chore: update @radix-ui/react-accordion to version 1.2.11

fix: merge conflicts
style: update itemClassName in ToolsDropdown for improved UI consistency
2025-07-26 15:03:26 +02:00 · 2025-07-26 03:07:03 +02:00 · 2025-07-26 01:55:17 +02:00 · 2025-07-26 01:55:16 +02:00 · 2025-07-26 01:55:16 +02:00 · 2025-07-26 01:55:16 +02:00
728 changed files with 8607 additions and 22015 deletions
--- a/.env.example
+++ b/.env.example
@@ -490,21 +490,6 @@ SAML_IMAGE_URL=
 # SAML_USE_AUTHN_RESPONSE_SIGNED=


-#===============================================#
-# Microsoft Graph API / Entra ID Integration  #
-#===============================================#
-
-# Enable Entra ID people search integration in permissions/sharing system
-# When enabled, the people picker will search both local database and Entra ID
-USE_ENTRA_ID_FOR_PEOPLE_SEARCH=false
-
-# When enabled, entra id groups owners will be considered as members of the group
-ENTRA_ID_INCLUDE_OWNERS_AS_MEMBERS=false
-
-# Microsoft Graph API scopes needed for people/group search
-# Default scopes provide access to user profiles and group memberships
-OPENID_GRAPH_SCOPES=User.Read,People.Read,GroupMember.Read.All
-
 # LDAP
 LDAP_URL=
 LDAP_BIND_DN=
@@ -642,6 +627,15 @@ HELP_AND_FAQ_URL=https://librechat.ai
 # Redis connection limits
 # REDIS_MAX_LISTENERS=40

+# Redis ping interval in seconds (0 = disabled, >0 = enabled)
+# When set to a positive integer, Redis clients will ping the server at this interval to keep connections alive
+# When unset or 0, no pinging is performed (recommended for most use cases)
+# REDIS_PING_INTERVAL=300
+
+# Force specific cache namespaces to use in-memory storage even when Redis is enabled
+# Comma-separated list of CacheKeys (e.g., STATIC_CONFIG,ROLES,MESSAGES)
+# FORCED_IN_MEMORY_CACHE_NAMESPACES=STATIC_CONFIG,ROLES
+
 #==================================================#
 #                      Others                      #
 #==================================================#
--- a/.github/workflows/client.yml
+++ b/.github/workflows/client.yml
@@ -1,6 +1,11 @@
 name: Publish `@librechat/client` to NPM

 on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'packages/client/package.json'
  workflow_dispatch:
    inputs:
      reason:
@@ -17,16 +22,37 @@ jobs:
      - name: Use Node.js
        uses: actions/setup-node@v4
        with:
-          node-version: '18.x'
-          
-      - name: Check if client package exists
+          node-version: '20.x'
+        
+      - name: Install client dependencies
+        run: cd packages/client && npm ci
+        
+      - name: Build client
+        run: cd packages/client && npm run build
+        
+      - name: Set up npm authentication
+        run: echo "//registry.npmjs.org/:_authToken=${{ secrets.PUBLISH_NPM_TOKEN }}" > ~/.npmrc
+        
+      - name: Check version change
+        id: check
+        working-directory: packages/client
        run: |
-          if [ -d "packages/client" ]; then
-            echo "Client package directory found"
+          PACKAGE_VERSION=$(node -p "require('./package.json').version")
+          PUBLISHED_VERSION=$(npm view @librechat/client version 2>/dev/null || echo "0.0.0")
+          if [ "$PACKAGE_VERSION" = "$PUBLISHED_VERSION" ]; then
+            echo "No version change, skipping publish"
+            echo "skip=true" >> $GITHUB_OUTPUT
          else
-            echo "Client package directory not found - workflow ready for future use"
-            exit 0
+            echo "Version changed, proceeding with publish"
+            echo "skip=false" >> $GITHUB_OUTPUT
          fi
-          
-      - name: Placeholder for future publishing
-        run: echo "Client package publishing workflow is ready" 
+            
+      - name: Pack package
+        if: steps.check.outputs.skip != 'true'
+        working-directory: packages/client
+        run: npm pack
+        
+      - name: Publish
+        if: steps.check.outputs.skip != 'true'
+        working-directory: packages/client
+        run: npm publish *.tgz --access public
--- a/.github/workflows/generate-release-changelog-pr.yml
+++ b/.github/workflows/generate-release-changelog-pr.yml
@@ -1,95 +0,0 @@
-name: Generate Release Changelog PR
-
-on:
-  push:
-    tags:
-      - 'v*.*.*'
-  workflow_dispatch:
-
-jobs:
-  generate-release-changelog-pr:
-    permissions:
-      contents: write    # Needed for pushing commits and creating branches.
-      pull-requests: write
-    runs-on: ubuntu-latest
-    steps:
-      # 1. Checkout the repository (with full history).
-      - name: Checkout Repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      # 2. Generate the release changelog using our custom configuration.
-      - name: Generate Release Changelog
-        id: generate_release
-        uses: mikepenz/release-changelog-builder-action@v5.1.0
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          configuration: ".github/configuration-release.json"
-          owner: ${{ github.repository_owner }}
-          repo: ${{ github.event.repository.name }}
-          outputFile: CHANGELOG-release.md
-
-      # 3. Update the main CHANGELOG.md:
-      #    - If it doesn't exist, create it with a basic header.
-      #    - Remove the "Unreleased" section (if present).
-      #    - Prepend the new release changelog above previous releases.
-      #    - Remove all temporary files before committing.
-      - name: Update CHANGELOG.md
-        run: |
-          # Determine the release tag, e.g. "v1.2.3"
-          TAG=${GITHUB_REF##*/}
-          echo "Using release tag: $TAG"
-          
-          # Ensure CHANGELOG.md exists; if not, create a basic header.
-          if [ ! -f CHANGELOG.md ]; then
-            echo "# Changelog" > CHANGELOG.md
-            echo "" >> CHANGELOG.md
-            echo "All notable changes to this project will be documented in this file." >> CHANGELOG.md
-            echo "" >> CHANGELOG.md
-          fi
-
-          echo "Updating CHANGELOG.md…"
-          
-          # Remove the "Unreleased" section (from "## [Unreleased]" until the first occurrence of '---') if it exists.
-          if grep -q "^## \[Unreleased\]" CHANGELOG.md; then
-            awk '/^## \[Unreleased\]/{flag=1} flag && /^---/{flag=0; next} !flag' CHANGELOG.md > CHANGELOG.cleaned
-          else
-            cp CHANGELOG.md CHANGELOG.cleaned
-          fi
-
-          # Split the cleaned file into:
-          #   - header.md: content before the first release header ("## [v...").
-          #   - tail.md: content from the first release header onward.
-          awk '/^## \[v/{exit} {print}' CHANGELOG.cleaned > header.md
-          awk 'f{print} /^## \[v/{f=1; print}' CHANGELOG.cleaned > tail.md
-
-          # Combine header, the new release changelog, and the tail.
-          echo "Combining updated changelog parts..."
-          cat header.md CHANGELOG-release.md > CHANGELOG.md.new
-          echo "" >> CHANGELOG.md.new
-          cat tail.md >> CHANGELOG.md.new
-
-          mv CHANGELOG.md.new CHANGELOG.md
-
-          # Remove temporary files.
-          rm -f CHANGELOG.cleaned header.md tail.md CHANGELOG-release.md
-
-          echo "Final CHANGELOG.md content:"
-          cat CHANGELOG.md
-
-      # 4. Create (or update) the Pull Request with the updated CHANGELOG.md.
-      - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v7
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          sign-commits: true
-          commit-message: "chore: update CHANGELOG for release ${{ github.ref_name }}"
-          base: main
-          branch: "changelog/${{ github.ref_name }}"
-          reviewers: danny-avila
-          title: "📜 docs: Changelog for release ${{ github.ref_name }}"
-          body: |
-            **Description**:
-            - This PR updates the CHANGELOG.md by removing the "Unreleased" section and adding new release notes for release ${{ github.ref_name }} above previous releases.
--- a/.github/workflows/generate-unreleased-changelog-pr.yml
+++ b/.github/workflows/generate-unreleased-changelog-pr.yml
@@ -1,107 +0,0 @@
-name: Generate Unreleased Changelog PR
-
-on:
-  schedule:
-    - cron: "0 0 * * 1"  # Runs every Monday at 00:00 UTC
-  workflow_dispatch:
-
-jobs:
-  generate-unreleased-changelog-pr:
-    permissions:
-      contents: write    # Needed for pushing commits and creating branches.
-      pull-requests: write
-    runs-on: ubuntu-latest
-    steps:
-      # 1. Checkout the repository on main.
-      - name: Checkout Repository on Main
-        uses: actions/checkout@v4
-        with:
-          ref: main
-          fetch-depth: 0
-
-      # 4. Get the latest version tag.
-      - name: Get Latest Tag
-        id: get_latest_tag
-        run: |
-          LATEST_TAG=$(git describe --tags $(git rev-list --tags --max-count=1) || echo "none")
-          echo "Latest tag: $LATEST_TAG"
-          echo "tag=$LATEST_TAG" >> $GITHUB_OUTPUT
-
-      # 5. Generate the Unreleased changelog.
-      - name: Generate Unreleased Changelog
-        id: generate_unreleased
-        uses: mikepenz/release-changelog-builder-action@v5.1.0
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          configuration: ".github/configuration-unreleased.json"
-          owner: ${{ github.repository_owner }}
-          repo: ${{ github.event.repository.name }}
-          outputFile: CHANGELOG-unreleased.md
-          fromTag: ${{ steps.get_latest_tag.outputs.tag }}
-          toTag: main
-
-      # 7. Update CHANGELOG.md with the new Unreleased section.
-      - name: Update CHANGELOG.md
-        id: update_changelog
-        run: |
-          # Create CHANGELOG.md if it doesn't exist.
-          if [ ! -f CHANGELOG.md ]; then
-            echo "# Changelog" > CHANGELOG.md
-            echo "" >> CHANGELOG.md
-            echo "All notable changes to this project will be documented in this file." >> CHANGELOG.md
-            echo "" >> CHANGELOG.md
-          fi
-          
-          echo "Updating CHANGELOG.md…"
-          
-          # Extract content before the "## [Unreleased]" (or first version header if missing).
-          if grep -q "^## \[Unreleased\]" CHANGELOG.md; then
-            awk '/^## \[Unreleased\]/{exit} {print}' CHANGELOG.md > CHANGELOG_TMP.md
-          else
-            awk '/^## \[v/{exit} {print}' CHANGELOG.md > CHANGELOG_TMP.md
-          fi
-          
-          # Append the generated Unreleased changelog.
-          echo "" >> CHANGELOG_TMP.md
-          cat CHANGELOG-unreleased.md >> CHANGELOG_TMP.md
-          echo "" >> CHANGELOG_TMP.md
-          
-          # Append the remainder of the original changelog (starting from the first version header).
-          awk 'f{print} /^## \[v/{f=1; print}' CHANGELOG.md >> CHANGELOG_TMP.md
-          
-          # Replace the old file with the updated file.
-          mv CHANGELOG_TMP.md CHANGELOG.md
-          
-          # Remove the temporary generated file.
-          rm -f CHANGELOG-unreleased.md
-          
-          echo "Final CHANGELOG.md:"
-          cat CHANGELOG.md
-
-      # 8. Check if CHANGELOG.md has any updates.
-      - name: Check for CHANGELOG.md changes
-        id: changelog_changes
-        run: |
-          if git diff --quiet CHANGELOG.md; then
-            echo "has_changes=false" >> $GITHUB_OUTPUT
-          else
-            echo "has_changes=true" >> $GITHUB_OUTPUT
-          fi
-
-      # 9. Create (or update) the Pull Request only if there are changes.
-      - name: Create Pull Request
-        if: steps.changelog_changes.outputs.has_changes == 'true'
-        uses: peter-evans/create-pull-request@v7
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          base: main
-          branch: "changelog/unreleased-update"
-          sign-commits: true
-          commit-message: "action: update Unreleased changelog"
-          title: "📜 docs: Unreleased Changelog"
-          body: |
-            **Description**:
-            - This PR updates the Unreleased section in CHANGELOG.md.
-            - It compares the current main branch with the latest version tag (determined as ${{ steps.get_latest_tag.outputs.tag }}),
-              regenerates the Unreleased changelog, removes any old Unreleased block, and inserts the new content.
--- a/.github/workflows/i18n-unused-keys.yml
+++ b/.github/workflows/i18n-unused-keys.yml
@@ -6,6 +6,7 @@ on:
      - "client/src/**"
      - "api/**"
      - "packages/data-provider/src/**"
+      - "packages/client/**"

 jobs:
  detect-unused-i18n-keys:
@@ -23,7 +24,7 @@ jobs:

          # Define paths
          I18N_FILE="client/src/locales/en/translation.json"
-          SOURCE_DIRS=("client/src" "api" "packages/data-provider/src")
+          SOURCE_DIRS=("client/src" "api" "packages/data-provider/src" "packages/client")

          # Check if translation file exists
          if [[ ! -f "$I18N_FILE" ]]; then
--- a/.github/workflows/unused-packages.yml
+++ b/.github/workflows/unused-packages.yml
@@ -7,6 +7,7 @@ on:
      - 'package-lock.json'
      - 'client/**'
      - 'api/**'
+      - 'packages/client/**'

 jobs:
  detect-unused-packages:
@@ -28,7 +29,7 @@ jobs:

      - name: Validate JSON files
        run: |
-          for FILE in package.json client/package.json api/package.json; do
+          for FILE in package.json client/package.json api/package.json packages/client/package.json; do
            if [[ -f "$FILE" ]]; then
              jq empty "$FILE" || (echo "::error title=Invalid JSON::$FILE is invalid" && exit 1)
            fi
@@ -63,12 +64,31 @@ jobs:
            local folder=$1
            local output_file=$2
            if [[ -d "$folder" ]]; then
-              grep -rEho "require\\(['\"]([a-zA-Z0-9@/._-]+)['\"]\\)" "$folder" --include=\*.{js,ts,mjs,cjs} | \
+              # Extract require() statements
+              grep -rEho "require\\(['\"]([a-zA-Z0-9@/._-]+)['\"]\\)" "$folder" --include=\*.{js,ts,tsx,jsx,mjs,cjs} | \
                sed -E "s/require\\(['\"]([a-zA-Z0-9@/._-]+)['\"]\\)/\1/" > "$output_file"
          
-              grep -rEho "import .* from ['\"]([a-zA-Z0-9@/._-]+)['\"]" "$folder" --include=\*.{js,ts,mjs,cjs} | \
+              # Extract ES6 imports - various patterns
+              # import x from 'module'
+              grep -rEho "import .* from ['\"]([a-zA-Z0-9@/._-]+)['\"]" "$folder" --include=\*.{js,ts,tsx,jsx,mjs,cjs} | \
                sed -E "s/import .* from ['\"]([a-zA-Z0-9@/._-]+)['\"]/\1/" >> "$output_file"
+              
+              # import 'module' (side-effect imports)
+              grep -rEho "import ['\"]([a-zA-Z0-9@/._-]+)['\"]" "$folder" --include=\*.{js,ts,tsx,jsx,mjs,cjs} | \
+                sed -E "s/import ['\"]([a-zA-Z0-9@/._-]+)['\"]/\1/" >> "$output_file"
+              
+              # export { x } from 'module' or export * from 'module'
+              grep -rEho "export .* from ['\"]([a-zA-Z0-9@/._-]+)['\"]" "$folder" --include=\*.{js,ts,tsx,jsx,mjs,cjs} | \
+                sed -E "s/export .* from ['\"]([a-zA-Z0-9@/._-]+)['\"]/\1/" >> "$output_file"
+              
+              # import type { x } from 'module' (TypeScript)
+              grep -rEho "import type .* from ['\"]([a-zA-Z0-9@/._-]+)['\"]" "$folder" --include=\*.{ts,tsx} | \
+                sed -E "s/import type .* from ['\"]([a-zA-Z0-9@/._-]+)['\"]/\1/" >> "$output_file"
          
+              # Remove subpath imports but keep the base package
+              # e.g., '@tanstack/react-query/devtools' becomes '@tanstack/react-query'
+              sed -i -E 's|^(@?[a-zA-Z0-9-]+(/[a-zA-Z0-9-]+)?)/.*|\1|' "$output_file"
+              
              sort -u "$output_file" -o "$output_file"
            else
              touch "$output_file"
@@ -78,13 +98,80 @@ jobs:
          extract_deps_from_code "." root_used_code.txt
          extract_deps_from_code "client" client_used_code.txt
          extract_deps_from_code "api" api_used_code.txt
+          
+          # Extract dependencies used by @librechat/client package
+          extract_deps_from_code "packages/client" packages_client_used_code.txt
+
+      - name: Get @librechat/client dependencies
+        id: get-librechat-client-deps
+        run: |
+          if [[ -f "packages/client/package.json" ]]; then
+            # Get all dependencies from @librechat/client (dependencies, devDependencies, and peerDependencies)
+            DEPS=$(jq -r '.dependencies // {} | keys[]' packages/client/package.json 2>/dev/null || echo "")
+            DEV_DEPS=$(jq -r '.devDependencies // {} | keys[]' packages/client/package.json 2>/dev/null || echo "")
+            PEER_DEPS=$(jq -r '.peerDependencies // {} | keys[]' packages/client/package.json 2>/dev/null || echo "")
+            
+            # Combine all dependencies
+            echo "$DEPS" > librechat_client_deps.txt
+            echo "$DEV_DEPS" >> librechat_client_deps.txt
+            echo "$PEER_DEPS" >> librechat_client_deps.txt
+            
+            # Also include dependencies that are imported in packages/client
+            cat packages_client_used_code.txt >> librechat_client_deps.txt
+            
+            # Remove empty lines and sort
+            grep -v '^$' librechat_client_deps.txt | sort -u > temp_deps.txt
+            mv temp_deps.txt librechat_client_deps.txt
+          else
+            touch librechat_client_deps.txt
+          fi
+
+      - name: Extract Workspace Dependencies
+        id: extract-workspace-deps
+        run: |
+          # Function to get dependencies from a workspace package that are used by another package
+          get_workspace_package_deps() {
+            local package_json=$1
+            local output_file=$2
+            
+            # Get all workspace dependencies (starting with @librechat/)
+            if [[ -f "$package_json" ]]; then
+              local workspace_deps=$(jq -r '.dependencies // {} | to_entries[] | select(.key | startswith("@librechat/")) | .key' "$package_json" 2>/dev/null || echo "")
+              
+              # For each workspace dependency, get its dependencies
+              for dep in $workspace_deps; do
+                # Convert @librechat/api to packages/api
+                local workspace_path=$(echo "$dep" | sed 's/@librechat\//packages\//')
+                local workspace_package_json="${workspace_path}/package.json"
+                
+                if [[ -f "$workspace_package_json" ]]; then
+                  # Extract all dependencies from the workspace package
+                  jq -r '.dependencies // {} | keys[]' "$workspace_package_json" 2>/dev/null >> "$output_file"
+                  # Also extract peerDependencies
+                  jq -r '.peerDependencies // {} | keys[]' "$workspace_package_json" 2>/dev/null >> "$output_file"
+                fi
+              done
+            fi
+            
+            if [[ -f "$output_file" ]]; then
+              sort -u "$output_file" -o "$output_file"
+            else
+              touch "$output_file"
+            fi
+          }
+          
+          # Get workspace dependencies for each package
+          get_workspace_package_deps "package.json" root_workspace_deps.txt
+          get_workspace_package_deps "client/package.json" client_workspace_deps.txt
+          get_workspace_package_deps "api/package.json" api_workspace_deps.txt

      - name: Run depcheck for root package.json
        id: check-root
        run: |
          if [[ -f "package.json" ]]; then
            UNUSED=$(depcheck --json | jq -r '.dependencies | join("\n")' || echo "")
-            UNUSED=$(comm -23 <(echo "$UNUSED" | sort) <(cat root_used_deps.txt root_used_code.txt | sort) || echo "")
+            # Exclude dependencies used in scripts, code, and workspace packages
+            UNUSED=$(comm -23 <(echo "$UNUSED" | sort) <(cat root_used_deps.txt root_used_code.txt root_workspace_deps.txt | sort) || echo "")
            echo "ROOT_UNUSED<<EOF" >> $GITHUB_ENV
            echo "$UNUSED" >> $GITHUB_ENV
            echo "EOF" >> $GITHUB_ENV
@@ -97,7 +184,8 @@ jobs:
            chmod -R 755 client
            cd client
            UNUSED=$(depcheck --json | jq -r '.dependencies | join("\n")' || echo "")
-            UNUSED=$(comm -23 <(echo "$UNUSED" | sort) <(cat ../client_used_deps.txt ../client_used_code.txt | sort) || echo "")
+            # Exclude dependencies used in scripts, code, and workspace packages
+            UNUSED=$(comm -23 <(echo "$UNUSED" | sort) <(cat ../client_used_deps.txt ../client_used_code.txt ../client_workspace_deps.txt | sort) || echo "")
            # Filter out false positives
            UNUSED=$(echo "$UNUSED" | grep -v "^micromark-extension-llm-math$" || echo "")
            echo "CLIENT_UNUSED<<EOF" >> $GITHUB_ENV
@@ -113,7 +201,8 @@ jobs:
            chmod -R 755 api
            cd api
            UNUSED=$(depcheck --json | jq -r '.dependencies | join("\n")' || echo "")
-            UNUSED=$(comm -23 <(echo "$UNUSED" | sort) <(cat ../api_used_deps.txt ../api_used_code.txt | sort) || echo "")
+            # Exclude dependencies used in scripts, code, and workspace packages
+            UNUSED=$(comm -23 <(echo "$UNUSED" | sort) <(cat ../api_used_deps.txt ../api_used_code.txt ../api_workspace_deps.txt | sort) || echo "")
            echo "API_UNUSED<<EOF" >> $GITHUB_ENV
            echo "$UNUSED" >> $GITHUB_ENV
            echo "EOF" >> $GITHUB_ENV
--- a/.vscode/launch.json
+++ b/.vscode/launch.json
@@ -8,8 +8,7 @@
      "skipFiles": ["<node_internals>/**"],
      "program": "${workspaceFolder}/api/server/index.js",
      "env": {
-        "NODE_ENV": "production",
-        "NODE_TLS_REJECT_UNAUTHORIZED": "0"
+        "NODE_ENV": "production"
      },
      "console": "integratedTerminal",
      "envFile": "${workspaceFolder}/.env"
--- a/api/app/clients/tools/util/fileSearch.js
+++ b/api/app/clients/tools/util/fileSearch.js
@@ -3,7 +3,6 @@ const axios = require('axios');
 const { tool } = require('@langchain/core/tools');
 const { logger } = require('@librechat/data-schemas');
 const { Tools, EToolResources } = require('librechat-data-provider');
-const { filterFilesByAgentAccess } = require('~/server/services/Files/permissions');
 const { generateShortLivedToken } = require('~/server/services/AuthService');
 const { getFiles } = require('~/models/File');

@@ -23,19 +22,14 @@ const primeFiles = async (options) => {
  const file_ids = tool_resources?.[EToolResources.file_search]?.file_ids ?? [];
  const agentResourceIds = new Set(file_ids);
  const resourceFiles = tool_resources?.[EToolResources.file_search]?.files ?? [];
-
-  // Get all files first
-  const allFiles = (await getFiles({ file_id: { $in: file_ids } }, null, { text: 0 })) ?? [];
-
-  // Filter by access if user and agent are provided
-  let dbFiles;
-  if (req?.user?.id && agentId) {
-    dbFiles = await filterFilesByAgentAccess(allFiles, req.user.id, agentId);
-  } else {
-    dbFiles = allFiles;
-  }
-
-  dbFiles = dbFiles.concat(resourceFiles);
+  const dbFiles = (
+    (await getFiles(
+      { file_id: { $in: file_ids } },
+      null,
+      { text: 0 },
+      { userId: req?.user?.id, agentId },
+    )) ?? []
+  ).concat(resourceFiles);

  let toolContext = `- Note: Semantic search is available through the ${Tools.file_search} tool but no files are currently loaded. Request the user to upload documents to search through.`;

--- a/api/cache/cacheConfig.js
+++ b/api/cache/cacheConfig.js
@@ -1,5 +1,6 @@
 const fs = require('fs');
 const { math, isEnabled } = require('@librechat/api');
+const { CacheKeys } = require('librechat-data-provider');

 // To ensure that different deployments do not interfere with each other's cache, we use a prefix for the Redis keys.
 // This prefix is usually the deployment ID, which is often passed to the container or pod as an env var.
@@ -15,7 +16,26 @@ if (USE_REDIS && !process.env.REDIS_URI) {
  throw new Error('USE_REDIS is enabled but REDIS_URI is not set.');
 }

+// Comma-separated list of cache namespaces that should be forced to use in-memory storage
+// even when Redis is enabled. This allows selective performance optimization for specific caches.
+const FORCED_IN_MEMORY_CACHE_NAMESPACES = process.env.FORCED_IN_MEMORY_CACHE_NAMESPACES
+  ? process.env.FORCED_IN_MEMORY_CACHE_NAMESPACES.split(',').map((key) => key.trim())
+  : [];
+
+// Validate against CacheKeys enum
+if (FORCED_IN_MEMORY_CACHE_NAMESPACES.length > 0) {
+  const validKeys = Object.values(CacheKeys);
+  const invalidKeys = FORCED_IN_MEMORY_CACHE_NAMESPACES.filter((key) => !validKeys.includes(key));
+
+  if (invalidKeys.length > 0) {
+    throw new Error(
+      `Invalid cache keys in FORCED_IN_MEMORY_CACHE_NAMESPACES: ${invalidKeys.join(', ')}. Valid keys: ${validKeys.join(', ')}`,
+    );
+  }
+}
+
 const cacheConfig = {
+  FORCED_IN_MEMORY_CACHE_NAMESPACES,
  USE_REDIS,
  REDIS_URI: process.env.REDIS_URI,
  REDIS_USERNAME: process.env.REDIS_USERNAME,
@@ -23,6 +43,7 @@ const cacheConfig = {
  REDIS_CA: process.env.REDIS_CA ? fs.readFileSync(process.env.REDIS_CA, 'utf8') : null,
  REDIS_KEY_PREFIX: process.env[REDIS_KEY_PREFIX_VAR] || REDIS_KEY_PREFIX || '',
  REDIS_MAX_LISTENERS: math(process.env.REDIS_MAX_LISTENERS, 40),
+  REDIS_PING_INTERVAL: math(process.env.REDIS_PING_INTERVAL, 0),

  CI: isEnabled(process.env.CI),
  DEBUG_MEMORY_CACHE: isEnabled(process.env.DEBUG_MEMORY_CACHE),
--- a/api/cache/cacheConfig.spec.js
+++ b/api/cache/cacheConfig.spec.js
@@ -14,6 +14,8 @@ describe('cacheConfig', () => {
    delete process.env.REDIS_KEY_PREFIX_VAR;
    delete process.env.REDIS_KEY_PREFIX;
    delete process.env.USE_REDIS;
+    delete process.env.REDIS_PING_INTERVAL;
+    delete process.env.FORCED_IN_MEMORY_CACHE_NAMESPACES;

    // Clear require cache
    jest.resetModules();
@@ -105,4 +107,51 @@ describe('cacheConfig', () => {
      expect(cacheConfig.REDIS_CA).toBeNull();
    });
  });
+
+  describe('REDIS_PING_INTERVAL configuration', () => {
+    test('should default to 0 when REDIS_PING_INTERVAL is not set', () => {
+      const { cacheConfig } = require('./cacheConfig');
+      expect(cacheConfig.REDIS_PING_INTERVAL).toBe(0);
+    });
+
+    test('should use provided REDIS_PING_INTERVAL value', () => {
+      process.env.REDIS_PING_INTERVAL = '300';
+
+      const { cacheConfig } = require('./cacheConfig');
+      expect(cacheConfig.REDIS_PING_INTERVAL).toBe(300);
+    });
+  });
+
+  describe('FORCED_IN_MEMORY_CACHE_NAMESPACES validation', () => {
+    test('should parse comma-separated cache keys correctly', () => {
+      process.env.FORCED_IN_MEMORY_CACHE_NAMESPACES = ' ROLES, STATIC_CONFIG ,MESSAGES ';
+
+      const { cacheConfig } = require('./cacheConfig');
+      expect(cacheConfig.FORCED_IN_MEMORY_CACHE_NAMESPACES).toEqual([
+        'ROLES',
+        'STATIC_CONFIG',
+        'MESSAGES',
+      ]);
+    });
+
+    test('should throw error for invalid cache keys', () => {
+      process.env.FORCED_IN_MEMORY_CACHE_NAMESPACES = 'INVALID_KEY,ROLES';
+
+      expect(() => {
+        require('./cacheConfig');
+      }).toThrow('Invalid cache keys in FORCED_IN_MEMORY_CACHE_NAMESPACES: INVALID_KEY');
+    });
+
+    test('should handle empty string gracefully', () => {
+      process.env.FORCED_IN_MEMORY_CACHE_NAMESPACES = '';
+
+      const { cacheConfig } = require('./cacheConfig');
+      expect(cacheConfig.FORCED_IN_MEMORY_CACHE_NAMESPACES).toEqual([]);
+    });
+
+    test('should handle undefined env var gracefully', () => {
+      const { cacheConfig } = require('./cacheConfig');
+      expect(cacheConfig.FORCED_IN_MEMORY_CACHE_NAMESPACES).toEqual([]);
+    });
+  });
 });
--- a/api/cache/cacheFactory.js
+++ b/api/cache/cacheFactory.js
@@ -16,7 +16,10 @@ const { RedisStore } = require('rate-limit-redis');
 * @returns {Keyv} Cache instance.
 */
 const standardCache = (namespace, ttl = undefined, fallbackStore = undefined) => {
-  if (cacheConfig.USE_REDIS) {
+  if (
+    cacheConfig.USE_REDIS &&
+    !cacheConfig.FORCED_IN_MEMORY_CACHE_NAMESPACES?.includes(namespace)
+  ) {
    const keyvRedis = new KeyvRedis(keyvRedisClient);
    const cache = new Keyv(keyvRedis, { namespace, ttl });
    keyvRedis.namespace = cacheConfig.REDIS_KEY_PREFIX;
--- a/api/cache/cacheFactory.spec.js
+++ b/api/cache/cacheFactory.spec.js
@@ -31,6 +31,7 @@ jest.mock('./cacheConfig', () => ({
  cacheConfig: {
    USE_REDIS: false,
    REDIS_KEY_PREFIX: 'test',
+    FORCED_IN_MEMORY_CACHE_NAMESPACES: [],
  },
 }));

@@ -63,6 +64,7 @@ describe('cacheFactory', () => {
    // Reset cache config mock
    cacheConfig.USE_REDIS = false;
    cacheConfig.REDIS_KEY_PREFIX = 'test';
+    cacheConfig.FORCED_IN_MEMORY_CACHE_NAMESPACES = [];
  });

  describe('redisCache', () => {
@@ -116,6 +118,30 @@ describe('cacheFactory', () => {

      expect(mockKeyv).toHaveBeenCalledWith({ namespace: undefined, ttl: undefined });
    });
+
+    it('should use fallback when namespace is in FORCED_IN_MEMORY_CACHE_NAMESPACES', () => {
+      cacheConfig.USE_REDIS = true;
+      cacheConfig.FORCED_IN_MEMORY_CACHE_NAMESPACES = ['forced-memory'];
+      const namespace = 'forced-memory';
+      const ttl = 3600;
+
+      standardCache(namespace, ttl);
+
+      expect(require('@keyv/redis').default).not.toHaveBeenCalled();
+      expect(mockKeyv).toHaveBeenCalledWith({ namespace, ttl });
+    });
+
+    it('should use Redis when namespace is not in FORCED_IN_MEMORY_CACHE_NAMESPACES', () => {
+      cacheConfig.USE_REDIS = true;
+      cacheConfig.FORCED_IN_MEMORY_CACHE_NAMESPACES = ['other-namespace'];
+      const namespace = 'test-namespace';
+      const ttl = 3600;
+
+      standardCache(namespace, ttl);
+
+      expect(require('@keyv/redis').default).toHaveBeenCalledWith(mockKeyvRedisClient);
+      expect(mockKeyv).toHaveBeenCalledWith(mockKeyvRedis, { namespace, ttl });
+    });
  });

  describe('violationCache', () => {
--- a/api/cache/getLogStores.js
+++ b/api/cache/getLogStores.js
@@ -33,6 +33,7 @@ const namespaces = {
  [CacheKeys.ROLES]: standardCache(CacheKeys.ROLES),
  [CacheKeys.MCP_TOOLS]: standardCache(CacheKeys.MCP_TOOLS),
  [CacheKeys.CONFIG_STORE]: standardCache(CacheKeys.CONFIG_STORE),
+  [CacheKeys.STATIC_CONFIG]: standardCache(CacheKeys.STATIC_CONFIG),
  [CacheKeys.PENDING_REQ]: standardCache(CacheKeys.PENDING_REQ),
  [CacheKeys.ENCODED_DOMAINS]: new Keyv({ store: keyvMongo, namespace: CacheKeys.ENCODED_DOMAINS }),
  [CacheKeys.ABORT_KEYS]: standardCache(CacheKeys.ABORT_KEYS, Time.TEN_MINUTES),
--- a/api/cache/redisClients.js
+++ b/api/cache/redisClients.js
@@ -1,6 +1,7 @@
 const IoRedis = require('ioredis');
-const { cacheConfig } = require('./cacheConfig');
+const { logger } = require('@librechat/data-schemas');
 const { createClient, createCluster } = require('@keyv/redis');
+const { cacheConfig } = require('./cacheConfig');

 const GLOBAL_PREFIX_SEPARATOR = '::';

@@ -25,17 +26,37 @@ if (cacheConfig.USE_REDIS) {
      ? new IoRedis(cacheConfig.REDIS_URI, redisOptions)
      : new IoRedis.Cluster(cacheConfig.REDIS_URI, { redisOptions });

-  // Pinging the Redis server every 5 minutes to keep the connection alive
-  const pingInterval = setInterval(() => ioredisClient.ping(), 5 * 60 * 1000);
-  ioredisClient.on('close', () => clearInterval(pingInterval));
-  ioredisClient.on('end', () => clearInterval(pingInterval));
+  ioredisClient.on('error', (err) => {
+    logger.error('ioredis client error:', err);
+  });
+
+  /** Ping Interval to keep the Redis server connection alive (if enabled) */
+  let pingInterval = null;
+  const clearPingInterval = () => {
+    if (pingInterval) {
+      clearInterval(pingInterval);
+      pingInterval = null;
+    }
+  };
+
+  if (cacheConfig.REDIS_PING_INTERVAL > 0) {
+    pingInterval = setInterval(() => {
+      if (ioredisClient && ioredisClient.status === 'ready') {
+        ioredisClient.ping();
+      }
+    }, cacheConfig.REDIS_PING_INTERVAL * 1000);
+    ioredisClient.on('close', clearPingInterval);
+    ioredisClient.on('end', clearPingInterval);
+  }
 }

 /** @type {import('@keyv/redis').RedisClient | import('@keyv/redis').RedisCluster | null} */
 let keyvRedisClient = null;
 if (cacheConfig.USE_REDIS) {
-  // ** WARNING ** Keyv Redis client does not support Prefix like ioredis above.
-  // The prefix feature will be handled by the Keyv-Redis store in cacheFactory.js
+  /**
+   * ** WARNING ** Keyv Redis client does not support Prefix like ioredis above.
+   * The prefix feature will be handled by the Keyv-Redis store in cacheFactory.js
+   */
  const redisOptions = { username, password, socket: { tls: ca != null, ca } };

  keyvRedisClient =
@@ -48,10 +69,28 @@ if (cacheConfig.USE_REDIS) {

  keyvRedisClient.setMaxListeners(cacheConfig.REDIS_MAX_LISTENERS);

-  // Pinging the Redis server every 5 minutes to keep the connection alive
-  const keyvPingInterval = setInterval(() => keyvRedisClient.ping(), 5 * 60 * 1000);
-  keyvRedisClient.on('disconnect', () => clearInterval(keyvPingInterval));
-  keyvRedisClient.on('end', () => clearInterval(keyvPingInterval));
+  keyvRedisClient.on('error', (err) => {
+    logger.error('@keyv/redis client error:', err);
+  });
+
+  /** Ping Interval to keep the Redis server connection alive (if enabled) */
+  let pingInterval = null;
+  const clearPingInterval = () => {
+    if (pingInterval) {
+      clearInterval(pingInterval);
+      pingInterval = null;
+    }
+  };
+
+  if (cacheConfig.REDIS_PING_INTERVAL > 0) {
+    pingInterval = setInterval(() => {
+      if (keyvRedisClient && keyvRedisClient.isReady) {
+        keyvRedisClient.ping();
+      }
+    }, cacheConfig.REDIS_PING_INTERVAL * 1000);
+    keyvRedisClient.on('disconnect', clearPingInterval);
+    keyvRedisClient.on('end', clearPingInterval);
+  }
 }

 module.exports = { ioredisClient, keyvRedisClient, GLOBAL_PREFIX_SEPARATOR };
--- a/api/jest.config.js
+++ b/api/jest.config.js
@@ -3,7 +3,6 @@ module.exports = {
  clearMocks: true,
  roots: ['<rootDir>'],
  coverageDirectory: 'coverage',
-  testTimeout: 30000, // 30 seconds timeout for all tests
  setupFiles: [
    './test/jestSetup.js',
    './test/__mocks__/logger.js',
--- a/api/models/Agent.js
+++ b/api/models/Agent.js
@@ -4,7 +4,7 @@ const { logger } = require('@librechat/data-schemas');
 const { SystemRoles, Tools, actionDelimiter } = require('librechat-data-provider');
 const { GLOBAL_PROJECT_NAME, EPHEMERAL_AGENT_ID, mcp_delimiter } =
  require('librechat-data-provider').Constants;
-// Default category value for new agents
+const { CONFIG_STORE, STARTUP_CONFIG } = require('librechat-data-provider').CacheKeys;
 const {
  getProjectByName,
  addAgentIdsToProject,
@@ -12,9 +12,7 @@ const {
  removeAgentFromAllProjects,
 } = require('./Project');
 const { getCachedTools } = require('~/server/services/Config');
-
-// Category values are now imported from shared constants
-// Schema fields (category, support_contact, is_promoted) are defined in @librechat/data-schemas
+const getLogStores = require('~/cache/getLogStores');
 const { getActions } = require('./Action');
 const { Agent } = require('~/db/models');

@@ -25,7 +23,7 @@ const { Agent } = require('~/db/models');
 * @throws {Error} If the agent creation fails.
 */
 const createAgent = async (agentData) => {
-  const { author: _author, ...versionData } = agentData;
+  const { author, ...versionData } = agentData;
  const timestamp = new Date();
  const initialAgentData = {
    ...agentData,
@@ -36,9 +34,7 @@ const createAgent = async (agentData) => {
        updatedAt: timestamp,
      },
    ],
-    category: agentData.category || 'general',
  };
-
  return (await Agent.create(initialAgentData)).toObject();
 };

@@ -135,7 +131,29 @@ const loadAgent = async ({ req, agent_id, endpoint, model_parameters }) => {
  }

  agent.version = agent.versions ? agent.versions.length : 0;
-  return agent;
+
+  if (agent.author.toString() === req.user.id) {
+    return agent;
+  }
+
+  if (!agent.projectIds) {
+    return null;
+  }
+
+  const cache = getLogStores(CONFIG_STORE);
+  /** @type {TStartupConfig} */
+  const cachedStartupConfig = await cache.get(STARTUP_CONFIG);
+  let { instanceProjectId } = cachedStartupConfig ?? {};
+  if (!instanceProjectId) {
+    instanceProjectId = (await getProjectByName(GLOBAL_PROJECT_NAME, '_id'))._id.toString();
+  }
+
+  for (const projectObjectId of agent.projectIds) {
+    const projectId = projectObjectId.toString();
+    if (projectId === instanceProjectId) {
+      return agent;
+    }
+  }
 };

 /**
@@ -165,7 +183,7 @@ const isDuplicateVersion = (updateData, currentData, versions, actionsHash = nul
    'actionsHash', // Exclude actionsHash from direct comparison
  ];

-  const { $push: _$push, $pull: _$pull, $addToSet: _$addToSet, ...directUpdates } = updateData;
+  const { $push, $pull, $addToSet, ...directUpdates } = updateData;

  if (Object.keys(directUpdates).length === 0 && !actionsHash) {
    return null;
@@ -184,116 +202,54 @@ const isDuplicateVersion = (updateData, currentData, versions, actionsHash = nul

  let isMatch = true;
  for (const field of importantFields) {
-    const wouldBeValue = wouldBeVersion[field];
-    const lastVersionValue = lastVersion[field];
-
-    // Skip if both are undefined/null
-    if (!wouldBeValue && !lastVersionValue) {
+    if (!wouldBeVersion[field] && !lastVersion[field]) {
      continue;
    }

-    // Handle arrays
-    if (Array.isArray(wouldBeValue) || Array.isArray(lastVersionValue)) {
-      // Normalize: treat undefined/null as empty array for comparison
-      let wouldBeArr;
-      if (Array.isArray(wouldBeValue)) {
-        wouldBeArr = wouldBeValue;
-      } else if (wouldBeValue == null) {
-        wouldBeArr = [];
-      } else {
-        wouldBeArr = [wouldBeValue];
-      }
-
-      let lastVersionArr;
-      if (Array.isArray(lastVersionValue)) {
-        lastVersionArr = lastVersionValue;
-      } else if (lastVersionValue == null) {
-        lastVersionArr = [];
-      } else {
-        lastVersionArr = [lastVersionValue];
-      }
-
-      if (wouldBeArr.length !== lastVersionArr.length) {
+    if (Array.isArray(wouldBeVersion[field]) && Array.isArray(lastVersion[field])) {
+      if (wouldBeVersion[field].length !== lastVersion[field].length) {
        isMatch = false;
        break;
      }

      // Special handling for projectIds (MongoDB ObjectIds)
      if (field === 'projectIds') {
-        const wouldBeIds = wouldBeArr.map((id) => id.toString()).sort();
-        const versionIds = lastVersionArr.map((id) => id.toString()).sort();
+        const wouldBeIds = wouldBeVersion[field].map((id) => id.toString()).sort();
+        const versionIds = lastVersion[field].map((id) => id.toString()).sort();

        if (!wouldBeIds.every((id, i) => id === versionIds[i])) {
          isMatch = false;
          break;
        }
      }
-      // Handle arrays of objects
-      else if (
-        wouldBeArr.length > 0 &&
-        typeof wouldBeArr[0] === 'object' &&
-        wouldBeArr[0] !== null
-      ) {
-        const sortedWouldBe = [...wouldBeArr].map((item) => JSON.stringify(item)).sort();
-        const sortedVersion = [...lastVersionArr].map((item) => JSON.stringify(item)).sort();
+      // Handle arrays of objects like tool_kwargs
+      else if (typeof wouldBeVersion[field][0] === 'object' && wouldBeVersion[field][0] !== null) {
+        const sortedWouldBe = [...wouldBeVersion[field]].map((item) => JSON.stringify(item)).sort();
+        const sortedVersion = [...lastVersion[field]].map((item) => JSON.stringify(item)).sort();

        if (!sortedWouldBe.every((item, i) => item === sortedVersion[i])) {
          isMatch = false;
          break;
        }
      } else {
-        const sortedWouldBe = [...wouldBeArr].sort();
-        const sortedVersion = [...lastVersionArr].sort();
+        const sortedWouldBe = [...wouldBeVersion[field]].sort();
+        const sortedVersion = [...lastVersion[field]].sort();

        if (!sortedWouldBe.every((item, i) => item === sortedVersion[i])) {
          isMatch = false;
          break;
        }
      }
-    }
-    // Handle objects
-    else if (typeof wouldBeValue === 'object' && wouldBeValue !== null) {
-      const lastVersionObj =
-        typeof lastVersionValue === 'object' && lastVersionValue !== null ? lastVersionValue : {};
-
-      // For empty objects, normalize the comparison
-      const wouldBeKeys = Object.keys(wouldBeValue);
-      const lastVersionKeys = Object.keys(lastVersionObj);
-
-      // If both are empty objects, they're equal
-      if (wouldBeKeys.length === 0 && lastVersionKeys.length === 0) {
-        continue;
-      }
-
-      // Otherwise do a deep comparison
-      if (JSON.stringify(wouldBeValue) !== JSON.stringify(lastVersionObj)) {
-        isMatch = false;
-        break;
-      }
-    }
-    // Handle primitive values
-    else {
-      // For primitives, handle the case where one is undefined and the other is a default value
-      if (wouldBeValue !== lastVersionValue) {
-        // Special handling for boolean false vs undefined
-        if (
-          typeof wouldBeValue === 'boolean' &&
-          wouldBeValue === false &&
-          lastVersionValue === undefined
-        ) {
-          continue;
-        }
-        // Special handling for empty string vs undefined
-        if (
-          typeof wouldBeValue === 'string' &&
-          wouldBeValue === '' &&
-          lastVersionValue === undefined
-        ) {
-          continue;
-        }
+    } else if (field === 'model_parameters') {
+      const wouldBeParams = wouldBeVersion[field] || {};
+      const lastVersionParams = lastVersion[field] || {};
+      if (JSON.stringify(wouldBeParams) !== JSON.stringify(lastVersionParams)) {
        isMatch = false;
        break;
      }
+    } else if (wouldBeVersion[field] !== lastVersion[field]) {
+      isMatch = false;
+      break;
    }
  }

@@ -322,14 +278,7 @@ const updateAgent = async (searchParameter, updateData, options = {}) => {

  const currentAgent = await Agent.findOne(searchParameter);
  if (currentAgent) {
-    const {
-      __v,
-      _id,
-      id: __id,
-      versions,
-      author: _author,
-      ...versionData
-    } = currentAgent.toObject();
+    const { __v, _id, id, versions, author, ...versionData } = currentAgent.toObject();
    const { $push, $pull, $addToSet, ...directUpdates } = updateData;

    let actionsHash = null;
@@ -520,113 +469,8 @@ const deleteAgent = async (searchParameter) => {
  return agent;
 };

-/**
- * Get agents by accessible IDs with optional cursor-based pagination.
- * @param {Object} params - The parameters for getting accessible agents.
- * @param {Array} [params.accessibleIds] - Array of agent ObjectIds the user has ACL access to.
- * @param {Object} [params.otherParams] - Additional query parameters (including author filter).
- * @param {number} [params.limit] - Number of agents to return (max 100). If not provided, returns all agents.
- * @param {string} [params.after] - Cursor for pagination - get agents after this cursor. // base64 encoded JSON string with updatedAt and _id.
- * @returns {Promise<Object>} A promise that resolves to an object containing the agents data and pagination info.
- */
-const getListAgentsByAccess = async ({
-  accessibleIds = [],
-  otherParams = {},
-  limit = null,
-  after = null,
-}) => {
-  const isPaginated = limit !== null && limit !== undefined;
-  const normalizedLimit = isPaginated ? Math.min(Math.max(1, parseInt(limit) || 20), 100) : null;
-
-  // Build base query combining ACL accessible agents with other filters
-  const baseQuery = { ...otherParams };
-
-  if (accessibleIds.length > 0) {
-    baseQuery._id = { $in: accessibleIds };
-  }
-
-  // Add cursor condition
-  if (after) {
-    try {
-      const cursor = JSON.parse(Buffer.from(after, 'base64').toString('utf8'));
-      const { updatedAt, _id } = cursor;
-
-      const cursorCondition = {
-        $or: [
-          { updatedAt: { $lt: new Date(updatedAt) } },
-          { updatedAt: new Date(updatedAt), _id: { $gt: new mongoose.Types.ObjectId(_id) } },
-        ],
-      };
-
-      // Merge cursor condition with base query
-      if (Object.keys(baseQuery).length > 0) {
-        baseQuery.$and = [{ ...baseQuery }, cursorCondition];
-        // Remove the original conditions from baseQuery to avoid duplication
-        Object.keys(baseQuery).forEach((key) => {
-          if (key !== '$and') delete baseQuery[key];
-        });
-      } else {
-        Object.assign(baseQuery, cursorCondition);
-      }
-    } catch (error) {
-      logger.warn('Invalid cursor:', error.message);
-    }
-  }
-
-  let query = Agent.find(baseQuery, {
-    id: 1,
-    _id: 1,
-    name: 1,
-    avatar: 1,
-    author: 1,
-    projectIds: 1,
-    description: 1,
-    updatedAt: 1,
-    category: 1,
-    support_contact: 1,
-    is_promoted: 1,
-  }).sort({ updatedAt: -1, _id: 1 });
-
-  // Only apply limit if pagination is requested
-  if (isPaginated) {
-    query = query.limit(normalizedLimit + 1);
-  }
-
-  const agents = await query.lean();
-
-  const hasMore = isPaginated ? agents.length > normalizedLimit : false;
-  const data = (isPaginated ? agents.slice(0, normalizedLimit) : agents).map((agent) => {
-    if (agent.author) {
-      agent.author = agent.author.toString();
-    }
-    return agent;
-  });
-
-  // Generate next cursor only if paginated
-  let nextCursor = null;
-  if (isPaginated && hasMore && data.length > 0) {
-    const lastAgent = agents[normalizedLimit - 1];
-    nextCursor = Buffer.from(
-      JSON.stringify({
-        updatedAt: lastAgent.updatedAt.toISOString(),
-        _id: lastAgent._id.toString(),
-      }),
-    ).toString('base64');
-  }
-
-  return {
-    object: 'list',
-    data,
-    first_id: data.length > 0 ? data[0].id : null,
-    last_id: data.length > 0 ? data[data.length - 1].id : null,
-    has_more: hasMore,
-    after: nextCursor,
-  };
-};
-
 /**
 * Get all agents.
- * @deprecated Use getListAgentsByAccess for ACL-aware agent listing
 * @param {Object} searchParameter - The search parameters to find matching agents.
 * @param {string} searchParameter.author - The user ID of the agent's author.
 * @returns {Promise<Object>} A promise that resolves to an object containing the agents data and pagination info.
@@ -645,15 +489,13 @@ const getListAgents = async (searchParameter) => {
  const agents = (
    await Agent.find(query, {
      id: 1,
-      _id: 1,
+      _id: 0,
      name: 1,
      avatar: 1,
      author: 1,
      projectIds: 1,
      description: 1,
-      // @deprecated - isCollaborative replaced by ACL permissions
      isCollaborative: 1,
-      category: 1,
    }).lean()
  ).map((agent) => {
    if (agent.author?.toString() !== author) {
@@ -819,14 +661,6 @@ const generateActionMetadataHash = async (actionIds, actions) => {

  return hashHex;
 };
-/**
- * Counts the number of promoted agents.
- * @returns  {Promise<number>} - The count of promoted agents
- */
-const countPromotedAgents = async () => {
-  const count = await Agent.countDocuments({ is_promoted: true });
-  return count;
-};

 /**
 * Load a default agent based on the endpoint
@@ -844,8 +678,6 @@ module.exports = {
  revertAgentVersion,
  updateAgentProjects,
  addAgentResourceFile,
-  getListAgentsByAccess,
  removeAgentResourceFiles,
  generateActionMetadataHash,
-  countPromotedAgents,
 };
--- a/api/models/Agent.spec.js
+++ b/api/models/Agent.spec.js
@@ -1258,328 +1258,6 @@ describe('models/Agent', () => {
      expect(secondUpdate.versions).toHaveLength(3);
    });

-    test('should detect changes in support_contact fields', async () => {
-      const agentId = `agent_${uuidv4()}`;
-      const authorId = new mongoose.Types.ObjectId();
-
-      // Create agent with initial support_contact
-      await createAgent({
-        id: agentId,
-        name: 'Agent with Support Contact',
-        provider: 'test',
-        model: 'test-model',
-        author: authorId,
-        support_contact: {
-          name: 'Initial Support',
-          email: 'initial@support.com',
-        },
-      });
-
-      // Update support_contact name only
-      const firstUpdate = await updateAgent(
-        { id: agentId },
-        {
-          support_contact: {
-            name: 'Updated Support',
-            email: 'initial@support.com',
-          },
-        },
-      );
-
-      expect(firstUpdate.versions).toHaveLength(2);
-      expect(firstUpdate.support_contact.name).toBe('Updated Support');
-      expect(firstUpdate.support_contact.email).toBe('initial@support.com');
-
-      // Update support_contact email only
-      const secondUpdate = await updateAgent(
-        { id: agentId },
-        {
-          support_contact: {
-            name: 'Updated Support',
-            email: 'updated@support.com',
-          },
-        },
-      );
-
-      expect(secondUpdate.versions).toHaveLength(3);
-      expect(secondUpdate.support_contact.email).toBe('updated@support.com');
-
-      // Try to update with same support_contact - should be detected as duplicate
-      await expect(
-        updateAgent(
-          { id: agentId },
-          {
-            support_contact: {
-              name: 'Updated Support',
-              email: 'updated@support.com',
-            },
-          },
-        ),
-      ).rejects.toThrow('Duplicate version');
-    });
-
-    test('should handle support_contact from empty to populated', async () => {
-      const agentId = `agent_${uuidv4()}`;
-      const authorId = new mongoose.Types.ObjectId();
-
-      // Create agent without support_contact
-      const agent = await createAgent({
-        id: agentId,
-        name: 'Agent without Support',
-        provider: 'test',
-        model: 'test-model',
-        author: authorId,
-      });
-
-      // Verify support_contact is undefined since it wasn't provided
-      expect(agent.support_contact).toBeUndefined();
-
-      // Update to add support_contact
-      const updated = await updateAgent(
-        { id: agentId },
-        {
-          support_contact: {
-            name: 'New Support Team',
-            email: 'support@example.com',
-          },
-        },
-      );
-
-      expect(updated.versions).toHaveLength(2);
-      expect(updated.support_contact.name).toBe('New Support Team');
-      expect(updated.support_contact.email).toBe('support@example.com');
-    });
-
-    test('should handle support_contact edge cases in isDuplicateVersion', async () => {
-      const agentId = `agent_${uuidv4()}`;
-      const authorId = new mongoose.Types.ObjectId();
-
-      // Create agent with support_contact
-      await createAgent({
-        id: agentId,
-        name: 'Edge Case Agent',
-        provider: 'test',
-        model: 'test-model',
-        author: authorId,
-        support_contact: {
-          name: 'Support',
-          email: 'support@test.com',
-        },
-      });
-
-      // Update to empty support_contact
-      const emptyUpdate = await updateAgent(
-        { id: agentId },
-        {
-          support_contact: {},
-        },
-      );
-
-      expect(emptyUpdate.versions).toHaveLength(2);
-      expect(emptyUpdate.support_contact).toEqual({});
-
-      // Update back to populated support_contact
-      const repopulated = await updateAgent(
-        { id: agentId },
-        {
-          support_contact: {
-            name: 'Support',
-            email: 'support@test.com',
-          },
-        },
-      );
-
-      expect(repopulated.versions).toHaveLength(3);
-
-      // Verify all versions have correct support_contact
-      const finalAgent = await getAgent({ id: agentId });
-      expect(finalAgent.versions[0].support_contact).toEqual({
-        name: 'Support',
-        email: 'support@test.com',
-      });
-      expect(finalAgent.versions[1].support_contact).toEqual({});
-      expect(finalAgent.versions[2].support_contact).toEqual({
-        name: 'Support',
-        email: 'support@test.com',
-      });
-    });
-
-    test('should preserve support_contact in version history', async () => {
-      const agentId = `agent_${uuidv4()}`;
-      const authorId = new mongoose.Types.ObjectId();
-
-      // Create agent
-      await createAgent({
-        id: agentId,
-        name: 'Version History Test',
-        provider: 'test',
-        model: 'test-model',
-        author: authorId,
-        support_contact: {
-          name: 'Initial Contact',
-          email: 'initial@test.com',
-        },
-      });
-
-      // Multiple updates with different support_contact values
-      await updateAgent(
-        { id: agentId },
-        {
-          support_contact: {
-            name: 'Second Contact',
-            email: 'second@test.com',
-          },
-        },
-      );
-
-      await updateAgent(
-        { id: agentId },
-        {
-          support_contact: {
-            name: 'Third Contact',
-            email: 'third@test.com',
-          },
-        },
-      );
-
-      const finalAgent = await getAgent({ id: agentId });
-
-      // Verify version history
-      expect(finalAgent.versions).toHaveLength(3);
-      expect(finalAgent.versions[0].support_contact).toEqual({
-        name: 'Initial Contact',
-        email: 'initial@test.com',
-      });
-      expect(finalAgent.versions[1].support_contact).toEqual({
-        name: 'Second Contact',
-        email: 'second@test.com',
-      });
-      expect(finalAgent.versions[2].support_contact).toEqual({
-        name: 'Third Contact',
-        email: 'third@test.com',
-      });
-
-      // Current state should match last version
-      expect(finalAgent.support_contact).toEqual({
-        name: 'Third Contact',
-        email: 'third@test.com',
-      });
-    });
-
-    test('should handle partial support_contact updates', async () => {
-      const agentId = `agent_${uuidv4()}`;
-      const authorId = new mongoose.Types.ObjectId();
-
-      // Create agent with full support_contact
-      await createAgent({
-        id: agentId,
-        name: 'Partial Update Test',
-        provider: 'test',
-        model: 'test-model',
-        author: authorId,
-        support_contact: {
-          name: 'Original Name',
-          email: 'original@email.com',
-        },
-      });
-
-      // MongoDB's findOneAndUpdate will replace the entire support_contact object
-      // So we need to verify that partial updates still work correctly
-      const updated = await updateAgent(
-        { id: agentId },
-        {
-          support_contact: {
-            name: 'New Name',
-            email: '', // Empty email
-          },
-        },
-      );
-
-      expect(updated.versions).toHaveLength(2);
-      expect(updated.support_contact.name).toBe('New Name');
-      expect(updated.support_contact.email).toBe('');
-
-      // Verify isDuplicateVersion works with partial changes
-      await expect(
-        updateAgent(
-          { id: agentId },
-          {
-            support_contact: {
-              name: 'New Name',
-              email: '',
-            },
-          },
-        ),
-      ).rejects.toThrow('Duplicate version');
-    });
-
-    // Edge Cases
-    describe.each([
-      {
-        operation: 'add',
-        name: 'empty file_id',
-        needsAgent: true,
-        params: { tool_resource: 'file_search', file_id: '' },
-        shouldResolve: true,
-      },
-      {
-        operation: 'add',
-        name: 'non-existent agent',
-        needsAgent: false,
-        params: { tool_resource: 'file_search', file_id: 'file123' },
-        shouldResolve: false,
-        error: 'Agent not found for adding resource file',
-      },
-    ])('addAgentResourceFile with $name', ({ needsAgent, params, shouldResolve, error }) => {
-      test(`should ${shouldResolve ? 'resolve' : 'reject'}`, async () => {
-        const agent = needsAgent ? await createBasicAgent() : null;
-        const agent_id = needsAgent ? agent.id : `agent_${uuidv4()}`;
-
-        if (shouldResolve) {
-          await expect(addAgentResourceFile({ agent_id, ...params })).resolves.toBeDefined();
-        } else {
-          await expect(addAgentResourceFile({ agent_id, ...params })).rejects.toThrow(error);
-        }
-      });
-    });
-
-    describe.each([
-      {
-        name: 'empty files array',
-        files: [],
-        needsAgent: true,
-        shouldResolve: true,
-      },
-      {
-        name: 'non-existent tool_resource',
-        files: [{ tool_resource: 'non_existent_tool', file_id: 'file123' }],
-        needsAgent: true,
-        shouldResolve: true,
-      },
-      {
-        name: 'non-existent agent',
-        files: [{ tool_resource: 'file_search', file_id: 'file123' }],
-        needsAgent: false,
-        shouldResolve: false,
-        error: 'Agent not found for removing resource files',
-      },
-    ])('removeAgentResourceFiles with $name', ({ files, needsAgent, shouldResolve, error }) => {
-      test(`should ${shouldResolve ? 'resolve' : 'reject'}`, async () => {
-        const agent = needsAgent ? await createBasicAgent() : null;
-        const agent_id = needsAgent ? agent.id : `agent_${uuidv4()}`;
-
-        if (shouldResolve) {
-          const result = await removeAgentResourceFiles({ agent_id, files });
-          expect(result).toBeDefined();
-          if (agent) {
-            expect(result.id).toBe(agent.id);
-          }
-        } else {
-          await expect(removeAgentResourceFiles({ agent_id, files })).rejects.toThrow(error);
-        }
-      });
-    });
-
    describe('Edge Cases', () => {
      test('should handle extremely large version history', async () => {
        const agentId = `agent_${uuidv4()}`;
@@ -1955,7 +1633,7 @@ describe('models/Agent', () => {
      expect(result.version).toBe(1);
    });

-    test('should return agent even when user is not author (permissions checked at route level)', async () => {
+    test('should return null when user is not author and agent has no projectIds', async () => {
      const authorId = new mongoose.Types.ObjectId();
      const userId = new mongoose.Types.ObjectId();
      const agentId = `agent_${uuidv4()}`;
@@ -1976,11 +1654,7 @@ describe('models/Agent', () => {
        model_parameters: { model: 'gpt-4' },
      });

-      // With the new permission system, loadAgent returns the agent regardless of permissions
-      // Permission checks are handled at the route level via middleware
-      expect(result).toBeTruthy();
-      expect(result.id).toBe(agentId);
-      expect(result.name).toBe('Test Agent');
+      expect(result).toBeFalsy();
    });

    test('should handle ephemeral agent with no MCP servers', async () => {
@@ -2088,7 +1762,7 @@ describe('models/Agent', () => {
        }
      });

-      test('should return agent from different project (permissions checked at route level)', async () => {
+      test('should handle loadAgent with agent from different project', async () => {
        const authorId = new mongoose.Types.ObjectId();
        const userId = new mongoose.Types.ObjectId();
        const agentId = `agent_${uuidv4()}`;
@@ -2111,11 +1785,7 @@ describe('models/Agent', () => {
          model_parameters: { model: 'gpt-4' },
        });

-        // With the new permission system, loadAgent returns the agent regardless of permissions
-        // Permission checks are handled at the route level via middleware
-        expect(result).toBeTruthy();
-        expect(result.id).toBe(agentId);
-        expect(result.name).toBe('Project Agent');
+        expect(result).toBeFalsy();
      });
    });
  });
@@ -2900,93 +2570,6 @@ describe('models/Agent', () => {
  });
 });

-describe('Support Contact Field', () => {
-  let mongoServer;
-
-  beforeAll(async () => {
-    mongoServer = await MongoMemoryServer.create();
-    const mongoUri = mongoServer.getUri();
-    Agent = mongoose.models.Agent || mongoose.model('Agent', agentSchema);
-    await mongoose.connect(mongoUri);
-  }, 20000);
-
-  afterAll(async () => {
-    await mongoose.disconnect();
-    await mongoServer.stop();
-  });
-
-  beforeEach(async () => {
-    await Agent.deleteMany({});
-  });
-
-  it('should not create subdocument with ObjectId for support_contact', async () => {
-    const userId = new mongoose.Types.ObjectId();
-    const agentData = {
-      id: 'agent_test_support',
-      name: 'Test Agent',
-      provider: 'openai',
-      model: 'gpt-4',
-      author: userId,
-      support_contact: {
-        name: 'Support Team',
-        email: 'support@example.com',
-      },
-    };
-
-    // Create agent
-    const agent = await createAgent(agentData);
-
-    // Verify support_contact is stored correctly
-    expect(agent.support_contact).toBeDefined();
-    expect(agent.support_contact.name).toBe('Support Team');
-    expect(agent.support_contact.email).toBe('support@example.com');
-
-    // Verify no _id field is created in support_contact
-    expect(agent.support_contact._id).toBeUndefined();
-
-    // Fetch from database to double-check
-    const dbAgent = await Agent.findOne({ id: agentData.id });
-    expect(dbAgent.support_contact).toBeDefined();
-    expect(dbAgent.support_contact.name).toBe('Support Team');
-    expect(dbAgent.support_contact.email).toBe('support@example.com');
-    expect(dbAgent.support_contact._id).toBeUndefined();
-  });
-
-  it('should handle empty support_contact correctly', async () => {
-    const userId = new mongoose.Types.ObjectId();
-    const agentData = {
-      id: 'agent_test_empty_support',
-      name: 'Test Agent',
-      provider: 'openai',
-      model: 'gpt-4',
-      author: userId,
-      support_contact: {},
-    };
-
-    const agent = await createAgent(agentData);
-
-    // Verify empty support_contact is stored as empty object
-    expect(agent.support_contact).toEqual({});
-    expect(agent.support_contact._id).toBeUndefined();
-  });
-
-  it('should handle missing support_contact correctly', async () => {
-    const userId = new mongoose.Types.ObjectId();
-    const agentData = {
-      id: 'agent_test_no_support',
-      name: 'Test Agent',
-      provider: 'openai',
-      model: 'gpt-4',
-      author: userId,
-    };
-
-    const agent = await createAgent(agentData);
-
-    // Verify support_contact is undefined when not provided
-    expect(agent.support_contact).toBeUndefined();
-  });
-});
-
 function createBasicAgent(overrides = {}) {
  const defaults = {
    id: `agent_${uuidv4()}`,
--- a/api/models/File.js
+++ b/api/models/File.js
@@ -1,5 +1,7 @@
 const { logger } = require('@librechat/data-schemas');
-const { EToolResources, FileContext } = require('librechat-data-provider');
+const { EToolResources, FileContext, Constants } = require('librechat-data-provider');
+const { getProjectByName } = require('./Project');
+const { getAgent } = require('./Agent');
 const { File } = require('~/db/models');

 /**
@@ -12,17 +14,124 @@ const findFileById = async (file_id, options = {}) => {
  return await File.findOne({ file_id, ...options }).lean();
 };

+/**
+ * Checks if a user has access to multiple files through a shared agent (batch operation)
+ * @param {string} userId - The user ID to check access for
+ * @param {string[]} fileIds - Array of file IDs to check
+ * @param {string} agentId - The agent ID that might grant access
+ * @returns {Promise<Map<string, boolean>>} Map of fileId to access status
+ */
+const hasAccessToFilesViaAgent = async (userId, fileIds, agentId, checkCollaborative = true) => {
+  const accessMap = new Map();
+
+  // Initialize all files as no access
+  fileIds.forEach((fileId) => accessMap.set(fileId, false));
+
+  try {
+    const agent = await getAgent({ id: agentId });
+
+    if (!agent) {
+      return accessMap;
+    }
+
+    // Check if user is the author - if so, grant access to all files
+    if (agent.author.toString() === userId) {
+      fileIds.forEach((fileId) => accessMap.set(fileId, true));
+      return accessMap;
+    }
+
+    // Check if agent is shared with the user via projects
+    if (!agent.projectIds || agent.projectIds.length === 0) {
+      return accessMap;
+    }
+
+    // Check if agent is in global project
+    const globalProject = await getProjectByName(Constants.GLOBAL_PROJECT_NAME, '_id');
+    if (
+      !globalProject ||
+      !agent.projectIds.some((pid) => pid.toString() === globalProject._id.toString())
+    ) {
+      return accessMap;
+    }
+
+    // Agent is globally shared - check if it's collaborative
+    if (checkCollaborative && !agent.isCollaborative) {
+      return accessMap;
+    }
+
+    // Check which files are actually attached
+    const attachedFileIds = new Set();
+    if (agent.tool_resources) {
+      for (const [_resourceType, resource] of Object.entries(agent.tool_resources)) {
+        if (resource?.file_ids && Array.isArray(resource.file_ids)) {
+          resource.file_ids.forEach((fileId) => attachedFileIds.add(fileId));
+        }
+      }
+    }
+
+    // Grant access only to files that are attached to this agent
+    fileIds.forEach((fileId) => {
+      if (attachedFileIds.has(fileId)) {
+        accessMap.set(fileId, true);
+      }
+    });
+
+    return accessMap;
+  } catch (error) {
+    logger.error('[hasAccessToFilesViaAgent] Error checking file access:', error);
+    return accessMap;
+  }
+};
+
 /**
 * Retrieves files matching a given filter, sorted by the most recently updated.
 * @param {Object} filter - The filter criteria to apply.
 * @param {Object} [_sortOptions] - Optional sort parameters.
 * @param {Object|String} [selectFields={ text: 0 }] - Fields to include/exclude in the query results.
 *                                                   Default excludes the 'text' field.
+ * @param {Object} [options] - Additional options
+ * @param {string} [options.userId] - User ID for access control
+ * @param {string} [options.agentId] - Agent ID that might grant access to files
 * @returns {Promise<Array<MongoFile>>} A promise that resolves to an array of file documents.
 */
-const getFiles = async (filter, _sortOptions, selectFields = { text: 0 }) => {
+const getFiles = async (filter, _sortOptions, selectFields = { text: 0 }, options = {}) => {
  const sortOptions = { updatedAt: -1, ..._sortOptions };
-  return await File.find(filter).select(selectFields).sort(sortOptions).lean();
+  const files = await File.find(filter).select(selectFields).sort(sortOptions).lean();
+
+  // If userId and agentId are provided, filter files based on access
+  if (options.userId && options.agentId) {
+    // Collect file IDs that need access check
+    const filesToCheck = [];
+    const ownedFiles = [];
+
+    for (const file of files) {
+      if (file.user && file.user.toString() === options.userId) {
+        ownedFiles.push(file);
+      } else {
+        filesToCheck.push(file);
+      }
+    }
+
+    if (filesToCheck.length === 0) {
+      return ownedFiles;
+    }
+
+    // Batch check access for all non-owned files
+    const fileIds = filesToCheck.map((f) => f.file_id);
+    const accessMap = await hasAccessToFilesViaAgent(
+      options.userId,
+      fileIds,
+      options.agentId,
+      false,
+    );
+
+    // Filter files based on access
+    const accessibleFiles = filesToCheck.filter((file) => accessMap.get(file.file_id));
+
+    return [...ownedFiles, ...accessibleFiles];
+  }
+
+  return files;
 };

 /**
@@ -176,4 +285,5 @@ module.exports = {
  deleteFiles,
  deleteFileByFilter,
  batchUpdateFiles,
+  hasAccessToFilesViaAgent,
 };
--- a/api/models/File.spec.js
+++ b/api/models/File.spec.js
@@ -1,17 +1,17 @@
 const mongoose = require('mongoose');
 const { v4: uuidv4 } = require('uuid');
+const { fileSchema } = require('@librechat/data-schemas');
+const { agentSchema } = require('@librechat/data-schemas');
+const { projectSchema } = require('@librechat/data-schemas');
 const { MongoMemoryServer } = require('mongodb-memory-server');
-const { createModels } = require('@librechat/data-schemas');
+const { GLOBAL_PROJECT_NAME } = require('librechat-data-provider').Constants;
 const { getFiles, createFile } = require('./File');
+const { getProjectByName } = require('./Project');
 const { createAgent } = require('./Agent');
-const { grantPermission } = require('~/server/services/PermissionService');
-const { seedDefaultRoles } = require('~/models');

 let File;
 let Agent;
-let AclEntry;
-let User;
-let modelsToCleanup = [];
+let Project;

 describe('File Access Control', () => {
  let mongoServer;
@@ -19,41 +19,13 @@ describe('File Access Control', () => {
  beforeAll(async () => {
    mongoServer = await MongoMemoryServer.create();
    const mongoUri = mongoServer.getUri();
+    File = mongoose.models.File || mongoose.model('File', fileSchema);
+    Agent = mongoose.models.Agent || mongoose.model('Agent', agentSchema);
+    Project = mongoose.models.Project || mongoose.model('Project', projectSchema);
    await mongoose.connect(mongoUri);
-
-    // Initialize all models
-    const models = createModels(mongoose);
-
-    // Track which models we're adding
-    modelsToCleanup = Object.keys(models);
-
-    // Register models on mongoose.models so methods can access them
-    const dbModels = require('~/db/models');
-    Object.assign(mongoose.models, dbModels);
-
-    File = dbModels.File;
-    Agent = dbModels.Agent;
-    AclEntry = dbModels.AclEntry;
-    User = dbModels.User;
-
-    // Seed default roles
-    await seedDefaultRoles();
  });

  afterAll(async () => {
-    // Clean up all collections before disconnecting
-    const collections = mongoose.connection.collections;
-    for (const key in collections) {
-      await collections[key].deleteMany({});
-    }
-
-    // Clear only the models we added
-    for (const modelName of modelsToCleanup) {
-      if (mongoose.models[modelName]) {
-        delete mongoose.models[modelName];
-      }
-    }
-
    await mongoose.disconnect();
    await mongoServer.stop();
  });
@@ -61,33 +33,16 @@ describe('File Access Control', () => {
  beforeEach(async () => {
    await File.deleteMany({});
    await Agent.deleteMany({});
-    await AclEntry.deleteMany({});
-    await User.deleteMany({});
-    // Don't delete AccessRole as they are seeded defaults needed for tests
+    await Project.deleteMany({});
  });

  describe('hasAccessToFilesViaAgent', () => {
    it('should efficiently check access for multiple files at once', async () => {
-      const userId = new mongoose.Types.ObjectId();
-      const authorId = new mongoose.Types.ObjectId();
+      const userId = new mongoose.Types.ObjectId().toString();
+      const authorId = new mongoose.Types.ObjectId().toString();
      const agentId = uuidv4();
      const fileIds = [uuidv4(), uuidv4(), uuidv4(), uuidv4()];

-      // Create users
-      await User.create({
-        _id: userId,
-        email: 'user@example.com',
-        emailVerified: true,
-        provider: 'local',
-      });
-
-      await User.create({
-        _id: authorId,
-        email: 'author@example.com',
-        emailVerified: true,
-        provider: 'local',
-      });
-
      // Create files
      for (const fileId of fileIds) {
        await createFile({
@@ -99,12 +54,13 @@ describe('File Access Control', () => {
      }

      // Create agent with only first two files attached
-      const agent = await createAgent({
+      await createAgent({
        id: agentId,
        name: 'Test Agent',
        author: authorId,
        model: 'gpt-4',
        provider: 'openai',
+        isCollaborative: true,
        tool_resources: {
          file_search: {
            file_ids: [fileIds[0], fileIds[1]],
@@ -112,19 +68,15 @@ describe('File Access Control', () => {
        },
      });

-      // Grant EDIT permission to user on the agent
-      await grantPermission({
-        principalType: 'user',
-        principalId: userId,
-        resourceType: 'agent',
-        resourceId: agent._id,
-        accessRoleId: 'agent_editor',
-        grantedBy: authorId,
-      });
+      // Get or create global project
+      const globalProject = await getProjectByName(GLOBAL_PROJECT_NAME, '_id');
+
+      // Share agent globally
+      await Agent.updateOne({ id: agentId }, { $push: { projectIds: globalProject._id } });

      // Check access for all files
-      const { hasAccessToFilesViaAgent } = require('~/server/services/Files/permissions');
-      const accessMap = await hasAccessToFilesViaAgent(userId.toString(), fileIds, agentId);
+      const { hasAccessToFilesViaAgent } = require('./File');
+      const accessMap = await hasAccessToFilesViaAgent(userId, fileIds, agentId);

      // Should have access only to the first two files
      expect(accessMap.get(fileIds[0])).toBe(true);
@@ -134,18 +86,10 @@ describe('File Access Control', () => {
    });

    it('should grant access to all files when user is the agent author', async () => {
-      const authorId = new mongoose.Types.ObjectId();
+      const authorId = new mongoose.Types.ObjectId().toString();
      const agentId = uuidv4();
      const fileIds = [uuidv4(), uuidv4(), uuidv4()];

-      // Create author user
-      await User.create({
-        _id: authorId,
-        email: 'author@example.com',
-        emailVerified: true,
-        provider: 'local',
-      });
-
      // Create agent
      await createAgent({
        id: agentId,
@@ -161,8 +105,8 @@ describe('File Access Control', () => {
      });

      // Check access as the author
-      const { hasAccessToFilesViaAgent } = require('~/server/services/Files/permissions');
-      const accessMap = await hasAccessToFilesViaAgent(authorId.toString(), fileIds, agentId);
+      const { hasAccessToFilesViaAgent } = require('./File');
+      const accessMap = await hasAccessToFilesViaAgent(authorId, fileIds, agentId);

      // Author should have access to all files
      expect(accessMap.get(fileIds[0])).toBe(true);
@@ -171,57 +115,31 @@ describe('File Access Control', () => {
    });

    it('should handle non-existent agent gracefully', async () => {
-      const userId = new mongoose.Types.ObjectId();
+      const userId = new mongoose.Types.ObjectId().toString();
      const fileIds = [uuidv4(), uuidv4()];

-      // Create user
-      await User.create({
-        _id: userId,
-        email: 'user@example.com',
-        emailVerified: true,
-        provider: 'local',
-      });
-
-      const { hasAccessToFilesViaAgent } = require('~/server/services/Files/permissions');
-      const accessMap = await hasAccessToFilesViaAgent(
-        userId.toString(),
-        fileIds,
-        'non-existent-agent',
-      );
+      const { hasAccessToFilesViaAgent } = require('./File');
+      const accessMap = await hasAccessToFilesViaAgent(userId, fileIds, 'non-existent-agent');

      // Should have no access to any files
      expect(accessMap.get(fileIds[0])).toBe(false);
      expect(accessMap.get(fileIds[1])).toBe(false);
    });

-    it('should deny access when user only has VIEW permission', async () => {
-      const userId = new mongoose.Types.ObjectId();
-      const authorId = new mongoose.Types.ObjectId();
+    it('should deny access when agent is not collaborative', async () => {
+      const userId = new mongoose.Types.ObjectId().toString();
+      const authorId = new mongoose.Types.ObjectId().toString();
      const agentId = uuidv4();
      const fileIds = [uuidv4(), uuidv4()];

-      // Create users
-      await User.create({
-        _id: userId,
-        email: 'user@example.com',
-        emailVerified: true,
-        provider: 'local',
-      });
-
-      await User.create({
-        _id: authorId,
-        email: 'author@example.com',
-        emailVerified: true,
-        provider: 'local',
-      });
-
-      // Create agent with files
-      const agent = await createAgent({
+      // Create agent with files but isCollaborative: false
+      await createAgent({
        id: agentId,
-        name: 'View-Only Agent',
+        name: 'Non-Collaborative Agent',
        author: authorId,
        model: 'gpt-4',
        provider: 'openai',
+        isCollaborative: false,
        tool_resources: {
          file_search: {
            file_ids: fileIds,
@@ -229,21 +147,17 @@ describe('File Access Control', () => {
        },
      });

-      // Grant only VIEW permission to user on the agent
-      await grantPermission({
-        principalType: 'user',
-        principalId: userId,
-        resourceType: 'agent',
-        resourceId: agent._id,
-        accessRoleId: 'agent_viewer',
-        grantedBy: authorId,
-      });
+      // Get or create global project
+      const globalProject = await getProjectByName(GLOBAL_PROJECT_NAME, '_id');
+
+      // Share agent globally
+      await Agent.updateOne({ id: agentId }, { $push: { projectIds: globalProject._id } });

      // Check access for files
-      const { hasAccessToFilesViaAgent } = require('~/server/services/Files/permissions');
-      const accessMap = await hasAccessToFilesViaAgent(userId.toString(), fileIds, agentId);
+      const { hasAccessToFilesViaAgent } = require('./File');
+      const accessMap = await hasAccessToFilesViaAgent(userId, fileIds, agentId);

-      // Should have no access to any files when only VIEW permission
+      // Should have no access to any files when isCollaborative is false
      expect(accessMap.get(fileIds[0])).toBe(false);
      expect(accessMap.get(fileIds[1])).toBe(false);
    });
@@ -258,28 +172,18 @@ describe('File Access Control', () => {
      const sharedFileId = `file_${uuidv4()}`;
      const inaccessibleFileId = `file_${uuidv4()}`;

-      // Create users
-      await User.create({
-        _id: userId,
-        email: 'user@example.com',
-        emailVerified: true,
-        provider: 'local',
-      });
-
-      await User.create({
-        _id: authorId,
-        email: 'author@example.com',
-        emailVerified: true,
-        provider: 'local',
-      });
+      // Create/get global project using getProjectByName which will upsert
+      const globalProject = await getProjectByName(GLOBAL_PROJECT_NAME);

      // Create agent with shared file
-      const agent = await createAgent({
+      await createAgent({
        id: agentId,
        name: 'Shared Agent',
        provider: 'test',
        model: 'test-model',
        author: authorId,
+        projectIds: [globalProject._id],
+        isCollaborative: true,
        tool_resources: {
          file_search: {
            file_ids: [sharedFileId],
@@ -287,16 +191,6 @@ describe('File Access Control', () => {
        },
      });

-      // Grant EDIT permission to user on the agent
-      await grantPermission({
-        principalType: 'user',
-        principalId: userId,
-        resourceType: 'agent',
-        resourceId: agent._id,
-        accessRoleId: 'agent_editor',
-        grantedBy: authorId,
-      });
-
      // Create files
      await createFile({
        file_id: ownedFileId,
@@ -326,17 +220,14 @@ describe('File Access Control', () => {
        bytes: 300,
      });

-      // Get all files first
-      const allFiles = await getFiles(
+      // Get files with access control
+      const files = await getFiles(
        { file_id: { $in: [ownedFileId, sharedFileId, inaccessibleFileId] } },
        null,
        { text: 0 },
+        { userId: userId.toString(), agentId },
      );

-      // Then filter by access control
-      const { filterFilesByAgentAccess } = require('~/server/services/Files/permissions');
-      const files = await filterFilesByAgentAccess(allFiles, userId.toString(), agentId);
-
      expect(files).toHaveLength(2);
      expect(files.map((f) => f.file_id)).toContain(ownedFileId);
      expect(files.map((f) => f.file_id)).toContain(sharedFileId);
--- a/api/models/Role.js
+++ b/api/models/Role.js
@@ -2,6 +2,7 @@ const {
  CacheKeys,
  SystemRoles,
  roleDefaults,
+  PermissionTypes,
  permissionsSchema,
  removeNullishValues,
 } = require('librechat-data-provider');
--- a/api/package.json
+++ b/api/package.json
@@ -52,8 +52,8 @@
    "@librechat/agents": "^2.4.68",
    "@librechat/api": "*",
    "@librechat/data-schemas": "*",
-    "@node-saml/passport-saml": "^5.0.0",
-    "@microsoft/microsoft-graph-client": "^3.0.7",
+    "@modelcontextprotocol/sdk": "^1.17.0",
+    "@node-saml/passport-saml": "^5.1.0",
    "@waylaidwanderer/fetch-event-source": "^3.0.1",
    "axios": "^1.8.2",
    "bcryptjs": "^2.4.3",
@@ -120,7 +120,7 @@
  },
  "devDependencies": {
    "jest": "^29.7.0",
-    "mongodb-memory-server": "^10.1.3",
+    "mongodb-memory-server": "^10.1.4",
    "nodemon": "^3.0.3",
    "supertest": "^7.1.0"
  }
--- a/api/server/controllers/PermissionsController.js
+++ b/api/server/controllers/PermissionsController.js
@@ -1,437 +0,0 @@
-/**
- * @import { TUpdateResourcePermissionsRequest, TUpdateResourcePermissionsResponse } from 'librechat-data-provider'
- */
-
-const mongoose = require('mongoose');
-const { logger } = require('@librechat/data-schemas');
-const {
-  getAvailableRoles,
-  ensurePrincipalExists,
-  getEffectivePermissions,
-  ensureGroupPrincipalExists,
-  bulkUpdateResourcePermissions,
-} = require('~/server/services/PermissionService');
-const { AclEntry } = require('~/db/models');
-const {
-  searchPrincipals: searchLocalPrincipals,
-  sortPrincipalsByRelevance,
-  calculateRelevanceScore,
-} = require('~/models');
-const {
-  searchEntraIdPrincipals,
-  entraIdPrincipalFeatureEnabled,
-} = require('~/server/services/GraphApiService');
-
-/**
- * Generic controller for resource permission endpoints
- * Delegates validation and logic to PermissionService
- */
-
-/**
- * Bulk update permissions for a resource (grant, update, remove)
- * @route PUT /api/{resourceType}/{resourceId}/permissions
- * @param {Object} req - Express request object
- * @param {Object} req.params - Route parameters
- * @param {string} req.params.resourceType - Resource type (e.g., 'agent')
- * @param {string} req.params.resourceId - Resource ID
- * @param {TUpdateResourcePermissionsRequest} req.body - Request body
- * @param {Object} res - Express response object
- * @returns {Promise<TUpdateResourcePermissionsResponse>} Updated permissions response
- */
-const updateResourcePermissions = async (req, res) => {
-  try {
-    const { resourceType, resourceId } = req.params;
-    /** @type {TUpdateResourcePermissionsRequest} */
-    const { updated, removed, public: isPublic, publicAccessRoleId } = req.body;
-    const { id: userId } = req.user;
-
-    // Prepare principals for the service call
-    const updatedPrincipals = [];
-    const revokedPrincipals = [];
-
-    // Add updated principals
-    if (updated && Array.isArray(updated)) {
-      updatedPrincipals.push(...updated);
-    }
-
-    // Add public permission if enabled
-    if (isPublic && publicAccessRoleId) {
-      updatedPrincipals.push({
-        type: 'public',
-        id: null,
-        accessRoleId: publicAccessRoleId,
-      });
-    }
-
-    // Prepare authentication context for enhanced group member fetching
-    const useEntraId = entraIdPrincipalFeatureEnabled(req.user);
-    const authHeader = req.headers.authorization;
-    const accessToken =
-      authHeader && authHeader.startsWith('Bearer ') ? authHeader.substring(7) : null;
-    const authContext =
-      useEntraId && accessToken
-        ? {
-            accessToken,
-            sub: req.user.openidId,
-          }
-        : null;
-
-    // Ensure updated principals exist in the database before processing permissions
-    const validatedPrincipals = [];
-    for (const principal of updatedPrincipals) {
-      try {
-        let principalId;
-
-        if (principal.type === 'public') {
-          principalId = null; // Public principals don't need database records
-        } else if (principal.type === 'user') {
-          principalId = await ensurePrincipalExists(principal);
-        } else if (principal.type === 'group') {
-          // Pass authContext to enable member fetching for Entra ID groups when available
-          principalId = await ensureGroupPrincipalExists(principal, authContext);
-        } else {
-          logger.error(`Unsupported principal type: ${principal.type}`);
-          continue; // Skip invalid principal types
-        }
-
-        // Update the principal with the validated ID for ACL operations
-        validatedPrincipals.push({
-          ...principal,
-          id: principalId,
-        });
-      } catch (error) {
-        logger.error('Error ensuring principal exists:', {
-          principal: {
-            type: principal.type,
-            id: principal.id,
-            name: principal.name,
-            source: principal.source,
-          },
-          error: error.message,
-        });
-        // Continue with other principals instead of failing the entire operation
-        continue;
-      }
-    }
-
-    // Add removed principals
-    if (removed && Array.isArray(removed)) {
-      revokedPrincipals.push(...removed);
-    }
-
-    // If public is disabled, add public to revoked list
-    if (!isPublic) {
-      revokedPrincipals.push({
-        type: 'public',
-        id: null,
-      });
-    }
-
-    const results = await bulkUpdateResourcePermissions({
-      resourceType,
-      resourceId,
-      updatedPrincipals: validatedPrincipals,
-      revokedPrincipals,
-      grantedBy: userId,
-    });
-
-    /** @type {TUpdateResourcePermissionsResponse} */
-    const response = {
-      message: 'Permissions updated successfully',
-      results: {
-        principals: results.granted,
-        public: isPublic || false,
-        publicAccessRoleId: isPublic ? publicAccessRoleId : undefined,
-      },
-    };
-
-    res.status(200).json(response);
-  } catch (error) {
-    logger.error('Error updating resource permissions:', error);
-    res.status(400).json({
-      error: 'Failed to update permissions',
-      details: error.message,
-    });
-  }
-};
-
-/**
- * Get principals with their permission roles for a resource (UI-friendly format)
- * Uses efficient aggregation pipeline to join User/Group data in single query
- * @route GET /api/permissions/{resourceType}/{resourceId}
- */
-const getResourcePermissions = async (req, res) => {
-  try {
-    const { resourceType, resourceId } = req.params;
-
-    // Use aggregation pipeline for efficient single-query data retrieval
-    const results = await AclEntry.aggregate([
-      // Match ACL entries for this resource
-      {
-        $match: {
-          resourceType,
-          resourceId: mongoose.Types.ObjectId.isValid(resourceId)
-            ? mongoose.Types.ObjectId.createFromHexString(resourceId)
-            : resourceId,
-        },
-      },
-      // Lookup AccessRole information
-      {
-        $lookup: {
-          from: 'accessroles',
-          localField: 'roleId',
-          foreignField: '_id',
-          as: 'role',
-        },
-      },
-      // Lookup User information (for user principals)
-      {
-        $lookup: {
-          from: 'users',
-          localField: 'principalId',
-          foreignField: '_id',
-          as: 'userInfo',
-        },
-      },
-      // Lookup Group information (for group principals)
-      {
-        $lookup: {
-          from: 'groups',
-          localField: 'principalId',
-          foreignField: '_id',
-          as: 'groupInfo',
-        },
-      },
-      // Project final structure
-      {
-        $project: {
-          principalType: 1,
-          principalId: 1,
-          accessRoleId: { $arrayElemAt: ['$role.accessRoleId', 0] },
-          userInfo: { $arrayElemAt: ['$userInfo', 0] },
-          groupInfo: { $arrayElemAt: ['$groupInfo', 0] },
-        },
-      },
-    ]);
-
-    const principals = [];
-    let publicPermission = null;
-
-    // Process aggregation results
-    for (const result of results) {
-      if (result.principalType === 'public') {
-        publicPermission = {
-          public: true,
-          publicAccessRoleId: result.accessRoleId,
-        };
-      } else if (result.principalType === 'user' && result.userInfo) {
-        principals.push({
-          type: 'user',
-          id: result.userInfo._id.toString(),
-          name: result.userInfo.name || result.userInfo.username,
-          email: result.userInfo.email,
-          avatar: result.userInfo.avatar,
-          source: !result.userInfo._id ? 'entra' : 'local',
-          idOnTheSource: result.userInfo.idOnTheSource || result.userInfo._id.toString(),
-          accessRoleId: result.accessRoleId,
-        });
-      } else if (result.principalType === 'group' && result.groupInfo) {
-        principals.push({
-          type: 'group',
-          id: result.groupInfo._id.toString(),
-          name: result.groupInfo.name,
-          email: result.groupInfo.email,
-          description: result.groupInfo.description,
-          avatar: result.groupInfo.avatar,
-          source: result.groupInfo.source || 'local',
-          idOnTheSource: result.groupInfo.idOnTheSource || result.groupInfo._id.toString(),
-          accessRoleId: result.accessRoleId,
-        });
-      }
-    }
-
-    // Return response in format expected by frontend
-    const response = {
-      resourceType,
-      resourceId,
-      principals,
-      public: publicPermission?.public || false,
-      ...(publicPermission?.publicAccessRoleId && {
-        publicAccessRoleId: publicPermission.publicAccessRoleId,
-      }),
-    };
-
-    res.status(200).json(response);
-  } catch (error) {
-    logger.error('Error getting resource permissions principals:', error);
-    res.status(500).json({
-      error: 'Failed to get permissions principals',
-      details: error.message,
-    });
-  }
-};
-
-/**
- * Get available roles for a resource type
- * @route GET /api/{resourceType}/roles
- */
-const getResourceRoles = async (req, res) => {
-  try {
-    const { resourceType } = req.params;
-
-    const roles = await getAvailableRoles({ resourceType });
-
-    res.status(200).json(
-      roles.map((role) => ({
-        accessRoleId: role.accessRoleId,
-        name: role.name,
-        description: role.description,
-        permBits: role.permBits,
-      })),
-    );
-  } catch (error) {
-    logger.error('Error getting resource roles:', error);
-    res.status(500).json({
-      error: 'Failed to get roles',
-      details: error.message,
-    });
-  }
-};
-
-/**
- * Get user's effective permission bitmask for a resource
- * @route GET /api/{resourceType}/{resourceId}/effective
- */
-const getUserEffectivePermissions = async (req, res) => {
-  try {
-    const { resourceType, resourceId } = req.params;
-    const { id: userId } = req.user;
-
-    const permissionBits = await getEffectivePermissions({
-      userId,
-      resourceType,
-      resourceId,
-    });
-
-    res.status(200).json({
-      permissionBits,
-    });
-  } catch (error) {
-    logger.error('Error getting user effective permissions:', error);
-    res.status(500).json({
-      error: 'Failed to get effective permissions',
-      details: error.message,
-    });
-  }
-};
-
-/**
- * Search for users and groups to grant permissions
- * Supports hybrid local database + Entra ID search when configured
- * @route GET /api/permissions/search-principals
- */
-const searchPrincipals = async (req, res) => {
-  try {
-    const { q: query, limit = 20, type } = req.query;
-
-    if (!query || query.trim().length === 0) {
-      return res.status(400).json({
-        error: 'Query parameter "q" is required and must not be empty',
-      });
-    }
-
-    if (query.trim().length < 2) {
-      return res.status(400).json({
-        error: 'Query must be at least 2 characters long',
-      });
-    }
-
-    const searchLimit = Math.min(Math.max(1, parseInt(limit) || 10), 50);
-    const typeFilter = ['user', 'group'].includes(type) ? type : null;
-
-    const localResults = await searchLocalPrincipals(query.trim(), searchLimit, typeFilter);
-    let allPrincipals = [...localResults];
-
-    const useEntraId = entraIdPrincipalFeatureEnabled(req.user);
-
-    if (useEntraId && localResults.length < searchLimit) {
-      try {
-        const graphTypeMap = {
-          user: 'users',
-          group: 'groups',
-          null: 'all',
-        };
-
-        const authHeader = req.headers.authorization;
-        const accessToken =
-          authHeader && authHeader.startsWith('Bearer ') ? authHeader.substring(7) : null;
-
-        if (accessToken) {
-          const graphResults = await searchEntraIdPrincipals(
-            accessToken,
-            req.user.openidId,
-            query.trim(),
-            graphTypeMap[typeFilter],
-            searchLimit - localResults.length,
-          );
-
-          const localEmails = new Set(
-            localResults.map((p) => p.email?.toLowerCase()).filter(Boolean),
-          );
-          const localGroupSourceIds = new Set(
-            localResults.map((p) => p.idOnTheSource).filter(Boolean),
-          );
-
-          for (const principal of graphResults) {
-            const isDuplicateByEmail =
-              principal.email && localEmails.has(principal.email.toLowerCase());
-            const isDuplicateBySourceId =
-              principal.idOnTheSource && localGroupSourceIds.has(principal.idOnTheSource);
-
-            if (!isDuplicateByEmail && !isDuplicateBySourceId) {
-              allPrincipals.push(principal);
-            }
-          }
-        }
-      } catch (graphError) {
-        logger.warn('Graph API search failed, falling back to local results:', graphError.message);
-      }
-    }
-    const scoredResults = allPrincipals.map((item) => ({
-      ...item,
-      _searchScore: calculateRelevanceScore(item, query.trim()),
-    }));
-
-    allPrincipals = sortPrincipalsByRelevance(scoredResults)
-      .slice(0, searchLimit)
-      .map((result) => {
-        const { _searchScore, ...resultWithoutScore } = result;
-        return resultWithoutScore;
-      });
-    res.status(200).json({
-      query: query.trim(),
-      limit: searchLimit,
-      type: typeFilter,
-      results: allPrincipals,
-      count: allPrincipals.length,
-      sources: {
-        local: allPrincipals.filter((r) => r.source === 'local').length,
-        entra: allPrincipals.filter((r) => r.source === 'entra').length,
-      },
-    });
-  } catch (error) {
-    logger.error('Error searching principals:', error);
-    res.status(500).json({
-      error: 'Failed to search principals',
-      details: error.message,
-    });
-  }
-};
-
-module.exports = {
-  updateResourcePermissions,
-  getResourcePermissions,
-  getResourceRoles,
-  getUserEffectivePermissions,
-  searchPrincipals,
-};
--- a/api/server/controllers/agents/v1.js
+++ b/api/server/controllers/agents/v1.js
@@ -1,12 +1,13 @@
 const { z } = require('zod');
 const fs = require('fs').promises;
 const { nanoid } = require('nanoid');
-const { logger, PermissionBits } = require('@librechat/data-schemas');
+const { logger } = require('@librechat/data-schemas');
 const { agentCreateSchema, agentUpdateSchema } = require('@librechat/api');
 const {
  Tools,
-  SystemRoles,
+  Constants,
  FileSources,
+  SystemRoles,
  EToolResources,
  actionDelimiter,
  removeNullishValues,
@@ -16,24 +17,18 @@ const {
  createAgent,
  updateAgent,
  deleteAgent,
-  getListAgentsByAccess,
-  countPromotedAgents,
-  revertAgentVersion,
+  getListAgents,
 } = require('~/models/Agent');
-const {
-  grantPermission,
-  findAccessibleResources,
-  findPubliclyAccessibleResources,
-  hasPublicPermission,
-} = require('~/server/services/PermissionService');
 const { getStrategyFunctions } = require('~/server/services/Files/strategies');
 const { resizeAvatar } = require('~/server/services/Files/images/avatar');
 const { refreshS3Url } = require('~/server/services/Files/S3/crud');
 const { filterFile } = require('~/server/services/Files/process');
 const { updateAction, getActions } = require('~/models/Action');
 const { getCachedTools } = require('~/server/services/Config');
+const { updateAgentProjects } = require('~/models/Agent');
+const { getProjectByName } = require('~/models/Project');
+const { revertAgentVersion } = require('~/models/Agent');
 const { deleteFileByFilter } = require('~/models/File');
-const { getCategoriesWithCounts } = require('~/models');

 const systemTools = {
  [Tools.execute_code]: true,
@@ -72,27 +67,6 @@ const createAgentHandler = async (req, res) => {
    }

    const agent = await createAgent(agentData);
-
-    // Automatically grant owner permissions to the creator
-    try {
-      await grantPermission({
-        principalType: 'user',
-        principalId: userId,
-        resourceType: 'agent',
-        resourceId: agent._id,
-        accessRoleId: 'agent_owner',
-        grantedBy: userId,
-      });
-      logger.debug(
-        `[createAgent] Granted owner permissions to user ${userId} for agent ${agent.id}`,
-      );
-    } catch (permissionError) {
-      logger.error(
-        `[createAgent] Failed to grant owner permissions for agent ${agent.id}:`,
-        permissionError,
-      );
-    }
-
    res.status(201).json(agent);
  } catch (error) {
    if (error instanceof z.ZodError) {
@@ -115,14 +89,21 @@ const createAgentHandler = async (req, res) => {
 * @returns {Promise<Agent>} 200 - success response - application/json
 * @returns {Error} 404 - Agent not found
 */
-const getAgentHandler = async (req, res, expandProperties = false) => {
+const getAgentHandler = async (req, res) => {
  try {
    const id = req.params.id;
    const author = req.user.id;

-    // Permissions are validated by middleware before calling this function
-    // Simply load the agent by ID
-    const agent = await getAgent({ id });
+    let query = { id, author };
+
+    const globalProject = await getProjectByName(Constants.GLOBAL_PROJECT_NAME, ['agentIds']);
+    if (globalProject && (globalProject.agentIds?.length ?? 0) > 0) {
+      query = {
+        $or: [{ id, $in: globalProject.agentIds }, query],
+      };
+    }
+
+    const agent = await getAgent(query);

    if (!agent) {
      return res.status(404).json({ error: 'Agent not found' });
@@ -139,45 +120,23 @@ const getAgentHandler = async (req, res, expandProperties = false) => {
    }

    agent.author = agent.author.toString();
-
-    // @deprecated - isCollaborative replaced by ACL permissions
    agent.isCollaborative = !!agent.isCollaborative;

-    // Check if agent is public
-    const isPublic = await hasPublicPermission({
-      resourceType: 'agent',
-      resourceId: agent._id,
-      requiredPermissions: PermissionBits.VIEW,
-    });
-    agent.isPublic = isPublic;
-
    if (agent.author !== author) {
      delete agent.author;
    }

-    if (!expandProperties) {
-      // VIEW permission: Basic agent info only
+    if (!agent.isCollaborative && agent.author !== author && req.user.role !== SystemRoles.ADMIN) {
      return res.status(200).json({
-        _id: agent._id,
        id: agent.id,
        name: agent.name,
-        description: agent.description,
        avatar: agent.avatar,
        author: agent.author,
-        provider: agent.provider,
-        model: agent.model,
        projectIds: agent.projectIds,
-        // @deprecated - isCollaborative replaced by ACL permissions
        isCollaborative: agent.isCollaborative,
-        isPublic: agent.isPublic,
        version: agent.version,
-        // Safe metadata
-        createdAt: agent.createdAt,
-        updatedAt: agent.updatedAt,
      });
    }
-
-    // EDIT permission: Full agent details including sensitive configuration
    return res.status(200).json(agent);
  } catch (error) {
    logger.error('[/Agents/:id] Error retrieving agent', error);
@@ -198,20 +157,43 @@ const updateAgentHandler = async (req, res) => {
  try {
    const id = req.params.id;
    const validatedData = agentUpdateSchema.parse(req.body);
-    const { _id, ...updateData } = removeNullishValues(validatedData);
+    const { projectIds, removeProjectIds, ...updateData } = removeNullishValues(validatedData);
+    const isAdmin = req.user.role === SystemRoles.ADMIN;
    const existingAgent = await getAgent({ id });

    if (!existingAgent) {
      return res.status(404).json({ error: 'Agent not found' });
    }

+    const isAuthor = existingAgent.author.toString() === req.user.id;
+    const hasEditPermission = existingAgent.isCollaborative || isAdmin || isAuthor;
+
+    if (!hasEditPermission) {
+      return res.status(403).json({
+        error: 'You do not have permission to modify this non-collaborative agent',
+      });
+    }
+
+    /** @type {boolean} */
+    const isProjectUpdate = (projectIds?.length ?? 0) > 0 || (removeProjectIds?.length ?? 0) > 0;
+
    let updatedAgent =
      Object.keys(updateData).length > 0
        ? await updateAgent({ id }, updateData, {
            updatingUserId: req.user.id,
+            skipVersioning: isProjectUpdate,
          })
        : existingAgent;

+    if (isProjectUpdate) {
+      updatedAgent = await updateAgentProjects({
+        user: req.user,
+        agentId: id,
+        projectIds,
+        removeProjectIds,
+      });
+    }
+
    if (updatedAgent.author) {
      updatedAgent.author = updatedAgent.author.toString();
    }
@@ -336,26 +318,6 @@ const duplicateAgentHandler = async (req, res) => {
    newAgentData.actions = agentActions;
    const newAgent = await createAgent(newAgentData);

-    // Automatically grant owner permissions to the duplicator
-    try {
-      await grantPermission({
-        principalType: 'user',
-        principalId: userId,
-        resourceType: 'agent',
-        resourceId: newAgent._id,
-        accessRoleId: 'agent_owner',
-        grantedBy: userId,
-      });
-      logger.debug(
-        `[duplicateAgent] Granted owner permissions to user ${userId} for duplicated agent ${newAgent.id}`,
-      );
-    } catch (permissionError) {
-      logger.error(
-        `[duplicateAgent] Failed to grant owner permissions for duplicated agent ${newAgent.id}:`,
-        permissionError,
-      );
-    }
-
    return res.status(201).json({
      agent: newAgent,
      actions: newActionsList,
@@ -382,7 +344,7 @@ const deleteAgentHandler = async (req, res) => {
    if (!agent) {
      return res.status(404).json({ error: 'Agent not found' });
    }
-    await deleteAgent({ id });
+    await deleteAgent({ id, author: req.user.id });
    return res.json({ message: 'Agent deleted' });
  } catch (error) {
    logger.error('[/Agents/:id] Error deleting Agent', error);
@@ -391,7 +353,7 @@ const deleteAgentHandler = async (req, res) => {
 };

 /**
- * Lists agents using ACL-aware permissions (ownership + explicit shares).
+ *
 * @route GET /Agents
 * @param {object} req - Express Request
 * @param {object} req.query - Request query
@@ -400,64 +362,9 @@ const deleteAgentHandler = async (req, res) => {
 */
 const getListAgentsHandler = async (req, res) => {
  try {
-    const userId = req.user.id;
-    const { category, search, limit, cursor, promoted } = req.query;
-    let requiredPermission = req.query.requiredPermission;
-    if (typeof requiredPermission === 'string') {
-      requiredPermission = parseInt(requiredPermission, 10);
-      if (isNaN(requiredPermission)) {
-        requiredPermission = PermissionBits.VIEW;
-      }
-    } else if (typeof requiredPermission !== 'number') {
-      requiredPermission = PermissionBits.VIEW;
-    }
-    // Base filter
-    const filter = {};
-
-    // Handle category filter - only apply if category is defined
-    if (category !== undefined && category.trim() !== '') {
-      filter.category = category;
-    }
-
-    // Handle promoted filter - only from query param
-    if (promoted === '1') {
-      filter.is_promoted = true;
-    } else if (promoted === '0') {
-      filter.is_promoted = { $ne: true };
-    }
-
-    // Handle search filter
-    if (search && search.trim() !== '') {
-      filter.$or = [
-        { name: { $regex: search.trim(), $options: 'i' } },
-        { description: { $regex: search.trim(), $options: 'i' } },
-      ];
-    }
-    // Get agent IDs the user has VIEW access to via ACL
-    const accessibleIds = await findAccessibleResources({
-      userId,
-      resourceType: 'agent',
-      requiredPermissions: requiredPermission,
+    const data = await getListAgents({
+      author: req.user.id,
    });
-    const publiclyAccessibleIds = await findPubliclyAccessibleResources({
-      resourceType: 'agent',
-      requiredPermissions: PermissionBits.VIEW,
-    });
-    // Use the new ACL-aware function
-    const data = await getListAgentsByAccess({
-      accessibleIds,
-      otherParams: filter,
-      limit,
-      after: cursor,
-    });
-    if (data?.data?.length) {
-      data.data = data.data.map((agent) => {
-        if (publiclyAccessibleIds.some((id) => id.equals(agent._id))) {
-          agent.isPublic = true;
-        }
-        return agent;
-      });
-    }
    return res.json(data);
  } catch (error) {
    logger.error('[/Agents] Error listing Agents', error);
@@ -624,48 +531,7 @@ const revertAgentVersionHandler = async (req, res) => {
    res.status(500).json({ error: error.message });
  }
 };
-/**
- * Get all agent categories with counts
- *
- * @param {Object} _req - Express request object (unused)
- * @param {Object} res - Express response object
- */
-const getAgentCategories = async (_req, res) => {
-  try {
-    const categories = await getCategoriesWithCounts();
-    const promotedCount = await countPromotedAgents();
-    const formattedCategories = categories.map((category) => ({
-      value: category.value,
-      label: category.label,
-      count: category.agentCount,
-      description: category.description,
-    }));

-    if (promotedCount > 0) {
-      formattedCategories.unshift({
-        value: 'promoted',
-        label: 'Promoted',
-        count: promotedCount,
-        description: 'Our recommended agents',
-      });
-    }
-
-    formattedCategories.push({
-      value: 'all',
-      label: 'All',
-      description: 'All available agents',
-    });
-
-    res.status(200).json(formattedCategories);
-  } catch (error) {
-    logger.error('[/Agents/Marketplace] Error fetching agent categories:', error);
-    res.status(500).json({
-      error: 'Failed to fetch agent categories',
-      userMessage: 'Unable to load categories. Please refresh the page.',
-      suggestion: 'Try refreshing the page or check your network connection',
-    });
-  }
-};
 module.exports = {
  createAgent: createAgentHandler,
  getAgent: getAgentHandler,
@@ -675,5 +541,4 @@ module.exports = {
  getListAgents: getListAgentsHandler,
  uploadAgentAvatar: uploadAgentAvatarHandler,
  revertAgentVersion: revertAgentVersionHandler,
-  getAgentCategories,
 };
--- a/api/server/controllers/agents/v1.spec.js
+++ b/api/server/controllers/agents/v1.spec.js
@@ -372,6 +372,52 @@ describe('Agent Controllers - Mass Assignment Protection', () => {
      expect(agentInDb.id).toBe(existingAgentId);
    });

+    test('should reject update from non-author when not collaborative', async () => {
+      const differentUserId = new mongoose.Types.ObjectId().toString();
+      mockReq.user.id = differentUserId; // Different user
+      mockReq.params.id = existingAgentId;
+      mockReq.body = {
+        name: 'Unauthorized Update',
+      };
+
+      await updateAgentHandler(mockReq, mockRes);
+
+      expect(mockRes.status).toHaveBeenCalledWith(403);
+      expect(mockRes.json).toHaveBeenCalledWith({
+        error: 'You do not have permission to modify this non-collaborative agent',
+      });
+
+      // Verify agent was not modified in database
+      const agentInDb = await Agent.findOne({ id: existingAgentId });
+      expect(agentInDb.name).toBe('Original Agent');
+    });
+
+    test('should allow update from non-author when collaborative', async () => {
+      // First make the agent collaborative
+      await Agent.updateOne({ id: existingAgentId }, { isCollaborative: true });
+
+      const differentUserId = new mongoose.Types.ObjectId().toString();
+      mockReq.user.id = differentUserId; // Different user
+      mockReq.params.id = existingAgentId;
+      mockReq.body = {
+        name: 'Collaborative Update',
+      };
+
+      await updateAgentHandler(mockReq, mockRes);
+
+      expect(mockRes.status).not.toHaveBeenCalledWith(403);
+      expect(mockRes.json).toHaveBeenCalled();
+
+      const updatedAgent = mockRes.json.mock.calls[0][0];
+      expect(updatedAgent.name).toBe('Collaborative Update');
+      // Author field should be removed for non-author
+      expect(updatedAgent.author).toBeUndefined();
+
+      // Verify in database
+      const agentInDb = await Agent.findOne({ id: existingAgentId });
+      expect(agentInDb.name).toBe('Collaborative Update');
+    });
+
    test('should allow admin to update any agent', async () => {
      const adminUserId = new mongoose.Types.ObjectId().toString();
      mockReq.user.id = adminUserId;
@@ -509,6 +555,45 @@ describe('Agent Controllers - Mass Assignment Protection', () => {
      expect(agentInDb.__v).not.toBe(99);
    });

+    test('should prevent privilege escalation through isCollaborative', async () => {
+      // Create a non-collaborative agent
+      const authorId = new mongoose.Types.ObjectId();
+      const agent = await Agent.create({
+        id: `agent_${uuidv4()}`,
+        name: 'Private Agent',
+        provider: 'openai',
+        model: 'gpt-4',
+        author: authorId,
+        isCollaborative: false,
+        versions: [
+          {
+            name: 'Private Agent',
+            provider: 'openai',
+            model: 'gpt-4',
+            createdAt: new Date(),
+            updatedAt: new Date(),
+          },
+        ],
+      });
+
+      // Try to make it collaborative as a different user
+      const attackerId = new mongoose.Types.ObjectId().toString();
+      mockReq.user.id = attackerId;
+      mockReq.params.id = agent.id;
+      mockReq.body = {
+        isCollaborative: true, // Trying to escalate privileges
+      };
+
+      await updateAgentHandler(mockReq, mockRes);
+
+      // Should be rejected
+      expect(mockRes.status).toHaveBeenCalledWith(403);
+
+      // Verify in database that it's still not collaborative
+      const agentInDb = await Agent.findOne({ id: agent.id });
+      expect(agentInDb.isCollaborative).toBe(false);
+    });
+
    test('should prevent author hijacking', async () => {
      const originalAuthorId = new mongoose.Types.ObjectId();
      const attackerId = new mongoose.Types.ObjectId();
--- a/api/server/index.js
+++ b/api/server/index.js
@@ -117,8 +117,6 @@ const startServer = async () => {
  app.use('/api/agents', routes.agents);
  app.use('/api/banner', routes.banner);
  app.use('/api/memories', routes.memories);
-  app.use('/api/permissions', routes.accessPermissions);
-
  app.use('/api/tags', routes.tags);
  app.use('/api/mcp', routes.mcp);

--- a/api/server/middleware/accessResources/canAccessAgentFromBody.js
+++ b/api/server/middleware/accessResources/canAccessAgentFromBody.js
@@ -1,97 +0,0 @@
-const { logger } = require('@librechat/data-schemas');
-const { Constants, isAgentsEndpoint } = require('librechat-data-provider');
-const { canAccessResource } = require('./canAccessResource');
-const { getAgent } = require('~/models/Agent');
-
-/**
- * Agent ID resolver function for agent_id from request body
- * Resolves custom agent ID (e.g., "agent_abc123") to MongoDB ObjectId
- * This is used specifically for chat routes where agent_id comes from request body
- *
- * @param {string} agentCustomId - Custom agent ID from request body
- * @returns {Promise<Object|null>} Agent document with _id field, or null if not found
- */
-const resolveAgentIdFromBody = async (agentCustomId) => {
-  // Handle ephemeral agents - they don't need permission checks
-  if (agentCustomId === Constants.EPHEMERAL_AGENT_ID) {
-    return null; // No permission check needed for ephemeral agents
-  }
-
-  return await getAgent({ id: agentCustomId });
-};
-
-/**
- * Middleware factory that creates middleware to check agent access permissions from request body.
- * This middleware is specifically designed for chat routes where the agent_id comes from req.body
- * instead of route parameters.
- *
- * @param {Object} options - Configuration options
- * @param {number} options.requiredPermission - The permission bit required (1=view, 2=edit, 4=delete, 8=share)
- * @returns {Function} Express middleware function
- *
- * @example
- * // Basic usage for agent chat (requires VIEW permission)
- * router.post('/chat',
- *   canAccessAgentFromBody({ requiredPermission: PermissionBits.VIEW }),
- *   buildEndpointOption,
- *   chatController
- * );
- */
-const canAccessAgentFromBody = (options) => {
-  const { requiredPermission } = options;
-
-  // Validate required options
-  if (!requiredPermission || typeof requiredPermission !== 'number') {
-    throw new Error('canAccessAgentFromBody: requiredPermission is required and must be a number');
-  }
-
-  return async (req, res, next) => {
-    try {
-      const { endpoint, agent_id } = req.body;
-      let agentId = agent_id;
-
-      if (!isAgentsEndpoint(endpoint)) {
-        agentId = Constants.EPHEMERAL_AGENT_ID;
-      }
-
-      if (!agentId) {
-        return res.status(400).json({
-          error: 'Bad Request',
-          message: 'agent_id is required in request body',
-        });
-      }
-
-      // Skip permission checks for ephemeral agents
-      if (agentId === Constants.EPHEMERAL_AGENT_ID) {
-        return next();
-      }
-
-      const agentAccessMiddleware = canAccessResource({
-        resourceType: 'agent',
-        requiredPermission,
-        resourceIdParam: 'agent_id', // This will be ignored since we use custom resolver
-        idResolver: () => resolveAgentIdFromBody(agentId),
-      });
-
-      const tempReq = {
-        ...req,
-        params: {
-          ...req.params,
-          agent_id: agentId,
-        },
-      };
-
-      return agentAccessMiddleware(tempReq, res, next);
-    } catch (error) {
-      logger.error('Failed to validate agent access permissions', error);
-      return res.status(500).json({
-        error: 'Internal Server Error',
-        message: 'Failed to validate agent access permissions',
-      });
-    }
-  };
-};
-
-module.exports = {
-  canAccessAgentFromBody,
-};
--- a/api/server/middleware/accessResources/canAccessAgentResource.js
+++ b/api/server/middleware/accessResources/canAccessAgentResource.js
@@ -1,58 +0,0 @@
-const { getAgent } = require('~/models/Agent');
-const { canAccessResource } = require('./canAccessResource');
-
-/**
- * Agent ID resolver function
- * Resolves custom agent ID (e.g., "agent_abc123") to MongoDB ObjectId
- *
- * @param {string} agentCustomId - Custom agent ID from route parameter
- * @returns {Promise<Object|null>} Agent document with _id field, or null if not found
- */
-const resolveAgentId = async (agentCustomId) => {
-  return await getAgent({ id: agentCustomId });
-};
-
-/**
- * Agent-specific middleware factory that creates middleware to check agent access permissions.
- * This middleware extends the generic canAccessResource to handle agent custom ID resolution.
- *
- * @param {Object} options - Configuration options
- * @param {number} options.requiredPermission - The permission bit required (1=view, 2=edit, 4=delete, 8=share)
- * @param {string} [options.resourceIdParam='id'] - The name of the route parameter containing the agent custom ID
- * @returns {Function} Express middleware function
- *
- * @example
- * // Basic usage for viewing agents
- * router.get('/agents/:id',
- *   canAccessAgentResource({ requiredPermission: 1 }),
- *   getAgent
- * );
- *
- * @example
- * // Custom resource ID parameter and edit permission
- * router.patch('/agents/:agent_id',
- *   canAccessAgentResource({
- *     requiredPermission: 2,
- *     resourceIdParam: 'agent_id'
- *   }),
- *   updateAgent
- * );
- */
-const canAccessAgentResource = (options) => {
-  const { requiredPermission, resourceIdParam = 'id' } = options;
-
-  if (!requiredPermission || typeof requiredPermission !== 'number') {
-    throw new Error('canAccessAgentResource: requiredPermission is required and must be a number');
-  }
-
-  return canAccessResource({
-    resourceType: 'agent',
-    requiredPermission,
-    resourceIdParam,
-    idResolver: resolveAgentId,
-  });
-};
-
-module.exports = {
-  canAccessAgentResource,
-};
--- a/api/server/middleware/accessResources/canAccessAgentResource.spec.js
+++ b/api/server/middleware/accessResources/canAccessAgentResource.spec.js
@@ -1,384 +0,0 @@
-const mongoose = require('mongoose');
-const { MongoMemoryServer } = require('mongodb-memory-server');
-const { canAccessAgentResource } = require('./canAccessAgentResource');
-const { User, Role, AclEntry } = require('~/db/models');
-const { createAgent } = require('~/models/Agent');
-
-describe('canAccessAgentResource middleware', () => {
-  let mongoServer;
-  let req, res, next;
-  let testUser;
-
-  beforeAll(async () => {
-    mongoServer = await MongoMemoryServer.create();
-    const mongoUri = mongoServer.getUri();
-    await mongoose.connect(mongoUri);
-  });
-
-  afterAll(async () => {
-    await mongoose.disconnect();
-    await mongoServer.stop();
-  });
-
-  beforeEach(async () => {
-    await mongoose.connection.dropDatabase();
-    await Role.create({
-      name: 'test-role',
-      permissions: {
-        AGENTS: {
-          USE: true,
-          CREATE: true,
-          SHARED_GLOBAL: false,
-        },
-      },
-    });
-
-    // Create a test user
-    testUser = await User.create({
-      email: 'test@example.com',
-      name: 'Test User',
-      username: 'testuser',
-      role: 'test-role',
-    });
-
-    req = {
-      user: { id: testUser._id.toString(), role: 'test-role' },
-      params: {},
-    };
-    res = {
-      status: jest.fn().mockReturnThis(),
-      json: jest.fn(),
-    };
-    next = jest.fn();
-
-    jest.clearAllMocks();
-  });
-
-  describe('middleware factory', () => {
-    test('should throw error if requiredPermission is not provided', () => {
-      expect(() => canAccessAgentResource({})).toThrow(
-        'canAccessAgentResource: requiredPermission is required and must be a number',
-      );
-    });
-
-    test('should throw error if requiredPermission is not a number', () => {
-      expect(() => canAccessAgentResource({ requiredPermission: '1' })).toThrow(
-        'canAccessAgentResource: requiredPermission is required and must be a number',
-      );
-    });
-
-    test('should create middleware with default resourceIdParam', () => {
-      const middleware = canAccessAgentResource({ requiredPermission: 1 });
-      expect(typeof middleware).toBe('function');
-      expect(middleware.length).toBe(3); // Express middleware signature
-    });
-
-    test('should create middleware with custom resourceIdParam', () => {
-      const middleware = canAccessAgentResource({
-        requiredPermission: 2,
-        resourceIdParam: 'agent_id',
-      });
-      expect(typeof middleware).toBe('function');
-      expect(middleware.length).toBe(3);
-    });
-  });
-
-  describe('permission checking with real agents', () => {
-    test('should allow access when user is the agent author', async () => {
-      // Create an agent owned by the test user
-      const agent = await createAgent({
-        id: `agent_${Date.now()}`,
-        name: 'Test Agent',
-        provider: 'openai',
-        model: 'gpt-4',
-        author: testUser._id,
-      });
-
-      // Create ACL entry for the author (owner permissions)
-      await AclEntry.create({
-        principalType: 'user',
-        principalId: testUser._id,
-        principalModel: 'User',
-        resourceType: 'agent',
-        resourceId: agent._id,
-        permBits: 15, // All permissions (1+2+4+8)
-        grantedBy: testUser._id,
-      });
-
-      req.params.id = agent.id;
-
-      const middleware = canAccessAgentResource({ requiredPermission: 1 }); // VIEW permission
-      await middleware(req, res, next);
-
-      expect(next).toHaveBeenCalled();
-      expect(res.status).not.toHaveBeenCalled();
-    });
-
-    test('should deny access when user is not the author and has no ACL entry', async () => {
-      // Create an agent owned by a different user
-      const otherUser = await User.create({
-        email: 'other@example.com',
-        name: 'Other User',
-        username: 'otheruser',
-        role: 'test-role',
-      });
-
-      const agent = await createAgent({
-        id: `agent_${Date.now()}`,
-        name: 'Other User Agent',
-        provider: 'openai',
-        model: 'gpt-4',
-        author: otherUser._id,
-      });
-
-      // Create ACL entry for the other user (owner)
-      await AclEntry.create({
-        principalType: 'user',
-        principalId: otherUser._id,
-        principalModel: 'User',
-        resourceType: 'agent',
-        resourceId: agent._id,
-        permBits: 15, // All permissions
-        grantedBy: otherUser._id,
-      });
-
-      req.params.id = agent.id;
-
-      const middleware = canAccessAgentResource({ requiredPermission: 1 }); // VIEW permission
-      await middleware(req, res, next);
-
-      expect(next).not.toHaveBeenCalled();
-      expect(res.status).toHaveBeenCalledWith(403);
-      expect(res.json).toHaveBeenCalledWith({
-        error: 'Forbidden',
-        message: 'Insufficient permissions to access this agent',
-      });
-    });
-
-    test('should allow access when user has ACL entry with sufficient permissions', async () => {
-      // Create an agent owned by a different user
-      const otherUser = await User.create({
-        email: 'other2@example.com',
-        name: 'Other User 2',
-        username: 'otheruser2',
-        role: 'test-role',
-      });
-
-      const agent = await createAgent({
-        id: `agent_${Date.now()}`,
-        name: 'Shared Agent',
-        provider: 'openai',
-        model: 'gpt-4',
-        author: otherUser._id,
-      });
-
-      // Create ACL entry granting view permission to test user
-      await AclEntry.create({
-        principalType: 'user',
-        principalId: testUser._id,
-        principalModel: 'User',
-        resourceType: 'agent',
-        resourceId: agent._id,
-        permBits: 1, // VIEW permission
-        grantedBy: otherUser._id,
-      });
-
-      req.params.id = agent.id;
-
-      const middleware = canAccessAgentResource({ requiredPermission: 1 }); // VIEW permission
-      await middleware(req, res, next);
-
-      expect(next).toHaveBeenCalled();
-      expect(res.status).not.toHaveBeenCalled();
-    });
-
-    test('should deny access when ACL permissions are insufficient', async () => {
-      // Create an agent owned by a different user
-      const otherUser = await User.create({
-        email: 'other3@example.com',
-        name: 'Other User 3',
-        username: 'otheruser3',
-        role: 'test-role',
-      });
-
-      const agent = await createAgent({
-        id: `agent_${Date.now()}`,
-        name: 'Limited Access Agent',
-        provider: 'openai',
-        model: 'gpt-4',
-        author: otherUser._id,
-      });
-
-      // Create ACL entry granting only view permission
-      await AclEntry.create({
-        principalType: 'user',
-        principalId: testUser._id,
-        principalModel: 'User',
-        resourceType: 'agent',
-        resourceId: agent._id,
-        permBits: 1, // VIEW permission only
-        grantedBy: otherUser._id,
-      });
-
-      req.params.id = agent.id;
-
-      const middleware = canAccessAgentResource({ requiredPermission: 2 }); // EDIT permission required
-      await middleware(req, res, next);
-
-      expect(next).not.toHaveBeenCalled();
-      expect(res.status).toHaveBeenCalledWith(403);
-      expect(res.json).toHaveBeenCalledWith({
-        error: 'Forbidden',
-        message: 'Insufficient permissions to access this agent',
-      });
-    });
-
-    test('should handle non-existent agent', async () => {
-      req.params.id = 'agent_nonexistent';
-
-      const middleware = canAccessAgentResource({ requiredPermission: 1 });
-      await middleware(req, res, next);
-
-      expect(next).not.toHaveBeenCalled();
-      expect(res.status).toHaveBeenCalledWith(404);
-      expect(res.json).toHaveBeenCalledWith({
-        error: 'Not Found',
-        message: 'agent not found',
-      });
-    });
-
-    test('should use custom resourceIdParam', async () => {
-      const agent = await createAgent({
-        id: `agent_${Date.now()}`,
-        name: 'Custom Param Agent',
-        provider: 'openai',
-        model: 'gpt-4',
-        author: testUser._id,
-      });
-
-      // Create ACL entry for the author
-      await AclEntry.create({
-        principalType: 'user',
-        principalId: testUser._id,
-        principalModel: 'User',
-        resourceType: 'agent',
-        resourceId: agent._id,
-        permBits: 15, // All permissions
-        grantedBy: testUser._id,
-      });
-
-      req.params.agent_id = agent.id; // Using custom param name
-
-      const middleware = canAccessAgentResource({
-        requiredPermission: 1,
-        resourceIdParam: 'agent_id',
-      });
-      await middleware(req, res, next);
-
-      expect(next).toHaveBeenCalled();
-      expect(res.status).not.toHaveBeenCalled();
-    });
-  });
-
-  describe('permission levels', () => {
-    let agent;
-
-    beforeEach(async () => {
-      agent = await createAgent({
-        id: `agent_${Date.now()}`,
-        name: 'Permission Test Agent',
-        provider: 'openai',
-        model: 'gpt-4',
-        author: testUser._id,
-      });
-
-      // Create ACL entry with all permissions for the owner
-      await AclEntry.create({
-        principalType: 'user',
-        principalId: testUser._id,
-        principalModel: 'User',
-        resourceType: 'agent',
-        resourceId: agent._id,
-        permBits: 15, // All permissions (1+2+4+8)
-        grantedBy: testUser._id,
-      });
-
-      req.params.id = agent.id;
-    });
-
-    test('should support view permission (1)', async () => {
-      const middleware = canAccessAgentResource({ requiredPermission: 1 });
-      await middleware(req, res, next);
-      expect(next).toHaveBeenCalled();
-    });
-
-    test('should support edit permission (2)', async () => {
-      const middleware = canAccessAgentResource({ requiredPermission: 2 });
-      await middleware(req, res, next);
-      expect(next).toHaveBeenCalled();
-    });
-
-    test('should support delete permission (4)', async () => {
-      const middleware = canAccessAgentResource({ requiredPermission: 4 });
-      await middleware(req, res, next);
-      expect(next).toHaveBeenCalled();
-    });
-
-    test('should support share permission (8)', async () => {
-      const middleware = canAccessAgentResource({ requiredPermission: 8 });
-      await middleware(req, res, next);
-      expect(next).toHaveBeenCalled();
-    });
-
-    test('should support combined permissions', async () => {
-      const viewAndEdit = 1 | 2; // 3
-      const middleware = canAccessAgentResource({ requiredPermission: viewAndEdit });
-      await middleware(req, res, next);
-      expect(next).toHaveBeenCalled();
-    });
-  });
-
-  describe('integration with agent operations', () => {
-    test('should work with agent CRUD operations', async () => {
-      const agentId = `agent_${Date.now()}`;
-
-      // Create agent
-      const agent = await createAgent({
-        id: agentId,
-        name: 'Integration Test Agent',
-        provider: 'openai',
-        model: 'gpt-4',
-        author: testUser._id,
-        description: 'Testing integration',
-      });
-
-      // Create ACL entry for the author
-      await AclEntry.create({
-        principalType: 'user',
-        principalId: testUser._id,
-        principalModel: 'User',
-        resourceType: 'agent',
-        resourceId: agent._id,
-        permBits: 15, // All permissions
-        grantedBy: testUser._id,
-      });
-
-      req.params.id = agentId;
-
-      // Test view access
-      const viewMiddleware = canAccessAgentResource({ requiredPermission: 1 });
-      await viewMiddleware(req, res, next);
-      expect(next).toHaveBeenCalled();
-      jest.clearAllMocks();
-
-      // Update the agent
-      const { updateAgent } = require('~/models/Agent');
-      await updateAgent({ id: agentId }, { description: 'Updated description' });
-
-      // Test edit access
-      const editMiddleware = canAccessAgentResource({ requiredPermission: 2 });
-      await editMiddleware(req, res, next);
-      expect(next).toHaveBeenCalled();
-    });
-  });
-});
--- a/api/server/middleware/accessResources/canAccessResource.js
+++ b/api/server/middleware/accessResources/canAccessResource.js
@@ -1,157 +0,0 @@
-const { logger } = require('@librechat/data-schemas');
-const { SystemRoles } = require('librechat-data-provider');
-const { checkPermission } = require('~/server/services/PermissionService');
-
-/**
- * Generic base middleware factory that creates middleware to check resource access permissions.
- * This middleware expects MongoDB ObjectIds as resource identifiers for ACL permission checks.
- *
- * @param {Object} options - Configuration options
- * @param {string} options.resourceType - The type of resource (e.g., 'agent', 'file', 'project')
- * @param {number} options.requiredPermission - The permission bit required (1=view, 2=edit, 4=delete, 8=share)
- * @param {string} [options.resourceIdParam='resourceId'] - The name of the route parameter containing the resource ID
- * @param {Function} [options.idResolver] - Optional function to resolve custom IDs to ObjectIds
- * @returns {Function} Express middleware function
- *
- * @example
- * // Direct usage with ObjectId (for resources that use MongoDB ObjectId in routes)
- * router.get('/prompts/:promptId',
- *   canAccessResource({ resourceType: 'prompt', requiredPermission: 1 }),
- *   getPrompt
- * );
- *
- * @example
- * // Usage with custom ID resolver (for resources that use custom string IDs)
- * router.get('/agents/:id',
- *   canAccessResource({
- *     resourceType: 'agent',
- *     requiredPermission: 1,
- *     resourceIdParam: 'id',
- *     idResolver: (customId) => resolveAgentId(customId)
- *   }),
- *   getAgent
- * );
- */
-const canAccessResource = (options) => {
-  const {
-    resourceType,
-    requiredPermission,
-    resourceIdParam = 'resourceId',
-    idResolver = null,
-  } = options;
-
-  if (!resourceType || typeof resourceType !== 'string') {
-    throw new Error('canAccessResource: resourceType is required and must be a string');
-  }
-
-  if (!requiredPermission || typeof requiredPermission !== 'number') {
-    throw new Error('canAccessResource: requiredPermission is required and must be a number');
-  }
-
-  return async (req, res, next) => {
-    try {
-      // Extract resource ID from route parameters
-      const rawResourceId = req.params[resourceIdParam];
-
-      if (!rawResourceId) {
-        logger.warn(`[canAccessResource] Missing ${resourceIdParam} in route parameters`);
-        return res.status(400).json({
-          error: 'Bad Request',
-          message: `${resourceIdParam} is required`,
-        });
-      }
-
-      // Check if user is authenticated
-      if (!req.user || !req.user.id) {
-        logger.warn(
-          `[canAccessResource] Unauthenticated request for ${resourceType} ${rawResourceId}`,
-        );
-        return res.status(401).json({
-          error: 'Unauthorized',
-          message: 'Authentication required',
-        });
-      }
-      // if system admin let through
-      if (req.user.role === SystemRoles.ADMIN) {
-        return next();
-      }
-      const userId = req.user.id;
-      let resourceId = rawResourceId;
-      let resourceInfo = null;
-
-      // Resolve custom ID to ObjectId if resolver is provided
-      if (idResolver) {
-        logger.debug(
-          `[canAccessResource] Resolving ${resourceType} custom ID ${rawResourceId} to ObjectId`,
-        );
-
-        const resolutionResult = await idResolver(rawResourceId);
-
-        if (!resolutionResult) {
-          logger.warn(`[canAccessResource] ${resourceType} not found: ${rawResourceId}`);
-          return res.status(404).json({
-            error: 'Not Found',
-            message: `${resourceType} not found`,
-          });
-        }
-
-        // Handle different resolver return formats
-        if (typeof resolutionResult === 'string' || resolutionResult._id) {
-          resourceId = resolutionResult._id || resolutionResult;
-          resourceInfo = typeof resolutionResult === 'object' ? resolutionResult : null;
-        } else {
-          resourceId = resolutionResult;
-        }
-
-        logger.debug(
-          `[canAccessResource] Resolved ${resourceType} ${rawResourceId} to ObjectId ${resourceId}`,
-        );
-      }
-
-      // Check permissions using PermissionService with ObjectId
-      const hasPermission = await checkPermission({
-        userId,
-        resourceType,
-        resourceId,
-        requiredPermission,
-      });
-
-      if (hasPermission) {
-        logger.debug(
-          `[canAccessResource] User ${userId} has permission ${requiredPermission} on ${resourceType} ${rawResourceId} (${resourceId})`,
-        );
-
-        req.resourceAccess = {
-          resourceType,
-          resourceId, // MongoDB ObjectId for ACL operations
-          customResourceId: rawResourceId, // Original ID from route params
-          permission: requiredPermission,
-          userId,
-          ...(resourceInfo && { resourceInfo }),
-        };
-
-        return next();
-      }
-
-      logger.warn(
-        `[canAccessResource] User ${userId} denied access to ${resourceType} ${rawResourceId} ` +
-          `(required permission: ${requiredPermission})`,
-      );
-
-      return res.status(403).json({
-        error: 'Forbidden',
-        message: `Insufficient permissions to access this ${resourceType}`,
-      });
-    } catch (error) {
-      logger.error(`[canAccessResource] Error checking access for ${resourceType}:`, error);
-      return res.status(500).json({
-        error: 'Internal Server Error',
-        message: 'Failed to check resource access permissions',
-      });
-    }
-  };
-};
-
-module.exports = {
-  canAccessResource,
-};
--- a/api/server/middleware/accessResources/index.js
+++ b/api/server/middleware/accessResources/index.js
@@ -1,9 +0,0 @@
-const { canAccessResource } = require('./canAccessResource');
-const { canAccessAgentResource } = require('./canAccessAgentResource');
-const { canAccessAgentFromBody } = require('./canAccessAgentFromBody');
-
-module.exports = {
-  canAccessResource,
-  canAccessAgentResource,
-  canAccessAgentFromBody,
-};
--- a/api/server/middleware/checkPeoplePickerAccess.js
+++ b/api/server/middleware/checkPeoplePickerAccess.js
@@ -1,72 +0,0 @@
-const { PermissionTypes, Permissions } = require('librechat-data-provider');
-const { getRoleByName } = require('~/models/Role');
-const { logger } = require('~/config');
-
-/**
- * Middleware to check if user has permission to access people picker functionality
- * Checks specific permission based on the 'type' query parameter:
- * - type=user: requires VIEW_USERS permission
- * - type=group: requires VIEW_GROUPS permission
- * - no type (mixed search): requires either VIEW_USERS OR VIEW_GROUPS
- */
-const checkPeoplePickerAccess = async (req, res, next) => {
-  try {
-    const user = req.user;
-    if (!user || !user.role) {
-      return res.status(401).json({
-        error: 'Unauthorized',
-        message: 'Authentication required',
-      });
-    }
-
-    const role = await getRoleByName(user.role);
-    if (!role || !role.permissions) {
-      return res.status(403).json({
-        error: 'Forbidden',
-        message: 'No permissions configured for user role',
-      });
-    }
-
-    const { type } = req.query;
-    const peoplePickerPerms = role.permissions[PermissionTypes.PEOPLE_PICKER] || {};
-    const canViewUsers = peoplePickerPerms[Permissions.VIEW_USERS] === true;
-    const canViewGroups = peoplePickerPerms[Permissions.VIEW_GROUPS] === true;
-
-    if (type === 'user') {
-      if (!canViewUsers) {
-        return res.status(403).json({
-          error: 'Forbidden',
-          message: 'Insufficient permissions to search for users',
-        });
-      }
-    } else if (type === 'group') {
-      if (!canViewGroups) {
-        return res.status(403).json({
-          error: 'Forbidden',
-          message: 'Insufficient permissions to search for groups',
-        });
-      }
-    } else {
-      if (!canViewUsers || !canViewGroups) {
-        return res.status(403).json({
-          error: 'Forbidden',
-          message: 'Insufficient permissions to search for both users and groups',
-        });
-      }
-    }
-    next();
-  } catch (error) {
-    logger.error(
-      `[checkPeoplePickerAccess][${req.user?.id}] checkPeoplePickerAccess error for req.query.type = ${req.query.type}`,
-      error,
-    );
-    return res.status(500).json({
-      error: 'Internal Server Error',
-      message: 'Failed to check permissions',
-    });
-  }
-};
-
-module.exports = {
-  checkPeoplePickerAccess,
-};
--- a/api/server/middleware/index.js
+++ b/api/server/middleware/index.js
@@ -8,7 +8,6 @@ const concurrentLimiter = require('./concurrentLimiter');
 const validateEndpoint = require('./validateEndpoint');
 const requireLocalAuth = require('./requireLocalAuth');
 const canDeleteAccount = require('./canDeleteAccount');
-const accessResources = require('./accessResources');
 const setBalanceConfig = require('./setBalanceConfig');
 const requireLdapAuth = require('./requireLdapAuth');
 const abortMiddleware = require('./abortMiddleware');
@@ -30,7 +29,6 @@ module.exports = {
  ...validate,
  ...limiters,
  ...roles,
-  ...accessResources,
  noIndex,
  checkBan,
  uaParser,
--- a/api/server/middleware/roles/access.spec.js
+++ b/api/server/middleware/roles/access.spec.js
@@ -1,370 +0,0 @@
-const mongoose = require('mongoose');
-const { MongoMemoryServer } = require('mongodb-memory-server');
-const { checkAccess, generateCheckAccess } = require('@librechat/api');
-const { PermissionTypes, Permissions } = require('librechat-data-provider');
-const { getRoleByName } = require('~/models/Role');
-const { Role } = require('~/db/models');
-
-// Mock the logger from @librechat/data-schemas
-jest.mock('@librechat/data-schemas', () => ({
-  ...jest.requireActual('@librechat/data-schemas'),
-  logger: {
-    warn: jest.fn(),
-    error: jest.fn(),
-    info: jest.fn(),
-    debug: jest.fn(),
-  },
-}));
-
-// Mock the cache to use a simple in-memory implementation
-const mockCache = new Map();
-jest.mock('~/cache/getLogStores', () => {
-  return jest.fn(() => ({
-    get: jest.fn(async (key) => mockCache.get(key)),
-    set: jest.fn(async (key, value) => mockCache.set(key, value)),
-    clear: jest.fn(async () => mockCache.clear()),
-  }));
-});
-
-describe('Access Middleware', () => {
-  let mongoServer;
-  let req, res, next;
-
-  beforeAll(async () => {
-    mongoServer = await MongoMemoryServer.create();
-    const mongoUri = mongoServer.getUri();
-    await mongoose.connect(mongoUri);
-  });
-
-  afterAll(async () => {
-    await mongoose.disconnect();
-    await mongoServer.stop();
-  });
-
-  beforeEach(async () => {
-    await mongoose.connection.dropDatabase();
-    mockCache.clear(); // Clear the cache between tests
-
-    // Create test roles
-    await Role.create({
-      name: 'user',
-      permissions: {
-        [PermissionTypes.BOOKMARKS]: { [Permissions.USE]: true },
-        [PermissionTypes.PROMPTS]: {
-          [Permissions.SHARED_GLOBAL]: false,
-          [Permissions.USE]: true,
-          [Permissions.CREATE]: true,
-        },
-        [PermissionTypes.MEMORIES]: {
-          [Permissions.USE]: true,
-          [Permissions.CREATE]: true,
-          [Permissions.UPDATE]: true,
-          [Permissions.READ]: true,
-          [Permissions.OPT_OUT]: true,
-        },
-        [PermissionTypes.AGENTS]: {
-          [Permissions.USE]: true,
-          [Permissions.CREATE]: false,
-          [Permissions.SHARED_GLOBAL]: false,
-        },
-        [PermissionTypes.MULTI_CONVO]: { [Permissions.USE]: true },
-        [PermissionTypes.TEMPORARY_CHAT]: { [Permissions.USE]: true },
-        [PermissionTypes.RUN_CODE]: { [Permissions.USE]: true },
-        [PermissionTypes.WEB_SEARCH]: { [Permissions.USE]: true },
-      },
-    });
-
-    await Role.create({
-      name: 'admin',
-      permissions: {
-        [PermissionTypes.BOOKMARKS]: { [Permissions.USE]: true },
-        [PermissionTypes.PROMPTS]: {
-          [Permissions.SHARED_GLOBAL]: true,
-          [Permissions.USE]: true,
-          [Permissions.CREATE]: true,
-        },
-        [PermissionTypes.MEMORIES]: {
-          [Permissions.USE]: true,
-          [Permissions.CREATE]: true,
-          [Permissions.UPDATE]: true,
-          [Permissions.READ]: true,
-          [Permissions.OPT_OUT]: true,
-        },
-        [PermissionTypes.AGENTS]: {
-          [Permissions.USE]: true,
-          [Permissions.CREATE]: true,
-          [Permissions.SHARED_GLOBAL]: true,
-        },
-        [PermissionTypes.MULTI_CONVO]: { [Permissions.USE]: true },
-        [PermissionTypes.TEMPORARY_CHAT]: { [Permissions.USE]: true },
-        [PermissionTypes.RUN_CODE]: { [Permissions.USE]: true },
-        [PermissionTypes.WEB_SEARCH]: { [Permissions.USE]: true },
-      },
-    });
-
-    // Create limited role with no AGENTS permissions
-    await Role.create({
-      name: 'limited',
-      permissions: {
-        // Explicitly set AGENTS permissions to false
-        [PermissionTypes.AGENTS]: {
-          [Permissions.USE]: false,
-          [Permissions.CREATE]: false,
-          [Permissions.SHARED_GLOBAL]: false,
-        },
-        // Has permissions for other types
-        [PermissionTypes.PROMPTS]: {
-          [Permissions.USE]: true,
-        },
-      },
-    });
-
-    req = {
-      user: { id: 'user123', role: 'user' },
-      body: {},
-      originalUrl: '/test',
-    };
-    res = {
-      status: jest.fn().mockReturnThis(),
-      json: jest.fn(),
-    };
-    next = jest.fn();
-    jest.clearAllMocks();
-  });
-
-  describe('checkAccess', () => {
-    test('should return false if user is not provided', async () => {
-      const result = await checkAccess({
-        user: null,
-        permissionType: PermissionTypes.AGENTS,
-        permissions: [Permissions.USE],
-        getRoleByName,
-      });
-      expect(result).toBe(false);
-    });
-
-    test('should return true if user has required permission', async () => {
-      const result = await checkAccess({
-        req: {},
-        user: { id: 'user123', role: 'user' },
-        permissionType: PermissionTypes.AGENTS,
-        permissions: [Permissions.USE],
-        getRoleByName,
-      });
-      expect(result).toBe(true);
-    });
-
-    test('should return false if user lacks required permission', async () => {
-      const result = await checkAccess({
-        req: {},
-        user: { id: 'user123', role: 'user' },
-        permissionType: PermissionTypes.AGENTS,
-        permissions: [Permissions.CREATE],
-        getRoleByName,
-      });
-      expect(result).toBe(false);
-    });
-
-    test('should return false if user has only some of multiple permissions', async () => {
-      // User has USE but not CREATE, so should fail when checking for both
-      const result = await checkAccess({
-        req: {},
-        user: { id: 'user123', role: 'user' },
-        permissionType: PermissionTypes.AGENTS,
-        permissions: [Permissions.CREATE, Permissions.USE],
-        getRoleByName,
-      });
-      expect(result).toBe(false);
-    });
-
-    test('should return true if user has all of multiple permissions', async () => {
-      // Admin has both USE and CREATE
-      const result = await checkAccess({
-        req: {},
-        user: { id: 'admin123', role: 'admin' },
-        permissionType: PermissionTypes.AGENTS,
-        permissions: [Permissions.CREATE, Permissions.USE],
-        getRoleByName,
-      });
-      expect(result).toBe(true);
-    });
-
-    test('should check body properties when permission is not directly granted', async () => {
-      const req = { body: { id: 'agent123' } };
-      const result = await checkAccess({
-        req,
-        user: { id: 'user123', role: 'user' },
-        permissionType: PermissionTypes.AGENTS,
-        permissions: [Permissions.UPDATE],
-        bodyProps: {
-          [Permissions.UPDATE]: ['id'],
-        },
-        checkObject: req.body,
-        getRoleByName,
-      });
-      expect(result).toBe(true);
-    });
-
-    test('should return false if role is not found', async () => {
-      const result = await checkAccess({
-        req: {},
-        user: { id: 'user123', role: 'nonexistent' },
-        permissionType: PermissionTypes.AGENTS,
-        permissions: [Permissions.USE],
-        getRoleByName,
-      });
-      expect(result).toBe(false);
-    });
-
-    test('should return false if role has no permissions for the requested type', async () => {
-      const result = await checkAccess({
-        req: {},
-        user: { id: 'user123', role: 'limited' },
-        permissionType: PermissionTypes.AGENTS,
-        permissions: [Permissions.USE],
-        getRoleByName,
-      });
-      expect(result).toBe(false);
-    });
-
-    test('should handle admin role with all permissions', async () => {
-      const createResult = await checkAccess({
-        req: {},
-        user: { id: 'admin123', role: 'admin' },
-        permissionType: PermissionTypes.AGENTS,
-        permissions: [Permissions.CREATE],
-        getRoleByName,
-      });
-      expect(createResult).toBe(true);
-
-      const shareResult = await checkAccess({
-        req: {},
-        user: { id: 'admin123', role: 'admin' },
-        permissionType: PermissionTypes.AGENTS,
-        permissions: [Permissions.SHARED_GLOBAL],
-        getRoleByName,
-      });
-      expect(shareResult).toBe(true);
-    });
-  });
-
-  describe('generateCheckAccess', () => {
-    test('should call next() when user has required permission', async () => {
-      const middleware = generateCheckAccess({
-        permissionType: PermissionTypes.AGENTS,
-        permissions: [Permissions.USE],
-        getRoleByName,
-      });
-      await middleware(req, res, next);
-
-      expect(next).toHaveBeenCalled();
-      expect(res.status).not.toHaveBeenCalled();
-    });
-
-    test('should return 403 when user lacks permission', async () => {
-      const middleware = generateCheckAccess({
-        permissionType: PermissionTypes.AGENTS,
-        permissions: [Permissions.CREATE],
-        getRoleByName,
-      });
-      await middleware(req, res, next);
-
-      expect(next).not.toHaveBeenCalled();
-      expect(res.status).toHaveBeenCalledWith(403);
-      expect(res.json).toHaveBeenCalledWith({ message: 'Forbidden: Insufficient permissions' });
-    });
-
-    test('should check body properties when configured', async () => {
-      req.body = { agentId: 'agent123', description: 'test' };
-
-      const bodyProps = {
-        [Permissions.CREATE]: ['agentId'],
-      };
-
-      const middleware = generateCheckAccess({
-        permissionType: PermissionTypes.AGENTS,
-        permissions: [Permissions.CREATE],
-        bodyProps,
-        getRoleByName,
-      });
-      await middleware(req, res, next);
-
-      expect(next).toHaveBeenCalled();
-      expect(res.status).not.toHaveBeenCalled();
-    });
-
-    test('should handle database errors gracefully', async () => {
-      // Mock getRoleByName to throw an error
-      const mockGetRoleByName = jest
-        .fn()
-        .mockRejectedValue(new Error('Database connection failed'));
-
-      const middleware = generateCheckAccess({
-        permissionType: PermissionTypes.AGENTS,
-        permissions: [Permissions.USE],
-        getRoleByName: mockGetRoleByName,
-      });
-      await middleware(req, res, next);
-
-      expect(next).not.toHaveBeenCalled();
-      expect(res.status).toHaveBeenCalledWith(500);
-      expect(res.json).toHaveBeenCalledWith({
-        message: expect.stringContaining('Server error:'),
-      });
-    });
-
-    test('should work with multiple permission types', async () => {
-      req.user.role = 'admin';
-
-      const middleware = generateCheckAccess({
-        permissionType: PermissionTypes.AGENTS,
-        permissions: [Permissions.USE, Permissions.CREATE, Permissions.SHARED_GLOBAL],
-        getRoleByName,
-      });
-      await middleware(req, res, next);
-
-      expect(next).toHaveBeenCalled();
-    });
-
-    test('should handle missing user gracefully', async () => {
-      req.user = null;
-
-      const middleware = generateCheckAccess({
-        permissionType: PermissionTypes.AGENTS,
-        permissions: [Permissions.USE],
-        getRoleByName,
-      });
-      await middleware(req, res, next);
-
-      expect(next).not.toHaveBeenCalled();
-      expect(res.status).toHaveBeenCalledWith(403);
-      expect(res.json).toHaveBeenCalledWith({ message: 'Forbidden: Insufficient permissions' });
-    });
-
-    test('should handle role with no AGENTS permissions', async () => {
-      await Role.create({
-        name: 'noaccess',
-        permissions: {
-          // Explicitly set AGENTS with all permissions false
-          [PermissionTypes.AGENTS]: {
-            [Permissions.USE]: false,
-            [Permissions.CREATE]: false,
-            [Permissions.SHARED_GLOBAL]: false,
-          },
-        },
-      });
-      req.user.role = 'noaccess';
-
-      const middleware = generateCheckAccess({
-        permissionType: PermissionTypes.AGENTS,
-        permissions: [Permissions.USE],
-        getRoleByName,
-      });
-      await middleware(req, res, next);
-
-      expect(next).not.toHaveBeenCalled();
-      expect(res.status).toHaveBeenCalledWith(403);
-      expect(res.json).toHaveBeenCalledWith({ message: 'Forbidden: Insufficient permissions' });
-    });
-  });
-});
--- a/api/server/routes/accessPermissions.js
+++ b/api/server/routes/accessPermissions.js
@@ -1,63 +0,0 @@
-const express = require('express');
-const { PermissionBits } = require('@librechat/data-schemas');
-const {
-  getUserEffectivePermissions,
-  updateResourcePermissions,
-  getResourcePermissions,
-  getResourceRoles,
-  searchPrincipals,
-} = require('~/server/controllers/PermissionsController');
-const { requireJwtAuth, checkBan, uaParser, canAccessResource } = require('~/server/middleware');
-const { checkPeoplePickerAccess } = require('~/server/middleware/checkPeoplePickerAccess');
-
-const router = express.Router();
-
-// Apply common middleware
-router.use(requireJwtAuth);
-router.use(checkBan);
-router.use(uaParser);
-
-/**
- * Generic routes for resource permissions
- * Pattern: /api/permissions/{resourceType}/{resourceId}
- */
-
-/**
- * GET /api/permissions/search-principals
- * Search for users and groups to grant permissions
- */
-router.get('/search-principals', checkPeoplePickerAccess, searchPrincipals);
-
-/**
- * GET /api/permissions/{resourceType}/roles
- * Get available roles for a resource type
- */
-router.get('/:resourceType/roles', getResourceRoles);
-
-/**
- * GET /api/permissions/{resourceType}/{resourceId}
- * Get all permissions for a specific resource
- */
-router.get('/:resourceType/:resourceId', getResourcePermissions);
-
-/**
- * PUT /api/permissions/{resourceType}/{resourceId}
- * Bulk update permissions for a specific resource
- */
-router.put(
-  '/:resourceType/:resourceId',
-  canAccessResource({
-    resourceType: 'agent',
-    requiredPermission: PermissionBits.SHARE,
-    resourceIdParam: 'resourceId',
-  }),
-  updateResourcePermissions,
-);
-
-/**
- * GET /api/permissions/{resourceType}/{resourceId}/effective
- * Get user's effective permissions for a specific resource
- */
-router.get('/:resourceType/:resourceId/effective', getUserEffectivePermissions);
-
-module.exports = router;
--- a/api/server/routes/agents/actions.js
+++ b/api/server/routes/agents/actions.js
@@ -1,21 +1,19 @@
 const express = require('express');
 const { nanoid } = require('nanoid');
+const { logger } = require('@librechat/data-schemas');
 const { generateCheckAccess } = require('@librechat/api');
-const { logger, PermissionBits } = require('@librechat/data-schemas');
 const {
+  SystemRoles,
  Permissions,
  PermissionTypes,
  actionDelimiter,
  removeNullishValues,
 } = require('librechat-data-provider');
 const { encryptMetadata, domainParser } = require('~/server/services/ActionService');
-const { findAccessibleResources } = require('~/server/services/PermissionService');
 const { updateAction, getActions, deleteAction } = require('~/models/Action');
 const { isActionDomainAllowed } = require('~/server/services/domains');
-const { canAccessAgentResource } = require('~/server/middleware');
 const { getAgent, updateAgent } = require('~/models/Agent');
 const { getRoleByName } = require('~/models/Role');
-const { getListAgentsByAccess } = require('~/models/Agent');

 const router = express.Router();

@@ -25,6 +23,12 @@ const checkAgentCreate = generateCheckAccess({
  getRoleByName,
 });

+// If the user has ADMIN role
+// then action edition is possible even if not owner of the assistant
+const isAdmin = (req) => {
+  return req.user.role === SystemRoles.ADMIN;
+};
+
 /**
 * Retrieves all user's actions
 * @route GET /actions/
@@ -33,22 +37,10 @@ const checkAgentCreate = generateCheckAccess({
 */
 router.get('/', async (req, res) => {
  try {
-    const userId = req.user.id;
-    const editableAgentObjectIds = await findAccessibleResources({
-      userId,
-      resourceType: 'agent',
-      requiredPermissions: PermissionBits.EDIT,
-    });
-
-    const agentsResponse = await getListAgentsByAccess({
-      accessibleIds: editableAgentObjectIds,
-    });
-
-    const editableAgentIds = agentsResponse.data.map((agent) => agent.id);
-    const actions =
-      editableAgentIds.length > 0 ? await getActions({ agent_id: { $in: editableAgentIds } }) : [];
-
-    res.json(actions);
+    const admin = isAdmin(req);
+    // If admin, get all actions, otherwise only user's actions
+    const searchParams = admin ? {} : { user: req.user.id };
+    res.json(await getActions(searchParams));
  } catch (error) {
    res.status(500).json({ error: error.message });
  }
@@ -63,111 +55,106 @@ router.get('/', async (req, res) => {
 * @param {ActionMetadata} req.body.metadata - Metadata for the action.
 * @returns {Object} 200 - success response - application/json
 */
-router.post(
-  '/:agent_id',
-  canAccessAgentResource({
-    requiredPermission: PermissionBits.EDIT,
-    resourceIdParam: 'agent_id',
-  }),
-  checkAgentCreate,
-  async (req, res) => {
-    try {
-      const { agent_id } = req.params;
+router.post('/:agent_id', checkAgentCreate, async (req, res) => {
+  try {
+    const { agent_id } = req.params;

-      /** @type {{ functions: FunctionTool[], action_id: string, metadata: ActionMetadata }} */
-      const { functions, action_id: _action_id, metadata: _metadata } = req.body;
-      if (!functions.length) {
-        return res.status(400).json({ message: 'No functions provided' });
-      }
-
-      let metadata = await encryptMetadata(removeNullishValues(_metadata, true));
-      const isDomainAllowed = await isActionDomainAllowed(metadata.domain);
-      if (!isDomainAllowed) {
-        return res.status(400).json({ message: 'Domain not allowed' });
-      }
-
-      let { domain } = metadata;
-      domain = await domainParser(domain, true);
-
-      if (!domain) {
-        return res.status(400).json({ message: 'No domain provided' });
-      }
-
-      const action_id = _action_id ?? nanoid();
-      const initialPromises = [];
-
-      // Permissions already validated by middleware - load agent directly
-      initialPromises.push(getAgent({ id: agent_id }));
-      if (_action_id) {
-        initialPromises.push(getActions({ action_id }, true));
-      }
-
-      /** @type {[Agent, [Action|undefined]]} */
-      const [agent, actions_result] = await Promise.all(initialPromises);
-      if (!agent) {
-        return res.status(404).json({ message: 'Agent not found for adding action' });
-      }
-
-      if (actions_result && actions_result.length) {
-        const action = actions_result[0];
-        metadata = { ...action.metadata, ...metadata };
-      }
-
-      const { actions: _actions = [], author: agent_author } = agent ?? {};
-      const actions = [];
-      for (const action of _actions) {
-        const [_action_domain, current_action_id] = action.split(actionDelimiter);
-        if (current_action_id === action_id) {
-          continue;
-        }
-
-        actions.push(action);
-      }
-
-      actions.push(`${domain}${actionDelimiter}${action_id}`);
-
-      /** @type {string[]}} */
-      const { tools: _tools = [] } = agent;
-
-      const tools = _tools
-        .filter((tool) => !(tool && (tool.includes(domain) || tool.includes(action_id))))
-        .concat(functions.map((tool) => `${tool.function.name}${actionDelimiter}${domain}`));
-
-      // Force version update since actions are changing
-      const updatedAgent = await updateAgent(
-        { id: agent_id },
-        { tools, actions },
-        {
-          updatingUserId: req.user.id,
-          forceVersion: true,
-        },
-      );
-
-      // Only update user field for new actions
-      const actionUpdateData = { metadata, agent_id };
-      if (!actions_result || !actions_result.length) {
-        // For new actions, use the agent owner's user ID
-        actionUpdateData.user = agent_author || req.user.id;
-      }
-
-      /** @type {[Action]} */
-      const updatedAction = await updateAction({ action_id }, actionUpdateData);
-
-      const sensitiveFields = ['api_key', 'oauth_client_id', 'oauth_client_secret'];
-      for (let field of sensitiveFields) {
-        if (updatedAction.metadata[field]) {
-          delete updatedAction.metadata[field];
-        }
-      }
-
-      res.json([updatedAgent, updatedAction]);
-    } catch (error) {
-      const message = 'Trouble updating the Agent Action';
-      logger.error(message, error);
-      res.status(500).json({ message });
+    /** @type {{ functions: FunctionTool[], action_id: string, metadata: ActionMetadata }} */
+    const { functions, action_id: _action_id, metadata: _metadata } = req.body;
+    if (!functions.length) {
+      return res.status(400).json({ message: 'No functions provided' });
    }
-  },
-);
+
+    let metadata = await encryptMetadata(removeNullishValues(_metadata, true));
+    const isDomainAllowed = await isActionDomainAllowed(metadata.domain);
+    if (!isDomainAllowed) {
+      return res.status(400).json({ message: 'Domain not allowed' });
+    }
+
+    let { domain } = metadata;
+    domain = await domainParser(domain, true);
+
+    if (!domain) {
+      return res.status(400).json({ message: 'No domain provided' });
+    }
+
+    const action_id = _action_id ?? nanoid();
+    const initialPromises = [];
+    const admin = isAdmin(req);
+
+    // If admin, can edit any agent, otherwise only user's agents
+    const agentQuery = admin ? { id: agent_id } : { id: agent_id, author: req.user.id };
+    // TODO: share agents
+    initialPromises.push(getAgent(agentQuery));
+    if (_action_id) {
+      initialPromises.push(getActions({ action_id }, true));
+    }
+
+    /** @type {[Agent, [Action|undefined]]} */
+    const [agent, actions_result] = await Promise.all(initialPromises);
+    if (!agent) {
+      return res.status(404).json({ message: 'Agent not found for adding action' });
+    }
+
+    if (actions_result && actions_result.length) {
+      const action = actions_result[0];
+      metadata = { ...action.metadata, ...metadata };
+    }
+
+    const { actions: _actions = [], author: agent_author } = agent ?? {};
+    const actions = [];
+    for (const action of _actions) {
+      const [_action_domain, current_action_id] = action.split(actionDelimiter);
+      if (current_action_id === action_id) {
+        continue;
+      }
+
+      actions.push(action);
+    }
+
+    actions.push(`${domain}${actionDelimiter}${action_id}`);
+
+    /** @type {string[]}} */
+    const { tools: _tools = [] } = agent;
+
+    const tools = _tools
+      .filter((tool) => !(tool && (tool.includes(domain) || tool.includes(action_id))))
+      .concat(functions.map((tool) => `${tool.function.name}${actionDelimiter}${domain}`));
+
+    // Force version update since actions are changing
+    const updatedAgent = await updateAgent(
+      agentQuery,
+      { tools, actions },
+      {
+        updatingUserId: req.user.id,
+        forceVersion: true,
+      },
+    );
+
+    // Only update user field for new actions
+    const actionUpdateData = { metadata, agent_id };
+    if (!actions_result || !actions_result.length) {
+      // For new actions, use the agent owner's user ID
+      actionUpdateData.user = agent_author || req.user.id;
+    }
+
+    /** @type {[Action]} */
+    const updatedAction = await updateAction({ action_id }, actionUpdateData);
+
+    const sensitiveFields = ['api_key', 'oauth_client_id', 'oauth_client_secret'];
+    for (let field of sensitiveFields) {
+      if (updatedAction.metadata[field]) {
+        delete updatedAction.metadata[field];
+      }
+    }
+
+    res.json([updatedAgent, updatedAction]);
+  } catch (error) {
+    const message = 'Trouble updating the Agent Action';
+    logger.error(message, error);
+    res.status(500).json({ message });
+  }
+});

 /**
 * Deletes an action for a specific agent.
@@ -176,56 +163,52 @@ router.post(
 * @param {string} req.params.action_id - The ID of the action to delete.
 * @returns {Object} 200 - success response - application/json
 */
-router.delete(
-  '/:agent_id/:action_id',
-  canAccessAgentResource({
-    requiredPermission: PermissionBits.EDIT,
-    resourceIdParam: 'agent_id',
-  }),
-  checkAgentCreate,
-  async (req, res) => {
-    try {
-      const { agent_id, action_id } = req.params;
+router.delete('/:agent_id/:action_id', checkAgentCreate, async (req, res) => {
+  try {
+    const { agent_id, action_id } = req.params;
+    const admin = isAdmin(req);

-      // Permissions already validated by middleware - load agent directly
-      const agent = await getAgent({ id: agent_id });
-      if (!agent) {
-        return res.status(404).json({ message: 'Agent not found for deleting action' });
-      }
-
-      const { tools = [], actions = [] } = agent;
-
-      let domain = '';
-      const updatedActions = actions.filter((action) => {
-        if (action.includes(action_id)) {
-          [domain] = action.split(actionDelimiter);
-          return false;
-        }
-        return true;
-      });
-
-      domain = await domainParser(domain, true);
-
-      if (!domain) {
-        return res.status(400).json({ message: 'No domain provided' });
-      }
-
-      const updatedTools = tools.filter((tool) => !(tool && tool.includes(domain)));
-
-      // Force version update since actions are being removed
-      await updateAgent(
-        { id: agent_id },
-        { tools: updatedTools, actions: updatedActions },
-        { updatingUserId: req.user.id, forceVersion: true },
-      );
-      await deleteAction({ action_id });
-      res.status(200).json({ message: 'Action deleted successfully' });
-    } catch (error) {
-      const message = 'Trouble deleting the Agent Action';
-      logger.error(message, error);
-      res.status(500).json({ message });
+    // If admin, can delete any agent, otherwise only user's agents
+    const agentQuery = admin ? { id: agent_id } : { id: agent_id, author: req.user.id };
+    const agent = await getAgent(agentQuery);
+    if (!agent) {
+      return res.status(404).json({ message: 'Agent not found for deleting action' });
    }
-  },
-);
+
+    const { tools = [], actions = [] } = agent;
+
+    let domain = '';
+    const updatedActions = actions.filter((action) => {
+      if (action.includes(action_id)) {
+        [domain] = action.split(actionDelimiter);
+        return false;
+      }
+      return true;
+    });
+
+    domain = await domainParser(domain, true);
+
+    if (!domain) {
+      return res.status(400).json({ message: 'No domain provided' });
+    }
+
+    const updatedTools = tools.filter((tool) => !(tool && tool.includes(domain)));
+
+    // Force version update since actions are being removed
+    await updateAgent(
+      agentQuery,
+      { tools: updatedTools, actions: updatedActions },
+      { updatingUserId: req.user.id, forceVersion: true },
+    );
+    // If admin, can delete any action, otherwise only user's actions
+    const actionQuery = admin ? { action_id } : { action_id, user: req.user.id };
+    await deleteAction(actionQuery);
+    res.status(200).json({ message: 'Action deleted successfully' });
+  } catch (error) {
+    const message = 'Trouble deleting the Agent Action';
+    logger.error(message, error);
+    res.status(500).json({ message });
+  }
+});

 module.exports = router;
--- a/api/server/routes/agents/chat.js
+++ b/api/server/routes/agents/chat.js
@@ -1,5 +1,4 @@
 const express = require('express');
-const { PermissionBits } = require('@librechat/data-schemas');
 const { generateCheckAccess, skipAgentCheck } = require('@librechat/api');
 const { PermissionTypes, Permissions } = require('librechat-data-provider');
 const {
@@ -8,7 +7,6 @@ const {
  // validateModel,
  validateConvoAccess,
  buildEndpointOption,
-  canAccessAgentFromBody,
 } = require('~/server/middleware');
 const { initializeClient } = require('~/server/services/Endpoints/agents');
 const AgentController = require('~/server/controllers/agents/request');
@@ -25,12 +23,8 @@ const checkAgentAccess = generateCheckAccess({
  skipCheck: skipAgentCheck,
  getRoleByName,
 });
-const checkAgentResourceAccess = canAccessAgentFromBody({
-  requiredPermission: PermissionBits.VIEW,
-});

 router.use(checkAgentAccess);
-router.use(checkAgentResourceAccess);
 router.use(validateConvoAccess);
 router.use(buildEndpointOption);
 router.use(setHeaders);
--- a/api/server/routes/agents/index.js
+++ b/api/server/routes/agents/index.js
@@ -37,6 +37,4 @@ if (isEnabled(LIMIT_MESSAGE_USER)) {
 chatRouter.use('/', chat);
 router.use('/chat', chatRouter);

-// Add marketplace routes
-
 module.exports = router;
--- a/api/server/routes/agents/v1.js
+++ b/api/server/routes/agents/v1.js
@@ -1,8 +1,7 @@
 const express = require('express');
 const { generateCheckAccess } = require('@librechat/api');
-const { PermissionBits } = require('@librechat/data-schemas');
 const { PermissionTypes, Permissions } = require('librechat-data-provider');
-const { requireJwtAuth, canAccessAgentResource } = require('~/server/middleware');
+const { requireJwtAuth } = require('~/server/middleware');
 const v1 = require('~/server/controllers/agents/v1');
 const { getRoleByName } = require('~/models/Role');
 const actions = require('./actions');
@@ -45,11 +44,6 @@ router.use('/actions', actions);
 */
 router.use('/tools', tools);

-/**
- * Get all agent categories with counts
- * @route GET /agents/marketplace/categories
- */
-router.get('/categories', v1.getAgentCategories);
 /**
 * Creates an agent.
 * @route POST /agents
@@ -59,38 +53,13 @@ router.get('/categories', v1.getAgentCategories);
 router.post('/', checkAgentCreate, v1.createAgent);

 /**
- * Retrieves basic agent information (VIEW permission required).
- * Returns safe, non-sensitive agent data for viewing purposes.
+ * Retrieves an agent.
 * @route GET /agents/:id
 * @param {string} req.params.id - Agent identifier.
- * @returns {Agent} 200 - Basic agent info - application/json
+ * @returns {Agent} 200 - Success response - application/json
 */
-router.get(
-  '/:id',
-  checkAgentAccess,
-  canAccessAgentResource({
-    requiredPermission: PermissionBits.VIEW,
-    resourceIdParam: 'id',
-  }),
-  v1.getAgent,
-);
+router.get('/:id', checkAgentAccess, v1.getAgent);

-/**
- * Retrieves full agent details including sensitive configuration (EDIT permission required).
- * Returns complete agent data for editing/configuration purposes.
- * @route GET /agents/:id/expanded
- * @param {string} req.params.id - Agent identifier.
- * @returns {Agent} 200 - Full agent details - application/json
- */
-router.get(
-  '/:id/expanded',
-  checkAgentAccess,
-  canAccessAgentResource({
-    requiredPermission: PermissionBits.EDIT,
-    resourceIdParam: 'id',
-  }),
-  (req, res) => v1.getAgent(req, res, true), // Expanded version
-);
 /**
 * Updates an agent.
 * @route PATCH /agents/:id
@@ -98,15 +67,7 @@ router.get(
 * @param {AgentUpdateParams} req.body - The agent update parameters.
 * @returns {Agent} 200 - Success response - application/json
 */
-router.patch(
-  '/:id',
-  checkGlobalAgentShare,
-  canAccessAgentResource({
-    requiredPermission: PermissionBits.EDIT,
-    resourceIdParam: 'id',
-  }),
-  v1.updateAgent,
-);
+router.patch('/:id', checkGlobalAgentShare, v1.updateAgent);

 /**
 * Duplicates an agent.
@@ -114,15 +75,7 @@ router.patch(
 * @param {string} req.params.id - Agent identifier.
 * @returns {Agent} 201 - Success response - application/json
 */
-router.post(
-  '/:id/duplicate',
-  checkAgentCreate,
-  canAccessAgentResource({
-    requiredPermission: PermissionBits.VIEW,
-    resourceIdParam: 'id',
-  }),
-  v1.duplicateAgent,
-);
+router.post('/:id/duplicate', checkAgentCreate, v1.duplicateAgent);

 /**
 * Deletes an agent.
@@ -130,15 +83,7 @@ router.post(
 * @param {string} req.params.id - Agent identifier.
 * @returns {Agent} 200 - success response - application/json
 */
-router.delete(
-  '/:id',
-  checkAgentCreate,
-  canAccessAgentResource({
-    requiredPermission: PermissionBits.DELETE,
-    resourceIdParam: 'id',
-  }),
-  v1.deleteAgent,
-);
+router.delete('/:id', checkAgentCreate, v1.deleteAgent);

 /**
 * Reverts an agent to a previous version.
@@ -165,14 +110,6 @@ router.get('/', checkAgentAccess, v1.getListAgents);
 * @param {string} [req.body.metadata] - Optional metadata for the agent's avatar.
 * @returns {Object} 200 - success response - application/json
 */
-avatar.post(
-  '/:agent_id/avatar/',
-  checkAgentAccess,
-  canAccessAgentResource({
-    requiredPermission: PermissionBits.EDIT,
-    resourceIdParam: 'agent_id',
-  }),
-  v1.uploadAgentAvatar,
-);
+avatar.post('/:agent_id/avatar/', checkAgentAccess, v1.uploadAgentAvatar);

 module.exports = { v1: router, avatar };
--- a/api/server/routes/config.js
+++ b/api/server/routes/config.js
@@ -106,6 +106,7 @@ router.get('/', async function (req, res) {
        const serverConfig = config.mcpServers[serverName];
        payload.mcpServers[serverName] = {
          customUserVars: serverConfig?.customUserVars || {},
+          chatMenu: serverConfig?.chatMenu,
        };
      }
    }
--- a/api/server/routes/files/files.agents.test.js
+++ b/api/server/routes/files/files.agents.test.js
@@ -3,11 +3,9 @@ const request = require('supertest');
 const mongoose = require('mongoose');
 const { v4: uuidv4 } = require('uuid');
 const { MongoMemoryServer } = require('mongodb-memory-server');
-const { createMethods } = require('@librechat/data-schemas');
-const { createAgent } = require('~/models/Agent');
-const { createFile } = require('~/models/File');
+const { GLOBAL_PROJECT_NAME } = require('librechat-data-provider').Constants;

-// Only mock the external dependencies that we don't want to test
+// Mock dependencies
 jest.mock('~/server/services/Files/process', () => ({
  processDeleteRequest: jest.fn().mockResolvedValue({}),
  filterFile: jest.fn(),
@@ -27,8 +25,31 @@ jest.mock('~/server/services/Tools/credentials', () => ({
  loadAuthValues: jest.fn(),
 }));

-// Import the router
-const router = require('~/server/routes/files/files');
+jest.mock('~/server/services/Files/S3/crud', () => ({
+  refreshS3FileUrls: jest.fn(),
+}));
+
+jest.mock('~/cache', () => ({
+  getLogStores: jest.fn(() => ({
+    get: jest.fn(),
+    set: jest.fn(),
+  })),
+}));
+
+jest.mock('~/config', () => ({
+  logger: {
+    error: jest.fn(),
+    warn: jest.fn(),
+    debug: jest.fn(),
+  },
+}));
+
+const { createFile } = require('~/models/File');
+const { createAgent } = require('~/models/Agent');
+const { getProjectByName } = require('~/models/Project');
+
+// Import the router after mocks
+const router = require('./files');

 describe('File Routes - Agent Files Endpoint', () => {
  let app;
@@ -39,42 +60,13 @@ describe('File Routes - Agent Files Endpoint', () => {
  let fileId1;
  let fileId2;
  let fileId3;
-  let File;
-  let User;
-  let Agent;
-  let methods;
-  let AclEntry;
-  // eslint-disable-next-line no-unused-vars
-  let AccessRole;
-  let modelsToCleanup = [];

  beforeAll(async () => {
    mongoServer = await MongoMemoryServer.create();
-    const mongoUri = mongoServer.getUri();
-    await mongoose.connect(mongoUri);
+    await mongoose.connect(mongoServer.getUri());

-    // Initialize all models using createModels
-    const { createModels } = require('@librechat/data-schemas');
-    const models = createModels(mongoose);
-
-    // Track which models we're adding
-    modelsToCleanup = Object.keys(models);
-
-    // Register models on mongoose.models so methods can access them
-    Object.assign(mongoose.models, models);
-
-    // Create methods with our test mongoose instance
-    methods = createMethods(mongoose);
-
-    // Now we can access models from the db/models
-    File = models.File;
-    Agent = models.Agent;
-    AclEntry = models.AclEntry;
-    User = models.User;
-    AccessRole = models.AccessRole;
-
-    // Seed default roles using our methods
-    await methods.seedDefaultRoles();
+    // Initialize models
+    require('~/db/models');

    app = express();
    app.use(express.json());
@@ -90,121 +82,88 @@ describe('File Routes - Agent Files Endpoint', () => {
  });

  afterAll(async () => {
-    // Clean up all collections before disconnecting
-    const collections = mongoose.connection.collections;
-    for (const key in collections) {
-      await collections[key].deleteMany({});
-    }
-
-    // Clear only the models we added
-    for (const modelName of modelsToCleanup) {
-      if (mongoose.models[modelName]) {
-        delete mongoose.models[modelName];
-      }
-    }
-
    await mongoose.disconnect();
    await mongoServer.stop();
  });

  beforeEach(async () => {
-    // Clean up all test data
-    await File.deleteMany({});
-    await Agent.deleteMany({});
-    await User.deleteMany({});
-    await AclEntry.deleteMany({});
-    // Don't delete AccessRole as they are seeded defaults needed for tests
+    jest.clearAllMocks();

-    // Create test users
-    authorId = new mongoose.Types.ObjectId();
-    otherUserId = new mongoose.Types.ObjectId();
+    // Clear database
+    const collections = mongoose.connection.collections;
+    for (const key in collections) {
+      await collections[key].deleteMany({});
+    }
+
+    authorId = new mongoose.Types.ObjectId().toString();
+    otherUserId = new mongoose.Types.ObjectId().toString();
    agentId = uuidv4();
    fileId1 = uuidv4();
    fileId2 = uuidv4();
    fileId3 = uuidv4();

-    // Create users in database
-    await User.create({
-      _id: authorId,
-      username: 'author',
-      email: 'author@test.com',
-    });
-
-    await User.create({
-      _id: otherUserId,
-      username: 'other',
-      email: 'other@test.com',
-    });
-
    // Create files
    await createFile({
      user: authorId,
      file_id: fileId1,
-      filename: 'file1.txt',
-      filepath: '/uploads/file1.txt',
-      bytes: 100,
+      filename: 'agent-file1.txt',
+      filepath: `/uploads/${authorId}/${fileId1}`,
+      bytes: 1024,
      type: 'text/plain',
    });

    await createFile({
      user: authorId,
      file_id: fileId2,
-      filename: 'file2.txt',
-      filepath: '/uploads/file2.txt',
-      bytes: 200,
+      filename: 'agent-file2.txt',
+      filepath: `/uploads/${authorId}/${fileId2}`,
+      bytes: 2048,
      type: 'text/plain',
    });

    await createFile({
      user: otherUserId,
      file_id: fileId3,
-      filename: 'file3.txt',
-      filepath: '/uploads/file3.txt',
-      bytes: 300,
+      filename: 'user-file.txt',
+      filepath: `/uploads/${otherUserId}/${fileId3}`,
+      bytes: 512,
      type: 'text/plain',
    });
+
+    // Create an agent with files attached
+    await createAgent({
+      id: agentId,
+      name: 'Test Agent',
+      author: authorId,
+      model: 'gpt-4',
+      provider: 'openai',
+      isCollaborative: true,
+      tool_resources: {
+        file_search: {
+          file_ids: [fileId1, fileId2],
+        },
+      },
+    });
+
+    // Share the agent globally
+    const globalProject = await getProjectByName(GLOBAL_PROJECT_NAME, '_id');
+    if (globalProject) {
+      const { updateAgent } = require('~/models/Agent');
+      await updateAgent({ id: agentId }, { projectIds: [globalProject._id] });
+    }
  });

  describe('GET /files/agent/:agent_id', () => {
-    it('should return files accessible through the agent for non-author with EDIT permission', async () => {
-      // Create an agent with files attached
-      const agent = await createAgent({
-        id: agentId,
-        name: 'Test Agent',
-        provider: 'openai',
-        model: 'gpt-4',
-        author: authorId,
-        tool_resources: {
-          file_search: {
-            file_ids: [fileId1, fileId2],
-          },
-        },
-      });
-
-      // Grant EDIT permission to user on the agent using PermissionService
-      const { grantPermission } = require('~/server/services/PermissionService');
-      await grantPermission({
-        principalType: 'user',
-        principalId: otherUserId,
-        resourceType: 'agent',
-        resourceId: agent._id,
-        accessRoleId: 'agent_editor',
-        grantedBy: authorId,
-      });
-
-      // Mock req.user for this request
-      app.use((req, res, next) => {
-        req.user = { id: otherUserId.toString() };
-        next();
-      });
-
+    it('should return files accessible through the agent for non-author', async () => {
      const response = await request(app).get(`/files/agent/${agentId}`);

      expect(response.status).toBe(200);
-      expect(Array.isArray(response.body)).toBe(true);
-      expect(response.body).toHaveLength(2);
-      expect(response.body.map((f) => f.file_id)).toContain(fileId1);
-      expect(response.body.map((f) => f.file_id)).toContain(fileId2);
+      expect(response.body).toHaveLength(2); // Only agent files, not user-owned files
+
+      const fileIds = response.body.map((f) => f.file_id);
+      expect(fileIds).toContain(fileId1);
+      expect(fileIds).toContain(fileId2);
+      expect(fileIds).not.toContain(fileId3); // User's own file not included
    });

    it('should return 400 when agent_id is not provided', async () => {
@@ -217,63 +176,45 @@ describe('File Routes - Agent Files Endpoint', () => {
      const response = await request(app).get('/files/agent/non-existent-agent');

      expect(response.status).toBe(200);
-      expect(Array.isArray(response.body)).toBe(true);
-      expect(response.body).toEqual([]);
+      expect(response.body).toEqual([]); // Empty array for non-existent agent
    });

-    it('should return empty array when user only has VIEW permission', async () => {
-      // Create an agent with files attached
-      const agent = await createAgent({
-        id: agentId,
-        name: 'Test Agent',
-        provider: 'openai',
-        model: 'gpt-4',
+    it('should return empty array when agent is not collaborative', async () => {
+      // Create a non-collaborative agent
+      const nonCollabAgentId = uuidv4();
+      await createAgent({
+        id: nonCollabAgentId,
+        name: 'Non-Collaborative Agent',
        author: authorId,
+        model: 'gpt-4',
+        provider: 'openai',
+        isCollaborative: false,
        tool_resources: {
          file_search: {
-            file_ids: [fileId1, fileId2],
+            file_ids: [fileId1],
          },
        },
      });

-      // Grant only VIEW permission to user on the agent
-      const { grantPermission } = require('~/server/services/PermissionService');
-      await grantPermission({
-        principalType: 'user',
-        principalId: otherUserId,
-        resourceType: 'agent',
-        resourceId: agent._id,
-        accessRoleId: 'agent_viewer',
-        grantedBy: authorId,
-      });
+      // Share it globally
+      const globalProject = await getProjectByName(GLOBAL_PROJECT_NAME, '_id');
+      if (globalProject) {
+        const { updateAgent } = require('~/models/Agent');
+        await updateAgent({ id: nonCollabAgentId }, { projectIds: [globalProject._id] });
+      }

-      const response = await request(app).get(`/files/agent/${agentId}`);
+      const response = await request(app).get(`/files/agent/${nonCollabAgentId}`);

      expect(response.status).toBe(200);
-      expect(Array.isArray(response.body)).toBe(true);
-      expect(response.body).toEqual([]);
+      expect(response.body).toEqual([]); // Empty array when not collaborative
    });

    it('should return agent files for agent author', async () => {
-      // Create an agent with files attached
-      await createAgent({
-        id: agentId,
-        name: 'Test Agent',
-        provider: 'openai',
-        model: 'gpt-4',
-        author: authorId,
-        tool_resources: {
-          file_search: {
-            file_ids: [fileId1, fileId2],
-          },
-        },
-      });
-
      // Create a new app instance with author authentication
      const authorApp = express();
      authorApp.use(express.json());
      authorApp.use((req, res, next) => {
-        req.user = { id: authorId.toString() };
+        req.user = { id: authorId };
        req.app = { locals: {} };
        next();
      });
@@ -282,48 +223,46 @@ describe('File Routes - Agent Files Endpoint', () => {
      const response = await request(authorApp).get(`/files/agent/${agentId}`);

      expect(response.status).toBe(200);
-      expect(Array.isArray(response.body)).toBe(true);
-      expect(response.body).toHaveLength(2);
+      expect(response.body).toHaveLength(2); // Agent files for author
+
+      const fileIds = response.body.map((f) => f.file_id);
+      expect(fileIds).toContain(fileId1);
+      expect(fileIds).toContain(fileId2);
+      expect(fileIds).not.toContain(fileId3); // User's own file not included
    });

    it('should return files uploaded by other users to shared agent for author', async () => {
-      const anotherUserId = new mongoose.Types.ObjectId();
+      // Create a file uploaded by another user
      const otherUserFileId = uuidv4();
-
-      await User.create({
-        _id: anotherUserId,
-        username: 'another',
-        email: 'another@test.com',
-      });
+      const anotherUserId = new mongoose.Types.ObjectId().toString();

      await createFile({
        user: anotherUserId,
        file_id: otherUserFileId,
        filename: 'other-user-file.txt',
-        filepath: '/uploads/other-user-file.txt',
-        bytes: 400,
+        filepath: `/uploads/${anotherUserId}/${otherUserFileId}`,
+        bytes: 4096,
        type: 'text/plain',
      });

-      // Create agent to include the file uploaded by another user
-      await createAgent({
-        id: agentId,
-        name: 'Test Agent',
-        provider: 'openai',
-        model: 'gpt-4',
-        author: authorId,
-        tool_resources: {
-          file_search: {
-            file_ids: [fileId1, otherUserFileId],
+      // Update agent to include the file uploaded by another user
+      const { updateAgent } = require('~/models/Agent');
+      await updateAgent(
+        { id: agentId },
+        {
+          tool_resources: {
+            file_search: {
+              file_ids: [fileId1, fileId2, otherUserFileId],
+            },
          },
        },
-      });
+      );

-      // Create a new app instance with author authentication
+      // Create app instance with author authentication
      const authorApp = express();
      authorApp.use(express.json());
      authorApp.use((req, res, next) => {
-        req.user = { id: authorId.toString() };
+        req.user = { id: authorId };
        req.app = { locals: {} };
        next();
      });
@@ -332,10 +271,12 @@ describe('File Routes - Agent Files Endpoint', () => {
      const response = await request(authorApp).get(`/files/agent/${agentId}`);

      expect(response.status).toBe(200);
-      expect(Array.isArray(response.body)).toBe(true);
-      expect(response.body).toHaveLength(2);
-      expect(response.body.map((f) => f.file_id)).toContain(fileId1);
-      expect(response.body.map((f) => f.file_id)).toContain(otherUserFileId);
+      expect(response.body).toHaveLength(3); // Including file from another user
+
+      const fileIds = response.body.map((f) => f.file_id);
+      expect(fileIds).toContain(fileId1);
+      expect(fileIds).toContain(fileId2);
+      expect(fileIds).toContain(otherUserFileId); // File uploaded by another user
    });
  });
 });
--- a/api/server/routes/files/files.js
+++ b/api/server/routes/files/files.js
@@ -5,8 +5,8 @@ const {
  Time,
  isUUID,
  CacheKeys,
+  Constants,
  FileSources,
-  PERMISSION_BITS,
  EModelEndpoint,
  isAgentsEndpoint,
  checkOpenAIStorage,
@@ -17,13 +17,12 @@ const {
  processDeleteRequest,
  processAgentFileUpload,
 } = require('~/server/services/Files/process');
+const { getFiles, batchUpdateFiles, hasAccessToFilesViaAgent } = require('~/models/File');
 const { getStrategyFunctions } = require('~/server/services/Files/strategies');
 const { getOpenAIClient } = require('~/server/controllers/assistants/helpers');
-const { checkPermission } = require('~/server/services/PermissionService');
 const { loadAuthValues } = require('~/server/services/Tools/credentials');
 const { refreshS3FileUrls } = require('~/server/services/Files/S3/crud');
-const { hasAccessToFilesViaAgent } = require('~/server/services/Files');
-const { getFiles, batchUpdateFiles } = require('~/models/File');
+const { getProjectByName } = require('~/models/Project');
 const { getAssistant } = require('~/models/Assistant');
 const { getAgent } = require('~/models/Agent');
 const { getLogStores } = require('~/cache');
@@ -78,15 +77,14 @@ router.get('/agent/:agent_id', async (req, res) => {

    // Check if user has access to the agent
    if (agent.author.toString() !== userId) {
-      // Non-authors need at least EDIT permission to view agent files
-      const hasEditPermission = await checkPermission({
-        userId,
-        resourceType: 'agent',
-        resourceId: agent._id,
-        requiredPermission: PERMISSION_BITS.EDIT,
-      });
+      // Non-authors need the agent to be globally shared and collaborative
+      const globalProject = await getProjectByName(Constants.GLOBAL_PROJECT_NAME, '_id');

-      if (!hasEditPermission) {
+      if (
+        !globalProject ||
+        !agent.projectIds.some((pid) => pid.toString() === globalProject._id.toString()) ||
+        !agent.isCollaborative
+      ) {
        return res.status(200).json([]);
      }
    }
--- a/api/server/routes/files/files.test.js
+++ b/api/server/routes/files/files.test.js
@@ -2,12 +2,10 @@ const express = require('express');
 const request = require('supertest');
 const mongoose = require('mongoose');
 const { v4: uuidv4 } = require('uuid');
-const { createMethods } = require('@librechat/data-schemas');
 const { MongoMemoryServer } = require('mongodb-memory-server');
-const { createAgent } = require('~/models/Agent');
-const { createFile } = require('~/models/File');
+const { GLOBAL_PROJECT_NAME } = require('librechat-data-provider').Constants;

-// Only mock the external dependencies that we don't want to test
+// Mock dependencies
 jest.mock('~/server/services/Files/process', () => ({
  processDeleteRequest: jest.fn().mockResolvedValue({}),
  filterFile: jest.fn(),
@@ -46,6 +44,9 @@ jest.mock('~/config', () => ({
  },
 }));

+const { createFile } = require('~/models/File');
+const { createAgent } = require('~/models/Agent');
+const { getProjectByName } = require('~/models/Project');
 const { processDeleteRequest } = require('~/server/services/Files/process');

 // Import the router after mocks
@@ -56,51 +57,22 @@ describe('File Routes - Delete with Agent Access', () => {
  let mongoServer;
  let authorId;
  let otherUserId;
-  let fileId;
-  let File;
-  let Agent;
-  let AclEntry;
-  let User;
-  let AccessRole;
-  let methods;
-  let modelsToCleanup = [];
-  // eslint-disable-next-line no-unused-vars
  let agentId;
+  let fileId;

  beforeAll(async () => {
    mongoServer = await MongoMemoryServer.create();
-    const mongoUri = mongoServer.getUri();
-    await mongoose.connect(mongoUri);
+    await mongoose.connect(mongoServer.getUri());

-    // Initialize all models using createModels
-    const { createModels } = require('@librechat/data-schemas');
-    const models = createModels(mongoose);
-
-    // Track which models we're adding
-    modelsToCleanup = Object.keys(models);
-
-    // Register models on mongoose.models so methods can access them
-    Object.assign(mongoose.models, models);
-
-    // Create methods with our test mongoose instance
-    methods = createMethods(mongoose);
-
-    // Now we can access models from the db/models
-    File = models.File;
-    Agent = models.Agent;
-    AclEntry = models.AclEntry;
-    User = models.User;
-    AccessRole = models.AccessRole;
-
-    // Seed default roles using our methods
-    await methods.seedDefaultRoles();
+    // Initialize models
+    require('~/db/models');

    app = express();
    app.use(express.json());

    // Mock authentication middleware
    app.use((req, res, next) => {
-      req.user = { id: otherUserId ? otherUserId.toString() : 'default-user' };
+      req.user = { id: otherUserId || 'default-user' };
      req.app = { locals: {} };
      next();
    });
@@ -109,19 +81,6 @@ describe('File Routes - Delete with Agent Access', () => {
  });

  afterAll(async () => {
-    // Clean up all collections before disconnecting
-    const collections = mongoose.connection.collections;
-    for (const key in collections) {
-      await collections[key].deleteMany({});
-    }
-
-    // Clear only the models we added
-    for (const modelName of modelsToCleanup) {
-      if (mongoose.models[modelName]) {
-        delete mongoose.models[modelName];
-      }
-    }
-
    await mongoose.disconnect();
    await mongoServer.stop();
  });
@@ -129,41 +88,48 @@ describe('File Routes - Delete with Agent Access', () => {
  beforeEach(async () => {
    jest.clearAllMocks();

-    // Clear database - clean up all test data
-    await File.deleteMany({});
-    await Agent.deleteMany({});
-    await User.deleteMany({});
-    await AclEntry.deleteMany({});
-    // Don't delete AccessRole as they are seeded defaults needed for tests
+    // Clear database
+    const collections = mongoose.connection.collections;
+    for (const key in collections) {
+      await collections[key].deleteMany({});
+    }

-    // Create test data
-    authorId = new mongoose.Types.ObjectId();
-    otherUserId = new mongoose.Types.ObjectId();
-    agentId = uuidv4();
+    authorId = new mongoose.Types.ObjectId().toString();
+    otherUserId = new mongoose.Types.ObjectId().toString();
    fileId = uuidv4();

-    // Create users in database
-    await User.create({
-      _id: authorId,
-      username: 'author',
-      email: 'author@test.com',
-    });
-
-    await User.create({
-      _id: otherUserId,
-      username: 'other',
-      email: 'other@test.com',
-    });
-
    // Create a file owned by the author
    await createFile({
      user: authorId,
      file_id: fileId,
      filename: 'test.txt',
-      filepath: '/uploads/test.txt',
-      bytes: 100,
+      filepath: `/uploads/${authorId}/${fileId}`,
+      bytes: 1024,
      type: 'text/plain',
    });
+
+    // Create an agent with the file attached
+    const agent = await createAgent({
+      id: uuidv4(),
+      name: 'Test Agent',
+      author: authorId,
+      model: 'gpt-4',
+      provider: 'openai',
+      isCollaborative: true,
+      tool_resources: {
+        file_search: {
+          file_ids: [fileId],
+        },
+      },
+    });
+    agentId = agent.id;
+
+    // Share the agent globally
+    const globalProject = await getProjectByName(GLOBAL_PROJECT_NAME, '_id');
+    if (globalProject) {
+      const { updateAgent } = require('~/models/Agent');
+      await updateAgent({ id: agentId }, { projectIds: [globalProject._id] });
+    }
  });

  describe('DELETE /files', () => {
@@ -174,8 +140,8 @@ describe('File Routes - Delete with Agent Access', () => {
        user: otherUserId,
        file_id: userFileId,
        filename: 'user-file.txt',
-        filepath: '/uploads/user-file.txt',
-        bytes: 200,
+        filepath: `/uploads/${otherUserId}/${userFileId}`,
+        bytes: 1024,
        type: 'text/plain',
      });

@@ -185,7 +151,7 @@ describe('File Routes - Delete with Agent Access', () => {
          files: [
            {
              file_id: userFileId,
-              filepath: '/uploads/user-file.txt',
+              filepath: `/uploads/${otherUserId}/${userFileId}`,
            },
          ],
        });
@@ -202,7 +168,7 @@ describe('File Routes - Delete with Agent Access', () => {
          files: [
            {
              file_id: fileId,
-              filepath: '/uploads/test.txt',
+              filepath: `/uploads/${authorId}/${fileId}`,
            },
          ],
        });
@@ -214,39 +180,14 @@ describe('File Routes - Delete with Agent Access', () => {
    });

    it('should allow deleting files accessible through shared agent', async () => {
-      // Create an agent with the file attached
-      const agent = await createAgent({
-        id: uuidv4(),
-        name: 'Test Agent',
-        provider: 'openai',
-        model: 'gpt-4',
-        author: authorId,
-        tool_resources: {
-          file_search: {
-            file_ids: [fileId],
-          },
-        },
-      });
-
-      // Grant EDIT permission to user on the agent
-      const { grantPermission } = require('~/server/services/PermissionService');
-      await grantPermission({
-        principalType: 'user',
-        principalId: otherUserId,
-        resourceType: 'agent',
-        resourceId: agent._id,
-        accessRoleId: 'agent_editor',
-        grantedBy: authorId,
-      });
-
      const response = await request(app)
        .delete('/files')
        .send({
-          agent_id: agent.id,
+          agent_id: agentId,
          files: [
            {
              file_id: fileId,
-              filepath: '/uploads/test.txt',
+              filepath: `/uploads/${authorId}/${fileId}`,
            },
          ],
        });
@@ -263,44 +204,19 @@ describe('File Routes - Delete with Agent Access', () => {
        user: authorId,
        file_id: unattachedFileId,
        filename: 'unattached.txt',
-        filepath: '/uploads/unattached.txt',
-        bytes: 300,
+        filepath: `/uploads/${authorId}/${unattachedFileId}`,
+        bytes: 1024,
        type: 'text/plain',
      });

-      // Create an agent without the unattached file
-      const agent = await createAgent({
-        id: uuidv4(),
-        name: 'Test Agent',
-        provider: 'openai',
-        model: 'gpt-4',
-        author: authorId,
-        tool_resources: {
-          file_search: {
-            file_ids: [fileId], // Only fileId, not unattachedFileId
-          },
-        },
-      });
-
-      // Grant EDIT permission to user on the agent
-      const { grantPermission } = require('~/server/services/PermissionService');
-      await grantPermission({
-        principalType: 'user',
-        principalId: otherUserId,
-        resourceType: 'agent',
-        resourceId: agent._id,
-        accessRoleId: 'agent_editor',
-        grantedBy: authorId,
-      });
-
      const response = await request(app)
        .delete('/files')
        .send({
-          agent_id: agent.id,
+          agent_id: agentId,
          files: [
            {
              file_id: unattachedFileId,
-              filepath: '/uploads/unattached.txt',
+              filepath: `/uploads/${authorId}/${unattachedFileId}`,
            },
          ],
        });
@@ -308,7 +224,6 @@ describe('File Routes - Delete with Agent Access', () => {
      expect(response.status).toBe(403);
      expect(response.body.message).toBe('You can only delete files you have access to');
      expect(response.body.unauthorizedFiles).toContain(unattachedFileId);
-      expect(processDeleteRequest).not.toHaveBeenCalled();
    });

    it('should handle mixed authorized and unauthorized files', async () => {
@@ -318,8 +233,8 @@ describe('File Routes - Delete with Agent Access', () => {
        user: otherUserId,
        file_id: userFileId,
        filename: 'user-file.txt',
-        filepath: '/uploads/user-file.txt',
-        bytes: 200,
+        filepath: `/uploads/${otherUserId}/${userFileId}`,
+        bytes: 1024,
        type: 'text/plain',
      });

@@ -329,87 +244,51 @@ describe('File Routes - Delete with Agent Access', () => {
        user: authorId,
        file_id: unauthorizedFileId,
        filename: 'unauthorized.txt',
-        filepath: '/uploads/unauthorized.txt',
-        bytes: 400,
+        filepath: `/uploads/${authorId}/${unauthorizedFileId}`,
+        bytes: 1024,
        type: 'text/plain',
      });

-      // Create an agent with only fileId attached
-      const agent = await createAgent({
-        id: uuidv4(),
-        name: 'Test Agent',
-        provider: 'openai',
-        model: 'gpt-4',
-        author: authorId,
-        tool_resources: {
-          file_search: {
-            file_ids: [fileId],
-          },
-        },
-      });
-
-      // Grant EDIT permission to user on the agent
-      const { grantPermission } = require('~/server/services/PermissionService');
-      await grantPermission({
-        principalType: 'user',
-        principalId: otherUserId,
-        resourceType: 'agent',
-        resourceId: agent._id,
-        accessRoleId: 'agent_editor',
-        grantedBy: authorId,
-      });
-
      const response = await request(app)
        .delete('/files')
        .send({
-          agent_id: agent.id,
+          agent_id: agentId,
          files: [
-            { file_id: userFileId, filepath: '/uploads/user-file.txt' },
-            { file_id: fileId, filepath: '/uploads/test.txt' },
-            { file_id: unauthorizedFileId, filepath: '/uploads/unauthorized.txt' },
+            {
+              file_id: fileId, // Authorized through agent
+              filepath: `/uploads/${authorId}/${fileId}`,
+            },
+            {
+              file_id: userFileId, // Owned by user
+              filepath: `/uploads/${otherUserId}/${userFileId}`,
+            },
+            {
+              file_id: unauthorizedFileId, // Not authorized
+              filepath: `/uploads/${authorId}/${unauthorizedFileId}`,
+            },
          ],
        });

      expect(response.status).toBe(403);
      expect(response.body.message).toBe('You can only delete files you have access to');
      expect(response.body.unauthorizedFiles).toContain(unauthorizedFileId);
-      expect(processDeleteRequest).not.toHaveBeenCalled();
+      expect(response.body.unauthorizedFiles).not.toContain(fileId);
+      expect(response.body.unauthorizedFiles).not.toContain(userFileId);
    });

-    it('should prevent deleting files when user lacks EDIT permission on agent', async () => {
-      // Create an agent with the file attached
-      const agent = await createAgent({
-        id: uuidv4(),
-        name: 'Test Agent',
-        provider: 'openai',
-        model: 'gpt-4',
-        author: authorId,
-        tool_resources: {
-          file_search: {
-            file_ids: [fileId],
-          },
-        },
-      });
-
-      // Grant only VIEW permission to user on the agent
-      const { grantPermission } = require('~/server/services/PermissionService');
-      await grantPermission({
-        principalType: 'user',
-        principalId: otherUserId,
-        resourceType: 'agent',
-        resourceId: agent._id,
-        accessRoleId: 'agent_viewer',
-        grantedBy: authorId,
-      });
+    it('should prevent deleting files when agent is not collaborative', async () => {
+      // Update the agent to be non-collaborative
+      const { updateAgent } = require('~/models/Agent');
+      await updateAgent({ id: agentId }, { isCollaborative: false });

      const response = await request(app)
        .delete('/files')
        .send({
-          agent_id: agent.id,
+          agent_id: agentId,
          files: [
            {
              file_id: fileId,
-              filepath: '/uploads/test.txt',
+              filepath: `/uploads/${authorId}/${fileId}`,
            },
          ],
        });
--- a/api/server/routes/index.js
+++ b/api/server/routes/index.js
@@ -1,4 +1,3 @@
-const accessPermissions = require('./accessPermissions');
 const assistants = require('./assistants');
 const categories = require('./categories');
 const tokenizer = require('./tokenizer');
@@ -29,7 +28,6 @@ const user = require('./user');
 const mcp = require('./mcp');

 module.exports = {
-  mcp,
  edit,
  auth,
  keys,
@@ -57,5 +55,5 @@ module.exports = {
  assistants,
  categories,
  staticRoute,
-  accessPermissions,
+  mcp,
 };
--- a/api/server/routes/mcp.js
+++ b/api/server/routes/mcp.js
@@ -331,7 +331,8 @@ router.post('/:serverName/reinitialize', requireJwtAuth, async (req, res) => {

    logger.info(`[MCP Reinitialize] Reinitializing server: ${serverName}`);

-    const config = await loadCustomConfig();
+    const printConfig = false;
+    const config = await loadCustomConfig(printConfig);
    if (!config || !config.mcpServers || !config.mcpServers[serverName]) {
      return res.status(404).json({
        error: `MCP server '${serverName}' not found in configuration`,
--- a/api/server/routes/oauth.js
+++ b/api/server/routes/oauth.js
@@ -9,7 +9,6 @@ const {
  setBalanceConfig,
  checkDomainAllowed,
 } = require('~/server/middleware');
-const { syncUserEntraGroupMemberships } = require('~/server/services/PermissionService');
 const { setAuthTokens, setOpenIDAuthTokens } = require('~/server/services/AuthService');
 const { isEnabled } = require('~/server/utils');
 const { logger } = require('~/config');
@@ -36,7 +35,6 @@ const oauthHandler = async (req, res) => {
      req.user.provider == 'openid' &&
      isEnabled(process.env.OPENID_REUSE_TOKENS) === true
    ) {
-      await syncUserEntraGroupMemberships(req.user, req.user.tokenset.access_token);
      setOpenIDAuthTokens(req.user.tokenset, res);
    } else {
      await setAuthTokens(req.user._id, res);
--- a/api/server/services/AppService.interface.spec.js
+++ b/api/server/services/AppService.interface.spec.js
@@ -1,7 +1,5 @@
 jest.mock('~/models', () => ({
  initializeRoles: jest.fn(),
-  seedDefaultRoles: jest.fn(),
-  ensureDefaultCategories: jest.fn(),
 }));
 jest.mock('~/models/Role', () => ({
  updateAccessPermissions: jest.fn(),
--- a/api/server/services/AppService.js
+++ b/api/server/services/AppService.js
@@ -16,7 +16,6 @@ const {
 const { azureAssistantsDefaults, assistantsConfigSetup } = require('./start/assistants');
 const { initializeAzureBlobService } = require('./Files/Azure/initialize');
 const { initializeFirebase } = require('./Files/Firebase/initialize');
-const { seedDefaultRoles, initializeRoles, ensureDefaultCategories } = require('~/models');
 const loadCustomConfig = require('./Config/loadCustomConfig');
 const handleRateLimits = require('./Config/handleRateLimits');
 const { loadDefaultInterface } = require('./start/interface');
@@ -26,6 +25,7 @@ const { processModelSpecs } = require('./start/modelSpecs');
 const { initializeS3 } = require('./Files/S3/initialize');
 const { loadAndFormatTools } = require('./ToolService');
 const { isEnabled } = require('~/server/utils');
+const { initializeRoles } = require('~/models');
 const { setCachedTools } = require('./Config');
 const paths = require('~/config/paths');

@@ -36,8 +36,6 @@ const paths = require('~/config/paths');
 */
 const AppService = async (app) => {
  await initializeRoles();
-  await seedDefaultRoles();
-  await ensureDefaultCategories();
  /** @type {TCustomConfig} */
  const config = (await loadCustomConfig()) ?? {};
  const configDefaults = getConfigDefaults();
--- a/api/server/services/AppService.spec.js
+++ b/api/server/services/AppService.spec.js
@@ -28,8 +28,6 @@ jest.mock('./Files/Firebase/initialize', () => ({
 }));
 jest.mock('~/models', () => ({
  initializeRoles: jest.fn(),
-  seedDefaultRoles: jest.fn(),
-  ensureDefaultCategories: jest.fn(),
 }));
 jest.mock('~/models/Role', () => ({
  updateAccessPermissions: jest.fn(),
--- a/api/server/services/Config/getCustomConfig.js
+++ b/api/server/services/Config/getCustomConfig.js
@@ -11,8 +11,8 @@ const getLogStores = require('~/cache/getLogStores');
 * @returns {Promise<TCustomConfig | null>}
 * */
 async function getCustomConfig() {
-  const cache = getLogStores(CacheKeys.CONFIG_STORE);
-  return (await cache.get(CacheKeys.CUSTOM_CONFIG)) || (await loadCustomConfig());
+  const cache = getLogStores(CacheKeys.STATIC_CONFIG);
+  return (await cache.get(CacheKeys.LIBRECHAT_YAML_CONFIG)) || (await loadCustomConfig());
 }

 /**
--- a/api/server/services/Config/loadCustomConfig.js
+++ b/api/server/services/Config/loadCustomConfig.js
@@ -120,8 +120,8 @@ https://www.librechat.ai/docs/configuration/stt_tts`);
    .forEach((endpoint) => parseCustomParams(endpoint.name, endpoint.customParams));

  if (customConfig.cache) {
-    const cache = getLogStores(CacheKeys.CONFIG_STORE);
-    await cache.set(CacheKeys.CUSTOM_CONFIG, customConfig);
+    const cache = getLogStores(CacheKeys.STATIC_CONFIG);
+    await cache.set(CacheKeys.LIBRECHAT_YAML_CONFIG, customConfig);
  }

  if (result.data.modelSpecs) {
--- a/api/server/services/Files/Code/process.js
+++ b/api/server/services/Files/Code/process.js
@@ -11,7 +11,6 @@ const {
  imageExtRegex,
  EToolResources,
 } = require('librechat-data-provider');
-const { filterFilesByAgentAccess } = require('~/server/services/Files/permissions');
 const { getStrategyFunctions } = require('~/server/services/Files/strategies');
 const { convertImage } = require('~/server/services/Files/images/convert');
 const { createFile, getFiles, updateFile } = require('~/models/File');
@@ -165,19 +164,14 @@ const primeFiles = async (options, apiKey) => {
  const file_ids = tool_resources?.[EToolResources.execute_code]?.file_ids ?? [];
  const agentResourceIds = new Set(file_ids);
  const resourceFiles = tool_resources?.[EToolResources.execute_code]?.files ?? [];
-
-  // Get all files first
-  const allFiles = (await getFiles({ file_id: { $in: file_ids } }, null, { text: 0 })) ?? [];
-
-  // Filter by access if user and agent are provided
-  let dbFiles;
-  if (req?.user?.id && agentId) {
-    dbFiles = await filterFilesByAgentAccess(allFiles, req.user.id, agentId);
-  } else {
-    dbFiles = allFiles;
-  }
-
-  dbFiles = dbFiles.concat(resourceFiles);
+  const dbFiles = (
+    (await getFiles(
+      { file_id: { $in: file_ids } },
+      null,
+      { text: 0 },
+      { userId: req?.user?.id, agentId },
+    )) ?? []
+  ).concat(resourceFiles);

  const files = [];
  const sessions = new Map();
--- a/api/server/services/Files/index.js
+++ b/api/server/services/Files/index.js
@@ -1,12 +0,0 @@
-const { processCodeFile } = require('./Code/process');
-const { processFileUpload } = require('./process');
-const { uploadImageBuffer } = require('./images');
-const { hasAccessToFilesViaAgent, filterFilesByAgentAccess } = require('./permissions');
-
-module.exports = {
-  processCodeFile,
-  processFileUpload,
-  uploadImageBuffer,
-  hasAccessToFilesViaAgent,
-  filterFilesByAgentAccess,
-};
--- a/api/server/services/Files/permissions.js
+++ b/api/server/services/Files/permissions.js
@@ -1,123 +0,0 @@
-const { logger } = require('@librechat/data-schemas');
-const { PERMISSION_BITS } = require('librechat-data-provider');
-const { checkPermission } = require('~/server/services/PermissionService');
-const { getAgent } = require('~/models/Agent');
-
-/**
- * Checks if a user has access to multiple files through a shared agent (batch operation)
- * @param {string} userId - The user ID to check access for
- * @param {string[]} fileIds - Array of file IDs to check
- * @param {string} agentId - The agent ID that might grant access
- * @returns {Promise<Map<string, boolean>>} Map of fileId to access status
- */
-const hasAccessToFilesViaAgent = async (userId, fileIds, agentId) => {
-  const accessMap = new Map();
-
-  // Initialize all files as no access
-  fileIds.forEach((fileId) => accessMap.set(fileId, false));
-
-  try {
-    const agent = await getAgent({ id: agentId });
-
-    if (!agent) {
-      return accessMap;
-    }
-
-    // Check if user is the author - if so, grant access to all files
-    if (agent.author.toString() === userId) {
-      fileIds.forEach((fileId) => accessMap.set(fileId, true));
-      return accessMap;
-    }
-
-    // Check if user has at least VIEW permission on the agent
-    const hasViewPermission = await checkPermission({
-      userId,
-      resourceType: 'agent',
-      resourceId: agent._id,
-      requiredPermission: PERMISSION_BITS.VIEW,
-    });
-
-    if (!hasViewPermission) {
-      return accessMap;
-    }
-
-    // Check if user has EDIT permission (which would indicate collaborative access)
-    const hasEditPermission = await checkPermission({
-      userId,
-      resourceType: 'agent',
-      resourceId: agent._id,
-      requiredPermission: PERMISSION_BITS.EDIT,
-    });
-
-    // If user only has VIEW permission, they can't access files
-    // Only users with EDIT permission or higher can access agent files
-    if (!hasEditPermission) {
-      return accessMap;
-    }
-
-    // User has edit permissions - check which files are actually attached
-    const attachedFileIds = new Set();
-    if (agent.tool_resources) {
-      for (const [_resourceType, resource] of Object.entries(agent.tool_resources)) {
-        if (resource?.file_ids && Array.isArray(resource.file_ids)) {
-          resource.file_ids.forEach((fileId) => attachedFileIds.add(fileId));
-        }
-      }
-    }
-
-    // Grant access only to files that are attached to this agent
-    fileIds.forEach((fileId) => {
-      if (attachedFileIds.has(fileId)) {
-        accessMap.set(fileId, true);
-      }
-    });
-
-    return accessMap;
-  } catch (error) {
-    logger.error('[hasAccessToFilesViaAgent] Error checking file access:', error);
-    return accessMap;
-  }
-};
-
-/**
- * Filter files based on user access through agents
- * @param {Array<MongoFile>} files - Array of file documents
- * @param {string} userId - User ID for access control
- * @param {string} agentId - Agent ID that might grant access to files
- * @returns {Promise<Array<MongoFile>>} Filtered array of accessible files
- */
-const filterFilesByAgentAccess = async (files, userId, agentId) => {
-  if (!userId || !agentId || !files || files.length === 0) {
-    return files;
-  }
-
-  // Separate owned files from files that need access check
-  const filesToCheck = [];
-  const ownedFiles = [];
-
-  for (const file of files) {
-    if (file.user && file.user.toString() === userId) {
-      ownedFiles.push(file);
-    } else {
-      filesToCheck.push(file);
-    }
-  }
-
-  if (filesToCheck.length === 0) {
-    return ownedFiles;
-  }
-
-  // Batch check access for all non-owned files
-  const fileIds = filesToCheck.map((f) => f.file_id);
-  const accessMap = await hasAccessToFilesViaAgent(userId, fileIds, agentId);
-
-  // Filter files based on access
-  const accessibleFiles = filesToCheck.filter((file) => accessMap.get(file.file_id));
-
-  return [...ownedFiles, ...accessibleFiles];
-};
-
-module.exports = {
-  hasAccessToFilesViaAgent,
-  filterFilesByAgentAccess,
-};
--- a/api/server/services/GraphApiService.js
+++ b/api/server/services/GraphApiService.js
@@ -1,525 +0,0 @@
-const client = require('openid-client');
-const { isEnabled } = require('@librechat/api');
-const { logger } = require('@librechat/data-schemas');
-const { CacheKeys } = require('librechat-data-provider');
-const { Client } = require('@microsoft/microsoft-graph-client');
-const { getOpenIdConfig } = require('~/strategies/openidStrategy');
-const getLogStores = require('~/cache/getLogStores');
-
-/**
- * @import { TPrincipalSearchResult, TGraphPerson, TGraphUser, TGraphGroup, TGraphPeopleResponse, TGraphUsersResponse, TGraphGroupsResponse } from 'librechat-data-provider'
- */
-
-/**
- * Checks if Entra ID principal search feature is enabled based on environment variables and user authentication
- * @param {Object} user - User object from request
- * @param {string} user.provider - Authentication provider
- * @param {string} user.openidId - OpenID subject identifier
- * @returns {boolean} True if Entra ID principal search is enabled and user is authenticated via OpenID
- */
-const entraIdPrincipalFeatureEnabled = (user) => {
-  return (
-    isEnabled(process.env.USE_ENTRA_ID_FOR_PEOPLE_SEARCH) &&
-    isEnabled(process.env.OPENID_REUSE_TOKENS) &&
-    user?.provider === 'openid' &&
-    user?.openidId
-  );
-};
-
-/**
- * Creates a Microsoft Graph client with on-behalf-of token exchange
- * @param {string} accessToken - OpenID Connect access token from user
- * @param {string} sub - Subject identifier from token claims
- * @returns {Promise<Client>} Authenticated Graph API client
- */
-const createGraphClient = async (accessToken, sub) => {
-  try {
-    // Reason: Use existing OpenID configuration and token exchange pattern from openidStrategy.js
-    const openidConfig = getOpenIdConfig();
-    const exchangedToken = await exchangeTokenForGraphAccess(openidConfig, accessToken, sub);
-
-    const graphClient = Client.init({
-      authProvider: (done) => {
-        done(null, exchangedToken);
-      },
-    });
-
-    return graphClient;
-  } catch (error) {
-    logger.error('[createGraphClient] Error creating Graph client:', error);
-    throw error;
-  }
-};
-
-/**
- * Exchange OpenID token for Graph API access using on-behalf-of flow
- * Similar to exchangeAccessTokenIfNeeded in openidStrategy.js but for Graph scopes
- * @param {Configuration} config - OpenID configuration
- * @param {string} accessToken - Original access token
- * @param {string} sub - Subject identifier
- * @returns {Promise<string>} Graph API access token
- */
-const exchangeTokenForGraphAccess = async (config, accessToken, sub) => {
-  try {
-    const tokensCache = getLogStores(CacheKeys.OPENID_EXCHANGED_TOKENS);
-    const cacheKey = `${sub}:graph`;
-
-    const cachedToken = await tokensCache.get(cacheKey);
-    if (cachedToken) {
-      return cachedToken.access_token;
-    }
-
-    const graphScopes = process.env.OPENID_GRAPH_SCOPES || 'User.Read,People.Read,Group.Read.All';
-    const scopeString = graphScopes
-      .split(',')
-      .map((scope) => `https://graph.microsoft.com/${scope}`)
-      .join(' ');
-
-    const grantResponse = await client.genericGrantRequest(
-      config,
-      'urn:ietf:params:oauth:grant-type:jwt-bearer',
-      {
-        scope: scopeString,
-        assertion: accessToken,
-        requested_token_use: 'on_behalf_of',
-      },
-    );
-
-    await tokensCache.set(
-      cacheKey,
-      {
-        access_token: grantResponse.access_token,
-      },
-      grantResponse.expires_in * 1000,
-    );
-
-    return grantResponse.access_token;
-  } catch (error) {
-    logger.error('[exchangeTokenForGraphAccess] Token exchange failed:', error);
-    throw error;
-  }
-};
-
-/**
- * Search for principals (people and groups) using Microsoft Graph API
- * Uses searchContacts first, then searchUsers and searchGroups to fill remaining slots
- * @param {string} accessToken - OpenID Connect access token
- * @param {string} sub - Subject identifier
- * @param {string} query - Search query string
- * @param {string} type - Type filter ('users', 'groups', or 'all')
- * @param {number} limit - Maximum number of results
- * @returns {Promise<TPrincipalSearchResult[]>} Array of principal search results
- */
-const searchEntraIdPrincipals = async (accessToken, sub, query, type = 'all', limit = 10) => {
-  try {
-    if (!query || query.trim().length < 2) {
-      return [];
-    }
-    const graphClient = await createGraphClient(accessToken, sub);
-    let allResults = [];
-
-    if (type === 'users' || type === 'all') {
-      const contactResults = await searchContacts(graphClient, query, limit);
-      allResults.push(...contactResults);
-    }
-    if (allResults.length >= limit) {
-      return allResults.slice(0, limit);
-    }
-
-    if (type === 'users') {
-      const userResults = await searchUsers(graphClient, query, limit);
-      allResults.push(...userResults);
-    } else if (type === 'groups') {
-      const groupResults = await searchGroups(graphClient, query, limit);
-      allResults.push(...groupResults);
-    } else if (type === 'all') {
-      const [userResults, groupResults] = await Promise.all([
-        searchUsers(graphClient, query, limit),
-        searchGroups(graphClient, query, limit),
-      ]);
-
-      allResults.push(...userResults, ...groupResults);
-    }
-
-    const seenIds = new Set();
-    const uniqueResults = allResults.filter((result) => {
-      if (seenIds.has(result.idOnTheSource)) {
-        return false;
-      }
-      seenIds.add(result.idOnTheSource);
-      return true;
-    });
-
-    return uniqueResults.slice(0, limit);
-  } catch (error) {
-    logger.error('[searchEntraIdPrincipals] Error searching principals:', error);
-    return [];
-  }
-};
-
-/**
- * Get current user's Entra ID group memberships from Microsoft Graph
- * Uses /me/memberOf endpoint to get groups the user is a member of
- * @param {string} accessToken - OpenID Connect access token
- * @param {string} sub - Subject identifier
- * @returns {Promise<Array<string>>} Array of group ID strings (GUIDs)
- */
-const getUserEntraGroups = async (accessToken, sub) => {
-  try {
-    const graphClient = await createGraphClient(accessToken, sub);
-
-    const groupsResponse = await graphClient.api('/me/memberOf').select('id').get();
-
-    return (groupsResponse.value || []).map((group) => group.id);
-  } catch (error) {
-    logger.error('[getUserEntraGroups] Error fetching user groups:', error);
-    return [];
-  }
-};
-
-/**
- * Get current user's owned Entra ID groups from Microsoft Graph
- * Uses /me/ownedObjects/microsoft.graph.group endpoint to get groups the user owns
- * @param {string} accessToken - OpenID Connect access token
- * @param {string} sub - Subject identifier
- * @returns {Promise<Array<string>>} Array of group ID strings (GUIDs)
- */
-const getUserOwnedEntraGroups = async (accessToken, sub) => {
-  try {
-    const graphClient = await createGraphClient(accessToken, sub);
-
-    const groupsResponse = await graphClient
-      .api('/me/ownedObjects/microsoft.graph.group')
-      .select('id')
-      .get();
-
-    return (groupsResponse.value || []).map((group) => group.id);
-  } catch (error) {
-    logger.error('[getUserOwnedEntraGroups] Error fetching user owned groups:', error);
-    return [];
-  }
-};
-
-/**
- * Get group members from Microsoft Graph API
- * Recursively fetches all members using pagination (@odata.nextLink)
- * @param {string} accessToken - OpenID Connect access token
- * @param {string} sub - Subject identifier
- * @param {string} groupId - Entra ID group object ID
- * @returns {Promise<Array>} Array of member IDs (idOnTheSource values)
- */
-const getGroupMembers = async (accessToken, sub, groupId) => {
-  try {
-    const graphClient = await createGraphClient(accessToken, sub);
-    const allMembers = [];
-    let nextLink = `/groups/${groupId}/members`;
-
-    while (nextLink) {
-      const membersResponse = await graphClient.api(nextLink).select('id').top(999).get();
-
-      const members = membersResponse.value || [];
-      allMembers.push(...members.map((member) => member.id));
-
-      nextLink = membersResponse['@odata.nextLink']
-        ? membersResponse['@odata.nextLink'].split('/v1.0')[1]
-        : null;
-    }
-
-    return allMembers;
-  } catch (error) {
-    logger.error('[getGroupMembers] Error fetching group members:', error);
-    return [];
-  }
-};
-/**
- * Get group owners from Microsoft Graph API
- * Recursively fetches all owners using pagination (@odata.nextLink)
- * @param {string} accessToken - OpenID Connect access token
- * @param {string} sub - Subject identifier
- * @param {string} groupId - Entra ID group object ID
- * @returns {Promise<Array>} Array of owner IDs (idOnTheSource values)
- */
-const getGroupOwners = async (accessToken, sub, groupId) => {
-  try {
-    const graphClient = await createGraphClient(accessToken, sub);
-    const allOwners = [];
-    let nextLink = `/groups/${groupId}/owners`;
-
-    while (nextLink) {
-      const ownersResponse = await graphClient.api(nextLink).select('id').top(999).get();
-
-      const owners = ownersResponse.value || [];
-      allOwners.push(...owners.map((member) => member.id));
-
-      nextLink = ownersResponse['@odata.nextLink']
-        ? ownersResponse['@odata.nextLink'].split('/v1.0')[1]
-        : null;
-    }
-
-    return allOwners;
-  } catch (error) {
-    logger.error('[getGroupOwners] Error fetching group owners:', error);
-    return [];
-  }
-};
-/**
- * Search for contacts (users only) using Microsoft Graph /me/people endpoint
- * Returns mapped TPrincipalSearchResult objects for users only
- * @param {Client} graphClient - Authenticated Microsoft Graph client
- * @param {string} query - Search query string
- * @param {number} limit - Maximum number of results (default: 10)
- * @returns {Promise<TPrincipalSearchResult[]>} Array of mapped user contact results
- */
-const searchContacts = async (graphClient, query, limit = 10) => {
-  try {
-    if (!query || query.trim().length < 2) {
-      return [];
-    }
-    if (
-      process.env.OPENID_GRAPH_SCOPES &&
-      !process.env.OPENID_GRAPH_SCOPES.toLowerCase().includes('people.read')
-    ) {
-      logger.warn('[searchContacts] People.Read scope is not enabled, skipping contact search');
-      return [];
-    }
-    // Reason: Search only for OrganizationUser (person) type, not groups
-    const filter = "personType/subclass eq 'OrganizationUser'";
-
-    let apiCall = graphClient
-      .api('/me/people')
-      .search(`"${query}"`)
-      .select(
-        'id,displayName,givenName,surname,userPrincipalName,jobTitle,department,companyName,scoredEmailAddresses,personType,phones',
-      )
-      .header('ConsistencyLevel', 'eventual')
-      .filter(filter)
-      .top(limit);
-
-    const contactsResponse = await apiCall.get();
-    return (contactsResponse.value || []).map(mapContactToTPrincipalSearchResult);
-  } catch (error) {
-    logger.error('[searchContacts] Error searching contacts:', error);
-    return [];
-  }
-};
-
-/**
- * Search for users using Microsoft Graph /users endpoint
- * Returns mapped TPrincipalSearchResult objects
- * @param {Client} graphClient - Authenticated Microsoft Graph client
- * @param {string} query - Search query string
- * @param {number} limit - Maximum number of results (default: 10)
- * @returns {Promise<TPrincipalSearchResult[]>} Array of mapped user results
- */
-const searchUsers = async (graphClient, query, limit = 10) => {
-  try {
-    if (!query || query.trim().length < 2) {
-      return [];
-    }
-
-    // Reason: Search users by display name, email, and user principal name
-    const usersResponse = await graphClient
-      .api('/users')
-      .search(
-        `"displayName:${query}" OR "userPrincipalName:${query}" OR "mail:${query}" OR "givenName:${query}" OR "surname:${query}"`,
-      )
-      .select(
-        'id,displayName,givenName,surname,userPrincipalName,jobTitle,department,companyName,mail,phones',
-      )
-      .header('ConsistencyLevel', 'eventual')
-      .top(limit)
-      .get();
-
-    return (usersResponse.value || []).map(mapUserToTPrincipalSearchResult);
-  } catch (error) {
-    logger.error('[searchUsers] Error searching users:', error);
-    return [];
-  }
-};
-
-/**
- * Search for groups using Microsoft Graph /groups endpoint
- * Returns mapped TPrincipalSearchResult objects, includes all group types
- * @param {Client} graphClient - Authenticated Microsoft Graph client
- * @param {string} query - Search query string
- * @param {number} limit - Maximum number of results (default: 10)
- * @returns {Promise<TPrincipalSearchResult[]>} Array of mapped group results
- */
-const searchGroups = async (graphClient, query, limit = 10) => {
-  try {
-    if (!query || query.trim().length < 2) {
-      return [];
-    }
-
-    // Reason: Search all groups by display name and email without filtering group types
-    const groupsResponse = await graphClient
-      .api('/groups')
-      .search(`"displayName:${query}" OR "mail:${query}" OR "mailNickname:${query}"`)
-      .select('id,displayName,mail,mailNickname,description,groupTypes,resourceProvisioningOptions')
-      .header('ConsistencyLevel', 'eventual')
-      .top(limit)
-      .get();
-
-    return (groupsResponse.value || []).map(mapGroupToTPrincipalSearchResult);
-  } catch (error) {
-    logger.error('[searchGroups] Error searching groups:', error);
-    return [];
-  }
-};
-
-/**
- * Test Graph API connectivity and permissions
- * @param {string} accessToken - OpenID Connect access token
- * @param {string} sub - Subject identifier
- * @returns {Promise<Object>} Test results with available permissions
- */
-const testGraphApiAccess = async (accessToken, sub) => {
-  try {
-    const graphClient = await createGraphClient(accessToken, sub);
-    const results = {
-      userAccess: false,
-      peopleAccess: false,
-      groupsAccess: false,
-      usersEndpointAccess: false,
-      groupsEndpointAccess: false,
-      errors: [],
-    };
-
-    // Test User.Read permission
-    try {
-      await graphClient.api('/me').select('id,displayName').get();
-      results.userAccess = true;
-    } catch (error) {
-      results.errors.push(`User.Read: ${error.message}`);
-    }
-
-    // Test People.Read permission with OrganizationUser filter
-    try {
-      await graphClient
-        .api('/me/people')
-        .filter("personType/subclass eq 'OrganizationUser'")
-        .top(1)
-        .get();
-      results.peopleAccess = true;
-    } catch (error) {
-      results.errors.push(`People.Read (OrganizationUser): ${error.message}`);
-    }
-
-    // Test People.Read permission with UnifiedGroup filter
-    try {
-      await graphClient
-        .api('/me/people')
-        .filter("personType/subclass eq 'UnifiedGroup'")
-        .top(1)
-        .get();
-      results.groupsAccess = true;
-    } catch (error) {
-      results.errors.push(`People.Read (UnifiedGroup): ${error.message}`);
-    }
-
-    // Test /users endpoint access (requires User.Read.All or similar)
-    try {
-      await graphClient
-        .api('/users')
-        .search('"displayName:test"')
-        .select('id,displayName,userPrincipalName')
-        .top(1)
-        .get();
-      results.usersEndpointAccess = true;
-    } catch (error) {
-      results.errors.push(`Users endpoint: ${error.message}`);
-    }
-
-    // Test /groups endpoint access (requires Group.Read.All or similar)
-    try {
-      await graphClient
-        .api('/groups')
-        .search('"displayName:test"')
-        .select('id,displayName,mail')
-        .top(1)
-        .get();
-      results.groupsEndpointAccess = true;
-    } catch (error) {
-      results.errors.push(`Groups endpoint: ${error.message}`);
-    }
-
-    return results;
-  } catch (error) {
-    logger.error('[testGraphApiAccess] Error testing Graph API access:', error);
-    return {
-      userAccess: false,
-      peopleAccess: false,
-      groupsAccess: false,
-      usersEndpointAccess: false,
-      groupsEndpointAccess: false,
-      errors: [error.message],
-    };
-  }
-};
-
-/**
- * Map Graph API user object to TPrincipalSearchResult format
- * @param {TGraphUser} user - Raw user object from Graph API
- * @returns {TPrincipalSearchResult} Mapped user result
- */
-const mapUserToTPrincipalSearchResult = (user) => {
-  return {
-    id: null,
-    type: 'user',
-    name: user.displayName,
-    email: user.mail || user.userPrincipalName,
-    username: user.userPrincipalName,
-    source: 'entra',
-    idOnTheSource: user.id,
-  };
-};
-
-/**
- * Map Graph API group object to TPrincipalSearchResult format
- * @param {TGraphGroup} group - Raw group object from Graph API
- * @returns {TPrincipalSearchResult} Mapped group result
- */
-const mapGroupToTPrincipalSearchResult = (group) => {
-  return {
-    id: null,
-    type: 'group',
-    name: group.displayName,
-    email: group.mail || group.userPrincipalName,
-    description: group.description,
-    source: 'entra',
-    idOnTheSource: group.id,
-  };
-};
-
-/**
- * Map Graph API /me/people contact object to TPrincipalSearchResult format
- * Handles both user and group contacts from the people endpoint
- * @param {TGraphPerson} contact - Raw contact object from Graph API /me/people
- * @returns {TPrincipalSearchResult} Mapped contact result
- */
-const mapContactToTPrincipalSearchResult = (contact) => {
-  const isGroup = contact.personType?.class === 'Group';
-  const primaryEmail = contact.scoredEmailAddresses?.[0]?.address;
-
-  return {
-    id: null,
-    type: isGroup ? 'group' : 'user',
-    name: contact.displayName,
-    email: primaryEmail,
-    username: !isGroup ? contact.userPrincipalName : undefined,
-    source: 'entra',
-    idOnTheSource: contact.id,
-  };
-};
-
-module.exports = {
-  getGroupMembers,
-  getGroupOwners,
-  createGraphClient,
-  getUserEntraGroups,
-  getUserOwnedEntraGroups,
-  testGraphApiAccess,
-  searchEntraIdPrincipals,
-  exchangeTokenForGraphAccess,
-  entraIdPrincipalFeatureEnabled,
-};
--- a/api/server/services/GraphApiService.spec.js
+++ b/api/server/services/GraphApiService.spec.js
@@ -1,720 +0,0 @@
-jest.mock('@microsoft/microsoft-graph-client');
-jest.mock('~/strategies/openidStrategy');
-jest.mock('~/cache/getLogStores');
-jest.mock('@librechat/data-schemas', () => ({
-  ...jest.requireActual('@librechat/data-schemas'),
-  logger: {
-    error: jest.fn(),
-    debug: jest.fn(),
-  },
-}));
-jest.mock('~/config', () => ({
-  logger: {
-    error: jest.fn(),
-    debug: jest.fn(),
-  },
-  createAxiosInstance: jest.fn(() => ({
-    create: jest.fn(),
-    defaults: {},
-  })),
-}));
-jest.mock('~/utils', () => ({
-  logAxiosError: jest.fn(),
-}));
-
-jest.mock('~/server/services/Config', () => ({}));
-jest.mock('~/server/services/Files/strategies', () => ({
-  getStrategyFunctions: jest.fn(),
-}));
-
-const mongoose = require('mongoose');
-const client = require('openid-client');
-const { MongoMemoryServer } = require('mongodb-memory-server');
-const { Client } = require('@microsoft/microsoft-graph-client');
-const { getOpenIdConfig } = require('~/strategies/openidStrategy');
-const getLogStores = require('~/cache/getLogStores');
-const GraphApiService = require('./GraphApiService');
-
-describe('GraphApiService', () => {
-  let mongoServer;
-  let mockGraphClient;
-  let mockTokensCache;
-  let mockOpenIdConfig;
-
-  beforeAll(async () => {
-    mongoServer = await MongoMemoryServer.create();
-    const mongoUri = mongoServer.getUri();
-    await mongoose.connect(mongoUri);
-  });
-
-  afterAll(async () => {
-    await mongoose.disconnect();
-    await mongoServer.stop();
-  });
-
-  afterEach(() => {
-    // Clean up environment variables
-    delete process.env.OPENID_GRAPH_SCOPES;
-  });
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    await mongoose.connection.dropDatabase();
-
-    // Set up environment variable for People.Read scope
-    process.env.OPENID_GRAPH_SCOPES = 'User.Read,People.Read,Group.Read.All';
-
-    // Mock Graph client
-    mockGraphClient = {
-      api: jest.fn().mockReturnThis(),
-      search: jest.fn().mockReturnThis(),
-      filter: jest.fn().mockReturnThis(),
-      select: jest.fn().mockReturnThis(),
-      header: jest.fn().mockReturnThis(),
-      top: jest.fn().mockReturnThis(),
-      get: jest.fn(),
-    };
-
-    Client.init.mockReturnValue(mockGraphClient);
-
-    // Mock tokens cache
-    mockTokensCache = {
-      get: jest.fn(),
-      set: jest.fn(),
-    };
-    getLogStores.mockReturnValue(mockTokensCache);
-
-    // Mock OpenID config
-    mockOpenIdConfig = {
-      client_id: 'test-client-id',
-      issuer: 'https://test-issuer.com',
-    };
-    getOpenIdConfig.mockReturnValue(mockOpenIdConfig);
-
-    // Mock openid-client (using the existing jest mock configuration)
-    if (client.genericGrantRequest) {
-      client.genericGrantRequest.mockResolvedValue({
-        access_token: 'mocked-graph-token',
-        expires_in: 3600,
-      });
-    }
-  });
-
-  describe('Dependency Contract Tests', () => {
-    it('should fail if getOpenIdConfig interface changes', () => {
-      // Reason: Ensure getOpenIdConfig returns expected structure
-      const config = getOpenIdConfig();
-
-      expect(config).toBeDefined();
-      expect(typeof config).toBe('object');
-      // Add specific property checks that GraphApiService depends on
-      expect(config).toHaveProperty('client_id');
-      expect(config).toHaveProperty('issuer');
-
-      // Ensure the function is callable
-      expect(typeof getOpenIdConfig).toBe('function');
-    });
-
-    it('should fail if openid-client.genericGrantRequest interface changes', () => {
-      // Reason: Ensure client.genericGrantRequest maintains expected signature
-      if (client.genericGrantRequest) {
-        expect(typeof client.genericGrantRequest).toBe('function');
-
-        // Test that it accepts the expected parameters
-        const mockCall = client.genericGrantRequest(
-          mockOpenIdConfig,
-          'urn:ietf:params:oauth:grant-type:jwt-bearer',
-          {
-            scope: 'test-scope',
-            assertion: 'test-token',
-            requested_token_use: 'on_behalf_of',
-          },
-        );
-
-        expect(mockCall).toBeDefined();
-      }
-    });
-
-    it('should fail if Microsoft Graph Client interface changes', () => {
-      // Reason: Ensure Graph Client maintains expected fluent API
-      expect(typeof Client.init).toBe('function');
-
-      const client = Client.init({ authProvider: jest.fn() });
-      expect(client).toHaveProperty('api');
-      expect(typeof client.api).toBe('function');
-    });
-  });
-
-  describe('createGraphClient', () => {
-    it('should create graph client with exchanged token', async () => {
-      const accessToken = 'test-access-token';
-      const sub = 'test-user-id';
-
-      const result = await GraphApiService.createGraphClient(accessToken, sub);
-
-      expect(getOpenIdConfig).toHaveBeenCalled();
-      expect(Client.init).toHaveBeenCalledWith({
-        authProvider: expect.any(Function),
-      });
-      expect(result).toBe(mockGraphClient);
-    });
-
-    it('should handle token exchange errors gracefully', async () => {
-      if (client.genericGrantRequest) {
-        client.genericGrantRequest.mockRejectedValue(new Error('Token exchange failed'));
-      }
-
-      await expect(GraphApiService.createGraphClient('invalid-token', 'test-user')).rejects.toThrow(
-        'Token exchange failed',
-      );
-    });
-  });
-
-  describe('exchangeTokenForGraphAccess', () => {
-    it('should return cached token if available', async () => {
-      const cachedToken = { access_token: 'cached-token' };
-      mockTokensCache.get.mockResolvedValue(cachedToken);
-
-      const result = await GraphApiService.exchangeTokenForGraphAccess(
-        mockOpenIdConfig,
-        'test-token',
-        'test-user',
-      );
-
-      expect(result).toBe('cached-token');
-      expect(mockTokensCache.get).toHaveBeenCalledWith('test-user:graph');
-      if (client.genericGrantRequest) {
-        expect(client.genericGrantRequest).not.toHaveBeenCalled();
-      }
-    });
-
-    it('should exchange token and cache result', async () => {
-      mockTokensCache.get.mockResolvedValue(null);
-
-      const result = await GraphApiService.exchangeTokenForGraphAccess(
-        mockOpenIdConfig,
-        'test-token',
-        'test-user',
-      );
-
-      if (client.genericGrantRequest) {
-        expect(client.genericGrantRequest).toHaveBeenCalledWith(
-          mockOpenIdConfig,
-          'urn:ietf:params:oauth:grant-type:jwt-bearer',
-          {
-            scope:
-              'https://graph.microsoft.com/User.Read https://graph.microsoft.com/People.Read https://graph.microsoft.com/Group.Read.All',
-            assertion: 'test-token',
-            requested_token_use: 'on_behalf_of',
-          },
-        );
-      }
-
-      expect(mockTokensCache.set).toHaveBeenCalledWith(
-        'test-user:graph',
-        { access_token: 'mocked-graph-token' },
-        3600000,
-      );
-
-      expect(result).toBe('mocked-graph-token');
-    });
-
-    it('should use custom scopes from environment', async () => {
-      const originalEnv = process.env.OPENID_GRAPH_SCOPES;
-      process.env.OPENID_GRAPH_SCOPES = 'Custom.Read,Custom.Write';
-
-      mockTokensCache.get.mockResolvedValue(null);
-
-      await GraphApiService.exchangeTokenForGraphAccess(
-        mockOpenIdConfig,
-        'test-token',
-        'test-user',
-      );
-
-      if (client.genericGrantRequest) {
-        expect(client.genericGrantRequest).toHaveBeenCalledWith(
-          mockOpenIdConfig,
-          'urn:ietf:params:oauth:grant-type:jwt-bearer',
-          {
-            scope:
-              'https://graph.microsoft.com/Custom.Read https://graph.microsoft.com/Custom.Write',
-            assertion: 'test-token',
-            requested_token_use: 'on_behalf_of',
-          },
-        );
-      }
-
-      process.env.OPENID_GRAPH_SCOPES = originalEnv;
-    });
-  });
-
-  describe('searchEntraIdPrincipals', () => {
-    // Mock data used by multiple tests
-    const mockContactsResponse = {
-      value: [
-        {
-          id: 'contact-user-1',
-          displayName: 'John Doe',
-          userPrincipalName: 'john@company.com',
-          mail: 'john@company.com',
-          personType: { class: 'Person', subclass: 'OrganizationUser' },
-          scoredEmailAddresses: [{ address: 'john@company.com', relevanceScore: 0.9 }],
-        },
-        {
-          id: 'contact-group-1',
-          displayName: 'Marketing Team',
-          mail: 'marketing@company.com',
-          personType: { class: 'Group', subclass: 'UnifiedGroup' },
-          scoredEmailAddresses: [{ address: 'marketing@company.com', relevanceScore: 0.8 }],
-        },
-      ],
-    };
-
-    const mockUsersResponse = {
-      value: [
-        {
-          id: 'dir-user-1',
-          displayName: 'Jane Smith',
-          userPrincipalName: 'jane@company.com',
-          mail: 'jane@company.com',
-        },
-      ],
-    };
-
-    const mockGroupsResponse = {
-      value: [
-        {
-          id: 'dir-group-1',
-          displayName: 'Development Team',
-          mail: 'dev@company.com',
-        },
-      ],
-    };
-
-    beforeEach(() => {
-      // Reset mock call history for each test
-      jest.clearAllMocks();
-
-      // Re-apply the Client.init mock after clearAllMocks
-      Client.init.mockReturnValue(mockGraphClient);
-
-      // Re-apply openid-client mock
-      if (client.genericGrantRequest) {
-        client.genericGrantRequest.mockResolvedValue({
-          access_token: 'mocked-graph-token',
-          expires_in: 3600,
-        });
-      }
-
-      // Re-apply cache mock
-      mockTokensCache.get.mockResolvedValue(null); // Force token exchange
-      mockTokensCache.set.mockResolvedValue();
-      getLogStores.mockReturnValue(mockTokensCache);
-      getOpenIdConfig.mockReturnValue(mockOpenIdConfig);
-    });
-
-    it('should return empty results for short queries', async () => {
-      const result = await GraphApiService.searchEntraIdPrincipals('token', 'user', 'a', 'all', 10);
-
-      expect(result).toEqual([]);
-      expect(mockGraphClient.api).not.toHaveBeenCalled();
-    });
-
-    it('should search contacts first and additional users for users type', async () => {
-      // Mock responses for this specific test
-      const contactsFilteredResponse = {
-        value: [
-          {
-            id: 'contact-user-1',
-            displayName: 'John Doe',
-            userPrincipalName: 'john@company.com',
-            mail: 'john@company.com',
-            personType: { class: 'Person', subclass: 'OrganizationUser' },
-            scoredEmailAddresses: [{ address: 'john@company.com', relevanceScore: 0.9 }],
-          },
-        ],
-      };
-
-      mockGraphClient.get
-        .mockResolvedValueOnce(contactsFilteredResponse) // contacts call
-        .mockResolvedValueOnce(mockUsersResponse); // users call
-
-      const result = await GraphApiService.searchEntraIdPrincipals(
-        'token',
-        'user',
-        'john',
-        'users',
-        10,
-      );
-
-      // Should call contacts first with user filter
-      expect(mockGraphClient.api).toHaveBeenCalledWith('/me/people');
-      expect(mockGraphClient.search).toHaveBeenCalledWith('"john"');
-      expect(mockGraphClient.filter).toHaveBeenCalledWith(
-        "personType/subclass eq 'OrganizationUser'",
-      );
-
-      // Should call users endpoint for additional results
-      expect(mockGraphClient.api).toHaveBeenCalledWith('/users');
-      expect(mockGraphClient.search).toHaveBeenCalledWith(
-        '"displayName:john" OR "userPrincipalName:john" OR "mail:john" OR "givenName:john" OR "surname:john"',
-      );
-
-      // Should return TPrincipalSearchResult array
-      expect(Array.isArray(result)).toBe(true);
-      expect(result).toHaveLength(2); // 1 from contacts + 1 from users
-      expect(result[0]).toMatchObject({
-        id: null,
-        type: 'user',
-        name: 'John Doe',
-        email: 'john@company.com',
-        source: 'entra',
-        idOnTheSource: 'contact-user-1',
-      });
-    });
-
-    it('should search groups endpoint only for groups type', async () => {
-      // Mock responses for this specific test - only groups endpoint called
-      mockGraphClient.get.mockResolvedValueOnce(mockGroupsResponse); // only groups call
-
-      const result = await GraphApiService.searchEntraIdPrincipals(
-        'token',
-        'user',
-        'team',
-        'groups',
-        10,
-      );
-
-      // Should NOT call contacts for groups type
-      expect(mockGraphClient.api).not.toHaveBeenCalledWith('/me/people');
-
-      // Should call groups endpoint only
-      expect(mockGraphClient.api).toHaveBeenCalledWith('/groups');
-      expect(mockGraphClient.search).toHaveBeenCalledWith(
-        '"displayName:team" OR "mail:team" OR "mailNickname:team"',
-      );
-
-      expect(Array.isArray(result)).toBe(true);
-      expect(result).toHaveLength(1); // 1 from groups only
-    });
-
-    it('should search all endpoints for all type', async () => {
-      // Mock responses for this specific test
-      mockGraphClient.get
-        .mockResolvedValueOnce(mockContactsResponse) // contacts call (both user and group)
-        .mockResolvedValueOnce(mockUsersResponse) // users call
-        .mockResolvedValueOnce(mockGroupsResponse); // groups call
-
-      const result = await GraphApiService.searchEntraIdPrincipals(
-        'token',
-        'user',
-        'test',
-        'all',
-        10,
-      );
-
-      // Should call contacts first with user filter
-      expect(mockGraphClient.api).toHaveBeenCalledWith('/me/people');
-      expect(mockGraphClient.search).toHaveBeenCalledWith('"test"');
-      expect(mockGraphClient.filter).toHaveBeenCalledWith(
-        "personType/subclass eq 'OrganizationUser'",
-      );
-
-      // Should call both users and groups endpoints
-      expect(mockGraphClient.api).toHaveBeenCalledWith('/users');
-      expect(mockGraphClient.api).toHaveBeenCalledWith('/groups');
-
-      expect(Array.isArray(result)).toBe(true);
-      expect(result).toHaveLength(4); // 2 from contacts + 1 from users + 1 from groups
-    });
-
-    it('should early exit if contacts reach limit', async () => {
-      // Mock contacts to return exactly the limit
-      const limitedContactsResponse = {
-        value: Array(10).fill({
-          id: 'contact-1',
-          displayName: 'Contact User',
-          mail: 'contact@company.com',
-          personType: { class: 'Person', subclass: 'OrganizationUser' },
-        }),
-      };
-
-      mockGraphClient.get.mockResolvedValueOnce(limitedContactsResponse);
-
-      const result = await GraphApiService.searchEntraIdPrincipals(
-        'token',
-        'user',
-        'test',
-        'all',
-        10,
-      );
-
-      // Should call contacts first
-      expect(mockGraphClient.api).toHaveBeenCalledWith('/me/people');
-      expect(mockGraphClient.search).toHaveBeenCalledWith('"test"');
-      // Should not call users endpoint since limit was reached
-      expect(mockGraphClient.api).not.toHaveBeenCalledWith('/users');
-
-      expect(result).toHaveLength(10);
-    });
-
-    it('should deduplicate results based on idOnTheSource', async () => {
-      // Mock responses with duplicate IDs
-      const duplicateContactsResponse = {
-        value: [
-          {
-            id: 'duplicate-id',
-            displayName: 'John Doe',
-            mail: 'john@company.com',
-            personType: { class: 'Person', subclass: 'OrganizationUser' },
-          },
-        ],
-      };
-
-      const duplicateUsersResponse = {
-        value: [
-          {
-            id: 'duplicate-id', // Same ID as contact
-            displayName: 'John Doe',
-            mail: 'john@company.com',
-          },
-        ],
-      };
-
-      mockGraphClient.get
-        .mockResolvedValueOnce(duplicateContactsResponse)
-        .mockResolvedValueOnce(duplicateUsersResponse);
-
-      const result = await GraphApiService.searchEntraIdPrincipals(
-        'token',
-        'user',
-        'john',
-        'users',
-        10,
-      );
-
-      // Should only return one result despite duplicate IDs
-      expect(result).toHaveLength(1);
-      expect(result[0].idOnTheSource).toBe('duplicate-id');
-    });
-
-    it('should handle Graph API errors gracefully', async () => {
-      mockGraphClient.get.mockRejectedValue(new Error('Graph API error'));
-
-      const result = await GraphApiService.searchEntraIdPrincipals(
-        'token',
-        'user',
-        'test',
-        'all',
-        10,
-      );
-
-      expect(result).toEqual([]);
-    });
-  });
-
-  describe('getUserEntraGroups', () => {
-    it('should fetch user groups from memberOf endpoint', async () => {
-      const mockGroupsResponse = {
-        value: [
-          {
-            id: 'group-1',
-          },
-          {
-            id: 'group-2',
-          },
-        ],
-      };
-
-      mockGraphClient.get.mockResolvedValue(mockGroupsResponse);
-
-      const result = await GraphApiService.getUserEntraGroups('token', 'user');
-
-      expect(mockGraphClient.api).toHaveBeenCalledWith('/me/memberOf');
-      expect(mockGraphClient.select).toHaveBeenCalledWith('id');
-
-      expect(result).toHaveLength(2);
-      expect(result).toEqual(['group-1', 'group-2']);
-    });
-
-    it('should return empty array on error', async () => {
-      mockGraphClient.get.mockRejectedValue(new Error('API error'));
-
-      const result = await GraphApiService.getUserEntraGroups('token', 'user');
-
-      expect(result).toEqual([]);
-    });
-
-    it('should handle empty response', async () => {
-      const mockGroupsResponse = {
-        value: [],
-      };
-
-      mockGraphClient.get.mockResolvedValue(mockGroupsResponse);
-
-      const result = await GraphApiService.getUserEntraGroups('token', 'user');
-
-      expect(result).toEqual([]);
-    });
-
-    it('should handle missing value property', async () => {
-      mockGraphClient.get.mockResolvedValue({});
-
-      const result = await GraphApiService.getUserEntraGroups('token', 'user');
-
-      expect(result).toEqual([]);
-    });
-  });
-
-  describe('testGraphApiAccess', () => {
-    beforeEach(() => {
-      jest.clearAllMocks();
-    });
-
-    it('should test all permissions and return success results', async () => {
-      // Mock successful responses for all tests
-      mockGraphClient.get
-        .mockResolvedValueOnce({ id: 'user-123', displayName: 'Test User' }) // /me test
-        .mockResolvedValueOnce({ value: [] }) // people OrganizationUser test
-        .mockResolvedValueOnce({ value: [] }) // people UnifiedGroup test
-        .mockResolvedValueOnce({ value: [] }) // /users endpoint test
-        .mockResolvedValueOnce({ value: [] }); // /groups endpoint test
-
-      const result = await GraphApiService.testGraphApiAccess('token', 'user');
-
-      expect(result).toEqual({
-        userAccess: true,
-        peopleAccess: true,
-        groupsAccess: true,
-        usersEndpointAccess: true,
-        groupsEndpointAccess: true,
-        errors: [],
-      });
-
-      // Verify all endpoints were tested
-      expect(mockGraphClient.api).toHaveBeenCalledWith('/me');
-      expect(mockGraphClient.api).toHaveBeenCalledWith('/me/people');
-      expect(mockGraphClient.api).toHaveBeenCalledWith('/users');
-      expect(mockGraphClient.api).toHaveBeenCalledWith('/groups');
-      expect(mockGraphClient.filter).toHaveBeenCalledWith(
-        "personType/subclass eq 'OrganizationUser'",
-      );
-      expect(mockGraphClient.filter).toHaveBeenCalledWith("personType/subclass eq 'UnifiedGroup'");
-      expect(mockGraphClient.search).toHaveBeenCalledWith('"displayName:test"');
-    });
-
-    it('should handle partial failures and record errors', async () => {
-      // Mock mixed success/failure responses
-      mockGraphClient.get
-        .mockResolvedValueOnce({ id: 'user-123', displayName: 'Test User' }) // /me success
-        .mockRejectedValueOnce(new Error('People access denied')) // people OrganizationUser fail
-        .mockResolvedValueOnce({ value: [] }) // people UnifiedGroup success
-        .mockRejectedValueOnce(new Error('Users endpoint access denied')) // /users fail
-        .mockResolvedValueOnce({ value: [] }); // /groups success
-
-      const result = await GraphApiService.testGraphApiAccess('token', 'user');
-
-      expect(result).toEqual({
-        userAccess: true,
-        peopleAccess: false,
-        groupsAccess: true,
-        usersEndpointAccess: false,
-        groupsEndpointAccess: true,
-        errors: [
-          'People.Read (OrganizationUser): People access denied',
-          'Users endpoint: Users endpoint access denied',
-        ],
-      });
-    });
-
-    it('should handle complete Graph client creation failure', async () => {
-      // Mock token exchange failure to test error handling
-      if (client.genericGrantRequest) {
-        client.genericGrantRequest.mockRejectedValue(new Error('Token exchange failed'));
-      }
-
-      const result = await GraphApiService.testGraphApiAccess('invalid-token', 'user');
-
-      expect(result).toEqual({
-        userAccess: false,
-        peopleAccess: false,
-        groupsAccess: false,
-        usersEndpointAccess: false,
-        groupsEndpointAccess: false,
-        errors: ['Token exchange failed'],
-      });
-    });
-
-    it('should record all permission errors', async () => {
-      // Mock all requests to fail
-      mockGraphClient.get
-        .mockRejectedValueOnce(new Error('User.Read denied'))
-        .mockRejectedValueOnce(new Error('People.Read OrganizationUser denied'))
-        .mockRejectedValueOnce(new Error('People.Read UnifiedGroup denied'))
-        .mockRejectedValueOnce(new Error('Users directory access denied'))
-        .mockRejectedValueOnce(new Error('Groups directory access denied'));
-
-      const result = await GraphApiService.testGraphApiAccess('token', 'user');
-
-      expect(result).toEqual({
-        userAccess: false,
-        peopleAccess: false,
-        groupsAccess: false,
-        usersEndpointAccess: false,
-        groupsEndpointAccess: false,
-        errors: [
-          'User.Read: User.Read denied',
-          'People.Read (OrganizationUser): People.Read OrganizationUser denied',
-          'People.Read (UnifiedGroup): People.Read UnifiedGroup denied',
-          'Users endpoint: Users directory access denied',
-          'Groups endpoint: Groups directory access denied',
-        ],
-      });
-    });
-
-    it('should test new endpoints with correct search patterns', async () => {
-      // Mock successful responses for endpoint testing
-      mockGraphClient.get
-        .mockResolvedValueOnce({ id: 'user-123', displayName: 'Test User' }) // /me
-        .mockResolvedValueOnce({ value: [] }) // people OrganizationUser
-        .mockResolvedValueOnce({ value: [] }) // people UnifiedGroup
-        .mockResolvedValueOnce({ value: [] }) // /users
-        .mockResolvedValueOnce({ value: [] }); // /groups
-
-      await GraphApiService.testGraphApiAccess('token', 'user');
-
-      // Verify /users endpoint test
-      expect(mockGraphClient.api).toHaveBeenCalledWith('/users');
-      expect(mockGraphClient.search).toHaveBeenCalledWith('"displayName:test"');
-      expect(mockGraphClient.select).toHaveBeenCalledWith('id,displayName,userPrincipalName');
-
-      // Verify /groups endpoint test
-      expect(mockGraphClient.api).toHaveBeenCalledWith('/groups');
-      expect(mockGraphClient.select).toHaveBeenCalledWith('id,displayName,mail');
-    });
-
-    it('should handle endpoint-specific permission failures', async () => {
-      // Mock specific endpoint failures
-      mockGraphClient.get
-        .mockResolvedValueOnce({ id: 'user-123', displayName: 'Test User' }) // /me success
-        .mockResolvedValueOnce({ value: [] }) // people OrganizationUser success
-        .mockResolvedValueOnce({ value: [] }) // people UnifiedGroup success
-        .mockRejectedValueOnce(new Error('Insufficient privileges')) // /users fail (User.Read.All needed)
-        .mockRejectedValueOnce(new Error('Access denied to groups')); // /groups fail (Group.Read.All needed)
-
-      const result = await GraphApiService.testGraphApiAccess('token', 'user');
-
-      expect(result).toEqual({
-        userAccess: true,
-        peopleAccess: true,
-        groupsAccess: true,
-        usersEndpointAccess: false,
-        groupsEndpointAccess: false,
-        errors: [
-          'Users endpoint: Insufficient privileges',
-          'Groups endpoint: Access denied to groups',
-        ],
-      });
-    });
-  });
-});
--- a/api/server/services/PermissionService.js
+++ b/api/server/services/PermissionService.js
@@ -1,721 +0,0 @@
-const mongoose = require('mongoose');
-const { getTransactionSupport, logger } = require('@librechat/data-schemas');
-const { isEnabled } = require('~/server/utils');
-const {
-  entraIdPrincipalFeatureEnabled,
-  getUserEntraGroups,
-  getUserOwnedEntraGroups,
-  getGroupMembers,
-  getGroupOwners,
-} = require('~/server/services/GraphApiService');
-const {
-  findGroupByExternalId,
-  findRoleByIdentifier,
-  getUserPrincipals,
-  createGroup,
-  createUser,
-  updateUser,
-  findUser,
-  grantPermission: grantPermissionACL,
-  findAccessibleResources: findAccessibleResourcesACL,
-  hasPermission,
-  getEffectivePermissions: getEffectivePermissionsACL,
-  findEntriesByPrincipalsAndResource,
-} = require('~/models');
-const { AclEntry, AccessRole, Group } = require('~/db/models');
-
-/** @type {boolean|null} */
-let transactionSupportCache = null;
-
-/**
- * @import { TPrincipal } from 'librechat-data-provider'
- */
-/**
- * Grant a permission to a principal for a resource using a role
- * @param {Object} params - Parameters for granting role-based permission
- * @param {string} params.principalType - 'user', 'group', or 'public'
- * @param {string|mongoose.Types.ObjectId|null} params.principalId - The ID of the principal (null for 'public')
- * @param {string} params.resourceType - Type of resource (e.g., 'agent')
- * @param {string|mongoose.Types.ObjectId} params.resourceId - The ID of the resource
- * @param {string} params.accessRoleId - The ID of the role (e.g., 'agent_viewer', 'agent_editor')
- * @param {string|mongoose.Types.ObjectId} params.grantedBy - User ID granting the permission
- * @param {mongoose.ClientSession} [params.session] - Optional MongoDB session for transactions
- * @returns {Promise<Object>} The created or updated ACL entry
- */
-const grantPermission = async ({
-  principalType,
-  principalId,
-  resourceType,
-  resourceId,
-  accessRoleId,
-  grantedBy,
-  session,
-}) => {
-  try {
-    if (!['user', 'group', 'public'].includes(principalType)) {
-      throw new Error(`Invalid principal type: ${principalType}`);
-    }
-
-    if (principalType !== 'public' && !principalId) {
-      throw new Error('Principal ID is required for user and group principals');
-    }
-
-    if (principalId && !mongoose.Types.ObjectId.isValid(principalId)) {
-      throw new Error(`Invalid principal ID: ${principalId}`);
-    }
-
-    if (!resourceId || !mongoose.Types.ObjectId.isValid(resourceId)) {
-      throw new Error(`Invalid resource ID: ${resourceId}`);
-    }
-
-    // Get the role to determine permission bits
-    const role = await findRoleByIdentifier(accessRoleId);
-    if (!role) {
-      throw new Error(`Role ${accessRoleId} not found`);
-    }
-
-    // Ensure the role is for the correct resource type
-    if (role.resourceType !== resourceType) {
-      throw new Error(
-        `Role ${accessRoleId} is for ${role.resourceType} resources, not ${resourceType}`,
-      );
-    }
-    return await grantPermissionACL(
-      principalType,
-      principalId,
-      resourceType,
-      resourceId,
-      role.permBits,
-      grantedBy,
-      session,
-      role._id,
-    );
-  } catch (error) {
-    logger.error(`[PermissionService.grantPermission] Error: ${error.message}`);
-    throw error;
-  }
-};
-
-/**
- * Check if a user has specific permission bits on a resource
- * @param {Object} params - Parameters for checking permissions
- * @param {string|mongoose.Types.ObjectId} params.userId - The ID of the user
- * @param {string} params.resourceType - Type of resource (e.g., 'agent')
- * @param {string|mongoose.Types.ObjectId} params.resourceId - The ID of the resource
- * @param {number} params.requiredPermissions - The permission bits required (e.g., 1 for VIEW, 3 for VIEW+EDIT)
- * @returns {Promise<boolean>} Whether the user has the required permission bits
- */
-const checkPermission = async ({ userId, resourceType, resourceId, requiredPermission }) => {
-  try {
-    if (typeof requiredPermission !== 'number' || requiredPermission < 1) {
-      throw new Error('requiredPermission must be a positive number');
-    }
-
-    // Get all principals for the user (user + groups + public)
-    const principals = await getUserPrincipals(userId);
-
-    if (principals.length === 0) {
-      return false;
-    }
-
-    return await hasPermission(principals, resourceType, resourceId, requiredPermission);
-  } catch (error) {
-    logger.error(`[PermissionService.checkPermission] Error: ${error.message}`);
-    // Re-throw validation errors
-    if (error.message.includes('requiredPermission must be')) {
-      throw error;
-    }
-    return false;
-  }
-};
-
-/**
- * Get effective permission bitmask for a user on a resource
- * @param {Object} params - Parameters for getting effective permissions
- * @param {string|mongoose.Types.ObjectId} params.userId - The ID of the user
- * @param {string} params.resourceType - Type of resource (e.g., 'agent')
- * @param {string|mongoose.Types.ObjectId} params.resourceId - The ID of the resource
- * @returns {Promise<number>} Effective permission bitmask
- */
-const getEffectivePermissions = async ({ userId, resourceType, resourceId }) => {
-  try {
-    // Get all principals for the user (user + groups + public)
-    const principals = await getUserPrincipals(userId);
-
-    if (principals.length === 0) {
-      return 0;
-    }
-    return await getEffectivePermissionsACL(principals, resourceType, resourceId);
-  } catch (error) {
-    logger.error(`[PermissionService.getEffectivePermissions] Error: ${error.message}`);
-    return 0;
-  }
-};
-
-/**
- * Find all resources of a specific type that a user has access to with specific permission bits
- * @param {Object} params - Parameters for finding accessible resources
- * @param {string|mongoose.Types.ObjectId} params.userId - The ID of the user
- * @param {string} params.resourceType - Type of resource (e.g., 'agent')
- * @param {number} params.requiredPermissions - The minimum permission bits required (e.g., 1 for VIEW, 3 for VIEW+EDIT)
- * @returns {Promise<Array>} Array of resource IDs
- */
-const findAccessibleResources = async ({ userId, resourceType, requiredPermissions }) => {
-  try {
-    if (typeof requiredPermissions !== 'number' || requiredPermissions < 1) {
-      throw new Error('requiredPermissions must be a positive number');
-    }
-
-    // Get all principals for the user (user + groups + public)
-    const principalsList = await getUserPrincipals(userId);
-
-    if (principalsList.length === 0) {
-      return [];
-    }
-    return await findAccessibleResourcesACL(principalsList, resourceType, requiredPermissions);
-  } catch (error) {
-    logger.error(`[PermissionService.findAccessibleResources] Error: ${error.message}`);
-    // Re-throw validation errors
-    if (error.message.includes('requiredPermissions must be')) {
-      throw error;
-    }
-    return [];
-  }
-};
-
-/**
- * Find all publicly accessible resources of a specific type
- * @param {Object} params - Parameters for finding publicly accessible resources
- * @param {string} params.resourceType - Type of resource (e.g., 'agent')
- * @param {number} params.requiredPermissions - The minimum permission bits required (e.g., 1 for VIEW, 3 for VIEW+EDIT)
- * @returns {Promise<Array>} Array of resource IDs
- */
-const findPubliclyAccessibleResources = async ({ resourceType, requiredPermissions }) => {
-  try {
-    if (typeof requiredPermissions !== 'number' || requiredPermissions < 1) {
-      throw new Error('requiredPermissions must be a positive number');
-    }
-
-    // Find all public ACL entries where the public principal has at least the required permission bits
-    const entries = await AclEntry.find({
-      principalType: 'public',
-      resourceType,
-      permBits: { $bitsAllSet: requiredPermissions },
-    }).distinct('resourceId');
-
-    return entries;
-  } catch (error) {
-    logger.error(`[PermissionService.findPubliclyAccessibleResources] Error: ${error.message}`);
-    // Re-throw validation errors
-    if (error.message.includes('requiredPermissions must be')) {
-      throw error;
-    }
-    return [];
-  }
-};
-
-/**
- * Get available roles for a resource type
- * @param {Object} params - Parameters for getting available roles
- * @param {string} params.resourceType - Type of resource (e.g., 'agent')
- * @returns {Promise<Array>} Array of role definitions
- */
-const getAvailableRoles = async ({ resourceType }) => {
-  try {
-    return await AccessRole.find({ resourceType }).lean();
-  } catch (error) {
-    logger.error(`[PermissionService.getAvailableRoles] Error: ${error.message}`);
-    return [];
-  }
-};
-
-/**
- * Ensures a principal exists in the database based on TPrincipal data
- * Creates user if it doesn't exist locally (for Entra ID users)
- * @param {Object} principal - TPrincipal object from frontend
- * @param {string} principal.type - 'user', 'group', or 'public'
- * @param {string} [principal.id] - Local database ID (null for Entra ID principals not yet synced)
- * @param {string} principal.name - Display name
- * @param {string} [principal.email] - Email address
- * @param {string} [principal.source] - 'local' or 'entra'
- * @param {string} [principal.idOnTheSource] - Entra ID object ID for external principals
- * @returns {Promise<string|null>} Returns the principalId for database operations, null for public
- */
-const ensurePrincipalExists = async function (principal) {
-  if (principal.type === 'public') {
-    return null;
-  }
-
-  if (principal.id) {
-    return principal.id;
-  }
-
-  if (principal.type === 'user' && principal.source === 'entra') {
-    if (!principal.email || !principal.idOnTheSource) {
-      throw new Error('Entra ID user principals must have email and idOnTheSource');
-    }
-
-    let existingUser = await findUser({ idOnTheSource: principal.idOnTheSource });
-
-    if (!existingUser) {
-      existingUser = await findUser({ email: principal.email.toLowerCase() });
-    }
-
-    if (existingUser) {
-      if (!existingUser.idOnTheSource && principal.idOnTheSource) {
-        await updateUser(existingUser._id, {
-          idOnTheSource: principal.idOnTheSource,
-          provider: 'openid',
-        });
-      }
-      return existingUser._id.toString();
-    }
-
-    const userData = {
-      name: principal.name,
-      email: principal.email.toLowerCase(),
-      emailVerified: false,
-      provider: 'openid',
-      idOnTheSource: principal.idOnTheSource,
-    };
-
-    const userId = await createUser(userData, true, false);
-    return userId.toString();
-  }
-
-  if (principal.type === 'group') {
-    throw new Error('Group principals should be handled by group-specific methods');
-  }
-
-  throw new Error(`Unsupported principal type: ${principal.type}`);
-};
-
-/**
- * Ensures a group principal exists in the database based on TPrincipal data
- * Creates group if it doesn't exist locally (for Entra ID groups)
- * For Entra ID groups, always synchronizes member IDs when authentication context is provided
- * @param {Object} principal - TPrincipal object from frontend
- * @param {string} principal.type - Must be 'group'
- * @param {string} [principal.id] - Local database ID (null for Entra ID principals not yet synced)
- * @param {string} principal.name - Display name
- * @param {string} [principal.email] - Email address
- * @param {string} [principal.description] - Group description
- * @param {string} [principal.source] - 'local' or 'entra'
- * @param {string} [principal.idOnTheSource] - Entra ID object ID for external principals
- * @param {Object} [authContext] - Optional authentication context for fetching member data
- * @param {string} [authContext.accessToken] - Access token for Graph API calls
- * @param {string} [authContext.sub] - Subject identifier
- * @returns {Promise<string>} Returns the groupId for database operations
- */
-const ensureGroupPrincipalExists = async function (principal, authContext = null) {
-  if (principal.type !== 'group') {
-    throw new Error(`Invalid principal type: ${principal.type}. Expected 'group'`);
-  }
-
-  if (principal.source === 'entra') {
-    if (!principal.name || !principal.idOnTheSource) {
-      throw new Error('Entra ID group principals must have name and idOnTheSource');
-    }
-
-    let memberIds = [];
-    if (authContext && authContext.accessToken && authContext.sub) {
-      try {
-        memberIds = await getGroupMembers(
-          authContext.accessToken,
-          authContext.sub,
-          principal.idOnTheSource,
-        );
-
-        // Include group owners as members if feature is enabled
-        if (isEnabled(process.env.ENTRA_ID_INCLUDE_OWNERS_AS_MEMBERS)) {
-          const ownerIds = await getGroupOwners(
-            authContext.accessToken,
-            authContext.sub,
-            principal.idOnTheSource,
-          );
-          if (ownerIds && ownerIds.length > 0) {
-            memberIds.push(...ownerIds);
-            // Remove duplicates
-            memberIds = [...new Set(memberIds)];
-          }
-        }
-      } catch (error) {
-        logger.error('Failed to fetch group members from Graph API:', error);
-      }
-    }
-
-    let existingGroup = await findGroupByExternalId(principal.idOnTheSource, 'entra');
-
-    if (!existingGroup && principal.email) {
-      existingGroup = await Group.findOne({ email: principal.email.toLowerCase() }).lean();
-    }
-
-    if (existingGroup) {
-      const updateData = {};
-      let needsUpdate = false;
-
-      if (!existingGroup.idOnTheSource && principal.idOnTheSource) {
-        updateData.idOnTheSource = principal.idOnTheSource;
-        updateData.source = 'entra';
-        needsUpdate = true;
-      }
-
-      if (principal.description && existingGroup.description !== principal.description) {
-        updateData.description = principal.description;
-        needsUpdate = true;
-      }
-
-      if (principal.email && existingGroup.email !== principal.email.toLowerCase()) {
-        updateData.email = principal.email.toLowerCase();
-        needsUpdate = true;
-      }
-
-      if (authContext && authContext.accessToken && authContext.sub) {
-        updateData.memberIds = memberIds;
-        needsUpdate = true;
-      }
-
-      if (needsUpdate) {
-        await Group.findByIdAndUpdate(existingGroup._id, { $set: updateData }, { new: true });
-      }
-
-      return existingGroup._id.toString();
-    }
-
-    const groupData = {
-      name: principal.name,
-      source: 'entra',
-      idOnTheSource: principal.idOnTheSource,
-      memberIds: memberIds, // Store idOnTheSource values of group members (empty if no auth context)
-    };
-
-    if (principal.email) {
-      groupData.email = principal.email.toLowerCase();
-    }
-
-    if (principal.description) {
-      groupData.description = principal.description;
-    }
-
-    const newGroup = await createGroup(groupData);
-    return newGroup._id.toString();
-  }
-  if (principal.id && authContext == null) {
-    return principal.id;
-  }
-
-  throw new Error(`Unsupported group principal source: ${principal.source}`);
-};
-
-/**
- * Synchronize user's Entra ID group memberships on sign-in
- * Gets user's group IDs from GraphAPI and updates memberships only for existing groups in database
- * Optionally includes groups the user owns if ENTRA_ID_INCLUDE_OWNERS_AS_MEMBERS is enabled
- * @param {Object} user - User object with authentication context
- * @param {string} user.openidId - User's OpenID subject identifier
- * @param {string} user.idOnTheSource - User's Entra ID (oid from token claims)
- * @param {string} user.provider - Authentication provider ('openid')
- * @param {string} accessToken - Access token for Graph API calls
- * @param {mongoose.ClientSession} [session] - Optional MongoDB session for transactions
- * @returns {Promise<void>}
- */
-const syncUserEntraGroupMemberships = async (user, accessToken, session = null) => {
-  try {
-    if (!entraIdPrincipalFeatureEnabled(user) || !accessToken || !user.idOnTheSource) {
-      return;
-    }
-
-    const memberGroupIds = await getUserEntraGroups(accessToken, user.openidId);
-    let allGroupIds = [...(memberGroupIds || [])];
-
-    // Include owned groups if feature is enabled
-    if (isEnabled(process.env.ENTRA_ID_INCLUDE_OWNERS_AS_MEMBERS)) {
-      const ownedGroupIds = await getUserOwnedEntraGroups(accessToken, user.openidId);
-      if (ownedGroupIds && ownedGroupIds.length > 0) {
-        allGroupIds.push(...ownedGroupIds);
-        // Remove duplicates
-        allGroupIds = [...new Set(allGroupIds)];
-      }
-    }
-
-    if (!allGroupIds || allGroupIds.length === 0) {
-      return;
-    }
-
-    const sessionOptions = session ? { session } : {};
-
-    await Group.updateMany(
-      {
-        idOnTheSource: { $in: allGroupIds },
-        source: 'entra',
-        memberIds: { $ne: user.idOnTheSource },
-      },
-      { $addToSet: { memberIds: user.idOnTheSource } },
-      sessionOptions,
-    );
-
-    await Group.updateMany(
-      {
-        source: 'entra',
-        memberIds: user.idOnTheSource,
-        idOnTheSource: { $nin: allGroupIds },
-      },
-      { $pull: { memberIds: user.idOnTheSource } },
-      sessionOptions,
-    );
-  } catch (error) {
-    logger.error(`[PermissionService.syncUserEntraGroupMemberships] Error syncing groups:`, error);
-  }
-};
-
-/**
- * Check if public has a specific permission on a resource
- * @param {Object} params - Parameters for checking public permission
- * @param {string} params.resourceType - Type of resource (e.g., 'agent')
- * @param {string|mongoose.Types.ObjectId} params.resourceId - The ID of the resource
- * @param {number} params.requiredPermissions - The permission bits required (e.g., 1 for VIEW, 3 for VIEW+EDIT)
- * @returns {Promise<boolean>} Whether public has the required permission bits
- */
-const hasPublicPermission = async ({ resourceType, resourceId, requiredPermissions }) => {
-  try {
-    if (typeof requiredPermissions !== 'number' || requiredPermissions < 1) {
-      throw new Error('requiredPermissions must be a positive number');
-    }
-
-    // Use public principal to check permissions
-    const publicPrincipal = [{ principalType: 'public' }];
-
-    const entries = await findEntriesByPrincipalsAndResource(
-      publicPrincipal,
-      resourceType,
-      resourceId,
-    );
-
-    // Check if any entry has the required permission bits
-    return entries.some((entry) => (entry.permBits & requiredPermissions) === requiredPermissions);
-  } catch (error) {
-    logger.error(`[PermissionService.hasPublicPermission] Error: ${error.message}`);
-    // Re-throw validation errors
-    if (error.message.includes('requiredPermissions must be')) {
-      throw error;
-    }
-    return false;
-  }
-};
-
-/**
- * Bulk update permissions for a resource (grant, update, revoke)
- * Efficiently handles multiple permission changes in a single transaction
- *
- * @param {Object} params - Parameters for bulk permission update
- * @param {string} params.resourceType - Type of resource (e.g., 'agent')
- * @param {string|mongoose.Types.ObjectId} params.resourceId - The ID of the resource
- * @param {Array<TPrincipal>} params.updatedPrincipals - Array of principals to grant/update permissions for
- * @param {Array<TPrincipal>} params.revokedPrincipals - Array of principals to revoke permissions from
- * @param {string|mongoose.Types.ObjectId} params.grantedBy - User ID making the changes
- * @param {mongoose.ClientSession} [params.session] - Optional MongoDB session for transactions
- * @returns {Promise<Object>} Results object with granted, updated, revoked arrays and error details
- */
-const bulkUpdateResourcePermissions = async ({
-  resourceType,
-  resourceId,
-  updatedPrincipals = [],
-  revokedPrincipals = [],
-  grantedBy,
-  session,
-}) => {
-  const supportsTransactions = await getTransactionSupport(mongoose, transactionSupportCache);
-  transactionSupportCache = supportsTransactions;
-  let localSession = session;
-  let shouldEndSession = false;
-
-  try {
-    if (!Array.isArray(updatedPrincipals)) {
-      throw new Error('updatedPrincipals must be an array');
-    }
-
-    if (!Array.isArray(revokedPrincipals)) {
-      throw new Error('revokedPrincipals must be an array');
-    }
-
-    if (!resourceId || !mongoose.Types.ObjectId.isValid(resourceId)) {
-      throw new Error(`Invalid resource ID: ${resourceId}`);
-    }
-
-    if (!localSession && supportsTransactions) {
-      localSession = await mongoose.startSession();
-      localSession.startTransaction();
-      shouldEndSession = true;
-    }
-
-    const sessionOptions = localSession ? { session: localSession } : {};
-
-    const roles = await AccessRole.find({ resourceType }).lean();
-    const rolesMap = new Map();
-    roles.forEach((role) => {
-      rolesMap.set(role.accessRoleId, role);
-    });
-
-    const results = {
-      granted: [],
-      updated: [],
-      revoked: [],
-      errors: [],
-    };
-
-    const bulkWrites = [];
-
-    for (const principal of updatedPrincipals) {
-      try {
-        if (!principal.accessRoleId) {
-          results.errors.push({
-            principal,
-            error: 'accessRoleId is required for updated principals',
-          });
-          continue;
-        }
-
-        const role = rolesMap.get(principal.accessRoleId);
-        if (!role) {
-          results.errors.push({
-            principal,
-            error: `Role ${principal.accessRoleId} not found`,
-          });
-          continue;
-        }
-
-        const query = {
-          principalType: principal.type,
-          resourceType,
-          resourceId,
-        };
-
-        if (principal.type !== 'public') {
-          query.principalId = principal.id;
-        }
-
-        const update = {
-          $set: {
-            permBits: role.permBits,
-            roleId: role._id,
-            grantedBy,
-            grantedAt: new Date(),
-          },
-          $setOnInsert: {
-            principalType: principal.type,
-            resourceType,
-            resourceId,
-            ...(principal.type !== 'public' && {
-              principalId: principal.id,
-              principalModel: principal.type === 'user' ? 'User' : 'Group',
-            }),
-          },
-        };
-
-        bulkWrites.push({
-          updateOne: {
-            filter: query,
-            update: update,
-            upsert: true,
-          },
-        });
-
-        results.granted.push({
-          type: principal.type,
-          id: principal.id,
-          name: principal.name,
-          email: principal.email,
-          source: principal.source,
-          avatar: principal.avatar,
-          description: principal.description,
-          idOnTheSource: principal.idOnTheSource,
-          accessRoleId: principal.accessRoleId,
-          memberCount: principal.memberCount,
-          memberIds: principal.memberIds,
-        });
-      } catch (error) {
-        results.errors.push({
-          principal,
-          error: error.message,
-        });
-      }
-    }
-
-    if (bulkWrites.length > 0) {
-      await AclEntry.bulkWrite(bulkWrites, sessionOptions);
-    }
-
-    const deleteQueries = [];
-    for (const principal of revokedPrincipals) {
-      try {
-        const query = {
-          principalType: principal.type,
-          resourceType,
-          resourceId,
-        };
-
-        if (principal.type !== 'public') {
-          query.principalId = principal.id;
-        }
-
-        deleteQueries.push(query);
-
-        results.revoked.push({
-          type: principal.type,
-          id: principal.id,
-          name: principal.name,
-          email: principal.email,
-          source: principal.source,
-          avatar: principal.avatar,
-          description: principal.description,
-          idOnTheSource: principal.idOnTheSource,
-          memberCount: principal.memberCount,
-        });
-      } catch (error) {
-        results.errors.push({
-          principal,
-          error: error.message,
-        });
-      }
-    }
-
-    if (deleteQueries.length > 0) {
-      await AclEntry.deleteMany(
-        {
-          $or: deleteQueries,
-        },
-        sessionOptions,
-      );
-    }
-
-    if (shouldEndSession && supportsTransactions) {
-      await localSession.commitTransaction();
-    }
-
-    return results;
-  } catch (error) {
-    if (shouldEndSession && supportsTransactions) {
-      await localSession.abortTransaction();
-    }
-    logger.error(`[PermissionService.bulkUpdateResourcePermissions] Error: ${error.message}`);
-    throw error;
-  } finally {
-    if (shouldEndSession && localSession) {
-      localSession.endSession();
-    }
-  }
-};
-
-module.exports = {
-  grantPermission,
-  checkPermission,
-  getEffectivePermissions,
-  findAccessibleResources,
-  findPubliclyAccessibleResources,
-  hasPublicPermission,
-  getAvailableRoles,
-  bulkUpdateResourcePermissions,
-  ensurePrincipalExists,
-  ensureGroupPrincipalExists,
-  syncUserEntraGroupMemberships,
-};
--- a/api/server/services/PermissionService.spec.js
+++ b/api/server/services/PermissionService.spec.js
--- a/api/server/services/start/interface.js
+++ b/api/server/services/start/interface.js
@@ -52,24 +52,6 @@ async function loadDefaultInterface(config, configDefaults, roleName = SystemRol
    webSearch: interfaceConfig?.webSearch ?? defaults.webSearch,
    fileSearch: interfaceConfig?.fileSearch ?? defaults.fileSearch,
    customWelcome: interfaceConfig?.customWelcome ?? defaults.customWelcome,
-    peoplePicker: {
-      admin: {
-        users: interfaceConfig?.peoplePicker?.admin?.users ?? defaults.peoplePicker?.admin.users,
-        groups: interfaceConfig?.peoplePicker?.admin?.groups ?? defaults.peoplePicker?.admin.groups,
-      },
-      user: {
-        users: interfaceConfig?.peoplePicker?.user?.users ?? defaults.peoplePicker?.user.users,
-        groups: interfaceConfig?.peoplePicker?.user?.groups ?? defaults.peoplePicker?.user.groups,
-      },
-    },
-    marketplace: {
-      admin: {
-        use: interfaceConfig?.marketplace?.admin?.use ?? defaults.marketplace?.admin.use,
-      },
-      user: {
-        use: interfaceConfig?.marketplace?.user?.use ?? defaults.marketplace?.user.use,
-      },
-    },
  });

  await updateAccessPermissions(roleName, {
@@ -84,13 +66,6 @@ async function loadDefaultInterface(config, configDefaults, roleName = SystemRol
    [PermissionTypes.TEMPORARY_CHAT]: { [Permissions.USE]: loadedInterface.temporaryChat },
    [PermissionTypes.RUN_CODE]: { [Permissions.USE]: loadedInterface.runCode },
    [PermissionTypes.WEB_SEARCH]: { [Permissions.USE]: loadedInterface.webSearch },
-    [PermissionTypes.PEOPLE_PICKER]: {
-      [Permissions.VIEW_USERS]: loadedInterface.peoplePicker.user?.users,
-      [Permissions.VIEW_GROUPS]: loadedInterface.peoplePicker.user?.groups,
-    },
-    [PermissionTypes.MARKETPLACE]: {
-      [Permissions.USE]: loadedInterface.marketplace.user?.use,
-    },
    [PermissionTypes.FILE_SEARCH]: { [Permissions.USE]: loadedInterface.fileSearch },
  });
  await updateAccessPermissions(SystemRoles.ADMIN, {
@@ -105,13 +80,6 @@ async function loadDefaultInterface(config, configDefaults, roleName = SystemRol
    [PermissionTypes.TEMPORARY_CHAT]: { [Permissions.USE]: loadedInterface.temporaryChat },
    [PermissionTypes.RUN_CODE]: { [Permissions.USE]: loadedInterface.runCode },
    [PermissionTypes.WEB_SEARCH]: { [Permissions.USE]: loadedInterface.webSearch },
-    [PermissionTypes.PEOPLE_PICKER]: {
-      [Permissions.VIEW_USERS]: loadedInterface.peoplePicker.admin?.users,
-      [Permissions.VIEW_GROUPS]: loadedInterface.peoplePicker.admin?.groups,
-    },
-    [PermissionTypes.MARKETPLACE]: {
-      [Permissions.USE]: loadedInterface.marketplace.admin?.use,
-    },
    [PermissionTypes.FILE_SEARCH]: { [Permissions.USE]: loadedInterface.fileSearch },
  });

--- a/api/server/services/start/interface.spec.js
+++ b/api/server/services/start/interface.spec.js
@@ -28,20 +28,12 @@ describe('loadDefaultInterface', () => {
    expect(updateAccessPermissions).toHaveBeenCalledWith(SystemRoles.USER, {
      [PermissionTypes.PROMPTS]: { [Permissions.USE]: true },
      [PermissionTypes.BOOKMARKS]: { [Permissions.USE]: true },
-      [PermissionTypes.MEMORIES]: {
-        [Permissions.USE]: true,
-        [Permissions.OPT_OUT]: undefined,
-      },
+      [PermissionTypes.MEMORIES]: { [Permissions.USE]: true, [Permissions.OPT_OUT]: undefined },
      [PermissionTypes.MULTI_CONVO]: { [Permissions.USE]: true },
      [PermissionTypes.AGENTS]: { [Permissions.USE]: true },
      [PermissionTypes.TEMPORARY_CHAT]: { [Permissions.USE]: true },
      [PermissionTypes.RUN_CODE]: { [Permissions.USE]: true },
      [PermissionTypes.WEB_SEARCH]: { [Permissions.USE]: true },
-      [PermissionTypes.MARKETPLACE]: { [Permissions.USE]: undefined },
-      [PermissionTypes.PEOPLE_PICKER]: {
-        [Permissions.VIEW_GROUPS]: undefined,
-        [Permissions.VIEW_USERS]: undefined,
-      },
      [PermissionTypes.FILE_SEARCH]: { [Permissions.USE]: true },
    });
  });
@@ -73,11 +65,6 @@ describe('loadDefaultInterface', () => {
      [PermissionTypes.TEMPORARY_CHAT]: { [Permissions.USE]: false },
      [PermissionTypes.RUN_CODE]: { [Permissions.USE]: false },
      [PermissionTypes.WEB_SEARCH]: { [Permissions.USE]: false },
-      [PermissionTypes.MARKETPLACE]: { [Permissions.USE]: undefined },
-      [PermissionTypes.PEOPLE_PICKER]: {
-        [Permissions.VIEW_GROUPS]: undefined,
-        [Permissions.VIEW_USERS]: undefined,
-      },
      [PermissionTypes.FILE_SEARCH]: { [Permissions.USE]: false },
    });
  });
@@ -100,11 +87,6 @@ describe('loadDefaultInterface', () => {
      [PermissionTypes.TEMPORARY_CHAT]: { [Permissions.USE]: undefined },
      [PermissionTypes.RUN_CODE]: { [Permissions.USE]: undefined },
      [PermissionTypes.WEB_SEARCH]: { [Permissions.USE]: undefined },
-      [PermissionTypes.MARKETPLACE]: { [Permissions.USE]: undefined },
-      [PermissionTypes.PEOPLE_PICKER]: {
-        [Permissions.VIEW_GROUPS]: undefined,
-        [Permissions.VIEW_USERS]: undefined,
-      },
      [PermissionTypes.FILE_SEARCH]: { [Permissions.USE]: undefined },
    });
  });
@@ -139,11 +121,6 @@ describe('loadDefaultInterface', () => {
      [PermissionTypes.TEMPORARY_CHAT]: { [Permissions.USE]: undefined },
      [PermissionTypes.RUN_CODE]: { [Permissions.USE]: undefined },
      [PermissionTypes.WEB_SEARCH]: { [Permissions.USE]: undefined },
-      [PermissionTypes.MARKETPLACE]: { [Permissions.USE]: undefined },
-      [PermissionTypes.PEOPLE_PICKER]: {
-        [Permissions.VIEW_GROUPS]: undefined,
-        [Permissions.VIEW_USERS]: undefined,
-      },
      [PermissionTypes.FILE_SEARCH]: { [Permissions.USE]: undefined },
    });
  });
@@ -175,11 +152,6 @@ describe('loadDefaultInterface', () => {
      [PermissionTypes.TEMPORARY_CHAT]: { [Permissions.USE]: undefined },
      [PermissionTypes.RUN_CODE]: { [Permissions.USE]: false },
      [PermissionTypes.WEB_SEARCH]: { [Permissions.USE]: true },
-      [PermissionTypes.MARKETPLACE]: { [Permissions.USE]: undefined },
-      [PermissionTypes.PEOPLE_PICKER]: {
-        [Permissions.VIEW_GROUPS]: undefined,
-        [Permissions.VIEW_USERS]: undefined,
-      },
      [PermissionTypes.FILE_SEARCH]: { [Permissions.USE]: false },
    });
  });
@@ -211,11 +183,6 @@ describe('loadDefaultInterface', () => {
      [PermissionTypes.TEMPORARY_CHAT]: { [Permissions.USE]: true },
      [PermissionTypes.RUN_CODE]: { [Permissions.USE]: true },
      [PermissionTypes.WEB_SEARCH]: { [Permissions.USE]: true },
-      [PermissionTypes.MARKETPLACE]: { [Permissions.USE]: undefined },
-      [PermissionTypes.PEOPLE_PICKER]: {
-        [Permissions.VIEW_GROUPS]: undefined,
-        [Permissions.VIEW_USERS]: undefined,
-      },
      [PermissionTypes.FILE_SEARCH]: { [Permissions.USE]: true },
    });
  });
@@ -238,11 +205,6 @@ describe('loadDefaultInterface', () => {
      [PermissionTypes.TEMPORARY_CHAT]: { [Permissions.USE]: undefined },
      [PermissionTypes.RUN_CODE]: { [Permissions.USE]: undefined },
      [PermissionTypes.WEB_SEARCH]: { [Permissions.USE]: undefined },
-      [PermissionTypes.MARKETPLACE]: { [Permissions.USE]: undefined },
-      [PermissionTypes.PEOPLE_PICKER]: {
-        [Permissions.VIEW_GROUPS]: undefined,
-        [Permissions.VIEW_USERS]: undefined,
-      },
      [PermissionTypes.FILE_SEARCH]: { [Permissions.USE]: undefined },
    });
  });
@@ -265,11 +227,6 @@ describe('loadDefaultInterface', () => {
      [PermissionTypes.TEMPORARY_CHAT]: { [Permissions.USE]: undefined },
      [PermissionTypes.RUN_CODE]: { [Permissions.USE]: undefined },
      [PermissionTypes.WEB_SEARCH]: { [Permissions.USE]: undefined },
-      [PermissionTypes.MARKETPLACE]: { [Permissions.USE]: undefined },
-      [PermissionTypes.PEOPLE_PICKER]: {
-        [Permissions.VIEW_GROUPS]: undefined,
-        [Permissions.VIEW_USERS]: undefined,
-      },
      [PermissionTypes.FILE_SEARCH]: { [Permissions.USE]: undefined },
    });
  });
@@ -292,11 +249,6 @@ describe('loadDefaultInterface', () => {
      [PermissionTypes.TEMPORARY_CHAT]: { [Permissions.USE]: undefined },
      [PermissionTypes.RUN_CODE]: { [Permissions.USE]: undefined },
      [PermissionTypes.WEB_SEARCH]: { [Permissions.USE]: undefined },
-      [PermissionTypes.MARKETPLACE]: { [Permissions.USE]: undefined },
-      [PermissionTypes.PEOPLE_PICKER]: {
-        [Permissions.VIEW_GROUPS]: undefined,
-        [Permissions.VIEW_USERS]: undefined,
-      },
      [PermissionTypes.FILE_SEARCH]: { [Permissions.USE]: undefined },
    });
  });
@@ -327,11 +279,6 @@ describe('loadDefaultInterface', () => {
      [PermissionTypes.TEMPORARY_CHAT]: { [Permissions.USE]: true },
      [PermissionTypes.RUN_CODE]: { [Permissions.USE]: false },
      [PermissionTypes.WEB_SEARCH]: { [Permissions.USE]: undefined },
-      [PermissionTypes.MARKETPLACE]: { [Permissions.USE]: undefined },
-      [PermissionTypes.PEOPLE_PICKER]: {
-        [Permissions.VIEW_GROUPS]: undefined,
-        [Permissions.VIEW_USERS]: undefined,
-      },
      [PermissionTypes.FILE_SEARCH]: { [Permissions.USE]: true },
    });
  });
@@ -363,11 +310,6 @@ describe('loadDefaultInterface', () => {
      [PermissionTypes.TEMPORARY_CHAT]: { [Permissions.USE]: undefined },
      [PermissionTypes.RUN_CODE]: { [Permissions.USE]: undefined },
      [PermissionTypes.WEB_SEARCH]: { [Permissions.USE]: undefined },
-      [PermissionTypes.MARKETPLACE]: { [Permissions.USE]: undefined },
-      [PermissionTypes.PEOPLE_PICKER]: {
-        [Permissions.VIEW_GROUPS]: undefined,
-        [Permissions.VIEW_USERS]: undefined,
-      },
      [PermissionTypes.FILE_SEARCH]: { [Permissions.USE]: true },
    });
  });
@@ -397,11 +339,6 @@ describe('loadDefaultInterface', () => {
      [PermissionTypes.TEMPORARY_CHAT]: { [Permissions.USE]: true },
      [PermissionTypes.RUN_CODE]: { [Permissions.USE]: false },
      [PermissionTypes.WEB_SEARCH]: { [Permissions.USE]: undefined },
-      [PermissionTypes.MARKETPLACE]: { [Permissions.USE]: undefined },
-      [PermissionTypes.PEOPLE_PICKER]: {
-        [Permissions.VIEW_GROUPS]: undefined,
-        [Permissions.VIEW_USERS]: undefined,
-      },
      [PermissionTypes.FILE_SEARCH]: { [Permissions.USE]: undefined },
    });
  });
@@ -419,20 +356,12 @@ describe('loadDefaultInterface', () => {
    expect(updateAccessPermissions).toHaveBeenCalledWith(SystemRoles.USER, {
      [PermissionTypes.PROMPTS]: { [Permissions.USE]: undefined },
      [PermissionTypes.BOOKMARKS]: { [Permissions.USE]: undefined },
-      [PermissionTypes.MEMORIES]: {
-        [Permissions.USE]: undefined,
-        [Permissions.OPT_OUT]: undefined,
-      },
+      [PermissionTypes.MEMORIES]: { [Permissions.USE]: undefined },
      [PermissionTypes.MULTI_CONVO]: { [Permissions.USE]: undefined },
      [PermissionTypes.AGENTS]: { [Permissions.USE]: undefined },
      [PermissionTypes.TEMPORARY_CHAT]: { [Permissions.USE]: undefined },
      [PermissionTypes.RUN_CODE]: { [Permissions.USE]: undefined },
      [PermissionTypes.WEB_SEARCH]: { [Permissions.USE]: undefined },
-      [PermissionTypes.MARKETPLACE]: { [Permissions.USE]: undefined },
-      [PermissionTypes.PEOPLE_PICKER]: {
-        [Permissions.VIEW_GROUPS]: undefined,
-        [Permissions.VIEW_USERS]: undefined,
-      },
      [PermissionTypes.FILE_SEARCH]: { [Permissions.USE]: true },
    });
  });
@@ -450,20 +379,12 @@ describe('loadDefaultInterface', () => {
    expect(updateAccessPermissions).toHaveBeenCalledWith(SystemRoles.USER, {
      [PermissionTypes.PROMPTS]: { [Permissions.USE]: undefined },
      [PermissionTypes.BOOKMARKS]: { [Permissions.USE]: undefined },
-      [PermissionTypes.MEMORIES]: {
-        [Permissions.USE]: undefined,
-        [Permissions.OPT_OUT]: undefined,
-      },
+      [PermissionTypes.MEMORIES]: { [Permissions.USE]: undefined },
      [PermissionTypes.MULTI_CONVO]: { [Permissions.USE]: undefined },
      [PermissionTypes.AGENTS]: { [Permissions.USE]: undefined },
      [PermissionTypes.TEMPORARY_CHAT]: { [Permissions.USE]: undefined },
      [PermissionTypes.RUN_CODE]: { [Permissions.USE]: undefined },
      [PermissionTypes.WEB_SEARCH]: { [Permissions.USE]: undefined },
-      [PermissionTypes.MARKETPLACE]: { [Permissions.USE]: undefined },
-      [PermissionTypes.PEOPLE_PICKER]: {
-        [Permissions.VIEW_GROUPS]: undefined,
-        [Permissions.VIEW_USERS]: undefined,
-      },
      [PermissionTypes.FILE_SEARCH]: { [Permissions.USE]: false },
    });
  });
@@ -495,11 +416,6 @@ describe('loadDefaultInterface', () => {
      [PermissionTypes.TEMPORARY_CHAT]: { [Permissions.USE]: true },
      [PermissionTypes.RUN_CODE]: { [Permissions.USE]: false },
      [PermissionTypes.WEB_SEARCH]: { [Permissions.USE]: true },
-      [PermissionTypes.MARKETPLACE]: { [Permissions.USE]: undefined },
-      [PermissionTypes.PEOPLE_PICKER]: {
-        [Permissions.VIEW_GROUPS]: undefined,
-        [Permissions.VIEW_USERS]: undefined,
-      },
      [PermissionTypes.FILE_SEARCH]: { [Permissions.USE]: true },
    });
  });
--- a/api/strategies/openidStrategy.js
+++ b/api/strategies/openidStrategy.js
@@ -365,7 +365,6 @@ async function setupOpenId() {
              email: userinfo.email || '',
              emailVerified: userinfo.email_verified || false,
              name: fullName,
-              idOnTheSource: userinfo.oid,
            };

            const balanceConfig = await getBalanceConfig();
@@ -376,7 +375,6 @@ async function setupOpenId() {
            user.openidId = userinfo.sub;
            user.username = username;
            user.name = fullName;
-            user.idOnTheSource = userinfo.oid;
          }

          if (!!userinfo && userinfo.picture && !user.avatar?.includes('manual=true')) {
--- a/api/test/jestSetup.js
+++ b/api/test/jestSetup.js
@@ -10,9 +10,4 @@ process.env.JWT_SECRET = 'test';
 process.env.JWT_REFRESH_SECRET = 'test';
 process.env.CREDS_KEY = 'test';
 process.env.CREDS_IV = 'test';
-process.env.ALLOW_EMAIL_LOGIN = 'true';
-
-// Set global test timeout to 30 seconds
-// This can be overridden in individual tests if needed
-jest.setTimeout(30000);
 process.env.OPENAI_API_KEY = 'test';
--- a/bun.lockb
+++ b/bun.lockb
--- a/client/package.json
+++ b/client/package.json
@@ -4,7 +4,6 @@
  "description": "",
  "type": "module",
  "scripts": {
-    "typecheck": "tsc --noEmit",
    "data-provider": "cd .. && npm run build:data-provider",
    "build:file": "cross-env NODE_ENV=production vite build --debug > vite-output.log 2>&1",
    "build": "cross-env NODE_ENV=production vite build && node ./scripts/post-build.cjs",
@@ -35,6 +34,7 @@
    "@dicebear/collection": "^9.2.2",
    "@dicebear/core": "^9.2.2",
    "@headlessui/react": "^2.1.2",
+    "@librechat/client": "*",
    "@marsidev/react-turnstile": "^1.1.0",
    "@radix-ui/react-accordion": "^1.1.2",
    "@radix-ui/react-alert-dialog": "^1.0.2",
@@ -71,6 +71,7 @@
    "i18next": "^24.2.2",
    "i18next-browser-languagedetector": "^8.0.3",
    "input-otp": "^1.4.2",
+    "jotai": "^2.12.5",
    "js-cookie": "^3.0.5",
    "librechat-data-provider": "*",
    "lodash": "^4.17.21",
--- a/client/src/App.jsx
+++ b/client/src/App.jsx
@@ -4,10 +4,9 @@ import { RouterProvider } from 'react-router-dom';
 import * as RadixToast from '@radix-ui/react-toast';
 import { HTML5Backend } from 'react-dnd-html5-backend';
 import { ReactQueryDevtools } from '@tanstack/react-query-devtools';
+import { Toast, ThemeProvider, ToastProvider } from '@librechat/client';
 import { QueryClient, QueryClientProvider, QueryCache } from '@tanstack/react-query';
-import { ScreenshotProvider, ThemeProvider, useApiErrorBoundary } from './hooks';
-import { ToastProvider } from './Providers';
-import Toast from './components/ui/Toast';
+import { ScreenshotProvider, useApiErrorBoundary } from './hooks';
 import { LiveAnnouncer } from '~/a11y';
 import { router } from './routes';

--- a/client/src/Providers/index.ts
+++ b/client/src/Providers/index.ts
@@ -1,11 +1,9 @@
 export { default as AssistantsProvider } from './AssistantsContext';
 export { default as AgentsProvider } from './AgentsContext';
-export { default as ToastProvider } from './ToastContext';
 export * from './ActivePanelContext';
 export * from './AgentPanelContext';
 export * from './ChatContext';
 export * from './ShareContext';
-export * from './ToastContext';
 export * from './FileMapContext';
 export * from './AddedChatContext';
 export * from './EditorContext';
--- a/client/src/a11y/LiveAnnouncer.tsx
+++ b/client/src/a11y/LiveAnnouncer.tsx
@@ -1,8 +1,7 @@
-// client/src/a11y/LiveAnnouncer.tsx
 import React, { useState, useCallback, useRef, useEffect, useMemo } from 'react';
 import type { AnnounceOptions } from '~/common';
 import AnnouncerContext from '~/Providers/AnnouncerContext';
-import useLocalize from '~/hooks/useLocalize';
+import { useLocalize } from '~/hooks';
 import Announcer from './Announcer';

 interface LiveAnnouncerProps {
--- a/client/src/common/agents-types.ts
+++ b/client/src/common/agents-types.ts
@@ -1,10 +1,5 @@
 import { AgentCapabilities, ArtifactModes } from 'librechat-data-provider';
-import type {
-  Agent,
-  AgentProvider,
-  AgentModelParameters,
-  SupportContact,
-} from 'librechat-data-provider';
+import type { Agent, AgentProvider, AgentModelParameters } from 'librechat-data-provider';
 import type { OptionWithIcon, ExtendedFile } from './types';

 export type TAgentOption = OptionWithIcon &
@@ -12,7 +7,6 @@ export type TAgentOption = OptionWithIcon &
    knowledge_files?: Array<[string, ExtendedFile]>;
    context_files?: Array<[string, ExtendedFile]>;
    code_files?: Array<[string, ExtendedFile]>;
-    _id?: string;
  };

 export type TAgentCapabilities = {
@@ -36,6 +30,4 @@ export type AgentForm = {
  agent_ids?: string[];
  [AgentCapabilities.artifacts]?: ArtifactModes | string;
  recursion_limit?: number;
-  support_contact?: SupportContact;
-  category: string;
 } & TAgentCapabilities;
--- a/client/src/common/menus.ts
+++ b/client/src/common/menus.ts
@@ -1,4 +1,3 @@
-/* eslint-disable @typescript-eslint/no-explicit-any */
 export type RenderProp<
  P = React.HTMLAttributes<any> & {
    ref?: React.Ref<any>;
--- a/client/src/common/types.ts
+++ b/client/src/common/types.ts
@@ -206,7 +206,9 @@ export type AgentPanelProps = {
  setActivePanel: React.Dispatch<React.SetStateAction<Panel>>;
  setMcp: React.Dispatch<React.SetStateAction<t.MCP | undefined>>;
  setAction: React.Dispatch<React.SetStateAction<t.Action | undefined>>;
+  endpointsConfig?: t.TEndpointsConfig;
  setCurrentAgentId: React.Dispatch<React.SetStateAction<string | undefined>>;
+  agentsConfig?: t.TAgentsEndpoint | null;
 };

 export type AgentPanelContextType = {
@@ -217,14 +219,12 @@ export type AgentPanelContextType = {
  mcps?: t.MCP[];
  setMcp: React.Dispatch<React.SetStateAction<t.MCP | undefined>>;
  setMcps: React.Dispatch<React.SetStateAction<t.MCP[] | undefined>>;
+  groupedTools: Record<string, t.AgentToolType & { tools?: t.AgentToolType[] }>;
  tools: t.AgentToolType[];
  activePanel?: string;
  setActivePanel: React.Dispatch<React.SetStateAction<Panel>>;
  setCurrentAgentId: React.Dispatch<React.SetStateAction<string | undefined>>;
-  groupedTools?: Record<string, t.AgentToolType & { tools?: t.AgentToolType[] }>;
  agent_id?: string;
-  agentsConfig?: t.TAgentsEndpoint | null;
-  endpointsConfig?: t.TEndpointsConfig | null;
 };

 export type AgentModelPanelProps = {
@@ -336,16 +336,13 @@ export type TAskProps = {
 export type TOptions = {
  editedMessageId?: string | null;
  editedText?: string | null;
-  editedContent?: {
-    index: number;
-    text: string;
-    type: 'text' | 'think';
-  };
  isRegenerate?: boolean;
  isContinued?: boolean;
  isEdited?: boolean;
  overrideMessages?: t.TMessage[];
-  /** Currently only utilized when resubmitting user-created message, uses that message's currently attached files */
+  /** This value is only true when the user submits a message with "Save & Submit" for a user-created message */
+  isResubmission?: boolean;
+  /** Currently only utilized when `isResubmission === true`, uses that message's currently attached files */
  overrideFiles?: t.TMessage['files'];
 };

--- a/client/src/components/Artifacts/Artifacts.tsx
+++ b/client/src/components/Artifacts/Artifacts.tsx
@@ -6,9 +6,9 @@ import type { SandpackPreviewRef, CodeEditorRef } from '@codesandbox/sandpack-re
 import useArtifacts from '~/hooks/Artifacts/useArtifacts';
 import DownloadArtifact from './DownloadArtifact';
 import { useEditorContext } from '~/Providers';
-import useLocalize from '~/hooks/useLocalize';
 import ArtifactTabs from './ArtifactTabs';
 import { CopyCodeButton } from './Code';
+import { useLocalize } from '~/hooks';
 import store from '~/store';

 export default function Artifacts() {
--- a/client/src/components/Artifacts/Code.tsx
+++ b/client/src/components/Artifacts/Code.tsx
@@ -1,12 +1,11 @@
 import React, { memo, useEffect, useRef, useState } from 'react';
+import copy from 'copy-to-clipboard';
 import rehypeKatex from 'rehype-katex';
 import ReactMarkdown from 'react-markdown';
 import rehypeHighlight from 'rehype-highlight';
-import copy from 'copy-to-clipboard';
+import { Clipboard, CheckMark } from '@librechat/client';
 import { handleDoubleClick, langSubset } from '~/utils';
-import Clipboard from '~/components/svg/Clipboard';
-import CheckMark from '~/components/svg/CheckMark';
-import useLocalize from '~/hooks/useLocalize';
+import { useLocalize } from '~/hooks';

 type TCodeProps = {
  inline: boolean;
--- a/client/src/components/Artifacts/DownloadArtifact.tsx
+++ b/client/src/components/Artifacts/DownloadArtifact.tsx
@@ -1,9 +1,9 @@
 import React, { useState } from 'react';
 import { Download } from 'lucide-react';
 import type { Artifact } from '~/common';
+import { CheckMark } from '@librechat/client';
 import useArtifactProps from '~/hooks/Artifacts/useArtifactProps';
 import { useEditorContext } from '~/Providers';
-import { CheckMark } from '~/components/svg';
 import { useLocalize } from '~/hooks';

 const DownloadArtifact = ({
--- a/client/src/components/Artifacts/Mermaid.tsx
+++ b/client/src/components/Artifacts/Mermaid.tsx
@@ -1,8 +1,7 @@
 import React, { useEffect, useRef, useState } from 'react';
 import mermaid from 'mermaid';
+import { Button } from '@librechat/client';
 import { TransformWrapper, TransformComponent, ReactZoomPanPinchRef } from 'react-zoom-pan-pinch';
-// import { Button } from '/components/ui/Button'; // Live component
-import { Button } from '~/components/ui/Button';
 import { ZoomIn, ZoomOut, RefreshCw } from 'lucide-react';

 interface MermaidDiagramProps {
--- a/client/src/components/Audio/TTS.tsx
+++ b/client/src/components/Audio/TTS.tsx
@@ -2,8 +2,8 @@
 import { useEffect } from 'react';
 import { useRecoilValue } from 'recoil';
 import type { TMessageAudio } from '~/common';
+import { VolumeIcon, VolumeMuteIcon, Spinner } from '@librechat/client';
 import { useLocalize, useTTSBrowser, useTTSExternal } from '~/hooks';
-import { VolumeIcon, VolumeMuteIcon, Spinner } from '~/components';
 import { logger } from '~/utils';
 import store from '~/store';

--- a/client/src/components/Audio/Voices.tsx
+++ b/client/src/components/Audio/Voices.tsx
@@ -1,8 +1,8 @@
 import React from 'react';
 import { useRecoilState } from 'recoil';
+import { Dropdown } from '@librechat/client';
 import type { Option } from '~/common';
 import { useLocalize, useTTSBrowser, useTTSExternal } from '~/hooks';
-import { Dropdown } from '~/components/ui';
 import { logger } from '~/utils';
 import store from '~/store';

--- a/client/src/components/Auth/AuthLayout.tsx
+++ b/client/src/components/Auth/AuthLayout.tsx
@@ -1,9 +1,9 @@
-import { TranslationKeys, useLocalize } from '~/hooks';
+import { ThemeSelector } from '@librechat/client';
 import { TStartupConfig } from 'librechat-data-provider';
 import { ErrorMessage } from '~/components/Auth/ErrorMessage';
+import { TranslationKeys, useLocalize } from '~/hooks';
 import SocialLoginRender from './SocialLoginRender';
 import { BlinkAnimation } from './BlinkAnimation';
-import { ThemeSelector } from '~/components';
 import { Banner } from '../Banners';
 import Footer from './Footer';

--- a/client/src/components/Auth/Login.tsx
+++ b/client/src/components/Auth/Login.tsx
@@ -1,10 +1,10 @@
 import { useOutletContext, useSearchParams } from 'react-router-dom';
 import { useEffect, useState } from 'react';
-import { useAuthContext } from '~/hooks/AuthContext';
+import { OpenIDIcon } from '@librechat/client';
 import type { TLoginLayoutContext } from '~/common';
 import { ErrorMessage } from '~/components/Auth/ErrorMessage';
 import SocialButton from '~/components/Auth/SocialButton';
-import { OpenIDIcon } from '~/components';
+import { useAuthContext } from '~/hooks/AuthContext';
 import { getLoginError } from '~/utils';
 import { useLocalize } from '~/hooks';
 import LoginForm from './LoginForm';
--- a/client/src/components/Auth/LoginForm.tsx
+++ b/client/src/components/Auth/LoginForm.tsx
@@ -1,11 +1,11 @@
-import { useForm } from 'react-hook-form';
 import React, { useState, useEffect, useContext } from 'react';
+import { useForm } from 'react-hook-form';
 import { Turnstile } from '@marsidev/react-turnstile';
+import { ThemeContext, Spinner, Button } from '@librechat/client';
 import type { TLoginUser, TStartupConfig } from 'librechat-data-provider';
 import type { TAuthContext } from '~/common';
 import { useResendVerificationEmail, useGetStartupConfig } from '~/data-provider';
-import { ThemeContext, useLocalize } from '~/hooks';
-import { Spinner, Button } from '~/components';
+import { useLocalize } from '~/hooks';

 type TLoginFormProps = {
  onSubmit: (data: TLoginUser) => void;
--- a/client/src/components/Auth/Registration.tsx
+++ b/client/src/components/Auth/Registration.tsx
@@ -1,12 +1,12 @@
 import { useForm } from 'react-hook-form';
 import React, { useContext, useState } from 'react';
 import { Turnstile } from '@marsidev/react-turnstile';
+import { ThemeContext, Spinner, Button } from '@librechat/client';
 import { useNavigate, useOutletContext, useLocation } from 'react-router-dom';
 import { useRegisterUserMutation } from 'librechat-data-provider/react-query';
 import type { TRegisterUser, TError } from 'librechat-data-provider';
-import { useLocalize, TranslationKeys, ThemeContext } from '~/hooks';
 import type { TLoginLayoutContext } from '~/common';
-import { Spinner, Button } from '~/components';
+import { useLocalize, TranslationKeys } from '~/hooks';
 import { ErrorMessage } from './ErrorMessage';

 const Registration: React.FC = () => {
--- a/client/src/components/Auth/RequestPasswordReset.tsx
+++ b/client/src/components/Auth/RequestPasswordReset.tsx
@@ -1,11 +1,11 @@
 import { useForm } from 'react-hook-form';
 import { useState, ReactNode } from 'react';
+import { Spinner, Button } from '@librechat/client';
 import { useOutletContext } from 'react-router-dom';
 import { useRequestPasswordResetMutation } from 'librechat-data-provider/react-query';
 import type { TRequestPasswordReset, TRequestPasswordResetResponse } from 'librechat-data-provider';
-import type { FC } from 'react';
 import type { TLoginLayoutContext } from '~/common';
-import { Spinner, Button } from '~/components';
+import type { FC } from 'react';
 import { useLocalize } from '~/hooks';

 const BodyTextWrapper: FC<{ children: ReactNode }> = ({ children }) => {
--- a/client/src/components/Auth/ResetPassword.tsx
+++ b/client/src/components/Auth/ResetPassword.tsx
@@ -1,10 +1,10 @@
 import { useForm } from 'react-hook-form';
+import { Spinner, Button } from '@librechat/client';
 import { useOutletContext } from 'react-router-dom';
 import { useNavigate, useSearchParams } from 'react-router-dom';
 import { useResetPasswordMutation } from 'librechat-data-provider/react-query';
 import type { TResetPassword } from 'librechat-data-provider';
 import type { TLoginLayoutContext } from '~/common';
-import { Spinner, Button } from '~/components';
 import { useLocalize } from '~/hooks';

 function ResetPassword() {
--- a/client/src/components/Auth/SocialLoginRender.tsx
+++ b/client/src/components/Auth/SocialLoginRender.tsx
@@ -6,7 +6,7 @@ import {
  DiscordIcon,
  AppleIcon,
  SamlIcon,
-} from '~/components';
+} from '@librechat/client';

 import SocialButton from './SocialButton';

--- a/client/src/components/Auth/TwoFactorScreen.tsx
+++ b/client/src/components/Auth/TwoFactorScreen.tsx
@@ -1,10 +1,10 @@
 import React, { useState, useCallback } from 'react';
 import { useSearchParams } from 'react-router-dom';
+import { useToastContext } from '@librechat/client';
 import { useForm, Controller } from 'react-hook-form';
 import { REGEXP_ONLY_DIGITS, REGEXP_ONLY_DIGITS_AND_CHARS } from 'input-otp';
-import { InputOTP, InputOTPGroup, InputOTPSeparator, InputOTPSlot, Label } from '~/components';
+import { InputOTP, InputOTPGroup, InputOTPSeparator, InputOTPSlot, Label } from '@librechat/client';
 import { useVerifyTwoFactorTempMutation } from '~/data-provider';
-import { useToastContext } from '~/Providers';
 import { useLocalize } from '~/hooks';

 interface VerifyPayload {
--- a/client/src/components/Auth/VerifyEmail.tsx
+++ b/client/src/components/Auth/VerifyEmail.tsx
@@ -1,8 +1,7 @@
-import { useSearchParams, useNavigate } from 'react-router-dom';
 import { useState, useEffect, useMemo, useCallback } from 'react';
+import { Spinner, ThemeSelector } from '@librechat/client';
+import { useSearchParams, useNavigate } from 'react-router-dom';
 import { useVerifyEmailMutation, useResendVerificationEmail } from '~/data-provider';
-import { ThemeSelector } from '~/components/ui';
-import { Spinner } from '~/components/svg';
 import { useLocalize } from '~/hooks';

 function RequestPasswordReset() {
--- a/client/src/components/Bookmarks/BookmarkEditDialog.tsx
+++ b/client/src/components/Bookmarks/BookmarkEditDialog.tsx
@@ -1,10 +1,8 @@
 import React, { useRef, Dispatch, SetStateAction } from 'react';
 import { TConversationTag } from 'librechat-data-provider';
-import OGDialogTemplate from '~/components/ui/OGDialogTemplate';
+import { OGDialogTemplate, OGDialog, Button, Spinner, useToastContext } from '@librechat/client';
 import { useConversationTagMutation } from '~/data-provider';
-import { OGDialog, Button, Spinner } from '~/components';
 import { NotificationSeverity } from '~/common';
-import { useToastContext } from '~/Providers';
 import BookmarkForm from './BookmarkForm';
 import { useLocalize } from '~/hooks';
 import { logger } from '~/utils';
--- a/client/src/components/Bookmarks/BookmarkForm.tsx
+++ b/client/src/components/Bookmarks/BookmarkForm.tsx
@@ -2,11 +2,10 @@ import React, { useEffect } from 'react';
 import { QueryKeys } from 'librechat-data-provider';
 import { Controller, useForm } from 'react-hook-form';
 import { useQueryClient } from '@tanstack/react-query';
+import { Checkbox, Label, TextareaAutosize, Input, useToastContext } from '@librechat/client';
 import type { TConversationTag, TConversationTagRequest } from 'librechat-data-provider';
-import { Checkbox, Label, TextareaAutosize, Input } from '~/components';
 import { useBookmarkContext } from '~/Providers/BookmarkContext';
 import { useConversationTagMutation } from '~/data-provider';
-import { useToastContext } from '~/Providers';
 import { useLocalize } from '~/hooks';
 import { cn, logger } from '~/utils';

--- a/client/src/components/Bookmarks/BookmarkItem.tsx
+++ b/client/src/components/Bookmarks/BookmarkItem.tsx
@@ -1,8 +1,8 @@
 import { useState } from 'react';
+import { Spinner } from '@librechat/client';
 import { MenuItem } from '@headlessui/react';
 import { BookmarkFilledIcon, BookmarkIcon } from '@radix-ui/react-icons';
 import type { FC } from 'react';
-import { Spinner } from '~/components/svg';

 type MenuItemProps = {
  tag: string | React.ReactNode;
--- a/client/src/components/Bookmarks/DeleteBookmarkButton.tsx
+++ b/client/src/components/Bookmarks/DeleteBookmarkButton.tsx
@@ -1,10 +1,17 @@
 import { useCallback, useState } from 'react';
+import {
+  Button,
+  TrashIcon,
+  Label,
+  OGDialog,
+  OGDialogTrigger,
+  TooltipAnchor,
+  OGDialogTemplate,
+  useToastContext,
+} from '@librechat/client';
 import type { FC } from 'react';
-import { Button, TrashIcon, Label, OGDialog, OGDialogTrigger, TooltipAnchor } from '~/components';
 import { useDeleteConversationTagMutation } from '~/data-provider';
-import OGDialogTemplate from '~/components/ui/OGDialogTemplate';
 import { NotificationSeverity } from '~/common';
-import { useToastContext } from '~/Providers';
 import { useLocalize } from '~/hooks';

 const DeleteBookmarkButton: FC<{
--- a/client/src/components/Bookmarks/EditBookmarkButton.tsx
+++ b/client/src/components/Bookmarks/EditBookmarkButton.tsx
@@ -1,7 +1,7 @@
 import { useState } from 'react';
-import type { FC } from 'react';
+import { TooltipAnchor, OGDialogTrigger, EditIcon, Button } from '@librechat/client';
 import type { TConversationTag } from 'librechat-data-provider';
-import { TooltipAnchor, OGDialogTrigger, EditIcon, Button } from '~/components';
+import type { FC } from 'react';
 import BookmarkEditDialog from './BookmarkEditDialog';
 import { useLocalize } from '~/hooks';

--- a/client/src/components/Chat/AddMultiConvo.tsx
+++ b/client/src/components/Chat/AddMultiConvo.tsx
@@ -1,8 +1,8 @@
 import { PlusCircle } from 'lucide-react';
+import { TooltipAnchor } from '@librechat/client';
 import { isAssistantsEndpoint } from 'librechat-data-provider';
 import type { TConversation } from 'librechat-data-provider';
 import { useChatContext, useAddedChatContext } from '~/Providers';
-import { TooltipAnchor } from '~/components';
 import { mainTextareaId } from '~/common';
 import { useLocalize } from '~/hooks';

--- a/client/src/components/Chat/ChatView.tsx
+++ b/client/src/components/Chat/ChatView.tsx
@@ -1,6 +1,7 @@
 import { memo, useCallback } from 'react';
 import { useRecoilValue } from 'recoil';
 import { useForm } from 'react-hook-form';
+import { Spinner } from '@librechat/client';
 import { useParams } from 'react-router-dom';
 import { Constants } from 'librechat-data-provider';
 import type { TMessage } from 'librechat-data-provider';
@@ -10,7 +11,6 @@ import { useChatHelpers, useAddedResponse, useSSE } from '~/hooks';
 import ConversationStarters from './Input/ConversationStarters';
 import { useGetMessagesByConvoId } from '~/data-provider';
 import MessagesView from './Messages/MessagesView';
-import { Spinner } from '~/components/svg';
 import Presentation from './Presentation';
 import { buildTree, cn } from '~/utils';
 import ChatForm from './Input/ChatForm';
--- a/client/src/components/Chat/ExportAndShareMenu.tsx
+++ b/client/src/components/Chat/ExportAndShareMenu.tsx
@@ -2,11 +2,11 @@ import { useState, useId, useRef } from 'react';
 import { useRecoilValue } from 'recoil';
 import * as Ariakit from '@ariakit/react';
 import { Upload, Share2 } from 'lucide-react';
+import { DropdownPopup, TooltipAnchor, useMediaQuery } from '@librechat/client';
 import type * as t from '~/common';
 import ExportModal from '~/components/Nav/ExportConversation/ExportModal';
 import { ShareButton } from '~/components/Conversations/ConvoOptions';
-import { DropdownPopup, TooltipAnchor } from '~/components/ui';
-import { useMediaQuery, useLocalize } from '~/hooks';
+import { useLocalize } from '~/hooks';
 import store from '~/store';

 export default function ExportAndShareMenu({
--- a/client/src/components/Chat/Header.tsx
+++ b/client/src/components/Chat/Header.tsx
@@ -1,4 +1,5 @@
 import { useMemo } from 'react';
+import { useMediaQuery } from '@librechat/client';
 import { useOutletContext } from 'react-router-dom';
 import { getConfigDefaults, PermissionTypes, Permissions } from 'librechat-data-provider';
 import type { ContextType } from '~/common';
@@ -6,17 +7,16 @@ import ModelSelector from './Menus/Endpoints/ModelSelector';
 import { PresetsMenu, HeaderNewChat, OpenSidebar } from './Menus';
 import { useGetStartupConfig } from '~/data-provider';
 import ExportAndShareMenu from './ExportAndShareMenu';
-import { useMediaQuery, useHasAccess } from '~/hooks';
 import BookmarkMenu from './Menus/BookmarkMenu';
 import { TemporaryChat } from './TemporaryChat';
 import AddMultiConvo from './AddMultiConvo';
+import { useHasAccess } from '~/hooks';

 const defaultInterface = getConfigDefaults().interface;

 export default function Header() {
  const { data: startupConfig } = useGetStartupConfig();
  const { navVisible, setNavVisible } = useOutletContext<ContextType>();
-
  const interfaceConfig = useMemo(
    () => startupConfig?.interface ?? defaultInterface,
    [startupConfig],
--- a/client/src/components/Chat/Input/Artifacts.tsx
+++ b/client/src/components/Chat/Input/Artifacts.tsx
@@ -1,8 +1,8 @@
 import React, { memo, useState, useCallback, useMemo } from 'react';
 import * as Ariakit from '@ariakit/react';
+import { CheckboxButton } from '@librechat/client';
 import { ArtifactModes } from 'librechat-data-provider';
 import { WandSparkles, ChevronDown } from 'lucide-react';
-import CheckboxButton from '~/components/ui/CheckboxButton';
 import { useBadgeRowContext } from '~/Providers';
 import { useLocalize } from '~/hooks';
 import { cn } from '~/utils';
--- a/client/src/components/Chat/Input/ArtifactsSubMenu.tsx
+++ b/client/src/components/Chat/Input/ArtifactsSubMenu.tsx
@@ -1,8 +1,8 @@
 import React from 'react';
 import * as Ariakit from '@ariakit/react';
+import { PinIcon } from '@librechat/client';
 import { ChevronRight, WandSparkles } from 'lucide-react';
 import { ArtifactModes } from 'librechat-data-provider';
-import { PinIcon } from '~/components/svg';
 import { useLocalize } from '~/hooks';
 import { cn } from '~/utils';

--- a/client/src/components/Chat/Input/AudioRecorder.tsx
+++ b/client/src/components/Chat/Input/AudioRecorder.tsx
@@ -1,8 +1,7 @@
 import { useCallback } from 'react';
-import { useChatFormContext, useToastContext } from '~/Providers';
-import { ListeningIcon, Spinner } from '~/components/svg';
+import { useToastContext, TooltipAnchor, ListeningIcon, Spinner } from '@librechat/client';
 import { useLocalize, useSpeechToText } from '~/hooks';
-import { TooltipAnchor } from '~/components/ui';
+import { useChatFormContext } from '~/Providers';
 import { globalAudioId } from '~/common';
 import { cn } from '~/utils';

--- a/client/src/components/Chat/Input/BadgeRow.tsx
+++ b/client/src/components/Chat/Input/BadgeRow.tsx
@@ -8,6 +8,7 @@ import React, {
  useReducer,
  useCallback,
 } from 'react';
+import { Badge } from '@librechat/client';
 import { useRecoilValue, useRecoilCallback } from 'recoil';
 import type { LucideIcon } from 'lucide-react';
 import CodeInterpreter from './CodeInterpreter';
@@ -15,7 +16,6 @@ import { BadgeRowProvider } from '~/Providers';
 import ToolsDropdown from './ToolsDropdown';
 import type { BadgeItem } from '~/common';
 import { useChatBadges } from '~/hooks';
-import { Badge } from '~/components/ui';
 import ToolDialogs from './ToolDialogs';
 import FileSearch from './FileSearch';
 import Artifacts from './Artifacts';
--- a/client/src/components/Chat/Input/ChatForm.tsx
+++ b/client/src/components/Chat/Input/ChatForm.tsx
@@ -1,5 +1,6 @@
 import { memo, useRef, useMemo, useEffect, useState, useCallback } from 'react';
 import { useWatch } from 'react-hook-form';
+import { TextareaAutosize } from '@librechat/client';
 import { useRecoilState, useRecoilValue } from 'recoil';
 import { Constants, isAssistantsEndpoint, isAgentsEndpoint } from 'librechat-data-provider';
 import {
@@ -20,7 +21,6 @@ import {
 import { mainTextareaId, BadgeItem } from '~/common';
 import AttachFileChat from './Files/AttachFileChat';
 import FileFormChat from './Files/FileFormChat';
-import { TextareaAutosize } from '~/components';
 import { cn, removeFocusRings } from '~/utils';
 import TextareaHeader from './TextareaHeader';
 import PromptsCommand from './PromptsCommand';
--- a/client/src/components/Chat/Input/CircleRender.tsx
+++ b/client/src/components/Chat/Input/CircleRender.tsx
@@ -1,6 +1,6 @@
 import React from 'react';
-import { CircleIcon, CircleDotsIcon } from '~/components/svg';
 import { ECallState } from 'librechat-data-provider';
+import { CircleIcon, CircleDotsIcon } from '@librechat/client';

 const CircleRender = ({ rmsLevel, isCameraOn, state }) => {
  const getIconComponent = (state) => {
--- a/client/src/components/Chat/Input/CodeInterpreter.tsx
+++ b/client/src/components/Chat/Input/CodeInterpreter.tsx
@@ -1,7 +1,7 @@
 import React, { memo } from 'react';
 import { TerminalSquareIcon } from 'lucide-react';
+import { CheckboxButton } from '@librechat/client';
 import { PermissionTypes, Permissions } from 'librechat-data-provider';
-import CheckboxButton from '~/components/ui/CheckboxButton';
 import { useLocalize, useHasAccess } from '~/hooks';
 import { useBadgeRowContext } from '~/Providers';

--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Marco Beretta	014060a11b	chore: update @radix-ui/react-accordion to version 1.2.11	2025-07-26 15:03:26 +02:00
Marco Beretta	80d406b629	fix: merge conflicts	2025-07-26 03:07:03 +02:00
Marco Beretta	22035bbf95	style: update itemClassName in ToolsDropdown for improved UI consistency	2025-07-26 01:55:17 +02:00
Marco Beretta	17a164b420	refactor: enhance Menu component to support custom render functions for menu items	2025-07-26 01:55:16 +02:00
Marco Beretta	5b663d0e35	chore: remove unused imports and clean up code in NewChat component	2025-07-26 01:55:16 +02:00
Marco Beretta	c273dfc1f4	refactor: code structure; chore: translations cleanup	2025-07-26 01:55:16 +02:00
Marco Beretta	de69bcdd64	chore: update package version to 0.1.5 and adjust peer dependencies - Bump version in package.json from 0.1.4 to 0.1.5. - Update peer dependency for @tanstack/react-query to allow version 5.0.0. - Add @tanstack/react-table and @tanstack/react-virtual as dependencies. - Update various dependencies to their latest compatible versions. - Simplify postcss.config.js by removing unnecessary options. - Clean up rollup.config.js by removing ignored PostCSS warnings. - Update CheckboxButton component to cast icon as React JSX element. - Adjust Combobox component's class names for better styling. - Change DropdownPopup component to use React's namespace import. - Modify InputOTP component to use 'any' type for OTPInputContext. - Ensure displayLabel and value in ModelParameters are converted to strings. - Update MultiSearch component's placeholder to ensure it's a string. - Cast selectIcon in MultiSelect as React JSX element for consistency. - Update OGDialogTemplate to cast selectText as React JSX element. - Initialize animationRef in PixelCard with undefined for clarity. - Add TypeScript ignore comments in Select and SelectDropDown components for Radix UI type conflicts. - Ensure title in SelectDropDown is a string and adjust rendering of options. - Update useLocalize hook to cast options as any for compatibility.	2025-07-26 01:55:14 +02:00
Marco Beretta	59412c2b36	chore: bump client version to 0.1.4 and update @react-spring dependencies	2025-07-26 01:48:11 +02:00
Marco Beretta	0af8fba7ca	chore: bump client version to 0.1.3 and update dependencies	2025-07-26 01:48:11 +02:00
Marco Beretta	d5cf83313b	chore: bump client version to 0.1.2 in package-lock.json	2025-07-26 01:48:11 +02:00
Marco Beretta	355da0fc2e	chore: bump version to 0.1.2 in package.json	2025-07-26 01:48:11 +02:00
Marco Beretta	8ba5aa6055	refactor: update package dependencies and improve PostCSS and Rollup configurations	2025-07-26 01:48:11 +02:00
Marco Beretta	f1204531a8	refactor: clean up client workflow and update package dependencies	2025-07-26 01:48:11 +02:00
Marco Beretta	a65e33758d	refactor: update peer dependencies and improve component typings - Removed duplicate peer dependencies from package.json and organized them. - Updated rollup.config.js to disable TypeScript checking during the build process. - Modified AnimatedTabs component to use React.ReactNode for label and content types, and added TypeScript workarounds for compatibility. - Enhanced Label and Separator components to accept an optional className prop and improved prop spreading. - Updated Slider component to include an optional className prop and refined prop handling for better type safety.	2025-07-26 01:48:11 +02:00
Marco Beretta	0855631c54	refactor: remove unused types and interfaces from common files	2025-07-26 01:48:11 +02:00
Marco Beretta	a1e052871f	refactor: reorganize exports in index.ts for improved clarity	2025-07-26 01:48:11 +02:00
Marco Beretta	ca18ada9e2	feat: update package.json and rollup.config.js to include jotai and enhance bundling configuration	2025-07-26 01:48:11 +02:00
Marco Beretta	103af99879	feat: update package.json and rollup.config.js to include jotai and enhance bundling configuration	2025-07-26 01:48:11 +02:00
Marco Beretta	412948e025	chore: move dependencies to peerDependencies in package.json	2025-07-26 01:48:11 +02:00
Marco Beretta	4da25826d9	chore: move @tanstack/react-virtual to dependencies and remove recoil from package.json	2025-07-26 01:48:11 +02:00
Marco Beretta	6e7fdeb3a3	feat: integrate Tailwind CSS and update theme context for improved styling	2025-07-26 01:48:11 +02:00
Marco Beretta	1c3f5b972d	chore: remove unnecessary logging of sttExternal and ttsExternal in Speech component	2025-07-26 01:48:10 +02:00
Danny Avila	e7aa83e073	chore: update tsconfig.json to exclude additional test files	2025-07-26 01:48:10 +02:00
Danny Avila	0b5155d277	chore: add missing @testing-library/react dependency to client package	2025-07-26 01:48:10 +02:00
Danny Avila	86deb4d19a	chore: update GitHub Actions workflow to install and build data-provider and client dependencies	2025-07-26 01:48:10 +02:00
Danny Avila	f741a59ec4	feat: update GitHub Actions workflow to publish @librechat/client	2025-07-26 01:48:10 +02:00
Danny Avila	83477bba34	chore: linting	2025-07-26 01:48:10 +02:00
Danny Avila	5476029bca	refactor: remove unused defaultSelectedValues prop from MCPSelect and MultiSelect components	2025-07-26 01:48:09 +02:00
Danny Avila	05a0a1f7cd	chore: linting	2025-07-26 01:47:35 +02:00
Danny Avila	55f67212d5	feat: add react-hook-form dependency and update FormInput component to use its types	2025-07-26 01:47:35 +02:00
Danny Avila	63d0c301a0	test: update AgentFooter tests to use document.querySelector for spinner checks test: mock window.matchMedia in setupTests.js for consistent test environment	2025-07-26 01:47:35 +02:00
Danny Avila	bac6e499b7	chore: include "packages/client" in unused i18next keys detection	2025-07-26 01:47:35 +02:00
Danny Avila	59de92afa9	fix: add missing peer dependency for @radix-ui/react-collapsible	2025-07-26 01:47:35 +02:00
Danny Avila	e297386cee	chore: enhance unused package detection for @librechat/client and improve dependency extraction	2025-07-26 01:47:34 +02:00
Danny Avila	e2b1cc607f	fix: correct frontend:ci script to include client package build	2025-07-26 01:47:19 +02:00
Danny Avila	55bda03d19	fix: add remaining peer dependencies and match actual versions previously used in `client/package.json`	2025-07-26 01:47:19 +02:00
Danny Avila	b11ba35790	fix: circular dependencies in DataTable	2025-07-26 01:47:18 +02:00
Danny Avila	8e1b00da2a	fix: correct useSprings implementation in SplitText component	2025-07-26 01:47:18 +02:00
Danny Avila	39f5dd47dc	fix: update peer dependencies in @librechat/client to prevent bundling them	2025-07-26 01:47:18 +02:00
Marco Beretta	16f83c6e8e	chore: fixed formatting issues	2025-07-26 01:47:18 +02:00
Marco Beretta	b71a82d0e9	feat: /client transition to @librechat/client	2025-07-26 01:47:17 +02:00
Danny Avila	63a5902404	feat: export Toast component in client package - Added export for the Toast component in index.ts to enhance modularity and accessibility of components.	2025-07-26 01:14:16 +02:00
Danny Avila	21c3a831c3	feat: add client package directory to update configuration - Included the 'client' package directory in the update.js configuration to ensure it is recognized during updates.	2025-07-26 01:14:16 +02:00
Danny Avila	ae43b4eed0	feat: update client package dependencies and Rollup configuration - Added rollup-plugin-postcss to package.json and updated package-lock.json. - Enhanced Rollup configuration to include postcss plugin for CSS handling. - Updated index.ts to export all components from the components directory for better modularity.	2025-07-26 01:14:14 +02:00
Danny Avila	2af4ca5b5c	chore: rename package/client build script command	2025-07-26 01:13:50 +02:00
Danny Avila	b6c7b0bc71	feat: enhance Rollup configuration for client package - Updated terser plugin settings to preserve directives like 'use client'. - Added custom warning handler to ignore "use client" directive warnings during the build process.	2025-07-26 01:13:50 +02:00
Danny Avila	f8738b207c	feat: update client package configuration and dependencies - Added new dependencies for Rollup plugins and updated existing ones in package.json and package-lock.json. - Introduced a new Rollup configuration file for building the client package. - Refactored build scripts to include a dedicated build command for the client. - Updated TypeScript configuration for improved module resolution and type declaration output. - Integrated a Toast component from the client package into the main App component.	2025-07-26 01:13:50 +02:00
Danny Avila	6ea1d5eab2	feat: add @librechat/client as a dependency in package.json and package-lock.json	2025-07-26 01:13:50 +02:00
Danny Avila	992911514c	fix: move dependencies to peerDependencies in client package	2025-07-26 01:13:50 +02:00
Marco Beretta	9289aeb2ba	feat: add back `recoil`	2025-07-26 01:13:50 +02:00
Marco Beretta	898d273aaf	fix: package; refactor: tsconfig	2025-07-26 01:13:50 +02:00
Marco Beretta	5859350bcb	fix: cleanup	2025-07-26 01:13:50 +02:00
Marco Beretta	882cca247a	feat: cleanup unused types from common/index.ts - Remove 104 unused type exports from packages/client/src/common/index.ts - Keep only 7 actually used exports (93% reduction) - Add cleanup script with enhanced import pattern detection - Support both named imports and namespace imports (* as t) - Create automatic backups and comprehensive documentation - Maintain type safety with build verification - No breaking changes to existing code Kept exports: - TShowToast, Option, OptionWithIcon, DropdownValueSetter - MentionOption, NotificationSeverity, MenuItemProps Scripts: cleanup-common-types-safe.js, README-CLEANUP.md	2025-07-26 01:13:50 +02:00
Marco Beretta	0b7dd55797	fix build client package	2025-07-26 01:13:50 +02:00
Marco Beretta	9f270127d3	feat: Add jotai as a peer dependency	2025-07-26 01:13:50 +02:00
Marco Beretta	1380db85cb	feat: Add common types and interfaces for accessibility, agents, artifacts, assistants, and tools	2025-07-26 01:13:50 +02:00
Marco Beretta	dcaa5af598	feat: init @librechat/client	2025-07-26 01:13:49 +02:00
Dustin Healy	545a909953	🗂️ refactor: Make `MCPSubMenu` consistent with `MCPSelect` (#8650 ) - Refactored MCPSelect and MCPSubMenu components to utilize a new custom hook, `useMCPServerManager`, for improved state management and server initialization logic. - Added functionality to handle simultaneous MCP server initialization requests, including cancellation and user notifications. - Updated translation files to include new messages for initialization cancellation. - Improved the configuration dialog handling for MCP servers, streamlining the user experience when managing server settings.	2025-07-25 14:51:42 -04:00
Danny Avila	cd436dc6a8	📦 chore: Update `@modelcontextprotocol/sdk` to v1.17.0 (#8674 ) * 📦 chore: Update `@modelcontextprotocol/sdk` to v1.17.0 * refactor: unused package detection by extracting workspace dependencies in GitHub Actions workflow * chore: Enhance unused package detection by including peerDependencies extraction in GitHub Actions workflow * fix: Ensure safe extraction of dependencies and peerDependencies in unused package detection workflow	2025-07-25 14:06:16 -04:00
Danny Avila	e75beb92b3	🗑️ chore: Remove Workflows for Changelogs (#8673 )	2025-07-25 13:45:22 -04:00
Danny Avila	5251246313	📱 refactor: Redis Client Error Logging and Ping only when Ready (#8671 ) * 📱 refactor: Redis Client Error Logging and Ping only when Ready * chore: intellisense for warning comment for Keyv Redis client regarding prefix support	2025-07-25 12:33:05 -04:00
Danny Avila	26f23c6aaf	📦 chore: Bump `@node-saml/passport-saml` to v5.1.0 (#8670 )	2025-07-25 11:26:20 -04:00
Danny Avila	1636af1f27	📦 chore: Bump `mongodb-memory-server` to v10.1.4 (#8669 )	2025-07-25 11:23:38 -04:00
Theo N. Truong	b050a0bf1e	✨ feat: Add Redis Ping Interval Configuration (#8648 ) Co-authored-by: Danny Avila <danny@librechat.ai>	2025-07-25 11:00:02 -04:00
github-actions[bot]	deb928bf80	🌍 i18n: Update translation.json with latest translations (#8664 ) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2025-07-25 10:36:14 -04:00
Theo N. Truong	21005b66cc	✨ feat: Add support for forced in-memory cache namespaces configuration (#8586 ) * ✨ feat: Add support for forced in-memory cache keys configuration * refactor: Update cache keys to use uppercase constants and moved cache for `librechat.yaml` into its own cache namespace (STATIC_CONFIG) and with a more descriptive key (LIBRECHAT_YAML_CONFIG)	2025-07-25 10:32:55 -04:00
Dustin Healy	3dc9e85fab	🐛 fix: Display OAuth MCP servers according to Chat Menu Setting (#8643 ) * fix: chatMenu not being respected in MCPSelect * fix: chatMenu not being respected in MCPSubMenu	2025-07-25 10:21:10 -04:00
Sebastien Bruel	ec67cf2d3a	🚇 chore: Remove Overridden Transport Error Listener (#8656 )	2025-07-25 10:17:33 -04:00