WIP: Responsive Segmented Controls

* 🔧 refactor: Improve Google Key Handling in `loadAsyncEndpoints`

- Enhanced logic to check if GOOGLE_KEY is provided, including user-provided checks.
- Updated service key loading mechanism to only attempt loading if GOOGLE_KEY is not provided.
- Added error logging for service key loading failures.

* 🔧 refactor: Enhance service key loading logic in `initializeClient`

.env.example

@@ -485,21 +485,6 @@ SAML_IMAGE_URL=
 # SAML_USE_AUTHN_RESPONSE_SIGNED=
 
 
-#===============================================#
-# Microsoft Graph API / Entra ID Integration  #
-#===============================================#
-
-# Enable Entra ID people search integration in permissions/sharing system
-# When enabled, the people picker will search both local database and Entra ID
-USE_ENTRA_ID_FOR_PEOPLE_SEARCH=false
-
-# When enabled, entra id groups owners will be considered as members of the group
-ENTRA_ID_INCLUDE_OWNERS_AS_MEMBERS=false
-
-# Microsoft Graph API scopes needed for people/group search
-# Default scopes provide access to user profiles and group memberships
-OPENID_GRAPH_SCOPES=User.Read,People.Read,GroupMember.Read.All
-
 # LDAP
 LDAP_URL=
 LDAP_BIND_DN=

.vscode/launch.json

@@ -8,8 +8,7 @@
       "skipFiles": ["<node_internals>/**"],
       "program": "${workspaceFolder}/api/server/index.js",
       "env": {
-        "NODE_ENV": "production",
-        "NODE_TLS_REJECT_UNAUTHORIZED": "0"
+        "NODE_ENV": "production"
       },
       "console": "integratedTerminal",
       "envFile": "${workspaceFolder}/.env"

Dockerfile

@@ -1,4 +1,4 @@
-# v0.7.8
+# v0.7.9-rc1
 
 # Base node image
 FROM node:20-alpine AS node

Dockerfile.multi

@@ -1,5 +1,5 @@
 # Dockerfile.multi
-# v0.7.8
+# v0.7.9-rc1
 
 # Base for all builds
 FROM node:20-alpine AS base-min

README.md

@@ -52,7 +52,7 @@
 - 🖥️ **UI & Experience** inspired by ChatGPT with enhanced design and features
 
 - 🤖 **AI Model Selection**:  
-  - Anthropic (Claude), AWS Bedrock, OpenAI, Azure OpenAI, Google, Vertex AI, OpenAI Assistants API (incl. Azure)
+  - Anthropic (Claude), AWS Bedrock, OpenAI, Azure OpenAI, Google, Vertex AI, OpenAI Responses API (incl. Azure)
   - [Custom Endpoints](https://www.librechat.ai/docs/quick_start/custom_endpoints): Use any OpenAI-compatible API with LibreChat, no proxy required
   - Compatible with [Local & Remote AI Providers](https://www.librechat.ai/docs/configuration/librechat_yaml/ai_endpoints):
     - Ollama, groq, Cohere, Mistral AI, Apple MLX, koboldcpp, together.ai,
@@ -66,10 +66,9 @@
 - 🔦 **Agents & Tools Integration**:  
   - **[LibreChat Agents](https://www.librechat.ai/docs/features/agents)**:
     - No-Code Custom Assistants: Build specialized, AI-driven helpers without coding  
-    - Flexible & Extensible: Attach tools like DALL-E-3, file search, code execution, and more  
-    - Compatible with Custom Endpoints, OpenAI, Azure, Anthropic, AWS Bedrock, and more
+    - Flexible & Extensible: Use MCP Servers, tools, file search, code execution, and more  
+    - Compatible with Custom Endpoints, OpenAI, Azure, Anthropic, AWS Bedrock, Google, Vertex AI, Responses API, and more
     - [Model Context Protocol (MCP) Support](https://modelcontextprotocol.io/clients#librechat) for Tools
-  - Use LibreChat Agents and OpenAI Assistants with Files, Code Interpreter, Tools, and API Actions
 
 - 🔍 **Web Search**:  
   - Search the internet and retrieve relevant information to enhance your AI context

api/app/clients/BaseClient.js

@@ -13,7 +13,6 @@ const {
 const { getMessages, saveMessage, updateMessage, saveConvo, getConvo } = require('~/models');
 const { checkBalance } = require('~/models/balanceMethods');
 const { truncateToolCallOutputs } = require('./prompts');
-const { addSpaceIfNeeded } = require('~/server/utils');
 const { getFiles } = require('~/models/File');
 const TextStream = require('./TextStream');
 const { logger } = require('~/config');
@@ -572,7 +571,7 @@ class BaseClient {
       });
     }
 
-    const { generation = '' } = opts;
+    const { editedContent } = opts;
 
     // It's not necessary to push to currentMessages
     // depending on subclass implementation of handling messages
@@ -587,11 +586,21 @@ class BaseClient {
           isCreatedByUser: false,
           model: this.modelOptions?.model ?? this.model,
           sender: this.sender,
-          text: generation,
         };
         this.currentMessages.push(userMessage, latestMessage);
-      } else {
-        latestMessage.text = generation;
+      } else if (editedContent != null) {
+        // Handle editedContent for content parts
+        if (editedContent && latestMessage.content && Array.isArray(latestMessage.content)) {
+          const { index, text, type } = editedContent;
+          if (index >= 0 && index < latestMessage.content.length) {
+            const contentPart = latestMessage.content[index];
+            if (type === ContentTypes.THINK && contentPart.type === ContentTypes.THINK) {
+              contentPart[ContentTypes.THINK] = text;
+            } else if (type === ContentTypes.TEXT && contentPart.type === ContentTypes.TEXT) {
+              contentPart[ContentTypes.TEXT] = text;
+            }
+          }
+        }
       }
       this.continued = true;
     } else {
@@ -672,16 +681,32 @@ class BaseClient {
     };
 
     if (typeof completion === 'string') {
-      responseMessage.text = addSpaceIfNeeded(generation) + completion;
+      responseMessage.text = completion;
     } else if (
       Array.isArray(completion) &&
       (this.clientName === EModelEndpoint.agents ||
         isParamEndpoint(this.options.endpoint, this.options.endpointType))
     ) {
       responseMessage.text = '';
-      responseMessage.content = completion;
+
+      if (!opts.editedContent || this.currentMessages.length === 0) {
+        responseMessage.content = completion;
+      } else {
+        const latestMessage = this.currentMessages[this.currentMessages.length - 1];
+        if (!latestMessage?.content) {
+          responseMessage.content = completion;
+        } else {
+          const existingContent = [...latestMessage.content];
+          const { type: editedType } = opts.editedContent;
+          responseMessage.content = this.mergeEditedContent(
+            existingContent,
+            completion,
+            editedType,
+          );
+        }
+      }
     } else if (Array.isArray(completion)) {
-      responseMessage.text = addSpaceIfNeeded(generation) + completion.join('');
+      responseMessage.text = completion.join('');
     }
 
     if (
@@ -1095,6 +1120,50 @@ class BaseClient {
     return numTokens;
   }
 
+  /**
+   * Merges completion content with existing content when editing TEXT or THINK types
+   * @param {Array} existingContent - The existing content array
+   * @param {Array} newCompletion - The new completion content
+   * @param {string} editedType - The type of content being edited
+   * @returns {Array} The merged content array
+   */
+  mergeEditedContent(existingContent, newCompletion, editedType) {
+    if (!newCompletion.length) {
+      return existingContent.concat(newCompletion);
+    }
+
+    if (editedType !== ContentTypes.TEXT && editedType !== ContentTypes.THINK) {
+      return existingContent.concat(newCompletion);
+    }
+
+    const lastIndex = existingContent.length - 1;
+    const lastExisting = existingContent[lastIndex];
+    const firstNew = newCompletion[0];
+
+    if (lastExisting?.type !== firstNew?.type || firstNew?.type !== editedType) {
+      return existingContent.concat(newCompletion);
+    }
+
+    const mergedContent = [...existingContent];
+    if (editedType === ContentTypes.TEXT) {
+      mergedContent[lastIndex] = {
+        ...mergedContent[lastIndex],
+        [ContentTypes.TEXT]:
+          (mergedContent[lastIndex][ContentTypes.TEXT] || '') + (firstNew[ContentTypes.TEXT] || ''),
+      };
+    } else {
+      mergedContent[lastIndex] = {
+        ...mergedContent[lastIndex],
+        [ContentTypes.THINK]:
+          (mergedContent[lastIndex][ContentTypes.THINK] || '') +
+          (firstNew[ContentTypes.THINK] || ''),
+      };
+    }
+
+    // Add remaining completion items
+    return mergedContent.concat(newCompletion.slice(1));
+  }
+
   async sendPayload(payload, opts = {}) {
     if (opts && typeof opts === 'object') {
       this.setOptions(opts);

api/models/Agent.js

@@ -4,7 +4,7 @@ const { logger } = require('@librechat/data-schemas');
 const { SystemRoles, Tools, actionDelimiter } = require('librechat-data-provider');
 const { GLOBAL_PROJECT_NAME, EPHEMERAL_AGENT_ID, mcp_delimiter } =
   require('librechat-data-provider').Constants;
-// Default category value for new agents
+const { CONFIG_STORE, STARTUP_CONFIG } = require('librechat-data-provider').CacheKeys;
 const {
   getProjectByName,
   addAgentIdsToProject,
@@ -12,9 +12,7 @@ const {
   removeAgentFromAllProjects,
 } = require('./Project');
 const { getCachedTools } = require('~/server/services/Config');
-
-// Category values are now imported from shared constants
-// Schema fields (category, support_contact, is_promoted) are defined in @librechat/data-schemas
+const getLogStores = require('~/cache/getLogStores');
 const { getActions } = require('./Action');
 const { Agent } = require('~/db/models');
 
@@ -25,7 +23,7 @@ const { Agent } = require('~/db/models');
  * @throws {Error} If the agent creation fails.
  */
 const createAgent = async (agentData) => {
-  const { author: _author, ...versionData } = agentData;
+  const { author, ...versionData } = agentData;
   const timestamp = new Date();
   const initialAgentData = {
     ...agentData,
@@ -36,7 +34,6 @@ const createAgent = async (agentData) => {
         updatedAt: timestamp,
       },
     ],
-    category: agentData.category || 'general',
   };
   return (await Agent.create(initialAgentData)).toObject();
 };
@@ -93,7 +90,7 @@ const loadEphemeralAgent = async ({ req, agent_id, endpoint, model_parameters: _
   }
 
   const instructions = req.body.promptPrefix;
-  return {
+  const result = {
     id: agent_id,
     instructions,
     provider: endpoint,
@@ -101,6 +98,11 @@ const loadEphemeralAgent = async ({ req, agent_id, endpoint, model_parameters: _
     model,
     tools,
   };
+
+  if (ephemeralAgent?.artifacts != null && ephemeralAgent.artifacts) {
+    result.artifacts = ephemeralAgent.artifacts;
+  }
+  return result;
 };
 
 /**
@@ -129,7 +131,29 @@ const loadAgent = async ({ req, agent_id, endpoint, model_parameters }) => {
   }
 
   agent.version = agent.versions ? agent.versions.length : 0;
-  return agent;
+
+  if (agent.author.toString() === req.user.id) {
+    return agent;
+  }
+
+  if (!agent.projectIds) {
+    return null;
+  }
+
+  const cache = getLogStores(CONFIG_STORE);
+  /** @type {TStartupConfig} */
+  const cachedStartupConfig = await cache.get(STARTUP_CONFIG);
+  let { instanceProjectId } = cachedStartupConfig ?? {};
+  if (!instanceProjectId) {
+    instanceProjectId = (await getProjectByName(GLOBAL_PROJECT_NAME, '_id'))._id.toString();
+  }
+
+  for (const projectObjectId of agent.projectIds) {
+    const projectId = projectObjectId.toString();
+    if (projectId === instanceProjectId) {
+      return agent;
+    }
+  }
 };
 
 /**
@@ -159,7 +183,7 @@ const isDuplicateVersion = (updateData, currentData, versions, actionsHash = nul
     'actionsHash', // Exclude actionsHash from direct comparison
   ];
 
-  const { $push: _$push, $pull: _$pull, $addToSet: _$addToSet, ...directUpdates } = updateData;
+  const { $push, $pull, $addToSet, ...directUpdates } = updateData;
 
   if (Object.keys(directUpdates).length === 0 && !actionsHash) {
     return null;
@@ -178,116 +202,54 @@ const isDuplicateVersion = (updateData, currentData, versions, actionsHash = nul
 
   let isMatch = true;
   for (const field of importantFields) {
-    const wouldBeValue = wouldBeVersion[field];
-    const lastVersionValue = lastVersion[field];
-
-    // Skip if both are undefined/null
-    if (!wouldBeValue && !lastVersionValue) {
+    if (!wouldBeVersion[field] && !lastVersion[field]) {
       continue;
     }
 
-    // Handle arrays
-    if (Array.isArray(wouldBeValue) || Array.isArray(lastVersionValue)) {
-      // Normalize: treat undefined/null as empty array for comparison
-      let wouldBeArr;
-      if (Array.isArray(wouldBeValue)) {
-        wouldBeArr = wouldBeValue;
-      } else if (wouldBeValue == null) {
-        wouldBeArr = [];
-      } else {
-        wouldBeArr = [wouldBeValue];
-      }
-
-      let lastVersionArr;
-      if (Array.isArray(lastVersionValue)) {
-        lastVersionArr = lastVersionValue;
-      } else if (lastVersionValue == null) {
-        lastVersionArr = [];
-      } else {
-        lastVersionArr = [lastVersionValue];
-      }
-
-      if (wouldBeArr.length !== lastVersionArr.length) {
+    if (Array.isArray(wouldBeVersion[field]) && Array.isArray(lastVersion[field])) {
+      if (wouldBeVersion[field].length !== lastVersion[field].length) {
         isMatch = false;
         break;
       }
 
       // Special handling for projectIds (MongoDB ObjectIds)
       if (field === 'projectIds') {
-        const wouldBeIds = wouldBeArr.map((id) => id.toString()).sort();
-        const versionIds = lastVersionArr.map((id) => id.toString()).sort();
+        const wouldBeIds = wouldBeVersion[field].map((id) => id.toString()).sort();
+        const versionIds = lastVersion[field].map((id) => id.toString()).sort();
 
         if (!wouldBeIds.every((id, i) => id === versionIds[i])) {
           isMatch = false;
           break;
         }
       }
-      // Handle arrays of objects
-      else if (
-        wouldBeArr.length > 0 &&
-        typeof wouldBeArr[0] === 'object' &&
-        wouldBeArr[0] !== null
-      ) {
-        const sortedWouldBe = [...wouldBeArr].map((item) => JSON.stringify(item)).sort();
-        const sortedVersion = [...lastVersionArr].map((item) => JSON.stringify(item)).sort();
+      // Handle arrays of objects like tool_kwargs
+      else if (typeof wouldBeVersion[field][0] === 'object' && wouldBeVersion[field][0] !== null) {
+        const sortedWouldBe = [...wouldBeVersion[field]].map((item) => JSON.stringify(item)).sort();
+        const sortedVersion = [...lastVersion[field]].map((item) => JSON.stringify(item)).sort();
 
         if (!sortedWouldBe.every((item, i) => item === sortedVersion[i])) {
           isMatch = false;
           break;
         }
       } else {
-        const sortedWouldBe = [...wouldBeArr].sort();
-        const sortedVersion = [...lastVersionArr].sort();
+        const sortedWouldBe = [...wouldBeVersion[field]].sort();
+        const sortedVersion = [...lastVersion[field]].sort();
 
         if (!sortedWouldBe.every((item, i) => item === sortedVersion[i])) {
           isMatch = false;
           break;
         }
       }
-    }
-    // Handle objects
-    else if (typeof wouldBeValue === 'object' && wouldBeValue !== null) {
-      const lastVersionObj =
-        typeof lastVersionValue === 'object' && lastVersionValue !== null ? lastVersionValue : {};
-
-      // For empty objects, normalize the comparison
-      const wouldBeKeys = Object.keys(wouldBeValue);
-      const lastVersionKeys = Object.keys(lastVersionObj);
-
-      // If both are empty objects, they're equal
-      if (wouldBeKeys.length === 0 && lastVersionKeys.length === 0) {
-        continue;
-      }
-
-      // Otherwise do a deep comparison
-      if (JSON.stringify(wouldBeValue) !== JSON.stringify(lastVersionObj)) {
-        isMatch = false;
-        break;
-      }
-    }
-    // Handle primitive values
-    else {
-      // For primitives, handle the case where one is undefined and the other is a default value
-      if (wouldBeValue !== lastVersionValue) {
-        // Special handling for boolean false vs undefined
-        if (
-          typeof wouldBeValue === 'boolean' &&
-          wouldBeValue === false &&
-          lastVersionValue === undefined
-        ) {
-          continue;
-        }
-        // Special handling for empty string vs undefined
-        if (
-          typeof wouldBeValue === 'string' &&
-          wouldBeValue === '' &&
-          lastVersionValue === undefined
-        ) {
-          continue;
-        }
+    } else if (field === 'model_parameters') {
+      const wouldBeParams = wouldBeVersion[field] || {};
+      const lastVersionParams = lastVersion[field] || {};
+      if (JSON.stringify(wouldBeParams) !== JSON.stringify(lastVersionParams)) {
         isMatch = false;
         break;
       }
+    } else if (wouldBeVersion[field] !== lastVersion[field]) {
+      isMatch = false;
+      break;
     }
   }
 
@@ -316,14 +278,7 @@ const updateAgent = async (searchParameter, updateData, options = {}) => {
 
   const currentAgent = await Agent.findOne(searchParameter);
   if (currentAgent) {
-    const {
-      __v,
-      _id,
-      id: __id,
-      versions,
-      author: _author,
-      ...versionData
-    } = currentAgent.toObject();
+    const { __v, _id, id, versions, author, ...versionData } = currentAgent.toObject();
     const { $push, $pull, $addToSet, ...directUpdates } = updateData;
 
     let actionsHash = null;
@@ -514,113 +469,8 @@ const deleteAgent = async (searchParameter) => {
   return agent;
 };
 
-/**
- * Get agents by accessible IDs with optional cursor-based pagination.
- * @param {Object} params - The parameters for getting accessible agents.
- * @param {Array} [params.accessibleIds] - Array of agent ObjectIds the user has ACL access to.
- * @param {Object} [params.otherParams] - Additional query parameters (including author filter).
- * @param {number} [params.limit] - Number of agents to return (max 100). If not provided, returns all agents.
- * @param {string} [params.after] - Cursor for pagination - get agents after this cursor. // base64 encoded JSON string with updatedAt and _id.
- * @returns {Promise<Object>} A promise that resolves to an object containing the agents data and pagination info.
- */
-const getListAgentsByAccess = async ({
-  accessibleIds = [],
-  otherParams = {},
-  limit = null,
-  after = null,
-}) => {
-  const isPaginated = limit !== null && limit !== undefined;
-  const normalizedLimit = isPaginated ? Math.min(Math.max(1, parseInt(limit) || 20), 100) : null;
-
-  // Build base query combining ACL accessible agents with other filters
-  const baseQuery = { ...otherParams };
-
-  if (accessibleIds.length > 0) {
-    baseQuery._id = { $in: accessibleIds };
-  }
-
-  // Add cursor condition
-  if (after) {
-    try {
-      const cursor = JSON.parse(Buffer.from(after, 'base64').toString('utf8'));
-      const { updatedAt, _id } = cursor;
-
-      const cursorCondition = {
-        $or: [
-          { updatedAt: { $lt: new Date(updatedAt) } },
-          { updatedAt: new Date(updatedAt), _id: { $gt: new mongoose.Types.ObjectId(_id) } },
-        ],
-      };
-
-      // Merge cursor condition with base query
-      if (Object.keys(baseQuery).length > 0) {
-        baseQuery.$and = [{ ...baseQuery }, cursorCondition];
-        // Remove the original conditions from baseQuery to avoid duplication
-        Object.keys(baseQuery).forEach((key) => {
-          if (key !== '$and') delete baseQuery[key];
-        });
-      } else {
-        Object.assign(baseQuery, cursorCondition);
-      }
-    } catch (error) {
-      logger.warn('Invalid cursor:', error.message);
-    }
-  }
-
-  let query = Agent.find(baseQuery, {
-    id: 1,
-    _id: 1,
-    name: 1,
-    avatar: 1,
-    author: 1,
-    projectIds: 1,
-    description: 1,
-    updatedAt: 1,
-    category: 1,
-    support_contact: 1,
-    is_promoted: 1,
-  }).sort({ updatedAt: -1, _id: 1 });
-
-  // Only apply limit if pagination is requested
-  if (isPaginated) {
-    query = query.limit(normalizedLimit + 1);
-  }
-
-  const agents = await query.lean();
-
-  const hasMore = isPaginated ? agents.length > normalizedLimit : false;
-  const data = (isPaginated ? agents.slice(0, normalizedLimit) : agents).map((agent) => {
-    if (agent.author) {
-      agent.author = agent.author.toString();
-    }
-    return agent;
-  });
-
-  // Generate next cursor only if paginated
-  let nextCursor = null;
-  if (isPaginated && hasMore && data.length > 0) {
-    const lastAgent = agents[normalizedLimit - 1];
-    nextCursor = Buffer.from(
-      JSON.stringify({
-        updatedAt: lastAgent.updatedAt.toISOString(),
-        _id: lastAgent._id.toString(),
-      }),
-    ).toString('base64');
-  }
-
-  return {
-    object: 'list',
-    data,
-    first_id: data.length > 0 ? data[0].id : null,
-    last_id: data.length > 0 ? data[data.length - 1].id : null,
-    has_more: hasMore,
-    after: nextCursor,
-  };
-};
-
 /**
  * Get all agents.
- * @deprecated Use getListAgentsByAccess for ACL-aware agent listing
  * @param {Object} searchParameter - The search parameters to find matching agents.
  * @param {string} searchParameter.author - The user ID of the agent's author.
  * @returns {Promise<Object>} A promise that resolves to an object containing the agents data and pagination info.
@@ -639,15 +489,13 @@ const getListAgents = async (searchParameter) => {
   const agents = (
     await Agent.find(query, {
       id: 1,
-      _id: 1,
+      _id: 0,
       name: 1,
       avatar: 1,
       author: 1,
       projectIds: 1,
       description: 1,
-      // @deprecated - isCollaborative replaced by ACL permissions
       isCollaborative: 1,
-      category: 1,
     }).lean()
   ).map((agent) => {
     if (agent.author?.toString() !== author) {
@@ -813,14 +661,6 @@ const generateActionMetadataHash = async (actionIds, actions) => {
 
   return hashHex;
 };
-/**
- * Counts the number of promoted agents.
- * @returns  {Promise<number>} - The count of promoted agents
- */
-const countPromotedAgents = async () => {
-  const count = await Agent.countDocuments({ is_promoted: true });
-  return count;
-};
 
 /**
  * Load a default agent based on the endpoint
@@ -838,8 +678,6 @@ module.exports = {
   revertAgentVersion,
   updateAgentProjects,
   addAgentResourceFile,
-  getListAgentsByAccess,
   removeAgentResourceFiles,
   generateActionMetadataHash,
-  countPromotedAgents,
 };

api/models/Agent.spec.js

@@ -1633,7 +1633,7 @@ describe('models/Agent', () => {
       expect(result.version).toBe(1);
     });
 
-    test('should return agent even when user is not author (permissions checked at route level)', async () => {
+    test('should return null when user is not author and agent has no projectIds', async () => {
       const authorId = new mongoose.Types.ObjectId();
       const userId = new mongoose.Types.ObjectId();
       const agentId = `agent_${uuidv4()}`;
@@ -1654,11 +1654,7 @@ describe('models/Agent', () => {
         model_parameters: { model: 'gpt-4' },
       });
 
-      // With the new permission system, loadAgent returns the agent regardless of permissions
-      // Permission checks are handled at the route level via middleware
-      expect(result).toBeTruthy();
-      expect(result.id).toBe(agentId);
-      expect(result.name).toBe('Test Agent');
+      expect(result).toBeFalsy();
     });
 
     test('should handle ephemeral agent with no MCP servers', async () => {
@@ -1766,7 +1762,7 @@ describe('models/Agent', () => {
         }
       });
 
-      test('should return agent from different project (permissions checked at route level)', async () => {
+      test('should handle loadAgent with agent from different project', async () => {
         const authorId = new mongoose.Types.ObjectId();
         const userId = new mongoose.Types.ObjectId();
         const agentId = `agent_${uuidv4()}`;
@@ -1789,11 +1785,7 @@ describe('models/Agent', () => {
           model_parameters: { model: 'gpt-4' },
         });
 
-        // With the new permission system, loadAgent returns the agent regardless of permissions
-        // Permission checks are handled at the route level via middleware
-        expect(result).toBeTruthy();
-        expect(result.id).toBe(agentId);
-        expect(result.name).toBe('Project Agent');
+        expect(result).toBeFalsy();
       });
     });
   });

api/models/Role.js

@@ -2,6 +2,7 @@ const {
   CacheKeys,
   SystemRoles,
   roleDefaults,
+  PermissionTypes,
   permissionsSchema,
   removeNullishValues,
 } = require('librechat-data-provider');

api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@librechat/backend",
-  "version": "v0.7.8",
+  "version": "v0.7.9-rc1",
   "description": "",
   "scripts": {
     "start": "echo 'please run this from the root directory'",
@@ -48,11 +48,10 @@
     "@langchain/google-genai": "^0.2.13",
     "@langchain/google-vertexai": "^0.2.13",
     "@langchain/textsplitters": "^0.1.0",
-    "@librechat/agents": "^2.4.46",
+    "@librechat/agents": "^2.4.56",
     "@librechat/api": "*",
     "@librechat/data-schemas": "*",
     "@node-saml/passport-saml": "^5.0.0",
-    "@microsoft/microsoft-graph-client": "^3.0.7",
     "@waylaidwanderer/fetch-event-source": "^3.0.1",
     "axios": "^1.8.2",
     "bcryptjs": "^2.4.3",

api/server/controllers/ErrorController.js

@@ -24,17 +24,23 @@ const handleValidationError = (err, res) => {
   }
 };
 
-// eslint-disable-next-line no-unused-vars
-module.exports = (err, req, res, next) => {
+module.exports = (err, _req, res, _next) => {
   try {
     if (err.name === 'ValidationError') {
-      return (err = handleValidationError(err, res));
+      return handleValidationError(err, res);
     }
     if (err.code && err.code == 11000) {
-      return (err = handleDuplicateKeyError(err, res));
+      return handleDuplicateKeyError(err, res);
     }
-  } catch (err) {
+    // Special handling for errors like SyntaxError
+    if (err.statusCode && err.body) {
+      return res.status(err.statusCode).send(err.body);
+    }
+
     logger.error('ErrorController => error', err);
-    res.status(500).send('An unknown error occurred.');
+    return res.status(500).send('An unknown error occurred.');
+  } catch (err) {
+    logger.error('ErrorController => processing error', err);
+    return res.status(500).send('Processing error in ErrorController.');
   }
 };

api/server/controllers/ErrorController.spec.js

@@ -0,0 +1,241 @@
+const errorController = require('./ErrorController');
+const { logger } = require('~/config');
+
+// Mock the logger
+jest.mock('~/config', () => ({
+  logger: {
+    error: jest.fn(),
+  },
+}));
+
+describe('ErrorController', () => {
+  let mockReq, mockRes, mockNext;
+
+  beforeEach(() => {
+    mockReq = {};
+    mockRes = {
+      status: jest.fn().mockReturnThis(),
+      send: jest.fn(),
+    };
+    mockNext = jest.fn();
+    logger.error.mockClear();
+  });
+
+  describe('ValidationError handling', () => {
+    it('should handle ValidationError with single error', () => {
+      const validationError = {
+        name: 'ValidationError',
+        errors: {
+          email: { message: 'Email is required', path: 'email' },
+        },
+      };
+
+      errorController(validationError, mockReq, mockRes, mockNext);
+
+      expect(mockRes.status).toHaveBeenCalledWith(400);
+      expect(mockRes.send).toHaveBeenCalledWith({
+        messages: '["Email is required"]',
+        fields: '["email"]',
+      });
+      expect(logger.error).toHaveBeenCalledWith('Validation error:', validationError.errors);
+    });
+
+    it('should handle ValidationError with multiple errors', () => {
+      const validationError = {
+        name: 'ValidationError',
+        errors: {
+          email: { message: 'Email is required', path: 'email' },
+          password: { message: 'Password is required', path: 'password' },
+        },
+      };
+
+      errorController(validationError, mockReq, mockRes, mockNext);
+
+      expect(mockRes.status).toHaveBeenCalledWith(400);
+      expect(mockRes.send).toHaveBeenCalledWith({
+        messages: '"Email is required Password is required"',
+        fields: '["email","password"]',
+      });
+      expect(logger.error).toHaveBeenCalledWith('Validation error:', validationError.errors);
+    });
+
+    it('should handle ValidationError with empty errors object', () => {
+      const validationError = {
+        name: 'ValidationError',
+        errors: {},
+      };
+
+      errorController(validationError, mockReq, mockRes, mockNext);
+
+      expect(mockRes.status).toHaveBeenCalledWith(400);
+      expect(mockRes.send).toHaveBeenCalledWith({
+        messages: '[]',
+        fields: '[]',
+      });
+    });
+  });
+
+  describe('Duplicate key error handling', () => {
+    it('should handle duplicate key error (code 11000)', () => {
+      const duplicateKeyError = {
+        code: 11000,
+        keyValue: { email: 'test@example.com' },
+      };
+
+      errorController(duplicateKeyError, mockReq, mockRes, mockNext);
+
+      expect(mockRes.status).toHaveBeenCalledWith(409);
+      expect(mockRes.send).toHaveBeenCalledWith({
+        messages: 'An document with that ["email"] already exists.',
+        fields: '["email"]',
+      });
+      expect(logger.error).toHaveBeenCalledWith('Duplicate key error:', duplicateKeyError.keyValue);
+    });
+
+    it('should handle duplicate key error with multiple fields', () => {
+      const duplicateKeyError = {
+        code: 11000,
+        keyValue: { email: 'test@example.com', username: 'testuser' },
+      };
+
+      errorController(duplicateKeyError, mockReq, mockRes, mockNext);
+
+      expect(mockRes.status).toHaveBeenCalledWith(409);
+      expect(mockRes.send).toHaveBeenCalledWith({
+        messages: 'An document with that ["email","username"] already exists.',
+        fields: '["email","username"]',
+      });
+      expect(logger.error).toHaveBeenCalledWith('Duplicate key error:', duplicateKeyError.keyValue);
+    });
+
+    it('should handle error with code 11000 as string', () => {
+      const duplicateKeyError = {
+        code: '11000',
+        keyValue: { email: 'test@example.com' },
+      };
+
+      errorController(duplicateKeyError, mockReq, mockRes, mockNext);
+
+      expect(mockRes.status).toHaveBeenCalledWith(409);
+      expect(mockRes.send).toHaveBeenCalledWith({
+        messages: 'An document with that ["email"] already exists.',
+        fields: '["email"]',
+      });
+    });
+  });
+
+  describe('SyntaxError handling', () => {
+    it('should handle errors with statusCode and body', () => {
+      const syntaxError = {
+        statusCode: 400,
+        body: 'Invalid JSON syntax',
+      };
+
+      errorController(syntaxError, mockReq, mockRes, mockNext);
+
+      expect(mockRes.status).toHaveBeenCalledWith(400);
+      expect(mockRes.send).toHaveBeenCalledWith('Invalid JSON syntax');
+    });
+
+    it('should handle errors with different statusCode and body', () => {
+      const customError = {
+        statusCode: 422,
+        body: { error: 'Unprocessable entity' },
+      };
+
+      errorController(customError, mockReq, mockRes, mockNext);
+
+      expect(mockRes.status).toHaveBeenCalledWith(422);
+      expect(mockRes.send).toHaveBeenCalledWith({ error: 'Unprocessable entity' });
+    });
+
+    it('should handle error with statusCode but no body', () => {
+      const partialError = {
+        statusCode: 400,
+      };
+
+      errorController(partialError, mockReq, mockRes, mockNext);
+
+      expect(mockRes.status).toHaveBeenCalledWith(500);
+      expect(mockRes.send).toHaveBeenCalledWith('An unknown error occurred.');
+    });
+
+    it('should handle error with body but no statusCode', () => {
+      const partialError = {
+        body: 'Some error message',
+      };
+
+      errorController(partialError, mockReq, mockRes, mockNext);
+
+      expect(mockRes.status).toHaveBeenCalledWith(500);
+      expect(mockRes.send).toHaveBeenCalledWith('An unknown error occurred.');
+    });
+  });
+
+  describe('Unknown error handling', () => {
+    it('should handle unknown errors', () => {
+      const unknownError = new Error('Some unknown error');
+
+      errorController(unknownError, mockReq, mockRes, mockNext);
+
+      expect(mockRes.status).toHaveBeenCalledWith(500);
+      expect(mockRes.send).toHaveBeenCalledWith('An unknown error occurred.');
+      expect(logger.error).toHaveBeenCalledWith('ErrorController => error', unknownError);
+    });
+
+    it('should handle errors with code other than 11000', () => {
+      const mongoError = {
+        code: 11100,
+        message: 'Some MongoDB error',
+      };
+
+      errorController(mongoError, mockReq, mockRes, mockNext);
+
+      expect(mockRes.status).toHaveBeenCalledWith(500);
+      expect(mockRes.send).toHaveBeenCalledWith('An unknown error occurred.');
+      expect(logger.error).toHaveBeenCalledWith('ErrorController => error', mongoError);
+    });
+
+    it('should handle null/undefined errors', () => {
+      errorController(null, mockReq, mockRes, mockNext);
+
+      expect(mockRes.status).toHaveBeenCalledWith(500);
+      expect(mockRes.send).toHaveBeenCalledWith('Processing error in ErrorController.');
+      expect(logger.error).toHaveBeenCalledWith(
+        'ErrorController => processing error',
+        expect.any(Error),
+      );
+    });
+  });
+
+  describe('Catch block handling', () => {
+    beforeEach(() => {
+      // Restore logger mock to normal behavior for these tests
+      logger.error.mockRestore();
+      logger.error = jest.fn();
+    });
+
+    it('should handle errors when logger.error throws', () => {
+      // Create fresh mocks for this test
+      const freshMockRes = {
+        status: jest.fn().mockReturnThis(),
+        send: jest.fn(),
+      };
+
+      // Mock logger to throw on the first call, succeed on the second
+      logger.error
+        .mockImplementationOnce(() => {
+          throw new Error('Logger error');
+        })
+        .mockImplementation(() => {});
+
+      const testError = new Error('Test error');
+
+      errorController(testError, mockReq, freshMockRes, mockNext);
+
+      expect(freshMockRes.status).toHaveBeenCalledWith(500);
+      expect(freshMockRes.send).toHaveBeenCalledWith('Processing error in ErrorController.');
+      expect(logger.error).toHaveBeenCalledTimes(2);
+    });
+  });
+});

api/server/controllers/PermissionsController.js

@@ -1,437 +0,0 @@
-/**
- * @import { TUpdateResourcePermissionsRequest, TUpdateResourcePermissionsResponse } from 'librechat-data-provider'
- */
-
-const mongoose = require('mongoose');
-const { logger } = require('@librechat/data-schemas');
-const {
-  getAvailableRoles,
-  ensurePrincipalExists,
-  getEffectivePermissions,
-  ensureGroupPrincipalExists,
-  bulkUpdateResourcePermissions,
-} = require('~/server/services/PermissionService');
-const { AclEntry } = require('~/db/models');
-const {
-  searchPrincipals: searchLocalPrincipals,
-  sortPrincipalsByRelevance,
-  calculateRelevanceScore,
-} = require('~/models');
-const {
-  searchEntraIdPrincipals,
-  entraIdPrincipalFeatureEnabled,
-} = require('~/server/services/GraphApiService');
-
-/**
- * Generic controller for resource permission endpoints
- * Delegates validation and logic to PermissionService
- */
-
-/**
- * Bulk update permissions for a resource (grant, update, remove)
- * @route PUT /api/{resourceType}/{resourceId}/permissions
- * @param {Object} req - Express request object
- * @param {Object} req.params - Route parameters
- * @param {string} req.params.resourceType - Resource type (e.g., 'agent')
- * @param {string} req.params.resourceId - Resource ID
- * @param {TUpdateResourcePermissionsRequest} req.body - Request body
- * @param {Object} res - Express response object
- * @returns {Promise<TUpdateResourcePermissionsResponse>} Updated permissions response
- */
-const updateResourcePermissions = async (req, res) => {
-  try {
-    const { resourceType, resourceId } = req.params;
-    /** @type {TUpdateResourcePermissionsRequest} */
-    const { updated, removed, public: isPublic, publicAccessRoleId } = req.body;
-    const { id: userId } = req.user;
-
-    // Prepare principals for the service call
-    const updatedPrincipals = [];
-    const revokedPrincipals = [];
-
-    // Add updated principals
-    if (updated && Array.isArray(updated)) {
-      updatedPrincipals.push(...updated);
-    }
-
-    // Add public permission if enabled
-    if (isPublic && publicAccessRoleId) {
-      updatedPrincipals.push({
-        type: 'public',
-        id: null,
-        accessRoleId: publicAccessRoleId,
-      });
-    }
-
-    // Prepare authentication context for enhanced group member fetching
-    const useEntraId = entraIdPrincipalFeatureEnabled(req.user);
-    const authHeader = req.headers.authorization;
-    const accessToken =
-      authHeader && authHeader.startsWith('Bearer ') ? authHeader.substring(7) : null;
-    const authContext =
-      useEntraId && accessToken
-        ? {
-            accessToken,
-            sub: req.user.openidId,
-          }
-        : null;
-
-    // Ensure updated principals exist in the database before processing permissions
-    const validatedPrincipals = [];
-    for (const principal of updatedPrincipals) {
-      try {
-        let principalId;
-
-        if (principal.type === 'public') {
-          principalId = null; // Public principals don't need database records
-        } else if (principal.type === 'user') {
-          principalId = await ensurePrincipalExists(principal);
-        } else if (principal.type === 'group') {
-          // Pass authContext to enable member fetching for Entra ID groups when available
-          principalId = await ensureGroupPrincipalExists(principal, authContext);
-        } else {
-          logger.error(`Unsupported principal type: ${principal.type}`);
-          continue; // Skip invalid principal types
-        }
-
-        // Update the principal with the validated ID for ACL operations
-        validatedPrincipals.push({
-          ...principal,
-          id: principalId,
-        });
-      } catch (error) {
-        logger.error('Error ensuring principal exists:', {
-          principal: {
-            type: principal.type,
-            id: principal.id,
-            name: principal.name,
-            source: principal.source,
-          },
-          error: error.message,
-        });
-        // Continue with other principals instead of failing the entire operation
-        continue;
-      }
-    }
-
-    // Add removed principals
-    if (removed && Array.isArray(removed)) {
-      revokedPrincipals.push(...removed);
-    }
-
-    // If public is disabled, add public to revoked list
-    if (!isPublic) {
-      revokedPrincipals.push({
-        type: 'public',
-        id: null,
-      });
-    }
-
-    const results = await bulkUpdateResourcePermissions({
-      resourceType,
-      resourceId,
-      updatedPrincipals: validatedPrincipals,
-      revokedPrincipals,
-      grantedBy: userId,
-    });
-
-    /** @type {TUpdateResourcePermissionsResponse} */
-    const response = {
-      message: 'Permissions updated successfully',
-      results: {
-        principals: results.granted,
-        public: isPublic || false,
-        publicAccessRoleId: isPublic ? publicAccessRoleId : undefined,
-      },
-    };
-
-    res.status(200).json(response);
-  } catch (error) {
-    logger.error('Error updating resource permissions:', error);
-    res.status(400).json({
-      error: 'Failed to update permissions',
-      details: error.message,
-    });
-  }
-};
-
-/**
- * Get principals with their permission roles for a resource (UI-friendly format)
- * Uses efficient aggregation pipeline to join User/Group data in single query
- * @route GET /api/permissions/{resourceType}/{resourceId}
- */
-const getResourcePermissions = async (req, res) => {
-  try {
-    const { resourceType, resourceId } = req.params;
-
-    // Use aggregation pipeline for efficient single-query data retrieval
-    const results = await AclEntry.aggregate([
-      // Match ACL entries for this resource
-      {
-        $match: {
-          resourceType,
-          resourceId: mongoose.Types.ObjectId.isValid(resourceId)
-            ? mongoose.Types.ObjectId.createFromHexString(resourceId)
-            : resourceId,
-        },
-      },
-      // Lookup AccessRole information
-      {
-        $lookup: {
-          from: 'accessroles',
-          localField: 'roleId',
-          foreignField: '_id',
-          as: 'role',
-        },
-      },
-      // Lookup User information (for user principals)
-      {
-        $lookup: {
-          from: 'users',
-          localField: 'principalId',
-          foreignField: '_id',
-          as: 'userInfo',
-        },
-      },
-      // Lookup Group information (for group principals)
-      {
-        $lookup: {
-          from: 'groups',
-          localField: 'principalId',
-          foreignField: '_id',
-          as: 'groupInfo',
-        },
-      },
-      // Project final structure
-      {
-        $project: {
-          principalType: 1,
-          principalId: 1,
-          accessRoleId: { $arrayElemAt: ['$role.accessRoleId', 0] },
-          userInfo: { $arrayElemAt: ['$userInfo', 0] },
-          groupInfo: { $arrayElemAt: ['$groupInfo', 0] },
-        },
-      },
-    ]);
-
-    const principals = [];
-    let publicPermission = null;
-
-    // Process aggregation results
-    for (const result of results) {
-      if (result.principalType === 'public') {
-        publicPermission = {
-          public: true,
-          publicAccessRoleId: result.accessRoleId,
-        };
-      } else if (result.principalType === 'user' && result.userInfo) {
-        principals.push({
-          type: 'user',
-          id: result.userInfo._id.toString(),
-          name: result.userInfo.name || result.userInfo.username,
-          email: result.userInfo.email,
-          avatar: result.userInfo.avatar,
-          source: !result.userInfo._id ? 'entra' : 'local',
-          idOnTheSource: result.userInfo.idOnTheSource || result.userInfo._id.toString(),
-          accessRoleId: result.accessRoleId,
-        });
-      } else if (result.principalType === 'group' && result.groupInfo) {
-        principals.push({
-          type: 'group',
-          id: result.groupInfo._id.toString(),
-          name: result.groupInfo.name,
-          email: result.groupInfo.email,
-          description: result.groupInfo.description,
-          avatar: result.groupInfo.avatar,
-          source: result.groupInfo.source || 'local',
-          idOnTheSource: result.groupInfo.idOnTheSource || result.groupInfo._id.toString(),
-          accessRoleId: result.accessRoleId,
-        });
-      }
-    }
-
-    // Return response in format expected by frontend
-    const response = {
-      resourceType,
-      resourceId,
-      principals,
-      public: publicPermission?.public || false,
-      ...(publicPermission?.publicAccessRoleId && {
-        publicAccessRoleId: publicPermission.publicAccessRoleId,
-      }),
-    };
-
-    res.status(200).json(response);
-  } catch (error) {
-    logger.error('Error getting resource permissions principals:', error);
-    res.status(500).json({
-      error: 'Failed to get permissions principals',
-      details: error.message,
-    });
-  }
-};
-
-/**
- * Get available roles for a resource type
- * @route GET /api/{resourceType}/roles
- */
-const getResourceRoles = async (req, res) => {
-  try {
-    const { resourceType } = req.params;
-
-    const roles = await getAvailableRoles({ resourceType });
-
-    res.status(200).json(
-      roles.map((role) => ({
-        accessRoleId: role.accessRoleId,
-        name: role.name,
-        description: role.description,
-        permBits: role.permBits,
-      })),
-    );
-  } catch (error) {
-    logger.error('Error getting resource roles:', error);
-    res.status(500).json({
-      error: 'Failed to get roles',
-      details: error.message,
-    });
-  }
-};
-
-/**
- * Get user's effective permission bitmask for a resource
- * @route GET /api/{resourceType}/{resourceId}/effective
- */
-const getUserEffectivePermissions = async (req, res) => {
-  try {
-    const { resourceType, resourceId } = req.params;
-    const { id: userId } = req.user;
-
-    const permissionBits = await getEffectivePermissions({
-      userId,
-      resourceType,
-      resourceId,
-    });
-
-    res.status(200).json({
-      permissionBits,
-    });
-  } catch (error) {
-    logger.error('Error getting user effective permissions:', error);
-    res.status(500).json({
-      error: 'Failed to get effective permissions',
-      details: error.message,
-    });
-  }
-};
-
-/**
- * Search for users and groups to grant permissions
- * Supports hybrid local database + Entra ID search when configured
- * @route GET /api/permissions/search-principals
- */
-const searchPrincipals = async (req, res) => {
-  try {
-    const { q: query, limit = 20, type } = req.query;
-
-    if (!query || query.trim().length === 0) {
-      return res.status(400).json({
-        error: 'Query parameter "q" is required and must not be empty',
-      });
-    }
-
-    if (query.trim().length < 2) {
-      return res.status(400).json({
-        error: 'Query must be at least 2 characters long',
-      });
-    }
-
-    const searchLimit = Math.min(Math.max(1, parseInt(limit) || 10), 50);
-    const typeFilter = ['user', 'group'].includes(type) ? type : null;
-
-    const localResults = await searchLocalPrincipals(query.trim(), searchLimit, typeFilter);
-    let allPrincipals = [...localResults];
-
-    const useEntraId = entraIdPrincipalFeatureEnabled(req.user);
-
-    if (useEntraId && localResults.length < searchLimit) {
-      try {
-        const graphTypeMap = {
-          user: 'users',
-          group: 'groups',
-          null: 'all',
-        };
-
-        const authHeader = req.headers.authorization;
-        const accessToken =
-          authHeader && authHeader.startsWith('Bearer ') ? authHeader.substring(7) : null;
-
-        if (accessToken) {
-          const graphResults = await searchEntraIdPrincipals(
-            accessToken,
-            req.user.openidId,
-            query.trim(),
-            graphTypeMap[typeFilter],
-            searchLimit - localResults.length,
-          );
-
-          const localEmails = new Set(
-            localResults.map((p) => p.email?.toLowerCase()).filter(Boolean),
-          );
-          const localGroupSourceIds = new Set(
-            localResults.map((p) => p.idOnTheSource).filter(Boolean),
-          );
-
-          for (const principal of graphResults) {
-            const isDuplicateByEmail =
-              principal.email && localEmails.has(principal.email.toLowerCase());
-            const isDuplicateBySourceId =
-              principal.idOnTheSource && localGroupSourceIds.has(principal.idOnTheSource);
-
-            if (!isDuplicateByEmail && !isDuplicateBySourceId) {
-              allPrincipals.push(principal);
-            }
-          }
-        }
-      } catch (graphError) {
-        logger.warn('Graph API search failed, falling back to local results:', graphError.message);
-      }
-    }
-    const scoredResults = allPrincipals.map((item) => ({
-      ...item,
-      _searchScore: calculateRelevanceScore(item, query.trim()),
-    }));
-
-    allPrincipals = sortPrincipalsByRelevance(scoredResults)
-      .slice(0, searchLimit)
-      .map((result) => {
-        const { _searchScore, ...resultWithoutScore } = result;
-        return resultWithoutScore;
-      });
-    res.status(200).json({
-      query: query.trim(),
-      limit: searchLimit,
-      type: typeFilter,
-      results: allPrincipals,
-      count: allPrincipals.length,
-      sources: {
-        local: allPrincipals.filter((r) => r.source === 'local').length,
-        entra: allPrincipals.filter((r) => r.source === 'entra').length,
-      },
-    });
-  } catch (error) {
-    logger.error('Error searching principals:', error);
-    res.status(500).json({
-      error: 'Failed to search principals',
-      details: error.message,
-    });
-  }
-};
-
-module.exports = {
-  updateResourcePermissions,
-  getResourcePermissions,
-  getResourceRoles,
-  getUserEffectivePermissions,
-  searchPrincipals,
-};

api/server/controllers/agents/client.js

@@ -525,7 +525,10 @@ class AgentClient extends BaseClient {
           messagesToProcess = [...messages.slice(-messageWindowSize)];
         }
       }
-      return await this.processMemory(messagesToProcess);
+
+      const bufferString = getBufferString(messagesToProcess);
+      const bufferMessage = new HumanMessage(`# Current Chat:\n\n${bufferString}`);
+      return await this.processMemory([bufferMessage]);
     } catch (error) {
       logger.error('Memory Agent failed to process memory', error);
     }

api/server/controllers/agents/request.js

@@ -14,8 +14,11 @@ const AgentController = async (req, res, next, initializeClient, addTitle) => {
     text,
     endpointOption,
     conversationId,
+    isContinued = false,
+    editedContent = null,
     parentMessageId = null,
     overrideParentMessageId = null,
+    responseMessageId: editedResponseMessageId = null,
   } = req.body;
 
   let sender;
@@ -67,7 +70,7 @@ const AgentController = async (req, res, next, initializeClient, addTitle) => {
             handler();
           }
         } catch (e) {
-          // Ignore cleanup errors
+          logger.error('[AgentController] Error in cleanup handler', e);
         }
       }
     }
@@ -155,7 +158,7 @@ const AgentController = async (req, res, next, initializeClient, addTitle) => {
       try {
         res.removeListener('close', closeHandler);
       } catch (e) {
-        // Ignore
+        logger.error('[AgentController] Error removing close listener', e);
       }
     });
 
@@ -163,10 +166,14 @@ const AgentController = async (req, res, next, initializeClient, addTitle) => {
       user: userId,
       onStart,
       getReqData,
+      isContinued,
+      editedContent,
       conversationId,
       parentMessageId,
       abortController,
       overrideParentMessageId,
+      isEdited: !!editedContent,
+      responseMessageId: editedResponseMessageId,
       progressOptions: {
         res,
       },

api/server/controllers/agents/v1.js

@@ -1,40 +1,39 @@
+const { z } = require('zod');
 const fs = require('fs').promises;
 const { nanoid } = require('nanoid');
-const { logger, PermissionBits } = require('@librechat/data-schemas');
+const { logger } = require('@librechat/data-schemas');
+const { agentCreateSchema, agentUpdateSchema } = require('@librechat/api');
 const {
   Tools,
-  SystemRoles,
+  Constants,
   FileSources,
+  SystemRoles,
   EToolResources,
   actionDelimiter,
+  removeNullishValues,
 } = require('librechat-data-provider');
 const {
   getAgent,
   createAgent,
   updateAgent,
   deleteAgent,
-  getListAgentsByAccess,
-  countPromotedAgents,
-  revertAgentVersion,
+  getListAgents,
 } = require('~/models/Agent');
-const {
-  grantPermission,
-  findAccessibleResources,
-  findPubliclyAccessibleResources,
-  hasPublicPermission,
-} = require('~/server/services/PermissionService');
 const { getStrategyFunctions } = require('~/server/services/Files/strategies');
 const { resizeAvatar } = require('~/server/services/Files/images/avatar');
 const { refreshS3Url } = require('~/server/services/Files/S3/crud');
 const { filterFile } = require('~/server/services/Files/process');
 const { updateAction, getActions } = require('~/models/Action');
 const { getCachedTools } = require('~/server/services/Config');
+const { updateAgentProjects } = require('~/models/Agent');
+const { getProjectByName } = require('~/models/Project');
+const { revertAgentVersion } = require('~/models/Agent');
 const { deleteFileByFilter } = require('~/models/File');
-const { getCategoriesWithCounts } = require('~/models');
 
 const systemTools = {
   [Tools.execute_code]: true,
   [Tools.file_search]: true,
+  [Tools.web_search]: true,
 };
 
 /**
@@ -47,9 +46,13 @@ const systemTools = {
  */
 const createAgentHandler = async (req, res) => {
   try {
-    const { tools = [], provider, name, description, instructions, model, ...agentData } = req.body;
+    const validatedData = agentCreateSchema.parse(req.body);
+    const { tools = [], ...agentData } = removeNullishValues(validatedData);
+
     const { id: userId } = req.user;
 
+    agentData.id = `agent_${nanoid()}`;
+    agentData.author = userId;
     agentData.tools = [];
 
     const availableTools = await getCachedTools({ includeGlobal: true });
@@ -63,40 +66,13 @@ const createAgentHandler = async (req, res) => {
       }
     }
 
-    Object.assign(agentData, {
-      author: userId,
-      name,
-      description,
-      instructions,
-      provider,
-      model,
-    });
-
-    agentData.id = `agent_${nanoid()}`;
     const agent = await createAgent(agentData);
-
-    // Automatically grant owner permissions to the creator
-    try {
-      await grantPermission({
-        principalType: 'user',
-        principalId: userId,
-        resourceType: 'agent',
-        resourceId: agent._id,
-        accessRoleId: 'agent_owner',
-        grantedBy: userId,
-      });
-      logger.debug(
-        `[createAgent] Granted owner permissions to user ${userId} for agent ${agent.id}`,
-      );
-    } catch (permissionError) {
-      logger.error(
-        `[createAgent] Failed to grant owner permissions for agent ${agent.id}:`,
-        permissionError,
-      );
-    }
-
     res.status(201).json(agent);
   } catch (error) {
+    if (error instanceof z.ZodError) {
+      logger.error('[/Agents] Validation error', error.errors);
+      return res.status(400).json({ error: 'Invalid request data', details: error.errors });
+    }
     logger.error('[/Agents] Error creating agent', error);
     res.status(500).json({ error: error.message });
   }
@@ -113,14 +89,21 @@ const createAgentHandler = async (req, res) => {
  * @returns {Promise<Agent>} 200 - success response - application/json
  * @returns {Error} 404 - Agent not found
  */
-const getAgentHandler = async (req, res, expandProperties = false) => {
+const getAgentHandler = async (req, res) => {
   try {
     const id = req.params.id;
     const author = req.user.id;
 
-    // Permissions are validated by middleware before calling this function
-    // Simply load the agent by ID
-    const agent = await getAgent({ id });
+    let query = { id, author };
+
+    const globalProject = await getProjectByName(Constants.GLOBAL_PROJECT_NAME, ['agentIds']);
+    if (globalProject && (globalProject.agentIds?.length ?? 0) > 0) {
+      query = {
+        $or: [{ id, $in: globalProject.agentIds }, query],
+      };
+    }
+
+    const agent = await getAgent(query);
 
     if (!agent) {
       return res.status(404).json({ error: 'Agent not found' });
@@ -137,45 +120,23 @@ const getAgentHandler = async (req, res, expandProperties = false) => {
     }
 
     agent.author = agent.author.toString();
-
-    // @deprecated - isCollaborative replaced by ACL permissions
     agent.isCollaborative = !!agent.isCollaborative;
 
-    // Check if agent is public
-    const isPublic = await hasPublicPermission({
-      resourceType: 'agent',
-      resourceId: agent._id,
-      requiredPermissions: PermissionBits.VIEW,
-    });
-    agent.isPublic = isPublic;
-
     if (agent.author !== author) {
       delete agent.author;
     }
 
-    if (!expandProperties) {
-      // VIEW permission: Basic agent info only
+    if (!agent.isCollaborative && agent.author !== author && req.user.role !== SystemRoles.ADMIN) {
       return res.status(200).json({
-        _id: agent._id,
         id: agent.id,
         name: agent.name,
-        description: agent.description,
         avatar: agent.avatar,
         author: agent.author,
-        provider: agent.provider,
-        model: agent.model,
         projectIds: agent.projectIds,
-        // @deprecated - isCollaborative replaced by ACL permissions
         isCollaborative: agent.isCollaborative,
-        isPublic: agent.isPublic,
         version: agent.version,
-        // Safe metadata
-        createdAt: agent.createdAt,
-        updatedAt: agent.updatedAt,
       });
     }
-
-    // EDIT permission: Full agent details including sensitive configuration
     return res.status(200).json(agent);
   } catch (error) {
     logger.error('[/Agents/:id] Error retrieving agent', error);
@@ -195,20 +156,44 @@ const getAgentHandler = async (req, res, expandProperties = false) => {
 const updateAgentHandler = async (req, res) => {
   try {
     const id = req.params.id;
-    const { _id, ...updateData } = req.body;
+    const validatedData = agentUpdateSchema.parse(req.body);
+    const { projectIds, removeProjectIds, ...updateData } = removeNullishValues(validatedData);
+    const isAdmin = req.user.role === SystemRoles.ADMIN;
     const existingAgent = await getAgent({ id });
 
     if (!existingAgent) {
       return res.status(404).json({ error: 'Agent not found' });
     }
 
+    const isAuthor = existingAgent.author.toString() === req.user.id;
+    const hasEditPermission = existingAgent.isCollaborative || isAdmin || isAuthor;
+
+    if (!hasEditPermission) {
+      return res.status(403).json({
+        error: 'You do not have permission to modify this non-collaborative agent',
+      });
+    }
+
+    /** @type {boolean} */
+    const isProjectUpdate = (projectIds?.length ?? 0) > 0 || (removeProjectIds?.length ?? 0) > 0;
+
     let updatedAgent =
       Object.keys(updateData).length > 0
         ? await updateAgent({ id }, updateData, {
             updatingUserId: req.user.id,
+            skipVersioning: isProjectUpdate,
           })
         : existingAgent;
 
+    if (isProjectUpdate) {
+      updatedAgent = await updateAgentProjects({
+        user: req.user,
+        agentId: id,
+        projectIds,
+        removeProjectIds,
+      });
+    }
+
     if (updatedAgent.author) {
       updatedAgent.author = updatedAgent.author.toString();
     }
@@ -219,6 +204,11 @@ const updateAgentHandler = async (req, res) => {
 
     return res.json(updatedAgent);
   } catch (error) {
+    if (error instanceof z.ZodError) {
+      logger.error('[/Agents/:id] Validation error', error.errors);
+      return res.status(400).json({ error: 'Invalid request data', details: error.errors });
+    }
+
     logger.error('[/Agents/:id] Error updating Agent', error);
 
     if (error.statusCode === 409) {
@@ -328,26 +318,6 @@ const duplicateAgentHandler = async (req, res) => {
     newAgentData.actions = agentActions;
     const newAgent = await createAgent(newAgentData);
 
-    // Automatically grant owner permissions to the duplicator
-    try {
-      await grantPermission({
-        principalType: 'user',
-        principalId: userId,
-        resourceType: 'agent',
-        resourceId: newAgent._id,
-        accessRoleId: 'agent_owner',
-        grantedBy: userId,
-      });
-      logger.debug(
-        `[duplicateAgent] Granted owner permissions to user ${userId} for duplicated agent ${newAgent.id}`,
-      );
-    } catch (permissionError) {
-      logger.error(
-        `[duplicateAgent] Failed to grant owner permissions for duplicated agent ${newAgent.id}:`,
-        permissionError,
-      );
-    }
-
     return res.status(201).json({
       agent: newAgent,
       actions: newActionsList,
@@ -374,7 +344,7 @@ const deleteAgentHandler = async (req, res) => {
     if (!agent) {
       return res.status(404).json({ error: 'Agent not found' });
     }
-    await deleteAgent({ id });
+    await deleteAgent({ id, author: req.user.id });
     return res.json({ message: 'Agent deleted' });
   } catch (error) {
     logger.error('[/Agents/:id] Error deleting Agent', error);
@@ -383,7 +353,7 @@ const deleteAgentHandler = async (req, res) => {
 };
 
 /**
- * Lists agents using ACL-aware permissions (ownership + explicit shares).
+ *
  * @route GET /Agents
  * @param {object} req - Express Request
  * @param {object} req.query - Request query
@@ -392,64 +362,9 @@ const deleteAgentHandler = async (req, res) => {
  */
 const getListAgentsHandler = async (req, res) => {
   try {
-    const userId = req.user.id;
-    const { category, search, limit, cursor, promoted } = req.query;
-    let requiredPermission = req.query.requiredPermission;
-    if (typeof requiredPermission === 'string') {
-      requiredPermission = parseInt(requiredPermission, 10);
-      if (isNaN(requiredPermission)) {
-        requiredPermission = PermissionBits.VIEW;
-      }
-    } else if (typeof requiredPermission !== 'number') {
-      requiredPermission = PermissionBits.VIEW;
-    }
-    // Base filter
-    const filter = {};
-
-    // Handle category filter - only apply if category is defined
-    if (category !== undefined && category.trim() !== '') {
-      filter.category = category;
-    }
-
-    // Handle promoted filter - only from query param
-    if (promoted === '1') {
-      filter.is_promoted = true;
-    } else if (promoted === '0') {
-      filter.is_promoted = { $ne: true };
-    }
-
-    // Handle search filter
-    if (search && search.trim() !== '') {
-      filter.$or = [
-        { name: { $regex: search.trim(), $options: 'i' } },
-        { description: { $regex: search.trim(), $options: 'i' } },
-      ];
-    }
-    // Get agent IDs the user has VIEW access to via ACL
-    const accessibleIds = await findAccessibleResources({
-      userId,
-      resourceType: 'agent',
-      requiredPermissions: requiredPermission,
+    const data = await getListAgents({
+      author: req.user.id,
     });
-    const publiclyAccessibleIds = await findPubliclyAccessibleResources({
-      resourceType: 'agent',
-      requiredPermissions: PermissionBits.VIEW,
-    });
-    // Use the new ACL-aware function
-    const data = await getListAgentsByAccess({
-      accessibleIds,
-      otherParams: filter,
-      limit,
-      after: cursor,
-    });
-    if (data?.data?.length) {
-      data.data = data.data.map((agent) => {
-        if (publiclyAccessibleIds.some((id) => id.equals(agent._id))) {
-          agent.isPublic = true;
-        }
-        return agent;
-      });
-    }
     return res.json(data);
   } catch (error) {
     logger.error('[/Agents] Error listing Agents', error);
@@ -527,7 +442,7 @@ const uploadAgentAvatarHandler = async (req, res) => {
     };
 
     promises.push(
-      await updateAgent({ id: agent_id }, data, {
+      await updateAgent({ id: agent_id, author: req.user.id }, data, {
         updatingUserId: req.user.id,
       }),
     );
@@ -607,48 +522,7 @@ const revertAgentVersionHandler = async (req, res) => {
     res.status(500).json({ error: error.message });
   }
 };
-/**
- * Get all agent categories with counts
- *
- * @param {Object} _req - Express request object (unused)
- * @param {Object} res - Express response object
- */
-const getAgentCategories = async (_req, res) => {
-  try {
-    const categories = await getCategoriesWithCounts();
-    const promotedCount = await countPromotedAgents();
-    const formattedCategories = categories.map((category) => ({
-      value: category.value,
-      label: category.label,
-      count: category.agentCount,
-      description: category.description,
-    }));
 
-    if (promotedCount > 0) {
-      formattedCategories.unshift({
-        value: 'promoted',
-        label: 'Promoted',
-        count: promotedCount,
-        description: 'Our recommended agents',
-      });
-    }
-
-    formattedCategories.push({
-      value: 'all',
-      label: 'All',
-      description: 'All available agents',
-    });
-
-    res.status(200).json(formattedCategories);
-  } catch (error) {
-    logger.error('[/Agents/Marketplace] Error fetching agent categories:', error);
-    res.status(500).json({
-      error: 'Failed to fetch agent categories',
-      userMessage: 'Unable to load categories. Please refresh the page.',
-      suggestion: 'Try refreshing the page or check your network connection',
-    });
-  }
-};
 module.exports = {
   createAgent: createAgentHandler,
   getAgent: getAgentHandler,
@@ -658,5 +532,4 @@ module.exports = {
   getListAgents: getListAgentsHandler,
   uploadAgentAvatar: uploadAgentAvatarHandler,
   revertAgentVersion: revertAgentVersionHandler,
-  getAgentCategories,
 };

api/server/controllers/agents/v1.spec.js

@@ -0,0 +1,659 @@
+const mongoose = require('mongoose');
+const { v4: uuidv4 } = require('uuid');
+const { MongoMemoryServer } = require('mongodb-memory-server');
+const { agentSchema } = require('@librechat/data-schemas');
+
+// Only mock the dependencies that are not database-related
+jest.mock('~/server/services/Config', () => ({
+  getCachedTools: jest.fn().mockResolvedValue({
+    web_search: true,
+    execute_code: true,
+    file_search: true,
+  }),
+}));
+
+jest.mock('~/models/Project', () => ({
+  getProjectByName: jest.fn().mockResolvedValue(null),
+}));
+
+jest.mock('~/server/services/Files/strategies', () => ({
+  getStrategyFunctions: jest.fn(),
+}));
+
+jest.mock('~/server/services/Files/images/avatar', () => ({
+  resizeAvatar: jest.fn(),
+}));
+
+jest.mock('~/server/services/Files/S3/crud', () => ({
+  refreshS3Url: jest.fn(),
+}));
+
+jest.mock('~/server/services/Files/process', () => ({
+  filterFile: jest.fn(),
+}));
+
+jest.mock('~/models/Action', () => ({
+  updateAction: jest.fn(),
+  getActions: jest.fn().mockResolvedValue([]),
+}));
+
+jest.mock('~/models/File', () => ({
+  deleteFileByFilter: jest.fn(),
+}));
+
+const { createAgent: createAgentHandler, updateAgent: updateAgentHandler } = require('./v1');
+
+/**
+ * @type {import('mongoose').Model<import('@librechat/data-schemas').IAgent>}
+ */
+let Agent;
+
+describe('Agent Controllers - Mass Assignment Protection', () => {
+  let mongoServer;
+  let mockReq;
+  let mockRes;
+
+  beforeAll(async () => {
+    mongoServer = await MongoMemoryServer.create();
+    const mongoUri = mongoServer.getUri();
+    await mongoose.connect(mongoUri);
+    Agent = mongoose.models.Agent || mongoose.model('Agent', agentSchema);
+  }, 20000);
+
+  afterAll(async () => {
+    await mongoose.disconnect();
+    await mongoServer.stop();
+  });
+
+  beforeEach(async () => {
+    await Agent.deleteMany({});
+
+    // Reset all mocks
+    jest.clearAllMocks();
+
+    // Setup mock request and response objects
+    mockReq = {
+      user: {
+        id: new mongoose.Types.ObjectId().toString(),
+        role: 'USER',
+      },
+      body: {},
+      params: {},
+      app: {
+        locals: {
+          fileStrategy: 'local',
+        },
+      },
+    };
+
+    mockRes = {
+      status: jest.fn().mockReturnThis(),
+      json: jest.fn().mockReturnThis(),
+    };
+  });
+
+  describe('createAgentHandler', () => {
+    test('should create agent with allowed fields only', async () => {
+      const validData = {
+        name: 'Test Agent',
+        description: 'A test agent',
+        instructions: 'Be helpful',
+        provider: 'openai',
+        model: 'gpt-4',
+        tools: ['web_search'],
+        model_parameters: { temperature: 0.7 },
+        tool_resources: {
+          file_search: { file_ids: ['file1', 'file2'] },
+        },
+      };
+
+      mockReq.body = validData;
+
+      await createAgentHandler(mockReq, mockRes);
+
+      expect(mockRes.status).toHaveBeenCalledWith(201);
+      expect(mockRes.json).toHaveBeenCalled();
+
+      const createdAgent = mockRes.json.mock.calls[0][0];
+      expect(createdAgent.name).toBe('Test Agent');
+      expect(createdAgent.description).toBe('A test agent');
+      expect(createdAgent.provider).toBe('openai');
+      expect(createdAgent.model).toBe('gpt-4');
+      expect(createdAgent.author.toString()).toBe(mockReq.user.id);
+      expect(createdAgent.tools).toContain('web_search');
+
+      // Verify in database
+      const agentInDb = await Agent.findOne({ id: createdAgent.id });
+      expect(agentInDb).toBeDefined();
+      expect(agentInDb.name).toBe('Test Agent');
+      expect(agentInDb.author.toString()).toBe(mockReq.user.id);
+    });
+
+    test('should reject creation with unauthorized fields (mass assignment protection)', async () => {
+      const maliciousData = {
+        // Required fields
+        provider: 'openai',
+        model: 'gpt-4',
+        name: 'Malicious Agent',
+
+        // Unauthorized fields that should be stripped
+        author: new mongoose.Types.ObjectId().toString(), // Should not be able to set author
+        authorName: 'Hacker', // Should be stripped
+        isCollaborative: true, // Should be stripped on creation
+        versions: [], // Should be stripped
+        _id: new mongoose.Types.ObjectId(), // Should be stripped
+        id: 'custom_agent_id', // Should be overridden
+        createdAt: new Date('2020-01-01'), // Should be stripped
+        updatedAt: new Date('2020-01-01'), // Should be stripped
+      };
+
+      mockReq.body = maliciousData;
+
+      await createAgentHandler(mockReq, mockRes);
+
+      expect(mockRes.status).toHaveBeenCalledWith(201);
+
+      const createdAgent = mockRes.json.mock.calls[0][0];
+
+      // Verify unauthorized fields were not set
+      expect(createdAgent.author.toString()).toBe(mockReq.user.id); // Should be the request user, not the malicious value
+      expect(createdAgent.authorName).toBeUndefined();
+      expect(createdAgent.isCollaborative).toBeFalsy();
+      expect(createdAgent.versions).toHaveLength(1); // Should have exactly 1 version from creation
+      expect(createdAgent.id).not.toBe('custom_agent_id'); // Should have generated ID
+      expect(createdAgent.id).toMatch(/^agent_/); // Should have proper prefix
+
+      // Verify timestamps are recent (not the malicious dates)
+      const createdTime = new Date(createdAgent.createdAt).getTime();
+      const now = Date.now();
+      expect(now - createdTime).toBeLessThan(5000); // Created within last 5 seconds
+
+      // Verify in database
+      const agentInDb = await Agent.findOne({ id: createdAgent.id });
+      expect(agentInDb.author.toString()).toBe(mockReq.user.id);
+      expect(agentInDb.authorName).toBeUndefined();
+    });
+
+    test('should validate required fields', async () => {
+      const invalidData = {
+        name: 'Missing Required Fields',
+        // Missing provider and model
+      };
+
+      mockReq.body = invalidData;
+
+      await createAgentHandler(mockReq, mockRes);
+
+      expect(mockRes.status).toHaveBeenCalledWith(400);
+      expect(mockRes.json).toHaveBeenCalledWith(
+        expect.objectContaining({
+          error: 'Invalid request data',
+          details: expect.any(Array),
+        }),
+      );
+
+      // Verify nothing was created in database
+      const count = await Agent.countDocuments();
+      expect(count).toBe(0);
+    });
+
+    test('should handle tool_resources validation', async () => {
+      const dataWithInvalidToolResources = {
+        provider: 'openai',
+        model: 'gpt-4',
+        name: 'Agent with Tool Resources',
+        tool_resources: {
+          // Valid resources
+          file_search: {
+            file_ids: ['file1', 'file2'],
+            vector_store_ids: ['vs1'],
+          },
+          execute_code: {
+            file_ids: ['file3'],
+          },
+          // Invalid resource (should be stripped by schema)
+          invalid_resource: {
+            file_ids: ['file4'],
+          },
+        },
+      };
+
+      mockReq.body = dataWithInvalidToolResources;
+
+      await createAgentHandler(mockReq, mockRes);
+
+      expect(mockRes.status).toHaveBeenCalledWith(201);
+
+      const createdAgent = mockRes.json.mock.calls[0][0];
+      expect(createdAgent.tool_resources).toBeDefined();
+      expect(createdAgent.tool_resources.file_search).toBeDefined();
+      expect(createdAgent.tool_resources.execute_code).toBeDefined();
+      expect(createdAgent.tool_resources.invalid_resource).toBeUndefined(); // Should be stripped
+
+      // Verify in database
+      const agentInDb = await Agent.findOne({ id: createdAgent.id });
+      expect(agentInDb.tool_resources.invalid_resource).toBeUndefined();
+    });
+
+    test('should handle avatar validation', async () => {
+      const dataWithAvatar = {
+        provider: 'openai',
+        model: 'gpt-4',
+        name: 'Agent with Avatar',
+        avatar: {
+          filepath: 'https://example.com/avatar.png',
+          source: 's3',
+        },
+      };
+
+      mockReq.body = dataWithAvatar;
+
+      await createAgentHandler(mockReq, mockRes);
+
+      expect(mockRes.status).toHaveBeenCalledWith(201);
+
+      const createdAgent = mockRes.json.mock.calls[0][0];
+      expect(createdAgent.avatar).toEqual({
+        filepath: 'https://example.com/avatar.png',
+        source: 's3',
+      });
+    });
+
+    test('should handle invalid avatar format', async () => {
+      const dataWithInvalidAvatar = {
+        provider: 'openai',
+        model: 'gpt-4',
+        name: 'Agent with Invalid Avatar',
+        avatar: 'just-a-string', // Invalid format
+      };
+
+      mockReq.body = dataWithInvalidAvatar;
+
+      await createAgentHandler(mockReq, mockRes);
+
+      expect(mockRes.status).toHaveBeenCalledWith(400);
+      expect(mockRes.json).toHaveBeenCalledWith(
+        expect.objectContaining({
+          error: 'Invalid request data',
+        }),
+      );
+    });
+  });
+
+  describe('updateAgentHandler', () => {
+    let existingAgentId;
+    let existingAgentAuthorId;
+
+    beforeEach(async () => {
+      // Create an existing agent for update tests
+      existingAgentAuthorId = new mongoose.Types.ObjectId();
+      const agent = await Agent.create({
+        id: `agent_${uuidv4()}`,
+        name: 'Original Agent',
+        provider: 'openai',
+        model: 'gpt-3.5-turbo',
+        author: existingAgentAuthorId,
+        description: 'Original description',
+        isCollaborative: false,
+        versions: [
+          {
+            name: 'Original Agent',
+            provider: 'openai',
+            model: 'gpt-3.5-turbo',
+            description: 'Original description',
+            createdAt: new Date(),
+            updatedAt: new Date(),
+          },
+        ],
+      });
+      existingAgentId = agent.id;
+    });
+
+    test('should update agent with allowed fields only', async () => {
+      mockReq.user.id = existingAgentAuthorId.toString(); // Set as author
+      mockReq.params.id = existingAgentId;
+      mockReq.body = {
+        name: 'Updated Agent',
+        description: 'Updated description',
+        model: 'gpt-4',
+        isCollaborative: true, // This IS allowed in updates
+      };
+
+      await updateAgentHandler(mockReq, mockRes);
+
+      expect(mockRes.status).not.toHaveBeenCalledWith(400);
+      expect(mockRes.status).not.toHaveBeenCalledWith(403);
+      expect(mockRes.json).toHaveBeenCalled();
+
+      const updatedAgent = mockRes.json.mock.calls[0][0];
+      expect(updatedAgent.name).toBe('Updated Agent');
+      expect(updatedAgent.description).toBe('Updated description');
+      expect(updatedAgent.model).toBe('gpt-4');
+      expect(updatedAgent.isCollaborative).toBe(true);
+      expect(updatedAgent.author).toBe(existingAgentAuthorId.toString());
+
+      // Verify in database
+      const agentInDb = await Agent.findOne({ id: existingAgentId });
+      expect(agentInDb.name).toBe('Updated Agent');
+      expect(agentInDb.isCollaborative).toBe(true);
+    });
+
+    test('should reject update with unauthorized fields (mass assignment protection)', async () => {
+      mockReq.user.id = existingAgentAuthorId.toString();
+      mockReq.params.id = existingAgentId;
+      mockReq.body = {
+        name: 'Updated Name',
+
+        // Unauthorized fields that should be stripped
+        author: new mongoose.Types.ObjectId().toString(), // Should not be able to change author
+        authorName: 'Hacker', // Should be stripped
+        id: 'different_agent_id', // Should be stripped
+        _id: new mongoose.Types.ObjectId(), // Should be stripped
+        versions: [], // Should be stripped
+        createdAt: new Date('2020-01-01'), // Should be stripped
+        updatedAt: new Date('2020-01-01'), // Should be stripped
+      };
+
+      await updateAgentHandler(mockReq, mockRes);
+
+      expect(mockRes.json).toHaveBeenCalled();
+
+      const updatedAgent = mockRes.json.mock.calls[0][0];
+
+      // Verify unauthorized fields were not changed
+      expect(updatedAgent.author).toBe(existingAgentAuthorId.toString()); // Should not have changed
+      expect(updatedAgent.authorName).toBeUndefined();
+      expect(updatedAgent.id).toBe(existingAgentId); // Should not have changed
+      expect(updatedAgent.name).toBe('Updated Name'); // Only this should have changed
+
+      // Verify in database
+      const agentInDb = await Agent.findOne({ id: existingAgentId });
+      expect(agentInDb.author.toString()).toBe(existingAgentAuthorId.toString());
+      expect(agentInDb.id).toBe(existingAgentId);
+    });
+
+    test('should reject update from non-author when not collaborative', async () => {
+      const differentUserId = new mongoose.Types.ObjectId().toString();
+      mockReq.user.id = differentUserId; // Different user
+      mockReq.params.id = existingAgentId;
+      mockReq.body = {
+        name: 'Unauthorized Update',
+      };
+
+      await updateAgentHandler(mockReq, mockRes);
+
+      expect(mockRes.status).toHaveBeenCalledWith(403);
+      expect(mockRes.json).toHaveBeenCalledWith({
+        error: 'You do not have permission to modify this non-collaborative agent',
+      });
+
+      // Verify agent was not modified in database
+      const agentInDb = await Agent.findOne({ id: existingAgentId });
+      expect(agentInDb.name).toBe('Original Agent');
+    });
+
+    test('should allow update from non-author when collaborative', async () => {
+      // First make the agent collaborative
+      await Agent.updateOne({ id: existingAgentId }, { isCollaborative: true });
+
+      const differentUserId = new mongoose.Types.ObjectId().toString();
+      mockReq.user.id = differentUserId; // Different user
+      mockReq.params.id = existingAgentId;
+      mockReq.body = {
+        name: 'Collaborative Update',
+      };
+
+      await updateAgentHandler(mockReq, mockRes);
+
+      expect(mockRes.status).not.toHaveBeenCalledWith(403);
+      expect(mockRes.json).toHaveBeenCalled();
+
+      const updatedAgent = mockRes.json.mock.calls[0][0];
+      expect(updatedAgent.name).toBe('Collaborative Update');
+      // Author field should be removed for non-author
+      expect(updatedAgent.author).toBeUndefined();
+
+      // Verify in database
+      const agentInDb = await Agent.findOne({ id: existingAgentId });
+      expect(agentInDb.name).toBe('Collaborative Update');
+    });
+
+    test('should allow admin to update any agent', async () => {
+      const adminUserId = new mongoose.Types.ObjectId().toString();
+      mockReq.user.id = adminUserId;
+      mockReq.user.role = 'ADMIN'; // Set as admin
+      mockReq.params.id = existingAgentId;
+      mockReq.body = {
+        name: 'Admin Update',
+      };
+
+      await updateAgentHandler(mockReq, mockRes);
+
+      expect(mockRes.status).not.toHaveBeenCalledWith(403);
+      expect(mockRes.json).toHaveBeenCalled();
+
+      const updatedAgent = mockRes.json.mock.calls[0][0];
+      expect(updatedAgent.name).toBe('Admin Update');
+    });
+
+    test('should handle projectIds updates', async () => {
+      mockReq.user.id = existingAgentAuthorId.toString();
+      mockReq.params.id = existingAgentId;
+
+      const projectId1 = new mongoose.Types.ObjectId().toString();
+      const projectId2 = new mongoose.Types.ObjectId().toString();
+
+      mockReq.body = {
+        projectIds: [projectId1, projectId2],
+      };
+
+      await updateAgentHandler(mockReq, mockRes);
+
+      expect(mockRes.json).toHaveBeenCalled();
+
+      const updatedAgent = mockRes.json.mock.calls[0][0];
+      expect(updatedAgent).toBeDefined();
+      // Note: updateAgentProjects requires more setup, so we just verify the handler doesn't crash
+    });
+
+    test('should validate tool_resources in updates', async () => {
+      mockReq.user.id = existingAgentAuthorId.toString();
+      mockReq.params.id = existingAgentId;
+      mockReq.body = {
+        tool_resources: {
+          ocr: {
+            file_ids: ['ocr1', 'ocr2'],
+          },
+          execute_code: {
+            file_ids: ['img1'],
+          },
+          // Invalid tool resource
+          invalid_tool: {
+            file_ids: ['invalid'],
+          },
+        },
+      };
+
+      await updateAgentHandler(mockReq, mockRes);
+
+      expect(mockRes.json).toHaveBeenCalled();
+
+      const updatedAgent = mockRes.json.mock.calls[0][0];
+      expect(updatedAgent.tool_resources).toBeDefined();
+      expect(updatedAgent.tool_resources.ocr).toBeDefined();
+      expect(updatedAgent.tool_resources.execute_code).toBeDefined();
+      expect(updatedAgent.tool_resources.invalid_tool).toBeUndefined();
+    });
+
+    test('should return 404 for non-existent agent', async () => {
+      mockReq.user.id = existingAgentAuthorId.toString();
+      mockReq.params.id = `agent_${uuidv4()}`; // Non-existent ID
+      mockReq.body = {
+        name: 'Update Non-existent',
+      };
+
+      await updateAgentHandler(mockReq, mockRes);
+
+      expect(mockRes.status).toHaveBeenCalledWith(404);
+      expect(mockRes.json).toHaveBeenCalledWith({ error: 'Agent not found' });
+    });
+
+    test('should handle validation errors properly', async () => {
+      mockReq.user.id = existingAgentAuthorId.toString();
+      mockReq.params.id = existingAgentId;
+      mockReq.body = {
+        model_parameters: 'invalid-not-an-object', // Should be an object
+      };
+
+      await updateAgentHandler(mockReq, mockRes);
+
+      expect(mockRes.status).toHaveBeenCalledWith(400);
+      expect(mockRes.json).toHaveBeenCalledWith(
+        expect.objectContaining({
+          error: 'Invalid request data',
+          details: expect.any(Array),
+        }),
+      );
+    });
+  });
+
+  describe('Mass Assignment Attack Scenarios', () => {
+    test('should prevent setting system fields during creation', async () => {
+      const systemFields = {
+        provider: 'openai',
+        model: 'gpt-4',
+        name: 'System Fields Test',
+
+        // System fields that should never be settable by users
+        __v: 99,
+        _id: new mongoose.Types.ObjectId(),
+        versions: [
+          {
+            name: 'Fake Version',
+            provider: 'fake',
+            model: 'fake-model',
+          },
+        ],
+      };
+
+      mockReq.body = systemFields;
+
+      await createAgentHandler(mockReq, mockRes);
+
+      expect(mockRes.status).toHaveBeenCalledWith(201);
+
+      const createdAgent = mockRes.json.mock.calls[0][0];
+
+      // Verify system fields were not affected
+      expect(createdAgent.__v).not.toBe(99);
+      expect(createdAgent.versions).toHaveLength(1); // Should only have the auto-created version
+      expect(createdAgent.versions[0].name).toBe('System Fields Test'); // From actual creation
+      expect(createdAgent.versions[0].provider).toBe('openai'); // From actual creation
+
+      // Verify in database
+      const agentInDb = await Agent.findOne({ id: createdAgent.id });
+      expect(agentInDb.__v).not.toBe(99);
+    });
+
+    test('should prevent privilege escalation through isCollaborative', async () => {
+      // Create a non-collaborative agent
+      const authorId = new mongoose.Types.ObjectId();
+      const agent = await Agent.create({
+        id: `agent_${uuidv4()}`,
+        name: 'Private Agent',
+        provider: 'openai',
+        model: 'gpt-4',
+        author: authorId,
+        isCollaborative: false,
+        versions: [
+          {
+            name: 'Private Agent',
+            provider: 'openai',
+            model: 'gpt-4',
+            createdAt: new Date(),
+            updatedAt: new Date(),
+          },
+        ],
+      });
+
+      // Try to make it collaborative as a different user
+      const attackerId = new mongoose.Types.ObjectId().toString();
+      mockReq.user.id = attackerId;
+      mockReq.params.id = agent.id;
+      mockReq.body = {
+        isCollaborative: true, // Trying to escalate privileges
+      };
+
+      await updateAgentHandler(mockReq, mockRes);
+
+      // Should be rejected
+      expect(mockRes.status).toHaveBeenCalledWith(403);
+
+      // Verify in database that it's still not collaborative
+      const agentInDb = await Agent.findOne({ id: agent.id });
+      expect(agentInDb.isCollaborative).toBe(false);
+    });
+
+    test('should prevent author hijacking', async () => {
+      const originalAuthorId = new mongoose.Types.ObjectId();
+      const attackerId = new mongoose.Types.ObjectId();
+
+      // Admin creates an agent
+      mockReq.user.id = originalAuthorId.toString();
+      mockReq.user.role = 'ADMIN';
+      mockReq.body = {
+        provider: 'openai',
+        model: 'gpt-4',
+        name: 'Admin Agent',
+        author: attackerId.toString(), // Trying to set different author
+      };
+
+      await createAgentHandler(mockReq, mockRes);
+
+      expect(mockRes.status).toHaveBeenCalledWith(201);
+
+      const createdAgent = mockRes.json.mock.calls[0][0];
+
+      // Author should be the actual user, not the attempted value
+      expect(createdAgent.author.toString()).toBe(originalAuthorId.toString());
+      expect(createdAgent.author.toString()).not.toBe(attackerId.toString());
+
+      // Verify in database
+      const agentInDb = await Agent.findOne({ id: createdAgent.id });
+      expect(agentInDb.author.toString()).toBe(originalAuthorId.toString());
+    });
+
+    test('should strip unknown fields to prevent future vulnerabilities', async () => {
+      mockReq.body = {
+        provider: 'openai',
+        model: 'gpt-4',
+        name: 'Future Proof Test',
+
+        // Unknown fields that might be added in future
+        superAdminAccess: true,
+        bypassAllChecks: true,
+        internalFlag: 'secret',
+        futureFeature: 'exploit',
+      };
+
+      await createAgentHandler(mockReq, mockRes);
+
+      expect(mockRes.status).toHaveBeenCalledWith(201);
+
+      const createdAgent = mockRes.json.mock.calls[0][0];
+
+      // Verify unknown fields were stripped
+      expect(createdAgent.superAdminAccess).toBeUndefined();
+      expect(createdAgent.bypassAllChecks).toBeUndefined();
+      expect(createdAgent.internalFlag).toBeUndefined();
+      expect(createdAgent.futureFeature).toBeUndefined();
+
+      // Also check in database
+      const agentInDb = await Agent.findOne({ id: createdAgent.id }).lean();
+      expect(agentInDb.superAdminAccess).toBeUndefined();
+      expect(agentInDb.bypassAllChecks).toBeUndefined();
+      expect(agentInDb.internalFlag).toBeUndefined();
+      expect(agentInDb.futureFeature).toBeUndefined();
+    });
+  });
+});

api/server/index.js

@@ -55,7 +55,6 @@ const startServer = async () => {
 
   /* Middleware */
   app.use(noIndex);
-  app.use(errorController);
   app.use(express.json({ limit: '3mb' }));
   app.use(express.urlencoded({ extended: true, limit: '3mb' }));
   app.use(mongoSanitize());
@@ -118,11 +117,12 @@ const startServer = async () => {
   app.use('/api/agents', routes.agents);
   app.use('/api/banner', routes.banner);
   app.use('/api/memories', routes.memories);
-  app.use('/api/permissions', routes.accessPermissions);
-
   app.use('/api/tags', routes.tags);
   app.use('/api/mcp', routes.mcp);
 
+  // Add the error controller one more time after all routes
+  app.use(errorController);
+
   app.use((req, res) => {
     res.set({
       'Cache-Control': process.env.INDEX_CACHE_CONTROL || 'no-cache, no-store, must-revalidate',

api/server/index.spec.js

@@ -1,5 +1,4 @@
 const fs = require('fs');
-const path = require('path');
 const request = require('supertest');
 const { MongoMemoryServer } = require('mongodb-memory-server');
 const mongoose = require('mongoose');
@@ -59,6 +58,30 @@ describe('Server Configuration', () => {
     expect(response.headers['pragma']).toBe('no-cache');
     expect(response.headers['expires']).toBe('0');
   });
+
+  it('should return 500 for unknown errors via ErrorController', async () => {
+    // Testing the error handling here on top of unit tests to ensure the middleware is correctly integrated
+
+    // Mock MongoDB operations to fail
+    const originalFindOne = mongoose.models.User.findOne;
+    const mockError = new Error('MongoDB operation failed');
+    mongoose.models.User.findOne = jest.fn().mockImplementation(() => {
+      throw mockError;
+    });
+
+    try {
+      const response = await request(app).post('/api/auth/login').send({
+        email: 'test@example.com',
+        password: 'password123',
+      });
+
+      expect(response.status).toBe(500);
+      expect(response.text).toBe('An unknown error occurred.');
+    } finally {
+      // Restore original function
+      mongoose.models.User.findOne = originalFindOne;
+    }
+  });
 });
 
 // Polls the /health endpoint every 30ms for up to 10 seconds to wait for the server to start completely

api/server/middleware/accessResources/canAccessAgentFromBody.js

@@ -1,97 +0,0 @@
-const { logger } = require('@librechat/data-schemas');
-const { Constants, isAgentsEndpoint } = require('librechat-data-provider');
-const { canAccessResource } = require('./canAccessResource');
-const { getAgent } = require('~/models/Agent');
-
-/**
- * Agent ID resolver function for agent_id from request body
- * Resolves custom agent ID (e.g., "agent_abc123") to MongoDB ObjectId
- * This is used specifically for chat routes where agent_id comes from request body
- *
- * @param {string} agentCustomId - Custom agent ID from request body
- * @returns {Promise<Object|null>} Agent document with _id field, or null if not found
- */
-const resolveAgentIdFromBody = async (agentCustomId) => {
-  // Handle ephemeral agents - they don't need permission checks
-  if (agentCustomId === Constants.EPHEMERAL_AGENT_ID) {
-    return null; // No permission check needed for ephemeral agents
-  }
-
-  return await getAgent({ id: agentCustomId });
-};
-
-/**
- * Middleware factory that creates middleware to check agent access permissions from request body.
- * This middleware is specifically designed for chat routes where the agent_id comes from req.body
- * instead of route parameters.
- *
- * @param {Object} options - Configuration options
- * @param {number} options.requiredPermission - The permission bit required (1=view, 2=edit, 4=delete, 8=share)
- * @returns {Function} Express middleware function
- *
- * @example
- * // Basic usage for agent chat (requires VIEW permission)
- * router.post('/chat',
- *   canAccessAgentFromBody({ requiredPermission: PermissionBits.VIEW }),
- *   buildEndpointOption,
- *   chatController
- * );
- */
-const canAccessAgentFromBody = (options) => {
-  const { requiredPermission } = options;
-
-  // Validate required options
-  if (!requiredPermission || typeof requiredPermission !== 'number') {
-    throw new Error('canAccessAgentFromBody: requiredPermission is required and must be a number');
-  }
-
-  return async (req, res, next) => {
-    try {
-      const { endpoint, agent_id } = req.body;
-      let agentId = agent_id;
-
-      if (!isAgentsEndpoint(endpoint)) {
-        agentId = Constants.EPHEMERAL_AGENT_ID;
-      }
-
-      if (!agentId) {
-        return res.status(400).json({
-          error: 'Bad Request',
-          message: 'agent_id is required in request body',
-        });
-      }
-
-      // Skip permission checks for ephemeral agents
-      if (agentId === Constants.EPHEMERAL_AGENT_ID) {
-        return next();
-      }
-
-      const agentAccessMiddleware = canAccessResource({
-        resourceType: 'agent',
-        requiredPermission,
-        resourceIdParam: 'agent_id', // This will be ignored since we use custom resolver
-        idResolver: () => resolveAgentIdFromBody(agentId),
-      });
-
-      const tempReq = {
-        ...req,
-        params: {
-          ...req.params,
-          agent_id: agentId,
-        },
-      };
-
-      return agentAccessMiddleware(tempReq, res, next);
-    } catch (error) {
-      logger.error('Failed to validate agent access permissions', error);
-      return res.status(500).json({
-        error: 'Internal Server Error',
-        message: 'Failed to validate agent access permissions',
-      });
-    }
-  };
-};
-
-module.exports = {
-  canAccessAgentFromBody,
-};

api/server/middleware/accessResources/canAccessAgentResource.js

@@ -1,58 +0,0 @@
-const { getAgent } = require('~/models/Agent');
-const { canAccessResource } = require('./canAccessResource');
-
-/**
- * Agent ID resolver function
- * Resolves custom agent ID (e.g., "agent_abc123") to MongoDB ObjectId
- *
- * @param {string} agentCustomId - Custom agent ID from route parameter
- * @returns {Promise<Object|null>} Agent document with _id field, or null if not found
- */
-const resolveAgentId = async (agentCustomId) => {
-  return await getAgent({ id: agentCustomId });
-};
-
-/**
- * Agent-specific middleware factory that creates middleware to check agent access permissions.
- * This middleware extends the generic canAccessResource to handle agent custom ID resolution.
- *
- * @param {Object} options - Configuration options
- * @param {number} options.requiredPermission - The permission bit required (1=view, 2=edit, 4=delete, 8=share)
- * @param {string} [options.resourceIdParam='id'] - The name of the route parameter containing the agent custom ID
- * @returns {Function} Express middleware function
- *
- * @example
- * // Basic usage for viewing agents
- * router.get('/agents/:id',
- *   canAccessAgentResource({ requiredPermission: 1 }),
- *   getAgent
- * );
- *
- * @example
- * // Custom resource ID parameter and edit permission
- * router.patch('/agents/:agent_id',
- *   canAccessAgentResource({
- *     requiredPermission: 2,
- *     resourceIdParam: 'agent_id'
- *   }),
- *   updateAgent
- * );
- */
-const canAccessAgentResource = (options) => {
-  const { requiredPermission, resourceIdParam = 'id' } = options;
-
-  if (!requiredPermission || typeof requiredPermission !== 'number') {
-    throw new Error('canAccessAgentResource: requiredPermission is required and must be a number');
-  }
-
-  return canAccessResource({
-    resourceType: 'agent',
-    requiredPermission,
-    resourceIdParam,
-    idResolver: resolveAgentId,
-  });
-};
-
-module.exports = {
-  canAccessAgentResource,
-};

api/server/middleware/accessResources/canAccessAgentResource.spec.js

@@ -1,384 +0,0 @@
-const mongoose = require('mongoose');
-const { MongoMemoryServer } = require('mongodb-memory-server');
-const { canAccessAgentResource } = require('./canAccessAgentResource');
-const { User, Role, AclEntry } = require('~/db/models');
-const { createAgent } = require('~/models/Agent');
-
-describe('canAccessAgentResource middleware', () => {
-  let mongoServer;
-  let req, res, next;
-  let testUser;
-
-  beforeAll(async () => {
-    mongoServer = await MongoMemoryServer.create();
-    const mongoUri = mongoServer.getUri();
-    await mongoose.connect(mongoUri);
-  });
-
-  afterAll(async () => {
-    await mongoose.disconnect();
-    await mongoServer.stop();
-  });
-
-  beforeEach(async () => {
-    await mongoose.connection.dropDatabase();
-    await Role.create({
-      name: 'test-role',
-      permissions: {
-        AGENTS: {
-          USE: true,
-          CREATE: true,
-          SHARED_GLOBAL: false,
-        },
-      },
-    });
-
-    // Create a test user
-    testUser = await User.create({
-      email: 'test@example.com',
-      name: 'Test User',
-      username: 'testuser',
-      role: 'test-role',
-    });
-
-    req = {
-      user: { id: testUser._id.toString(), role: 'test-role' },
-      params: {},
-    };
-    res = {
-      status: jest.fn().mockReturnThis(),
-      json: jest.fn(),
-    };
-    next = jest.fn();
-
-    jest.clearAllMocks();
-  });
-
-  describe('middleware factory', () => {
-    test('should throw error if requiredPermission is not provided', () => {
-      expect(() => canAccessAgentResource({})).toThrow(
-        'canAccessAgentResource: requiredPermission is required and must be a number',
-      );
-    });
-
-    test('should throw error if requiredPermission is not a number', () => {
-      expect(() => canAccessAgentResource({ requiredPermission: '1' })).toThrow(
-        'canAccessAgentResource: requiredPermission is required and must be a number',
-      );
-    });
-
-    test('should create middleware with default resourceIdParam', () => {
-      const middleware = canAccessAgentResource({ requiredPermission: 1 });
-      expect(typeof middleware).toBe('function');
-      expect(middleware.length).toBe(3); // Express middleware signature
-    });
-
-    test('should create middleware with custom resourceIdParam', () => {
-      const middleware = canAccessAgentResource({
-        requiredPermission: 2,
-        resourceIdParam: 'agent_id',
-      });
-      expect(typeof middleware).toBe('function');
-      expect(middleware.length).toBe(3);
-    });
-  });
-
-  describe('permission checking with real agents', () => {
-    test('should allow access when user is the agent author', async () => {
-      // Create an agent owned by the test user
-      const agent = await createAgent({
-        id: `agent_${Date.now()}`,
-        name: 'Test Agent',
-        provider: 'openai',
-        model: 'gpt-4',
-        author: testUser._id,
-      });
-
-      // Create ACL entry for the author (owner permissions)
-      await AclEntry.create({
-        principalType: 'user',
-        principalId: testUser._id,
-        principalModel: 'User',
-        resourceType: 'agent',
-        resourceId: agent._id,
-        permBits: 15, // All permissions (1+2+4+8)
-        grantedBy: testUser._id,
-      });
-
-      req.params.id = agent.id;
-
-      const middleware = canAccessAgentResource({ requiredPermission: 1 }); // VIEW permission
-      await middleware(req, res, next);
-
-      expect(next).toHaveBeenCalled();
-      expect(res.status).not.toHaveBeenCalled();
-    });
-
-    test('should deny access when user is not the author and has no ACL entry', async () => {
-      // Create an agent owned by a different user
-      const otherUser = await User.create({
-        email: 'other@example.com',
-        name: 'Other User',
-        username: 'otheruser',
-        role: 'test-role',
-      });
-
-      const agent = await createAgent({
-        id: `agent_${Date.now()}`,
-        name: 'Other User Agent',
-        provider: 'openai',
-        model: 'gpt-4',
-        author: otherUser._id,
-      });
-
-      // Create ACL entry for the other user (owner)
-      await AclEntry.create({
-        principalType: 'user',
-        principalId: otherUser._id,
-        principalModel: 'User',
-        resourceType: 'agent',
-        resourceId: agent._id,
-        permBits: 15, // All permissions
-        grantedBy: otherUser._id,
-      });
-
-      req.params.id = agent.id;
-
-      const middleware = canAccessAgentResource({ requiredPermission: 1 }); // VIEW permission
-      await middleware(req, res, next);
-
-      expect(next).not.toHaveBeenCalled();
-      expect(res.status).toHaveBeenCalledWith(403);
-      expect(res.json).toHaveBeenCalledWith({
-        error: 'Forbidden',
-        message: 'Insufficient permissions to access this agent',
-      });
-    });
-
-    test('should allow access when user has ACL entry with sufficient permissions', async () => {
-      // Create an agent owned by a different user
-      const otherUser = await User.create({
-        email: 'other2@example.com',
-        name: 'Other User 2',
-        username: 'otheruser2',
-        role: 'test-role',
-      });
-
-      const agent = await createAgent({
-        id: `agent_${Date.now()}`,
-        name: 'Shared Agent',
-        provider: 'openai',
-        model: 'gpt-4',
-        author: otherUser._id,
-      });
-
-      // Create ACL entry granting view permission to test user
-      await AclEntry.create({
-        principalType: 'user',
-        principalId: testUser._id,
-        principalModel: 'User',
-        resourceType: 'agent',
-        resourceId: agent._id,
-        permBits: 1, // VIEW permission
-        grantedBy: otherUser._id,
-      });
-
-      req.params.id = agent.id;
-
-      const middleware = canAccessAgentResource({ requiredPermission: 1 }); // VIEW permission
-      await middleware(req, res, next);
-
-      expect(next).toHaveBeenCalled();
-      expect(res.status).not.toHaveBeenCalled();
-    });
-
-    test('should deny access when ACL permissions are insufficient', async () => {
-      // Create an agent owned by a different user
-      const otherUser = await User.create({
-        email: 'other3@example.com',
-        name: 'Other User 3',
-        username: 'otheruser3',
-        role: 'test-role',
-      });
-
-      const agent = await createAgent({
-        id: `agent_${Date.now()}`,
-        name: 'Limited Access Agent',
-        provider: 'openai',
-        model: 'gpt-4',
-        author: otherUser._id,
-      });
-
-      // Create ACL entry granting only view permission
-      await AclEntry.create({
-        principalType: 'user',
-        principalId: testUser._id,
-        principalModel: 'User',
-        resourceType: 'agent',
-        resourceId: agent._id,
-        permBits: 1, // VIEW permission only
-        grantedBy: otherUser._id,
-      });
-
-      req.params.id = agent.id;
-
-      const middleware = canAccessAgentResource({ requiredPermission: 2 }); // EDIT permission required
-      await middleware(req, res, next);
-
-      expect(next).not.toHaveBeenCalled();
-      expect(res.status).toHaveBeenCalledWith(403);
-      expect(res.json).toHaveBeenCalledWith({
-        error: 'Forbidden',
-        message: 'Insufficient permissions to access this agent',
-      });
-    });
-
-    test('should handle non-existent agent', async () => {
-      req.params.id = 'agent_nonexistent';
-
-      const middleware = canAccessAgentResource({ requiredPermission: 1 });
-      await middleware(req, res, next);
-
-      expect(next).not.toHaveBeenCalled();
-      expect(res.status).toHaveBeenCalledWith(404);
-      expect(res.json).toHaveBeenCalledWith({
-        error: 'Not Found',
-        message: 'agent not found',
-      });
-    });
-
-    test('should use custom resourceIdParam', async () => {
-      const agent = await createAgent({
-        id: `agent_${Date.now()}`,
-        name: 'Custom Param Agent',
-        provider: 'openai',
-        model: 'gpt-4',
-        author: testUser._id,
-      });
-
-      // Create ACL entry for the author
-      await AclEntry.create({
-        principalType: 'user',
-        principalId: testUser._id,
-        principalModel: 'User',
-        resourceType: 'agent',
-        resourceId: agent._id,
-        permBits: 15, // All permissions
-        grantedBy: testUser._id,
-      });
-
-      req.params.agent_id = agent.id; // Using custom param name
-
-      const middleware = canAccessAgentResource({
-        requiredPermission: 1,
-        resourceIdParam: 'agent_id',
-      });
-      await middleware(req, res, next);
-
-      expect(next).toHaveBeenCalled();
-      expect(res.status).not.toHaveBeenCalled();
-    });
-  });
-
-  describe('permission levels', () => {
-    let agent;
-
-    beforeEach(async () => {
-      agent = await createAgent({
-        id: `agent_${Date.now()}`,
-        name: 'Permission Test Agent',
-        provider: 'openai',
-        model: 'gpt-4',
-        author: testUser._id,
-      });
-
-      // Create ACL entry with all permissions for the owner
-      await AclEntry.create({
-        principalType: 'user',
-        principalId: testUser._id,
-        principalModel: 'User',
-        resourceType: 'agent',
-        resourceId: agent._id,
-        permBits: 15, // All permissions (1+2+4+8)
-        grantedBy: testUser._id,
-      });
-
-      req.params.id = agent.id;
-    });
-
-    test('should support view permission (1)', async () => {
-      const middleware = canAccessAgentResource({ requiredPermission: 1 });
-      await middleware(req, res, next);
-      expect(next).toHaveBeenCalled();
-    });
-
-    test('should support edit permission (2)', async () => {
-      const middleware = canAccessAgentResource({ requiredPermission: 2 });
-      await middleware(req, res, next);
-      expect(next).toHaveBeenCalled();
-    });
-
-    test('should support delete permission (4)', async () => {
-      const middleware = canAccessAgentResource({ requiredPermission: 4 });
-      await middleware(req, res, next);
-      expect(next).toHaveBeenCalled();
-    });
-
-    test('should support share permission (8)', async () => {
-      const middleware = canAccessAgentResource({ requiredPermission: 8 });
-      await middleware(req, res, next);
-      expect(next).toHaveBeenCalled();
-    });
-
-    test('should support combined permissions', async () => {
-      const viewAndEdit = 1 | 2; // 3
-      const middleware = canAccessAgentResource({ requiredPermission: viewAndEdit });
-      await middleware(req, res, next);
-      expect(next).toHaveBeenCalled();
-    });
-  });
-
-  describe('integration with agent operations', () => {
-    test('should work with agent CRUD operations', async () => {
-      const agentId = `agent_${Date.now()}`;
-
-      // Create agent
-      const agent = await createAgent({
-        id: agentId,
-        name: 'Integration Test Agent',
-        provider: 'openai',
-        model: 'gpt-4',
-        author: testUser._id,
-        description: 'Testing integration',
-      });
-
-      // Create ACL entry for the author
-      await AclEntry.create({
-        principalType: 'user',
-        principalId: testUser._id,
-        principalModel: 'User',
-        resourceType: 'agent',
-        resourceId: agent._id,
-        permBits: 15, // All permissions
-        grantedBy: testUser._id,
-      });
-
-      req.params.id = agentId;
-
-      // Test view access
-      const viewMiddleware = canAccessAgentResource({ requiredPermission: 1 });
-      await viewMiddleware(req, res, next);
-      expect(next).toHaveBeenCalled();
-      jest.clearAllMocks();
-
-      // Update the agent
-      const { updateAgent } = require('~/models/Agent');
-      await updateAgent({ id: agentId }, { description: 'Updated description' });
-
-      // Test edit access
-      const editMiddleware = canAccessAgentResource({ requiredPermission: 2 });
-      await editMiddleware(req, res, next);
-      expect(next).toHaveBeenCalled();
-    });
-  });
-});

api/server/middleware/accessResources/canAccessResource.js

@@ -1,157 +0,0 @@
-const { logger } = require('@librechat/data-schemas');
-const { SystemRoles } = require('librechat-data-provider');
-const { checkPermission } = require('~/server/services/PermissionService');
-
-/**
- * Generic base middleware factory that creates middleware to check resource access permissions.
- * This middleware expects MongoDB ObjectIds as resource identifiers for ACL permission checks.
- *
- * @param {Object} options - Configuration options
- * @param {string} options.resourceType - The type of resource (e.g., 'agent', 'file', 'project')
- * @param {number} options.requiredPermission - The permission bit required (1=view, 2=edit, 4=delete, 8=share)
- * @param {string} [options.resourceIdParam='resourceId'] - The name of the route parameter containing the resource ID
- * @param {Function} [options.idResolver] - Optional function to resolve custom IDs to ObjectIds
- * @returns {Function} Express middleware function
- *
- * @example
- * // Direct usage with ObjectId (for resources that use MongoDB ObjectId in routes)
- * router.get('/prompts/:promptId',
- *   canAccessResource({ resourceType: 'prompt', requiredPermission: 1 }),
- *   getPrompt
- * );
- *
- * @example
- * // Usage with custom ID resolver (for resources that use custom string IDs)
- * router.get('/agents/:id',
- *   canAccessResource({
- *     resourceType: 'agent',
- *     requiredPermission: 1,
- *     resourceIdParam: 'id',
- *     idResolver: (customId) => resolveAgentId(customId)
- *   }),
- *   getAgent
- * );
- */
-const canAccessResource = (options) => {
-  const {
-    resourceType,
-    requiredPermission,
-    resourceIdParam = 'resourceId',
-    idResolver = null,
-  } = options;
-
-  if (!resourceType || typeof resourceType !== 'string') {
-    throw new Error('canAccessResource: resourceType is required and must be a string');
-  }
-
-  if (!requiredPermission || typeof requiredPermission !== 'number') {
-    throw new Error('canAccessResource: requiredPermission is required and must be a number');
-  }
-
-  return async (req, res, next) => {
-    try {
-      // Extract resource ID from route parameters
-      const rawResourceId = req.params[resourceIdParam];
-
-      if (!rawResourceId) {
-        logger.warn(`[canAccessResource] Missing ${resourceIdParam} in route parameters`);
-        return res.status(400).json({
-          error: 'Bad Request',
-          message: `${resourceIdParam} is required`,
-        });
-      }
-
-      // Check if user is authenticated
-      if (!req.user || !req.user.id) {
-        logger.warn(
-          `[canAccessResource] Unauthenticated request for ${resourceType} ${rawResourceId}`,
-        );
-        return res.status(401).json({
-          error: 'Unauthorized',
-          message: 'Authentication required',
-        });
-      }
-      // if system admin let through
-      if (req.user.role === SystemRoles.ADMIN) {
-        return next();
-      }
-      const userId = req.user.id;
-      let resourceId = rawResourceId;
-      let resourceInfo = null;
-
-      // Resolve custom ID to ObjectId if resolver is provided
-      if (idResolver) {
-        logger.debug(
-          `[canAccessResource] Resolving ${resourceType} custom ID ${rawResourceId} to ObjectId`,
-        );
-
-        const resolutionResult = await idResolver(rawResourceId);
-
-        if (!resolutionResult) {
-          logger.warn(`[canAccessResource] ${resourceType} not found: ${rawResourceId}`);
-          return res.status(404).json({
-            error: 'Not Found',
-            message: `${resourceType} not found`,
-          });
-        }
-
-        // Handle different resolver return formats
-        if (typeof resolutionResult === 'string' || resolutionResult._id) {
-          resourceId = resolutionResult._id || resolutionResult;
-          resourceInfo = typeof resolutionResult === 'object' ? resolutionResult : null;
-        } else {
-          resourceId = resolutionResult;
-        }
-
-        logger.debug(
-          `[canAccessResource] Resolved ${resourceType} ${rawResourceId} to ObjectId ${resourceId}`,
-        );
-      }
-
-      // Check permissions using PermissionService with ObjectId
-      const hasPermission = await checkPermission({
-        userId,
-        resourceType,
-        resourceId,
-        requiredPermission,
-      });
-
-      if (hasPermission) {
-        logger.debug(
-          `[canAccessResource] User ${userId} has permission ${requiredPermission} on ${resourceType} ${rawResourceId} (${resourceId})`,
-        );
-
-        req.resourceAccess = {
-          resourceType,
-          resourceId, // MongoDB ObjectId for ACL operations
-          customResourceId: rawResourceId, // Original ID from route params
-          permission: requiredPermission,
-          userId,
-          ...(resourceInfo && { resourceInfo }),
-        };
-
-        return next();
-      }
-
-      logger.warn(
-        `[canAccessResource] User ${userId} denied access to ${resourceType} ${rawResourceId} ` +
-          `(required permission: ${requiredPermission})`,
-      );
-
-      return res.status(403).json({
-        error: 'Forbidden',
-        message: `Insufficient permissions to access this ${resourceType}`,
-      });
-    } catch (error) {
-      logger.error(`[canAccessResource] Error checking access for ${resourceType}:`, error);
-      return res.status(500).json({
-        error: 'Internal Server Error',
-        message: 'Failed to check resource access permissions',
-      });
-    }
-  };
-};
-
-module.exports = {
-  canAccessResource,
-};

api/server/middleware/accessResources/index.js

@@ -1,9 +0,0 @@
-const { canAccessResource } = require('./canAccessResource');
-const { canAccessAgentResource } = require('./canAccessAgentResource');
-const { canAccessAgentFromBody } = require('./canAccessAgentFromBody');
-
-module.exports = {
-  canAccessResource,
-  canAccessAgentResource,
-  canAccessAgentFromBody,
-};

api/server/middleware/checkBan.js

@@ -18,7 +18,6 @@ const message = 'Your account has been temporarily banned due to violations of o
  * @function
  * @param {Object} req - Express Request object.
  * @param {Object} res - Express Response object.
- * @param {String} errorMessage - Error message to be displayed in case of /api/ask or /api/edit request.
  *
  * @returns {Promise<Object>} - Returns a Promise which when resolved sends a response status of 403 with a specific message if request is not of api/ask or api/edit types. If it is, calls `denyRequest()` function.
  */
@@ -135,6 +134,7 @@ const checkBan = async (req, res, next = () => {}) => {
     return await banResponse(req, res);
   } catch (error) {
     logger.error('Error in checkBan middleware:', error);
+    return next(error);
   }
 };
 

api/server/middleware/index.js

@@ -8,7 +8,6 @@ const concurrentLimiter = require('./concurrentLimiter');
 const validateEndpoint = require('./validateEndpoint');
 const requireLocalAuth = require('./requireLocalAuth');
 const canDeleteAccount = require('./canDeleteAccount');
-const accessResources = require('./accessResources');
 const setBalanceConfig = require('./setBalanceConfig');
 const requireLdapAuth = require('./requireLdapAuth');
 const abortMiddleware = require('./abortMiddleware');
@@ -30,7 +29,6 @@ module.exports = {
   ...validate,
   ...limiters,
   ...roles,
-  ...accessResources,
   noIndex,
   checkBan,
   uaParser,

api/server/middleware/limiters/forkLimiters.js

@@ -0,0 +1,88 @@
+const rateLimit = require('express-rate-limit');
+const { isEnabled } = require('@librechat/api');
+const { RedisStore } = require('rate-limit-redis');
+const { logger } = require('@librechat/data-schemas');
+const { ViolationTypes } = require('librechat-data-provider');
+const ioredisClient = require('~/cache/ioredisClient');
+const logViolation = require('~/cache/logViolation');
+
+const getEnvironmentVariables = () => {
+  const FORK_IP_MAX = parseInt(process.env.FORK_IP_MAX) || 30;
+  const FORK_IP_WINDOW = parseInt(process.env.FORK_IP_WINDOW) || 1;
+  const FORK_USER_MAX = parseInt(process.env.FORK_USER_MAX) || 7;
+  const FORK_USER_WINDOW = parseInt(process.env.FORK_USER_WINDOW) || 1;
+
+  const forkIpWindowMs = FORK_IP_WINDOW * 60 * 1000;
+  const forkIpMax = FORK_IP_MAX;
+  const forkIpWindowInMinutes = forkIpWindowMs / 60000;
+
+  const forkUserWindowMs = FORK_USER_WINDOW * 60 * 1000;
+  const forkUserMax = FORK_USER_MAX;
+  const forkUserWindowInMinutes = forkUserWindowMs / 60000;
+
+  return {
+    forkIpWindowMs,
+    forkIpMax,
+    forkIpWindowInMinutes,
+    forkUserWindowMs,
+    forkUserMax,
+    forkUserWindowInMinutes,
+  };
+};
+
+const createForkHandler = (ip = true) => {
+  const { forkIpMax, forkIpWindowInMinutes, forkUserMax, forkUserWindowInMinutes } =
+    getEnvironmentVariables();
+
+  return async (req, res) => {
+    const type = ViolationTypes.FILE_UPLOAD_LIMIT;
+    const errorMessage = {
+      type,
+      max: ip ? forkIpMax : forkUserMax,
+      limiter: ip ? 'ip' : 'user',
+      windowInMinutes: ip ? forkIpWindowInMinutes : forkUserWindowInMinutes,
+    };
+
+    await logViolation(req, res, type, errorMessage);
+    res.status(429).json({ message: 'Too many conversation fork requests. Try again later' });
+  };
+};
+
+const createForkLimiters = () => {
+  const { forkIpWindowMs, forkIpMax, forkUserWindowMs, forkUserMax } = getEnvironmentVariables();
+
+  const ipLimiterOptions = {
+    windowMs: forkIpWindowMs,
+    max: forkIpMax,
+    handler: createForkHandler(),
+  };
+  const userLimiterOptions = {
+    windowMs: forkUserWindowMs,
+    max: forkUserMax,
+    handler: createForkHandler(false),
+    keyGenerator: function (req) {
+      return req.user?.id;
+    },
+  };
+
+  if (isEnabled(process.env.USE_REDIS) && ioredisClient) {
+    logger.debug('Using Redis for fork rate limiters.');
+    const sendCommand = (...args) => ioredisClient.call(...args);
+    const ipStore = new RedisStore({
+      sendCommand,
+      prefix: 'fork_ip_limiter:',
+    });
+    const userStore = new RedisStore({
+      sendCommand,
+      prefix: 'fork_user_limiter:',
+    });
+    ipLimiterOptions.store = ipStore;
+    userLimiterOptions.store = userStore;
+  }
+
+  const forkIpLimiter = rateLimit(ipLimiterOptions);
+  const forkUserLimiter = rateLimit(userLimiterOptions);
+  return { forkIpLimiter, forkUserLimiter };
+};
+
+module.exports = { createForkLimiters };

api/server/middleware/limiters/importLimiters.js

@@ -1,10 +1,10 @@
 const rateLimit = require('express-rate-limit');
+const { isEnabled } = require('@librechat/api');
 const { RedisStore } = require('rate-limit-redis');
+const { logger } = require('@librechat/data-schemas');
 const { ViolationTypes } = require('librechat-data-provider');
 const ioredisClient = require('~/cache/ioredisClient');
 const logViolation = require('~/cache/logViolation');
-const { isEnabled } = require('~/server/utils');
-const { logger } = require('~/config');
 
 const getEnvironmentVariables = () => {
   const IMPORT_IP_MAX = parseInt(process.env.IMPORT_IP_MAX) || 100;

api/server/middleware/limiters/index.js

@@ -4,6 +4,7 @@ const createSTTLimiters = require('./sttLimiters');
 const loginLimiter = require('./loginLimiter');
 const importLimiters = require('./importLimiters');
 const uploadLimiters = require('./uploadLimiters');
+const forkLimiters = require('./forkLimiters');
 const registerLimiter = require('./registerLimiter');
 const toolCallLimiter = require('./toolCallLimiter');
 const messageLimiters = require('./messageLimiters');
@@ -14,6 +15,7 @@ module.exports = {
   ...uploadLimiters,
   ...importLimiters,
   ...messageLimiters,
+  ...forkLimiters,
   loginLimiter,
   registerLimiter,
   toolCallLimiter,

api/server/middleware/roles/access.spec.js

@@ -1,357 +0,0 @@
-const mongoose = require('mongoose');
-const { MongoMemoryServer } = require('mongodb-memory-server');
-const { checkAccess, generateCheckAccess } = require('@librechat/api');
-const { PermissionTypes, Permissions } = require('librechat-data-provider');
-const { getRoleByName } = require('~/models/Role');
-const { Role } = require('~/db/models');
-
-// Mock the logger from @librechat/data-schemas
-jest.mock('@librechat/data-schemas', () => ({
-  ...jest.requireActual('@librechat/data-schemas'),
-  logger: {
-    warn: jest.fn(),
-    error: jest.fn(),
-    info: jest.fn(),
-    debug: jest.fn(),
-  },
-}));
-
-// Mock the cache to use a simple in-memory implementation
-const mockCache = new Map();
-jest.mock('~/cache/getLogStores', () => {
-  return jest.fn(() => ({
-    get: jest.fn(async (key) => mockCache.get(key)),
-    set: jest.fn(async (key, value) => mockCache.set(key, value)),
-    clear: jest.fn(async () => mockCache.clear()),
-  }));
-});
-
-describe('Access Middleware', () => {
-  let mongoServer;
-  let req, res, next;
-
-  beforeAll(async () => {
-    mongoServer = await MongoMemoryServer.create();
-    const mongoUri = mongoServer.getUri();
-    await mongoose.connect(mongoUri);
-  });
-
-  afterAll(async () => {
-    await mongoose.disconnect();
-    await mongoServer.stop();
-  });
-
-  beforeEach(async () => {
-    await mongoose.connection.dropDatabase();
-    mockCache.clear(); // Clear the cache between tests
-
-    // Create test roles
-    await Role.create({
-      name: 'user',
-      permissions: {
-        [PermissionTypes.BOOKMARKS]: { [Permissions.USE]: true },
-        [PermissionTypes.PROMPTS]: {
-          [Permissions.SHARED_GLOBAL]: false,
-          [Permissions.USE]: true,
-          [Permissions.CREATE]: true,
-        },
-        [PermissionTypes.MEMORIES]: {
-          [Permissions.USE]: true,
-          [Permissions.CREATE]: true,
-          [Permissions.UPDATE]: true,
-          [Permissions.READ]: true,
-          [Permissions.OPT_OUT]: true,
-        },
-        [PermissionTypes.AGENTS]: {
-          [Permissions.USE]: true,
-          [Permissions.CREATE]: false,
-          [Permissions.SHARED_GLOBAL]: false,
-        },
-        [PermissionTypes.MULTI_CONVO]: { [Permissions.USE]: true },
-        [PermissionTypes.TEMPORARY_CHAT]: { [Permissions.USE]: true },
-        [PermissionTypes.RUN_CODE]: { [Permissions.USE]: true },
-        [PermissionTypes.WEB_SEARCH]: { [Permissions.USE]: true },
-      },
-    });
-
-    await Role.create({
-      name: 'admin',
-      permissions: {
-        [PermissionTypes.BOOKMARKS]: { [Permissions.USE]: true },
-        [PermissionTypes.PROMPTS]: {
-          [Permissions.SHARED_GLOBAL]: true,
-          [Permissions.USE]: true,
-          [Permissions.CREATE]: true,
-        },
-        [PermissionTypes.MEMORIES]: {
-          [Permissions.USE]: true,
-          [Permissions.CREATE]: true,
-          [Permissions.UPDATE]: true,
-          [Permissions.READ]: true,
-          [Permissions.OPT_OUT]: true,
-        },
-        [PermissionTypes.AGENTS]: {
-          [Permissions.USE]: true,
-          [Permissions.CREATE]: true,
-          [Permissions.SHARED_GLOBAL]: true,
-        },
-        [PermissionTypes.MULTI_CONVO]: { [Permissions.USE]: true },
-        [PermissionTypes.TEMPORARY_CHAT]: { [Permissions.USE]: true },
-        [PermissionTypes.RUN_CODE]: { [Permissions.USE]: true },
-        [PermissionTypes.WEB_SEARCH]: { [Permissions.USE]: true },
-      },
-    });
-
-    // Create limited role with no AGENTS permissions
-    await Role.create({
-      name: 'limited',
-      permissions: {
-        // Explicitly set AGENTS permissions to false
-        [PermissionTypes.AGENTS]: {
-          [Permissions.USE]: false,
-          [Permissions.CREATE]: false,
-          [Permissions.SHARED_GLOBAL]: false,
-        },
-        // Has permissions for other types
-        [PermissionTypes.PROMPTS]: {
-          [Permissions.USE]: true,
-        },
-      },
-    });
-
-    req = {
-      user: { id: 'user123', role: 'user' },
-      body: {},
-      originalUrl: '/test',
-    };
-    res = {
-      status: jest.fn().mockReturnThis(),
-      json: jest.fn(),
-    };
-    next = jest.fn();
-    jest.clearAllMocks();
-  });
-
-  describe('checkAccess', () => {
-    test('should return false if user is not provided', async () => {
-      const result = await checkAccess({
-        user: null,
-        permissionType: PermissionTypes.AGENTS,
-        permissions: [Permissions.USE],
-        getRoleByName,
-      });
-      expect(result).toBe(false);
-    });
-
-    test('should return true if user has required permission', async () => {
-      const result = await checkAccess({
-        req: {},
-        user: { id: 'user123', role: 'user' },
-        permissionType: PermissionTypes.AGENTS,
-        permissions: [Permissions.USE],
-        getRoleByName,
-      });
-      expect(result).toBe(true);
-    });
-
-    test('should return false if user lacks required permission', async () => {
-      const result = await checkAccess({
-        req: {},
-        user: { id: 'user123', role: 'user' },
-        permissionType: PermissionTypes.AGENTS,
-        permissions: [Permissions.CREATE],
-        getRoleByName,
-      });
-      expect(result).toBe(false);
-    });
-
-    test('should return true if user has any of multiple permissions', async () => {
-      const result = await checkAccess({
-        req: {},
-        user: { id: 'user123', role: 'user' },
-        permissionType: PermissionTypes.AGENTS,
-        permissions: [Permissions.CREATE, Permissions.USE],
-        getRoleByName,
-      });
-      expect(result).toBe(true);
-    });
-
-    test('should check body properties when permission is not directly granted', async () => {
-      const req = { body: { id: 'agent123' } };
-      const result = await checkAccess({
-        req,
-        user: { id: 'user123', role: 'user' },
-        permissionType: PermissionTypes.AGENTS,
-        permissions: [Permissions.UPDATE],
-        bodyProps: {
-          [Permissions.UPDATE]: ['id'],
-        },
-        checkObject: req.body,
-        getRoleByName,
-      });
-      expect(result).toBe(true);
-    });
-
-    test('should return false if role is not found', async () => {
-      const result = await checkAccess({
-        req: {},
-        user: { id: 'user123', role: 'nonexistent' },
-        permissionType: PermissionTypes.AGENTS,
-        permissions: [Permissions.USE],
-        getRoleByName,
-      });
-      expect(result).toBe(false);
-    });
-
-    test('should return false if role has no permissions for the requested type', async () => {
-      const result = await checkAccess({
-        req: {},
-        user: { id: 'user123', role: 'limited' },
-        permissionType: PermissionTypes.AGENTS,
-        permissions: [Permissions.USE],
-        getRoleByName,
-      });
-      expect(result).toBe(false);
-    });
-
-    test('should handle admin role with all permissions', async () => {
-      const createResult = await checkAccess({
-        req: {},
-        user: { id: 'admin123', role: 'admin' },
-        permissionType: PermissionTypes.AGENTS,
-        permissions: [Permissions.CREATE],
-        getRoleByName,
-      });
-      expect(createResult).toBe(true);
-
-      const shareResult = await checkAccess({
-        req: {},
-        user: { id: 'admin123', role: 'admin' },
-        permissionType: PermissionTypes.AGENTS,
-        permissions: [Permissions.SHARED_GLOBAL],
-        getRoleByName,
-      });
-      expect(shareResult).toBe(true);
-    });
-  });
-
-  describe('generateCheckAccess', () => {
-    test('should call next() when user has required permission', async () => {
-      const middleware = generateCheckAccess({
-        permissionType: PermissionTypes.AGENTS,
-        permissions: [Permissions.USE],
-        getRoleByName,
-      });
-      await middleware(req, res, next);
-
-      expect(next).toHaveBeenCalled();
-      expect(res.status).not.toHaveBeenCalled();
-    });
-
-    test('should return 403 when user lacks permission', async () => {
-      const middleware = generateCheckAccess({
-        permissionType: PermissionTypes.AGENTS,
-        permissions: [Permissions.CREATE],
-        getRoleByName,
-      });
-      await middleware(req, res, next);
-
-      expect(next).not.toHaveBeenCalled();
-      expect(res.status).toHaveBeenCalledWith(403);
-      expect(res.json).toHaveBeenCalledWith({ message: 'Forbidden: Insufficient permissions' });
-    });
-
-    test('should check body properties when configured', async () => {
-      req.body = { agentId: 'agent123', description: 'test' };
-
-      const bodyProps = {
-        [Permissions.CREATE]: ['agentId'],
-      };
-
-      const middleware = generateCheckAccess({
-        permissionType: PermissionTypes.AGENTS,
-        permissions: [Permissions.CREATE],
-        bodyProps,
-        getRoleByName,
-      });
-      await middleware(req, res, next);
-
-      expect(next).toHaveBeenCalled();
-      expect(res.status).not.toHaveBeenCalled();
-    });
-
-    test('should handle database errors gracefully', async () => {
-      // Mock getRoleByName to throw an error
-      const mockGetRoleByName = jest
-        .fn()
-        .mockRejectedValue(new Error('Database connection failed'));
-
-      const middleware = generateCheckAccess({
-        permissionType: PermissionTypes.AGENTS,
-        permissions: [Permissions.USE],
-        getRoleByName: mockGetRoleByName,
-      });
-      await middleware(req, res, next);
-
-      expect(next).not.toHaveBeenCalled();
-      expect(res.status).toHaveBeenCalledWith(500);
-      expect(res.json).toHaveBeenCalledWith({
-        message: expect.stringContaining('Server error:'),
-      });
-    });
-
-    test('should work with multiple permission types', async () => {
-      req.user.role = 'admin';
-
-      const middleware = generateCheckAccess({
-        permissionType: PermissionTypes.AGENTS,
-        permissions: [Permissions.USE, Permissions.CREATE, Permissions.SHARED_GLOBAL],
-        getRoleByName,
-      });
-      await middleware(req, res, next);
-
-      expect(next).toHaveBeenCalled();
-    });
-
-    test('should handle missing user gracefully', async () => {
-      req.user = null;
-
-      const middleware = generateCheckAccess({
-        permissionType: PermissionTypes.AGENTS,
-        permissions: [Permissions.USE],
-        getRoleByName,
-      });
-      await middleware(req, res, next);
-
-      expect(next).not.toHaveBeenCalled();
-      expect(res.status).toHaveBeenCalledWith(403);
-      expect(res.json).toHaveBeenCalledWith({ message: 'Forbidden: Insufficient permissions' });
-    });
-
-    test('should handle role with no AGENTS permissions', async () => {
-      await Role.create({
-        name: 'noaccess',
-        permissions: {
-          // Explicitly set AGENTS with all permissions false
-          [PermissionTypes.AGENTS]: {
-            [Permissions.USE]: false,
-            [Permissions.CREATE]: false,
-            [Permissions.SHARED_GLOBAL]: false,
-          },
-        },
-      });
-      req.user.role = 'noaccess';
-
-      const middleware = generateCheckAccess({
-        permissionType: PermissionTypes.AGENTS,
-        permissions: [Permissions.USE],
-        getRoleByName,
-      });
-      await middleware(req, res, next);
-
-      expect(next).not.toHaveBeenCalled();
-      expect(res.status).toHaveBeenCalledWith(403);
-      expect(res.json).toHaveBeenCalledWith({ message: 'Forbidden: Insufficient permissions' });
-    });
-  });
-});

api/server/routes/accessPermissions.js

@@ -1,62 +0,0 @@
-const express = require('express');
-const { PermissionBits } = require('@librechat/data-schemas');
-const {
-  getUserEffectivePermissions,
-  updateResourcePermissions,
-  getResourcePermissions,
-  getResourceRoles,
-  searchPrincipals,
-} = require('~/server/controllers/PermissionsController');
-const { requireJwtAuth, checkBan, uaParser, canAccessResource } = require('~/server/middleware');
-
-const router = express.Router();
-
-// Apply common middleware
-router.use(requireJwtAuth);
-router.use(checkBan);
-router.use(uaParser);
-
-/**
- * Generic routes for resource permissions
- * Pattern: /api/permissions/{resourceType}/{resourceId}
- */
-
-/**
- * GET /api/permissions/search-principals
- * Search for users and groups to grant permissions
- */
-router.get('/search-principals', searchPrincipals);
-
-/**
- * GET /api/permissions/{resourceType}/roles
- * Get available roles for a resource type
- */
-router.get('/:resourceType/roles', getResourceRoles);
-
-/**
- * GET /api/permissions/{resourceType}/{resourceId}
- * Get all permissions for a specific resource
- */
-router.get('/:resourceType/:resourceId', getResourcePermissions);
-
-/**
- * PUT /api/permissions/{resourceType}/{resourceId}
- * Bulk update permissions for a specific resource
- */
-router.put(
-  '/:resourceType/:resourceId',
-  canAccessResource({
-    resourceType: 'agent',
-    requiredPermission: PermissionBits.SHARE,
-    resourceIdParam: 'resourceId',
-  }),
-  updateResourcePermissions,
-);
-
-/**
- * GET /api/permissions/{resourceType}/{resourceId}/effective
- * Get user's effective permissions for a specific resource
- */
-router.get('/:resourceType/:resourceId/effective', getUserEffectivePermissions);
-
-module.exports = router;

api/server/routes/agents/actions.js

@@ -1,8 +1,9 @@
 const express = require('express');
 const { nanoid } = require('nanoid');
+const { logger } = require('@librechat/data-schemas');
 const { generateCheckAccess } = require('@librechat/api');
-const { logger, PermissionBits } = require('@librechat/data-schemas');
 const {
+  SystemRoles,
   Permissions,
   PermissionTypes,
   actionDelimiter,
@@ -11,7 +12,6 @@ const {
 const { encryptMetadata, domainParser } = require('~/server/services/ActionService');
 const { updateAction, getActions, deleteAction } = require('~/models/Action');
 const { isActionDomainAllowed } = require('~/server/services/domains');
-const { canAccessAgentResource } = require('~/server/middleware');
 const { getAgent, updateAgent } = require('~/models/Agent');
 const { getRoleByName } = require('~/models/Role');
 
@@ -23,6 +23,12 @@ const checkAgentCreate = generateCheckAccess({
   getRoleByName,
 });
 
+// If the user has ADMIN role
+// then action edition is possible even if not owner of the assistant
+const isAdmin = (req) => {
+  return req.user.role === SystemRoles.ADMIN;
+};
+
 /**
  * Retrieves all user's actions
  * @route GET /actions/
@@ -31,8 +37,9 @@ const checkAgentCreate = generateCheckAccess({
  */
 router.get('/', async (req, res) => {
   try {
-    // Get all actions for the user (admin permissions handled by middleware if needed)
-    const searchParams = { user: req.user.id };
+    const admin = isAdmin(req);
+    // If admin, get all actions, otherwise only user's actions
+    const searchParams = admin ? {} : { user: req.user.id };
     res.json(await getActions(searchParams));
   } catch (error) {
     res.status(500).json({ error: error.message });
@@ -48,111 +55,106 @@ router.get('/', async (req, res) => {
  * @param {ActionMetadata} req.body.metadata - Metadata for the action.
  * @returns {Object} 200 - success response - application/json
  */
-router.post(
-  '/:agent_id',
-  canAccessAgentResource({
-    requiredPermission: PermissionBits.EDIT,
-    resourceIdParam: 'agent_id',
-  }),
-  checkAgentCreate,
-  async (req, res) => {
-    try {
-      const { agent_id } = req.params;
+router.post('/:agent_id', checkAgentCreate, async (req, res) => {
+  try {
+    const { agent_id } = req.params;
 
-      /** @type {{ functions: FunctionTool[], action_id: string, metadata: ActionMetadata }} */
-      const { functions, action_id: _action_id, metadata: _metadata } = req.body;
-      if (!functions.length) {
-        return res.status(400).json({ message: 'No functions provided' });
-      }
-
-      let metadata = await encryptMetadata(removeNullishValues(_metadata, true));
-      const isDomainAllowed = await isActionDomainAllowed(metadata.domain);
-      if (!isDomainAllowed) {
-        return res.status(400).json({ message: 'Domain not allowed' });
-      }
-
-      let { domain } = metadata;
-      domain = await domainParser(domain, true);
-
-      if (!domain) {
-        return res.status(400).json({ message: 'No domain provided' });
-      }
-
-      const action_id = _action_id ?? nanoid();
-      const initialPromises = [];
-
-      // Permissions already validated by middleware - load agent directly
-      initialPromises.push(getAgent({ id: agent_id }));
-      if (_action_id) {
-        initialPromises.push(getActions({ action_id }, true));
-      }
-
-      /** @type {[Agent, [Action|undefined]]} */
-      const [agent, actions_result] = await Promise.all(initialPromises);
-      if (!agent) {
-        return res.status(404).json({ message: 'Agent not found for adding action' });
-      }
-
-      if (actions_result && actions_result.length) {
-        const action = actions_result[0];
-        metadata = { ...action.metadata, ...metadata };
-      }
-
-      const { actions: _actions = [], author: agent_author } = agent ?? {};
-      const actions = [];
-      for (const action of _actions) {
-        const [_action_domain, current_action_id] = action.split(actionDelimiter);
-        if (current_action_id === action_id) {
-          continue;
-        }
-
-        actions.push(action);
-      }
-
-      actions.push(`${domain}${actionDelimiter}${action_id}`);
-
-      /** @type {string[]}} */
-      const { tools: _tools = [] } = agent;
-
-      const tools = _tools
-        .filter((tool) => !(tool && (tool.includes(domain) || tool.includes(action_id))))
-        .concat(functions.map((tool) => `${tool.function.name}${actionDelimiter}${domain}`));
-
-      // Force version update since actions are changing
-      const updatedAgent = await updateAgent(
-        { id: agent_id },
-        { tools, actions },
-        {
-          updatingUserId: req.user.id,
-          forceVersion: true,
-        },
-      );
-
-      // Only update user field for new actions
-      const actionUpdateData = { metadata, agent_id };
-      if (!actions_result || !actions_result.length) {
-        // For new actions, use the agent owner's user ID
-        actionUpdateData.user = agent_author || req.user.id;
-      }
-
-      /** @type {[Action]} */
-      const updatedAction = await updateAction({ action_id }, actionUpdateData);
-
-      const sensitiveFields = ['api_key', 'oauth_client_id', 'oauth_client_secret'];
-      for (let field of sensitiveFields) {
-        if (updatedAction.metadata[field]) {
-          delete updatedAction.metadata[field];
-        }
-      }
-
-      res.json([updatedAgent, updatedAction]);
-    } catch (error) {
-      const message = 'Trouble updating the Agent Action';
-      logger.error(message, error);
-      res.status(500).json({ message });
+    /** @type {{ functions: FunctionTool[], action_id: string, metadata: ActionMetadata }} */
+    const { functions, action_id: _action_id, metadata: _metadata } = req.body;
+    if (!functions.length) {
+      return res.status(400).json({ message: 'No functions provided' });
     }
-  },
-);
+
+    let metadata = await encryptMetadata(removeNullishValues(_metadata, true));
+    const isDomainAllowed = await isActionDomainAllowed(metadata.domain);
+    if (!isDomainAllowed) {
+      return res.status(400).json({ message: 'Domain not allowed' });
+    }
+
+    let { domain } = metadata;
+    domain = await domainParser(domain, true);
+
+    if (!domain) {
+      return res.status(400).json({ message: 'No domain provided' });
+    }
+
+    const action_id = _action_id ?? nanoid();
+    const initialPromises = [];
+    const admin = isAdmin(req);
+
+    // If admin, can edit any agent, otherwise only user's agents
+    const agentQuery = admin ? { id: agent_id } : { id: agent_id, author: req.user.id };
+    // TODO: share agents
+    initialPromises.push(getAgent(agentQuery));
+    if (_action_id) {
+      initialPromises.push(getActions({ action_id }, true));
+    }
+
+    /** @type {[Agent, [Action|undefined]]} */
+    const [agent, actions_result] = await Promise.all(initialPromises);
+    if (!agent) {
+      return res.status(404).json({ message: 'Agent not found for adding action' });
+    }
+
+    if (actions_result && actions_result.length) {
+      const action = actions_result[0];
+      metadata = { ...action.metadata, ...metadata };
+    }
+
+    const { actions: _actions = [], author: agent_author } = agent ?? {};
+    const actions = [];
+    for (const action of _actions) {
+      const [_action_domain, current_action_id] = action.split(actionDelimiter);
+      if (current_action_id === action_id) {
+        continue;
+      }
+
+      actions.push(action);
+    }
+
+    actions.push(`${domain}${actionDelimiter}${action_id}`);
+
+    /** @type {string[]}} */
+    const { tools: _tools = [] } = agent;
+
+    const tools = _tools
+      .filter((tool) => !(tool && (tool.includes(domain) || tool.includes(action_id))))
+      .concat(functions.map((tool) => `${tool.function.name}${actionDelimiter}${domain}`));
+
+    // Force version update since actions are changing
+    const updatedAgent = await updateAgent(
+      agentQuery,
+      { tools, actions },
+      {
+        updatingUserId: req.user.id,
+        forceVersion: true,
+      },
+    );
+
+    // Only update user field for new actions
+    const actionUpdateData = { metadata, agent_id };
+    if (!actions_result || !actions_result.length) {
+      // For new actions, use the agent owner's user ID
+      actionUpdateData.user = agent_author || req.user.id;
+    }
+
+    /** @type {[Action]} */
+    const updatedAction = await updateAction({ action_id }, actionUpdateData);
+
+    const sensitiveFields = ['api_key', 'oauth_client_id', 'oauth_client_secret'];
+    for (let field of sensitiveFields) {
+      if (updatedAction.metadata[field]) {
+        delete updatedAction.metadata[field];
+      }
+    }
+
+    res.json([updatedAgent, updatedAction]);
+  } catch (error) {
+    const message = 'Trouble updating the Agent Action';
+    logger.error(message, error);
+    res.status(500).json({ message });
+  }
+});
 
 /**
  * Deletes an action for a specific agent.
@@ -161,56 +163,52 @@ router.post(
  * @param {string} req.params.action_id - The ID of the action to delete.
  * @returns {Object} 200 - success response - application/json
  */
-router.delete(
-  '/:agent_id/:action_id',
-  canAccessAgentResource({
-    requiredPermission: PermissionBits.EDIT,
-    resourceIdParam: 'agent_id',
-  }),
-  checkAgentCreate,
-  async (req, res) => {
-    try {
-      const { agent_id, action_id } = req.params;
+router.delete('/:agent_id/:action_id', checkAgentCreate, async (req, res) => {
+  try {
+    const { agent_id, action_id } = req.params;
+    const admin = isAdmin(req);
 
-      // Permissions already validated by middleware - load agent directly
-      const agent = await getAgent({ id: agent_id });
-      if (!agent) {
-        return res.status(404).json({ message: 'Agent not found for deleting action' });
-      }
-
-      const { tools = [], actions = [] } = agent;
-
-      let domain = '';
-      const updatedActions = actions.filter((action) => {
-        if (action.includes(action_id)) {
-          [domain] = action.split(actionDelimiter);
-          return false;
-        }
-        return true;
-      });
-
-      domain = await domainParser(domain, true);
-
-      if (!domain) {
-        return res.status(400).json({ message: 'No domain provided' });
-      }
-
-      const updatedTools = tools.filter((tool) => !(tool && tool.includes(domain)));
-
-      // Force version update since actions are being removed
-      await updateAgent(
-        { id: agent_id },
-        { tools: updatedTools, actions: updatedActions },
-        { updatingUserId: req.user.id, forceVersion: true },
-      );
-      await deleteAction({ action_id });
-      res.status(200).json({ message: 'Action deleted successfully' });
-    } catch (error) {
-      const message = 'Trouble deleting the Agent Action';
-      logger.error(message, error);
-      res.status(500).json({ message });
+    // If admin, can delete any agent, otherwise only user's agents
+    const agentQuery = admin ? { id: agent_id } : { id: agent_id, author: req.user.id };
+    const agent = await getAgent(agentQuery);
+    if (!agent) {
+      return res.status(404).json({ message: 'Agent not found for deleting action' });
     }
-  },
-);
+
+    const { tools = [], actions = [] } = agent;
+
+    let domain = '';
+    const updatedActions = actions.filter((action) => {
+      if (action.includes(action_id)) {
+        [domain] = action.split(actionDelimiter);
+        return false;
+      }
+      return true;
+    });
+
+    domain = await domainParser(domain, true);
+
+    if (!domain) {
+      return res.status(400).json({ message: 'No domain provided' });
+    }
+
+    const updatedTools = tools.filter((tool) => !(tool && tool.includes(domain)));
+
+    // Force version update since actions are being removed
+    await updateAgent(
+      agentQuery,
+      { tools: updatedTools, actions: updatedActions },
+      { updatingUserId: req.user.id, forceVersion: true },
+    );
+    // If admin, can delete any action, otherwise only user's actions
+    const actionQuery = admin ? { action_id } : { action_id, user: req.user.id };
+    await deleteAction(actionQuery);
+    res.status(200).json({ message: 'Action deleted successfully' });
+  } catch (error) {
+    const message = 'Trouble deleting the Agent Action';
+    logger.error(message, error);
+    res.status(500).json({ message });
+  }
+});
 
 module.exports = router;

api/server/routes/agents/chat.js

@@ -1,5 +1,4 @@
 const express = require('express');
-const { PermissionBits } = require('@librechat/data-schemas');
 const { generateCheckAccess, skipAgentCheck } = require('@librechat/api');
 const { PermissionTypes, Permissions } = require('librechat-data-provider');
 const {
@@ -8,7 +7,6 @@ const {
   // validateModel,
   validateConvoAccess,
   buildEndpointOption,
-  canAccessAgentFromBody,
 } = require('~/server/middleware');
 const { initializeClient } = require('~/server/services/Endpoints/agents');
 const AgentController = require('~/server/controllers/agents/request');
@@ -25,12 +23,8 @@ const checkAgentAccess = generateCheckAccess({
   skipCheck: skipAgentCheck,
   getRoleByName,
 });
-const checkAgentResourceAccess = canAccessAgentFromBody({
-  requiredPermission: PermissionBits.VIEW,
-});
 
 router.use(checkAgentAccess);
-router.use(checkAgentResourceAccess);
 router.use(validateConvoAccess);
 router.use(buildEndpointOption);
 router.use(setHeaders);

api/server/routes/agents/index.js

@@ -37,6 +37,4 @@ if (isEnabled(LIMIT_MESSAGE_USER)) {
 chatRouter.use('/', chat);
 router.use('/chat', chatRouter);
 
-// Add marketplace routes
-
 module.exports = router;

api/server/routes/agents/v1.js

@@ -1,8 +1,7 @@
 const express = require('express');
 const { generateCheckAccess } = require('@librechat/api');
-const { PermissionBits } = require('@librechat/data-schemas');
 const { PermissionTypes, Permissions } = require('librechat-data-provider');
-const { requireJwtAuth, canAccessAgentResource } = require('~/server/middleware');
+const { requireJwtAuth } = require('~/server/middleware');
 const v1 = require('~/server/controllers/agents/v1');
 const { getRoleByName } = require('~/models/Role');
 const actions = require('./actions');
@@ -45,11 +44,6 @@ router.use('/actions', actions);
  */
 router.use('/tools', tools);
 
-/**
- * Get all agent categories with counts
- * @route GET /agents/marketplace/categories
- */
-router.get('/categories', v1.getAgentCategories);
 /**
  * Creates an agent.
  * @route POST /agents
@@ -59,38 +53,13 @@ router.get('/categories', v1.getAgentCategories);
 router.post('/', checkAgentCreate, v1.createAgent);
 
 /**
- * Retrieves basic agent information (VIEW permission required).
- * Returns safe, non-sensitive agent data for viewing purposes.
+ * Retrieves an agent.
  * @route GET /agents/:id
  * @param {string} req.params.id - Agent identifier.
- * @returns {Agent} 200 - Basic agent info - application/json
+ * @returns {Agent} 200 - Success response - application/json
  */
-router.get(
-  '/:id',
-  checkAgentAccess,
-  canAccessAgentResource({
-    requiredPermission: PermissionBits.VIEW,
-    resourceIdParam: 'id',
-  }),
-  v1.getAgent,
-);
+router.get('/:id', checkAgentAccess, v1.getAgent);
 
-/**
- * Retrieves full agent details including sensitive configuration (EDIT permission required).
- * Returns complete agent data for editing/configuration purposes.
- * @route GET /agents/:id/expanded
- * @param {string} req.params.id - Agent identifier.
- * @returns {Agent} 200 - Full agent details - application/json
- */
-router.get(
-  '/:id/expanded',
-  checkAgentAccess,
-  canAccessAgentResource({
-    requiredPermission: PermissionBits.EDIT,
-    resourceIdParam: 'id',
-  }),
-  (req, res) => v1.getAgent(req, res, true), // Expanded version
-);
 /**
  * Updates an agent.
  * @route PATCH /agents/:id
@@ -98,15 +67,7 @@ router.get(
  * @param {AgentUpdateParams} req.body - The agent update parameters.
  * @returns {Agent} 200 - Success response - application/json
  */
-router.patch(
-  '/:id',
-  checkGlobalAgentShare,
-  canAccessAgentResource({
-    requiredPermission: PermissionBits.EDIT,
-    resourceIdParam: 'id',
-  }),
-  v1.updateAgent,
-);
+router.patch('/:id', checkGlobalAgentShare, v1.updateAgent);
 
 /**
  * Duplicates an agent.
@@ -114,15 +75,7 @@ router.patch(
  * @param {string} req.params.id - Agent identifier.
  * @returns {Agent} 201 - Success response - application/json
  */
-router.post(
-  '/:id/duplicate',
-  checkAgentCreate,
-  canAccessAgentResource({
-    requiredPermission: PermissionBits.VIEW,
-    resourceIdParam: 'id',
-  }),
-  v1.duplicateAgent,
-);
+router.post('/:id/duplicate', checkAgentCreate, v1.duplicateAgent);
 
 /**
  * Deletes an agent.
@@ -130,15 +83,7 @@ router.post(
  * @param {string} req.params.id - Agent identifier.
  * @returns {Agent} 200 - success response - application/json
  */
-router.delete(
-  '/:id',
-  checkAgentCreate,
-  canAccessAgentResource({
-    requiredPermission: PermissionBits.DELETE,
-    resourceIdParam: 'id',
-  }),
-  v1.deleteAgent,
-);
+router.delete('/:id', checkAgentCreate, v1.deleteAgent);
 
 /**
  * Reverts an agent to a previous version.
@@ -165,14 +110,6 @@ router.get('/', checkAgentAccess, v1.getListAgents);
  * @param {string} [req.body.metadata] - Optional metadata for the agent's avatar.
  * @returns {Object} 200 - success response - application/json
  */
-avatar.post(
-  '/:agent_id/avatar/',
-  checkAgentAccess,
-  canAccessAgentResource({
-    requiredPermission: PermissionBits.EDIT,
-    resourceIdParam: 'agent_id',
-  }),
-  v1.uploadAgentAvatar,
-);
+avatar.post('/:agent_id/avatar/', checkAgentAccess, v1.uploadAgentAvatar);
 
 module.exports = { v1: router, avatar };

api/server/routes/convos.js

@@ -1,16 +1,17 @@
 const multer = require('multer');
 const express = require('express');
+const { sleep } = require('@librechat/agents');
+const { isEnabled } = require('@librechat/api');
+const { logger } = require('@librechat/data-schemas');
 const { CacheKeys, EModelEndpoint } = require('librechat-data-provider');
 const { getConvosByCursor, deleteConvos, getConvo, saveConvo } = require('~/models/Conversation');
 const { forkConversation, duplicateConversation } = require('~/server/utils/import/fork');
+const { createImportLimiters, createForkLimiters } = require('~/server/middleware');
 const { storage, importFileFilter } = require('~/server/routes/files/multer');
 const requireJwtAuth = require('~/server/middleware/requireJwtAuth');
 const { importConversations } = require('~/server/utils/import');
-const { createImportLimiters } = require('~/server/middleware');
 const { deleteToolCalls } = require('~/models/ToolCall');
-const { isEnabled, sleep } = require('~/server/utils');
 const getLogStores = require('~/cache/getLogStores');
-const { logger } = require('~/config');
 
 const assistantClients = {
   [EModelEndpoint.azureAssistants]: require('~/server/services/Endpoints/azureAssistants'),
@@ -43,6 +44,7 @@ router.get('/', async (req, res) => {
     });
     res.status(200).json(result);
   } catch (error) {
+    logger.error('Error fetching conversations', error);
     res.status(500).json({ error: 'Error fetching conversations' });
   }
 });
@@ -156,6 +158,7 @@ router.post('/update', async (req, res) => {
 });
 
 const { importIpLimiter, importUserLimiter } = createImportLimiters();
+const { forkIpLimiter, forkUserLimiter } = createForkLimiters();
 const upload = multer({ storage: storage, fileFilter: importFileFilter });
 
 /**
@@ -189,7 +192,7 @@ router.post(
  * @param {express.Response<TForkConvoResponse>} res - Express response object.
  * @returns {Promise<void>} - The response after forking the conversation.
  */
-router.post('/fork', async (req, res) => {
+router.post('/fork', forkIpLimiter, forkUserLimiter, async (req, res) => {
   try {
     /** @type {TForkConvoRequest} */
     const { conversationId, messageId, option, splitAtTarget, latestMessageId } = req.body;

api/server/routes/files/multer.spec.js

@@ -477,7 +477,9 @@ describe('Multer Configuration', () => {
         done(new Error('Expected mkdirSync to throw an error but no error was thrown'));
       } catch (error) {
         // This is the expected behavior - mkdirSync throws synchronously for invalid paths
-        expect(error.code).toBe('EACCES');
+        // On Linux, this typically returns EACCES (permission denied)
+        // On macOS/Darwin, this returns ENOENT (no such file or directory)
+        expect(['EACCES', 'ENOENT']).toContain(error.code);
         done();
       }
     });

api/server/routes/index.js

@@ -1,4 +1,3 @@
-const accessPermissions = require('./accessPermissions');
 const assistants = require('./assistants');
 const categories = require('./categories');
 const tokenizer = require('./tokenizer');
@@ -29,7 +28,6 @@ const user = require('./user');
 const mcp = require('./mcp');
 
 module.exports = {
-  mcp,
   edit,
   auth,
   keys,
@@ -57,5 +55,5 @@ module.exports = {
   assistants,
   categories,
   staticRoute,
-  accessPermissions,
+  mcp,
 };

api/server/routes/messages.js

@@ -235,12 +235,13 @@ router.put('/:conversationId/:messageId', validateMessageReq, async (req, res) =
       return res.status(400).json({ error: 'Content part not found' });
     }
 
-    if (updatedContent[index].type !== ContentTypes.TEXT) {
+    const currentPartType = updatedContent[index].type;
+    if (currentPartType !== ContentTypes.TEXT && currentPartType !== ContentTypes.THINK) {
       return res.status(400).json({ error: 'Cannot update non-text content' });
     }
 
-    const oldText = updatedContent[index].text;
-    updatedContent[index] = { type: ContentTypes.TEXT, text };
+    const oldText = updatedContent[index][currentPartType];
+    updatedContent[index] = { type: currentPartType, [currentPartType]: text };
 
     let tokenCount = message.tokenCount;
     if (tokenCount !== undefined) {

api/server/routes/oauth.js

@@ -9,7 +9,6 @@ const {
   setBalanceConfig,
   checkDomainAllowed,
 } = require('~/server/middleware');
-const { syncUserEntraGroupMemberships } = require('~/server/services/PermissionService');
 const { setAuthTokens, setOpenIDAuthTokens } = require('~/server/services/AuthService');
 const { isEnabled } = require('~/server/utils');
 const { logger } = require('~/config');
@@ -36,7 +35,6 @@ const oauthHandler = async (req, res) => {
       req.user.provider == 'openid' &&
       isEnabled(process.env.OPENID_REUSE_TOKENS) === true
     ) {
-      await syncUserEntraGroupMemberships(req.user, req.user.tokenset.access_token);
       setOpenIDAuthTokens(req.user.tokenset, res);
     } else {
       await setAuthTokens(req.user._id, res);

api/server/services/AppService.interface.spec.js

@@ -1,7 +1,5 @@
 jest.mock('~/models', () => ({
   initializeRoles: jest.fn(),
-  seedDefaultRoles: jest.fn(),
-  ensureDefaultCategories: jest.fn(),
 }));
 jest.mock('~/models/Role', () => ({
   updateAccessPermissions: jest.fn(),

api/server/services/AppService.js

@@ -17,7 +17,6 @@ const {
 const { azureAssistantsDefaults, assistantsConfigSetup } = require('./start/assistants');
 const { initializeAzureBlobService } = require('./Files/Azure/initialize');
 const { initializeFirebase } = require('./Files/Firebase/initialize');
-const { seedDefaultRoles, initializeRoles, ensureDefaultCategories } = require('~/models');
 const loadCustomConfig = require('./Config/loadCustomConfig');
 const handleRateLimits = require('./Config/handleRateLimits');
 const { loadDefaultInterface } = require('./start/interface');
@@ -27,6 +26,7 @@ const { processModelSpecs } = require('./start/modelSpecs');
 const { initializeS3 } = require('./Files/S3/initialize');
 const { loadAndFormatTools } = require('./ToolService');
 const { isEnabled } = require('~/server/utils');
+const { initializeRoles } = require('~/models');
 const { setCachedTools } = require('./Config');
 const paths = require('~/config/paths');
 
@@ -37,8 +37,6 @@ const paths = require('~/config/paths');
  */
 const AppService = async (app) => {
   await initializeRoles();
-  await seedDefaultRoles();
-  await ensureDefaultCategories();
   /** @type {TCustomConfig} */
   const config = (await loadCustomConfig()) ?? {};
   const configDefaults = getConfigDefaults();

api/server/services/AppService.spec.js

@@ -28,8 +28,6 @@ jest.mock('./Files/Firebase/initialize', () => ({
 }));
 jest.mock('~/models', () => ({
   initializeRoles: jest.fn(),
-  seedDefaultRoles: jest.fn(),
-  ensureDefaultCategories: jest.fn(),
 }));
 jest.mock('~/models/Role', () => ({
   updateAccessPermissions: jest.fn(),
@@ -154,12 +152,14 @@ describe('AppService', () => {
       filteredTools: undefined,
       includedTools: undefined,
       webSearch: {
+        safeSearch: 1,
+        jinaApiKey: '${JINA_API_KEY}',
         cohereApiKey: '${COHERE_API_KEY}',
+        serperApiKey: '${SERPER_API_KEY}',
+        searxngApiKey: '${SEARXNG_API_KEY}',
         firecrawlApiKey: '${FIRECRAWL_API_KEY}',
         firecrawlApiUrl: '${FIRECRAWL_API_URL}',
-        jinaApiKey: '${JINA_API_KEY}',
-        safeSearch: 1,
-        serperApiKey: '${SERPER_API_KEY}',
+        searxngInstanceUrl: '${SEARXNG_INSTANCE_URL}',
       },
       memory: undefined,
       agents: {

api/server/services/Config/getEndpointsConfig.js

@@ -1,4 +1,10 @@
-const { CacheKeys, EModelEndpoint, orderEndpointsConfig } = require('librechat-data-provider');
+const {
+  CacheKeys,
+  EModelEndpoint,
+  isAgentsEndpoint,
+  orderEndpointsConfig,
+  defaultAgentCapabilities,
+} = require('librechat-data-provider');
 const loadDefaultEndpointsConfig = require('./loadDefaultEConfig');
 const loadConfigEndpoints = require('./loadConfigEndpoints');
 const getLogStores = require('~/cache/getLogStores');
@@ -80,8 +86,12 @@ async function getEndpointsConfig(req) {
  * @returns {Promise<boolean>}
  */
 const checkCapability = async (req, capability) => {
+  const isAgents = isAgentsEndpoint(req.body?.original_endpoint || req.body?.endpoint);
   const endpointsConfig = await getEndpointsConfig(req);
-  const capabilities = endpointsConfig?.[EModelEndpoint.agents]?.capabilities ?? [];
+  const capabilities =
+    isAgents || endpointsConfig?.[EModelEndpoint.agents]?.capabilities != null
+      ? (endpointsConfig?.[EModelEndpoint.agents]?.capabilities ?? [])
+      : defaultAgentCapabilities;
   return capabilities.includes(capability);
 };
 

api/server/services/Config/loadAsyncEndpoints.js

@@ -1,5 +1,7 @@
+const path = require('path');
+const { logger } = require('@librechat/data-schemas');
+const { loadServiceKey, isUserProvided } = require('@librechat/api');
 const { EModelEndpoint } = require('librechat-data-provider');
-const { isUserProvided } = require('~/server/utils');
 const { config } = require('./EndpointService');
 
 const { openAIApiKey, azureOpenAIApiKey, useAzurePlugins, userProvidedOpenAI, googleKey } = config;
@@ -9,37 +11,42 @@ const { openAIApiKey, azureOpenAIApiKey, useAzurePlugins, userProvidedOpenAI, go
  * @param {Express.Request} req - The request object
  */
 async function loadAsyncEndpoints(req) {
-  let i = 0;
   let serviceKey, googleUserProvides;
-  try {
-    serviceKey = require('~/data/auth.json');
-  } catch (e) {
-    if (i === 0) {
-      i++;
+
+  /** Check if GOOGLE_KEY is provided at all(including 'user_provided') */
+  const isGoogleKeyProvided = googleKey && googleKey.trim() !== '';
+
+  if (isGoogleKeyProvided) {
+    /** If GOOGLE_KEY is provided, check if it's user_provided */
+    googleUserProvides = isUserProvided(googleKey);
+  } else {
+    /** Only attempt to load service key if GOOGLE_KEY is not provided */
+    const serviceKeyPath =
+      process.env.GOOGLE_SERVICE_KEY_FILE_PATH ||
+      path.join(__dirname, '../../..', 'data', 'auth.json');
+
+    try {
+      serviceKey = await loadServiceKey(serviceKeyPath);
+    } catch (error) {
+      logger.error('Error loading service key', error);
+      serviceKey = null;
     }
   }
 
-  if (isUserProvided(googleKey)) {
-    googleUserProvides = true;
-    if (i <= 1) {
-      i++;
-    }
-  }
-
-  const google = serviceKey || googleKey ? { userProvide: googleUserProvides } : false;
+  const google = serviceKey || isGoogleKeyProvided ? { userProvide: googleUserProvides } : false;
 
   const useAzure = req.app.locals[EModelEndpoint.azureOpenAI]?.plugins;
   const gptPlugins =
     useAzure || openAIApiKey || azureOpenAIApiKey
       ? {
-        availableAgents: ['classic', 'functions'],
-        userProvide: useAzure ? false : userProvidedOpenAI,
-        userProvideURL: useAzure
-          ? false
-          : config[EModelEndpoint.openAI]?.userProvideURL ||
+          availableAgents: ['classic', 'functions'],
+          userProvide: useAzure ? false : userProvidedOpenAI,
+          userProvideURL: useAzure
+            ? false
+            : config[EModelEndpoint.openAI]?.userProvideURL ||
               config[EModelEndpoint.azureOpenAI]?.userProvideURL,
-        azure: useAzurePlugins || useAzure,
-      }
+          azure: useAzurePlugins || useAzure,
+        }
       : false;
 
   return { google, gptPlugins };

api/server/services/Endpoints/agents/agent.js

@@ -85,7 +85,7 @@ const initializeAgent = async ({
   });
 
   const provider = agent.provider;
-  const { tools, toolContextMap } =
+  const { tools: structuredTools, toolContextMap } =
     (await loadTools?.({
       req,
       res,
@@ -140,6 +140,24 @@ const initializeAgent = async ({
     agent.provider = options.provider;
   }
 
+  /** @type {import('@librechat/agents').GenericTool[]} */
+  let tools = options.tools?.length ? options.tools : structuredTools;
+  if (
+    (agent.provider === Providers.GOOGLE || agent.provider === Providers.VERTEXAI) &&
+    options.tools?.length &&
+    structuredTools?.length
+  ) {
+    throw new Error(`{ "type": "${ErrorTypes.GOOGLE_TOOL_CONFLICT}"}`);
+  } else if (
+    (agent.provider === Providers.OPENAI ||
+      agent.provider === Providers.AZURE ||
+      agent.provider === Providers.ANTHROPIC) &&
+    options.tools?.length &&
+    structuredTools?.length
+  ) {
+    tools = structuredTools.concat(options.tools);
+  }
+
   /** @type {import('@librechat/agents').ClientOptions} */
   agent.model_parameters = { ...options.llmConfig };
   if (options.configOptions) {
@@ -162,10 +180,10 @@ const initializeAgent = async ({
 
   return {
     ...agent,
-    tools,
     attachments,
     resendFiles,
     toolContextMap,
+    tools,
     maxContextTokens: (agentMaxContextTokens - maxTokens) * 0.9,
   };
 };

api/server/services/Endpoints/anthropic/llm.js

@@ -78,7 +78,17 @@ function getLLMConfig(apiKey, options = {}) {
     requestOptions.anthropicApiUrl = options.reverseProxyUrl;
   }
 
+  const tools = [];
+
+  if (mergedOptions.web_search) {
+    tools.push({
+      type: 'web_search_20250305',
+      name: 'web_search',
+    });
+  }
+
   return {
+    tools,
     /** @type {AnthropicClientOptions} */
     llmConfig: removeNullishValues(requestOptions),
   };

api/server/services/Endpoints/google/initialize.js

@@ -1,5 +1,6 @@
-const { getGoogleConfig, isEnabled } = require('@librechat/api');
+const path = require('path');
 const { EModelEndpoint, AuthKeys } = require('librechat-data-provider');
+const { getGoogleConfig, isEnabled, loadServiceKey } = require('@librechat/api');
 const { getUserKey, checkUserKeyExpiry } = require('~/server/services/UserService');
 const { GoogleClient } = require('~/app');
 
@@ -15,10 +16,25 @@ const initializeClient = async ({ req, res, endpointOption, overrideModel, optio
   }
 
   let serviceKey = {};
-  try {
-    serviceKey = require('~/data/auth.json');
-  } catch (_e) {
-    // Do nothing
+
+  /** Check if GOOGLE_KEY is provided at all (including 'user_provided') */
+  const isGoogleKeyProvided =
+    (GOOGLE_KEY && GOOGLE_KEY.trim() !== '') || (isUserProvided && userKey != null);
+
+  if (!isGoogleKeyProvided) {
+    /** Only attempt to load service key if GOOGLE_KEY is not provided */
+    try {
+      const serviceKeyPath =
+        process.env.GOOGLE_SERVICE_KEY_FILE_PATH ||
+        path.join(__dirname, '../../../..', 'data', 'auth.json');
+      serviceKey = await loadServiceKey(serviceKeyPath);
+      if (!serviceKey) {
+        serviceKey = {};
+      }
+    } catch (_e) {
+      // Service key loading failed, but that's okay if not required
+      serviceKey = {};
+    }
   }
 
   const credentials = isUserProvided

api/server/services/Endpoints/index.js

@@ -7,6 +7,16 @@ const initCustom = require('~/server/services/Endpoints/custom/initialize');
 const initGoogle = require('~/server/services/Endpoints/google/initialize');
 const { getCustomEndpointConfig } = require('~/server/services/Config');
 
+/** Check if the provider is a known custom provider
+ * @param {string | undefined} [provider] - The provider string
+ * @returns {boolean} - True if the provider is a known custom provider, false otherwise
+ */
+function isKnownCustomProvider(provider) {
+  return [Providers.XAI, Providers.OLLAMA, Providers.DEEPSEEK, Providers.OPENROUTER].includes(
+    provider?.toLowerCase() || '',
+  );
+}
+
 const providerConfigMap = {
   [Providers.XAI]: initCustom,
   [Providers.OLLAMA]: initCustom,
@@ -46,6 +56,13 @@ async function getProviderConfig(provider) {
     overrideProvider = Providers.OPENAI;
   }
 
+  if (isKnownCustomProvider(overrideProvider || provider) && !customEndpointConfig) {
+    customEndpointConfig = await getCustomEndpointConfig(provider);
+    if (!customEndpointConfig) {
+      throw new Error(`Provider ${provider} not supported`);
+    }
+  }
+
   return {
     getOptions,
     overrideProvider,

api/server/services/Files/strategies.js

@@ -1,5 +1,9 @@
 const { FileSources } = require('librechat-data-provider');
-const { uploadMistralOCR, uploadAzureMistralOCR } = require('@librechat/api');
+const {
+  uploadMistralOCR,
+  uploadAzureMistralOCR,
+  uploadGoogleVertexMistralOCR,
+} = require('@librechat/api');
 const {
   getFirebaseURL,
   prepareImageURL,
@@ -222,6 +226,26 @@ const azureMistralOCRStrategy = () => ({
   handleFileUpload: uploadAzureMistralOCR,
 });
 
+const vertexMistralOCRStrategy = () => ({
+  /** @type {typeof saveFileFromURL | null} */
+  saveURL: null,
+  /** @type {typeof getLocalFileURL | null} */
+  getFileURL: null,
+  /** @type {typeof saveLocalBuffer | null} */
+  saveBuffer: null,
+  /** @type {typeof processLocalAvatar | null} */
+  processAvatar: null,
+  /** @type {typeof uploadLocalImage | null} */
+  handleImageUpload: null,
+  /** @type {typeof prepareImagesLocal | null} */
+  prepareImagePayload: null,
+  /** @type {typeof deleteLocalFile | null} */
+  deleteFile: null,
+  /** @type {typeof getLocalFileStream | null} */
+  getDownloadStream: null,
+  handleFileUpload: uploadGoogleVertexMistralOCR,
+});
+
 // Strategy Selector
 const getStrategyFunctions = (fileSource) => {
   if (fileSource === FileSources.firebase) {
@@ -244,6 +268,8 @@ const getStrategyFunctions = (fileSource) => {
     return mistralOCRStrategy();
   } else if (fileSource === FileSources.azure_mistral_ocr) {
     return azureMistralOCRStrategy();
+  } else if (fileSource === FileSources.vertexai_mistral_ocr) {
+    return vertexMistralOCRStrategy();
   } else {
     throw new Error('Invalid file source');
   }

api/server/services/GraphApiService.js

@@ -1,525 +0,0 @@
-const client = require('openid-client');
-const { isEnabled } = require('@librechat/api');
-const { logger } = require('@librechat/data-schemas');
-const { CacheKeys } = require('librechat-data-provider');
-const { Client } = require('@microsoft/microsoft-graph-client');
-const { getOpenIdConfig } = require('~/strategies/openidStrategy');
-const getLogStores = require('~/cache/getLogStores');
-
-/**
- * @import { TPrincipalSearchResult, TGraphPerson, TGraphUser, TGraphGroup, TGraphPeopleResponse, TGraphUsersResponse, TGraphGroupsResponse } from 'librechat-data-provider'
- */
-
-/**
- * Checks if Entra ID principal search feature is enabled based on environment variables and user authentication
- * @param {Object} user - User object from request
- * @param {string} user.provider - Authentication provider
- * @param {string} user.openidId - OpenID subject identifier
- * @returns {boolean} True if Entra ID principal search is enabled and user is authenticated via OpenID
- */
-const entraIdPrincipalFeatureEnabled = (user) => {
-  return (
-    isEnabled(process.env.USE_ENTRA_ID_FOR_PEOPLE_SEARCH) &&
-    isEnabled(process.env.OPENID_REUSE_TOKENS) &&
-    user?.provider === 'openid' &&
-    user?.openidId
-  );
-};
-
-/**
- * Creates a Microsoft Graph client with on-behalf-of token exchange
- * @param {string} accessToken - OpenID Connect access token from user
- * @param {string} sub - Subject identifier from token claims
- * @returns {Promise<Client>} Authenticated Graph API client
- */
-const createGraphClient = async (accessToken, sub) => {
-  try {
-    // Reason: Use existing OpenID configuration and token exchange pattern from openidStrategy.js
-    const openidConfig = getOpenIdConfig();
-    const exchangedToken = await exchangeTokenForGraphAccess(openidConfig, accessToken, sub);
-
-    const graphClient = Client.init({
-      authProvider: (done) => {
-        done(null, exchangedToken);
-      },
-    });
-
-    return graphClient;
-  } catch (error) {
-    logger.error('[createGraphClient] Error creating Graph client:', error);
-    throw error;
-  }
-};
-
-/**
- * Exchange OpenID token for Graph API access using on-behalf-of flow
- * Similar to exchangeAccessTokenIfNeeded in openidStrategy.js but for Graph scopes
- * @param {Configuration} config - OpenID configuration
- * @param {string} accessToken - Original access token
- * @param {string} sub - Subject identifier
- * @returns {Promise<string>} Graph API access token
- */
-const exchangeTokenForGraphAccess = async (config, accessToken, sub) => {
-  try {
-    const tokensCache = getLogStores(CacheKeys.OPENID_EXCHANGED_TOKENS);
-    const cacheKey = `${sub}:graph`;
-
-    const cachedToken = await tokensCache.get(cacheKey);
-    if (cachedToken) {
-      return cachedToken.access_token;
-    }
-
-    const graphScopes = process.env.OPENID_GRAPH_SCOPES || 'User.Read,People.Read,Group.Read.All';
-    const scopeString = graphScopes
-      .split(',')
-      .map((scope) => `https://graph.microsoft.com/${scope}`)
-      .join(' ');
-
-    const grantResponse = await client.genericGrantRequest(
-      config,
-      'urn:ietf:params:oauth:grant-type:jwt-bearer',
-      {
-        scope: scopeString,
-        assertion: accessToken,
-        requested_token_use: 'on_behalf_of',
-      },
-    );
-
-    await tokensCache.set(
-      cacheKey,
-      {
-        access_token: grantResponse.access_token,
-      },
-      grantResponse.expires_in * 1000,
-    );
-
-    return grantResponse.access_token;
-  } catch (error) {
-    logger.error('[exchangeTokenForGraphAccess] Token exchange failed:', error);
-    throw error;
-  }
-};
-
-/**
- * Search for principals (people and groups) using Microsoft Graph API
- * Uses searchContacts first, then searchUsers and searchGroups to fill remaining slots
- * @param {string} accessToken - OpenID Connect access token
- * @param {string} sub - Subject identifier
- * @param {string} query - Search query string
- * @param {string} type - Type filter ('users', 'groups', or 'all')
- * @param {number} limit - Maximum number of results
- * @returns {Promise<TPrincipalSearchResult[]>} Array of principal search results
- */
-const searchEntraIdPrincipals = async (accessToken, sub, query, type = 'all', limit = 10) => {
-  try {
-    if (!query || query.trim().length < 2) {
-      return [];
-    }
-    const graphClient = await createGraphClient(accessToken, sub);
-    let allResults = [];
-
-    if (type === 'users' || type === 'all') {
-      const contactResults = await searchContacts(graphClient, query, limit);
-      allResults.push(...contactResults);
-    }
-    if (allResults.length >= limit) {
-      return allResults.slice(0, limit);
-    }
-
-    if (type === 'users') {
-      const userResults = await searchUsers(graphClient, query, limit);
-      allResults.push(...userResults);
-    } else if (type === 'groups') {
-      const groupResults = await searchGroups(graphClient, query, limit);
-      allResults.push(...groupResults);
-    } else if (type === 'all') {
-      const [userResults, groupResults] = await Promise.all([
-        searchUsers(graphClient, query, limit),
-        searchGroups(graphClient, query, limit),
-      ]);
-
-      allResults.push(...userResults, ...groupResults);
-    }
-
-    const seenIds = new Set();
-    const uniqueResults = allResults.filter((result) => {
-      if (seenIds.has(result.idOnTheSource)) {
-        return false;
-      }
-      seenIds.add(result.idOnTheSource);
-      return true;
-    });
-
-    return uniqueResults.slice(0, limit);
-  } catch (error) {
-    logger.error('[searchEntraIdPrincipals] Error searching principals:', error);
-    return [];
-  }
-};
-
-/**
- * Get current user's Entra ID group memberships from Microsoft Graph
- * Uses /me/memberOf endpoint to get groups the user is a member of
- * @param {string} accessToken - OpenID Connect access token
- * @param {string} sub - Subject identifier
- * @returns {Promise<Array<string>>} Array of group ID strings (GUIDs)
- */
-const getUserEntraGroups = async (accessToken, sub) => {
-  try {
-    const graphClient = await createGraphClient(accessToken, sub);
-
-    const groupsResponse = await graphClient.api('/me/memberOf').select('id').get();
-
-    return (groupsResponse.value || []).map((group) => group.id);
-  } catch (error) {
-    logger.error('[getUserEntraGroups] Error fetching user groups:', error);
-    return [];
-  }
-};
-
-/**
- * Get current user's owned Entra ID groups from Microsoft Graph
- * Uses /me/ownedObjects/microsoft.graph.group endpoint to get groups the user owns
- * @param {string} accessToken - OpenID Connect access token
- * @param {string} sub - Subject identifier
- * @returns {Promise<Array<string>>} Array of group ID strings (GUIDs)
- */
-const getUserOwnedEntraGroups = async (accessToken, sub) => {
-  try {
-    const graphClient = await createGraphClient(accessToken, sub);
-
-    const groupsResponse = await graphClient
-      .api('/me/ownedObjects/microsoft.graph.group')
-      .select('id')
-      .get();
-
-    return (groupsResponse.value || []).map((group) => group.id);
-  } catch (error) {
-    logger.error('[getUserOwnedEntraGroups] Error fetching user owned groups:', error);
-    return [];
-  }
-};
-
-/**
- * Get group members from Microsoft Graph API
- * Recursively fetches all members using pagination (@odata.nextLink)
- * @param {string} accessToken - OpenID Connect access token
- * @param {string} sub - Subject identifier
- * @param {string} groupId - Entra ID group object ID
- * @returns {Promise<Array>} Array of member IDs (idOnTheSource values)
- */
-const getGroupMembers = async (accessToken, sub, groupId) => {
-  try {
-    const graphClient = await createGraphClient(accessToken, sub);
-    const allMembers = [];
-    let nextLink = `/groups/${groupId}/members`;
-
-    while (nextLink) {
-      const membersResponse = await graphClient.api(nextLink).select('id').top(999).get();
-
-      const members = membersResponse.value || [];
-      allMembers.push(...members.map((member) => member.id));
-
-      nextLink = membersResponse['@odata.nextLink']
-        ? membersResponse['@odata.nextLink'].split('/v1.0')[1]
-        : null;
-    }
-
-    return allMembers;
-  } catch (error) {
-    logger.error('[getGroupMembers] Error fetching group members:', error);
-    return [];
-  }
-};
-/**
- * Get group owners from Microsoft Graph API
- * Recursively fetches all owners using pagination (@odata.nextLink)
- * @param {string} accessToken - OpenID Connect access token
- * @param {string} sub - Subject identifier
- * @param {string} groupId - Entra ID group object ID
- * @returns {Promise<Array>} Array of owner IDs (idOnTheSource values)
- */
-const getGroupOwners = async (accessToken, sub, groupId) => {
-  try {
-    const graphClient = await createGraphClient(accessToken, sub);
-    const allOwners = [];
-    let nextLink = `/groups/${groupId}/owners`;
-
-    while (nextLink) {
-      const ownersResponse = await graphClient.api(nextLink).select('id').top(999).get();
-
-      const owners = ownersResponse.value || [];
-      allOwners.push(...owners.map((member) => member.id));
-
-      nextLink = ownersResponse['@odata.nextLink']
-        ? ownersResponse['@odata.nextLink'].split('/v1.0')[1]
-        : null;
-    }
-
-    return allOwners;
-  } catch (error) {
-    logger.error('[getGroupOwners] Error fetching group owners:', error);
-    return [];
-  }
-};
-/**
- * Search for contacts (users only) using Microsoft Graph /me/people endpoint
- * Returns mapped TPrincipalSearchResult objects for users only
- * @param {Client} graphClient - Authenticated Microsoft Graph client
- * @param {string} query - Search query string
- * @param {number} limit - Maximum number of results (default: 10)
- * @returns {Promise<TPrincipalSearchResult[]>} Array of mapped user contact results
- */
-const searchContacts = async (graphClient, query, limit = 10) => {
-  try {
-    if (!query || query.trim().length < 2) {
-      return [];
-    }
-    if (
-      process.env.OPENID_GRAPH_SCOPES &&
-      !process.env.OPENID_GRAPH_SCOPES.toLowerCase().includes('people.read')
-    ) {
-      logger.warn('[searchContacts] People.Read scope is not enabled, skipping contact search');
-      return [];
-    }
-    // Reason: Search only for OrganizationUser (person) type, not groups
-    const filter = "personType/subclass eq 'OrganizationUser'";
-
-    let apiCall = graphClient
-      .api('/me/people')
-      .search(`"${query}"`)
-      .select(
-        'id,displayName,givenName,surname,userPrincipalName,jobTitle,department,companyName,scoredEmailAddresses,personType,phones',
-      )
-      .header('ConsistencyLevel', 'eventual')
-      .filter(filter)
-      .top(limit);
-
-    const contactsResponse = await apiCall.get();
-    return (contactsResponse.value || []).map(mapContactToTPrincipalSearchResult);
-  } catch (error) {
-    logger.error('[searchContacts] Error searching contacts:', error);
-    return [];
-  }
-};
-
-/**
- * Search for users using Microsoft Graph /users endpoint
- * Returns mapped TPrincipalSearchResult objects
- * @param {Client} graphClient - Authenticated Microsoft Graph client
- * @param {string} query - Search query string
- * @param {number} limit - Maximum number of results (default: 10)
- * @returns {Promise<TPrincipalSearchResult[]>} Array of mapped user results
- */
-const searchUsers = async (graphClient, query, limit = 10) => {
-  try {
-    if (!query || query.trim().length < 2) {
-      return [];
-    }
-
-    // Reason: Search users by display name, email, and user principal name
-    const usersResponse = await graphClient
-      .api('/users')
-      .search(
-        `"displayName:${query}" OR "userPrincipalName:${query}" OR "mail:${query}" OR "givenName:${query}" OR "surname:${query}"`,
-      )
-      .select(
-        'id,displayName,givenName,surname,userPrincipalName,jobTitle,department,companyName,mail,phones',
-      )
-      .header('ConsistencyLevel', 'eventual')
-      .top(limit)
-      .get();
-
-    return (usersResponse.value || []).map(mapUserToTPrincipalSearchResult);
-  } catch (error) {
-    logger.error('[searchUsers] Error searching users:', error);
-    return [];
-  }
-};
-
-/**
- * Search for groups using Microsoft Graph /groups endpoint
- * Returns mapped TPrincipalSearchResult objects, includes all group types
- * @param {Client} graphClient - Authenticated Microsoft Graph client
- * @param {string} query - Search query string
- * @param {number} limit - Maximum number of results (default: 10)
- * @returns {Promise<TPrincipalSearchResult[]>} Array of mapped group results
- */
-const searchGroups = async (graphClient, query, limit = 10) => {
-  try {
-    if (!query || query.trim().length < 2) {
-      return [];
-    }
-
-    // Reason: Search all groups by display name and email without filtering group types
-    const groupsResponse = await graphClient
-      .api('/groups')
-      .search(`"displayName:${query}" OR "mail:${query}" OR "mailNickname:${query}"`)
-      .select('id,displayName,mail,mailNickname,description,groupTypes,resourceProvisioningOptions')
-      .header('ConsistencyLevel', 'eventual')
-      .top(limit)
-      .get();
-
-    return (groupsResponse.value || []).map(mapGroupToTPrincipalSearchResult);
-  } catch (error) {
-    logger.error('[searchGroups] Error searching groups:', error);
-    return [];
-  }
-};
-
-/**
- * Test Graph API connectivity and permissions
- * @param {string} accessToken - OpenID Connect access token
- * @param {string} sub - Subject identifier
- * @returns {Promise<Object>} Test results with available permissions
- */
-const testGraphApiAccess = async (accessToken, sub) => {
-  try {
-    const graphClient = await createGraphClient(accessToken, sub);
-    const results = {
-      userAccess: false,
-      peopleAccess: false,
-      groupsAccess: false,
-      usersEndpointAccess: false,
-      groupsEndpointAccess: false,
-      errors: [],
-    };
-
-    // Test User.Read permission
-    try {
-      await graphClient.api('/me').select('id,displayName').get();
-      results.userAccess = true;
-    } catch (error) {
-      results.errors.push(`User.Read: ${error.message}`);
-    }
-
-    // Test People.Read permission with OrganizationUser filter
-    try {
-      await graphClient
-        .api('/me/people')
-        .filter("personType/subclass eq 'OrganizationUser'")
-        .top(1)
-        .get();
-      results.peopleAccess = true;
-    } catch (error) {
-      results.errors.push(`People.Read (OrganizationUser): ${error.message}`);
-    }
-
-    // Test People.Read permission with UnifiedGroup filter
-    try {
-      await graphClient
-        .api('/me/people')
-        .filter("personType/subclass eq 'UnifiedGroup'")
-        .top(1)
-        .get();
-      results.groupsAccess = true;
-    } catch (error) {
-      results.errors.push(`People.Read (UnifiedGroup): ${error.message}`);
-    }
-
-    // Test /users endpoint access (requires User.Read.All or similar)
-    try {
-      await graphClient
-        .api('/users')
-        .search('"displayName:test"')
-        .select('id,displayName,userPrincipalName')
-        .top(1)
-        .get();
-      results.usersEndpointAccess = true;
-    } catch (error) {
-      results.errors.push(`Users endpoint: ${error.message}`);
-    }
-
-    // Test /groups endpoint access (requires Group.Read.All or similar)
-    try {
-      await graphClient
-        .api('/groups')
-        .search('"displayName:test"')
-        .select('id,displayName,mail')
-        .top(1)
-        .get();
-      results.groupsEndpointAccess = true;
-    } catch (error) {
-      results.errors.push(`Groups endpoint: ${error.message}`);
-    }
-
-    return results;
-  } catch (error) {
-    logger.error('[testGraphApiAccess] Error testing Graph API access:', error);
-    return {
-      userAccess: false,
-      peopleAccess: false,
-      groupsAccess: false,
-      usersEndpointAccess: false,
-      groupsEndpointAccess: false,
-      errors: [error.message],
-    };
-  }
-};
-
-/**
- * Map Graph API user object to TPrincipalSearchResult format
- * @param {TGraphUser} user - Raw user object from Graph API
- * @returns {TPrincipalSearchResult} Mapped user result
- */
-const mapUserToTPrincipalSearchResult = (user) => {
-  return {
-    id: null,
-    type: 'user',
-    name: user.displayName,
-    email: user.mail || user.userPrincipalName,
-    username: user.userPrincipalName,
-    source: 'entra',
-    idOnTheSource: user.id,
-  };
-};
-
-/**
- * Map Graph API group object to TPrincipalSearchResult format
- * @param {TGraphGroup} group - Raw group object from Graph API
- * @returns {TPrincipalSearchResult} Mapped group result
- */
-const mapGroupToTPrincipalSearchResult = (group) => {
-  return {
-    id: null,
-    type: 'group',
-    name: group.displayName,
-    email: group.mail || group.userPrincipalName,
-    description: group.description,
-    source: 'entra',
-    idOnTheSource: group.id,
-  };
-};
-
-/**
- * Map Graph API /me/people contact object to TPrincipalSearchResult format
- * Handles both user and group contacts from the people endpoint
- * @param {TGraphPerson} contact - Raw contact object from Graph API /me/people
- * @returns {TPrincipalSearchResult} Mapped contact result
- */
-const mapContactToTPrincipalSearchResult = (contact) => {
-  const isGroup = contact.personType?.class === 'Group';
-  const primaryEmail = contact.scoredEmailAddresses?.[0]?.address;
-
-  return {
-    id: null,
-    type: isGroup ? 'group' : 'user',
-    name: contact.displayName,
-    email: primaryEmail,
-    username: !isGroup ? contact.userPrincipalName : undefined,
-    source: 'entra',
-    idOnTheSource: contact.id,
-  };
-};
-
-module.exports = {
-  getGroupMembers,
-  getGroupOwners,
-  createGraphClient,
-  getUserEntraGroups,
-  getUserOwnedEntraGroups,
-  testGraphApiAccess,
-  searchEntraIdPrincipals,
-  exchangeTokenForGraphAccess,
-  entraIdPrincipalFeatureEnabled,
-};

api/server/services/GraphApiService.spec.js

@@ -1,720 +0,0 @@
-jest.mock('@microsoft/microsoft-graph-client');
-jest.mock('~/strategies/openidStrategy');
-jest.mock('~/cache/getLogStores');
-jest.mock('@librechat/data-schemas', () => ({
-  ...jest.requireActual('@librechat/data-schemas'),
-  logger: {
-    error: jest.fn(),
-    debug: jest.fn(),
-  },
-}));
-jest.mock('~/config', () => ({
-  logger: {
-    error: jest.fn(),
-    debug: jest.fn(),
-  },
-  createAxiosInstance: jest.fn(() => ({
-    create: jest.fn(),
-    defaults: {},
-  })),
-}));
-jest.mock('~/utils', () => ({
-  logAxiosError: jest.fn(),
-}));
-
-jest.mock('~/server/services/Config', () => ({}));
-jest.mock('~/server/services/Files/strategies', () => ({
-  getStrategyFunctions: jest.fn(),
-}));
-
-const mongoose = require('mongoose');
-const client = require('openid-client');
-const { MongoMemoryServer } = require('mongodb-memory-server');
-const { Client } = require('@microsoft/microsoft-graph-client');
-const { getOpenIdConfig } = require('~/strategies/openidStrategy');
-const getLogStores = require('~/cache/getLogStores');
-const GraphApiService = require('./GraphApiService');
-
-describe('GraphApiService', () => {
-  let mongoServer;
-  let mockGraphClient;
-  let mockTokensCache;
-  let mockOpenIdConfig;
-
-  beforeAll(async () => {
-    mongoServer = await MongoMemoryServer.create();
-    const mongoUri = mongoServer.getUri();
-    await mongoose.connect(mongoUri);
-  });
-
-  afterAll(async () => {
-    await mongoose.disconnect();
-    await mongoServer.stop();
-  });
-
-  afterEach(() => {
-    // Clean up environment variables
-    delete process.env.OPENID_GRAPH_SCOPES;
-  });
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    await mongoose.connection.dropDatabase();
-
-    // Set up environment variable for People.Read scope
-    process.env.OPENID_GRAPH_SCOPES = 'User.Read,People.Read,Group.Read.All';
-
-    // Mock Graph client
-    mockGraphClient = {
-      api: jest.fn().mockReturnThis(),
-      search: jest.fn().mockReturnThis(),
-      filter: jest.fn().mockReturnThis(),
-      select: jest.fn().mockReturnThis(),
-      header: jest.fn().mockReturnThis(),
-      top: jest.fn().mockReturnThis(),
-      get: jest.fn(),
-    };
-
-    Client.init.mockReturnValue(mockGraphClient);
-
-    // Mock tokens cache
-    mockTokensCache = {
-      get: jest.fn(),
-      set: jest.fn(),
-    };
-    getLogStores.mockReturnValue(mockTokensCache);
-
-    // Mock OpenID config
-    mockOpenIdConfig = {
-      client_id: 'test-client-id',
-      issuer: 'https://test-issuer.com',
-    };
-    getOpenIdConfig.mockReturnValue(mockOpenIdConfig);
-
-    // Mock openid-client (using the existing jest mock configuration)
-    if (client.genericGrantRequest) {
-      client.genericGrantRequest.mockResolvedValue({
-        access_token: 'mocked-graph-token',
-        expires_in: 3600,
-      });
-    }
-  });
-
-  describe('Dependency Contract Tests', () => {
-    it('should fail if getOpenIdConfig interface changes', () => {
-      // Reason: Ensure getOpenIdConfig returns expected structure
-      const config = getOpenIdConfig();
-
-      expect(config).toBeDefined();
-      expect(typeof config).toBe('object');
-      // Add specific property checks that GraphApiService depends on
-      expect(config).toHaveProperty('client_id');
-      expect(config).toHaveProperty('issuer');
-
-      // Ensure the function is callable
-      expect(typeof getOpenIdConfig).toBe('function');
-    });
-
-    it('should fail if openid-client.genericGrantRequest interface changes', () => {
-      // Reason: Ensure client.genericGrantRequest maintains expected signature
-      if (client.genericGrantRequest) {
-        expect(typeof client.genericGrantRequest).toBe('function');
-
-        // Test that it accepts the expected parameters
-        const mockCall = client.genericGrantRequest(
-          mockOpenIdConfig,
-          'urn:ietf:params:oauth:grant-type:jwt-bearer',
-          {
-            scope: 'test-scope',
-            assertion: 'test-token',
-            requested_token_use: 'on_behalf_of',
-          },
-        );
-
-        expect(mockCall).toBeDefined();
-      }
-    });
-
-    it('should fail if Microsoft Graph Client interface changes', () => {
-      // Reason: Ensure Graph Client maintains expected fluent API
-      expect(typeof Client.init).toBe('function');
-
-      const client = Client.init({ authProvider: jest.fn() });
-      expect(client).toHaveProperty('api');
-      expect(typeof client.api).toBe('function');
-    });
-  });
-
-  describe('createGraphClient', () => {
-    it('should create graph client with exchanged token', async () => {
-      const accessToken = 'test-access-token';
-      const sub = 'test-user-id';
-
-      const result = await GraphApiService.createGraphClient(accessToken, sub);
-
-      expect(getOpenIdConfig).toHaveBeenCalled();
-      expect(Client.init).toHaveBeenCalledWith({
-        authProvider: expect.any(Function),
-      });
-      expect(result).toBe(mockGraphClient);
-    });
-
-    it('should handle token exchange errors gracefully', async () => {
-      if (client.genericGrantRequest) {
-        client.genericGrantRequest.mockRejectedValue(new Error('Token exchange failed'));
-      }
-
-      await expect(GraphApiService.createGraphClient('invalid-token', 'test-user')).rejects.toThrow(
-        'Token exchange failed',
-      );
-    });
-  });
-
-  describe('exchangeTokenForGraphAccess', () => {
-    it('should return cached token if available', async () => {
-      const cachedToken = { access_token: 'cached-token' };
-      mockTokensCache.get.mockResolvedValue(cachedToken);
-
-      const result = await GraphApiService.exchangeTokenForGraphAccess(
-        mockOpenIdConfig,
-        'test-token',
-        'test-user',
-      );
-
-      expect(result).toBe('cached-token');
-      expect(mockTokensCache.get).toHaveBeenCalledWith('test-user:graph');
-      if (client.genericGrantRequest) {
-        expect(client.genericGrantRequest).not.toHaveBeenCalled();
-      }
-    });
-
-    it('should exchange token and cache result', async () => {
-      mockTokensCache.get.mockResolvedValue(null);
-
-      const result = await GraphApiService.exchangeTokenForGraphAccess(
-        mockOpenIdConfig,
-        'test-token',
-        'test-user',
-      );
-
-      if (client.genericGrantRequest) {
-        expect(client.genericGrantRequest).toHaveBeenCalledWith(
-          mockOpenIdConfig,
-          'urn:ietf:params:oauth:grant-type:jwt-bearer',
-          {
-            scope:
-              'https://graph.microsoft.com/User.Read https://graph.microsoft.com/People.Read https://graph.microsoft.com/Group.Read.All',
-            assertion: 'test-token',
-            requested_token_use: 'on_behalf_of',
-          },
-        );
-      }
-
-      expect(mockTokensCache.set).toHaveBeenCalledWith(
-        'test-user:graph',
-        { access_token: 'mocked-graph-token' },
-        3600000,
-      );
-
-      expect(result).toBe('mocked-graph-token');
-    });
-
-    it('should use custom scopes from environment', async () => {
-      const originalEnv = process.env.OPENID_GRAPH_SCOPES;
-      process.env.OPENID_GRAPH_SCOPES = 'Custom.Read,Custom.Write';
-
-      mockTokensCache.get.mockResolvedValue(null);
-
-      await GraphApiService.exchangeTokenForGraphAccess(
-        mockOpenIdConfig,
-        'test-token',
-        'test-user',
-      );
-
-      if (client.genericGrantRequest) {
-        expect(client.genericGrantRequest).toHaveBeenCalledWith(
-          mockOpenIdConfig,
-          'urn:ietf:params:oauth:grant-type:jwt-bearer',
-          {
-            scope:
-              'https://graph.microsoft.com/Custom.Read https://graph.microsoft.com/Custom.Write',
-            assertion: 'test-token',
-            requested_token_use: 'on_behalf_of',
-          },
-        );
-      }
-
-      process.env.OPENID_GRAPH_SCOPES = originalEnv;
-    });
-  });
-
-  describe('searchEntraIdPrincipals', () => {
-    // Mock data used by multiple tests
-    const mockContactsResponse = {
-      value: [
-        {
-          id: 'contact-user-1',
-          displayName: 'John Doe',
-          userPrincipalName: 'john@company.com',
-          mail: 'john@company.com',
-          personType: { class: 'Person', subclass: 'OrganizationUser' },
-          scoredEmailAddresses: [{ address: 'john@company.com', relevanceScore: 0.9 }],
-        },
-        {
-          id: 'contact-group-1',
-          displayName: 'Marketing Team',
-          mail: 'marketing@company.com',
-          personType: { class: 'Group', subclass: 'UnifiedGroup' },
-          scoredEmailAddresses: [{ address: 'marketing@company.com', relevanceScore: 0.8 }],
-        },
-      ],
-    };
-
-    const mockUsersResponse = {
-      value: [
-        {
-          id: 'dir-user-1',
-          displayName: 'Jane Smith',
-          userPrincipalName: 'jane@company.com',
-          mail: 'jane@company.com',
-        },
-      ],
-    };
-
-    const mockGroupsResponse = {
-      value: [
-        {
-          id: 'dir-group-1',
-          displayName: 'Development Team',
-          mail: 'dev@company.com',
-        },
-      ],
-    };
-
-    beforeEach(() => {
-      // Reset mock call history for each test
-      jest.clearAllMocks();
-
-      // Re-apply the Client.init mock after clearAllMocks
-      Client.init.mockReturnValue(mockGraphClient);
-
-      // Re-apply openid-client mock
-      if (client.genericGrantRequest) {
-        client.genericGrantRequest.mockResolvedValue({
-          access_token: 'mocked-graph-token',
-          expires_in: 3600,
-        });
-      }
-
-      // Re-apply cache mock
-      mockTokensCache.get.mockResolvedValue(null); // Force token exchange
-      mockTokensCache.set.mockResolvedValue();
-      getLogStores.mockReturnValue(mockTokensCache);
-      getOpenIdConfig.mockReturnValue(mockOpenIdConfig);
-    });
-
-    it('should return empty results for short queries', async () => {
-      const result = await GraphApiService.searchEntraIdPrincipals('token', 'user', 'a', 'all', 10);
-
-      expect(result).toEqual([]);
-      expect(mockGraphClient.api).not.toHaveBeenCalled();
-    });
-
-    it('should search contacts first and additional users for users type', async () => {
-      // Mock responses for this specific test
-      const contactsFilteredResponse = {
-        value: [
-          {
-            id: 'contact-user-1',
-            displayName: 'John Doe',
-            userPrincipalName: 'john@company.com',
-            mail: 'john@company.com',
-            personType: { class: 'Person', subclass: 'OrganizationUser' },
-            scoredEmailAddresses: [{ address: 'john@company.com', relevanceScore: 0.9 }],
-          },
-        ],
-      };
-
-      mockGraphClient.get
-        .mockResolvedValueOnce(contactsFilteredResponse) // contacts call
-        .mockResolvedValueOnce(mockUsersResponse); // users call
-
-      const result = await GraphApiService.searchEntraIdPrincipals(
-        'token',
-        'user',
-        'john',
-        'users',
-        10,
-      );
-
-      // Should call contacts first with user filter
-      expect(mockGraphClient.api).toHaveBeenCalledWith('/me/people');
-      expect(mockGraphClient.search).toHaveBeenCalledWith('"john"');
-      expect(mockGraphClient.filter).toHaveBeenCalledWith(
-        "personType/subclass eq 'OrganizationUser'",
-      );
-
-      // Should call users endpoint for additional results
-      expect(mockGraphClient.api).toHaveBeenCalledWith('/users');
-      expect(mockGraphClient.search).toHaveBeenCalledWith(
-        '"displayName:john" OR "userPrincipalName:john" OR "mail:john" OR "givenName:john" OR "surname:john"',
-      );
-
-      // Should return TPrincipalSearchResult array
-      expect(Array.isArray(result)).toBe(true);
-      expect(result).toHaveLength(2); // 1 from contacts + 1 from users
-      expect(result[0]).toMatchObject({
-        id: null,
-        type: 'user',
-        name: 'John Doe',
-        email: 'john@company.com',
-        source: 'entra',
-        idOnTheSource: 'contact-user-1',
-      });
-    });
-
-    it('should search groups endpoint only for groups type', async () => {
-      // Mock responses for this specific test - only groups endpoint called
-      mockGraphClient.get.mockResolvedValueOnce(mockGroupsResponse); // only groups call
-
-      const result = await GraphApiService.searchEntraIdPrincipals(
-        'token',
-        'user',
-        'team',
-        'groups',
-        10,
-      );
-
-      // Should NOT call contacts for groups type
-      expect(mockGraphClient.api).not.toHaveBeenCalledWith('/me/people');
-
-      // Should call groups endpoint only
-      expect(mockGraphClient.api).toHaveBeenCalledWith('/groups');
-      expect(mockGraphClient.search).toHaveBeenCalledWith(
-        '"displayName:team" OR "mail:team" OR "mailNickname:team"',
-      );
-
-      expect(Array.isArray(result)).toBe(true);
-      expect(result).toHaveLength(1); // 1 from groups only
-    });
-
-    it('should search all endpoints for all type', async () => {
-      // Mock responses for this specific test
-      mockGraphClient.get
-        .mockResolvedValueOnce(mockContactsResponse) // contacts call (both user and group)
-        .mockResolvedValueOnce(mockUsersResponse) // users call
-        .mockResolvedValueOnce(mockGroupsResponse); // groups call
-
-      const result = await GraphApiService.searchEntraIdPrincipals(
-        'token',
-        'user',
-        'test',
-        'all',
-        10,
-      );
-
-      // Should call contacts first with user filter
-      expect(mockGraphClient.api).toHaveBeenCalledWith('/me/people');
-      expect(mockGraphClient.search).toHaveBeenCalledWith('"test"');
-      expect(mockGraphClient.filter).toHaveBeenCalledWith(
-        "personType/subclass eq 'OrganizationUser'",
-      );
-
-      // Should call both users and groups endpoints
-      expect(mockGraphClient.api).toHaveBeenCalledWith('/users');
-      expect(mockGraphClient.api).toHaveBeenCalledWith('/groups');
-
-      expect(Array.isArray(result)).toBe(true);
-      expect(result).toHaveLength(4); // 2 from contacts + 1 from users + 1 from groups
-    });
-
-    it('should early exit if contacts reach limit', async () => {
-      // Mock contacts to return exactly the limit
-      const limitedContactsResponse = {
-        value: Array(10).fill({
-          id: 'contact-1',
-          displayName: 'Contact User',
-          mail: 'contact@company.com',
-          personType: { class: 'Person', subclass: 'OrganizationUser' },
-        }),
-      };
-
-      mockGraphClient.get.mockResolvedValueOnce(limitedContactsResponse);
-
-      const result = await GraphApiService.searchEntraIdPrincipals(
-        'token',
-        'user',
-        'test',
-        'all',
-        10,
-      );
-
-      // Should call contacts first
-      expect(mockGraphClient.api).toHaveBeenCalledWith('/me/people');
-      expect(mockGraphClient.search).toHaveBeenCalledWith('"test"');
-      // Should not call users endpoint since limit was reached
-      expect(mockGraphClient.api).not.toHaveBeenCalledWith('/users');
-
-      expect(result).toHaveLength(10);
-    });
-
-    it('should deduplicate results based on idOnTheSource', async () => {
-      // Mock responses with duplicate IDs
-      const duplicateContactsResponse = {
-        value: [
-          {
-            id: 'duplicate-id',
-            displayName: 'John Doe',
-            mail: 'john@company.com',
-            personType: { class: 'Person', subclass: 'OrganizationUser' },
-          },
-        ],
-      };
-
-      const duplicateUsersResponse = {
-        value: [
-          {
-            id: 'duplicate-id', // Same ID as contact
-            displayName: 'John Doe',
-            mail: 'john@company.com',
-          },
-        ],
-      };
-
-      mockGraphClient.get
-        .mockResolvedValueOnce(duplicateContactsResponse)
-        .mockResolvedValueOnce(duplicateUsersResponse);
-
-      const result = await GraphApiService.searchEntraIdPrincipals(
-        'token',
-        'user',
-        'john',
-        'users',
-        10,
-      );
-
-      // Should only return one result despite duplicate IDs
-      expect(result).toHaveLength(1);
-      expect(result[0].idOnTheSource).toBe('duplicate-id');
-    });
-
-    it('should handle Graph API errors gracefully', async () => {
-      mockGraphClient.get.mockRejectedValue(new Error('Graph API error'));
-
-      const result = await GraphApiService.searchEntraIdPrincipals(
-        'token',
-        'user',
-        'test',
-        'all',
-        10,
-      );
-
-      expect(result).toEqual([]);
-    });
-  });
-
-  describe('getUserEntraGroups', () => {
-    it('should fetch user groups from memberOf endpoint', async () => {
-      const mockGroupsResponse = {
-        value: [
-          {
-            id: 'group-1',
-          },
-          {
-            id: 'group-2',
-          },
-        ],
-      };
-
-      mockGraphClient.get.mockResolvedValue(mockGroupsResponse);
-
-      const result = await GraphApiService.getUserEntraGroups('token', 'user');
-
-      expect(mockGraphClient.api).toHaveBeenCalledWith('/me/memberOf');
-      expect(mockGraphClient.select).toHaveBeenCalledWith('id');
-
-      expect(result).toHaveLength(2);
-      expect(result).toEqual(['group-1', 'group-2']);
-    });
-
-    it('should return empty array on error', async () => {
-      mockGraphClient.get.mockRejectedValue(new Error('API error'));
-
-      const result = await GraphApiService.getUserEntraGroups('token', 'user');
-
-      expect(result).toEqual([]);
-    });
-
-    it('should handle empty response', async () => {
-      const mockGroupsResponse = {
-        value: [],
-      };
-
-      mockGraphClient.get.mockResolvedValue(mockGroupsResponse);
-
-      const result = await GraphApiService.getUserEntraGroups('token', 'user');
-
-      expect(result).toEqual([]);
-    });
-
-    it('should handle missing value property', async () => {
-      mockGraphClient.get.mockResolvedValue({});
-
-      const result = await GraphApiService.getUserEntraGroups('token', 'user');
-
-      expect(result).toEqual([]);
-    });
-  });
-
-  describe('testGraphApiAccess', () => {
-    beforeEach(() => {
-      jest.clearAllMocks();
-    });
-
-    it('should test all permissions and return success results', async () => {
-      // Mock successful responses for all tests
-      mockGraphClient.get
-        .mockResolvedValueOnce({ id: 'user-123', displayName: 'Test User' }) // /me test
-        .mockResolvedValueOnce({ value: [] }) // people OrganizationUser test
-        .mockResolvedValueOnce({ value: [] }) // people UnifiedGroup test
-        .mockResolvedValueOnce({ value: [] }) // /users endpoint test
-        .mockResolvedValueOnce({ value: [] }); // /groups endpoint test
-
-      const result = await GraphApiService.testGraphApiAccess('token', 'user');
-
-      expect(result).toEqual({
-        userAccess: true,
-        peopleAccess: true,
-        groupsAccess: true,
-        usersEndpointAccess: true,
-        groupsEndpointAccess: true,
-        errors: [],
-      });
-
-      // Verify all endpoints were tested
-      expect(mockGraphClient.api).toHaveBeenCalledWith('/me');
-      expect(mockGraphClient.api).toHaveBeenCalledWith('/me/people');
-      expect(mockGraphClient.api).toHaveBeenCalledWith('/users');
-      expect(mockGraphClient.api).toHaveBeenCalledWith('/groups');
-      expect(mockGraphClient.filter).toHaveBeenCalledWith(
-        "personType/subclass eq 'OrganizationUser'",
-      );
-      expect(mockGraphClient.filter).toHaveBeenCalledWith("personType/subclass eq 'UnifiedGroup'");
-      expect(mockGraphClient.search).toHaveBeenCalledWith('"displayName:test"');
-    });
-
-    it('should handle partial failures and record errors', async () => {
-      // Mock mixed success/failure responses
-      mockGraphClient.get
-        .mockResolvedValueOnce({ id: 'user-123', displayName: 'Test User' }) // /me success
-        .mockRejectedValueOnce(new Error('People access denied')) // people OrganizationUser fail
-        .mockResolvedValueOnce({ value: [] }) // people UnifiedGroup success
-        .mockRejectedValueOnce(new Error('Users endpoint access denied')) // /users fail
-        .mockResolvedValueOnce({ value: [] }); // /groups success
-
-      const result = await GraphApiService.testGraphApiAccess('token', 'user');
-
-      expect(result).toEqual({
-        userAccess: true,
-        peopleAccess: false,
-        groupsAccess: true,
-        usersEndpointAccess: false,
-        groupsEndpointAccess: true,
-        errors: [
-          'People.Read (OrganizationUser): People access denied',
-          'Users endpoint: Users endpoint access denied',
-        ],
-      });
-    });
-
-    it('should handle complete Graph client creation failure', async () => {
-      // Mock token exchange failure to test error handling
-      if (client.genericGrantRequest) {
-        client.genericGrantRequest.mockRejectedValue(new Error('Token exchange failed'));
-      }
-
-      const result = await GraphApiService.testGraphApiAccess('invalid-token', 'user');
-
-      expect(result).toEqual({
-        userAccess: false,
-        peopleAccess: false,
-        groupsAccess: false,
-        usersEndpointAccess: false,
-        groupsEndpointAccess: false,
-        errors: ['Token exchange failed'],
-      });
-    });
-
-    it('should record all permission errors', async () => {
-      // Mock all requests to fail
-      mockGraphClient.get
-        .mockRejectedValueOnce(new Error('User.Read denied'))
-        .mockRejectedValueOnce(new Error('People.Read OrganizationUser denied'))
-        .mockRejectedValueOnce(new Error('People.Read UnifiedGroup denied'))
-        .mockRejectedValueOnce(new Error('Users directory access denied'))
-        .mockRejectedValueOnce(new Error('Groups directory access denied'));
-
-      const result = await GraphApiService.testGraphApiAccess('token', 'user');
-
-      expect(result).toEqual({
-        userAccess: false,
-        peopleAccess: false,
-        groupsAccess: false,
-        usersEndpointAccess: false,
-        groupsEndpointAccess: false,
-        errors: [
-          'User.Read: User.Read denied',
-          'People.Read (OrganizationUser): People.Read OrganizationUser denied',
-          'People.Read (UnifiedGroup): People.Read UnifiedGroup denied',
-          'Users endpoint: Users directory access denied',
-          'Groups endpoint: Groups directory access denied',
-        ],
-      });
-    });
-
-    it('should test new endpoints with correct search patterns', async () => {
-      // Mock successful responses for endpoint testing
-      mockGraphClient.get
-        .mockResolvedValueOnce({ id: 'user-123', displayName: 'Test User' }) // /me
-        .mockResolvedValueOnce({ value: [] }) // people OrganizationUser
-        .mockResolvedValueOnce({ value: [] }) // people UnifiedGroup
-        .mockResolvedValueOnce({ value: [] }) // /users
-        .mockResolvedValueOnce({ value: [] }); // /groups
-
-      await GraphApiService.testGraphApiAccess('token', 'user');
-
-      // Verify /users endpoint test
-      expect(mockGraphClient.api).toHaveBeenCalledWith('/users');
-      expect(mockGraphClient.search).toHaveBeenCalledWith('"displayName:test"');
-      expect(mockGraphClient.select).toHaveBeenCalledWith('id,displayName,userPrincipalName');
-
-      // Verify /groups endpoint test
-      expect(mockGraphClient.api).toHaveBeenCalledWith('/groups');
-      expect(mockGraphClient.select).toHaveBeenCalledWith('id,displayName,mail');
-    });
-
-    it('should handle endpoint-specific permission failures', async () => {
-      // Mock specific endpoint failures
-      mockGraphClient.get
-        .mockResolvedValueOnce({ id: 'user-123', displayName: 'Test User' }) // /me success
-        .mockResolvedValueOnce({ value: [] }) // people OrganizationUser success
-        .mockResolvedValueOnce({ value: [] }) // people UnifiedGroup success
-        .mockRejectedValueOnce(new Error('Insufficient privileges')) // /users fail (User.Read.All needed)
-        .mockRejectedValueOnce(new Error('Access denied to groups')); // /groups fail (Group.Read.All needed)
-
-      const result = await GraphApiService.testGraphApiAccess('token', 'user');
-
-      expect(result).toEqual({
-        userAccess: true,
-        peopleAccess: true,
-        groupsAccess: true,
-        usersEndpointAccess: false,
-        groupsEndpointAccess: false,
-        errors: [
-          'Users endpoint: Insufficient privileges',
-          'Groups endpoint: Access denied to groups',
-        ],
-      });
-    });
-  });
-});

api/server/services/PermissionService.js

@@ -1,721 +0,0 @@
-const mongoose = require('mongoose');
-const { getTransactionSupport, logger } = require('@librechat/data-schemas');
-const { isEnabled } = require('~/server/utils');
-const {
-  entraIdPrincipalFeatureEnabled,
-  getUserEntraGroups,
-  getUserOwnedEntraGroups,
-  getGroupMembers,
-  getGroupOwners,
-} = require('~/server/services/GraphApiService');
-const {
-  findGroupByExternalId,
-  findRoleByIdentifier,
-  getUserPrincipals,
-  createGroup,
-  createUser,
-  updateUser,
-  findUser,
-  grantPermission: grantPermissionACL,
-  findAccessibleResources: findAccessibleResourcesACL,
-  hasPermission,
-  getEffectivePermissions: getEffectivePermissionsACL,
-  findEntriesByPrincipalsAndResource,
-} = require('~/models');
-const { AclEntry, AccessRole, Group } = require('~/db/models');
-
-/** @type {boolean|null} */
-let transactionSupportCache = null;
-
-/**
- * @import { TPrincipal } from 'librechat-data-provider'
- */
-/**
- * Grant a permission to a principal for a resource using a role
- * @param {Object} params - Parameters for granting role-based permission
- * @param {string} params.principalType - 'user', 'group', or 'public'
- * @param {string|mongoose.Types.ObjectId|null} params.principalId - The ID of the principal (null for 'public')
- * @param {string} params.resourceType - Type of resource (e.g., 'agent')
- * @param {string|mongoose.Types.ObjectId} params.resourceId - The ID of the resource
- * @param {string} params.accessRoleId - The ID of the role (e.g., 'agent_viewer', 'agent_editor')
- * @param {string|mongoose.Types.ObjectId} params.grantedBy - User ID granting the permission
- * @param {mongoose.ClientSession} [params.session] - Optional MongoDB session for transactions
- * @returns {Promise<Object>} The created or updated ACL entry
- */
-const grantPermission = async ({
-  principalType,
-  principalId,
-  resourceType,
-  resourceId,
-  accessRoleId,
-  grantedBy,
-  session,
-}) => {
-  try {
-    if (!['user', 'group', 'public'].includes(principalType)) {
-      throw new Error(`Invalid principal type: ${principalType}`);
-    }
-
-    if (principalType !== 'public' && !principalId) {
-      throw new Error('Principal ID is required for user and group principals');
-    }
-
-    if (principalId && !mongoose.Types.ObjectId.isValid(principalId)) {
-      throw new Error(`Invalid principal ID: ${principalId}`);
-    }
-
-    if (!resourceId || !mongoose.Types.ObjectId.isValid(resourceId)) {
-      throw new Error(`Invalid resource ID: ${resourceId}`);
-    }
-
-    // Get the role to determine permission bits
-    const role = await findRoleByIdentifier(accessRoleId);
-    if (!role) {
-      throw new Error(`Role ${accessRoleId} not found`);
-    }
-
-    // Ensure the role is for the correct resource type
-    if (role.resourceType !== resourceType) {
-      throw new Error(
-        `Role ${accessRoleId} is for ${role.resourceType} resources, not ${resourceType}`,
-      );
-    }
-    return await grantPermissionACL(
-      principalType,
-      principalId,
-      resourceType,
-      resourceId,
-      role.permBits,
-      grantedBy,
-      session,
-      role._id,
-    );
-  } catch (error) {
-    logger.error(`[PermissionService.grantPermission] Error: ${error.message}`);
-    throw error;
-  }
-};
-
-/**
- * Check if a user has specific permission bits on a resource
- * @param {Object} params - Parameters for checking permissions
- * @param {string|mongoose.Types.ObjectId} params.userId - The ID of the user
- * @param {string} params.resourceType - Type of resource (e.g., 'agent')
- * @param {string|mongoose.Types.ObjectId} params.resourceId - The ID of the resource
- * @param {number} params.requiredPermissions - The permission bits required (e.g., 1 for VIEW, 3 for VIEW+EDIT)
- * @returns {Promise<boolean>} Whether the user has the required permission bits
- */
-const checkPermission = async ({ userId, resourceType, resourceId, requiredPermission }) => {
-  try {
-    if (typeof requiredPermission !== 'number' || requiredPermission < 1) {
-      throw new Error('requiredPermission must be a positive number');
-    }
-
-    // Get all principals for the user (user + groups + public)
-    const principals = await getUserPrincipals(userId);
-
-    if (principals.length === 0) {
-      return false;
-    }
-
-    return await hasPermission(principals, resourceType, resourceId, requiredPermission);
-  } catch (error) {
-    logger.error(`[PermissionService.checkPermission] Error: ${error.message}`);
-    // Re-throw validation errors
-    if (error.message.includes('requiredPermission must be')) {
-      throw error;
-    }
-    return false;
-  }
-};
-
-/**
- * Get effective permission bitmask for a user on a resource
- * @param {Object} params - Parameters for getting effective permissions
- * @param {string|mongoose.Types.ObjectId} params.userId - The ID of the user
- * @param {string} params.resourceType - Type of resource (e.g., 'agent')
- * @param {string|mongoose.Types.ObjectId} params.resourceId - The ID of the resource
- * @returns {Promise<number>} Effective permission bitmask
- */
-const getEffectivePermissions = async ({ userId, resourceType, resourceId }) => {
-  try {
-    // Get all principals for the user (user + groups + public)
-    const principals = await getUserPrincipals(userId);
-
-    if (principals.length === 0) {
-      return 0;
-    }
-    return await getEffectivePermissionsACL(principals, resourceType, resourceId);
-  } catch (error) {
-    logger.error(`[PermissionService.getEffectivePermissions] Error: ${error.message}`);
-    return 0;
-  }
-};
-
-/**
- * Find all resources of a specific type that a user has access to with specific permission bits
- * @param {Object} params - Parameters for finding accessible resources
- * @param {string|mongoose.Types.ObjectId} params.userId - The ID of the user
- * @param {string} params.resourceType - Type of resource (e.g., 'agent')
- * @param {number} params.requiredPermissions - The minimum permission bits required (e.g., 1 for VIEW, 3 for VIEW+EDIT)
- * @returns {Promise<Array>} Array of resource IDs
- */
-const findAccessibleResources = async ({ userId, resourceType, requiredPermissions }) => {
-  try {
-    if (typeof requiredPermissions !== 'number' || requiredPermissions < 1) {
-      throw new Error('requiredPermissions must be a positive number');
-    }
-
-    // Get all principals for the user (user + groups + public)
-    const principalsList = await getUserPrincipals(userId);
-
-    if (principalsList.length === 0) {
-      return [];
-    }
-    return await findAccessibleResourcesACL(principalsList, resourceType, requiredPermissions);
-  } catch (error) {
-    logger.error(`[PermissionService.findAccessibleResources] Error: ${error.message}`);
-    // Re-throw validation errors
-    if (error.message.includes('requiredPermissions must be')) {
-      throw error;
-    }
-    return [];
-  }
-};
-
-/**
- * Find all publicly accessible resources of a specific type
- * @param {Object} params - Parameters for finding publicly accessible resources
- * @param {string} params.resourceType - Type of resource (e.g., 'agent')
- * @param {number} params.requiredPermissions - The minimum permission bits required (e.g., 1 for VIEW, 3 for VIEW+EDIT)
- * @returns {Promise<Array>} Array of resource IDs
- */
-const findPubliclyAccessibleResources = async ({ resourceType, requiredPermissions }) => {
-  try {
-    if (typeof requiredPermissions !== 'number' || requiredPermissions < 1) {
-      throw new Error('requiredPermissions must be a positive number');
-    }
-
-    // Find all public ACL entries where the public principal has at least the required permission bits
-    const entries = await AclEntry.find({
-      principalType: 'public',
-      resourceType,
-      permBits: { $bitsAllSet: requiredPermissions },
-    }).distinct('resourceId');
-
-    return entries;
-  } catch (error) {
-    logger.error(`[PermissionService.findPubliclyAccessibleResources] Error: ${error.message}`);
-    // Re-throw validation errors
-    if (error.message.includes('requiredPermissions must be')) {
-      throw error;
-    }
-    return [];
-  }
-};
-
-/**
- * Get available roles for a resource type
- * @param {Object} params - Parameters for getting available roles
- * @param {string} params.resourceType - Type of resource (e.g., 'agent')
- * @returns {Promise<Array>} Array of role definitions
- */
-const getAvailableRoles = async ({ resourceType }) => {
-  try {
-    return await AccessRole.find({ resourceType }).lean();
-  } catch (error) {
-    logger.error(`[PermissionService.getAvailableRoles] Error: ${error.message}`);
-    return [];
-  }
-};
-
-/**
- * Ensures a principal exists in the database based on TPrincipal data
- * Creates user if it doesn't exist locally (for Entra ID users)
- * @param {Object} principal - TPrincipal object from frontend
- * @param {string} principal.type - 'user', 'group', or 'public'
- * @param {string} [principal.id] - Local database ID (null for Entra ID principals not yet synced)
- * @param {string} principal.name - Display name
- * @param {string} [principal.email] - Email address
- * @param {string} [principal.source] - 'local' or 'entra'
- * @param {string} [principal.idOnTheSource] - Entra ID object ID for external principals
- * @returns {Promise<string|null>} Returns the principalId for database operations, null for public
- */
-const ensurePrincipalExists = async function (principal) {
-  if (principal.type === 'public') {
-    return null;
-  }
-
-  if (principal.id) {
-    return principal.id;
-  }
-
-  if (principal.type === 'user' && principal.source === 'entra') {
-    if (!principal.email || !principal.idOnTheSource) {
-      throw new Error('Entra ID user principals must have email and idOnTheSource');
-    }
-
-    let existingUser = await findUser({ idOnTheSource: principal.idOnTheSource });
-
-    if (!existingUser) {
-      existingUser = await findUser({ email: principal.email.toLowerCase() });
-    }
-
-    if (existingUser) {
-      if (!existingUser.idOnTheSource && principal.idOnTheSource) {
-        await updateUser(existingUser._id, {
-          idOnTheSource: principal.idOnTheSource,
-          provider: 'openid',
-        });
-      }
-      return existingUser._id.toString();
-    }
-
-    const userData = {
-      name: principal.name,
-      email: principal.email.toLowerCase(),
-      emailVerified: false,
-      provider: 'openid',
-      idOnTheSource: principal.idOnTheSource,
-    };
-
-    const userId = await createUser(userData, true, false);
-    return userId.toString();
-  }
-
-  if (principal.type === 'group') {
-    throw new Error('Group principals should be handled by group-specific methods');
-  }
-
-  throw new Error(`Unsupported principal type: ${principal.type}`);
-};
-
-/**
- * Ensures a group principal exists in the database based on TPrincipal data
- * Creates group if it doesn't exist locally (for Entra ID groups)
- * For Entra ID groups, always synchronizes member IDs when authentication context is provided
- * @param {Object} principal - TPrincipal object from frontend
- * @param {string} principal.type - Must be 'group'
- * @param {string} [principal.id] - Local database ID (null for Entra ID principals not yet synced)
- * @param {string} principal.name - Display name
- * @param {string} [principal.email] - Email address
- * @param {string} [principal.description] - Group description
- * @param {string} [principal.source] - 'local' or 'entra'
- * @param {string} [principal.idOnTheSource] - Entra ID object ID for external principals
- * @param {Object} [authContext] - Optional authentication context for fetching member data
- * @param {string} [authContext.accessToken] - Access token for Graph API calls
- * @param {string} [authContext.sub] - Subject identifier
- * @returns {Promise<string>} Returns the groupId for database operations
- */
-const ensureGroupPrincipalExists = async function (principal, authContext = null) {
-  if (principal.type !== 'group') {
-    throw new Error(`Invalid principal type: ${principal.type}. Expected 'group'`);
-  }
-
-  if (principal.source === 'entra') {
-    if (!principal.name || !principal.idOnTheSource) {
-      throw new Error('Entra ID group principals must have name and idOnTheSource');
-    }
-
-    let memberIds = [];
-    if (authContext && authContext.accessToken && authContext.sub) {
-      try {
-        memberIds = await getGroupMembers(
-          authContext.accessToken,
-          authContext.sub,
-          principal.idOnTheSource,
-        );
-
-        // Include group owners as members if feature is enabled
-        if (isEnabled(process.env.ENTRA_ID_INCLUDE_OWNERS_AS_MEMBERS)) {
-          const ownerIds = await getGroupOwners(
-            authContext.accessToken,
-            authContext.sub,
-            principal.idOnTheSource,
-          );
-          if (ownerIds && ownerIds.length > 0) {
-            memberIds.push(...ownerIds);
-            // Remove duplicates
-            memberIds = [...new Set(memberIds)];
-          }
-        }
-      } catch (error) {
-        logger.error('Failed to fetch group members from Graph API:', error);
-      }
-    }
-
-    let existingGroup = await findGroupByExternalId(principal.idOnTheSource, 'entra');
-
-    if (!existingGroup && principal.email) {
-      existingGroup = await Group.findOne({ email: principal.email.toLowerCase() }).lean();
-    }
-
-    if (existingGroup) {
-      const updateData = {};
-      let needsUpdate = false;
-
-      if (!existingGroup.idOnTheSource && principal.idOnTheSource) {
-        updateData.idOnTheSource = principal.idOnTheSource;
-        updateData.source = 'entra';
-        needsUpdate = true;
-      }
-
-      if (principal.description && existingGroup.description !== principal.description) {
-        updateData.description = principal.description;
-        needsUpdate = true;
-      }
-
-      if (principal.email && existingGroup.email !== principal.email.toLowerCase()) {
-        updateData.email = principal.email.toLowerCase();
-        needsUpdate = true;
-      }
-
-      if (authContext && authContext.accessToken && authContext.sub) {
-        updateData.memberIds = memberIds;
-        needsUpdate = true;
-      }
-
-      if (needsUpdate) {
-        await Group.findByIdAndUpdate(existingGroup._id, { $set: updateData }, { new: true });
-      }
-
-      return existingGroup._id.toString();
-    }
-
-    const groupData = {
-      name: principal.name,
-      source: 'entra',
-      idOnTheSource: principal.idOnTheSource,
-      memberIds: memberIds, // Store idOnTheSource values of group members (empty if no auth context)
-    };
-
-    if (principal.email) {
-      groupData.email = principal.email.toLowerCase();
-    }
-
-    if (principal.description) {
-      groupData.description = principal.description;
-    }
-
-    const newGroup = await createGroup(groupData);
-    return newGroup._id.toString();
-  }
-  if (principal.id && authContext == null) {
-    return principal.id;
-  }
-
-  throw new Error(`Unsupported group principal source: ${principal.source}`);
-};
-
-/**
- * Synchronize user's Entra ID group memberships on sign-in
- * Gets user's group IDs from GraphAPI and updates memberships only for existing groups in database
- * Optionally includes groups the user owns if ENTRA_ID_INCLUDE_OWNERS_AS_MEMBERS is enabled
- * @param {Object} user - User object with authentication context
- * @param {string} user.openidId - User's OpenID subject identifier
- * @param {string} user.idOnTheSource - User's Entra ID (oid from token claims)
- * @param {string} user.provider - Authentication provider ('openid')
- * @param {string} accessToken - Access token for Graph API calls
- * @param {mongoose.ClientSession} [session] - Optional MongoDB session for transactions
- * @returns {Promise<void>}
- */
-const syncUserEntraGroupMemberships = async (user, accessToken, session = null) => {
-  try {
-    if (!entraIdPrincipalFeatureEnabled(user) || !accessToken || !user.idOnTheSource) {
-      return;
-    }
-
-    const memberGroupIds = await getUserEntraGroups(accessToken, user.openidId);
-    let allGroupIds = [...(memberGroupIds || [])];
-
-    // Include owned groups if feature is enabled
-    if (isEnabled(process.env.ENTRA_ID_INCLUDE_OWNERS_AS_MEMBERS)) {
-      const ownedGroupIds = await getUserOwnedEntraGroups(accessToken, user.openidId);
-      if (ownedGroupIds && ownedGroupIds.length > 0) {
-        allGroupIds.push(...ownedGroupIds);
-        // Remove duplicates
-        allGroupIds = [...new Set(allGroupIds)];
-      }
-    }
-
-    if (!allGroupIds || allGroupIds.length === 0) {
-      return;
-    }
-
-    const sessionOptions = session ? { session } : {};
-
-    await Group.updateMany(
-      {
-        idOnTheSource: { $in: allGroupIds },
-        source: 'entra',
-        memberIds: { $ne: user.idOnTheSource },
-      },
-      { $addToSet: { memberIds: user.idOnTheSource } },
-      sessionOptions,
-    );
-
-    await Group.updateMany(
-      {
-        source: 'entra',
-        memberIds: user.idOnTheSource,
-        idOnTheSource: { $nin: allGroupIds },
-      },
-      { $pull: { memberIds: user.idOnTheSource } },
-      sessionOptions,
-    );
-  } catch (error) {
-    logger.error(`[PermissionService.syncUserEntraGroupMemberships] Error syncing groups:`, error);
-  }
-};
-
-/**
- * Check if public has a specific permission on a resource
- * @param {Object} params - Parameters for checking public permission
- * @param {string} params.resourceType - Type of resource (e.g., 'agent')
- * @param {string|mongoose.Types.ObjectId} params.resourceId - The ID of the resource
- * @param {number} params.requiredPermissions - The permission bits required (e.g., 1 for VIEW, 3 for VIEW+EDIT)
- * @returns {Promise<boolean>} Whether public has the required permission bits
- */
-const hasPublicPermission = async ({ resourceType, resourceId, requiredPermissions }) => {
-  try {
-    if (typeof requiredPermissions !== 'number' || requiredPermissions < 1) {
-      throw new Error('requiredPermissions must be a positive number');
-    }
-
-    // Use public principal to check permissions
-    const publicPrincipal = [{ principalType: 'public' }];
-
-    const entries = await findEntriesByPrincipalsAndResource(
-      publicPrincipal,
-      resourceType,
-      resourceId,
-    );
-
-    // Check if any entry has the required permission bits
-    return entries.some((entry) => (entry.permBits & requiredPermissions) === requiredPermissions);
-  } catch (error) {
-    logger.error(`[PermissionService.hasPublicPermission] Error: ${error.message}`);
-    // Re-throw validation errors
-    if (error.message.includes('requiredPermissions must be')) {
-      throw error;
-    }
-    return false;
-  }
-};
-
-/**
- * Bulk update permissions for a resource (grant, update, revoke)
- * Efficiently handles multiple permission changes in a single transaction
- *
- * @param {Object} params - Parameters for bulk permission update
- * @param {string} params.resourceType - Type of resource (e.g., 'agent')
- * @param {string|mongoose.Types.ObjectId} params.resourceId - The ID of the resource
- * @param {Array<TPrincipal>} params.updatedPrincipals - Array of principals to grant/update permissions for
- * @param {Array<TPrincipal>} params.revokedPrincipals - Array of principals to revoke permissions from
- * @param {string|mongoose.Types.ObjectId} params.grantedBy - User ID making the changes
- * @param {mongoose.ClientSession} [params.session] - Optional MongoDB session for transactions
- * @returns {Promise<Object>} Results object with granted, updated, revoked arrays and error details
- */
-const bulkUpdateResourcePermissions = async ({
-  resourceType,
-  resourceId,
-  updatedPrincipals = [],
-  revokedPrincipals = [],
-  grantedBy,
-  session,
-}) => {
-  const supportsTransactions = await getTransactionSupport(mongoose, transactionSupportCache);
-  transactionSupportCache = supportsTransactions;
-  let localSession = session;
-  let shouldEndSession = false;
-
-  try {
-    if (!Array.isArray(updatedPrincipals)) {
-      throw new Error('updatedPrincipals must be an array');
-    }
-
-    if (!Array.isArray(revokedPrincipals)) {
-      throw new Error('revokedPrincipals must be an array');
-    }
-
-    if (!resourceId || !mongoose.Types.ObjectId.isValid(resourceId)) {
-      throw new Error(`Invalid resource ID: ${resourceId}`);
-    }
-
-    if (!localSession && supportsTransactions) {
-      localSession = await mongoose.startSession();
-      localSession.startTransaction();
-      shouldEndSession = true;
-    }
-
-    const sessionOptions = localSession ? { session: localSession } : {};
-
-    const roles = await AccessRole.find({ resourceType }).lean();
-    const rolesMap = new Map();
-    roles.forEach((role) => {
-      rolesMap.set(role.accessRoleId, role);
-    });
-
-    const results = {
-      granted: [],
-      updated: [],
-      revoked: [],
-      errors: [],
-    };
-
-    const bulkWrites = [];
-
-    for (const principal of updatedPrincipals) {
-      try {
-        if (!principal.accessRoleId) {
-          results.errors.push({
-            principal,
-            error: 'accessRoleId is required for updated principals',
-          });
-          continue;
-        }
-
-        const role = rolesMap.get(principal.accessRoleId);
-        if (!role) {
-          results.errors.push({
-            principal,
-            error: `Role ${principal.accessRoleId} not found`,
-          });
-          continue;
-        }
-
-        const query = {
-          principalType: principal.type,
-          resourceType,
-          resourceId,
-        };
-
-        if (principal.type !== 'public') {
-          query.principalId = principal.id;
-        }
-
-        const update = {
-          $set: {
-            permBits: role.permBits,
-            roleId: role._id,
-            grantedBy,
-            grantedAt: new Date(),
-          },
-          $setOnInsert: {
-            principalType: principal.type,
-            resourceType,
-            resourceId,
-            ...(principal.type !== 'public' && {
-              principalId: principal.id,
-              principalModel: principal.type === 'user' ? 'User' : 'Group',
-            }),
-          },
-        };
-
-        bulkWrites.push({
-          updateOne: {
-            filter: query,
-            update: update,
-            upsert: true,
-          },
-        });
-
-        results.granted.push({
-          type: principal.type,
-          id: principal.id,
-          name: principal.name,
-          email: principal.email,
-          source: principal.source,
-          avatar: principal.avatar,
-          description: principal.description,
-          idOnTheSource: principal.idOnTheSource,
-          accessRoleId: principal.accessRoleId,
-          memberCount: principal.memberCount,
-          memberIds: principal.memberIds,
-        });
-      } catch (error) {
-        results.errors.push({
-          principal,
-          error: error.message,
-        });
-      }
-    }
-
-    if (bulkWrites.length > 0) {
-      await AclEntry.bulkWrite(bulkWrites, sessionOptions);
-    }
-
-    const deleteQueries = [];
-    for (const principal of revokedPrincipals) {
-      try {
-        const query = {
-          principalType: principal.type,
-          resourceType,
-          resourceId,
-        };
-
-        if (principal.type !== 'public') {
-          query.principalId = principal.id;
-        }
-
-        deleteQueries.push(query);
-
-        results.revoked.push({
-          type: principal.type,
-          id: principal.id,
-          name: principal.name,
-          email: principal.email,
-          source: principal.source,
-          avatar: principal.avatar,
-          description: principal.description,
-          idOnTheSource: principal.idOnTheSource,
-          memberCount: principal.memberCount,
-        });
-      } catch (error) {
-        results.errors.push({
-          principal,
-          error: error.message,
-        });
-      }
-    }
-
-    if (deleteQueries.length > 0) {
-      await AclEntry.deleteMany(
-        {
-          $or: deleteQueries,
-        },
-        sessionOptions,
-      );
-    }
-
-    if (shouldEndSession && supportsTransactions) {
-      await localSession.commitTransaction();
-    }
-
-    return results;
-  } catch (error) {
-    if (shouldEndSession && supportsTransactions) {
-      await localSession.abortTransaction();
-    }
-    logger.error(`[PermissionService.bulkUpdateResourcePermissions] Error: ${error.message}`);
-    throw error;
-  } finally {
-    if (shouldEndSession && localSession) {
-      localSession.endSession();
-    }
-  }
-};
-
-module.exports = {
-  grantPermission,
-  checkPermission,
-  getEffectivePermissions,
-  findAccessibleResources,
-  findPubliclyAccessibleResources,
-  hasPublicPermission,
-  getAvailableRoles,
-  bulkUpdateResourcePermissions,
-  ensurePrincipalExists,
-  ensureGroupPrincipalExists,
-  syncUserEntraGroupMemberships,
-};

api/server/utils/import/importers-timestamp.spec.js

@@ -0,0 +1,280 @@
+const { Constants } = require('librechat-data-provider');
+const { ImportBatchBuilder } = require('./importBatchBuilder');
+const { getImporter } = require('./importers');
+
+// Mock the database methods
+jest.mock('~/models/Conversation', () => ({
+  bulkSaveConvos: jest.fn(),
+}));
+jest.mock('~/models/Message', () => ({
+  bulkSaveMessages: jest.fn(),
+}));
+jest.mock('~/cache/getLogStores');
+const getLogStores = require('~/cache/getLogStores');
+const mockedCacheGet = jest.fn();
+getLogStores.mockImplementation(() => ({
+  get: mockedCacheGet,
+}));
+
+describe('Import Timestamp Ordering', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockedCacheGet.mockResolvedValue(null);
+  });
+
+  describe('LibreChat Import - Timestamp Issues', () => {
+    test('should maintain proper timestamp order between parent and child messages', async () => {
+      // Create a LibreChat export with out-of-order timestamps
+      const jsonData = {
+        conversationId: 'test-convo-123',
+        title: 'Test Conversation',
+        messages: [
+          {
+            messageId: 'parent-1',
+            parentMessageId: Constants.NO_PARENT,
+            text: 'Parent Message',
+            sender: 'user',
+            isCreatedByUser: true,
+            createdAt: '2023-01-01T00:02:00Z', // Parent created AFTER child
+          },
+          {
+            messageId: 'child-1',
+            parentMessageId: 'parent-1',
+            text: 'Child Message',
+            sender: 'assistant',
+            isCreatedByUser: false,
+            createdAt: '2023-01-01T00:01:00Z', // Child created BEFORE parent
+          },
+          {
+            messageId: 'grandchild-1',
+            parentMessageId: 'child-1',
+            text: 'Grandchild Message',
+            sender: 'user',
+            isCreatedByUser: true,
+            createdAt: '2023-01-01T00:00:30Z', // Even earlier
+          },
+        ],
+      };
+
+      const requestUserId = 'user-123';
+      const importBatchBuilder = new ImportBatchBuilder(requestUserId);
+      jest.spyOn(importBatchBuilder, 'saveMessage');
+
+      const importer = getImporter(jsonData);
+      await importer(jsonData, requestUserId, () => importBatchBuilder);
+
+      // Check the actual messages stored in the builder
+      const savedMessages = importBatchBuilder.messages;
+
+      const parent = savedMessages.find((msg) => msg.text === 'Parent Message');
+      const child = savedMessages.find((msg) => msg.text === 'Child Message');
+      const grandchild = savedMessages.find((msg) => msg.text === 'Grandchild Message');
+
+      // Verify all messages were found
+      expect(parent).toBeDefined();
+      expect(child).toBeDefined();
+      expect(grandchild).toBeDefined();
+
+      // FIXED behavior: timestamps ARE corrected
+      expect(new Date(child.createdAt).getTime()).toBeGreaterThan(
+        new Date(parent.createdAt).getTime(),
+      );
+      expect(new Date(grandchild.createdAt).getTime()).toBeGreaterThan(
+        new Date(child.createdAt).getTime(),
+      );
+    });
+
+    test('should handle complex multi-branch scenario with out-of-order timestamps', async () => {
+      const jsonData = {
+        conversationId: 'complex-test-123',
+        title: 'Complex Test',
+        messages: [
+          // Branch 1: Root -> A -> B with reversed timestamps
+          {
+            messageId: 'root-1',
+            parentMessageId: Constants.NO_PARENT,
+            text: 'Root 1',
+            sender: 'user',
+            isCreatedByUser: true,
+            createdAt: '2023-01-01T00:03:00Z',
+          },
+          {
+            messageId: 'a-1',
+            parentMessageId: 'root-1',
+            text: 'A1',
+            sender: 'assistant',
+            isCreatedByUser: false,
+            createdAt: '2023-01-01T00:02:00Z', // Before parent
+          },
+          {
+            messageId: 'b-1',
+            parentMessageId: 'a-1',
+            text: 'B1',
+            sender: 'user',
+            isCreatedByUser: true,
+            createdAt: '2023-01-01T00:01:00Z', // Before grandparent
+          },
+          // Branch 2: Root -> C -> D with mixed timestamps
+          {
+            messageId: 'root-2',
+            parentMessageId: Constants.NO_PARENT,
+            text: 'Root 2',
+            sender: 'user',
+            isCreatedByUser: true,
+            createdAt: '2023-01-01T00:00:30Z', // Earlier than branch 1
+          },
+          {
+            messageId: 'c-2',
+            parentMessageId: 'root-2',
+            text: 'C2',
+            sender: 'assistant',
+            isCreatedByUser: false,
+            createdAt: '2023-01-01T00:04:00Z', // Much later
+          },
+          {
+            messageId: 'd-2',
+            parentMessageId: 'c-2',
+            text: 'D2',
+            sender: 'user',
+            isCreatedByUser: true,
+            createdAt: '2023-01-01T00:02:30Z', // Between root and parent
+          },
+        ],
+      };
+
+      const requestUserId = 'user-123';
+      const importBatchBuilder = new ImportBatchBuilder(requestUserId);
+      jest.spyOn(importBatchBuilder, 'saveMessage');
+
+      const importer = getImporter(jsonData);
+      await importer(jsonData, requestUserId, () => importBatchBuilder);
+
+      const savedMessages = importBatchBuilder.messages;
+
+      // Verify that timestamps are preserved as-is (not corrected)
+      const root1 = savedMessages.find((msg) => msg.text === 'Root 1');
+      const a1 = savedMessages.find((msg) => msg.text === 'A1');
+      const b1 = savedMessages.find((msg) => msg.text === 'B1');
+      const root2 = savedMessages.find((msg) => msg.text === 'Root 2');
+      const c2 = savedMessages.find((msg) => msg.text === 'C2');
+      const d2 = savedMessages.find((msg) => msg.text === 'D2');
+
+      // Branch 1: timestamps should now be in correct order
+      expect(new Date(a1.createdAt).getTime()).toBeGreaterThan(new Date(root1.createdAt).getTime());
+      expect(new Date(b1.createdAt).getTime()).toBeGreaterThan(new Date(a1.createdAt).getTime());
+
+      // Branch 2: all timestamps should be properly ordered
+      expect(new Date(c2.createdAt).getTime()).toBeGreaterThan(new Date(root2.createdAt).getTime());
+      expect(new Date(d2.createdAt).getTime()).toBeGreaterThan(new Date(c2.createdAt).getTime());
+    });
+
+    test('recursive format should NOW have timestamp protection', async () => {
+      // Create a recursive LibreChat export with out-of-order timestamps
+      const jsonData = {
+        conversationId: 'recursive-test-123',
+        title: 'Recursive Test',
+        recursive: true,
+        messages: [
+          {
+            messageId: 'parent-1',
+            parentMessageId: Constants.NO_PARENT,
+            text: 'Parent Message',
+            sender: 'User',
+            isCreatedByUser: true,
+            createdAt: '2023-01-01T00:02:00Z', // Parent created AFTER child
+            children: [
+              {
+                messageId: 'child-1',
+                parentMessageId: 'parent-1',
+                text: 'Child Message',
+                sender: 'Assistant',
+                isCreatedByUser: false,
+                createdAt: '2023-01-01T00:01:00Z', // Child created BEFORE parent
+                children: [
+                  {
+                    messageId: 'grandchild-1',
+                    parentMessageId: 'child-1',
+                    text: 'Grandchild Message',
+                    sender: 'User',
+                    isCreatedByUser: true,
+                    createdAt: '2023-01-01T00:00:30Z', // Even earlier
+                    children: [],
+                  },
+                ],
+              },
+            ],
+          },
+        ],
+      };
+
+      const requestUserId = 'user-123';
+      const importBatchBuilder = new ImportBatchBuilder(requestUserId);
+
+      const importer = getImporter(jsonData);
+      await importer(jsonData, requestUserId, () => importBatchBuilder);
+
+      const savedMessages = importBatchBuilder.messages;
+
+      // Messages should be saved
+      expect(savedMessages).toHaveLength(3);
+
+      // In recursive format, timestamps are NOT included in the saved messages
+      // The saveMessage method doesn't receive createdAt for recursive imports
+      const parent = savedMessages.find((msg) => msg.text === 'Parent Message');
+      const child = savedMessages.find((msg) => msg.text === 'Child Message');
+      const grandchild = savedMessages.find((msg) => msg.text === 'Grandchild Message');
+
+      expect(parent).toBeDefined();
+      expect(child).toBeDefined();
+      expect(grandchild).toBeDefined();
+
+      // Recursive imports NOW preserve and correct timestamps
+      expect(parent.createdAt).toBeDefined();
+      expect(child.createdAt).toBeDefined();
+      expect(grandchild.createdAt).toBeDefined();
+
+      // Timestamps should be corrected to maintain proper order
+      expect(new Date(child.createdAt).getTime()).toBeGreaterThan(
+        new Date(parent.createdAt).getTime(),
+      );
+      expect(new Date(grandchild.createdAt).getTime()).toBeGreaterThan(
+        new Date(child.createdAt).getTime(),
+      );
+    });
+  });
+
+  describe('Comparison with Fork Functionality', () => {
+    test('fork functionality correctly handles timestamp issues (for comparison)', async () => {
+      const { cloneMessagesWithTimestamps } = require('./fork');
+
+      const messagesToClone = [
+        {
+          messageId: 'parent',
+          parentMessageId: Constants.NO_PARENT,
+          text: 'Parent Message',
+          createdAt: '2023-01-01T00:02:00Z', // Parent created AFTER child
+        },
+        {
+          messageId: 'child',
+          parentMessageId: 'parent',
+          text: 'Child Message',
+          createdAt: '2023-01-01T00:01:00Z', // Child created BEFORE parent
+        },
+      ];
+
+      const importBatchBuilder = new ImportBatchBuilder('user-123');
+      jest.spyOn(importBatchBuilder, 'saveMessage');
+
+      cloneMessagesWithTimestamps(messagesToClone, importBatchBuilder);
+
+      const savedMessages = importBatchBuilder.messages;
+      const parent = savedMessages.find((msg) => msg.text === 'Parent Message');
+      const child = savedMessages.find((msg) => msg.text === 'Child Message');
+
+      // Fork functionality DOES correct the timestamps
+      expect(new Date(child.createdAt).getTime()).toBeGreaterThan(
+        new Date(parent.createdAt).getTime(),
+      );
+    });
+  });
+});

api/server/utils/import/importers.js

@@ -1,6 +1,7 @@
 const { v4: uuidv4 } = require('uuid');
 const { EModelEndpoint, Constants, openAISettings, CacheKeys } = require('librechat-data-provider');
 const { createImportBatchBuilder } = require('./importBatchBuilder');
+const { cloneMessagesWithTimestamps } = require('./fork');
 const getLogStores = require('~/cache/getLogStores');
 const logger = require('~/config/winston');
 
@@ -107,67 +108,47 @@ async function importLibreChatConvo(
 
     if (jsonData.recursive) {
       /**
-       * Recursively traverse the messages tree and save each message to the database.
+       * Flatten the recursive message tree into a flat array
        * @param {TMessage[]} messages
        * @param {string} parentMessageId
+       * @param {TMessage[]} flatMessages
        */
-      const traverseMessages = async (messages, parentMessageId = null) => {
+      const flattenMessages = (
+        messages,
+        parentMessageId = Constants.NO_PARENT,
+        flatMessages = [],
+      ) => {
         for (const message of messages) {
           if (!message.text && !message.content) {
             continue;
           }
 
-          let savedMessage;
-          if (message.sender?.toLowerCase() === 'user' || message.isCreatedByUser) {
-            savedMessage = await importBatchBuilder.saveMessage({
-              text: message.text,
-              content: message.content,
-              sender: 'user',
-              isCreatedByUser: true,
-              parentMessageId: parentMessageId,
-            });
-          } else {
-            savedMessage = await importBatchBuilder.saveMessage({
-              text: message.text,
-              content: message.content,
-              sender: message.sender,
-              isCreatedByUser: false,
-              model: options.model,
-              parentMessageId: parentMessageId,
-            });
-          }
+          const flatMessage = {
+            ...message,
+            parentMessageId: parentMessageId,
+            children: undefined, // Remove children from flat structure
+          };
+          flatMessages.push(flatMessage);
 
           if (!firstMessageDate && message.createdAt) {
             firstMessageDate = new Date(message.createdAt);
           }
 
           if (message.children && message.children.length > 0) {
-            await traverseMessages(message.children, savedMessage.messageId);
+            flattenMessages(message.children, message.messageId, flatMessages);
           }
         }
+        return flatMessages;
       };
 
-      await traverseMessages(messagesToImport);
+      const flatMessages = flattenMessages(messagesToImport);
+      cloneMessagesWithTimestamps(flatMessages, importBatchBuilder);
     } else if (messagesToImport) {
-      const idMapping = new Map();
-
+      cloneMessagesWithTimestamps(messagesToImport, importBatchBuilder);
       for (const message of messagesToImport) {
         if (!firstMessageDate && message.createdAt) {
           firstMessageDate = new Date(message.createdAt);
         }
-        const newMessageId = uuidv4();
-        idMapping.set(message.messageId, newMessageId);
-
-        const clonedMessage = {
-          ...message,
-          messageId: newMessageId,
-          parentMessageId:
-            message.parentMessageId && message.parentMessageId !== Constants.NO_PARENT
-              ? idMapping.get(message.parentMessageId) || Constants.NO_PARENT
-              : Constants.NO_PARENT,
-        };
-
-        importBatchBuilder.saveMessage(clonedMessage);
       }
     } else {
       throw new Error('Invalid LibreChat file format');

api/server/utils/import/importers.spec.js

@@ -175,36 +175,60 @@ describe('importLibreChatConvo', () => {
     jest.spyOn(importBatchBuilder, 'saveMessage');
     jest.spyOn(importBatchBuilder, 'saveBatch');
 
-    // When
     const importer = getImporter(jsonData);
     await importer(jsonData, requestUserId, () => importBatchBuilder);
 
-    // Create a map to track original message IDs to new UUIDs
-    const idToUUIDMap = new Map();
-    importBatchBuilder.saveMessage.mock.calls.forEach((call) => {
-      const message = call[0];
-      idToUUIDMap.set(message.originalMessageId, message.messageId);
+    // Get the imported messages
+    const messages = importBatchBuilder.messages;
+    expect(messages.length).toBeGreaterThan(0);
+
+    // Build maps for verification
+    const textToMessageMap = new Map();
+    const messageIdToMessage = new Map();
+    messages.forEach((msg) => {
+      if (msg.text) {
+        // For recursive imports, text might be very long, so just use the first 100 chars as key
+        const textKey = msg.text.substring(0, 100);
+        textToMessageMap.set(textKey, msg);
+      }
+      messageIdToMessage.set(msg.messageId, msg);
     });
 
-    const checkChildren = (children, parentId) => {
-      children.forEach((child) => {
-        const childUUID = idToUUIDMap.get(child.messageId);
-        const expectedParentId = idToUUIDMap.get(parentId) ?? null;
-        const messageCall = importBatchBuilder.saveMessage.mock.calls.find(
-          (call) => call[0].messageId === childUUID,
-        );
-
-        const actualParentId = messageCall[0].parentMessageId;
-        expect(actualParentId).toBe(expectedParentId);
-
-        if (child.children && child.children.length > 0) {
-          checkChildren(child.children, child.messageId);
+    // Count expected messages from the tree
+    const countMessagesInTree = (nodes) => {
+      let count = 0;
+      nodes.forEach((node) => {
+        if (node.text || node.content) {
+          count++;
+        }
+        if (node.children && node.children.length > 0) {
+          count += countMessagesInTree(node.children);
         }
       });
+      return count;
     };
 
-    // Start hierarchy validation from root messages
-    checkChildren(jsonData.messages, null);
+    const expectedMessageCount = countMessagesInTree(jsonData.messages);
+    expect(messages.length).toBe(expectedMessageCount);
+
+    // Verify all messages have valid parent relationships
+    messages.forEach((msg) => {
+      if (msg.parentMessageId !== Constants.NO_PARENT) {
+        const parent = messageIdToMessage.get(msg.parentMessageId);
+        expect(parent).toBeDefined();
+
+        // Verify timestamp ordering
+        if (msg.createdAt && parent.createdAt) {
+          expect(new Date(msg.createdAt).getTime()).toBeGreaterThanOrEqual(
+            new Date(parent.createdAt).getTime(),
+          );
+        }
+      }
+    });
+
+    // Verify at least one root message exists
+    const rootMessages = messages.filter((msg) => msg.parentMessageId === Constants.NO_PARENT);
+    expect(rootMessages.length).toBeGreaterThan(0);
 
     expect(importBatchBuilder.saveBatch).toHaveBeenCalled();
   });

api/strategies/openIdJwtStrategy.js

@@ -1,4 +1,5 @@
 const { SystemRoles } = require('librechat-data-provider');
+const { HttpsProxyAgent } = require('https-proxy-agent');
 const { Strategy: JwtStrategy, ExtractJwt } = require('passport-jwt');
 const { updateUser, findUser } = require('~/models');
 const { logger } = require('~/config');
@@ -13,17 +14,23 @@ const { isEnabled } = require('~/server/utils');
  * The strategy extracts the JWT from the Authorization header as a Bearer token.
  * The JWT is then verified using the signing key, and the user is retrieved from the database.
  */
-const openIdJwtLogin = (openIdConfig) =>
-  new JwtStrategy(
+const openIdJwtLogin = (openIdConfig) => {
+  let jwksRsaOptions = {
+    cache: isEnabled(process.env.OPENID_JWKS_URL_CACHE_ENABLED) || true,
+    cacheMaxAge: process.env.OPENID_JWKS_URL_CACHE_TIME
+      ? eval(process.env.OPENID_JWKS_URL_CACHE_TIME)
+      : 60000,
+    jwksUri: openIdConfig.serverMetadata().jwks_uri,
+  };
+
+  if (process.env.PROXY) {
+    jwksRsaOptions.requestAgent = new HttpsProxyAgent(process.env.PROXY);
+  }
+
+  return new JwtStrategy(
     {
       jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
-      secretOrKeyProvider: jwksRsa.passportJwtSecret({
-        cache: isEnabled(process.env.OPENID_JWKS_URL_CACHE_ENABLED) || true,
-        cacheMaxAge: process.env.OPENID_JWKS_URL_CACHE_TIME
-          ? eval(process.env.OPENID_JWKS_URL_CACHE_TIME)
-          : 60000,
-        jwksUri: openIdConfig.serverMetadata().jwks_uri,
-      }),
+      secretOrKeyProvider: jwksRsa.passportJwtSecret(jwksRsaOptions),
     },
     async (payload, done) => {
       try {
@@ -48,5 +55,6 @@ const openIdJwtLogin = (openIdConfig) =>
       }
     },
   );
+};
 
 module.exports = openIdJwtLogin;

api/strategies/openidStrategy.js

@@ -49,7 +49,7 @@ async function customFetch(url, options) {
       logger.info(`[openidStrategy] proxy agent configured: ${process.env.PROXY}`);
       fetchOptions = {
         ...options,
-        dispatcher: new HttpsProxyAgent(process.env.PROXY),
+        dispatcher: new undici.ProxyAgent(process.env.PROXY),
       };
     }
 
@@ -365,7 +365,6 @@ async function setupOpenId() {
               email: userinfo.email || '',
               emailVerified: userinfo.email_verified || false,
               name: fullName,
-              idOnTheSource: userinfo.oid,
             };
 
             const balanceConfig = await getBalanceConfig();
@@ -376,7 +375,6 @@ async function setupOpenId() {
             user.openidId = userinfo.sub;
             user.username = username;
             user.name = fullName;
-            user.idOnTheSource = userinfo.oid;
           }
 
           if (!!userinfo && userinfo.picture && !user.avatar?.includes('manual=true')) {

client/package.json

@@ -1,10 +1,9 @@
 {
   "name": "@librechat/frontend",
-  "version": "v0.7.8",
+  "version": "v0.7.9-rc1",
   "description": "",
   "type": "module",
   "scripts": {
-    "typecheck": "tsc --noEmit",
     "data-provider": "cd .. && npm run build:data-provider",
     "build:file": "cross-env NODE_ENV=production vite build --debug > vite-output.log 2>&1",
     "build": "cross-env NODE_ENV=production vite build && node ./scripts/post-build.cjs",

client/src/Providers/AgentPanelContext.tsx

@@ -1,9 +1,9 @@
 import React, { createContext, useContext, useState } from 'react';
 import { Constants, EModelEndpoint } from 'librechat-data-provider';
-import type { TPlugin, AgentToolType, Action, MCP } from 'librechat-data-provider';
+import type { MCP, Action, TPlugin, AgentToolType } from 'librechat-data-provider';
 import type { AgentPanelContextType } from '~/common';
 import { useAvailableToolsQuery, useGetActionsQuery } from '~/data-provider';
-import { useLocalize } from '~/hooks';
+import { useLocalize, useGetAgentsConfig } from '~/hooks';
 import { Panel } from '~/common';
 
 const AgentPanelContext = createContext<AgentPanelContextType | undefined>(undefined);
@@ -75,21 +75,25 @@ export function AgentPanelProvider({ children }: { children: React.ReactNode })
     {} as Record<string, AgentToolType & { tools?: AgentToolType[] }>,
   );
 
-  const value = {
-    action,
-    setAction,
+  const { agentsConfig, endpointsConfig } = useGetAgentsConfig();
+
+  const value: AgentPanelContextType = {
     mcp,
-    setMcp,
     mcps,
-    setMcps,
-    activePanel,
-    setActivePanel,
-    setCurrentAgentId,
-    agent_id,
-    groupedTools,
     /** Query data for actions and tools */
-    actions,
     tools,
+    action,
+    setMcp,
+    actions,
+    setMcps,
+    agent_id,
+    setAction,
+    activePanel,
+    groupedTools,
+    agentsConfig,
+    setActivePanel,
+    endpointsConfig,
+    setCurrentAgentId,
   };
 
   return <AgentPanelContext.Provider value={value}>{children}</AgentPanelContext.Provider>;

client/src/Providers/BadgeRowContext.tsx

@@ -1,14 +1,25 @@
-import React, { createContext, useContext } from 'react';
-import { Tools, LocalStorageKeys } from 'librechat-data-provider';
-import { useMCPSelect, useToolToggle, useCodeApiKeyForm, useSearchApiKeyForm } from '~/hooks';
+import React, { createContext, useContext, useEffect, useRef } from 'react';
+import { useSetRecoilState } from 'recoil';
+import { Tools, Constants, LocalStorageKeys, AgentCapabilities } from 'librechat-data-provider';
+import type { TAgentsEndpoint } from 'librechat-data-provider';
+import {
+  useSearchApiKeyForm,
+  useGetAgentsConfig,
+  useCodeApiKeyForm,
+  useToolToggle,
+  useMCPSelect,
+} from '~/hooks';
 import { useGetStartupConfig } from '~/data-provider';
+import { ephemeralAgentByConvoId } from '~/store';
 
 interface BadgeRowContextType {
   conversationId?: string | null;
+  agentsConfig?: TAgentsEndpoint | null;
   mcpSelect: ReturnType<typeof useMCPSelect>;
   webSearch: ReturnType<typeof useToolToggle>;
-  codeInterpreter: ReturnType<typeof useToolToggle>;
+  artifacts: ReturnType<typeof useToolToggle>;
   fileSearch: ReturnType<typeof useToolToggle>;
+  codeInterpreter: ReturnType<typeof useToolToggle>;
   codeApiKeyForm: ReturnType<typeof useCodeApiKeyForm>;
   searchApiKeyForm: ReturnType<typeof useSearchApiKeyForm>;
   startupConfig: ReturnType<typeof useGetStartupConfig>['data'];
@@ -26,10 +37,88 @@ export function useBadgeRowContext() {
 
 interface BadgeRowProviderProps {
   children: React.ReactNode;
+  isSubmitting?: boolean;
   conversationId?: string | null;
 }
 
-export default function BadgeRowProvider({ children, conversationId }: BadgeRowProviderProps) {
+export default function BadgeRowProvider({
+  children,
+  isSubmitting,
+  conversationId,
+}: BadgeRowProviderProps) {
+  const hasInitializedRef = useRef(false);
+  const lastKeyRef = useRef<string>('');
+  const { agentsConfig } = useGetAgentsConfig();
+  const key = conversationId ?? Constants.NEW_CONVO;
+  const setEphemeralAgent = useSetRecoilState(ephemeralAgentByConvoId(key));
+
+  /** Initialize ephemeralAgent from localStorage on mount and when conversation changes */
+  useEffect(() => {
+    if (isSubmitting) {
+      return;
+    }
+    // Check if this is a new conversation or the first load
+    if (!hasInitializedRef.current || lastKeyRef.current !== key) {
+      hasInitializedRef.current = true;
+      lastKeyRef.current = key;
+
+      // Load all localStorage values
+      const codeToggleKey = `${LocalStorageKeys.LAST_CODE_TOGGLE_}${key}`;
+      const webSearchToggleKey = `${LocalStorageKeys.LAST_WEB_SEARCH_TOGGLE_}${key}`;
+      const fileSearchToggleKey = `${LocalStorageKeys.LAST_FILE_SEARCH_TOGGLE_}${key}`;
+      const artifactsToggleKey = `${LocalStorageKeys.LAST_ARTIFACTS_TOGGLE_}${key}`;
+
+      const codeToggleValue = localStorage.getItem(codeToggleKey);
+      const webSearchToggleValue = localStorage.getItem(webSearchToggleKey);
+      const fileSearchToggleValue = localStorage.getItem(fileSearchToggleKey);
+      const artifactsToggleValue = localStorage.getItem(artifactsToggleKey);
+
+      const initialValues: Record<string, any> = {};
+
+      if (codeToggleValue !== null) {
+        try {
+          initialValues[Tools.execute_code] = JSON.parse(codeToggleValue);
+        } catch (e) {
+          console.error('Failed to parse code toggle value:', e);
+        }
+      }
+
+      if (webSearchToggleValue !== null) {
+        try {
+          initialValues[Tools.web_search] = JSON.parse(webSearchToggleValue);
+        } catch (e) {
+          console.error('Failed to parse web search toggle value:', e);
+        }
+      }
+
+      if (fileSearchToggleValue !== null) {
+        try {
+          initialValues[Tools.file_search] = JSON.parse(fileSearchToggleValue);
+        } catch (e) {
+          console.error('Failed to parse file search toggle value:', e);
+        }
+      }
+
+      if (artifactsToggleValue !== null) {
+        try {
+          initialValues[AgentCapabilities.artifacts] = JSON.parse(artifactsToggleValue);
+        } catch (e) {
+          console.error('Failed to parse artifacts toggle value:', e);
+        }
+      }
+
+      // Always set values for all tools (use defaults if not in localStorage)
+      // If ephemeralAgent is null, create a new object with just our tool values
+      setEphemeralAgent((prev) => ({
+        ...(prev || {}),
+        [Tools.execute_code]: initialValues[Tools.execute_code] ?? false,
+        [Tools.web_search]: initialValues[Tools.web_search] ?? false,
+        [Tools.file_search]: initialValues[Tools.file_search] ?? false,
+        [AgentCapabilities.artifacts]: initialValues[AgentCapabilities.artifacts] ?? false,
+      }));
+    }
+  }, [key, isSubmitting, setEphemeralAgent]);
+
   /** Startup config */
   const { data: startupConfig } = useGetStartupConfig();
 
@@ -74,10 +163,20 @@ export default function BadgeRowProvider({ children, conversationId }: BadgeRowP
     isAuthenticated: true,
   });
 
+  /** Artifacts hook - using a custom key since it's not a Tool but a capability */
+  const artifacts = useToolToggle({
+    conversationId,
+    toolKey: AgentCapabilities.artifacts,
+    localStorageKey: LocalStorageKeys.LAST_ARTIFACTS_TOGGLE_,
+    isAuthenticated: true,
+  });
+
   const value: BadgeRowContextType = {
     mcpSelect,
     webSearch,
+    artifacts,
     fileSearch,
+    agentsConfig,
     startupConfig,
     conversationId,
     codeApiKeyForm,

client/src/common/agents-types.ts

@@ -1,10 +1,5 @@
 import { AgentCapabilities, ArtifactModes } from 'librechat-data-provider';
-import type {
-  Agent,
-  AgentProvider,
-  AgentModelParameters,
-  SupportContact,
-} from 'librechat-data-provider';
+import type { Agent, AgentProvider, AgentModelParameters } from 'librechat-data-provider';
 import type { OptionWithIcon, ExtendedFile } from './types';
 
 export type TAgentOption = OptionWithIcon &
@@ -12,7 +7,6 @@ export type TAgentOption = OptionWithIcon &
     knowledge_files?: Array<[string, ExtendedFile]>;
     context_files?: Array<[string, ExtendedFile]>;
     code_files?: Array<[string, ExtendedFile]>;
-    _id?: string;
   };
 
 export type TAgentCapabilities = {
@@ -36,6 +30,4 @@ export type AgentForm = {
   agent_ids?: string[];
   [AgentCapabilities.artifacts]?: ArtifactModes | string;
   recursion_limit?: number;
-  support_contact?: SupportContact;
-  category: string;
 } & TAgentCapabilities;

client/src/common/types.ts

@@ -206,9 +206,7 @@ export type AgentPanelProps = {
   setActivePanel: React.Dispatch<React.SetStateAction<Panel>>;
   setMcp: React.Dispatch<React.SetStateAction<t.MCP | undefined>>;
   setAction: React.Dispatch<React.SetStateAction<t.Action | undefined>>;
-  endpointsConfig?: t.TEndpointsConfig;
   setCurrentAgentId: React.Dispatch<React.SetStateAction<string | undefined>>;
-  agentsConfig?: t.TAgentsEndpoint | null;
 };
 
 export type AgentPanelContextType = {
@@ -225,6 +223,8 @@ export type AgentPanelContextType = {
   setCurrentAgentId: React.Dispatch<React.SetStateAction<string | undefined>>;
   groupedTools?: Record<string, t.AgentToolType & { tools?: t.AgentToolType[] }>;
   agent_id?: string;
+  agentsConfig?: t.TAgentsEndpoint | null;
+  endpointsConfig?: t.TEndpointsConfig | null;
 };
 
 export type AgentModelPanelProps = {
@@ -336,6 +336,11 @@ export type TAskProps = {
 export type TOptions = {
   editedMessageId?: string | null;
   editedText?: string | null;
+  editedContent?: {
+    index: number;
+    text: string;
+    type: 'text' | 'think';
+  };
   isRegenerate?: boolean;
   isContinued?: boolean;
   isEdited?: boolean;

client/src/components/Chat/Header.tsx

@@ -16,7 +16,6 @@ const defaultInterface = getConfigDefaults().interface;
 export default function Header() {
   const { data: startupConfig } = useGetStartupConfig();
   const { navVisible, setNavVisible } = useOutletContext<ContextType>();
-
   const interfaceConfig = useMemo(
     () => startupConfig?.interface ?? defaultInterface,
     [startupConfig],

client/src/components/Chat/Input/Artifacts.tsx

@@ -0,0 +1,152 @@
+import React, { memo, useState, useCallback, useMemo } from 'react';
+import * as Ariakit from '@ariakit/react';
+import { ArtifactModes } from 'librechat-data-provider';
+import { WandSparkles, ChevronDown } from 'lucide-react';
+import CheckboxButton from '~/components/ui/CheckboxButton';
+import { useBadgeRowContext } from '~/Providers';
+import { useLocalize } from '~/hooks';
+import { cn } from '~/utils';
+
+interface ArtifactsToggleState {
+  enabled: boolean;
+  mode: string;
+}
+
+function Artifacts() {
+  const localize = useLocalize();
+  const { artifacts } = useBadgeRowContext();
+  const { toggleState, debouncedChange, isPinned } = artifacts;
+
+  const [isPopoverOpen, setIsPopoverOpen] = useState(false);
+
+  const currentState = useMemo<ArtifactsToggleState>(() => {
+    if (typeof toggleState === 'string' && toggleState) {
+      return { enabled: true, mode: toggleState };
+    }
+    return { enabled: false, mode: '' };
+  }, [toggleState]);
+
+  const isEnabled = currentState.enabled;
+  const isShadcnEnabled = currentState.mode === ArtifactModes.SHADCNUI;
+  const isCustomEnabled = currentState.mode === ArtifactModes.CUSTOM;
+
+  const handleToggle = useCallback(() => {
+    if (isEnabled) {
+      debouncedChange({ value: '' });
+    } else {
+      debouncedChange({ value: ArtifactModes.DEFAULT });
+    }
+  }, [isEnabled, debouncedChange]);
+
+  const handleShadcnToggle = useCallback(() => {
+    if (isShadcnEnabled) {
+      debouncedChange({ value: ArtifactModes.DEFAULT });
+    } else {
+      debouncedChange({ value: ArtifactModes.SHADCNUI });
+    }
+  }, [isShadcnEnabled, debouncedChange]);
+
+  const handleCustomToggle = useCallback(() => {
+    if (isCustomEnabled) {
+      debouncedChange({ value: ArtifactModes.DEFAULT });
+    } else {
+      debouncedChange({ value: ArtifactModes.CUSTOM });
+    }
+  }, [isCustomEnabled, debouncedChange]);
+
+  if (!isEnabled && !isPinned) {
+    return null;
+  }
+
+  return (
+    <div className="flex">
+      <CheckboxButton
+        className={cn('max-w-fit', isEnabled && 'rounded-r-none border-r-0')}
+        checked={isEnabled}
+        setValue={handleToggle}
+        label={localize('com_ui_artifacts')}
+        isCheckedClassName="border-amber-600/40 bg-amber-500/10 hover:bg-amber-700/10"
+        icon={<WandSparkles className="icon-md" />}
+      />
+
+      {isEnabled && (
+        <Ariakit.MenuProvider open={isPopoverOpen} setOpen={setIsPopoverOpen}>
+          <Ariakit.MenuButton
+            className={cn(
+              'w-7 rounded-l-none rounded-r-full border-b border-l-0 border-r border-t border-border-light md:w-6',
+              'border-amber-600/40 bg-amber-500/10 hover:bg-amber-700/10',
+              'transition-colors',
+            )}
+            onClick={(e) => e.stopPropagation()}
+          >
+            <ChevronDown className="ml-1 h-4 w-4 text-text-secondary md:ml-0" />
+          </Ariakit.MenuButton>
+
+          <Ariakit.Menu
+            gutter={8}
+            className={cn(
+              'animate-popover z-50 flex max-h-[300px]',
+              'flex-col overflow-auto overscroll-contain rounded-xl',
+              'bg-surface-secondary px-1.5 py-1 text-text-primary shadow-lg',
+              'border border-border-light',
+              'min-w-[250px] outline-none',
+            )}
+            portal
+          >
+            <div className="px-2 py-1.5">
+              <div className="mb-2 text-xs font-medium text-text-secondary">
+                {localize('com_ui_artifacts_options')}
+              </div>
+
+              {/* Include shadcn/ui Option */}
+              <Ariakit.MenuItem
+                hideOnClick={false}
+                onClick={(event) => {
+                  event.preventDefault();
+                  event.stopPropagation();
+                  handleShadcnToggle();
+                }}
+                disabled={isCustomEnabled}
+                className={cn(
+                  'mb-1 flex items-center justify-between rounded-lg px-2 py-2',
+                  'cursor-pointer outline-none transition-colors',
+                  'hover:bg-black/[0.075] dark:hover:bg-white/10',
+                  'data-[active-item]:bg-black/[0.075] dark:data-[active-item]:bg-white/10',
+                  isCustomEnabled && 'cursor-not-allowed opacity-50',
+                )}
+              >
+                <div className="flex items-center gap-2">
+                  <Ariakit.MenuItemCheck checked={isShadcnEnabled} />
+                  <span className="text-sm">{localize('com_ui_include_shadcnui' as any)}</span>
+                </div>
+              </Ariakit.MenuItem>
+
+              {/* Custom Prompt Mode Option */}
+              <Ariakit.MenuItem
+                hideOnClick={false}
+                onClick={(event) => {
+                  event.preventDefault();
+                  event.stopPropagation();
+                  handleCustomToggle();
+                }}
+                className={cn(
+                  'flex items-center justify-between rounded-lg px-2 py-2',
+                  'cursor-pointer outline-none transition-colors',
+                  'hover:bg-black/[0.075] dark:hover:bg-white/10',
+                  'data-[active-item]:bg-black/[0.075] dark:data-[active-item]:bg-white/10',
+                )}
+              >
+                <div className="flex items-center gap-2">
+                  <Ariakit.MenuItemCheck checked={isCustomEnabled} />
+                  <span className="text-sm">{localize('com_ui_custom_prompt_mode' as any)}</span>
+                </div>
+              </Ariakit.MenuItem>
+            </div>
+          </Ariakit.Menu>
+        </Ariakit.MenuProvider>
+      )}
+    </div>
+  );
+}
+
+export default memo(Artifacts);

client/src/components/Chat/Input/ArtifactsSubMenu.tsx

@@ -0,0 +1,147 @@
+import React from 'react';
+import * as Ariakit from '@ariakit/react';
+import { ChevronRight, WandSparkles } from 'lucide-react';
+import { ArtifactModes } from 'librechat-data-provider';
+import { PinIcon } from '~/components/svg';
+import { useLocalize } from '~/hooks';
+import { cn } from '~/utils';
+
+interface ArtifactsSubMenuProps {
+  isArtifactsPinned: boolean;
+  setIsArtifactsPinned: (value: boolean) => void;
+  artifactsMode: string;
+  handleArtifactsToggle: () => void;
+  handleShadcnToggle: () => void;
+  handleCustomToggle: () => void;
+}
+
+const ArtifactsSubMenu = ({
+  isArtifactsPinned,
+  setIsArtifactsPinned,
+  artifactsMode,
+  handleArtifactsToggle,
+  handleShadcnToggle,
+  handleCustomToggle,
+  ...props
+}: ArtifactsSubMenuProps) => {
+  const localize = useLocalize();
+
+  const menuStore = Ariakit.useMenuStore({
+    focusLoop: true,
+    showTimeout: 100,
+    placement: 'right',
+  });
+
+  const isEnabled = artifactsMode !== '' && artifactsMode !== undefined;
+  const isShadcnEnabled = artifactsMode === ArtifactModes.SHADCNUI;
+  const isCustomEnabled = artifactsMode === ArtifactModes.CUSTOM;
+
+  return (
+    <Ariakit.MenuProvider store={menuStore}>
+      <Ariakit.MenuItem
+        {...props}
+        hideOnClick={false}
+        render={
+          <Ariakit.MenuButton
+            onClick={(e: React.MouseEvent<HTMLButtonElement>) => {
+              e.stopPropagation();
+              handleArtifactsToggle();
+            }}
+            onMouseEnter={() => {
+              if (isEnabled) {
+                menuStore.show();
+              }
+            }}
+            className="flex w-full cursor-pointer items-center justify-between rounded-lg p-2 hover:bg-surface-hover"
+          />
+        }
+      >
+        <div className="flex items-center gap-2">
+          <WandSparkles className="icon-md" />
+          <span>{localize('com_ui_artifacts')}</span>
+          {isEnabled && <ChevronRight className="ml-auto h-3 w-3" />}
+        </div>
+        <button
+          type="button"
+          onClick={(e) => {
+            e.stopPropagation();
+            setIsArtifactsPinned(!isArtifactsPinned);
+          }}
+          className={cn(
+            'rounded p-1 transition-all duration-200',
+            'hover:bg-surface-tertiary hover:shadow-sm',
+            !isArtifactsPinned && 'text-text-secondary hover:text-text-primary',
+          )}
+          aria-label={isArtifactsPinned ? 'Unpin' : 'Pin'}
+        >
+          <div className="h-4 w-4">
+            <PinIcon unpin={isArtifactsPinned} />
+          </div>
+        </button>
+      </Ariakit.MenuItem>
+
+      {isEnabled && (
+        <Ariakit.Menu
+          portal={true}
+          unmountOnHide={true}
+          className={cn(
+            'animate-popover-left z-50 ml-3 flex min-w-[250px] flex-col rounded-xl',
+            'border border-border-light bg-surface-secondary px-1.5 py-1 shadow-lg',
+          )}
+        >
+          <div className="px-2 py-1.5">
+            <div className="mb-2 text-xs font-medium text-text-secondary">
+              {localize('com_ui_artifacts_options')}
+            </div>
+
+            {/* Include shadcn/ui Option */}
+            <Ariakit.MenuItem
+              hideOnClick={false}
+              onClick={(event) => {
+                event.preventDefault();
+                event.stopPropagation();
+                handleShadcnToggle();
+              }}
+              disabled={isCustomEnabled}
+              className={cn(
+                'mb-1 flex items-center justify-between rounded-lg px-2 py-2',
+                'cursor-pointer text-text-primary outline-none transition-colors',
+                'hover:bg-black/[0.075] dark:hover:bg-white/10',
+                'data-[active-item]:bg-black/[0.075] dark:data-[active-item]:bg-white/10',
+                isCustomEnabled && 'cursor-not-allowed opacity-50',
+              )}
+            >
+              <div className="flex items-center gap-2">
+                <Ariakit.MenuItemCheck checked={isShadcnEnabled} />
+                <span className="text-sm">{localize('com_ui_include_shadcnui' as any)}</span>
+              </div>
+            </Ariakit.MenuItem>
+
+            {/* Custom Prompt Mode Option */}
+            <Ariakit.MenuItem
+              hideOnClick={false}
+              onClick={(event) => {
+                event.preventDefault();
+                event.stopPropagation();
+                handleCustomToggle();
+              }}
+              className={cn(
+                'flex items-center justify-between rounded-lg px-2 py-2',
+                'cursor-pointer text-text-primary outline-none transition-colors',
+                'hover:bg-black/[0.075] dark:hover:bg-white/10',
+                'data-[active-item]:bg-black/[0.075] dark:data-[active-item]:bg-white/10',
+              )}
+            >
+              <div className="flex items-center gap-2">
+                <Ariakit.MenuItemCheck checked={isCustomEnabled} />
+                <span className="text-sm">{localize('com_ui_custom_prompt_mode' as any)}</span>
+              </div>
+            </Ariakit.MenuItem>
+          </div>
+        </Ariakit.Menu>
+      )}
+    </Ariakit.MenuProvider>
+  );
+};
+
+export default React.memo(ArtifactsSubMenu);

client/src/components/Chat/Input/BadgeRow.tsx

@@ -18,6 +18,7 @@ import { useChatBadges } from '~/hooks';
 import { Badge } from '~/components/ui';
 import ToolDialogs from './ToolDialogs';
 import FileSearch from './FileSearch';
+import Artifacts from './Artifacts';
 import MCPSelect from './MCPSelect';
 import WebSearch from './WebSearch';
 import store from '~/store';
@@ -27,6 +28,7 @@ interface BadgeRowProps {
   onChange: (badges: Pick<BadgeItem, 'id'>[]) => void;
   onToggle?: (badgeId: string, currentActive: boolean) => void;
   conversationId?: string | null;
+  isSubmitting?: boolean;
   isInChat: boolean;
 }
 
@@ -140,6 +142,7 @@ const dragReducer = (state: DragState, action: DragAction): DragState => {
 function BadgeRow({
   showEphemeralBadges,
   conversationId,
+  isSubmitting,
   onChange,
   onToggle,
   isInChat,
@@ -317,7 +320,7 @@ function BadgeRow({
   }, [dragState.draggedBadge, handleMouseMove, handleMouseUp]);
 
   return (
-    <BadgeRowProvider conversationId={conversationId}>
+    <BadgeRowProvider conversationId={conversationId} isSubmitting={isSubmitting}>
       <div ref={containerRef} className="relative flex flex-wrap items-center gap-2">
         {showEphemeralBadges === true && <ToolsDropdown />}
         {tempBadges.map((badge, index) => (
@@ -364,6 +367,7 @@ function BadgeRow({
             <WebSearch />
             <CodeInterpreter />
             <FileSearch />
+            <Artifacts />
             <MCPSelect />
           </>
         )}

client/src/components/Chat/Input/ChatForm.tsx

@@ -305,6 +305,7 @@ const ChatForm = memo(({ index = 0 }: { index?: number }) => {
               </div>
               <BadgeRow
                 showEphemeralBadges={!isAgentsEndpoint(endpoint) && !isAssistantsEndpoint(endpoint)}
+                isSubmitting={isSubmitting || isSubmittingAdded}
                 conversationId={conversationId}
                 onChange={setBadges}
                 isInChat={

client/src/components/Chat/Input/Files/AttachFileChat.tsx

@@ -4,18 +4,21 @@ import {
   supportsFiles,
   mergeFileConfig,
   isAgentsEndpoint,
+  isAssistantsEndpoint,
   fileConfig as defaultFileConfig,
 } from 'librechat-data-provider';
 import type { EndpointFileConfig } from 'librechat-data-provider';
 import { useGetFileConfig } from '~/data-provider';
 import AttachFileMenu from './AttachFileMenu';
 import { useChatContext } from '~/Providers';
+import AttachFile from './AttachFile';
 
 function AttachFileChat({ disableInputs }: { disableInputs: boolean }) {
   const { conversation } = useChatContext();
   const conversationId = conversation?.conversationId ?? Constants.NEW_CONVO;
   const { endpoint, endpointType } = conversation ?? { endpoint: null };
   const isAgents = useMemo(() => isAgentsEndpoint(endpoint), [endpoint]);
+  const isAssistants = useMemo(() => isAssistantsEndpoint(endpoint), [endpoint]);
 
   const { data: fileConfig = defaultFileConfig } = useGetFileConfig({
     select: (data) => mergeFileConfig(data),
@@ -25,7 +28,9 @@ function AttachFileChat({ disableInputs }: { disableInputs: boolean }) {
   const endpointSupportsFiles: boolean = supportsFiles[endpointType ?? endpoint ?? ''] ?? false;
   const isUploadDisabled = (disableInputs || endpointFileConfig?.disabled) ?? false;
 
-  if (isAgents || (endpointSupportsFiles && !isUploadDisabled)) {
+  if (isAssistants && endpointSupportsFiles && !isUploadDisabled) {
+    return <AttachFile disabled={disableInputs} />;
+  } else if (isAgents || (endpointSupportsFiles && !isUploadDisabled)) {
     return (
       <AttachFileMenu
         disabled={disableInputs}
@@ -34,7 +39,6 @@ function AttachFileChat({ disableInputs }: { disableInputs: boolean }) {
       />
     );
   }
-
   return null;
 }
 

client/src/components/Chat/Input/Files/AttachFileMenu.tsx

@@ -2,11 +2,10 @@ import { useSetRecoilState } from 'recoil';
 import * as Ariakit from '@ariakit/react';
 import React, { useRef, useState, useMemo } from 'react';
 import { FileSearch, ImageUpIcon, TerminalSquareIcon, FileType2Icon } from 'lucide-react';
+import { EToolResources, EModelEndpoint, defaultAgentCapabilities } from 'librechat-data-provider';
 import type { EndpointFileConfig } from 'librechat-data-provider';
+import { useLocalize, useGetAgentsConfig, useFileHandling, useAgentCapabilities } from '~/hooks';
 import { FileUpload, TooltipAnchor, DropdownPopup, AttachmentIcon } from '~/components';
-import { EToolResources, EModelEndpoint } from 'librechat-data-provider';
-import { useGetEndpointsQuery } from '~/data-provider';
-import { useLocalize, useFileHandling } from '~/hooks';
 import { ephemeralAgentByConvoId } from '~/store';
 import { cn } from '~/utils';
 
@@ -23,20 +22,17 @@ const AttachFileMenu = ({ disabled, conversationId, endpointFileConfig }: Attach
   const [isPopoverActive, setIsPopoverActive] = useState(false);
   const setEphemeralAgent = useSetRecoilState(ephemeralAgentByConvoId(conversationId));
   const [toolResource, setToolResource] = useState<EToolResources | undefined>();
-  const { data: endpointsConfig } = useGetEndpointsQuery();
   const { handleFileChange } = useFileHandling({
     overrideEndpoint: EModelEndpoint.agents,
     overrideEndpointFileConfig: endpointFileConfig,
   });
 
+  const { agentsConfig } = useGetAgentsConfig();
   /** TODO: Ephemeral Agent Capabilities
    * Allow defining agent capabilities on a per-endpoint basis
    * Use definition for agents endpoint for ephemeral agents
    * */
-  const capabilities = useMemo(
-    () => endpointsConfig?.[EModelEndpoint.agents]?.capabilities ?? [],
-    [endpointsConfig],
-  );
+  const capabilities = useAgentCapabilities(agentsConfig?.capabilities ?? defaultAgentCapabilities);
 
   const handleUploadClick = (isImage?: boolean) => {
     if (!inputRef.current) {
@@ -60,7 +56,7 @@ const AttachFileMenu = ({ disabled, conversationId, endpointFileConfig }: Attach
       },
     ];
 
-    if (capabilities.includes(EToolResources.ocr)) {
+    if (capabilities.ocrEnabled) {
       items.push({
         label: localize('com_ui_upload_ocr_text'),
         onClick: () => {
@@ -71,7 +67,7 @@ const AttachFileMenu = ({ disabled, conversationId, endpointFileConfig }: Attach
       });
     }
 
-    if (capabilities.includes(EToolResources.file_search)) {
+    if (capabilities.fileSearchEnabled) {
       items.push({
         label: localize('com_ui_upload_file_search'),
         onClick: () => {
@@ -83,7 +79,7 @@ const AttachFileMenu = ({ disabled, conversationId, endpointFileConfig }: Attach
       });
     }
 
-    if (capabilities.includes(EToolResources.execute_code)) {
+    if (capabilities.codeEnabled) {
       items.push({
         label: localize('com_ui_upload_code_files'),
         onClick: () => {

client/src/components/Chat/Input/ToolsDropdown.tsx

@@ -2,11 +2,18 @@ import React, { useState, useMemo, useCallback } from 'react';
 import * as Ariakit from '@ariakit/react';
 import { Globe, Settings, Settings2, TerminalSquareIcon } from 'lucide-react';
 import type { MenuItemProps } from '~/common';
-import { Permissions, PermissionTypes, AuthType } from 'librechat-data-provider';
+import {
+  AuthType,
+  Permissions,
+  ArtifactModes,
+  PermissionTypes,
+  defaultAgentCapabilities,
+} from 'librechat-data-provider';
 import { TooltipAnchor, DropdownPopup } from '~/components';
+import { useLocalize, useHasAccess, useAgentCapabilities } from '~/hooks';
+import ArtifactsSubMenu from '~/components/Chat/Input/ArtifactsSubMenu';
 import MCPSubMenu from '~/components/Chat/Input/MCPSubMenu';
 import { PinIcon, VectorIcon } from '~/components/svg';
-import { useLocalize, useHasAccess } from '~/hooks';
 import { useBadgeRowContext } from '~/Providers';
 import { cn } from '~/utils';
 
@@ -21,12 +28,17 @@ const ToolsDropdown = ({ disabled }: ToolsDropdownProps) => {
   const {
     webSearch,
     mcpSelect,
+    artifacts,
     fileSearch,
+    agentsConfig,
     startupConfig,
     codeApiKeyForm,
     codeInterpreter,
     searchApiKeyForm,
   } = useBadgeRowContext();
+  const { codeEnabled, webSearchEnabled, artifactsEnabled, fileSearchEnabled } =
+    useAgentCapabilities(agentsConfig?.capabilities ?? defaultAgentCapabilities);
+
   const { setIsDialogOpen: setIsCodeDialogOpen, menuTriggerRef: codeMenuTriggerRef } =
     codeApiKeyForm;
   const { setIsDialogOpen: setIsSearchDialogOpen, menuTriggerRef: searchMenuTriggerRef } =
@@ -42,6 +54,7 @@ const ToolsDropdown = ({ disabled }: ToolsDropdownProps) => {
     authData: codeAuthData,
   } = codeInterpreter;
   const { isPinned: isFileSearchPinned, setIsPinned: setIsFileSearchPinned } = fileSearch;
+  const { isPinned: isArtifactsPinned, setIsPinned: setIsArtifactsPinned } = artifacts;
   const {
     mcpValues,
     mcpServerNames,
@@ -72,19 +85,46 @@ const ToolsDropdown = ({ disabled }: ToolsDropdownProps) => {
 
   const handleWebSearchToggle = useCallback(() => {
     const newValue = !webSearch.toggleState;
-    webSearch.debouncedChange({ isChecked: newValue });
+    webSearch.debouncedChange({ value: newValue });
   }, [webSearch]);
 
   const handleCodeInterpreterToggle = useCallback(() => {
     const newValue = !codeInterpreter.toggleState;
-    codeInterpreter.debouncedChange({ isChecked: newValue });
+    codeInterpreter.debouncedChange({ value: newValue });
   }, [codeInterpreter]);
 
   const handleFileSearchToggle = useCallback(() => {
     const newValue = !fileSearch.toggleState;
-    fileSearch.debouncedChange({ isChecked: newValue });
+    fileSearch.debouncedChange({ value: newValue });
   }, [fileSearch]);
 
+  const handleArtifactsToggle = useCallback(() => {
+    const currentState = artifacts.toggleState;
+    if (!currentState || currentState === '') {
+      artifacts.debouncedChange({ value: ArtifactModes.DEFAULT });
+    } else {
+      artifacts.debouncedChange({ value: '' });
+    }
+  }, [artifacts]);
+
+  const handleShadcnToggle = useCallback(() => {
+    const currentState = artifacts.toggleState;
+    if (currentState === ArtifactModes.SHADCNUI) {
+      artifacts.debouncedChange({ value: ArtifactModes.DEFAULT });
+    } else {
+      artifacts.debouncedChange({ value: ArtifactModes.SHADCNUI });
+    }
+  }, [artifacts]);
+
+  const handleCustomToggle = useCallback(() => {
+    const currentState = artifacts.toggleState;
+    if (currentState === ArtifactModes.CUSTOM) {
+      artifacts.debouncedChange({ value: ArtifactModes.DEFAULT });
+    } else {
+      artifacts.debouncedChange({ value: ArtifactModes.CUSTOM });
+    }
+  }, [artifacts]);
+
   const handleMCPToggle = useCallback(
     (serverName: string) => {
       const currentValues = mcpSelect.mcpValues ?? [];
@@ -98,9 +138,10 @@ const ToolsDropdown = ({ disabled }: ToolsDropdownProps) => {
 
   const mcpPlaceholder = startupConfig?.interface?.mcpServers?.placeholder;
 
-  const dropdownItems = useMemo(() => {
-    const items: MenuItemProps[] = [];
-    items.push({
+  const dropdownItems: MenuItemProps[] = [];
+
+  if (fileSearchEnabled) {
+    dropdownItems.push({
       onClick: handleFileSearchToggle,
       hideOnClick: false,
       render: (props) => (
@@ -129,159 +170,149 @@ const ToolsDropdown = ({ disabled }: ToolsDropdownProps) => {
         </div>
       ),
     });
+  }
 
-    if (canUseWebSearch) {
-      items.push({
-        onClick: handleWebSearchToggle,
-        hideOnClick: false,
-        render: (props) => (
-          <div {...props}>
-            <div className="flex items-center gap-2">
-              <Globe className="icon-md" />
-              <span>{localize('com_ui_web_search')}</span>
-            </div>
-            <div className="flex items-center gap-1">
-              {showWebSearchSettings && (
-                <button
-                  type="button"
-                  onClick={(e) => {
-                    e.stopPropagation();
-                    setIsSearchDialogOpen(true);
-                  }}
-                  className={cn(
-                    'rounded p-1 transition-all duration-200',
-                    'hover:bg-surface-secondary hover:shadow-sm',
-                    'text-text-secondary hover:text-text-primary',
-                  )}
-                  aria-label="Configure web search"
-                  ref={searchMenuTriggerRef}
-                >
-                  <div className="h-4 w-4">
-                    <Settings className="h-4 w-4" />
-                  </div>
-                </button>
-              )}
+  if (canUseWebSearch && webSearchEnabled) {
+    dropdownItems.push({
+      onClick: handleWebSearchToggle,
+      hideOnClick: false,
+      render: (props) => (
+        <div {...props}>
+          <div className="flex items-center gap-2">
+            <Globe className="icon-md" />
+            <span>{localize('com_ui_web_search')}</span>
+          </div>
+          <div className="flex items-center gap-1">
+            {showWebSearchSettings && (
               <button
                 type="button"
                 onClick={(e) => {
                   e.stopPropagation();
-                  setIsSearchPinned(!isSearchPinned);
+                  setIsSearchDialogOpen(true);
                 }}
                 className={cn(
                   'rounded p-1 transition-all duration-200',
                   'hover:bg-surface-secondary hover:shadow-sm',
-                  !isSearchPinned && 'text-text-secondary hover:text-text-primary',
+                  'text-text-secondary hover:text-text-primary',
                 )}
-                aria-label={isSearchPinned ? 'Unpin' : 'Pin'}
+                aria-label="Configure web search"
+                ref={searchMenuTriggerRef}
               >
                 <div className="h-4 w-4">
-                  <PinIcon unpin={isSearchPinned} />
+                  <Settings className="h-4 w-4" />
                 </div>
               </button>
-            </div>
-          </div>
-        ),
-      });
-    }
-
-    if (canRunCode) {
-      items.push({
-        onClick: handleCodeInterpreterToggle,
-        hideOnClick: false,
-        render: (props) => (
-          <div {...props}>
-            <div className="flex items-center gap-2">
-              <TerminalSquareIcon className="icon-md" />
-              <span>{localize('com_assistants_code_interpreter')}</span>
-            </div>
-            <div className="flex items-center gap-1">
-              {showCodeSettings && (
-                <button
-                  type="button"
-                  onClick={(e) => {
-                    e.stopPropagation();
-                    setIsCodeDialogOpen(true);
-                  }}
-                  ref={codeMenuTriggerRef}
-                  className={cn(
-                    'rounded p-1 transition-all duration-200',
-                    'hover:bg-surface-secondary hover:shadow-sm',
-                    'text-text-secondary hover:text-text-primary',
-                  )}
-                  aria-label="Configure code interpreter"
-                >
-                  <div className="h-4 w-4">
-                    <Settings className="h-4 w-4" />
-                  </div>
-                </button>
+            )}
+            <button
+              type="button"
+              onClick={(e) => {
+                e.stopPropagation();
+                setIsSearchPinned(!isSearchPinned);
+              }}
+              className={cn(
+                'rounded p-1 transition-all duration-200',
+                'hover:bg-surface-secondary hover:shadow-sm',
+                !isSearchPinned && 'text-text-secondary hover:text-text-primary',
               )}
+              aria-label={isSearchPinned ? 'Unpin' : 'Pin'}
+            >
+              <div className="h-4 w-4">
+                <PinIcon unpin={isSearchPinned} />
+              </div>
+            </button>
+          </div>
+        </div>
+      ),
+    });
+  }
+
+  if (canRunCode && codeEnabled) {
+    dropdownItems.push({
+      onClick: handleCodeInterpreterToggle,
+      hideOnClick: false,
+      render: (props) => (
+        <div {...props}>
+          <div className="flex items-center gap-2">
+            <TerminalSquareIcon className="icon-md" />
+            <span>{localize('com_assistants_code_interpreter')}</span>
+          </div>
+          <div className="flex items-center gap-1">
+            {showCodeSettings && (
               <button
                 type="button"
                 onClick={(e) => {
                   e.stopPropagation();
-                  setIsCodePinned(!isCodePinned);
+                  setIsCodeDialogOpen(true);
                 }}
+                ref={codeMenuTriggerRef}
                 className={cn(
                   'rounded p-1 transition-all duration-200',
                   'hover:bg-surface-secondary hover:shadow-sm',
-                  !isCodePinned && 'text-text-primary hover:text-text-primary',
+                  'text-text-secondary hover:text-text-primary',
                 )}
-                aria-label={isCodePinned ? 'Unpin' : 'Pin'}
+                aria-label="Configure code interpreter"
               >
                 <div className="h-4 w-4">
-                  <PinIcon unpin={isCodePinned} />
+                  <Settings className="h-4 w-4" />
                 </div>
               </button>
-            </div>
+            )}
+            <button
+              type="button"
+              onClick={(e) => {
+                e.stopPropagation();
+                setIsCodePinned(!isCodePinned);
+              }}
+              className={cn(
+                'rounded p-1 transition-all duration-200',
+                'hover:bg-surface-secondary hover:shadow-sm',
+                !isCodePinned && 'text-text-primary hover:text-text-primary',
+              )}
+              aria-label={isCodePinned ? 'Unpin' : 'Pin'}
+            >
+              <div className="h-4 w-4">
+                <PinIcon unpin={isCodePinned} />
+              </div>
+            </button>
           </div>
-        ),
-      });
-    }
+        </div>
+      ),
+    });
+  }
 
-    if (mcpServerNames && mcpServerNames.length > 0) {
-      items.push({
-        hideOnClick: false,
-        render: (props) => (
-          <MCPSubMenu
-            {...props}
-            mcpValues={mcpValues}
-            isMCPPinned={isMCPPinned}
-            placeholder={mcpPlaceholder}
-            mcpServerNames={mcpServerNames}
-            setIsMCPPinned={setIsMCPPinned}
-            handleMCPToggle={handleMCPToggle}
-          />
-        ),
-      });
-    }
+  if (artifactsEnabled) {
+    dropdownItems.push({
+      hideOnClick: false,
+      render: (props) => (
+        <ArtifactsSubMenu
+          {...props}
+          isArtifactsPinned={isArtifactsPinned}
+          setIsArtifactsPinned={setIsArtifactsPinned}
+          artifactsMode={artifacts.toggleState as string}
+          handleArtifactsToggle={handleArtifactsToggle}
+          handleShadcnToggle={handleShadcnToggle}
+          handleCustomToggle={handleCustomToggle}
+        />
+      ),
+    });
+  }
 
-    return items;
-  }, [
-    localize,
-    mcpValues,
-    canRunCode,
-    isMCPPinned,
-    isCodePinned,
-    mcpPlaceholder,
-    mcpServerNames,
-    isSearchPinned,
-    setIsMCPPinned,
-    canUseWebSearch,
-    setIsCodePinned,
-    handleMCPToggle,
-    showCodeSettings,
-    setIsSearchPinned,
-    isFileSearchPinned,
-    codeMenuTriggerRef,
-    setIsCodeDialogOpen,
-    searchMenuTriggerRef,
-    showWebSearchSettings,
-    setIsFileSearchPinned,
-    handleWebSearchToggle,
-    setIsSearchDialogOpen,
-    handleFileSearchToggle,
-    handleCodeInterpreterToggle,
-  ]);
+  if (mcpServerNames && mcpServerNames.length > 0) {
+    dropdownItems.push({
+      hideOnClick: false,
+      render: (props) => (
+        <MCPSubMenu
+          {...props}
+          mcpValues={mcpValues}
+          isMCPPinned={isMCPPinned}
+          placeholder={mcpPlaceholder}
+          mcpServerNames={mcpServerNames}
+          setIsMCPPinned={setIsMCPPinned}
+          handleMCPToggle={handleMCPToggle}
+        />
+      ),
+    });
+  }
 
   const menuTrigger = (
     <TooltipAnchor

client/src/components/Chat/Input/WebSearch.tsx

@@ -8,7 +8,7 @@ import { useBadgeRowContext } from '~/Providers';
 function WebSearch() {
   const localize = useLocalize();
   const { webSearch: webSearchData, searchApiKeyForm } = useBadgeRowContext();
-  const { toggleState: webSearch, debouncedChange, isPinned } = webSearchData;
+  const { toggleState: webSearch, debouncedChange, isPinned, authData } = webSearchData;
   const { badgeTriggerRef } = searchApiKeyForm;
 
   const canUseWebSearch = useHasAccess({
@@ -21,7 +21,7 @@ function WebSearch() {
   }
 
   return (
-    (webSearch || isPinned) && (
+    (isPinned || (webSearch && authData?.authenticated)) && (
       <CheckboxButton
         ref={badgeTriggerRef}
         className="max-w-fit"

client/src/components/Chat/Menus/OpenSidebar.tsx

@@ -17,7 +17,7 @@ export default function OpenSidebar({
           variant="outline"
           data-testid="open-sidebar-button"
           aria-label={localize('com_nav_open_sidebar')}
-          className="rounded-xl border border-border-light bg-surface-secondary p-2 hover:bg-surface-hover"
+          className="rounded-xl border border-border-light bg-surface-secondary p-2 hover:bg-surface-hover max-md:hidden"
           onClick={() =>
             setNavVisible((prev) => {
               localStorage.setItem('navVisible', JSON.stringify(!prev));

client/src/components/Chat/Messages/Content/ContentParts.tsx

@@ -81,14 +81,23 @@ const ContentParts = memo(
       return (
         <>
           {content.map((part, idx) => {
-            if (part?.type !== ContentTypes.TEXT || typeof part.text !== 'string') {
+            if (!part) {
+              return null;
+            }
+            const isTextPart =
+              part?.type === ContentTypes.TEXT ||
+              typeof (part as unknown as Agents.MessageContentText)?.text !== 'string';
+            const isThinkPart =
+              part?.type === ContentTypes.THINK ||
+              typeof (part as unknown as Agents.ReasoningDeltaUpdate)?.think !== 'string';
+            if (!isTextPart && !isThinkPart) {
               return null;
             }
 
             return (
               <EditTextPart
                 index={idx}
-                text={part.text}
+                part={part as Agents.MessageContentText | Agents.ReasoningDeltaUpdate}
                 messageId={messageId}
                 isSubmitting={isSubmitting}
                 enterEdit={enterEdit}

client/src/components/Chat/Messages/Content/Parts/EditTextPart.tsx

@@ -1,8 +1,9 @@
+import { useRef, useEffect, useCallback, useMemo } from 'react';
 import { useForm } from 'react-hook-form';
 import { ContentTypes } from 'librechat-data-provider';
 import { useRecoilState, useRecoilValue } from 'recoil';
-import { useRef, useEffect, useCallback, useMemo } from 'react';
 import { useUpdateMessageContentMutation } from 'librechat-data-provider/react-query';
+import type { Agents } from 'librechat-data-provider';
 import type { TEditProps } from '~/common';
 import Container from '~/components/Chat/Messages/Content/Container';
 import { useChatContext, useAddedChatContext } from '~/Providers';
@@ -12,18 +13,19 @@ import { useLocalize } from '~/hooks';
 import store from '~/store';
 
 const EditTextPart = ({
-  text,
+  part,
   index,
   messageId,
   isSubmitting,
   enterEdit,
-}: Omit<TEditProps, 'message' | 'ask'> & {
+}: Omit<TEditProps, 'message' | 'ask' | 'text'> & {
   index: number;
   messageId: string;
+  part: Agents.MessageContentText | Agents.ReasoningDeltaUpdate;
 }) => {
   const localize = useLocalize();
   const { addedIndex } = useAddedChatContext();
-  const { getMessages, setMessages, conversation } = useChatContext();
+  const { ask, getMessages, setMessages, conversation } = useChatContext();
   const [latestMultiMessage, setLatestMultiMessage] = useRecoilState(
     store.latestMessageFamily(addedIndex),
   );
@@ -34,15 +36,16 @@ const EditTextPart = ({
     [getMessages, messageId],
   );
 
+  const chatDirection = useRecoilValue(store.chatDirection);
+
   const textAreaRef = useRef<HTMLTextAreaElement | null>(null);
   const updateMessageContentMutation = useUpdateMessageContentMutation(conversationId ?? '');
 
-  const chatDirection = useRecoilValue(store.chatDirection).toLowerCase();
-  const isRTL = chatDirection === 'rtl';
+  const isRTL = chatDirection?.toLowerCase() === 'rtl';
 
   const { register, handleSubmit, setValue } = useForm({
     defaultValues: {
-      text: text ?? '',
+      text: (ContentTypes.THINK in part ? part.think : part.text) || '',
     },
   });
 
@@ -55,15 +58,7 @@ const EditTextPart = ({
     }
   }, []);
 
-  /*
-  const resubmitMessage = () => {
-    showToast({
-      status: 'warning',
-      message: localize('com_warning_resubmit_unsupported'),
-    });
-
-    // const resubmitMessage = (data: { text: string }) => {
-    // Not supported by AWS Bedrock
+  const resubmitMessage = (data: { text: string }) => {
     const messages = getMessages();
     const parentMessage = messages?.find((msg) => msg.messageId === message?.parentMessageId);
 
@@ -73,17 +68,19 @@ const EditTextPart = ({
     ask(
       { ...parentMessage },
       {
-        editedText: data.text,
+        editedContent: {
+          index,
+          text: data.text,
+          type: part.type,
+        },
         editedMessageId: messageId,
         isRegenerate: true,
         isEdited: true,
       },
     );
 
-    setSiblingIdx((siblingIdx ?? 0) - 1);
     enterEdit(true);
   };
-  */
 
   const updateMessage = (data: { text: string }) => {
     const messages = getMessages();
@@ -167,13 +164,13 @@ const EditTextPart = ({
         />
       </div>
       <div className="mt-2 flex w-full justify-center text-center">
-        {/* <button
+        <button
           className="btn btn-primary relative mr-2"
           disabled={isSubmitting}
           onClick={handleSubmit(resubmitMessage)}
         >
           {localize('com_ui_save_submit')}
-        </button> */}
+        </button>
         <button
           className="btn btn-secondary relative mr-2"
           disabled={isSubmitting}

client/src/components/Chat/Messages/Fork.tsx

@@ -233,9 +233,17 @@ export default function Fork({
         status: 'info',
       });
     },
-    onError: () => {
+    onError: (error) => {
+      /** Rate limit error (429 status code) */
+      const isRateLimitError =
+        (error as any)?.response?.status === 429 ||
+        (error as any)?.status === 429 ||
+        (error as any)?.statusCode === 429;
+
       showToast({
-        message: localize('com_ui_fork_error'),
+        message: isRateLimitError
+          ? localize('com_ui_fork_error_rate_limit')
+          : localize('com_ui_fork_error'),
         status: 'error',
       });
     },

client/src/components/Messages/Content/Error.tsx

@@ -62,6 +62,7 @@ const errorMessages = {
     const { info } = json;
     return info;
   },
+  [ErrorTypes.GOOGLE_TOOL_CONFLICT]: 'com_error_google_tool_conflict',
   [ViolationTypes.BAN]:
     'Your account has been temporarily banned due to violations of our service.',
   invalid_api_key:

client/src/components/Nav/NewChat.tsx

@@ -1,13 +1,13 @@
-import React, { useCallback, useContext } from 'react';
+import React, { useCallback } from 'react';
+import { useRecoilValue } from 'recoil';
 import { useNavigate } from 'react-router-dom';
 import { useQueryClient } from '@tanstack/react-query';
-import { QueryKeys, Constants, PermissionTypes, Permissions } from 'librechat-data-provider';
-import type { TMessage } from 'librechat-data-provider';
+import { QueryKeys, Constants } from 'librechat-data-provider';
+import type { TMessage, TStartupConfig } from 'librechat-data-provider';
 import { NewChatIcon, MobileSidebar, Sidebar } from '~/components/svg';
+import { getDefaultModelSpec, getModelSpecPreset } from '~/utils';
 import { TooltipAnchor, Button } from '~/components/ui';
-import { useLocalize, useNewConvo, useHasAccess } from '~/hooks';
-import { AuthContext } from '~/hooks/AuthContext';
-import { LayoutGrid } from 'lucide-react';
+import { useLocalize, useNewConvo } from '~/hooks';
 import store from '~/store';
 
 export default function NewChat({
@@ -29,11 +29,6 @@ export default function NewChat({
   const navigate = useNavigate();
   const localize = useLocalize();
   const { conversation } = store.useCreateConversationAtom(index);
-  const authContext = useContext(AuthContext);
-  const hasAccessToAgents = useHasAccess({
-    permissionType: PermissionTypes.AGENTS,
-    permission: Permissions.USE,
-  });
 
   const clickHandler: React.MouseEventHandler<HTMLButtonElement> = useCallback(
     (e) => {
@@ -55,22 +50,6 @@ export default function NewChat({
     [queryClient, conversation, newConvo, navigate, toggleNav, isSmallScreen],
   );
 
-  const handleAgentMarketplace = useCallback(() => {
-    navigate('/agents');
-    if (isSmallScreen) {
-      toggleNav();
-    }
-  }, [navigate, isSmallScreen, toggleNav]);
-
-  // Check if auth is ready (avoid race conditions)
-  const authReady =
-    authContext?.isAuthenticated !== undefined &&
-    (authContext?.isAuthenticated === false || authContext?.user !== undefined);
-
-  // Show agent marketplace when auth is ready and user has access
-  // Note: endpointsConfig[agents] is null, but we can still show the marketplace
-  const showAgentMarketplace = authReady && hasAccessToAgents;
-
   return (
     <>
       <div className="flex items-center justify-between py-[2px] md:py-2">
@@ -109,29 +88,6 @@ export default function NewChat({
           />
         </div>
       </div>
-
-      {/* Agent Marketplace button - separate row like ChatGPT */}
-      {showAgentMarketplace && (
-        <div className="flex px-2 pb-4 pt-2 md:px-3">
-          <TooltipAnchor
-            description={localize('com_nav_agents_marketplace')}
-            render={
-              <Button
-                variant="outline"
-                data-testid="nav-agents-marketplace-button"
-                aria-label={localize('com_nav_agents_marketplace')}
-                className="flex w-full items-center justify-start gap-3 rounded-xl border-none bg-transparent p-3 text-left hover:bg-surface-hover"
-                onClick={handleAgentMarketplace}
-              >
-                <LayoutGrid className="h-5 w-5 flex-shrink-0" />
-                <span className="truncate text-base font-medium">
-                  {localize('com_nav_agents_marketplace')}
-                </span>
-              </Button>
-            }
-          />
-        </div>
-      )}
       {subHeaders != null ? subHeaders : null}
     </>
   );

client/src/components/Nav/Settings.tsx

@@ -17,7 +17,6 @@ import {
   General,
   Chat,
   Speech,
-  Beta,
   Commands,
   Data,
   Account,
@@ -233,9 +232,6 @@ export default function Settings({ open, onOpenChange }: TDialogProps) {
                     <Tabs.Content value={SettingsTabValues.CHAT}>
                       <Chat />
                     </Tabs.Content>
-                    <Tabs.Content value={SettingsTabValues.BETA}>
-                      <Beta />
-                    </Tabs.Content>
                     <Tabs.Content value={SettingsTabValues.COMMANDS}>
                       <Commands />
                     </Tabs.Content>

client/src/components/Nav/SettingsTabs/Beta/Beta.tsx

@@ -1,18 +0,0 @@
-import { memo } from 'react';
-import CodeArtifacts from './CodeArtifacts';
-import ChatBadges from './ChatBadges';
-
-function Beta() {
-  return (
-    <div className="flex flex-col gap-3 p-1 text-sm text-text-primary">
-      <div className="pb-3">
-        <CodeArtifacts />
-      </div>
-      {/* <div className="pb-3">
-        <ChatBadges />
-      </div> */}
-    </div>
-  );
-}
-
-export default memo(Beta);

client/src/components/Nav/SettingsTabs/Beta/ChatBadges.tsx

@@ -1,22 +0,0 @@
-import { useSetRecoilState } from 'recoil';
-import { Button } from '~/components/ui';
-import { useLocalize } from '~/hooks';
-import store from '~/store';
-
-export default function ChatBadges() {
-  const setIsEditing = useSetRecoilState<boolean>(store.isEditingBadges);
-  const localize = useLocalize();
-
-  const handleEditChatBadges = () => {
-    setIsEditing(true);
-  };
-
-  return (
-    <div className="flex items-center justify-between">
-      <div>{localize('com_nav_edit_chat_badges')}</div>
-      <Button variant="outline" onClick={handleEditChatBadges}>
-        {localize('com_ui_edit')}
-      </Button>
-    </div>
-  );
-}

client/src/components/Nav/SettingsTabs/Beta/CodeArtifacts.tsx

@@ -1,95 +0,0 @@
-import { useRecoilState } from 'recoil';
-import HoverCardSettings from '~/components/Nav/SettingsTabs/HoverCardSettings';
-import { Switch } from '~/components/ui';
-import { useLocalize } from '~/hooks';
-import store from '~/store';
-
-export default function CodeArtifacts() {
-  const [codeArtifacts, setCodeArtifacts] = useRecoilState<boolean>(store.codeArtifacts);
-  const [includeShadcnui, setIncludeShadcnui] = useRecoilState<boolean>(store.includeShadcnui);
-  const [customPromptMode, setCustomPromptMode] = useRecoilState<boolean>(store.customPromptMode);
-  const localize = useLocalize();
-
-  const handleCodeArtifactsChange = (value: boolean) => {
-    setCodeArtifacts(value);
-    if (!value) {
-      setIncludeShadcnui(false);
-      setCustomPromptMode(false);
-    }
-  };
-
-  const handleIncludeShadcnuiChange = (value: boolean) => {
-    setIncludeShadcnui(value);
-  };
-
-  const handleCustomPromptModeChange = (value: boolean) => {
-    setCustomPromptMode(value);
-    if (value) {
-      setIncludeShadcnui(false);
-    }
-  };
-
-  return (
-    <div className="space-y-4">
-      <h3 className="text-lg font-medium">{localize('com_ui_artifacts')}</h3>
-      <div className="space-y-2">
-        <SwitchItem
-          id="codeArtifacts"
-          label={localize('com_ui_artifacts_toggle')}
-          checked={codeArtifacts}
-          onCheckedChange={handleCodeArtifactsChange}
-          hoverCardText="com_nav_info_code_artifacts"
-        />
-        <SwitchItem
-          id="includeShadcnui"
-          label={localize('com_ui_include_shadcnui')}
-          checked={includeShadcnui}
-          onCheckedChange={handleIncludeShadcnuiChange}
-          hoverCardText="com_nav_info_include_shadcnui"
-          disabled={!codeArtifacts || customPromptMode}
-        />
-        <SwitchItem
-          id="customPromptMode"
-          label={localize('com_ui_custom_prompt_mode')}
-          checked={customPromptMode}
-          onCheckedChange={handleCustomPromptModeChange}
-          hoverCardText="com_nav_info_custom_prompt_mode"
-          disabled={!codeArtifacts}
-        />
-      </div>
-    </div>
-  );
-}
-
-function SwitchItem({
-  id,
-  label,
-  checked,
-  onCheckedChange,
-  hoverCardText,
-  disabled = false,
-}: {
-  id: string;
-  label: string;
-  checked: boolean;
-  onCheckedChange: (value: boolean) => void;
-  hoverCardText: string;
-  disabled?: boolean;
-}) {
-  return (
-    <div className="flex items-center justify-between">
-      <div className="flex items-center space-x-2">
-        <div className={disabled ? 'text-gray-400' : ''}>{label}</div>
-        <HoverCardSettings side="bottom" text={hoverCardText} />
-      </div>
-      <Switch
-        id={id}
-        checked={checked}
-        onCheckedChange={onCheckedChange}
-        className="ml-4"
-        data-testid={id}
-        disabled={disabled}
-      />
-    </div>
-  );
-}

client/src/components/Nav/SettingsTabs/General/General.tsx

@@ -86,6 +86,7 @@ export const LangSelector = ({
     { value: 'fr-FR', label: localize('com_nav_lang_french') },
     { value: 'he-HE', label: localize('com_nav_lang_hebrew') },
     { value: 'hu-HU', label: localize('com_nav_lang_hungarian') },
+    { value: 'hy-AM', label: localize('com_nav_lang_armenian') },
     { value: 'it-IT', label: localize('com_nav_lang_italian') },
     { value: 'pl-PL', label: localize('com_nav_lang_polish') },
     { value: 'pt-BR', label: localize('com_nav_lang_brazilian_portuguese') },
@@ -96,9 +97,11 @@ export const LangSelector = ({
     { value: 'cs-CZ', label: localize('com_nav_lang_czech') },
     { value: 'sv-SE', label: localize('com_nav_lang_swedish') },
     { value: 'ko-KR', label: localize('com_nav_lang_korean') },
+    { value: 'lv-LV', label: localize('com_nav_lang_latvian') },
     { value: 'vi-VN', label: localize('com_nav_lang_vietnamese') },
     { value: 'th-TH', label: localize('com_nav_lang_thai') },
     { value: 'tr-TR', label: localize('com_nav_lang_turkish') },
+    { value: 'ug', label: localize('com_nav_lang_uyghur') },
     { value: 'nl-NL', label: localize('com_nav_lang_dutch') },
     { value: 'id-ID', label: localize('com_nav_lang_indonesia') },
     { value: 'fi-FI', label: localize('com_nav_lang_finnish') },

client/src/components/Nav/SettingsTabs/index.ts

@@ -1,7 +1,6 @@
 export { default as General } from './General/General';
 export { default as Chat } from './Chat/Chat';
 export { default as Data } from './Data/Data';
-export { default as Beta } from './Beta/Beta';
 export { default as Commands } from './Commands/Commands';
 export { RevokeKeysButton } from './Data/RevokeKeysButton';
 export { default as Account } from './Account/Account';

client/src/components/Prompts/Groups/CategoryIcon.tsx

@@ -9,10 +9,6 @@ import {
   PlaneTakeoffIcon,
   GraduationCapIcon,
   TerminalSquareIcon,
-  // NEW: Add these for agent categories
-  Users as UsersIcon,
-  Beaker as BeakerIcon,
-  Settings as SettingsIcon,
 } from 'lucide-react';
 import { cn } from '~/utils';
 
@@ -26,13 +22,6 @@ const categoryIconMap: Record<string, React.ElementType> = {
   code: TerminalSquareIcon,
   travel: PlaneTakeoffIcon,
   teach_or_explain: GraduationCapIcon,
-  // NEW: Agent categories
-  general: BoxIcon,
-  hr: UsersIcon,
-  rd: BeakerIcon,
-  it: TerminalSquareIcon,
-  sales: LineChartIcon,
-  aftersales: SettingsIcon,
 };
 
 const categoryColorMap: Record<string, string> = {
@@ -45,13 +34,6 @@ const categoryColorMap: Record<string, string> = {
   finance: 'text-orange-400',
   roleplay: 'text-orange-400',
   teach_or_explain: 'text-blue-300',
-  // NEW: Agent categories
-  general: 'text-blue-500',
-  hr: 'text-green-500',
-  rd: 'text-purple-500',
-  it: 'text-red-500',
-  sales: 'text-orange-500',
-  aftersales: 'text-yellow-500',
 };
 
 export default function CategoryIcon({

client/src/components/SidePanel/Agents/Advanced/AdvancedPanel.tsx

@@ -2,20 +2,20 @@ import { useMemo } from 'react';
 import { ChevronLeft } from 'lucide-react';
 import { AgentCapabilities } from 'librechat-data-provider';
 import { useFormContext, Controller } from 'react-hook-form';
-import type { AgentForm, AgentPanelProps } from '~/common';
+import type { AgentForm } from '~/common';
+import { useAgentPanelContext } from '~/Providers';
 import MaxAgentSteps from './MaxAgentSteps';
-import AgentChain from './AgentChain';
 import { useLocalize } from '~/hooks';
+import AgentChain from './AgentChain';
 import { Panel } from '~/common';
 
-export default function AdvancedPanel({
-  agentsConfig,
-  setActivePanel,
-}: Pick<AgentPanelProps, 'setActivePanel' | 'agentsConfig'>) {
+export default function AdvancedPanel() {
   const localize = useLocalize();
   const methods = useFormContext<AgentForm>();
   const { control, watch } = methods;
   const currentAgentId = watch('id');
+
+  const { agentsConfig, setActivePanel } = useAgentPanelContext();
   const chainEnabled = useMemo(
     () => agentsConfig?.capabilities.includes(AgentCapabilities.chain) ?? false,
     [agentsConfig],

client/src/components/SidePanel/Agents/AgentAvatar.tsx

@@ -14,12 +14,7 @@ import type {
   AgentCreateParams,
   AgentListResponse,
 } from 'librechat-data-provider';
-import {
-  useUploadAgentAvatarMutation,
-  useGetFileConfig,
-  allAgentViewAndEditQueryKeys,
-  invalidateAgentMarketplaceQueries,
-} from '~/data-provider';
+import { useUploadAgentAvatarMutation, useGetFileConfig } from '~/data-provider';
 import { AgentAvatarRender, NoImage, AvatarMenu } from './Images';
 import { useToastContext } from '~/Providers';
 import { useLocalize } from '~/hooks';
@@ -62,31 +57,30 @@ function Avatar({
       const newUrl = data.avatar?.filepath ?? '';
       setPreviewUrl(newUrl);
 
-      ((keys) => {
-        keys.forEach((key) => {
-          const res = queryClient.getQueryData<AgentListResponse>([QueryKeys.agents, key]);
+      const res = queryClient.getQueryData<AgentListResponse>([
+        QueryKeys.agents,
+        defaultOrderQuery,
+      ]);
 
-          if (!res?.data) {
-            return;
-          }
+      if (!res?.data) {
+        return;
+      }
 
-          const agents = res.data.map((agent) => {
-            if (agent.id === agent_id) {
-              return {
-                ...agent,
-                ...data,
-              };
-            }
-            return agent;
-          });
+      const agents = res.data.map((agent) => {
+        if (agent.id === agent_id) {
+          return {
+            ...agent,
+            ...data,
+          };
+        }
+        return agent;
+      });
+
+      queryClient.setQueryData<AgentListResponse>([QueryKeys.agents, defaultOrderQuery], {
+        ...res,
+        data: agents,
+      });
 
-          queryClient.setQueryData<AgentListResponse>([QueryKeys.agents, key], {
-            ...res,
-            data: agents,
-          });
-        });
-      })(allAgentViewAndEditQueryKeys);
-      invalidateAgentMarketplaceQueries(queryClient);
       setProgress(1);
     },
     onError: (error) => {

client/src/components/SidePanel/Agents/AgentCard.tsx

@@ -1,93 +0,0 @@
-import React from 'react';
-
-import type t from 'librechat-data-provider';
-
-import useLocalize from '~/hooks/useLocalize';
-import { renderAgentAvatar, getContactDisplayName } from '~/utils/agents';
-import { cn } from '~/utils';
-
-interface AgentCardProps {
-  agent: t.Agent; // The agent data to display
-  onClick: () => void; // Callback when card is clicked
-  className?: string; // Additional CSS classes
-}
-
-/**
- * Card component to display agent information
- */
-const AgentCard: React.FC<AgentCardProps> = ({ agent, onClick, className = '' }) => {
-  const localize = useLocalize();
-
-  return (
-    <div
-      className={cn(
-        'group relative flex overflow-hidden rounded-2xl',
-        'cursor-pointer transition-colors duration-200',
-        'aspect-[5/2.5] w-full',
-        'bg-gray-50 hover:bg-gray-100 dark:bg-gray-700 dark:hover:bg-gray-600',
-        className,
-      )}
-      onClick={onClick}
-      aria-label={localize('com_agents_agent_card_label', {
-        name: agent.name,
-        description: agent.description || localize('com_agents_no_description'),
-      })}
-      aria-describedby={`agent-${agent.id}-description`}
-      tabIndex={0}
-      role="button"
-      onKeyDown={(e) => {
-        if (e.key === 'Enter' || e.key === ' ') {
-          e.preventDefault();
-          onClick();
-        }
-      }}
-    >
-      <div className="flex h-full gap-2 px-3 py-2 sm:gap-3 sm:px-4 sm:py-3">
-        {/* Agent avatar section - left side, responsive */}
-        <div className="flex flex-shrink-0 items-center">
-          {renderAgentAvatar(agent, { size: 'md' })}
-        </div>
-
-        {/* Agent info section - right side, responsive */}
-        <div className="flex min-w-0 flex-1 flex-col justify-center">
-          {/* Agent name - responsive text sizing */}
-          <h3 className="mb-1 line-clamp-1 text-base font-bold text-gray-900 dark:text-white sm:mb-2 sm:text-lg">
-            {agent.name}
-          </h3>
-
-          {/* Agent description - responsive text sizing and spacing */}
-          <p
-            id={`agent-${agent.id}-description`}
-            className={cn(
-              'mb-1 line-clamp-2 text-xs leading-relaxed text-gray-600 dark:text-gray-300',
-              'sm:mb-2 sm:text-sm',
-            )}
-            aria-label={`Description: ${agent.description || localize('com_agents_no_description')}`}
-          >
-            {agent.description || (
-              <span className="italic text-gray-400">{localize('com_agents_no_description')}</span>
-            )}
-          </p>
-
-          {/* Owner info - responsive text sizing */}
-          {(() => {
-            const displayName = getContactDisplayName(agent);
-
-            if (displayName) {
-              return (
-                <div className="flex items-center text-xs text-gray-500 dark:text-gray-400 sm:text-sm">
-                  <span className="font-light">{localize('com_agents_created_by')}</span>
-                  <span className="ml-1 font-bold">{displayName}</span>
-                </div>
-              );
-            }
-
-            return null;
-          })()}
-        </div>
-      </div>
-    </div>
-  );
-};
-
-export default AgentCard;

client/src/components/SidePanel/Agents/AgentCategoryDisplay.tsx

@@ -1,62 +0,0 @@
-import React from 'react';
-import { useAgentCategories } from '~/hooks/Agents';
-import { cn } from '~/utils';
-
-interface AgentCategoryDisplayProps {
-  category?: string;
-  className?: string;
-  showIcon?: boolean;
-  iconClassName?: string;
-  showEmptyFallback?: boolean;
-}
-
-/**
- * Component to display an agent category with proper translation
- *
- * @param category - The category value (e.g., "general", "hr", etc.)
- * @param className - Optional className for the container
- * @param showIcon - Whether to show the category icon
- * @param iconClassName - Optional className for the icon
- * @param showEmptyFallback - Whether to show a fallback for empty categories
- */
-const AgentCategoryDisplay: React.FC<AgentCategoryDisplayProps> = ({
-  category,
-  className = '',
-  showIcon = true,
-  iconClassName = 'h-4 w-4 mr-2',
-  showEmptyFallback = false,
-}) => {
-  const { categories, emptyCategory } = useAgentCategories();
-
-  // Find the category in our processed categories list
-  const categoryItem = categories.find((c) => c.value === category);
-
-  // Handle empty string case differently than undefined/null
-  if (category === '') {
-    if (!showEmptyFallback) {
-      return null;
-    }
-    // Show the empty category placeholder
-    return (
-      <div className={cn('flex items-center text-gray-400', className)}>
-        <span>{emptyCategory.label}</span>
-      </div>
-    );
-  }
-
-  // No category or unknown category
-  if (!category || !categoryItem) {
-    return null;
-  }
-
-  return (
-    <div className={cn('flex items-center', className)}>
-      {showIcon && categoryItem.icon && (
-        <span className={cn('flex-shrink-0', iconClassName)}>{categoryItem.icon}</span>
-      )}
-      <span>{categoryItem.label}</span>
-    </div>
-  );
-};
-
-export default AgentCategoryDisplay;

client/src/components/SidePanel/Agents/AgentCategorySelector.tsx

@@ -1,96 +0,0 @@
-import React, { useState } from 'react';
-import { useTranslation } from 'react-i18next';
-import {
-  useFormContext,
-  Controller,
-  useWatch,
-  ControllerRenderProps,
-  FieldValues,
-  FieldPath,
-} from 'react-hook-form';
-import ControlCombobox from '~/components/ui/ControlCombobox';
-import { useAgentCategories } from '~/hooks/Agents';
-import { cn } from '~/utils';
-
-/**
- * Custom hook to handle category synchronization
- */
-const useCategorySync = (agent_id: string | null) => {
-  const [handled, setHandled] = useState(false);
-
-  return {
-    syncCategory: <T extends FieldPath<FieldValues>>(
-      field: ControllerRenderProps<FieldValues, T>,
-    ) => {
-      // Only run once and only for new agents
-      if (!handled && agent_id === '' && !field.value) {
-        field.onChange('general');
-        setHandled(true);
-      }
-    },
-  };
-};
-
-/**
- * A component for selecting agent categories with form validation
- */
-const AgentCategorySelector: React.FC<{ className?: string }> = ({ className }) => {
-  const { t } = useTranslation();
-  const formContext = useFormContext();
-  const { categories } = useAgentCategories();
-
-  // Always call useWatch
-  const agent_id = useWatch({
-    name: 'id',
-    control: formContext.control,
-  });
-
-  // Use custom hook for category sync
-  const { syncCategory } = useCategorySync(agent_id);
-
-  // Transform categories to the format expected by ControlCombobox
-  const comboboxItems = categories.map((category) => ({
-    label: category.label,
-    value: category.value,
-  }));
-
-  const getCategoryDisplayValue = (value: string) => {
-    const categoryItem = comboboxItems.find((c) => c.value === value);
-    return categoryItem?.label || comboboxItems.find((c) => c.value === 'general')?.label;
-  };
-
-  const searchPlaceholder = t('com_ui_search_agent_category', 'Search categories...');
-  const ariaLabel = t('com_ui_agent_category_selector_aria', "Agent's category selector");
-
-  return (
-    <Controller
-      name="category"
-      control={formContext.control}
-      defaultValue="general"
-      render={({ field }) => {
-        // Sync category if needed (without using useEffect in render)
-        syncCategory(field);
-
-        const displayValue = getCategoryDisplayValue(field.value);
-
-        return (
-          <ControlCombobox
-            selectedValue={field.value}
-            displayValue={displayValue}
-            searchPlaceholder={searchPlaceholder}
-            setValue={(value) => {
-              field.onChange(value);
-            }}
-            items={comboboxItems}
-            className={cn(className)}
-            ariaLabel={ariaLabel}
-            isCollapsed={false}
-            showCarat={true}
-          />
-        );
-      }}
-    />
-  );
-};
-
-export default AgentCategorySelector;

client/src/components/SidePanel/Agents/AgentConfig.tsx

@@ -1,9 +1,10 @@
 import React, { useState, useMemo, useCallback } from 'react';
+import { EModelEndpoint } from 'librechat-data-provider';
 import { Controller, useWatch, useFormContext } from 'react-hook-form';
-import { EModelEndpoint, AgentCapabilities } from 'librechat-data-provider';
 import type { AgentForm, AgentPanelProps, IconComponentTypes } from '~/common';
 import { cn, defaultTextProps, removeFocusOutlines, getEndpointField, getIconKey } from '~/utils';
 import { useToastContext, useFileMapContext, useAgentPanelContext } from '~/Providers';
+import useAgentCapabilities from '~/hooks/Agents/useAgentCapabilities';
 import Action from '~/components/SidePanel/Builder/Action';
 import { ToolSelectDialog } from '~/components/Tools';
 import { icons } from '~/hooks/Endpoint/Icons';
@@ -17,7 +18,6 @@ import FileSearch from './FileSearch';
 import Artifacts from './Artifacts';
 import AgentTool from './AgentTool';
 import CodeForm from './Code/Form';
-import AgentCategorySelector from './AgentCategorySelector';
 import { Panel } from '~/common';
 
 const labelClass = 'mb-2 text-token-text-primary block font-medium';
@@ -27,56 +27,37 @@ const inputClass = cn(
   removeFocusOutlines,
 );
 
-export default function AgentConfig({
-  agentsConfig,
-  createMutation,
-  endpointsConfig,
-}: Pick<AgentPanelProps, 'agentsConfig' | 'createMutation' | 'endpointsConfig'>) {
+export default function AgentConfig({ createMutation }: Pick<AgentPanelProps, 'createMutation'>) {
   const localize = useLocalize();
   const fileMap = useFileMapContext();
   const { showToast } = useToastContext();
   const methods = useFormContext<AgentForm>();
   const [showToolDialog, setShowToolDialog] = useState(false);
-  const { actions, setAction, groupedTools: allTools, setActivePanel } = useAgentPanelContext();
-
   const {
-    control,
-    formState: { errors },
-  } = methods;
+    actions,
+    setAction,
+    agentsConfig,
+    setActivePanel,
+    endpointsConfig,
+    groupedTools: allTools,
+  } = useAgentPanelContext();
+
+  const { control } = methods;
   const provider = useWatch({ control, name: 'provider' });
   const model = useWatch({ control, name: 'model' });
   const agent = useWatch({ control, name: 'agent' });
   const tools = useWatch({ control, name: 'tools' });
   const agent_id = useWatch({ control, name: 'id' });
 
-  const toolsEnabled = useMemo(
-    () => agentsConfig?.capabilities?.includes(AgentCapabilities.tools) ?? false,
-    [agentsConfig],
-  );
-  const actionsEnabled = useMemo(
-    () => agentsConfig?.capabilities?.includes(AgentCapabilities.actions) ?? false,
-    [agentsConfig],
-  );
-  const artifactsEnabled = useMemo(
-    () => agentsConfig?.capabilities?.includes(AgentCapabilities.artifacts) ?? false,
-    [agentsConfig],
-  );
-  const ocrEnabled = useMemo(
-    () => agentsConfig?.capabilities?.includes(AgentCapabilities.ocr) ?? false,
-    [agentsConfig],
-  );
-  const fileSearchEnabled = useMemo(
-    () => agentsConfig?.capabilities?.includes(AgentCapabilities.file_search) ?? false,
-    [agentsConfig],
-  );
-  const webSearchEnabled = useMemo(
-    () => agentsConfig?.capabilities?.includes(AgentCapabilities.web_search) ?? false,
-    [agentsConfig],
-  );
-  const codeEnabled = useMemo(
-    () => agentsConfig?.capabilities?.includes(AgentCapabilities.execute_code) ?? false,
-    [agentsConfig],
-  );
+  const {
+    ocrEnabled,
+    codeEnabled,
+    toolsEnabled,
+    actionsEnabled,
+    artifactsEnabled,
+    webSearchEnabled,
+    fileSearchEnabled,
+  } = useAgentCapabilities(agentsConfig?.capabilities);
 
   const context_files = useMemo(() => {
     if (typeof agent === 'string') {
@@ -193,33 +174,21 @@ export default function AgentConfig({
           />
           <label className={labelClass} htmlFor="name">
             {localize('com_ui_name')}
-            <span className="text-red-500">*</span>
           </label>
           <Controller
             name="name"
-            rules={{ required: localize('com_ui_agent_name_is_required') }}
             control={control}
             render={({ field }) => (
-              <>
-                <input
-                  {...field}
-                  value={field.value ?? ''}
-                  maxLength={256}
-                  className={inputClass}
-                  id="name"
-                  type="text"
-                  placeholder={localize('com_agents_name_placeholder')}
-                  aria-label="Agent name"
-                />
-                <div
-                  className={cn(
-                    'mt-1 w-56 text-sm text-red-500',
-                    errors.name ? 'visible h-auto' : 'invisible h-0',
-                  )}
-                >
-                  {errors.name ? errors.name.message : ' '}
-                </div>
-              </>
+              <input
+                {...field}
+                value={field.value ?? ''}
+                maxLength={256}
+                className={inputClass}
+                id="name"
+                type="text"
+                placeholder={localize('com_agents_name_placeholder')}
+                aria-label="Agent name"
+              />
             )}
           />
           <Controller
@@ -254,13 +223,6 @@ export default function AgentConfig({
             )}
           />
         </div>
-        {/* Category */}
-        <div className="mb-4">
-          <label className={labelClass} htmlFor="category-selector">
-            {localize('com_ui_category')} <span className="text-red-500">*</span>
-          </label>
-          <AgentCategorySelector className="w-full" />
-        </div>
         {/* Instructions */}
         <Instructions />
         {/* Model and Provider */}
@@ -380,93 +342,6 @@ export default function AgentConfig({
         </div>
         {/* MCP Section */}
         {/* <MCPSection /> */}
-
-        {/* Support Contact (Optional) */}
-        <div className="mb-4">
-          <div className="mb-1.5 flex items-center gap-2">
-            <span>
-              <label className="text-token-text-primary block font-medium">
-                {localize('com_ui_support_contact')}
-              </label>
-            </span>
-          </div>
-          <div className="space-y-3">
-            {/* Support Contact Name */}
-            <div className="flex flex-col">
-              <label
-                className="mb-1 flex items-center justify-between"
-                htmlFor="support-contact-name"
-              >
-                <span className="text-sm">{localize('com_ui_support_contact_name')}</span>
-              </label>
-              <Controller
-                name="support_contact.name"
-                control={control}
-                rules={{
-                  minLength: {
-                    value: 3,
-                    message: localize('com_ui_support_contact_name_min_length', { minLength: 3 }),
-                  },
-                }}
-                render={({ field, fieldState: { error } }) => (
-                  <>
-                    <input
-                      {...field}
-                      value={field.value ?? ''}
-                      className={cn(inputClass, error ? 'border-2 border-red-500' : '')}
-                      id="support-contact-name"
-                      type="text"
-                      placeholder={localize('com_ui_support_contact_name_placeholder')}
-                      aria-label="Support contact name"
-                    />
-                    {error && (
-                      <span className="text-sm text-red-500 transition duration-300 ease-in-out">
-                        {error.message}
-                      </span>
-                    )}
-                  </>
-                )}
-              />
-            </div>
-            {/* Support Contact Email */}
-            <div className="flex flex-col">
-              <label
-                className="mb-1 flex items-center justify-between"
-                htmlFor="support-contact-email"
-              >
-                <span className="text-sm">{localize('com_ui_support_contact_email')}</span>
-              </label>
-              <Controller
-                name="support_contact.email"
-                control={control}
-                rules={{
-                  pattern: {
-                    value: /^\w+([.-]?\w+)*@\w+([.-]?\w+)*(\.\w{2,3})+$/,
-                    message: localize('com_ui_support_contact_email_invalid'),
-                  },
-                }}
-                render={({ field, fieldState: { error } }) => (
-                  <>
-                    <input
-                      {...field}
-                      value={field.value ?? ''}
-                      className={cn(inputClass, error ? 'border-2 border-red-500' : '')}
-                      id="support-contact-email"
-                      type="email"
-                      placeholder={localize('com_ui_support_contact_email_placeholder')}
-                      aria-label="Support contact email"
-                    />
-                    {error && (
-                      <span className="text-sm text-red-500 transition duration-300 ease-in-out">
-                        {error.message}
-                      </span>
-                    )}
-                  </>
-                )}
-              />
-            </div>
-          </div>
-        </div>
       </div>
       <ToolSelectDialog
         isOpen={showToolDialog}

client/src/components/SidePanel/Agents/AgentDetail.tsx

@@ -1,197 +0,0 @@
-import React, { useRef, useState, useEffect } from 'react';
-import { useNavigate } from 'react-router-dom';
-
-import type t from 'librechat-data-provider';
-import { AgentListResponse, PERMISSION_BITS, QueryKeys } from 'librechat-data-provider';
-interface SupportContact {
-  name?: string;
-  email?: string;
-}
-
-interface AgentWithSupport extends t.Agent {
-  support_contact?: SupportContact;
-}
-
-import { useQueryClient } from '@tanstack/react-query';
-import { Dialog, DialogContent, Button } from '~/components/ui';
-import { renderAgentAvatar } from '~/utils/agents';
-import useLocalize from '~/hooks/useLocalize';
-import { DotsIcon } from '~/components/svg';
-import { useToast } from '~/hooks';
-
-interface AgentDetailProps {
-  agent: AgentWithSupport; // The agent data to display
-  isOpen: boolean; // Whether the detail dialog is open
-  onClose: () => void; // Callback when dialog is closed
-}
-
-/**
- * Dialog for displaying agent details
- */
-const AgentDetail: React.FC<AgentDetailProps> = ({ agent, isOpen, onClose }) => {
-  const localize = useLocalize();
-  const navigate = useNavigate();
-  const { showToast } = useToast();
-  const dialogRef = useRef<HTMLDivElement>(null);
-  const dropdownRef = useRef<HTMLDivElement>(null);
-  const [dropdownOpen, setDropdownOpen] = useState(false);
-  const queryClient = useQueryClient();
-  // Close dropdown when clicking outside the dropdown menu
-  useEffect(() => {
-    const handleClickOutside = (event: MouseEvent) => {
-      if (
-        dropdownOpen &&
-        dropdownRef.current &&
-        !dropdownRef.current.contains(event.target as Node)
-      ) {
-        setDropdownOpen(false);
-      }
-    };
-
-    document.addEventListener('mousedown', handleClickOutside);
-    return () => {
-      document.removeEventListener('mousedown', handleClickOutside);
-    };
-  }, [dropdownOpen]);
-
-  /**
-   * Navigate to chat with the selected agent
-   */
-  const handleStartChat = () => {
-    if (agent) {
-      const keys = [QueryKeys.agents, { requiredPermission: PERMISSION_BITS.EDIT }];
-      const listResp = queryClient.getQueryData<AgentListResponse>(keys);
-      if (listResp != null) {
-        if (!listResp.data.some((a) => a.id === agent.id)) {
-          const currentAgents = [agent, ...JSON.parse(JSON.stringify(listResp.data))];
-          queryClient.setQueryData<AgentListResponse>(keys, { ...listResp, data: currentAgents });
-        }
-      }
-      navigate(`/c/new?agent_id=${agent.id}`);
-    }
-  };
-
-  /**
-   * Copy the agent's shareable link to clipboard
-   */
-  const handleCopyLink = () => {
-    const baseUrl = new URL(window.location.origin);
-    const chatUrl = `${baseUrl.origin}/c/new?agent_id=${agent.id}`;
-    navigator.clipboard
-      .writeText(chatUrl)
-      .then(() => {
-        showToast({
-          message: localize('com_agents_link_copied'),
-        });
-      })
-      .catch(() => {
-        showToast({
-          message: localize('com_agents_link_copy_failed'),
-        });
-      });
-  };
-
-  /**
-   * Format contact information with mailto links when appropriate
-   */
-  const formatContact = () => {
-    if (!agent?.support_contact) return null;
-
-    const { name, email } = agent.support_contact;
-
-    if (name && email) {
-      return (
-        <a href={`mailto:${email}`} className="text-primary hover:underline">
-          {name}
-        </a>
-      );
-    }
-
-    if (email) {
-      return (
-        <a href={`mailto:${email}`} className="text-primary hover:underline">
-          {email}
-        </a>
-      );
-    }
-
-    if (name) {
-      return <span>{name}</span>;
-    }
-
-    return null;
-  };
-
-  return (
-    <Dialog open={isOpen} onOpenChange={(open) => !open && onClose()}>
-      <DialogContent ref={dialogRef} className="max-h-[90vh] overflow-y-auto py-8 sm:max-w-[450px]">
-        {/* Context menu - top right */}
-        <div ref={dropdownRef} className="absolute right-12 top-5 z-50">
-          <Button
-            variant="ghost"
-            size="icon"
-            className="h-8 w-8 rounded-lg text-text-secondary hover:bg-surface-hover hover:text-text-primary dark:hover:bg-surface-hover"
-            aria-label={localize('com_agents_more_options')}
-            aria-expanded={dropdownOpen}
-            aria-haspopup="menu"
-            onClick={(e) => {
-              e.stopPropagation();
-              setDropdownOpen(!dropdownOpen);
-            }}
-          >
-            <DotsIcon className="h-4 w-4" />
-          </Button>
-
-          {/* Simple dropdown menu */}
-          {dropdownOpen && (
-            <div className="absolute right-0 top-10 z-[9999] w-48 rounded-xl border border-border-light bg-surface-primary py-1 shadow-lg dark:bg-surface-secondary dark:shadow-2xl">
-              <button
-                onClick={(e) => {
-                  e.stopPropagation();
-                  setDropdownOpen(false);
-                  handleCopyLink();
-                }}
-                className="w-full px-3 py-2 text-left text-sm text-text-primary transition-colors hover:bg-surface-hover focus:bg-surface-hover focus:outline-none"
-              >
-                {localize('com_agents_copy_link')}
-              </button>
-            </div>
-          )}
-        </div>
-
-        {/* Agent avatar - top center */}
-        <div className="mt-6 flex justify-center">{renderAgentAvatar(agent, { size: 'xl' })}</div>
-
-        {/* Agent name - center aligned below image */}
-        <div className="mt-3 text-center">
-          <h2 className="text-2xl font-bold text-gray-900 dark:text-white">
-            {agent?.name || localize('com_agents_loading')}
-          </h2>
-        </div>
-
-        {/* Contact info - center aligned below name */}
-        {agent?.support_contact && formatContact() && (
-          <div className="mt-1 text-center text-sm text-gray-600 dark:text-gray-400">
-            {localize('com_agents_contact')}: {formatContact()}
-          </div>
-        )}
-
-        {/* Agent description - below contact */}
-        <div className="mt-4 whitespace-pre-wrap px-6 text-center text-base text-gray-700 dark:text-gray-300">
-          {agent?.description || (
-            <span className="italic text-gray-400">{localize('com_agents_no_description')}</span>
-          )}
-        </div>
-
-        {/* Action button */}
-        <div className="mb-4 mt-6 flex justify-center">
-          <Button className="w-full max-w-xs" onClick={handleStartChat} disabled={!agent}>
-            {localize('com_agents_start_chat')}
-          </Button>
-        </div>
-      </DialogContent>
-    </Dialog>
-  );
-};
-
-export default AgentDetail;

client/src/components/SidePanel/Agents/AgentFooter.tsx

@@ -1,21 +1,16 @@
 import { useWatch, useFormContext } from 'react-hook-form';
-import {
-  SystemRoles,
-  Permissions,
-  PermissionTypes,
-  PERMISSION_BITS,
-} from 'librechat-data-provider';
+import { SystemRoles, Permissions, PermissionTypes } from 'librechat-data-provider';
 import type { AgentForm, AgentPanelProps } from '~/common';
-import { useLocalize, useAuthContext, useHasAccess, useResourcePermissions } from '~/hooks';
-import GrantAccessDialog from './Sharing/GrantAccessDialog';
+import { useLocalize, useAuthContext, useHasAccess } from '~/hooks';
 import { useUpdateAgentMutation } from '~/data-provider';
 import AdvancedButton from './Advanced/AdvancedButton';
-import VersionButton from './Version/VersionButton';
 import DuplicateAgent from './DuplicateAgent';
 import AdminSettings from './AdminSettings';
 import DeleteButton from './DeleteButton';
 import { Spinner } from '~/components';
+import ShareAgent from './ShareAgent';
 import { Panel } from '~/common';
+import VersionButton from './Version/VersionButton';
 
 export default function AgentFooter({
   activePanel,
@@ -37,17 +32,12 @@ export default function AgentFooter({
   const { control } = methods;
   const agent = useWatch({ control, name: 'agent' });
   const agent_id = useWatch({ control, name: 'id' });
+
   const hasAccessToShareAgents = useHasAccess({
     permissionType: PermissionTypes.AGENTS,
     permission: Permissions.SHARED_GLOBAL,
   });
-  const { hasPermission, isLoading: permissionsLoading } = useResourcePermissions(
-    'agent',
-    agent?._id || '',
-  );
 
-  const canShareThisAgent = hasPermission(PERMISSION_BITS.SHARE);
-  const canDeleteThisAgent = hasPermission(PERMISSION_BITS.DELETE);
   const renderSaveButton = () => {
     if (createMutation.isLoading || updateMutation.isLoading) {
       return <Spinner className="icon-md" aria-hidden="true" />;
@@ -69,21 +59,18 @@ export default function AgentFooter({
       {user?.role === SystemRoles.ADMIN && showButtons && <AdminSettings />}
       {/* Context Button */}
       <div className="flex items-center justify-end gap-2">
-        {(agent?.author === user?.id || user?.role === SystemRoles.ADMIN || canDeleteThisAgent) &&
-          !permissionsLoading && (
-            <DeleteButton
+        <DeleteButton
+          agent_id={agent_id}
+          setCurrentAgentId={setCurrentAgentId}
+          createMutation={createMutation}
+        />
+        {(agent?.author === user?.id || user?.role === SystemRoles.ADMIN) &&
+          hasAccessToShareAgents && (
+            <ShareAgent
               agent_id={agent_id}
-              setCurrentAgentId={setCurrentAgentId}
-              createMutation={createMutation}
-            />
-          )}
-        {(agent?.author === user?.id || user?.role === SystemRoles.ADMIN || canShareThisAgent) &&
-          hasAccessToShareAgents &&
-          !permissionsLoading && (
-            <GrantAccessDialog
-              agentDbId={agent?._id}
-              agentId={agent_id}
               agentName={agent?.name ?? ''}
+              projectIds={agent?.projectIds ?? []}
+              isCollaborative={agent?.isCollaborative}
             />
           )}
         {agent && agent.author === user?.id && <DuplicateAgent agent_id={agent_id} />}

client/src/components/SidePanel/Agents/AgentGrid.tsx

@@ -1,288 +0,0 @@
-import React, { useMemo } from 'react';
-
-import type t from 'librechat-data-provider';
-
-import { useMarketplaceAgentsInfiniteQuery } from '~/data-provider/Agents';
-import { useAgentCategories } from '~/hooks/Agents';
-import useLocalize from '~/hooks/useLocalize';
-import { Button } from '~/components/ui';
-import { Spinner } from '~/components/svg';
-import { useHasData } from './SmartLoader';
-import ErrorDisplay from './ErrorDisplay';
-import AgentCard from './AgentCard';
-import { cn } from '~/utils';
-import { PERMISSION_BITS } from 'librechat-data-provider';
-interface AgentGridProps {
-  category: string; // Currently selected category
-  searchQuery: string; // Current search query
-  onSelectAgent: (agent: t.Agent) => void; // Callback when agent is selected
-}
-
-/**
- * Component for displaying a grid of agent cards
- */
-const AgentGrid: React.FC<AgentGridProps> = ({ category, searchQuery, onSelectAgent }) => {
-  const localize = useLocalize();
-
-  // Get category data from API
-  const { categories } = useAgentCategories();
-
-  // Build query parameters based on current state
-  const queryParams = useMemo(() => {
-    const params: {
-      requiredPermission: number;
-      category?: string;
-      search?: string;
-      limit: number;
-      promoted?: 0 | 1;
-    } = {
-      requiredPermission: PERMISSION_BITS.VIEW, // View permission for marketplace viewing
-      limit: 6,
-    };
-
-    // Handle search
-    if (searchQuery) {
-      params.search = searchQuery;
-      // Include category filter for search if it's not 'all' or 'promoted'
-      if (category !== 'all' && category !== 'promoted') {
-        params.category = category;
-      }
-    } else {
-      // Handle category-based queries
-      if (category === 'promoted') {
-        params.promoted = 1;
-      } else if (category !== 'all') {
-        params.category = category;
-      }
-      // For 'all' category, no additional filters needed
-    }
-
-    return params;
-  }, [category, searchQuery]);
-
-  // Use infinite query for marketplace agents
-  const {
-    data,
-    isLoading,
-    error,
-    isFetching,
-    fetchNextPage,
-    hasNextPage,
-    refetch,
-    isFetchingNextPage,
-  } = useMarketplaceAgentsInfiniteQuery(queryParams);
-
-  // Flatten all pages into a single array of agents
-  const currentAgents = useMemo(() => {
-    if (!data?.pages) return [];
-    return data.pages.flatMap((page) => page.data || []);
-  }, [data?.pages]);
-
-  // Check if we have meaningful data to prevent unnecessary loading states
-  const hasData = useHasData(data?.pages?.[0]);
-
-  /**
-   * Get category display name from API data or use fallback
-   */
-  const getCategoryDisplayName = (categoryValue: string) => {
-    const categoryData = categories.find((cat) => cat.value === categoryValue);
-    if (categoryData) {
-      return categoryData.label;
-    }
-
-    // Fallback for special categories or unknown categories
-    if (categoryValue === 'promoted') {
-      return localize('com_agents_top_picks');
-    }
-    if (categoryValue === 'all') {
-      return 'All';
-    }
-
-    // Simple capitalization for unknown categories
-    return categoryValue.charAt(0).toUpperCase() + categoryValue.slice(1);
-  };
-
-  /**
-   * Load more agents when "See More" button is clicked
-   */
-  const handleLoadMore = () => {
-    if (hasNextPage && !isFetching) {
-      fetchNextPage();
-    }
-  };
-
-  /**
-   * Get the appropriate title for the agents grid based on current state
-   */
-  const getGridTitle = () => {
-    if (searchQuery) {
-      return localize('com_agents_results_for', { query: searchQuery });
-    }
-
-    return getCategoryDisplayName(category);
-  };
-
-  // Loading skeleton component
-  const loadingSkeleton = (
-    <div className="space-y-6">
-      <div className="mb-4">
-        <div className="mb-2 h-6 w-48 animate-pulse rounded-md bg-gray-200 dark:bg-gray-700"></div>
-        <div className="h-4 w-64 animate-pulse rounded-md bg-gray-200 dark:bg-gray-700"></div>
-      </div>
-      <div className="grid grid-cols-1 gap-6 md:grid-cols-2">
-        {Array(6)
-          .fill(0)
-          .map((_, index) => (
-            <div
-              key={index}
-              className={cn(
-                'flex h-[250px] animate-pulse flex-col overflow-hidden rounded-lg',
-                'bg-gray-200 dark:bg-gray-800',
-              )}
-            >
-              <div className="h-40 bg-gray-300 dark:bg-gray-700"></div>
-              <div className="flex-1 p-5">
-                <div className="mb-3 h-4 w-3/4 rounded bg-gray-300 dark:bg-gray-700"></div>
-                <div className="mb-2 h-3 w-full rounded bg-gray-300 dark:bg-gray-700"></div>
-                <div className="h-3 w-2/3 rounded bg-gray-300 dark:bg-gray-700"></div>
-              </div>
-            </div>
-          ))}
-      </div>
-    </div>
-  );
-
-  // Handle error state with enhanced error display
-  if (error) {
-    return (
-      <ErrorDisplay
-        error={error || 'Unknown error occurred'}
-        onRetry={() => refetch()}
-        context={{
-          searchQuery,
-          category,
-        }}
-      />
-    );
-  }
-
-  // Main content component with proper semantic structure
-  const mainContent = (
-    <div
-      className="space-y-6"
-      role="tabpanel"
-      id={`category-panel-${category}`}
-      aria-labelledby={`category-tab-${category}`}
-      aria-live="polite"
-      aria-busy={isLoading && !hasData}
-    >
-      {/* Grid title - only show for search results */}
-      {searchQuery && (
-        <div className="mb-4">
-          <h2
-            className="text-xl font-bold text-gray-900 dark:text-white"
-            id={`category-heading-${category}`}
-            aria-label={`${getGridTitle()}, ${currentAgents.length || 0} agents available`}
-          >
-            {getGridTitle()}
-          </h2>
-        </div>
-      )}
-
-      {/* Handle empty results with enhanced accessibility */}
-      {(!currentAgents || currentAgents.length === 0) && !isLoading && !isFetching ? (
-        <div
-          className="py-12 text-center text-gray-500"
-          role="status"
-          aria-live="polite"
-          aria-label={
-            searchQuery
-              ? localize('com_agents_search_empty_heading')
-              : localize('com_agents_empty_state_heading')
-          }
-        >
-          <h3 className="mb-2 text-lg font-medium">
-            {searchQuery
-              ? localize('com_agents_search_empty_heading')
-              : localize('com_agents_empty_state_heading')}
-          </h3>
-          <p className="text-sm">
-            {searchQuery
-              ? localize('com_agents_no_results')
-              : localize('com_agents_none_in_category')}
-          </p>
-        </div>
-      ) : (
-        <>
-          {/* Announcement for screen readers */}
-          <div id="search-results-count" className="sr-only" aria-live="polite" aria-atomic="true">
-            {localize('com_agents_grid_announcement', {
-              count: currentAgents?.length || 0,
-              category: getCategoryDisplayName(category),
-            })}
-          </div>
-
-          {/* Agent grid - 2 per row with proper semantic structure */}
-          {currentAgents && currentAgents.length > 0 && (
-            <div
-              className="grid grid-cols-1 gap-6 md:grid-cols-2"
-              role="grid"
-              aria-label={localize('com_agents_grid_announcement', {
-                count: currentAgents.length,
-                category: getCategoryDisplayName(category),
-              })}
-            >
-              {currentAgents.map((agent: t.Agent, index: number) => (
-                <div key={`${agent.id}-${index}`} role="gridcell">
-                  <AgentCard agent={agent} onClick={() => onSelectAgent(agent)} />
-                </div>
-              ))}
-            </div>
-          )}
-
-          {/* Loading indicator when fetching more with accessibility */}
-          {isFetching && hasNextPage && (
-            <div
-              className="flex justify-center py-4"
-              role="status"
-              aria-live="polite"
-              aria-label={localize('com_agents_loading')}
-            >
-              <Spinner className="h-6 w-6 text-primary" />
-              <span className="sr-only">{localize('com_agents_loading')}</span>
-            </div>
-          )}
-
-          {/* Load more button with enhanced accessibility */}
-          {hasNextPage && !isFetching && (
-            <div className="mt-8 flex justify-center">
-              <Button
-                variant="outline"
-                onClick={handleLoadMore}
-                className={cn(
-                  'min-w-[160px] border-2 border-gray-300 bg-white px-6 py-3 font-medium text-gray-700',
-                  'shadow-sm transition-all duration-200 hover:border-gray-400 hover:bg-gray-50',
-                  'hover:shadow-md focus:ring-2 focus:ring-blue-500 focus:ring-offset-2',
-                  'dark:border-gray-600 dark:bg-gray-800 dark:text-gray-200',
-                  'dark:hover:border-gray-500 dark:hover:bg-gray-700 dark:focus:ring-blue-400',
-                )}
-                aria-label={localize('com_agents_load_more_label', {
-                  category: getCategoryDisplayName(category),
-                })}
-              >
-                {localize('com_agents_see_more')}
-              </Button>
-            </div>
-          )}
-        </>
-      )}
-    </div>
-  );
-
-  if (isLoading || (isFetching && !isFetchingNextPage)) {
-    return loadingSkeleton;
-  }
-  return mainContent;
-};
-
-export default AgentGrid;

client/src/components/SidePanel/Agents/AgentMarketplace.tsx

@@ -1,301 +0,0 @@
-import React, { useState, useEffect, useMemo } from 'react';
-import { useOutletContext } from 'react-router-dom';
-import { useSearchParams, useParams, useNavigate } from 'react-router-dom';
-import { useSetRecoilState, useRecoilValue } from 'recoil';
-
-import type t from 'librechat-data-provider';
-import type { ContextType } from '~/common';
-
-import { useGetEndpointsQuery, useGetAgentCategoriesQuery } from '~/data-provider';
-import { useDocumentTitle } from '~/hooks';
-import useLocalize from '~/hooks/useLocalize';
-import { TooltipAnchor, Button } from '~/components/ui';
-import { NewChatIcon } from '~/components/svg';
-import { OpenSidebar } from '~/components/Chat/Menus';
-import { SidePanelGroup } from '~/components/SidePanel';
-import { MarketplaceProvider } from './MarketplaceContext';
-import CategoryTabs from './CategoryTabs';
-import AgentDetail from './AgentDetail';
-import SearchBar from './SearchBar';
-import AgentGrid from './AgentGrid';
-import store from '~/store';
-
-interface AgentMarketplaceProps {
-  className?: string;
-}
-
-/**
- * AgentMarketplace - Main component for browsing and discovering agents
- *
- * Provides tabbed navigation for different agent categories,
- * search functionality, and detailed agent view through a modal dialog.
- * Uses URL parameters for state persistence and deep linking.
- */
-const AgentMarketplace: React.FC<AgentMarketplaceProps> = ({ className = '' }) => {
-  const localize = useLocalize();
-  const navigate = useNavigate();
-  const [searchParams, setSearchParams] = useSearchParams();
-  const { category } = useParams();
-  const setHideSidePanel = useSetRecoilState(store.hideSidePanel);
-  const hideSidePanel = useRecoilValue(store.hideSidePanel);
-  const { navVisible, setNavVisible } = useOutletContext<ContextType>();
-
-  // Get URL parameters (default to 'promoted' instead of 'all')
-  const activeTab = category || 'promoted';
-  const searchQuery = searchParams.get('q') || '';
-  const selectedAgentId = searchParams.get('agent_id') || '';
-
-  // Local state
-  const [isDetailOpen, setIsDetailOpen] = useState(false);
-  const [selectedAgent, setSelectedAgent] = useState<t.Agent | null>(null);
-
-  // Set page title
-  useDocumentTitle(`${localize('com_agents_marketplace')} | LibreChat`);
-
-  // Ensure right sidebar is always visible in marketplace
-  useEffect(() => {
-    setHideSidePanel(false);
-
-    // Also try to force expand via localStorage
-    localStorage.setItem('hideSidePanel', 'false');
-    localStorage.setItem('fullPanelCollapse', 'false');
-  }, [setHideSidePanel, hideSidePanel]);
-
-  // Ensure endpoints config is loaded first (required for agent queries)
-  useGetEndpointsQuery();
-
-  // Fetch categories using existing query pattern
-  const categoriesQuery = useGetAgentCategoriesQuery({
-    staleTime: 1000 * 60 * 15, // 15 minutes - categories rarely change
-    refetchOnWindowFocus: false,
-    refetchOnReconnect: false,
-    refetchOnMount: false,
-  });
-
-  /**
-   * Handle agent card selection
-   *
-   * @param agent - The selected agent object
-   */
-  const handleAgentSelect = (agent: t.Agent) => {
-    // Update URL with selected agent
-    const newParams = new URLSearchParams(searchParams);
-    newParams.set('agent_id', agent.id);
-    setSearchParams(newParams);
-    setSelectedAgent(agent);
-    setIsDetailOpen(true);
-  };
-
-  /**
-   * Handle closing the agent detail dialog
-   */
-  const handleDetailClose = () => {
-    const newParams = new URLSearchParams(searchParams);
-    newParams.delete('agent_id');
-    setSearchParams(newParams);
-    setSelectedAgent(null);
-    setIsDetailOpen(false);
-  };
-
-  /**
-   * Handle category tab selection changes
-   *
-   * @param tabValue - The selected category value
-   */
-  const handleTabChange = (tabValue: string) => {
-    const currentSearchParams = searchParams.toString();
-    const searchParamsStr = currentSearchParams ? `?${currentSearchParams}` : '';
-
-    // Navigate to the selected category
-    if (tabValue === 'promoted') {
-      navigate(`/agents${searchParamsStr}`);
-    } else {
-      navigate(`/agents/${tabValue}${searchParamsStr}`);
-    }
-  };
-
-  /**
-   * Handle search query changes
-   *
-   * @param query - The search query string
-   */
-  const handleSearch = (query: string) => {
-    const newParams = new URLSearchParams(searchParams);
-    if (query.trim()) {
-      newParams.set('q', query.trim());
-      // Switch to "all" category when starting a new search
-      navigate(`/agents/all?${newParams.toString()}`);
-    } else {
-      newParams.delete('q');
-      // Preserve current category when clearing search
-      const currentCategory = activeTab;
-      if (currentCategory === 'promoted') {
-        navigate(`/agents${newParams.toString() ? `?${newParams.toString()}` : ''}`);
-      } else {
-        navigate(
-          `/agents/${currentCategory}${newParams.toString() ? `?${newParams.toString()}` : ''}`,
-        );
-      }
-    }
-  };
-
-  /**
-   * Handle new chat button click
-   */
-  const handleNewChat = (e: React.MouseEvent<HTMLButtonElement>) => {
-    if (e.button === 0 && (e.ctrlKey || e.metaKey)) {
-      window.open('/c/new', '_blank');
-      return;
-    }
-    navigate('/c/new');
-  };
-
-  // Check if a detail view should be open based on URL
-  useEffect(() => {
-    setIsDetailOpen(!!selectedAgentId);
-  }, [selectedAgentId]);
-
-  // Layout configuration for SidePanelGroup
-  const defaultLayout = useMemo(() => {
-    const resizableLayout = localStorage.getItem('react-resizable-panels:layout');
-    return typeof resizableLayout === 'string' ? JSON.parse(resizableLayout) : undefined;
-  }, []);
-
-  const defaultCollapsed = useMemo(() => {
-    const collapsedPanels = localStorage.getItem('react-resizable-panels:collapsed');
-    return typeof collapsedPanels === 'string' ? JSON.parse(collapsedPanels) : true;
-  }, []);
-
-  const fullCollapse = useMemo(() => localStorage.getItem('fullPanelCollapse') === 'true', []);
-
-  return (
-    <div className={`relative flex w-full grow overflow-hidden bg-presentation ${className}`}>
-      <MarketplaceProvider>
-        <SidePanelGroup
-          defaultLayout={defaultLayout}
-          fullPanelCollapse={fullCollapse}
-          defaultCollapsed={defaultCollapsed}
-        >
-          <main className="flex h-full flex-col overflow-y-auto" role="main">
-            {/* Simplified header for agents marketplace - only show nav controls when needed */}
-            <div className="sticky top-0 z-10 flex h-14 w-full items-center justify-between bg-white p-2 font-semibold text-text-primary dark:bg-gray-800">
-              <div className="mx-1 flex items-center gap-2">
-                {!navVisible && <OpenSidebar setNavVisible={setNavVisible} />}
-                {!navVisible && (
-                  <TooltipAnchor
-                    description={localize('com_ui_new_chat')}
-                    render={
-                      <Button
-                        size="icon"
-                        variant="outline"
-                        data-testid="agents-new-chat-button"
-                        aria-label={localize('com_ui_new_chat')}
-                        className="rounded-xl border border-border-light bg-surface-secondary p-2 hover:bg-surface-hover max-md:hidden"
-                        onClick={handleNewChat}
-                      >
-                        <NewChatIcon />
-                      </Button>
-                    }
-                  />
-                )}
-              </div>
-            </div>
-            <div className="container mx-auto max-w-4xl px-4 py-8">
-              {/* Hero Section - ChatGPT Style */}
-              <div className="mb-8 mt-12 text-center">
-                <h1 className="mb-3 text-5xl font-bold tracking-tight text-gray-900 dark:text-white">
-                  {localize('com_agents_marketplace')}
-                </h1>
-                <p className="mx-auto mb-6 max-w-2xl text-lg text-gray-600 dark:text-gray-300">
-                  {localize('com_agents_marketplace_subtitle')}
-                </p>
-
-                {/* Search bar */}
-                <div className="mx-auto max-w-2xl">
-                  <SearchBar value={searchQuery} onSearch={handleSearch} />
-                </div>
-              </div>
-
-              {/* Category tabs */}
-              <CategoryTabs
-                categories={categoriesQuery.data || []}
-                activeTab={activeTab}
-                isLoading={categoriesQuery.isLoading}
-                onChange={handleTabChange}
-              />
-
-              {/* Category header - only show when not searching */}
-              {!searchQuery && (
-                <div className="mb-6">
-                  {(() => {
-                    // Get category data for display
-                    const getCategoryData = () => {
-                      if (activeTab === 'promoted') {
-                        return {
-                          name: localize('com_agents_top_picks'),
-                          description: localize('com_agents_recommended'),
-                        };
-                      }
-                      if (activeTab === 'all') {
-                        return {
-                          name: 'All Agents',
-                          description: 'Browse all shared agents across all categories',
-                        };
-                      }
-
-                      // Find the category in the API data
-                      const categoryData = categoriesQuery.data?.find(
-                        (cat) => cat.value === activeTab,
-                      );
-                      if (categoryData) {
-                        return {
-                          name: categoryData.label,
-                          description: categoryData.description || '',
-                        };
-                      }
-
-                      // Fallback for unknown categories
-                      return {
-                        name: activeTab.charAt(0).toUpperCase() + activeTab.slice(1),
-                        description: '',
-                      };
-                    };
-
-                    const { name, description } = getCategoryData();
-
-                    return (
-                      <div className="text-left">
-                        <h2 className="text-2xl font-bold text-gray-900 dark:text-white">{name}</h2>
-                        {description && (
-                          <p className="mt-2 text-gray-600 dark:text-gray-300">{description}</p>
-                        )}
-                      </div>
-                    );
-                  })()}
-                </div>
-              )}
-
-              {/* Agent grid */}
-              <AgentGrid
-                category={activeTab}
-                searchQuery={searchQuery}
-                onSelectAgent={handleAgentSelect}
-              />
-            </div>
-
-            {/* Agent detail dialog */}
-            {isDetailOpen && selectedAgent && (
-              <AgentDetail
-                agent={selectedAgent}
-                isOpen={isDetailOpen}
-                onClose={handleDetailClose}
-              />
-            )}
-          </main>
-        </SidePanelGroup>
-      </MarketplaceProvider>
-    </div>
-  );
-};
-
-export default AgentMarketplace;

client/src/components/SidePanel/Agents/AgentPanel.tsx

@@ -7,9 +7,6 @@ import {
   Constants,
   SystemRoles,
   EModelEndpoint,
-  TAgentsEndpoint,
-  PERMISSION_BITS,
-  TEndpointsConfig,
   isAssistantsEndpoint,
 } from 'librechat-data-provider';
 import type { AgentForm, StringOption } from '~/common';
@@ -17,10 +14,8 @@ import {
   useCreateAgentMutation,
   useUpdateAgentMutation,
   useGetAgentByIdQuery,
-  useGetExpandedAgentByIdQuery,
 } from '~/data-provider';
 import { createProviderOption, getDefaultAgentFormValues } from '~/utils';
-import { useResourcePermissions } from '~/hooks/useResourcePermissions';
 import { useSelectAgent, useLocalize, useAuthContext } from '~/hooks';
 import { useAgentPanelContext } from '~/Providers/AgentPanelContext';
 import AgentPanelSkeleton from './AgentPanelSkeleton';
@@ -33,19 +28,15 @@ import { Button } from '~/components';
 import ModelPanel from './ModelPanel';
 import { Panel } from '~/common';
 
-export default function AgentPanel({
-  agentsConfig,
-  endpointsConfig,
-}: {
-  agentsConfig: TAgentsEndpoint | null;
-  endpointsConfig: TEndpointsConfig;
-}) {
+export default function AgentPanel() {
   const localize = useLocalize();
   const { user } = useAuthContext();
   const { showToast } = useToastContext();
   const {
     activePanel,
+    agentsConfig,
     setActivePanel,
+    endpointsConfig,
     setCurrentAgentId,
     agent_id: current_agent_id,
   } = useAgentPanelContext();
@@ -53,29 +44,10 @@ export default function AgentPanel({
   const { onSelect: onSelectAgent } = useSelectAgent();
 
   const modelsQuery = useGetModelsQuery();
-
-  // Basic agent query for initial permission check
-  const basicAgentQuery = useGetAgentByIdQuery(current_agent_id ?? '', {
+  const agentQuery = useGetAgentByIdQuery(current_agent_id ?? '', {
     enabled: !!(current_agent_id ?? '') && current_agent_id !== Constants.EPHEMERAL_AGENT_ID,
   });
 
-  const { hasPermission, isLoading: permissionsLoading } = useResourcePermissions(
-    'agent',
-    basicAgentQuery.data?._id || '',
-  );
-
-  const canEdit = hasPermission(PERMISSION_BITS.EDIT);
-
-  const expandedAgentQuery = useGetExpandedAgentByIdQuery(current_agent_id ?? '', {
-    enabled:
-      !!(current_agent_id ?? '') &&
-      current_agent_id !== Constants.EPHEMERAL_AGENT_ID &&
-      canEdit &&
-      !permissionsLoading,
-  });
-
-  const agentQuery = canEdit && expandedAgentQuery.data ? expandedAgentQuery : basicAgentQuery;
-
   const models = useMemo(() => modelsQuery.data ?? {}, [modelsQuery.data]);
   const methods = useForm<AgentForm>({
     defaultValues: getDefaultAgentFormValues(),
@@ -205,8 +177,6 @@ export default function AgentPanel({
         end_after_tools,
         hide_sequential_outputs,
         recursion_limit,
-        category,
-        support_contact,
       } = data;
 
       const model = _model ?? '';
@@ -229,8 +199,6 @@ export default function AgentPanel({
             end_after_tools,
             hide_sequential_outputs,
             recursion_limit,
-            category,
-            support_contact,
           },
         });
         return;
@@ -242,12 +210,6 @@ export default function AgentPanel({
           status: 'error',
         });
       }
-      if (!name) {
-        return showToast({
-          message: localize('com_agents_missing_name'),
-          status: 'error',
-        });
-      }
 
       create.mutate({
         name,
@@ -262,8 +224,6 @@ export default function AgentPanel({
         end_after_tools,
         hide_sequential_outputs,
         recursion_limit,
-        category,
-        support_contact,
       });
     },
     [agent_id, create, update, showToast, localize],
@@ -276,16 +236,19 @@ export default function AgentPanel({
   }, [agent_id, onSelectAgent]);
 
   const canEditAgent = useMemo(() => {
-    if (!agentQuery.data?.id) {
-      return true;
-    }
+    const canEdit =
+      (agentQuery.data?.isCollaborative ?? false)
+        ? true
+        : agentQuery.data?.author === user?.id || user?.role === SystemRoles.ADMIN;
 
-    if (user?.role === SystemRoles.ADMIN) {
-      return true;
-    }
-
-    return canEdit;
-  }, [agentQuery.data?.id, user?.role, canEdit]);
+    return agentQuery.data?.id != null && agentQuery.data.id ? canEdit : true;
+  }, [
+    agentQuery.data?.isCollaborative,
+    agentQuery.data?.author,
+    agentQuery.data?.id,
+    user?.id,
+    user?.role,
+  ]);
 
   return (
     <FormProvider {...methods}>
@@ -294,7 +257,7 @@ export default function AgentPanel({
         className="scrollbar-gutter-stable h-auto w-full flex-shrink-0 overflow-x-hidden"
         aria-label="Agent configuration form"
       >
-        <div className="mx-1 mt-2 flex w-full flex-wrap gap-2">
+        <div className="mt-2 flex w-full flex-wrap gap-2">
           <div className="w-full">
             <AgentSelect
               createMutation={create}
@@ -354,14 +317,10 @@ export default function AgentPanel({
           <ModelPanel models={models} providers={providers} setActivePanel={setActivePanel} />
         )}
         {canEditAgent && !agentQuery.isInitialLoading && activePanel === Panel.builder && (
-          <AgentConfig
-            createMutation={create}
-            agentsConfig={agentsConfig}
-            endpointsConfig={endpointsConfig}
-          />
+          <AgentConfig createMutation={create} />
         )}
         {canEditAgent && !agentQuery.isInitialLoading && activePanel === Panel.advanced && (
-          <AdvancedPanel setActivePanel={setActivePanel} agentsConfig={agentsConfig} />
+          <AdvancedPanel />
         )}
         {canEditAgent && !agentQuery.isInitialLoading && (
           <AgentFooter

client/src/components/SidePanel/Agents/AgentPanelSwitch.tsx

@@ -1,8 +1,5 @@
-import { useEffect, useMemo } from 'react';
-import { EModelEndpoint, AgentCapabilities } from 'librechat-data-provider';
-import type { TConfig, TEndpointsConfig, TAgentsEndpoint } from 'librechat-data-provider';
+import { useEffect } from 'react';
 import { AgentPanelProvider, useAgentPanelContext } from '~/Providers/AgentPanelContext';
-import { useGetEndpointsQuery } from '~/data-provider';
 import VersionPanel from './Version/VersionPanel';
 import { useChatContext } from '~/Providers';
 import ActionsPanel from './ActionsPanel';
@@ -22,21 +19,6 @@ function AgentPanelSwitchWithContext() {
   const { conversation } = useChatContext();
   const { activePanel, setCurrentAgentId } = useAgentPanelContext();
 
-  // TODO: Implement MCP endpoint
-  const { data: endpointsConfig = {} as TEndpointsConfig } = useGetEndpointsQuery();
-
-  const agentsConfig = useMemo<TAgentsEndpoint | null>(() => {
-    const config = endpointsConfig?.[EModelEndpoint.agents] ?? null;
-    if (!config) return null;
-
-    return {
-      ...(config as TConfig),
-      capabilities: Array.isArray(config.capabilities)
-        ? config.capabilities.map((cap) => cap as unknown as AgentCapabilities)
-        : ([] as AgentCapabilities[]),
-    } as TAgentsEndpoint;
-  }, [endpointsConfig]);
-
   useEffect(() => {
     const agent_id = conversation?.agent_id ?? '';
     if (agent_id) {
@@ -57,5 +39,5 @@ function AgentPanelSwitchWithContext() {
   if (activePanel === Panel.mcp) {
     return <MCPPanel />;
   }
-  return <AgentPanel agentsConfig={agentsConfig} endpointsConfig={endpointsConfig} />;
+  return <AgentPanel />;
 }

client/src/components/SidePanel/Agents/AgentSelect.tsx

@@ -1,11 +1,7 @@
 import { EarthIcon } from 'lucide-react';
 import { useCallback, useEffect, useRef } from 'react';
 import { useFormContext, Controller } from 'react-hook-form';
-import {
-  AgentCapabilities,
-  defaultAgentFormValues,
-  PERMISSION_BITS,
-} from 'librechat-data-provider';
+import { AgentCapabilities, defaultAgentFormValues } from 'librechat-data-provider';
 import type { UseMutationResult, QueryObserverResult } from '@tanstack/react-query';
 import type { Agent, AgentCreateParams } from 'librechat-data-provider';
 import type { TAgentCapabilities, AgentForm } from '~/common';
@@ -32,25 +28,24 @@ export default function AgentSelect({
   const { control, reset } = useFormContext();
 
   const { data: startupConfig } = useGetStartupConfig();
-  const { data: agents = null } = useListAgentsQuery(
-    { requiredPermission: PERMISSION_BITS.EDIT },
-    {
-      select: (res) =>
-        res.data.map((agent) =>
-          processAgentOption({
-            agent: {
-              ...agent,
-              name: agent.name || agent.id,
-            },
-            instanceProjectId: startupConfig?.instanceProjectId,
-          }),
-        ),
-    },
-  );
+  const { data: agents = null } = useListAgentsQuery(undefined, {
+    select: (res) =>
+      res.data.map((agent) =>
+        processAgentOption({
+          agent: {
+            ...agent,
+            name: agent.name || agent.id,
+          },
+          instanceProjectId: startupConfig?.instanceProjectId,
+        }),
+      ),
+  });
 
   const resetAgentForm = useCallback(
     (fullAgent: Agent) => {
-      const isGlobal = fullAgent.isPublic ?? false;
+      const { instanceProjectId } = startupConfig ?? {};
+      const isGlobal =
+        (instanceProjectId != null && fullAgent.projectIds?.includes(instanceProjectId)) ?? false;
       const update = {
         ...fullAgent,
         provider: createProviderOption(fullAgent.provider),
@@ -82,10 +77,6 @@ export default function AgentSelect({
         agent: update,
         model: update.model,
         tools: agentTools,
-        // Ensure the category is properly set for the form
-        category: fullAgent.category || 'general',
-        // Make sure support_contact is properly loaded
-        support_contact: fullAgent.support_contact,
       };
 
       Object.entries(fullAgent).forEach(([name, value]) => {

client/src/components/SidePanel/Agents/AgentTool.tsx

@@ -226,7 +226,7 @@ export default function AgentTool({
                             }}
                             className={cn(
                               'h-4 w-4 rounded border border-gray-300 transition-all duration-200 hover:border-gray-400 dark:border-gray-600 dark:hover:border-gray-500',
-                              isExpanded ? 'opacity-100' : 'opacity-0',
+                              isExpanded ? 'visible' : 'pointer-events-none invisible',
                             )}
                             onClick={(e) => e.stopPropagation()}
                             onKeyDown={(e) => {