  spec: {
+    type: StringConstructor;
+  };
+  tags: {
+    type: StringConstructor[];
+    default: never[];
+  };
+  tools: {
+    type: {
+      type: StringConstructor;
+    }[];
+    default: undefined;
+  };
+  maxContextTokens: {
+    type: NumberConstructor;
+  };
+  max_tokens: {
+    type: NumberConstructor;
+  };
+  useResponsesApi: {
+    type: BooleanConstructor;
+  };
+  /** OpenAI Responses API / Anthropic API / Google API */
+  web_search: {
+    type: BooleanConstructor;
+  };
+  disableStreaming: {
+    type: BooleanConstructor;
+  };
+  fileTokenLimit: {
+    type: NumberConstructor;
+  };
+  /** Reasoning models only */
+  reasoning_effort: {
+    type: StringConstructor;
+  };
+  reasoning_summary: {
+    type: StringConstructor;
+  };
+  /** Verbosity control */
+  verbosity: {
+    type: StringConstructor;
+  };
+} = {
   endpoint: {
     type: String,
     default: null,
diff --git a/packages/data-schemas/src/schema/group.ts b/packages/data-schemas/src/schema/group.ts
index 3cdbd313309..73d8928233e 100644
--- a/packages/data-schemas/src/schema/group.ts
+++ b/packages/data-schemas/src/schema/group.ts
@@ -1,7 +1,7 @@
 import { Schema } from 'mongoose';
 import type { IGroup } from '~/types';
 
-const groupSchema = new Schema<IGroup>(
+const groupSchema: Schema<IGroup> = new Schema<IGroup>(
   {
     name: {
       type: String,
diff --git a/packages/data-schemas/src/schema/index.ts b/packages/data-schemas/src/schema/index.ts
index 2a5eff658bd..0dfd4dcb305 100644
--- a/packages/data-schemas/src/schema/index.ts
+++ b/packages/data-schemas/src/schema/index.ts
@@ -6,6 +6,7 @@ export { default as assistantSchema } from './assistant';
 export { default as balanceSchema } from './balance';
 export { default as bannerSchema } from './banner';
 export { default as categoriesSchema } from './categories';
+export { default as chatProjectSchema } from './chatProject';
 export { default as conversationTagSchema } from './conversationTag';
 export { default as convoSchema } from './convo';
 export { default as fileSchema } from './file';
@@ -18,6 +19,8 @@ export { default as promptGroupSchema } from './promptGroup';
 export { default as roleSchema } from './role';
 export { default as sessionSchema } from './session';
 export { default as shareSchema } from './share';
+export { default as skillSyncCredentialSchema } from './skillSyncCredential';
+export { default as skillSyncStatusSchema } from './skillSyncStatus';
 export { default as tokenSchema } from './token';
 export { default as toolCallSchema } from './toolCall';
 export { default as transactionSchema } from './transaction';
diff --git a/packages/data-schemas/src/schema/mcpServer.ts b/packages/data-schemas/src/schema/mcpServer.ts
index ac881932da8..9a0d63bff8a 100644
--- a/packages/data-schemas/src/schema/mcpServer.ts
+++ b/packages/data-schemas/src/schema/mcpServer.ts
@@ -1,7 +1,7 @@
 import { Schema } from 'mongoose';
 import type { MCPServerDocument } from '~/types';
 
-const mcpServerSchema = new Schema<MCPServerDocument>(
+const mcpServerSchema: Schema<MCPServerDocument> = new Schema<MCPServerDocument>(
   {
     serverName: {
       type: String,
diff --git a/packages/data-schemas/src/schema/promptGroup.ts b/packages/data-schemas/src/schema/promptGroup.ts
index 629942f23bc..99dc8bda69f 100644
--- a/packages/data-schemas/src/schema/promptGroup.ts
+++ b/packages/data-schemas/src/schema/promptGroup.ts
@@ -2,7 +2,7 @@ import { Schema } from 'mongoose';
 import { Constants } from 'librechat-data-provider';
 import type { IPromptGroupDocument } from '~/types';
 
-const promptGroupSchema = new Schema<IPromptGroupDocument>(
+const promptGroupSchema: Schema<IPromptGroupDocument> = new Schema<IPromptGroupDocument>(
   {
     name: {
       type: String,
diff --git a/packages/data-schemas/src/schema/role.ts b/packages/data-schemas/src/schema/role.ts
index ed2ae58379f..c931179631e 100644
--- a/packages/data-schemas/src/schema/role.ts
+++ b/packages/data-schemas/src/schema/role.ts
@@ -74,6 +74,11 @@ const rolePermissionsSchema = new Schema(
       [Permissions.SHARE]: { type: Boolean },
       [Permissions.SHARE_PUBLIC]: { type: Boolean },
     },
+    [PermissionTypes.SHARED_LINKS]: {
+      [Permissions.CREATE]: { type: Boolean },
+      [Permissions.SHARE]: { type: Boolean },
+      [Permissions.SHARE_PUBLIC]: { type: Boolean },
+    },
   },
   { _id: false },
 );
diff --git a/packages/data-schemas/src/schema/share.ts b/packages/data-schemas/src/schema/share.ts
index 616536fe527..66eb3e808f8 100644
--- a/packages/data-schemas/src/schema/share.ts
+++ b/packages/data-schemas/src/schema/share.ts
@@ -7,7 +7,6 @@ export interface ISharedLink extends Document {
   messages?: Types.ObjectId[];
   shareId?: string;
   targetMessageId?: string;
-  isPublic: boolean;
   expiredAt?: Date;
   createdAt?: Date;
   updatedAt?: Date;
@@ -38,10 +37,6 @@ const shareSchema: Schema<ISharedLink> = new Schema(
       required: false,
       index: true,
     },
-    isPublic: {
-      type: Boolean,
-      default: true,
-    },
     tenantId: {
       type: String,
       index: true,
diff --git a/packages/data-schemas/src/schema/skill.ts b/packages/data-schemas/src/schema/skill.ts
index c3d30e981ad..9ece6d82cce 100644
--- a/packages/data-schemas/src/schema/skill.ts
+++ b/packages/data-schemas/src/schema/skill.ts
@@ -182,12 +182,9 @@ const skillSchema: Schema<ISkillDocument> = new Schema(
     /**
      * Provenance of this skill's canonical definition.
      *
-     * - `inline` — authored directly inside LibreChat (the only path wired
-     *   up in phase 1).
-     * - `github` / `notion` — **reserved for phase 2+ external sync**. No
-     *   code path currently produces these values. The column exists now so
-     *   a future sync worker can populate `source` + `sourceMetadata` without
-     *   a schema migration.
+     * - `inline` — authored directly inside LibreChat.
+     * - `github` — mirrored from a configured GitHub skill sync source.
+     * - `notion` — reserved for future external sync integrations.
      */
     source: {
       type: String,
@@ -195,10 +192,8 @@ const skillSchema: Schema<ISkillDocument> = new Schema(
       default: 'inline',
     },
     /**
-     * Arbitrary JSON provenance payload keyed by `source`. Phase 2+ sync
-     * workers will use this to store the upstream commit SHA (github),
-     * page id (notion), etc. Unused in phase 1 — kept `Mixed` to avoid
-     * committing to a shape before the sync paths exist.
+     * Arbitrary JSON provenance payload keyed by `source`. GitHub sync stores
+     * source id, upstream path, commit/blob SHAs, and sync status here.
      */
     sourceMetadata: {
       type: Schema.Types.Mixed,
@@ -211,7 +206,7 @@ const skillSchema: Schema<ISkillDocument> = new Schema(
     /**
      * When `true`, the skill's SKILL.md body is auto-primed into every turn
      * without user `$` invocation or model discretion. Mirrors the
-     * `always-apply` YAML frontmatter field and is kept as a first-class
+     * always-apply YAML frontmatter field and is kept as a first-class
      * column so the `listAlwaysApplySkills` query at the top of every
      * request is an indexed lookup, not a frontmatter scan.
      */
@@ -234,5 +229,7 @@ skillSchema.index({ author: 1, tenantId: 1 });
 skillSchema.index({ category: 1, updatedAt: -1 });
 skillSchema.index({ updatedAt: -1, _id: 1 });
 skillSchema.index({ name: 1, author: 1, tenantId: 1 }, { unique: true });
+skillSchema.index({ source: 1, 'sourceMetadata.upstreamId': 1, tenantId: 1 });
+skillSchema.index({ source: 1, 'sourceMetadata.sourceId': 1, tenantId: 1 });
 
 export default skillSchema;
diff --git a/packages/data-schemas/src/schema/skillFile.ts b/packages/data-schemas/src/schema/skillFile.ts
index efb5a29c1db..27f38847b93 100644
--- a/packages/data-schemas/src/schema/skillFile.ts
+++ b/packages/data-schemas/src/schema/skillFile.ts
@@ -69,6 +69,9 @@ const skillFileSchema: Schema<ISkillFileDocument> = new Schema(
       type: String,
       required: true,
     },
+    sourceMetadata: {
+      type: Schema.Types.Mixed,
+    },
     mimeType: {
       type: String,
       required: true,
diff --git a/packages/data-schemas/src/schema/skillSyncCredential.ts b/packages/data-schemas/src/schema/skillSyncCredential.ts
new file mode 100644
index 00000000000..3ff90a1d79d
--- /dev/null
+++ b/packages/data-schemas/src/schema/skillSyncCredential.ts
@@ -0,0 +1,45 @@
+import { Schema } from 'mongoose';
+import type { ISkillSyncCredentialDocument } from '~/types/skillSync';
+
+const skillSyncCredentialSchema: Schema<ISkillSyncCredentialDocument> = new Schema(
+  {
+    provider: {
+      type: String,
+      enum: ['github'],
+      required: true,
+      index: true,
+    },
+    credentialKey: {
+      type: String,
+      required: true,
+      maxlength: 64,
+      match: /^[a-zA-Z0-9][a-zA-Z0-9_-]*$/,
+      index: true,
+    },
+    encryptedToken: {
+      type: String,
+      required: true,
+      select: false,
+    },
+    tokenHash: {
+      type: String,
+      required: true,
+      select: false,
+    },
+    createdBy: {
+      type: Schema.Types.ObjectId,
+      ref: 'User',
+    },
+    updatedBy: {
+      type: Schema.Types.ObjectId,
+      ref: 'User',
+    },
+  },
+  {
+    timestamps: true,
+  },
+);
+
+skillSyncCredentialSchema.index({ provider: 1, credentialKey: 1 }, { unique: true });
+
+export default skillSyncCredentialSchema;
diff --git a/packages/data-schemas/src/schema/skillSyncStatus.ts b/packages/data-schemas/src/schema/skillSyncStatus.ts
new file mode 100644
index 00000000000..0413f9d02e2
--- /dev/null
+++ b/packages/data-schemas/src/schema/skillSyncStatus.ts
@@ -0,0 +1,97 @@
+import { Schema } from 'mongoose';
+import type { ISkillSyncStatusDocument } from '~/types/skillSync';
+
+const skillSyncStatusSchema: Schema<ISkillSyncStatusDocument> = new Schema(
+  {
+    provider: {
+      type: String,
+      enum: ['github'],
+      required: true,
+      index: true,
+    },
+    sourceId: {
+      type: String,
+      required: true,
+      maxlength: 128,
+      index: true,
+    },
+    tenantId: {
+      type: String,
+      index: true,
+    },
+    status: {
+      type: String,
+      enum: ['idle', 'running', 'succeeded', 'failed', 'skipped'],
+      default: 'idle',
+      required: true,
+    },
+    credentialKey: {
+      type: String,
+    },
+    owner: {
+      type: String,
+    },
+    repo: {
+      type: String,
+    },
+    ref: {
+      type: String,
+    },
+    paths: {
+      type: [String],
+      default: undefined,
+    },
+    startedAt: {
+      type: Date,
+    },
+    finishedAt: {
+      type: Date,
+    },
+    lastSuccessAt: {
+      type: Date,
+    },
+    lastFailureAt: {
+      type: Date,
+    },
+    errorCode: {
+      type: String,
+    },
+    errorMessage: {
+      type: String,
+    },
+    syncedSkillCount: {
+      type: Number,
+      default: 0,
+      min: 0,
+    },
+    syncedFileCount: {
+      type: Number,
+      default: 0,
+      min: 0,
+    },
+    deletedSkillCount: {
+      type: Number,
+      default: 0,
+      min: 0,
+    },
+    deletedFileCount: {
+      type: Number,
+      default: 0,
+      min: 0,
+    },
+    lockOwner: {
+      type: String,
+    },
+    lockExpiresAt: {
+      type: Date,
+      index: true,
+    },
+  },
+  {
+    timestamps: true,
+  },
+);
+
+skillSyncStatusSchema.index({ provider: 1, sourceId: 1, tenantId: 1 }, { unique: true });
+
+export default skillSyncStatusSchema;
diff --git a/packages/data-schemas/src/schema/systemGrant.ts b/packages/data-schemas/src/schema/systemGrant.ts
index 61ba319ba4c..eac8dc6b19c 100644
--- a/packages/data-schemas/src/schema/systemGrant.ts
+++ b/packages/data-schemas/src/schema/systemGrant.ts
@@ -1,9 +1,9 @@
 import { Schema } from 'mongoose';
 import { PrincipalType } from 'librechat-data-provider';
-import { isValidCapability } from '~/admin/capabilities';
 import type { ISystemGrant } from '~/types';
+import { isValidCapability } from '~/admin/capabilities';
 
-const systemGrantSchema = new Schema<ISystemGrant>(
+const systemGrantSchema: Schema<ISystemGrant> = new Schema<ISystemGrant>(
   {
     principalType: {
       type: String,
diff --git a/packages/data-schemas/src/schema/user.ts b/packages/data-schemas/src/schema/user.ts
index f43319642d0..8c407e3d365 100644
--- a/packages/data-schemas/src/schema/user.ts
+++ b/packages/data-schemas/src/schema/user.ts
@@ -23,7 +23,7 @@ const BackupCodeSchema = new Schema(
   { _id: false },
 );
 
-const userSchema = new Schema<IUser>(
+const userSchema: Schema<IUser> = new Schema<IUser>(
   {
     name: {
       type: String,
diff --git a/packages/data-schemas/src/types/aclEntry.ts b/packages/data-schemas/src/types/aclEntry.ts
index ae5860a5998..a2320b5a40e 100644
--- a/packages/data-schemas/src/types/aclEntry.ts
+++ b/packages/data-schemas/src/types/aclEntry.ts
@@ -22,6 +22,8 @@ export type AclEntry = {
   grantedBy?: Types.ObjectId;
   /** When this permission was granted */
   grantedAt?: Date;
+  /** Optional expiration date for permissions tied to expiring resources */
+  expiredAt?: Date;
   tenantId?: string;
 };
 
diff --git a/packages/data-schemas/src/types/app.ts b/packages/data-schemas/src/types/app.ts
index 4562e588eeb..0eb0f4d60b1 100644
--- a/packages/data-schemas/src/types/app.ts
+++ b/packages/data-schemas/src/types/app.ts
@@ -13,6 +13,7 @@ import type {
   TAssistantEndpoint,
   TAnthropicEndpoint,
   SummarizationConfig,
+  SkillSyncConfig,
 } from 'librechat-data-provider';
 
 export type JsonSchemaType = {
@@ -62,6 +63,10 @@ export interface AppConfig {
   summarization?: SummarizationConfig;
   /** Web search configuration */
   webSearch?: TCustomConfig['webSearch'];
+  /** Message filter configuration (PII and future filter types) */
+  messageFilter?: TCustomConfig['messageFilter'];
+  /** Skill sync configuration */
+  skillSync?: SkillSyncConfig;
   /** File storage strategy ('local', 's3', 'firebase', 'azure_blob', 'cloudfront') */
   fileStrategy: FileStorage;
   /** File strategies configuration */
diff --git a/packages/data-schemas/src/types/chatProject.ts b/packages/data-schemas/src/types/chatProject.ts
new file mode 100644
index 00000000000..8486ec6f2b1
--- /dev/null
+++ b/packages/data-schemas/src/types/chatProject.ts
@@ -0,0 +1,16 @@
+import type { Document, Types } from 'mongoose';
+
+export interface IChatProject {
+  _id?: Types.ObjectId;
+  name: string;
+  description?: string;
+  user: string;
+  conversationCount: number;
+  lastConversationAt?: Date | null;
+  lastConversationId?: string | null;
+  createdAt?: Date;
+  updatedAt?: Date;
+  tenantId?: string;
+}
+
+export interface IChatProjectDocument extends Omit<IChatProject, '_id'>, Document {}
diff --git a/packages/data-schemas/src/types/config.ts b/packages/data-schemas/src/types/config.ts
index 04e0ca58abd..b980a709939 100644
--- a/packages/data-schemas/src/types/config.ts
+++ b/packages/data-schemas/src/types/config.ts
@@ -18,6 +18,8 @@ export type Config = {
   priority: number;
   /** Configuration overrides matching librechat.yaml structure */
   overrides: Partial<TCustomConfig>;
+  /** Dot-paths that suppress inherited config values during resolution */
+  tombstones?: string[];
   /** Whether this config override is currently active */
   isActive: boolean;
   /** Version number for cache invalidation, auto-increments on overrides change */
diff --git a/packages/data-schemas/src/types/convo.ts b/packages/data-schemas/src/types/convo.ts
index 5cd828e9d6d..abced644248 100644
--- a/packages/data-schemas/src/types/convo.ts
+++ b/packages/data-schemas/src/types/convo.ts
@@ -42,6 +42,7 @@ export interface IConversation extends Document {
   greeting?: string;
   spec?: string;
   tags?: string[];
+  chatProjectId?: string | null;
   tools?: string[];
   maxContextTokens?: number;
   max_tokens?: number;
diff --git a/packages/data-schemas/src/types/index.ts b/packages/data-schemas/src/types/index.ts
index f0b1fee5ec4..da4f42c435e 100644
--- a/packages/data-schemas/src/types/index.ts
+++ b/packages/data-schemas/src/types/index.ts
@@ -5,6 +5,7 @@ export * from './app';
 export * from './user';
 export * from './token';
 export * from './convo';
+export * from './chatProject';
 export * from './session';
 export * from './balance';
 export * from './banner';
@@ -25,6 +26,7 @@ export * from './memory';
 export * from './prompts';
 /* Skills */
 export * from './skill';
+export * from './skillSync';
 /* Access Control */
 export * from './accessRole';
 export * from './aclEntry';
diff --git a/packages/data-schemas/src/types/role.ts b/packages/data-schemas/src/types/role.ts
index 7ffa6e88497..2f6b6c813c4 100644
--- a/packages/data-schemas/src/types/role.ts
+++ b/packages/data-schemas/src/types/role.ts
@@ -72,6 +72,11 @@ export interface IRole extends Document {
       [Permissions.SHARE]?: boolean;
       [Permissions.SHARE_PUBLIC]?: boolean;
     };
+    [PermissionTypes.SHARED_LINKS]?: {
+      [Permissions.CREATE]?: boolean;
+      [Permissions.SHARE]?: boolean;
+      [Permissions.SHARE_PUBLIC]?: boolean;
+    };
   };
   tenantId?: string;
 }
diff --git a/packages/data-schemas/src/types/share.ts b/packages/data-schemas/src/types/share.ts
index 285818c35a7..3d5de455d1f 100644
--- a/packages/data-schemas/src/types/share.ts
+++ b/packages/data-schemas/src/types/share.ts
@@ -9,21 +9,57 @@ export interface ISharedLink {
   messages?: Types.ObjectId[];
   shareId?: string;
   targetMessageId?: string;
-  isPublic: boolean;
   expiredAt?: Date;
   createdAt?: Date;
   updatedAt?: Date;
+  /** Owning tenant for multi-tenant deployments (read by the shared-link access middleware). */
+  tenantId?: string;
 }
 
 export interface ShareServiceError extends Error {
   code: string;
 }
 
+/**
+ * A file or attachment as exposed through a public shared link: storage- and
+ * identity-internal fields are stripped, but render-relevant data (including
+ * dynamic tool-call payloads keyed by tool name) is preserved.
+ */
+export type SharedFile = Record<string, unknown>;
+
+/**
+ * Public, anonymized projection of a message returned by a shared link. Only
+ * render-relevant fields are surfaced; internal fields (user, endpoint,
+ * conversationSignature, clientId, plugin(s), metadata, etc.) are omitted.
+ */
+export type SharedMessage = Pick<
+  IMessage,
+  | 'messageId'
+  | 'parentMessageId'
+  | 'conversationId'
+  | 'sender'
+  | 'text'
+  | 'content'
+  | 'iconURL'
+  | 'isCreatedByUser'
+  | 'createdAt'
+  | 'updatedAt'
+  | 'tokenCount'
+  | 'unfinished'
+  | 'error'
+  | 'finish_reason'
+  | 'manualSkills'
+  | 'alwaysAppliedSkills'
+> & {
+  model?: string;
+  files?: SharedFile[];
+  attachments?: SharedFile[];
+};
+
 export interface SharedLinksResult {
   links: Array<{
     shareId: string;
     title: string;
-    isPublic: boolean;
     createdAt: Date;
     conversationId: string;
   }>;
@@ -33,33 +69,36 @@ export interface SharedLinksResult {
 
 export interface SharedMessagesResult {
   conversationId: string;
-  messages: Array<IMessage>;
+  messages: Array<SharedMessage>;
   shareId: string;
   title?: string;
-  isPublic: boolean;
   createdAt?: Date;
   updatedAt?: Date;
 }
 
 export interface CreateShareResult {
+  _id?: string;
   shareId: string;
   conversationId: string;
   targetMessageId?: string;
 }
 
 export interface UpdateShareResult {
+  _id?: string;
   shareId: string;
   conversationId: string;
   targetMessageId?: string;
 }
 
 export interface DeleteShareResult {
+  _id?: string;
   success: boolean;
   shareId: string;
   message: string;
 }
 
 export interface GetShareLinkResult {
+  _id?: string;
   shareId: string | null;
   targetMessageId?: string;
   success: boolean;
diff --git a/packages/data-schemas/src/types/skill.ts b/packages/data-schemas/src/types/skill.ts
index a2cba928d19..e10c5bfda76 100644
--- a/packages/data-schemas/src/types/skill.ts
+++ b/packages/data-schemas/src/types/skill.ts
@@ -70,14 +70,14 @@ export interface ISkill {
   version: number;
   /**
    * Provenance of this skill's canonical definition.
-   * - `inline` — authored inside LibreChat (the only value phase 1 produces).
-   * - `github` / `notion` — reserved for phase 2+ external sync. Kept in the
-   *   enum so a future sync worker can populate it without a migration.
+   * - `inline` — authored inside LibreChat.
+   * - `github` — mirrored from a configured GitHub skill sync source.
+   * - `notion` — reserved for future external sync integrations.
    */
   source: 'inline' | 'github' | 'notion';
   /**
-   * Provenance payload keyed by `source`. Phase 2+ sync workers will store
-   * upstream identifiers (commit SHA, page id, etc.) here. Unused in phase 1.
+   * Provenance payload keyed by `source`, including upstream identifiers
+   * such as GitHub source id, path, and commit/blob SHAs.
    */
   sourceMetadata?: Record<string, unknown>;
   /** Denormalized count of associated `SkillFile` rows. Kept in sync by skill methods. */
@@ -120,6 +120,7 @@ export interface ISkillFile {
   storageKey?: string;
   storageRegion?: string;
   source: string;
+  sourceMetadata?: Record<string, unknown>;
   mimeType: string;
   bytes: number;
   category: 'script' | 'reference' | 'asset' | 'other';
diff --git a/packages/data-schemas/src/types/skillSync.ts b/packages/data-schemas/src/types/skillSync.ts
new file mode 100644
index 00000000000..edd3bf5704a
--- /dev/null
+++ b/packages/data-schemas/src/types/skillSync.ts
@@ -0,0 +1,45 @@
+import type { Document, Types } from 'mongoose';
+
+export type SkillSyncProvider = 'github';
+export type SkillSyncRunStatus = 'idle' | 'running' | 'succeeded' | 'failed' | 'skipped';
+
+export interface ISkillSyncCredential {
+  provider: SkillSyncProvider;
+  credentialKey: string;
+  encryptedToken: string;
+  tokenHash: string;
+  createdBy?: Types.ObjectId;
+  updatedBy?: Types.ObjectId;
+  createdAt?: Date;
+  updatedAt?: Date;
+}
+
+export interface ISkillSyncCredentialDocument extends ISkillSyncCredential, Document {}
+
+export interface ISkillSyncStatus {
+  provider: SkillSyncProvider;
+  sourceId: string;
+  tenantId?: string;
+  status: SkillSyncRunStatus;
+  credentialKey?: string;
+  owner?: string;
+  repo?: string;
+  ref?: string;
+  paths?: string[];
+  startedAt?: Date;
+  finishedAt?: Date;
+  lastSuccessAt?: Date;
+  lastFailureAt?: Date;
+  errorCode?: string;
+  errorMessage?: string;
+  syncedSkillCount: number;
+  syncedFileCount: number;
+  deletedSkillCount: number;
+  deletedFileCount: number;
+  lockOwner?: string;
+  lockExpiresAt?: Date;
+  createdAt?: Date;
+  updatedAt?: Date;
+}
+
+export interface ISkillSyncStatusDocument extends ISkillSyncStatus, Document {}
diff --git a/packages/data-schemas/src/types/token.ts b/packages/data-schemas/src/types/token.ts
index fd5bfa3a8a0..560900c4090 100644
--- a/packages/data-schemas/src/types/token.ts
+++ b/packages/data-schemas/src/types/token.ts
@@ -19,15 +19,15 @@ export interface TokenCreateData {
   identifier?: string;
   token: string;
   expiresIn: number;
-  metadata?: Map<string, unknown>;
+  metadata?: Record<string, unknown> | Map<string, unknown>;
 }
 
 export interface TokenQuery {
   userId?: Types.ObjectId | string;
   token?: string;
-  email?: string;
-  type?: string;
-  identifier?: string;
+  email?: string | null;
+  type?: string | null;
+  identifier?: string | RegExp | null;
 }
 
 export interface TokenUpdateData {
@@ -37,7 +37,7 @@ export interface TokenUpdateData {
   token?: string;
   expiresAt?: Date;
   expiresIn?: number;
-  metadata?: Map<string, unknown>;
+  metadata?: Record<string, unknown> | Map<string, unknown>;
 }
 
 export interface TokenDeleteResult {
diff --git a/packages/data-schemas/src/utils/object-traverse.spec.ts b/packages/data-schemas/src/utils/object-traverse.spec.ts
new file mode 100644
index 00000000000..555d8740c04
--- /dev/null
+++ b/packages/data-schemas/src/utils/object-traverse.spec.ts
@@ -0,0 +1,158 @@
+import type { TraverseContext } from './object-traverse';
+import traverse from './object-traverse';
+
+/** Collects the dotted leaf paths visited during a traversal. */
+function collectLeafPaths(input: unknown): string[] {
+  const paths: string[] = [];
+  traverse(input).forEach(function (this: TraverseContext) {
+    if (this.isLeaf && !this.isRoot) {
+      paths.push(this.path.join('.'));
+    }
+  });
+  return paths;
+}
+
+/** Counts every node (including the root) visited during a traversal. */
+function countVisits(input: unknown, options?: { maxNodes?: number; maxDepth?: number }): number {
+  let count = 0;
+  traverse(input, options).forEach(function () {
+    count++;
+  });
+  return count;
+}
+
+describe('object-traverse', () => {
+  describe('correctness', () => {
+    it('visits every leaf of a plain nested object', () => {
+      const paths = collectLeafPaths({ a: 1, b: { c: 2, d: 3 } });
+      expect(paths).toEqual(expect.arrayContaining(['a', 'b.c', 'b.d']));
+    });
+
+    it('traverses shared (non-circular) references that appear in multiple branches', () => {
+      const shared = { secret: 'value' };
+      const paths = collectLeafPaths({ a: shared, b: shared });
+
+      expect(paths).toContain('a.secret');
+      expect(paths).toContain('b.secret');
+    });
+
+    it('traverses an array containing the same object multiple times', () => {
+      const shared = { value: 42 };
+      expect(collectLeafPaths([shared, shared, shared])).toEqual(['0.value', '1.value', '2.value']);
+    });
+
+    it('invokes the callback for each occurrence of a shared reference', () => {
+      const shared = { name: 'duplicate' };
+      const visited: unknown[] = [];
+      traverse({ first: shared, second: shared }).forEach(function (value: unknown) {
+        visited.push(value);
+      });
+
+      expect(visited.filter((node) => node === shared)).toHaveLength(2);
+    });
+
+    it('does not treat a diamond-shaped (DAG) structure as circular', () => {
+      const leaf = { v: 1 };
+      const paths = collectLeafPaths({ left: { leaf }, right: { leaf } });
+
+      expect(paths).toContain('left.leaf.v');
+      expect(paths).toContain('right.leaf.v');
+    });
+  });
+
+  describe('cycle safety', () => {
+    it('does not infinitely recurse on a self-referential object', () => {
+      const node: Record<string, unknown> = { id: 1 };
+      node.self = node;
+
+      const paths = collectLeafPaths(node);
+
+      expect(paths).toContain('id');
+      expect(paths).not.toContain('self.id');
+    });
+
+    it('does not infinitely recurse on a multi-node cycle', () => {
+      const a: Record<string, unknown> = { name: 'a' };
+      const b: Record<string, unknown> = { name: 'b' };
+      a.next = b;
+      b.prev = a;
+
+      expect(() => countVisits(a)).not.toThrow();
+      const paths = collectLeafPaths(a);
+      expect(paths).toContain('name');
+      expect(paths).toContain('next.name');
+    });
+  });
+
+  describe('bounds', () => {
+    it('caps total work via maxNodes on a fan-out DAG', () => {
+      // A diamond chain has 2^depth root-to-leaf paths; without a bound this
+      // would visit millions of nodes. The cap keeps it finite.
+      let node: Record<string, unknown> = { leaf: 1 };
+      for (let i = 0; i < 24; i++) {
+        const child = node;
+        node = { l: child, r: child };
+      }
+
+      expect(countVisits(node, { maxNodes: 5000 })).toBeLessThanOrEqual(5000);
+    });
+
+    it('stops descending past maxDepth, visiting deep nodes as leaves', () => {
+      const deep = { a: { b: { c: { d: { e: 'too deep' } } } } };
+
+      const leafLevels: number[] = [];
+      traverse(deep, { maxDepth: 2 }).forEach(function (this: TraverseContext) {
+        if (this.isLeaf) {
+          leafLevels.push(this.level);
+        }
+      });
+
+      expect(Math.max(...leafLevels)).toBe(2);
+    });
+
+    it('does not truncate ordinary objects under the default bounds', () => {
+      // root, a, b, b.c, b.d, and the three array elements.
+      expect(countVisits({ a: 1, b: { c: 2, d: [3, 4, 5] } })).toBe(8);
+    });
+
+    it('stops iterating array children once the node budget is exhausted', () => {
+      let indexReads = 0;
+      const big = Array.from({ length: 1000 }, (_, i) => ({ i }));
+      const probed = new Proxy(big, {
+        get(target, prop, receiver) {
+          if (typeof prop === 'string' && /^\d+$/.test(prop)) {
+            indexReads++;
+          }
+          return Reflect.get(target, prop, receiver);
+        },
+      });
+
+      // The budget is spent on the root alone, so the child loop must break
+      // before touching all 1000 elements (no O(n) work after the cap).
+      countVisits(probed, { maxNodes: 1 });
+
+      expect(indexReads).toBeLessThan(10);
+    });
+  });
+
+  describe('mutation safety', () => {
+    it('detects an ancestor cycle even when a callback replaces the node via update()', () => {
+      const arr: unknown[] = [];
+      arr.push(arr);
+
+      let selfVisits = 0;
+      traverse(arr, { maxDepth: 50 }).forEach(function (this: TraverseContext, value: unknown) {
+        if (value === arr) {
+          selfVisits++;
+        }
+        // Mimic the debug formatter, which rewrites array nodes in place.
+        if (this.notLeaf && Array.isArray(value)) {
+          this.update('[summary]');
+        }
+      });
+
+      // The self-reference is skipped as a true cycle, not re-expanded per level.
+      expect(selfVisits).toBe(1);
+    });
+  });
+});
diff --git a/packages/data-schemas/src/utils/object-traverse.ts b/packages/data-schemas/src/utils/object-traverse.ts
index 836f59a3451..c61fd5cab27 100644
--- a/packages/data-schemas/src/utils/object-traverse.ts
+++ b/packages/data-schemas/src/utils/object-traverse.ts
@@ -3,6 +3,28 @@
  * Simplified implementation focused on the forEach use case
  */
 
+/**
+ * Defensive bounds for traversal. Cycles are detected via the ancestor chain,
+ * but a shared (non-circular) reference reachable through many paths can still
+ * fan out super-linearly on a DAG. These caps keep traversal off the event loop
+ * floor for pathological inputs (e.g. logging a deeply shared object) without
+ * affecting normal use. Tune via the options argument to `traverse`.
+ */
+export interface TraverseOptions {
+  /** Maximum number of nodes visited before traversal stops. */
+  maxNodes?: number;
+  /** Maximum depth descended; deeper nodes are visited as leaves, not expanded. */
+  maxDepth?: number;
+}
+
+// Tuned for the sole consumer, the debug logger. Measured cost is ~140ns/node
+// with the formatter callback, so ~2.5k nodes keeps one log under ~1ms even on
+// slower prod hardware, while real log objects are ~25-30 nodes at depth 3-4 —
+// ample headroom. maxNodes bounds fan-out (the cost lever); maxDepth bounds
+// recursion/readability. Callers needing more override via the options argument.
+const DEFAULT_MAX_NODES = 2_500;
+const DEFAULT_MAX_DEPTH = 5;
+
 export interface TraverseContext {
   node: unknown;
   path: (string | number)[];
@@ -87,37 +109,60 @@ function deleteProperty(obj: TraversableObject, key: string | number): void {
   }
 }
 
-function forEach(obj: unknown, callback: ForEachCallback): void {
-  const visited = new WeakSet<object>();
+function hasOwnEnumerable(node: TraversableObject): boolean {
+  for (const key in node) {
+    if (Object.prototype.hasOwnProperty.call(node, key)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+function forEach(obj: unknown, callback: ForEachCallback, options?: TraverseOptions): void {
+  const maxNodes = options?.maxNodes ?? DEFAULT_MAX_NODES;
+  const maxDepth = options?.maxDepth ?? DEFAULT_MAX_DEPTH;
+  let visitedCount = 0;
+  // Original (never-mutated) node references for the current DFS path, paired
+  // with their contexts. Cycle detection compares against these rather than
+  // context.node, which a callback's update() can reassign.
+  const ancestors: { node: TraversableObject; context: TraverseContext }[] = [];
+
+  function findAncestorCycle(node: TraversableObject): TraverseContext | null {
+    for (let i = ancestors.length - 1; i >= 0; i--) {
+      if (ancestors[i].node === node) {
+        return ancestors[i].context;
+      }
+    }
+    return null;
+  }
 
   function walk(node: unknown, path: (string | number)[] = [], parent?: TraverseContext): void {
-    // Check for circular references
+    if (visitedCount >= maxNodes) {
+      return; // Bound total work; stop once the node budget is exhausted.
+    }
+
+    // Detect cycles via the current DFS path's original node refs. A shared
+    // (non-circular) reference appearing in multiple branches is traversed
+    // independently; the node/depth caps keep a DAG of shared references from
+    // fanning out unboundedly.
     let circular: TraverseContext | null = null;
     if (isObject(node)) {
-      if (visited.has(node)) {
-        // Find the circular reference in the parent chain
-        let p = parent;
-        while (p) {
-          if (p.node === node) {
-            circular = p;
-            break;
-          }
-          p = p.parent;
-        }
-        return; // Skip circular references
+      circular = findAncestorCycle(node);
+      if (circular) {
+        return; // Skip true cycles to avoid infinite recursion.
       }
-      visited.add(node);
     }
 
     const key = path.length > 0 ? path[path.length - 1] : undefined;
     const isRoot = path.length === 0;
     const level = path.length;
+    const tooDeep = level >= maxDepth;
 
     // Determine if this is a leaf node
     const isLeaf =
+      tooDeep ||
       !isObject(node) ||
-      (Array.isArray(node) && node.length === 0) ||
-      Object.keys(node).length === 0;
+      (Array.isArray(node) ? node.length === 0 : !hasOwnEnumerable(node));
 
     // Create context
     const context: TraverseContext = {
@@ -149,19 +194,32 @@ function forEach(obj: unknown, callback: ForEachCallback): void {
     };
 
     // Call the callback with the context
+    visitedCount++;
     callback.call(context, node);
 
-    // Traverse children if not circular and is an object
-    if (!circular && isObject(node) && !isLeaf) {
+    // Traverse children within bounds, breaking as soon as the budget is spent
+    // so a wide array/object can't incur O(n) work after the cap is reached.
+    if (isObject(node) && !isLeaf) {
+      ancestors.push({ node, context });
       if (Array.isArray(node)) {
         for (let i = 0; i < node.length; i++) {
+          if (visitedCount >= maxNodes) {
+            break;
+          }
           walk(node[i], [...path, i], context);
         }
       } else {
-        for (const [childKey, childValue] of Object.entries(node)) {
-          walk(childValue, [...path, childKey], context);
+        for (const childKey in node) {
+          if (!Object.prototype.hasOwnProperty.call(node, childKey)) {
+            continue;
+          }
+          if (visitedCount >= maxNodes) {
+            break;
+          }
+          walk(node[childKey], [...path, childKey], context);
         }
       }
+      ancestors.pop();
     }
   }
 
@@ -169,10 +227,10 @@ function forEach(obj: unknown, callback: ForEachCallback): void {
 }
 
 // Main traverse function that returns an object with forEach method
-export default function traverse(obj: unknown) {
+export default function traverse(obj: unknown, options?: TraverseOptions) {
   return {
     forEach(callback: ForEachCallback): void {
-      forEach(obj, callback);
+      forEach(obj, callback, options);
     },
   };
 }
diff --git a/packages/data-schemas/src/utils/retention.ts b/packages/data-schemas/src/utils/retention.ts
index 7d57351676e..68188209da0 100644
--- a/packages/data-schemas/src/utils/retention.ts
+++ b/packages/data-schemas/src/utils/retention.ts
@@ -28,5 +28,5 @@ export const buildRetentionVisibilityFilter = <
     ],
   }) as FilterQuery<T>;
 
-export const createFallbackRetentionDate = (now = Date.now()): Date =>
+export const createFallbackRetentionDate = (now: number = Date.now()): Date =>
   new Date(now + DEFAULT_RETENTION_HOURS * 60 * 60 * 1000);
diff --git a/packages/data-schemas/src/utils/tempChatRetention.ts b/packages/data-schemas/src/utils/tempChatRetention.ts
index 663228c13ec..00122546254 100644
--- a/packages/data-schemas/src/utils/tempChatRetention.ts
+++ b/packages/data-schemas/src/utils/tempChatRetention.ts
@@ -1,10 +1,10 @@
-import logger from '~/config/winston';
 import type { AppConfig } from '~/types';
+import logger from '~/config/winston';
 
 /**
  * Default retention period for temporary chats in hours
  */
-export const DEFAULT_RETENTION_HOURS = 24 * 30; // 30 days
+export const DEFAULT_RETENTION_HOURS: number = 24 * 30; // 30 days
 
 /**
  * Minimum allowed retention period in hours
diff --git a/packages/data-schemas/tsconfig.json b/packages/data-schemas/tsconfig.json
index e5790a6cf88..76597facb6d 100644
--- a/packages/data-schemas/tsconfig.json
+++ b/packages/data-schemas/tsconfig.json
@@ -3,7 +3,8 @@
     "target": "ES2019",
     "module": "ESNext",
     "moduleResolution": "bundler",
-    "declaration": false,
+    "declaration": true,
+    "isolatedDeclarations": true,
     "noEmit": true,
     "strict": true,
     "esModuleInterop": true,
diff --git a/packages/data-schemas/tsdown.config.mjs b/packages/data-schemas/tsdown.config.mjs
new file mode 100644
index 00000000000..1b6923ce667
--- /dev/null
+++ b/packages/data-schemas/tsdown.config.mjs
@@ -0,0 +1,24 @@
+import path from 'node:path';
+import { defineConfig } from 'tsdown';
+
+export default defineConfig({
+  entry: ['src/index.ts', 'src/admin/capabilities.ts'],
+  format: ['esm', 'cjs'],
+  platform: 'node',
+  dts: { oxc: true },
+  outDir: 'dist',
+  sourcemap: true,
+  // Externalize all third-party deps (consumers provide the peers); bundle only `dotenv`
+  // so the package stays self-contained for its env-loading side effect, matching the
+  // prior Rollup build. `neverBundle` is the 0.22 replacement for the deprecated `external`.
+  deps: {
+    neverBundle: (id) =>
+      id !== 'dotenv' &&
+      !id.startsWith('dotenv/') &&
+      !id.startsWith('.') &&
+      !id.startsWith('~') &&
+      !path.isAbsolute(id),
+    // dotenv is bundled on purpose, so silence the "detected dependencies in bundle" hint.
+    onlyBundle: false,
+  },
+});
diff --git a/scripts/sort-imports.mts b/scripts/sort-imports.mts
new file mode 100644
index 00000000000..2d89608f76c
--- /dev/null
+++ b/scripts/sort-imports.mts
@@ -0,0 +1,257 @@
+#!/usr/bin/env node
+/**
+ * Sorts imports across the LibreChat monorepo per project convention
+ * (CLAUDE.md § Import Order):
+ *
+ *   1. Package value imports     — shortest line to longest (`react` always first)
+ *   2. import type from packages — longest line to shortest
+ *   3. import type from local    — longest line to shortest
+ *   4. Local value imports       — longest line to shortest
+ *
+ * "Local" covers relative paths (`./`, `../`) and the workspace path aliases
+ * (`~/`, `src/`, `test/`). Workspace packages such as `librechat-data-provider`
+ * and `@librechat/*` are treated as package imports, not local.
+ *
+ * Runs on Node 24+ via native type-stripping (`.mts` keeps ESM semantics under
+ * the CommonJS repo root):
+ *
+ *   Run:        npm run sort-imports
+ *   Check only: npm run sort-imports:check
+ *   Targeted:   node scripts/sort-imports.mts path/to/file.ts [...]
+ */
+
+import { readFile, writeFile, readdir } from 'node:fs/promises';
+import { join, relative, resolve, sep, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+
+/** Source roots scanned when no explicit files are passed. */
+const SOURCE_ROOTS = [
+  'api',
+  'client/src',
+  'packages/api/src',
+  'packages/data-provider/src',
+  'packages/data-schemas/src',
+  'packages/client/src',
+];
+
+const SOURCE_DIRS = SOURCE_ROOTS.map((rel) => resolve(ROOT, rel));
+const EXTENSIONS = ['.ts', '.tsx', '.js', '.jsx', '.mts', '.cts', '.mjs', '.cjs'];
+const SKIP_DIR_NAMES = new Set([
+  'node_modules',
+  'dist',
+  'types',
+  'coverage',
+  '.turbo',
+  'data',
+  'demo',
+]);
+
+const args = process.argv.slice(2);
+const CHECK = args.includes('--check');
+const FILE_ARGS = args.filter((arg) => !arg.startsWith('--'));
+
+const LOCAL_PREFIXES = ['~/', 'src/', 'test/', './', '../'];
+
+/** Per-file opt-out for modules where import order is load-bearing. */
+const IGNORE_MARKER = /^\s*\/\/\s*sort-imports-ignore\b/;
+
+function isLocal(spec: string): boolean {
+  return LOCAL_PREFIXES.some((prefix) => spec.startsWith(prefix));
+}
+
+function hasSourceExtension(path: string): boolean {
+  return EXTENSIONS.some((ext) => path.endsWith(ext));
+}
+
+function isUnderSourceDir(abs: string): boolean {
+  return SOURCE_DIRS.some((dir) => abs === dir || abs.startsWith(`${dir}${sep}`));
+}
+
+interface Stmt {
+  raw: string;
+  spec: string;
+  isType: boolean;
+  isLocal: boolean;
+  len: number;
+}
+
+function extractSpec(raw: string): string | null {
+  return raw.match(/from\s+['"]([^'"]+)['"]/)?.[1] ?? null;
+}
+
+/** Applies the CLAUDE.md grouping/length ordering to a run of pure imports. */
+function sortSegment(stmts: Stmt[]): string[] {
+  const g1 = stmts
+    .filter((s) => !s.isType && !s.isLocal)
+    .sort((a, b) => {
+      const aReact = a.spec === 'react' ? 0 : 1;
+      const bReact = b.spec === 'react' ? 0 : 1;
+      if (aReact !== bReact) return aReact - bReact;
+      return a.len - b.len;
+    });
+  const g2 = stmts
+    .filter((s) => s.isType && !s.isLocal)
+    .sort((a, b) => b.len - a.len);
+  const g3 = stmts
+    .filter((s) => s.isType && s.isLocal)
+    .sort((a, b) => b.len - a.len);
+  const g4 = stmts
+    .filter((s) => !s.isType && s.isLocal)
+    .sort((a, b) => b.len - a.len);
+  return [...g1, ...g2, ...g3, ...g4].map((s) => s.raw);
+}
+
+function sortFileImports(content: string): string | null {
+  const lines = content.split('\n');
+
+  if (lines.some((line) => IGNORE_MARKER.test(line))) {
+    return null;
+  }
+
+  let i = 0;
+  while (i < lines.length) {
+    const t = lines[i].trimStart();
+    if (
+      t === '' ||
+      t.startsWith('//') ||
+      t.startsWith('/*') ||
+      t.startsWith('*') ||
+      t.startsWith('*/') ||
+      t.startsWith('\'use ') ||
+      t.startsWith('"use ')
+    ) {
+      i++;
+    } else {
+      break;
+    }
+  }
+
+  const importStart = i;
+  // Side-effect imports (no `from` clause) are treated as immovable barriers:
+  // sorting is confined to each contiguous run of pure imports between them, so
+  // module-evaluation order around anything with side effects (polyfills,
+  // registration, css, etc.) is never changed.
+  const emitted: string[] = [];
+  const originalRaws: string[] = [];
+  let segment: Stmt[] = [];
+  let importEnd = i;
+
+  const flushSegment = (): void => {
+    if (segment.length === 0) return;
+    emitted.push(...sortSegment(segment));
+    segment = [];
+  };
+
+  while (i < lines.length) {
+    const t = lines[i].trimStart();
+    if (!t.startsWith('import ') && !t.startsWith('import{')) break;
+
+    let raw = lines[i];
+    let j = i;
+    while (!raw.includes(';') && j + 1 < lines.length) {
+      j++;
+      raw += '\n' + lines[j];
+    }
+    i = j + 1;
+    importEnd = i;
+    originalRaws.push(raw);
+
+    const spec = extractSpec(raw);
+    if (spec == null || spec === '') {
+      flushSegment();
+      emitted.push(raw);
+      while (i < lines.length && lines[i].trim() === '') i++;
+      continue;
+    }
+
+    segment.push({
+      raw,
+      spec,
+      isType: /^import\s+type[\s{]/.test(raw.trimStart()),
+      isLocal: isLocal(spec),
+      len: raw
+        .split('\n')
+        .map((l) => l.trim())
+        .join(' ').length,
+    });
+
+    while (i < lines.length && lines[i].trim() === '') i++;
+  }
+  flushSegment();
+
+  if (originalRaws.length < 2) return null;
+  if (originalRaws.join('\n') === emitted.join('\n')) return null;
+
+  return [
+    ...lines.slice(0, importStart),
+    ...emitted,
+    ...lines.slice(importEnd),
+  ].join('\n');
+}
+
+/** Recursively yields absolute paths of every source file under `dir`. */
+async function* walkSourceFiles(dir: string): AsyncGenerator<string> {
+  const entries = await readdir(dir, { withFileTypes: true });
+  for (const entry of entries) {
+    if (entry.isDirectory()) {
+      if (SKIP_DIR_NAMES.has(entry.name)) continue;
+      yield* walkSourceFiles(join(dir, entry.name));
+    } else if (entry.isFile() && hasSourceExtension(entry.name)) {
+      yield join(dir, entry.name);
+    }
+  }
+}
+
+/**
+ * Resolves the set of files to process. When explicit paths are passed
+ * (e.g. by lint-staged) only those source files under a known root are sorted;
+ * otherwise every source file under each root is scanned.
+ */
+async function collectFiles(): Promise<string[]> {
+  if (FILE_ARGS.length > 0) {
+    return FILE_ARGS.map((file) => resolve(file)).filter(
+      (abs) => hasSourceExtension(abs) && isUnderSourceDir(abs),
+    );
+  }
+
+  const files: string[] = [];
+  for (const dir of SOURCE_DIRS) {
+    try {
+      for await (const abs of walkSourceFiles(dir)) {
+        files.push(abs);
+      }
+    } catch {
+      continue;
+    }
+  }
+  return files;
+}
+
+let changed = 0;
+let total = 0;
+
+for (const filePath of await collectFiles()) {
+  const rel = relative(ROOT, filePath);
+  const content = await readFile(filePath, 'utf8');
+  const result = sortFileImports(content);
+  total++;
+  if (result === null) continue;
+  changed++;
+  if (CHECK) {
+    console.log(`  ✗ ${rel}`);
+  } else {
+    await writeFile(filePath, result);
+    console.log(`  ✓ ${rel}`);
+  }
+}
+
+if (CHECK && changed) {
+  console.log(`\n${changed}/${total} files need sorting. Run: npm run sort-imports`);
+  process.exit(1);
+} else if (changed) {
+  console.log(`\nSorted ${changed}/${total} files.`);
+} else {
+  console.log(`All ${total} files already sorted.`);
+}
diff --git a/skill/README.md b/skill/README.md
new file mode 100644
index 00000000000..42da54931bc
--- /dev/null
+++ b/skill/README.md
@@ -0,0 +1,15 @@
+# Deployment Skills
+
+Place shared deployment skills in this directory. Each skill should live in its own folder with a
+`SKILL.md` file, for example:
+
+```text
+skill/
+  my-shared-skill/
+    SKILL.md
+    references/
+      notes.md
+```
+
+These skills are loaded at server startup, exposed read-only to all users with Skills enabled, and
+are not persisted as Skill documents in MongoDB.
diff --git a/turbo.json b/turbo.json
index 3f79eabbc62..f5c88b1c312 100644
--- a/turbo.json
+++ b/turbo.json
@@ -1,5 +1,5 @@
 {
-  "$schema": "https://turbo.build/schema.json",
+  "$schema": "https://v2-9-17.turborepo.dev/schema.json",
   "globalDependencies": ["package-lock.json"],
   "tasks": {
     "build": {
@@ -13,6 +13,7 @@
         "scripts/**",
         "rollup.config.js",
         "server-rollup.config.js",
+        "tsdown.config.mjs",
         "tsconfig.json",
         "tsconfig.build.json",
         "vite.config.ts",