Merge remote-tracking branch 'origin/master' into deploy/prod-tooltip-wrap-2391

Co-authored-by: dadachann <185672915+dadachann@users.noreply.github.com>

.github/workflows/deploy-prod.yml

@@ -0,0 +1,59 @@
+name: Build and deploy production
+
+on:
+  push:
+    branches: [deploy/prod]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: langbot-production
+  cancel-in-progress: false
+
+env:
+  CORE_IMAGE: ${{ secrets.DOCKER_USERNAME }}/langbot
+  CLOUD_IMAGE: ${{ secrets.DOCKER_USERNAME }}/langbot-cloud-core
+  SPACE_REF: 178b1634c104e635c706e1fb4ca37cb3de073cf9
+
+jobs:
+  build-and-deploy:
+    runs-on: ubuntu-latest
+    environment: production
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+      - name: Build exact Core image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            ${{ env.CORE_IMAGE }}:prod-${{ github.sha }}
+            ${{ env.CORE_IMAGE }}:deploy-prod
+          cache-from: type=gha,scope=core-prod
+          cache-to: type=gha,mode=max,scope=core-prod
+      - name: Checkout production Cloud adapter
+        uses: actions/checkout@v4
+        with:
+          repository: langbot-app/langbot-space
+          ref: ${{ env.SPACE_REF }}
+          token: ${{ secrets.CLA_PAT }}
+          path: .space
+      - name: Build exact Cloud Core image
+        uses: docker/build-push-action@v6
+        with:
+          context: .space
+          file: .space/Dockerfile.cloud
+          push: true
+          build-args: LANGBOT_CORE_IMAGE=${{ env.CORE_IMAGE }}:prod-${{ github.sha }}
+          tags: |
+            ${{ env.CLOUD_IMAGE }}:prod-${{ github.sha }}
+            ${{ env.CLOUD_IMAGE }}:deploy-prod
+          cache-from: type=gha,scope=cloud-core-prod
+          cache-to: type=gha,mode=max,scope=cloud-core-prod

deploy/prod/deploy.sh

@@ -0,0 +1,97 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+cd /opt/langbot-cloud-prod
+TAG=${1:?usage: deploy.sh prod-<40-char-sha>}
+[[ "$TAG" =~ ^prod-[0-9a-f]{40}$ ]] || { echo 'invalid immutable image tag' >&2; exit 2; }
+[[ -s .env ]] || { echo '/opt/langbot-cloud-prod/.env is missing' >&2; exit 3; }
+
+rendered_compose=$(docker compose config)
+grep -Fq 'LANGBOT_SPACE_CONTROL_PLANE_URL: https://space.langbot.app' <<<"$rendered_compose" || {
+  echo 'Cloud control-plane URL must be https://space.langbot.app' >&2
+  exit 4
+}
+grep -Fq 'SPACE__URL: https://space.langbot.app' <<<"$rendered_compose" || {
+  echo 'Cloud user-facing Space URL must be https://space.langbot.app' >&2
+  exit 5
+}
+grep -Eq 'LANGBOT_TELEMETRY_INGEST_TOKEN: .+' <<<"$rendered_compose" || {
+  echo 'Cloud telemetry ingest token must be configured' >&2
+  exit 6
+}
+
+update_env() {
+  local key=$1 value=$2
+  python3 - "$key" "$value" <<'PY'
+from pathlib import Path
+import os
+import sys
+
+path = Path('.env')
+key, value = sys.argv[1:]
+lines = path.read_text().splitlines()
+updated = False
+for index, line in enumerate(lines):
+    if line.startswith(f'{key}='):
+        lines[index] = f'{key}={value}'
+        updated = True
+        break
+if not updated:
+    lines.append(f'{key}={value}')
+temporary = Path('.env.tmp')
+temporary.write_text('\n'.join(lines) + '\n')
+os.chmod(temporary, 0o600)
+temporary.replace(path)
+PY
+}
+update_env LANGBOT_IMAGE_TAG "$TAG"
+set -a
+. ./.env
+set +a
+: "${CLOUD_V2_CONTROL_PLANE_TOKEN:?CLOUD_V2_CONTROL_PLANE_TOKEN is required}"
+
+for attempt in 1 2 3 4 5; do
+  if docker compose pull postgres redis migrate plugin-runtime core; then
+    break
+  fi
+  if [ "$attempt" -eq 5 ]; then
+    echo "docker compose pull failed after $attempt attempts" >&2
+    exit 1
+  fi
+  delay=$((attempt * 10))
+  echo "docker compose pull failed (attempt $attempt/5); retrying in ${delay}s" >&2
+  sleep "$delay"
+done
+docker compose up -d postgres redis
+for _ in $(seq 1 60); do
+  if docker compose exec -T postgres pg_isready -U langbot_operator -d langbot >/dev/null 2>&1; then break; fi
+  sleep 2
+done
+docker compose exec -T postgres pg_isready -U langbot_operator -d langbot >/dev/null
+
+docker compose exec -T postgres psql -v ON_ERROR_STOP=1 -U langbot_operator -d langbot \
+  -v runtime_password="$POSTGRES_RUNTIME_PASSWORD" <<'SQL'
+SELECT format('CREATE ROLE langbot_runtime LOGIN PASSWORD %L', :'runtime_password')
+WHERE NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'langbot_runtime')\gexec
+ALTER ROLE langbot_runtime PASSWORD :'runtime_password';
+GRANT CONNECT ON DATABASE langbot TO langbot_runtime;
+REVOKE CREATE ON SCHEMA public FROM PUBLIC, langbot_runtime;
+REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA public FROM langbot_runtime;
+REVOKE ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public FROM langbot_runtime;
+ALTER DEFAULT PRIVILEGES FOR ROLE langbot_operator IN SCHEMA public REVOKE ALL ON TABLES FROM langbot_runtime;
+ALTER DEFAULT PRIVILEGES FOR ROLE langbot_operator IN SCHEMA public REVOKE ALL ON SEQUENCES FROM langbot_runtime;
+GRANT USAGE ON SCHEMA public TO langbot_runtime;
+SQL
+
+docker compose --profile tools run --rm migrate
+
+docker compose up -d --remove-orphans plugin-runtime core
+for _ in $(seq 1 90); do
+  if docker compose exec -T core python -c 'import urllib.request; urllib.request.urlopen("http://127.0.0.1:5300/healthz", timeout=3)' >/dev/null 2>&1; then
+    docker compose ps
+    exit 0
+  fi
+  sleep 2
+done
+docker compose logs --tail=200 core plugin-runtime >&2
+exit 1

deploy/prod/docker-compose.yml

@@ -0,0 +1,162 @@
+services:
+  postgres:
+    image: pgvector/pgvector:pg17
+    container_name: langbot-cloud-postgres
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: langbot
+      POSTGRES_USER: langbot_operator
+      POSTGRES_PASSWORD: ${POSTGRES_OPERATOR_PASSWORD}
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+    healthcheck:
+      test: [CMD-SHELL, "pg_isready -U langbot_operator -d langbot"]
+      interval: 5s
+      timeout: 5s
+      retries: 30
+    networks: [internal]
+
+  redis:
+    image: redis:7.4-alpine
+    container_name: langbot-cloud-redis
+    restart: unless-stopped
+    command: [redis-server, --appendonly, "yes", --requirepass, "${REDIS_PASSWORD}"]
+    volumes:
+      - redis-data:/data
+    healthcheck:
+      test: [CMD-SHELL, "redis-cli -a \"$${REDIS_PASSWORD}\" ping | grep PONG"]
+      interval: 5s
+      timeout: 5s
+      retries: 20
+    environment:
+      REDIS_PASSWORD: ${REDIS_PASSWORD}
+    networks: [internal]
+
+  migrate:
+    image: rockchin/langbot-cloud-core:${LANGBOT_IMAGE_TAG}
+    profiles: [tools]
+    command: [uv, run, langbot, migrate, --cloud]
+    environment: &core-env
+      TZ: Asia/Shanghai
+      SYSTEM__INSTANCE_ID: ${CLOUD_V2_INSTANCE_UUID}
+      SYSTEM__EDITION: cloud
+      SYSTEM__RECOVERY_KEY: ${SYSTEM_RECOVERY_KEY}
+      SYSTEM__JWT__SECRET: ${JWT_SECRET}
+      SYSTEM__LIMITATION__MAX_BOTS: "2"
+      SYSTEM__LIMITATION__MAX_PIPELINES: "3"
+      SYSTEM__LIMITATION__MAX_EXTENSIONS: "3"
+      SYSTEM__LIMITATION__MAX_KNOWLEDGE_BASES: "2"
+      API__WEBHOOK_PREFIX: https://cloud.langbot.app
+      API__WEBUI_URL: https://cloud.langbot.app
+      WORKSPACE__INVITATIONS__PUBLIC_WEB_URL: https://cloud.langbot.app
+      DATABASE__USE: postgresql
+      DATABASE__POSTGRESQL__URL: postgresql+asyncpg://langbot_runtime:${POSTGRES_RUNTIME_PASSWORD}@postgres:5432/langbot
+      DATABASE__CLOUD_MIGRATION__OPERATOR_DSN_ENV: LANGBOT_CLOUD_MIGRATION_DSN
+      LANGBOT_CLOUD_MIGRATION_DSN: postgresql://langbot_operator:${POSTGRES_OPERATOR_PASSWORD}@postgres:5432/langbot
+      VDB__USE: pgvector
+      VDB__PGVECTOR__USE_BUSINESS_DATABASE: "true"
+      VDB__PGVECTOR__ALLOWED_DIMENSIONS: "384,512,768,1024,1536"
+      PLUGIN__ENABLE: "true"
+      PLUGIN__RUNTIME_WS_URL: ws://plugin-runtime:5400/control/ws
+      PLUGIN__DISPLAY_PLUGIN_DEBUG_URL: wss://cloud.langbot.app/plugin/debug/ws
+      PLUGIN__WORKER__MAX_CPUS: "0.25"
+      PLUGIN__WORKER__MAX_MEMORY_MB: "256"
+      PLUGIN__WORKER__MAX_PIDS: "128"
+      PLUGIN__WORKER__MAX_WORKERS: "16"
+      PLUGIN__WORKER__MAX_TOTAL_CPUS: "4.0"
+      PLUGIN__WORKER__MAX_TOTAL_MEMORY_MB: "4096"
+      PLUGIN__WORKER__REQUIRE_HARD_LIMITS: "true"
+      LANGBOT_PLUGIN_RUNTIME_CONTROL_TOKEN: ${PLUGIN_RUNTIME_CONTROL_TOKEN}
+      # Cloud v2 currently grants no managed Box capability. Keep the shared
+      # runtime deployed but disable Core integration until a hard-quota-capable
+      # backend can satisfy the fail-closed Cloud readiness contract.
+      BOX__ENABLED: "false"
+      BOX__BACKEND: nsjail
+      BOX__RUNTIME__ENDPOINT: ws://box:5410
+      BOX__ADMISSION__REQUIRED: "true"
+      BOX__ADMISSION__LOGICAL_SESSION_ID: global
+      BOX__ADMISSION__REQUIRED_BACKEND: nsjail
+      BOX__ADMISSION__MAX_SESSIONS: "1"
+      BOX__ADMISSION__MAX_MANAGED_PROCESSES: "0"
+      BOX__ADMISSION__CPUS: "0.25"
+      BOX__ADMISSION__MEMORY_MB: "256"
+      BOX__ADMISSION__WORKSPACE_QUOTA_MB: "256"
+      BOX__LOCAL__HOST_ROOT: /app/data/box
+      BOX__LOCAL__DEFAULT_WORKSPACE: /app/data/box
+      BOX__LOCAL__ALLOWED_MOUNT_ROOTS: /app/data/box
+      LANGBOT_BOX_CONTROL_TOKEN: ${BOX_CONTROL_TOKEN}
+      MCP__STDIO__ENABLED: "false"
+      LANGBOT_SPACE_CONTROL_PLANE_URL: https://space.langbot.app
+      LANGBOT_SPACE_CONTROL_PLANE_TOKEN: ${CLOUD_V2_CONTROL_PLANE_TOKEN}
+      LANGBOT_TELEMETRY_INGEST_TOKEN: ${CLOUD_V2_CONTROL_PLANE_TOKEN}
+      LANGBOT_SPACE_CONTROL_PLANE_PUBLIC_KEY: ${CLOUD_V2_MANIFEST_PUBLIC_KEY}
+      LANGBOT_SPACE_CONTROL_PLANE_KEY_ID: ${CLOUD_V2_MANIFEST_KEY_ID}
+      SPACE__URL: https://space.langbot.app
+    depends_on:
+      postgres: {condition: service_healthy}
+    networks: [internal]
+
+  plugin-runtime:
+    image: rockchin/langbot:${LANGBOT_IMAGE_TAG}
+    container_name: langbot-cloud-plugin-runtime
+    restart: unless-stopped
+    command: [uv, run, python, -m, langbot_plugin.cli.__init__, rt]
+    environment:
+      LANGBOT_PLUGIN_RUNTIME_CONTROL_TOKEN: ${PLUGIN_RUNTIME_CONTROL_TOKEN}
+    volumes:
+      - plugin-data:/app/data
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+    cgroup: host
+    privileged: true
+    expose: ["5400"]
+    networks: [internal]
+
+  box:
+    image: rockchin/langbot:${LANGBOT_IMAGE_TAG}
+    container_name: langbot-cloud-box
+    restart: unless-stopped
+    command: [uv, run, lbp, box, --host, 0.0.0.0, --ws-control-port, "5410"]
+    environment:
+      LANGBOT_BOX_CONTROL_TOKEN: ${BOX_CONTROL_TOKEN}
+      LANGBOT_BOX_ROOT: /app/data/box
+    volumes:
+      - box-data:/app/data/box
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+    cgroup: host
+    privileged: true
+    expose: ["5410"]
+    networks: [internal]
+
+  core:
+    image: rockchin/langbot-cloud-core:${LANGBOT_IMAGE_TAG}
+    container_name: langbot-cloud-core
+    restart: unless-stopped
+    environment: *core-env
+    volumes:
+      - core-data:/app/data
+      - box-data:/app/data/box
+    depends_on:
+      postgres: {condition: service_healthy}
+      redis: {condition: service_healthy}
+      plugin-runtime: {condition: service_started}
+      box: {condition: service_started}
+    expose: ["5300"]
+    healthcheck:
+      test: [CMD-SHELL, "python -c 'import urllib.request; urllib.request.urlopen(\"http://127.0.0.1:5300/healthz\", timeout=3)'" ]
+      interval: 10s
+      timeout: 5s
+      retries: 30
+      start_period: 30s
+    networks: [internal, shared-network]
+
+networks:
+  internal:
+  shared-network:
+    external: true
+
+volumes:
+  postgres-data:
+  redis-data:
+  plugin-data:
+  box-data:
+  core-data:

docs/review/model-reasoning-control-design.md

@@ -1,476 +0,0 @@
-# 模型思考控制设计方案
-
-> 日期：2026-07-31
-> 状态：Phase 1 已审核并实现
-> 范围：LangBot 主仓库的模型配置、LiteLLM 请求层、Local Agent、Web 管理面板、监控与测试
-
-## 1. 结论
-
-建议为 LangBot 增加一套与厂商参数解耦的“思考策略”模型，并明确区分三个概念：
-
-1. **思考能力**：模型是否支持思考，以及支持开关、档位还是 token 预算。
-2. **思考策略**：一次请求选择厂商默认、关闭、开启或指定思考档位。
-3. **思考展示**：是否把模型返回的思考内容展示给最终用户。
-
-现有 `remove-think` 只属于第 3 类。它会过滤输出，但不会阻止模型思考，也不会降低思考 token、费用或延迟。新能力不应复用或改写这个字段。
-
-推荐实现原则：
-
-- 默认值为 `provider_default`，不向上游增加任何新参数，现有模型行为完全不变。
-- 用户显式选择的策略必须被准确执行；无法准确执行时返回明确错误，不静默降级。
-- LangBot 内部只保存统一策略，Provider 请求层负责翻译成各厂商参数。
-- `extra_args` 保留为高级逃生口，但不能成为主 UI 的思考配置方式。
-- 模型页只管理并展示能力；可写策略归属于 Local Agent 流水线，同一模型可在不同业务中使用不同思考量。
-- 原始 reasoning 数据与展示文本分开保存，保证多轮对话、工具调用和签名字段不丢失。
-
-## 2. 调研结论
-
-### 2.1 可验证资料
-
-本次结论基于以下可验证来源：
-
-- OpenAI 官方 Reasoning Guide：`reasoning.effort` 的可选值由模型决定，可包括 `none`、`minimal`、`low`、`medium`、`high`、`xhigh`、`max`；低档位偏向低延迟和低 token，高档位偏向质量。
-  - https://developers.openai.com/api/docs/guides/reasoning#reasoning-effort
-- LangBot 锁定的 LiteLLM `1.88.1` 实现。`uv.lock` 已锁定该版本，本地缓存中的适配代码可以确认 LangBot 实际依赖所支持的翻译行为。
-- LangBot 当前实现：模型级 `extra_args` 会在 `LiteLLMRequester._build_completion_args()` 中直接合并到 `acompletion()` 参数。
-
-Anthropic、Google 和 LiteLLM 的官方文档域名在本次环境中被浏览器策略禁止访问，因此下表中这些厂商的结论以 LiteLLM `1.88.1` 实际适配代码为准。实施前应再用对应厂商官方文档做一次参数范围核验，尤其是模型代际和允许值。
-
-### 2.2 厂商差异矩阵
-
-| Provider / 生态 | 可控制能力 | LiteLLM 1.88.1 统一入口 | 关键限制 | 建议支持级别 |
-| --- | --- | --- | --- | --- |
-| OpenAI | 思考档位，部分模型支持 `none` | `reasoning_effort` | 每个模型支持的档位不同，不能把 `none` 当成通用能力 | 首批完整支持 |
-| Anthropic | 旧模型使用 extended thinking + token budget；新模型可用 adaptive thinking + effort | `reasoning_effort` 或 `thinking` | `none` 表示不发送 thinking；新旧模型的映射不同 | 首批完整支持 |
-| Gemini | 2.x 主要映射为 `thinkingBudget`；3.x 主要映射为 `thinkingLevel` | `reasoning_effort` 或 `thinking` | Gemini 3 的 `none` 可能只能降到最低档，不能保证真正关闭 | 首批支持，但严格限制关闭语义 |
-| DeepSeek | 开启/关闭；当前适配不支持预算档位 | `thinking={type: enabled}`；非 `none` effort 会映射成开启 | 多轮思考模式要求回传 `reasoning_content` | 首批开关支持 |
-| xAI | 思考档位 | `reasoning_effort` | 仅 reasoning-capable 模型接受 | 首批完整支持 |
-| Ollama | `think` 布尔值；部分模型接受 low/medium/high | `reasoning_effort` | 非 gpt-oss 模型的档位可能退化为布尔开关 | 首批支持，按模型能力裁剪 UI |
-| OpenRouter | 聚合多厂商的 reasoning 参数 | `reasoning_effort`、`thinking` | 实际能力由路由后的模型决定 | 首批支持，能力未知时要求测试 |
-| Volcengine / Doubao | `thinking.type` 支持 enabled/disabled/auto | LiteLLM `volcengine` 适配器支持 `thinking` | LangBot 当前 manifest 使用 `openai`，不会进入该适配器 | 第二批，先修正路由并回归 |
-| Bailian / Qwen | 厂商兼容接口有独立思考开关/预算 | LiteLLM `dashscope` 适配器目前未提供统一 reasoning 映射 | LangBot 当前 manifest 使用 `openai`，只能通过高级参数透传 | 第二批，实施前核对官方字段 |
-| 其他 OpenAI-compatible 网关 | 取决于网关 | 尝试标准 `reasoning_effort` | 不能仅凭模型名推断完整能力 | 保守支持，默认不自动开启 |
-
-### 2.3 对 LangBot 的直接含义
-
-不能把这个功能实现成单一 `enable_thinking: bool`，原因如下：
-
-- 有的模型只有开关，有的模型只有档位，有的模型允许精确 token 预算。
-- 有的模型本身始终推理，只能降低思考量，无法真正关闭。
-- 同一个通用档位在不同厂商会映射成不同的实际预算。
-- 聚合网关和自定义 OpenAI-compatible 服务无法可靠地通过模型名识别能力。
-- “不展示思考内容”不等于“关闭思考”。
-
-## 3. 当前项目现状
-
-### 3.1 已有能力
-
-- `LLMModel.extra_args` 是 JSON 字段，Web 端已有通用高级参数编辑器。
-- `LiteLLMRequester` 会按“模型级 `extra_args`，再调用级 `extra_args`”的顺序合并参数。
-- LiteLLM 已统一处理多个 Provider 的 `reasoning_effort`、`thinking` 和返回的 `reasoning_content`。
-- `LocalAgentRunner` 的非流式、流式、工具调用和 fallback 路径都经过 `RuntimeProvider.invoke_llm*()`。
-- `remove-think` 已能控制 `<think>` 或独立 reasoning 内容是否进入展示文本。
-- Gemini 工具调用所需的 `provider_specific_fields` / thought signature 已有保留逻辑和单元测试。
-
-### 3.2 现有缺口
-
-- 管理员只能手写 `extra_args`，没有统一语义、能力提示和校验。
-- `remove-think` 名称容易被误解为关闭模型思考。
-- 模型扫描只识别 `vision` 和 `func_call`，没有 reasoning 能力。
-- 当前返回处理会把 `reasoning_content` 拼进 `<think>` 文本后删除原字段，可能损失多轮思考所需的结构化数据。
-- DeepSeek 思考模式需要在后续轮次回传 `reasoning_content`，当前链路不能保证完整保留。
-- Pipeline 只能选择模型，不能针对业务覆盖模型的思考策略。
-- 监控只记录总输入/输出 token，没有单独展示 reasoning token。
-- 部分 Provider manifest 仍声明为通用 `openai`，导致 LiteLLM 的厂商专用翻译器不会生效。
-
-### 3.3 预计改动地图
-
-| 层 | 主要文件 | 责任 |
-| --- | --- | --- |
-| 持久化 | `src/langbot/pkg/entity/persistence/model.py`、`src/langbot/pkg/persistence/alembic/versions/` | 新增 `reasoning_config` JSON 列和 Alembic 迁移 |
-| 模型服务 | `src/langbot/pkg/api/http/service/model.py` | CRUD 校验、冲突检测、测试模型时使用统一策略 |
-| HTTP 控制器 | `src/langbot/pkg/api/http/controller/groups/provider/models.py` | 继续复用现有模型路由，不新增平行 API |
-| 模型管理 | `src/langbot/pkg/provider/modelmgr/modelmgr.py` | 临时模型、数据库模型与扫描结果加载新字段 |
-| 请求抽象 | `src/langbot/pkg/provider/modelmgr/requester.py` | 定义能力查询和 reasoning 参数构建接口 |
-| LiteLLM 适配 | `src/langbot/pkg/provider/modelmgr/requesters/litellmchat.py` | 能力识别、策略翻译、参数合并、reasoning 返回保留 |
-| Provider manifest | `src/langbot/pkg/provider/modelmgr/requesters/*.yaml` | 必要时修正 Provider 路由；相关变更放到独立阶段 |
-| Agent 调用 | `src/langbot/pkg/provider/runners/localagent.py` | 所有非流式、流式、工具调用、fallback 路径传递统一策略 |
-| Pipeline 元数据 | `src/langbot/templates/metadata/pipeline/ai.yaml` | 第二阶段加入 Pipeline 级覆盖 |
-| 输出配置 | `src/langbot/templates/metadata/pipeline/output.yaml` | 保留键名，澄清 `remove-think` 只控制展示 |
-| Web 类型/API | `web/src/app/infra/entities/api/index.ts`、`web/src/app/infra/http/BackendClient.ts` | 增加配置与能力响应类型 |
-| 模型 UI | `web/src/app/home/components/models-dialog/` | 能力标记、策略控件、校验、模型测试 |
-| i18n | `web/src/i18n/locales/` | 至少补齐英文、简体中文及项目已有覆盖语言 |
-| 测试 | `tests/unit_tests/provider/`、`web/tests/` | 翻译、服务、流式 round-trip、前端状态测试 |
-
-Phase 1 不修改 `langbot-plugin-sdk` 的公共实体或运行时协议。现有 `provider_message.Message.provider_specific_fields` 已可承载 Provider 原始 reasoning 数据；只有后续要把 reasoning 升级为跨插件公开实体时，才需要跨仓库 SDK 变更。
-
-## 4. 领域模型
-
-### 4.1 统一策略
-
-新增 `ReasoningConfig`，保存于 LLM 模型，Pipeline 可提供同结构覆盖。产品层只暴露一个离散档位：
-
-```json
-{
-  "level": "provider_default"
-}
-```
-
-字段定义：
-
-| 字段 | 类型 | 含义 |
-| --- | --- | --- |
-| `level` | `provider_default \| disabled \| enabled \| minimal \| low \| medium \| high \| xhigh \| max` | 同时表达开关和思考强度 |
-
-校验规则：
-
-- `provider_default`：不发送任何 reasoning 参数，保持厂商和模型默认行为。
-- `disabled`：明确关闭；仅当模型可真正关闭时允许保存/运行。
-- `enabled`：明确开启，但由 Provider 决定具体强度，适用于只有开关的模型。
-- `minimal` 到 `max`：明确开启，并指定强度；仅允许选择模型实际支持的档位。
-- 厂商的 `auto` 统一映射为 `provider_default`，不再增加一个重复状态。
-- 精确 token 预算不进入主数据结构。少数需要预算的场景继续通过高级参数配置，并由模型测试接口校验。
-
-### 4.2 能力描述
-
-沿用现有 `LLMModel.abilities`，新增 `reasoning` 能力标记。同时由后端在 API 返回中计算只读的 `reasoning_capabilities`：
-
-```json
-{
-  "supported": true,
-  "controls": ["toggle", "effort"],
-  "efforts": ["none", "low", "medium", "high"],
-  "can_disable": true,
-  "source": "litellm"
-}
-```
-
-设计约束：
-
-- `abilities` 仍是用户可编辑的粗粒度能力，符合现有 `vision`、`func_call` 模式。
-- `reasoning_capabilities` 不持久化，优先从 LiteLLM 模型元数据计算，避免模型升级后数据库残留过期能力。
-- 无法识别的自定义模型返回 `supported: null`、`source: unknown`，不猜测。
-- 用户可手动添加 `reasoning` ability，但未知能力模型必须先通过“测试模型”验证显式策略。
-- UI 只展示后端声明可用的控件；未知模型保留 Provider Default 和高级参数入口。
-
-### 4.3 持久化
-
-在 `llm_models` 表新增 JSON 列：
-
-```text
-reasoning_config JSON NOT NULL DEFAULT {"level":"provider_default"}
-```
-
-使用 Alembic 新迁移，不修改冻结的 legacy migration。
-
-该列作为已实现版本的兼容字段保留；新的模型页不再提供写入口，Local Agent 请求以流水线中按模型 UUID 保存的策略为准。
-
-不建议把内部策略塞进 `extra_args`，原因是当前 `extra_args` 会原样发送给 LiteLLM；使用保留键会让内部元数据泄漏到上游，并使高级参数与产品配置难以区分。
-
-## 5. 配置优先级与请求流程
-
-### 5.1 优先级
-
-```text
-Pipeline 当前候选模型策略
-        ↓ 缺少配置时固定为 provider_default
-Provider / 模型默认行为
-```
-
-请求参数合并顺序：
-
-```text
-基础参数
-  -> 模型 extra_args
-  -> 调用级 extra_args
-  -> 统一 reasoning 策略翻译结果（最后应用）
-```
-
-统一策略最后应用，可以确保流水线行为不受模型页历史设置影响。为了避免用户困惑，保存和测试时要检测 `extra_args` 中的冲突字段；当 `level != provider_default` 时，发现以下字段应直接报错：
-
-- `reasoning_effort`
-- `thinking`
-- `reasoning`
-- `extra_body` 内已知的 `thinking`、`enable_thinking`、`thinking_budget` 等字段
-
-当 `level == provider_default` 时继续允许这些高级参数，保证旧配置兼容。
-
-### 5.2 翻译层
-
-在 `pkg/provider/modelmgr/` 内新增独立的 reasoning 规范化模块，职责是：
-
-1. 读取当前流水线候选模型的请求级策略。
-2. 查询 `ProviderAPIRequester.get_reasoning_capabilities(model)`。
-3. 严格校验策略是否可以准确执行。
-4. 生成 LiteLLM 参数，不直接发 HTTP。
-5. 返回可观测的“最终生效策略”供日志和测试使用。
-
-建议接口：
-
-```python
-class ProviderAPIRequester:
-    def get_reasoning_capabilities(self, model: RuntimeLLMModel) -> ReasoningCapabilities: ...
-
-    def build_reasoning_args(
-        self,
-        model: RuntimeLLMModel,
-        config: ReasoningConfig,
-    ) -> dict[str, Any]: ...
-```
-
-LiteLLMRequester 默认优先生成统一参数：
-
-- 强度档位：`reasoning_effort=<level>`
-- 仅开启：`thinking={"type":"enabled"}` 或 Provider 等价参数
-- 关闭：优先 `reasoning_effort="none"`
-- 高级参数中的精确预算：`thinking={"type":"enabled","budget_tokens":N}`
-
-Provider 特例只放在 requester 翻译层，不进入 Pipeline 或平台适配器。
-
-### 5.3 Provider 特例
-
-- **Gemini 3**：如果 LiteLLM 能力表不能确认真正关闭，`disabled` 必须报“不支持关闭，可选择 Provider Default 或最低档”，不能把 `none` 静默映射成 low/minimal。
-- **DeepSeek**：所有非 `none` 档位最终都只是开启。能力 API 只返回 `toggle`，UI 不显示档位；多轮必须保存并回传 `reasoning_content`。
-- **Ollama**：仅对明确支持等级的模型展示 effort；其他模型只展示开关。
-- **OpenRouter**：以路由后的模型能力为准。模型未知时允许 Provider Default，显式策略必须通过测试接口。
-- **Volcengine**：使用 `thinking.type=enabled/disabled/auto`。应先让该 requester 进入 LiteLLM `volcengine` 适配器，或增加等价的明确翻译，不能依赖模型名。
-- **Bailian/Qwen**：作为第二批 Provider 专用翻译。实施前核对官方字段、模型范围、预算上下限和流式返回结构，不凭经验写接口。
-
-## 6. 返回数据与思考展示
-
-### 6.1 保留原始 reasoning
-
-当前 `LiteLLMRequester` 会读取 `reasoning_content`，将其拼接成 `<think>` 文本，再删除原字段。建议改为：
-
-```text
-上游 reasoning_content
-  ├─ 原样保存在 Message.provider_specific_fields.reasoning_content
-  └─ 根据 remove-think 决定是否渲染为 <think>...</think>
-```
-
-流式路径需要在 accumulator 中分别累计 `content` 与 `reasoning_content`，最终消息必须携带结构化 reasoning。不能只依赖已经渲染的 `<think>` 文本反向解析。
-
-这样可以同时满足：
-
-- `remove-think=true` 时用户看不到思考内容，但多轮协议仍能回传必要数据。
-- `remove-think=false` 时保持当前用户体验。
-- DeepSeek 多轮 thinking 不丢上下文。
-- Gemini thought signature、Anthropic thinking block 等 Provider 字段可以继续按结构化方式 round-trip。
-
-### 6.2 现有字段处理
-
-保留数据库和 Pipeline 配置键 `remove-think`，避免破坏兼容。Web 文案改为更准确的：
-
-- 中文：`向用户展示思考过程`
-- 英文：`Show reasoning process`
-
-UI 使用正向开关，保存时转换回 `remove-think = !showReasoning`。文案必须强调它只影响展示，不影响模型是否思考、token 或费用。
-
-## 7. Web 管理面板
-
-### 7.1 模型编辑
-
-模型页只承担能力管理和只读展示：
-
-1. `Reasoning` ability 复选框与 Vision、Function Calling 并列，供无法自动识别的自定义模型手动声明能力。
-2. 模型卡片使用简短图标或 badge 标识 reasoning 能力。
-3. 模型页不提供可写思考挡位，避免模型默认值与流水线策略形成两个控制源。
-
-### 7.2 Local Agent 流水线策略
-
-在 Local Agent 的主模型和每一个 fallback 模型下分别显示紧凑离散滑杆：
-
-1. `Provider 默认` 始终为首个选项；选择它时不向上游增加任何思考参数。
-2. 完整档位顺序为：`Provider 默认 / 关闭 / 开启 / 最低 / 低 / 中 / 高 / 极高 / 最大`。
-3. 前端只渲染后端为该模型返回的可用档位；仅开关模型显示 `Provider 默认 / 关闭 / 开启`。
-4. 模型不能真正关闭时不提供 `关闭`；能力未知时只显示不可调的 `Provider 默认`。
-5. 主模型和 fallback 分别保存策略，切换候选模型时不会把一个模型的挡位错误应用到另一个模型。
-6. Dify、Coze、Langflow、n8n 等外部 Runner 不显示该控件，因为 LangBot 不直接发起其内部模型请求。
-
-流水线配置保持旧格式兼容，并在模型选择对象中增加按 UUID 保存的映射：
-
-```json
-{
-  "model": {
-    "primary": "primary-model-uuid",
-    "fallbacks": ["fallback-model-uuid"],
-    "reasoning": {
-      "primary-model-uuid": "high"
-    }
-  }
-}
-```
-
-`provider_default` 不写入映射；缺少 `reasoning` 的旧流水线天然等价于全部使用 Provider 默认。
-
-滑杆交互要求：轨道使用现有主色和中性灰，不使用渐变；当前档位同时显示文字；支持键盘方向键和正确的 ARIA value text；窄屏下不溢出。
-
-### 7.3 i18n
-
-新增文案至少覆盖 `en_US`、`zh_Hans`；`ja_JP` 在模型面板现有同类字段已覆盖时同步补齐。不要把厂商参数名直接作为用户文案。
-
-## 8. API、MCP 与 Skill
-
-### 8.1 HTTP API
-
-模型 CRUD 增加：
-
-- 请求字段：`reasoning_config`
-- 响应字段：`reasoning_config`
-- 只读字段：`reasoning_capabilities`
-
-模型测试接口必须使用与真实请求完全相同的规范化和翻译逻辑，并在失败时返回可操作错误，例如：
-
-```text
-Model gemini-3-... cannot disable reasoning.
-Supported controls: effort=[low, medium, high].
-```
-
-可选增加只读调试信息，仅在测试接口返回：
-
-```json
-{
-  "effective_reasoning": {
-    "level": "low",
-    "translated_keys": ["reasoning_effort"]
-  }
-}
-```
-
-不得返回 API key、完整请求正文或原始思考内容。
-
-### 8.2 MCP 与技能
-
-当前 MCP 仅列出模型 Provider，没有完整模型 CRUD 工具。如果本次不新增 agent-accessible HTTP 操作，则无需强行新增 MCP 工具。
-
-如果后续让 Agent 修改模型思考策略，则必须同一提交更新：
-
-- `src/langbot/pkg/api/mcp/server.py`
-- 对应的 `skills/` 文档
-- 参数 schema 和安全说明
-
-## 9. 监控与可观测性
-
-控制思考量后，管理员需要判断质量、延迟和成本是否值得。建议第二阶段增加：
-
-- `reasoning_tokens`：从 `completion_tokens_details.reasoning_tokens` 或 Provider 等价字段提取。
-- `effective_reasoning_level`：记录规范化后的生效档位，不记录原始思考内容。
-- 模型监控页展示输入 token、可见输出 token、reasoning token、总延迟。
-- Provider 不返回细分 token 时显示未知，不推算。
-
-安全要求：日志、监控、debug API 默认都不得记录 reasoning 原文。思考内容可能包含敏感信息或系统提示，不应因为新增配置而扩大持久化范围。
-
-## 10. 兼容与迁移
-
-### 10.1 数据迁移
-
-- 所有现有 LLM 记录迁移为 `{"level":"provider_default"}`。
-- 不自动解析或迁移现有 `extra_args` 中的 reasoning 参数，避免误判嵌套结构和 Provider 语义。
-- UI 检测到旧 `extra_args` reasoning 字段时显示“由高级参数控制”，统一策略保持 Provider Default。
-- 用户主动改成统一策略时，要求先移除冲突高级参数。
-
-### 10.2 运行时兼容
-
-- `provider_default` 不产生任何新增请求参数。
-- 不改变现有 `remove-think` 的存储键和默认值。
-- 不改变已有 Provider 的 `litellm_provider`，除非该 Provider 在专项回归后单独切换。
-- `drop_params` 不能用于掩盖显式 reasoning 配置错误；显式策略被丢弃应视为失败。
-- 自托管和 toB 环境中的自定义兼容接口保持可用，未知能力不阻止 Provider Default 请求。
-
-## 11. 实施拆分
-
-### Phase 1：统一基础设施与主流 Provider
-
-- Alembic 增加 `llm_models.reasoning_config`。
-- Backend 模型实体、CRUD、测试接口支持统一配置。
-- LiteLLMRequester 增加能力查询、严格校验和参数翻译。
-- 支持 OpenAI、Anthropic、Gemini、DeepSeek、xAI、Ollama、OpenRouter 的已验证 LiteLLM 路径。
-- 修复结构化 reasoning 的非流式/流式保留。
-- 模型面板增加 reasoning ability 与只读能力标识。
-- Local Agent 主模型和每个 fallback 增加独立的请求级策略。
-
-### Phase 2：国内 Provider
-
-- 专项核对并支持 Volcengine/Doubao、Bailian/Qwen。
-- 对相关 requester 的 `litellm_provider` 变更做独立回归，避免把 reasoning 功能和通用请求行为回归混在一起。
-- 补齐扫描结果中的 reasoning capability。
-
-### Phase 3：监控与评估
-
-- 持久化 reasoning token 和生效策略。
-- 监控页增加 reasoning 成本/延迟指标。
-- 建立不同 effort 的离线质量、首 token 延迟、总耗时和 token 对比基线。
-
-## 12. 测试方案
-
-### 12.1 单元测试
-
-- `ReasoningConfig` 所有合法/非法组合。
-- `provider_default` 不产生任何新增参数。
-- 显式配置覆盖模型/调用 `extra_args` 的顺序。
-- reasoning 配置与高级参数冲突时拒绝。
-- OpenAI 档位原样映射。
-- Anthropic 档位映射，以及高级参数预算兼容。
-- Gemini 2 budget、Gemini 3 level，以及不支持真正关闭时拒绝。
-- DeepSeek 只显示/接受 toggle，非 `none` effort 不伪装成不同档位。
-- Ollama 布尔与分级模型差异。
-- Volcengine enabled/disabled/auto 翻译。
-- 未知 Provider 只允许 Provider Default，或在显式测试后使用标准参数。
-- 非流式 `reasoning_content` 保存到 `provider_specific_fields`。
-- 流式 reasoning 分片累计后仍能 round-trip。
-- Gemini thought signature 和工具调用现有测试不能回归。
-
-### 12.2 服务与持久化测试
-
-- 新建、读取、更新模型的 `reasoning_config`。
-- Alembic 从当前 head 升级后默认值正确。
-- 模型测试接口与真实 Local Agent 使用同一翻译函数。
-- 旧模型、旧 `extra_args` 和 `remove-think` 行为不变。
-
-### 12.3 前端测试
-
-- 能力不同的模型显示正确控件。
-- 离散滑杆只能停在后端返回的可用档位。
-- 当前档位文字、键盘操作和 ARIA value text 正确。
-- 仅开关模型、不可关闭模型、完整档位模型分别显示正确刻度。
-- fallback 能力不兼容时阻止保存并给出明确提示。
-- 中英文文案完整，移动端 Popover 不溢出。
-
-### 12.4 Provider 冒烟测试
-
-至少选取以下真实或可控 mock：
-
-- 一个支持 `none` 的 OpenAI reasoning 模型。
-- 一个不支持 `none` 的 reasoning 模型。
-- 一个 Anthropic adaptive thinking 模型。
-- 一个 Gemini 2.x 与一个 Gemini 3.x 模型。
-- 一个 DeepSeek hybrid thinking 模型，执行两轮含工具调用对话。
-- 一个 Ollama 本地 reasoning 模型。
-- 一个 OpenAI-compatible 自定义网关，验证 Provider Default 完全不变。
-
-每个模型比较 Provider Default、最低档、中档、高档或关闭，记录成功率、首 token 延迟、总耗时、总 token 和 reasoning token（若可用）。
-
-## 13. 风险与控制
-
-| 风险 | 影响 | 控制措施 |
-| --- | --- | --- |
-| 将“最低思考”误当成“关闭” | 用户以为节省了成本，实际仍在推理 | `can_disable` 严格校验，不静默降级 |
-| 模型能力表过期 | 新模型无法配置或旧模型报错 | 能力未知时保守；允许测试；升级 LiteLLM 时回归 |
-| 高 effort 导致延迟/费用陡增 | 用户体验和预算风险 | 默认 Provider Default；UI 提示；后续监控 reasoning token |
-| `extra_args` 与统一配置冲突 | 实际生效值不可预测 | 保存/测试时拒绝冲突；统一策略最后应用 |
-| reasoning 原文进入日志 | 敏感信息泄露 | 不记录原文，只记录策略和 token |
-| 多轮 reasoning 丢失 | 工具调用或后续轮次失败/降质 | 结构化保存并 round-trip；流式专项测试 |
-| 修改 Provider 路由造成通用回归 | 非 reasoning 请求也受影响 | 国内 Provider 路由放第二阶段，独立提交和回归 |
-
-## 14. 需要审核确认的决策
-
-1. **是否同意三层分离**：能力、策略、展示互不替代，保留 `remove-think` 仅控制展示。
-2. **是否同意严格语义**：显式关闭无法准确执行时直接报错，不自动降为最低思考。
-3. **是否同意请求级配置**：流水线按模型 UUID 保存挡位，不把产品配置塞进 `extra_args`。
-4. **是否同意 Runner 边界**：仅 Local Agent 展示控制项，外部 Runner 由其外部系统管理模型策略。
-5. **是否同意保守默认**：所有现有模型迁移为 Provider Default，不自动开启、关闭或迁移旧高级参数。
-6. **是否把结构化 reasoning 保留纳入第一阶段**：这是 DeepSeek 多轮和工具调用正确性的必要条件，建议必须纳入。
-
-## 15. 推荐审核结果
-
-建议按以上 6 项全部通过，并将 Phase 1 作为一个完整功能单元实施。不要只增加前端开关或只在 `extra_args` 中写 `reasoning_effort`；那样虽然改动小，但会继续混淆展示与推理、无法处理 Provider 差异，也无法保证多轮对话正确性。

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "langbot"
-version = "4.10.6"
+version = "4.10.7"
 description = "Production-grade platform for building agentic IM bots"
 readme = "README.md"
 license-files = ["LICENSE"]
@@ -71,7 +71,7 @@ dependencies = [
     "chromadb>=1.0.0,<2.0.0",
     "qdrant-client (>=1.15.1,<2.0.0)",
     "pyseekdb==1.1.0.post3",
-    "langbot-plugin @ git+https://github.com/langbot-app/langbot-plugin-sdk.git@1d65ed301a6afc52150a998043f73cd6032c8162",
+    "langbot-plugin @ git+https://github.com/langbot-app/langbot-plugin-sdk.git@101e453e916b39465a6294d6471c9eaae8725d5c",
     "asyncpg>=0.30.0",
     "line-bot-sdk>=3.19.0",
     "matrix-nio>=0.25.2",

src/langbot/pkg/api/http/authz.py

@@ -19,7 +19,6 @@ class Permission(enum.StrEnum):
     WORKSPACE_VIEW = 'workspace.view'
     WORKSPACE_UPDATE = 'workspace.update'
     WORKSPACE_DELETE = 'workspace.delete'
-    OWNER_TRANSFER = 'owner.transfer'
     MEMBER_VIEW = 'member.view'
     MEMBER_INVITE = 'member.invite'
     MEMBER_UPDATE_ROLE = 'member.update_role'
@@ -49,7 +48,6 @@ _ROLE_PERMISSIONS: typing.Final = types.MappingProxyType(
             if permission
             not in {
                 Permission.WORKSPACE_DELETE,
-                Permission.OWNER_TRANSFER,
                 Permission.BILLING_LINK_MANAGE,
             }
         ),

src/langbot/pkg/api/http/controller/group.py

@@ -62,7 +62,6 @@ class AuthType(enum.Enum):
 
 _SUPPORT_ADMIN_DENIED_PERMISSIONS = frozenset(
     {
-        Permission.OWNER_TRANSFER.value,
         Permission.MEMBER_VIEW.value,
         Permission.MEMBER_INVITE.value,
         Permission.MEMBER_UPDATE_ROLE.value,

src/langbot/pkg/api/http/controller/groups/user.py

@@ -285,8 +285,25 @@ class UserRouterGroup(group.RouterGroup):
                 request_context.workspace_uuid,
             )
             owner = await self.ap.user_service.get_workspace_owner(access.workspace.uuid)
-            owner_space_bound = bool(owner and owner.space_account_uuid)
-            credits = await self.ap.space_service.get_credits(owner.user) if owner_space_bound else None
+            cloud_mode = getattr(getattr(self.ap, 'deployment', None), 'mode', 'oss') == 'cloud'
+            owner_has_local_space_credentials = bool(owner and owner.space_account_uuid)
+            # Cloud Accounts authenticate through LangBot Account, so every projected
+            # Workspace owner is already bound even when this Core has no local OAuth
+            # token row (model billing uses the owner's control-plane API key).
+            owner_space_bound = cloud_mode or owner_has_local_space_credentials
+            if cloud_mode:
+                catalog_service = getattr(self.ap, 'cloud_model_catalog_service', None)
+                credits = (
+                    catalog_service.get_workspace_credits(access.workspace.uuid)
+                    if catalog_service is not None
+                    else None
+                )
+            else:
+                credits = (
+                    await self.ap.space_service.get_credits(owner.user)
+                    if owner is not None and owner.space_account_uuid
+                    else None
+                )
             return self.success(
                 data={
                     'credits': credits,
@@ -302,8 +319,10 @@ class UserRouterGroup(group.RouterGroup):
                 return self.success(data={'initialized': False})
 
             capabilities = await self.ap.user_service.get_login_capabilities()
-            if getattr(getattr(self.ap, 'deployment', None), 'mode', 'oss') == 'cloud':
+            cloud_mode = getattr(getattr(self.ap, 'deployment', None), 'mode', 'oss') == 'cloud'
+            if cloud_mode:
                 capabilities['password_login_enabled'] = False
+            capabilities['authenticated_invitation_acceptance_enabled'] = cloud_mode
             return self.success(data={'initialized': True, **capabilities})
 
         @self.route('/set-password', methods=['POST'], auth_type=group.AuthType.USER_TOKEN)

src/langbot/pkg/api/http/service/model.py

@@ -5,11 +5,11 @@ import uuid
 import sqlalchemy
 from langbot_plugin.api.entities.builtin.provider import message as provider_message
 
+from ....cloud.model_catalog import LANGBOT_MODELS_PROVIDER_REQUESTER
 from ....core import app
 from ....entity.persistence import model as persistence_model
 from ....entity.persistence import pipeline as persistence_pipeline
 from ....provider.modelmgr import requester as model_requester
-from ....provider.modelmgr import reasoning as model_reasoning
 from ....workspace.errors import WorkspaceNotFoundError
 from .secrets import mask_secret_value, redact_secrets, restore_secret_placeholders
 from .tenant import TenantContext, require_workspace_uuid, scope_statement
@@ -55,53 +55,6 @@ def _redact_model_secrets(model_data: dict) -> dict:
     return redacted
 
 
-def _normalize_llm_reasoning(model_data: dict) -> None:
-    model_data['reasoning_config'] = model_reasoning.validate_reasoning_config(
-        model_data.get('reasoning_config'),
-        model_data.get('abilities'),
-        model_data.get('extra_args'),
-    )
-
-
-def _validate_llm_reasoning_capability(
-    model_entity: persistence_model.LLMModel,
-    runtime_provider: model_requester.RuntimeProvider,
-) -> None:
-    config = model_reasoning.normalize_reasoning_config(model_entity.reasoning_config)
-    if config['level'] == 'provider_default':
-        return
-
-    runtime_model = model_requester.RuntimeLLMModel(
-        execution_context=runtime_provider.execution_context,
-        model_entity=model_entity,
-        provider=runtime_provider,
-    )
-    capabilities = runtime_provider.requester.get_reasoning_capabilities(runtime_model)
-    model_reasoning.validate_reasoning_capabilities(config, capabilities, model_entity.name)
-
-
-def _reasoning_capabilities(ap: app.Application, model: persistence_model.LLMModel) -> dict:
-    model_mgr = getattr(ap, 'model_mgr', None)
-    runtime_models = getattr(model_mgr, 'llm_model_dict', {}) if model_mgr is not None else {}
-    for runtime_model in runtime_models.values():
-        if (
-            runtime_model.model_entity.uuid == model.uuid
-            and runtime_model.model_entity.workspace_uuid == model.workspace_uuid
-        ):
-            return runtime_model.provider.requester.get_reasoning_capabilities(runtime_model)
-    return model_reasoning.default_reasoning_capabilities(
-        supported='reasoning' in (model.abilities or []),
-        source='manual' if 'reasoning' in (model.abilities or []) else 'unknown',
-    )
-
-
-def _serialize_llm_model(ap: app.Application, model: persistence_model.LLMModel) -> dict:
-    model_dict = ap.persistence_mgr.serialize_model(persistence_model.LLMModel, model)
-    model_dict['reasoning_config'] = model_reasoning.normalize_reasoning_config(model_dict.get('reasoning_config'))
-    model_dict['reasoning_capabilities'] = _reasoning_capabilities(ap, model)
-    return model_dict
-
-
 async def _validate_provider_supports(
     ap: app.Application,
     context: TenantContext,
@@ -161,6 +114,23 @@ async def _require_workspace_provider(
     return provider
 
 
+def _is_cloud_runtime(ap: app.Application) -> bool:
+    mode = getattr(ap.persistence_mgr, 'mode', None)
+    return getattr(mode, 'value', None) == 'cloud_runtime'
+
+
+async def _assert_cloud_managed_provider_mutable(
+    ap: app.Application,
+    context: TenantContext,
+    provider_uuid: str,
+) -> None:
+    if not _is_cloud_runtime(ap):
+        return
+    provider = await _require_workspace_provider(ap, context, provider_uuid)
+    if provider.get('requester') == LANGBOT_MODELS_PROVIDER_REQUESTER:
+        raise ValueError('LangBot Models is managed by Cloud and cannot be modified')
+
+
 async def _require_runtime_provider(
     ap: app.Application,
     context: TenantContext,
@@ -195,7 +165,7 @@ class LLMModelsService:
 
         models_list = []
         for model in models:
-            model_dict = _serialize_llm_model(self.ap, model)
+            model_dict = self.ap.persistence_mgr.serialize_model(persistence_model.LLMModel, model)
             provider = providers.get(model.provider_uuid)
             if provider:
                 provider_dict = self.ap.persistence_mgr.serialize_model(persistence_model.ModelProvider, provider)
@@ -226,7 +196,7 @@ class LLMModelsService:
             )
         )
         models = result.all()
-        serialized = [_serialize_llm_model(self.ap, model) for model in models]
+        serialized = [self.ap.persistence_mgr.serialize_model(persistence_model.LLMModel, m) for m in models]
         return serialized if include_secret else [_redact_model_secrets(model) for model in serialized]
 
     async def create_llm_model(
@@ -261,18 +231,15 @@ class LLMModelsService:
                 model_data['provider_uuid'] = provider_uuid
 
         await _require_workspace_provider(self.ap, context, model_data['provider_uuid'])
+        await _assert_cloud_managed_provider_mutable(self.ap, context, model_data['provider_uuid'])
         await _validate_provider_supports(self.ap, context, model_data['provider_uuid'], 'llm')
-        _normalize_llm_reasoning(model_data)
-
-        runtime_provider = await _require_runtime_provider(self.ap, context, model_data['provider_uuid'])
-        model_entity = persistence_model.LLMModel(**model_data)
-        _validate_llm_reasoning_capability(model_entity, runtime_provider)
 
         await self.ap.persistence_mgr.execute_async(sqlalchemy.insert(persistence_model.LLMModel).values(**model_data))
 
+        runtime_provider = await _require_runtime_provider(self.ap, context, model_data['provider_uuid'])
         runtime_llm_model = await self.ap.model_mgr.load_llm_model_with_provider(
             context,
-            model_entity,
+            persistence_model.LLMModel(**model_data),
             runtime_provider,
         )
         await self.ap.model_mgr.cache_llm_model(context, runtime_llm_model)
@@ -320,7 +287,7 @@ class LLMModelsService:
         if model is None:
             return None
 
-        model_dict = _serialize_llm_model(self.ap, model)
+        model_dict = self.ap.persistence_mgr.serialize_model(persistence_model.LLMModel, model)
 
         # Get provider
         provider_result = await self.ap.persistence_mgr.execute_async(
@@ -343,11 +310,17 @@ class LLMModelsService:
 
         return model_dict
 
-    async def update_llm_model(self, context: TenantContext, model_uuid: str, model_data: dict) -> None:
+    async def update_llm_model(
+        self,
+        context: TenantContext,
+        model_uuid: str,
+        model_data: dict,
+    ) -> None:
         """Update an existing LLM model"""
         existing_model = await self.get_llm_model(context, model_uuid, include_secret=True)
         if existing_model is None:
             raise WorkspaceNotFoundError('Model not found')
+        await _assert_cloud_managed_provider_mutable(self.ap, context, existing_model['provider_uuid'])
         model_data = model_data.copy()
         model_data.pop('uuid', None)
         model_data.pop('workspace_uuid', None)
@@ -373,20 +346,9 @@ class LLMModelsService:
 
         provider_uuid = model_data.get('provider_uuid', existing_model['provider_uuid'])
         await _require_workspace_provider(self.ap, context, provider_uuid)
+        await _assert_cloud_managed_provider_mutable(self.ap, context, provider_uuid)
         await _validate_provider_supports(self.ap, context, provider_uuid, 'llm')
 
-        merged_model_data = {
-            key: value
-            for key, value in {**existing_model, **model_data, 'provider_uuid': provider_uuid}.items()
-            if key not in {'provider', 'created_at', 'updated_at', 'reasoning_capabilities'}
-        }
-        _normalize_llm_reasoning(merged_model_data)
-        model_data['reasoning_config'] = merged_model_data['reasoning_config']
-
-        runtime_provider = await _require_runtime_provider(self.ap, context, provider_uuid)
-        model_entity = persistence_model.LLMModel(**_runtime_model_data(model_uuid, merged_model_data))
-        _validate_llm_reasoning_capability(model_entity, runtime_provider)
-
         result = await self.ap.persistence_mgr.execute_async(
             scope_statement(
                 sqlalchemy.update(persistence_model.LLMModel)
@@ -400,15 +362,30 @@ class LLMModelsService:
             raise WorkspaceNotFoundError('Model not found')
 
         await self.ap.model_mgr.remove_llm_model(context, model_uuid)
+        runtime_provider = await _require_runtime_provider(self.ap, context, provider_uuid)
         runtime_llm_model = await self.ap.model_mgr.load_llm_model_with_provider(
             context,
-            model_entity,
+            persistence_model.LLMModel(
+                **_runtime_model_data(
+                    model_uuid,
+                    {
+                        key: value
+                        for key, value in {**existing_model, **model_data, 'provider_uuid': provider_uuid}.items()
+                        if key not in {'provider', 'created_at', 'updated_at'}
+                    },
+                )
+            ),
             runtime_provider,
         )
         await self.ap.model_mgr.cache_llm_model(context, runtime_llm_model)
 
     async def delete_llm_model(self, context: TenantContext, model_uuid: str) -> None:
         """Delete an LLM model"""
+        if _is_cloud_runtime(self.ap):
+            existing_model = await self.get_llm_model(context, model_uuid, include_secret=True)
+            if existing_model is None:
+                raise WorkspaceNotFoundError('Model not found')
+            await _assert_cloud_managed_provider_mutable(self.ap, context, existing_model['provider_uuid'])
         result = await self.ap.persistence_mgr.execute_async(
             scope_statement(
                 sqlalchemy.delete(persistence_model.LLMModel).where(persistence_model.LLMModel.uuid == model_uuid),
@@ -430,7 +407,6 @@ class LLMModelsService:
                 raise WorkspaceNotFoundError('Model not found')
             runtime_llm_model = await self.ap.model_mgr.get_model_by_uuid(context, model_uuid)
         else:
-            _normalize_llm_reasoning(model_data)
             runtime_llm_model = await self.ap.model_mgr.init_temporary_runtime_llm_model(context, model_data)
 
         extra_args = model_data.get('extra_args', {})
@@ -503,7 +479,10 @@ class EmbeddingModelsService:
         return serialized if include_secret else [_redact_model_secrets(model) for model in serialized]
 
     async def create_embedding_model(
-        self, context: TenantContext, model_data: dict, preserve_uuid: bool = False
+        self,
+        context: TenantContext,
+        model_data: dict,
+        preserve_uuid: bool = False,
     ) -> str:
         """Create a new embedding model"""
         model_data = model_data.copy()
@@ -527,6 +506,7 @@ class EmbeddingModelsService:
                 model_data['provider_uuid'] = provider_uuid
 
         await _require_workspace_provider(self.ap, context, model_data['provider_uuid'])
+        await _assert_cloud_managed_provider_mutable(self.ap, context, model_data['provider_uuid'])
         await _validate_provider_supports(self.ap, context, model_data['provider_uuid'], 'text-embedding')
 
         await self.ap.persistence_mgr.execute_async(
@@ -585,11 +565,17 @@ class EmbeddingModelsService:
 
         return model_dict
 
-    async def update_embedding_model(self, context: TenantContext, model_uuid: str, model_data: dict) -> None:
+    async def update_embedding_model(
+        self,
+        context: TenantContext,
+        model_uuid: str,
+        model_data: dict,
+    ) -> None:
         """Update an existing embedding model"""
         existing_model = await self.get_embedding_model(context, model_uuid, include_secret=True)
         if existing_model is None:
             raise WorkspaceNotFoundError('Model not found')
+        await _assert_cloud_managed_provider_mutable(self.ap, context, existing_model['provider_uuid'])
         model_data = model_data.copy()
         model_data.pop('uuid', None)
         model_data.pop('workspace_uuid', None)
@@ -614,6 +600,7 @@ class EmbeddingModelsService:
 
         provider_uuid = model_data.get('provider_uuid', existing_model['provider_uuid'])
         await _require_workspace_provider(self.ap, context, provider_uuid)
+        await _assert_cloud_managed_provider_mutable(self.ap, context, provider_uuid)
         await _validate_provider_supports(self.ap, context, provider_uuid, 'text-embedding')
 
         result = await self.ap.persistence_mgr.execute_async(
@@ -648,6 +635,11 @@ class EmbeddingModelsService:
 
     async def delete_embedding_model(self, context: TenantContext, model_uuid: str) -> None:
         """Delete an embedding model"""
+        if _is_cloud_runtime(self.ap):
+            existing_model = await self.get_embedding_model(context, model_uuid, include_secret=True)
+            if existing_model is None:
+                raise WorkspaceNotFoundError('Model not found')
+            await _assert_cloud_managed_provider_mutable(self.ap, context, existing_model['provider_uuid'])
         result = await self.ap.persistence_mgr.execute_async(
             scope_statement(
                 sqlalchemy.delete(persistence_model.EmbeddingModel).where(
@@ -740,7 +732,12 @@ class RerankModelsService:
         serialized = [self.ap.persistence_mgr.serialize_model(persistence_model.RerankModel, m) for m in models]
         return serialized if include_secret else [_redact_model_secrets(model) for model in serialized]
 
-    async def create_rerank_model(self, context: TenantContext, model_data: dict, preserve_uuid: bool = False) -> str:
+    async def create_rerank_model(
+        self,
+        context: TenantContext,
+        model_data: dict,
+        preserve_uuid: bool = False,
+    ) -> str:
         """Create a new rerank model"""
         model_data = model_data.copy()
         if not preserve_uuid:
@@ -763,6 +760,7 @@ class RerankModelsService:
                 model_data['provider_uuid'] = provider_uuid
 
         await _require_workspace_provider(self.ap, context, model_data['provider_uuid'])
+        await _assert_cloud_managed_provider_mutable(self.ap, context, model_data['provider_uuid'])
         await _validate_provider_supports(self.ap, context, model_data['provider_uuid'], 'rerank')
 
         await self.ap.persistence_mgr.execute_async(
@@ -821,11 +819,17 @@ class RerankModelsService:
 
         return model_dict
 
-    async def update_rerank_model(self, context: TenantContext, model_uuid: str, model_data: dict) -> None:
+    async def update_rerank_model(
+        self,
+        context: TenantContext,
+        model_uuid: str,
+        model_data: dict,
+    ) -> None:
         """Update an existing rerank model"""
         existing_model = await self.get_rerank_model(context, model_uuid, include_secret=True)
         if existing_model is None:
             raise WorkspaceNotFoundError('Model not found')
+        await _assert_cloud_managed_provider_mutable(self.ap, context, existing_model['provider_uuid'])
         model_data = model_data.copy()
         model_data.pop('uuid', None)
         model_data.pop('workspace_uuid', None)
@@ -850,6 +854,7 @@ class RerankModelsService:
 
         provider_uuid = model_data.get('provider_uuid', existing_model['provider_uuid'])
         await _require_workspace_provider(self.ap, context, provider_uuid)
+        await _assert_cloud_managed_provider_mutable(self.ap, context, provider_uuid)
         await _validate_provider_supports(self.ap, context, provider_uuid, 'rerank')
 
         result = await self.ap.persistence_mgr.execute_async(
@@ -884,6 +889,11 @@ class RerankModelsService:
 
     async def delete_rerank_model(self, context: TenantContext, model_uuid: str) -> None:
         """Delete a rerank model"""
+        if _is_cloud_runtime(self.ap):
+            existing_model = await self.get_rerank_model(context, model_uuid, include_secret=True)
+            if existing_model is None:
+                raise WorkspaceNotFoundError('Model not found')
+            await _assert_cloud_managed_provider_mutable(self.ap, context, existing_model['provider_uuid'])
         result = await self.ap.persistence_mgr.execute_async(
             scope_statement(
                 sqlalchemy.delete(persistence_model.RerankModel).where(

src/langbot/pkg/api/http/service/provider.py

@@ -5,6 +5,7 @@ import traceback
 
 import sqlalchemy
 
+from ....cloud.model_catalog import LANGBOT_MODELS_PROVIDER_REQUESTER
 from ....core import app
 from ....entity.persistence import model as persistence_model
 from ....workspace.errors import WorkspaceNotFoundError
@@ -20,6 +21,20 @@ class ModelProviderService:
     def __init__(self, ap: app.Application) -> None:
         self.ap = ap
 
+    def _is_cloud_runtime(self) -> bool:
+        mode = getattr(self.ap.persistence_mgr, 'mode', None)
+        return getattr(mode, 'value', None) == 'cloud_runtime'
+
+    def _system_requester_is_reserved(self, requester: object) -> bool:
+        return self._is_cloud_runtime() and requester == LANGBOT_MODELS_PROVIDER_REQUESTER
+
+    async def _assert_provider_mutable(self, context: TenantContext, provider_uuid: str) -> None:
+        if not self._is_cloud_runtime():
+            return
+        provider = await self.get_provider(context, provider_uuid)
+        if provider is not None and self._system_requester_is_reserved(provider.get('requester')):
+            raise ValueError('LangBot Models is managed by Cloud and cannot be modified')
+
     @staticmethod
     def _normalize_api_keys(api_keys: str | list[str] | tuple[str, ...] | None) -> list[str]:
         if api_keys is None:
@@ -99,6 +114,8 @@ class ModelProviderService:
     async def create_provider(self, context: TenantContext, provider_data: dict) -> str:
         """Create a new provider"""
         provider_data = provider_data.copy()
+        if self._system_requester_is_reserved(provider_data.get('requester')):
+            raise ValueError('space-chat-completions is reserved for the Cloud-managed LangBot Models provider')
         provider_data['uuid'] = str(uuid.uuid4())
         provider_data['workspace_uuid'] = require_workspace_uuid(context)
         provider_data['api_keys'] = self._normalize_api_keys(
@@ -115,7 +132,10 @@ class ModelProviderService:
 
     async def update_provider(self, context: TenantContext, provider_uuid: str, provider_data: dict) -> None:
         """Update an existing provider"""
+        await self._assert_provider_mutable(context, provider_uuid)
         provider_data = provider_data.copy()
+        if self._system_requester_is_reserved(provider_data.get('requester')):
+            raise ValueError('space-chat-completions is reserved for the Cloud-managed LangBot Models provider')
         provider_data.pop('uuid', None)
         provider_data.pop('workspace_uuid', None)
         if 'api_keys' in provider_data:
@@ -145,6 +165,7 @@ class ModelProviderService:
 
     async def delete_provider(self, context: TenantContext, provider_uuid: str) -> None:
         """Delete a provider (only if no models reference it)"""
+        await self._assert_provider_mutable(context, provider_uuid)
         workspace_uuid = require_workspace_uuid(context)
         # Check if any models use this provider
         llm_result = await self.ap.persistence_mgr.execute_async(
@@ -245,6 +266,8 @@ class ModelProviderService:
         api_keys: list,
     ) -> str:
         """Find existing provider or create new one"""
+        if self._system_requester_is_reserved(requester):
+            raise ValueError('space-chat-completions is reserved for the Cloud-managed LangBot Models provider')
         workspace_uuid = require_workspace_uuid(context)
         api_keys = self._normalize_api_keys(restore_secret_placeholders(api_keys, sensitive=True))
 

src/langbot/pkg/cloud/bootstrap.py

@@ -13,6 +13,7 @@ from typing import Any, Protocol, runtime_checkable
 from ..workspace.policy import CloudWorkspacePolicy, SingleWorkspacePolicy
 from .directory import DirectoryProjectionProvider, directory_projection_limits_from_config
 from .entitlements import EntitlementProvider, OpenSourceEntitlementProvider
+from .model_catalog import CloudModelCatalogProvider
 
 
 CLOUD_BOOTSTRAP_ENTRY_POINT = 'langbot.cloud_bootstrap'
@@ -50,6 +51,7 @@ class OpenSourceDeployment:
     )
     directory_provider: None = None
     manifest_provider: None = None
+    model_catalog_provider: None = None
     persistence_mode: str = 'oss_compat'
     required_vector_backend: str | None = None
 
@@ -80,6 +82,7 @@ class VerifiedCloudDeployment:
     entitlement_provider: EntitlementProvider
     directory_provider: DirectoryProjectionProvider
     manifest_provider: CloudManifestProvider
+    model_catalog_provider: CloudModelCatalogProvider
     verification_key_id: str
     mode: str = dataclasses.field(default='cloud', init=False)
     workspace_policy: CloudWorkspacePolicy = dataclasses.field(default_factory=CloudWorkspacePolicy, init=False)
@@ -110,6 +113,8 @@ class VerifiedCloudDeployment:
             raise CloudBootstrapError('Verified Cloud bootstrap did not provide a directory adapter')
         if not isinstance(self.manifest_provider, CloudManifestProvider):
             raise CloudBootstrapError('Verified Cloud bootstrap did not provide a Manifest renewal adapter')
+        if not isinstance(self.model_catalog_provider, CloudModelCatalogProvider):
+            raise CloudBootstrapError('Verified Cloud bootstrap did not provide a model catalog adapter')
 
     def validate_instance_config(self, config: dict[str, Any]) -> None:
         try:
@@ -138,8 +143,14 @@ class VerifiedCloudDeployment:
         if plugin_worker.get('require_hard_limits') is not True:
             raise CloudBootstrapError('Cloud Runtime requires plugin.worker.require_hard_limits=true')
         box_config = config.get('box', {})
-        if box_config.get('enabled') is not True:
-            raise CloudBootstrapError('Cloud runtime requires box.enabled=true')
+        box_enabled = box_config.get('enabled')
+        if box_enabled is False:
+            # Explicitly disabling Box removes the sandbox surface entirely and
+            # therefore does not weaken tenant isolation. Validate the strict
+            # runtime/admission contract only when the surface is enabled.
+            return
+        if box_enabled is not True:
+            raise CloudBootstrapError('Cloud runtime requires box.enabled to be an explicit boolean')
         if box_config.get('backend') != 'nsjail':
             raise CloudBootstrapError('Cloud runtime requires box.backend=nsjail')
         runtime_endpoint = str(box_config.get('runtime', {}).get('endpoint', '') or '').strip()

src/langbot/pkg/cloud/model_catalog.py

@@ -0,0 +1,327 @@
+from __future__ import annotations
+
+import asyncio
+import uuid
+from datetime import datetime
+from typing import Any, Literal, Protocol, runtime_checkable
+
+import sqlalchemy
+from pydantic import BaseModel, ConfigDict, Field, SecretStr, field_validator
+
+from ..entity.persistence import model as persistence_model
+
+
+LANGBOT_MODELS_PROVIDER_REQUESTER = 'space-chat-completions'
+LANGBOT_MODELS_PROVIDER_NAME = 'LangBot Models'
+_MODEL_RESOURCE_NAMESPACE = uuid.UUID('94c703ca-1df5-4e91-bcd3-74ac65cb7921')
+_SUPPORTED_CATEGORIES = {'chat', 'embedding', 'rerank'}
+_MODEL_TABLES = (
+    persistence_model.LLMModel,
+    persistence_model.EmbeddingModel,
+    persistence_model.RerankModel,
+)
+
+
+class CloudModelCatalogItem(BaseModel):
+    model_config = ConfigDict(extra='forbid', frozen=True)
+
+    uuid: str = Field(min_length=1, max_length=255)
+    model_id: str = Field(min_length=1, max_length=255)
+    category: Literal['chat', 'embedding', 'rerank']
+    llm_abilities: tuple[str, ...] = ()
+    is_featured: bool = False
+    featured_order: int = 0
+
+    @field_validator('llm_abilities', mode='before')
+    @classmethod
+    def normalize_missing_abilities(cls, value: Any) -> Any:
+        return () if value is None else value
+
+    @field_validator('llm_abilities')
+    @classmethod
+    def validate_abilities(cls, value: tuple[str, ...]) -> tuple[str, ...]:
+        if any(not item.strip() or len(item) > 64 for item in value):
+            raise ValueError('Model abilities must be non-empty strings of at most 64 characters')
+        if len(set(value)) != len(value):
+            raise ValueError('Model abilities must be unique')
+        return value
+
+
+class CloudWorkspaceModelBilling(BaseModel):
+    model_config = ConfigDict(extra='forbid', frozen=True)
+
+    workspace_uuid: str = Field(min_length=36, max_length=36)
+    owner_account_uuid: str | None = Field(default=None, min_length=36, max_length=36)
+    api_key: SecretStr | None = None
+    credits: int | None = None
+
+    @field_validator('workspace_uuid')
+    @classmethod
+    def validate_uuid(cls, value: str) -> str:
+        return str(uuid.UUID(value))
+
+    @field_validator('owner_account_uuid')
+    @classmethod
+    def validate_optional_uuid(cls, value: str | None) -> str | None:
+        return None if value is None else str(uuid.UUID(value))
+
+
+class CloudModelCatalogSnapshot(BaseModel):
+    model_config = ConfigDict(extra='forbid', frozen=True)
+
+    instance_uuid: str = Field(min_length=1, max_length=255)
+    generated_at: datetime
+    base_url: str = Field(min_length=1, max_length=512)
+    models: tuple[CloudModelCatalogItem, ...]
+    workspaces: tuple[CloudWorkspaceModelBilling, ...]
+
+    @field_validator('base_url')
+    @classmethod
+    def validate_base_url(cls, value: str) -> str:
+        normalized = value.rstrip('/')
+        if not normalized.startswith('https://'):
+            raise ValueError('Cloud model gateway base URL must use HTTPS')
+        return normalized
+
+    @field_validator('models')
+    @classmethod
+    def validate_models(cls, value: tuple[CloudModelCatalogItem, ...]) -> tuple[CloudModelCatalogItem, ...]:
+        if len(value) > 500:
+            raise ValueError('Cloud model catalog exceeds 500 models')
+        identities = {(item.category, item.uuid) for item in value}
+        if len(identities) != len(value):
+            raise ValueError('Cloud model catalog contains duplicate model identities')
+        return value
+
+    @field_validator('workspaces')
+    @classmethod
+    def validate_workspaces(
+        cls, value: tuple[CloudWorkspaceModelBilling, ...]
+    ) -> tuple[CloudWorkspaceModelBilling, ...]:
+        if len(value) > 10_000:
+            raise ValueError('Cloud model catalog exceeds 10000 Workspaces')
+        identities = {item.workspace_uuid for item in value}
+        if len(identities) != len(value):
+            raise ValueError('Cloud model catalog contains duplicate Workspaces')
+        return value
+
+
+@runtime_checkable
+class CloudModelCatalogProvider(Protocol):
+    async def fetch_model_catalog(self, instance_uuid: str) -> CloudModelCatalogSnapshot:
+        """Fetch and verify the complete model catalog and Workspace billing projection."""
+        ...
+
+
+def system_provider_uuid(workspace_uuid: str) -> str:
+    workspace = str(uuid.UUID(workspace_uuid))
+    return str(uuid.uuid5(_MODEL_RESOURCE_NAMESPACE, f'{workspace}:provider:{LANGBOT_MODELS_PROVIDER_REQUESTER}'))
+
+
+def system_model_uuid(workspace_uuid: str, category: str, upstream_uuid: str) -> str:
+    workspace = str(uuid.UUID(workspace_uuid))
+    if category not in _SUPPORTED_CATEGORIES:
+        raise ValueError(f'Unsupported model category: {category}')
+    if not upstream_uuid:
+        raise ValueError('Upstream model UUID is required')
+    return str(uuid.uuid5(_MODEL_RESOURCE_NAMESPACE, f'{workspace}:model:{category}:{upstream_uuid}'))
+
+
+class CloudModelCatalogSyncService:
+    """Reconcile Space-owned model catalog and Owner billing tokens into every Cloud Workspace."""
+
+    def __init__(
+        self,
+        ap: Any,
+        provider: CloudModelCatalogProvider,
+        instance_uuid: str,
+        *,
+        sync_interval_seconds: float = 3600.0,
+    ) -> None:
+        if not isinstance(provider, CloudModelCatalogProvider):
+            raise TypeError('Cloud model catalog sync requires a CloudModelCatalogProvider')
+        if sync_interval_seconds < 10:
+            raise ValueError('Cloud model catalog sync interval must be at least 10 seconds')
+        self.ap = ap
+        self.provider = provider
+        self.instance_uuid = instance_uuid
+        self.sync_interval_seconds = float(sync_interval_seconds)
+        # A tenant UoW commits one Workspace at a time. Keep a durable in-memory
+        # convergence marker so a failed runtime reload is retried even when the
+        # following database reconciliation is a no-op.
+        self._runtime_reload_pending = False
+        self._workspace_credits: dict[str, int | None] = {}
+
+    def get_workspace_credits(self, workspace_uuid: str) -> int | None:
+        """Return the latest signed owner-credit projection for a Workspace."""
+        return self._workspace_credits.get(str(uuid.UUID(workspace_uuid)))
+
+    async def initialize(self) -> None:
+        await self.sync_once(reload_runtime=False)
+
+    async def run(self) -> None:
+        while True:
+            await asyncio.sleep(self.sync_interval_seconds)
+            try:
+                await self.sync_once(reload_runtime=True)
+            except asyncio.CancelledError:
+                raise
+            except Exception as exc:
+                # Exception messages can contain rendered SQL bound values,
+                # including provider API keys. Log only the exception class.
+                self.ap.logger.warning(f'Cloud model catalog synchronization failed ({type(exc).__name__})')
+
+    async def sync_once(self, *, reload_runtime: bool = True) -> dict[str, int]:
+        summary = {'workspaces': 0, 'created': 0, 'updated': 0, 'deleted': 0}
+        snapshot: CloudModelCatalogSnapshot | None = None
+        sync_error: Exception | None = None
+        reload_error: Exception | None = None
+        try:
+            snapshot = await self.provider.fetch_model_catalog(self.instance_uuid)
+            if snapshot.instance_uuid != self.instance_uuid:
+                raise ValueError('Cloud model catalog targets another LangBot instance')
+
+            bindings = await self.ap.workspace_service.list_active_execution_bindings()
+            billing_by_workspace = {item.workspace_uuid: item for item in snapshot.workspaces}
+            missing = sorted(
+                binding.workspace_uuid for binding in bindings if binding.workspace_uuid not in billing_by_workspace
+            )
+            if missing:
+                raise ValueError(
+                    f'Cloud model catalog is missing billing projections for {len(missing)} active Workspaces'
+                )
+
+            for binding in bindings:
+                counts = await self._sync_workspace(
+                    binding.workspace_uuid,
+                    snapshot,
+                    billing_by_workspace[binding.workspace_uuid],
+                )
+                summary['workspaces'] += 1
+                workspace_changed = any(counts[key] > 0 for key in ('created', 'updated', 'deleted'))
+                if workspace_changed:
+                    # _sync_workspace returns only after its tenant UoW commits.
+                    self._runtime_reload_pending = True
+                for key in ('created', 'updated', 'deleted'):
+                    summary[key] += counts[key]
+                self._workspace_credits[binding.workspace_uuid] = billing_by_workspace[binding.workspace_uuid].credits
+        except Exception as exc:
+            sync_error = exc
+        finally:
+            model_mgr = getattr(self.ap, 'model_mgr', None)
+            if reload_runtime and self._runtime_reload_pending and model_mgr is not None:
+                try:
+                    await model_mgr.load_models_from_db()
+                except Exception as exc:
+                    reload_error = exc
+                else:
+                    self._runtime_reload_pending = False
+
+        if sync_error is not None:
+            if reload_error is not None:
+                raise sync_error from reload_error
+            raise sync_error
+        if reload_error is not None:
+            raise reload_error
+
+        changed = any(summary[key] > 0 for key in ('created', 'updated', 'deleted'))
+        if changed and snapshot is not None:
+            self.ap.logger.info(
+                'Cloud model catalog synchronized '
+                f'({summary["workspaces"]} Workspaces, {len(snapshot.models)} models, '
+                f'created={summary["created"]}, updated={summary["updated"]}, deleted={summary["deleted"]})'
+            )
+        return summary
+
+    async def _sync_workspace(
+        self,
+        workspace_uuid: str,
+        snapshot: CloudModelCatalogSnapshot,
+        billing: CloudWorkspaceModelBilling,
+    ) -> dict[str, int]:
+        counts = {'created': 0, 'updated': 0, 'deleted': 0}
+        provider_uuid = system_provider_uuid(workspace_uuid)
+        desired_keys = [billing.api_key.get_secret_value()] if billing.api_key is not None else []
+
+        async with self.ap.persistence_mgr.tenant_uow(workspace_uuid) as uow:
+            provider = await uow.session.scalar(
+                sqlalchemy.select(persistence_model.ModelProvider).where(
+                    persistence_model.ModelProvider.uuid == provider_uuid
+                )
+            )
+            provider_values = {
+                'workspace_uuid': workspace_uuid,
+                'name': LANGBOT_MODELS_PROVIDER_NAME,
+                'requester': LANGBOT_MODELS_PROVIDER_REQUESTER,
+                'base_url': snapshot.base_url,
+                'api_keys': desired_keys,
+            }
+            if provider is None:
+                provider = persistence_model.ModelProvider(uuid=provider_uuid, **provider_values)
+                uow.session.add(provider)
+                await uow.session.flush()
+                counts['created'] += 1
+            elif self._update_entity(provider, provider_values):
+                counts['updated'] += 1
+
+            existing_by_table: dict[type, dict[str, Any]] = {}
+            for table in _MODEL_TABLES:
+                rows = (
+                    await uow.session.scalars(sqlalchemy.select(table).where(table.provider_uuid == provider_uuid))
+                ).all()
+                existing_by_table[table] = {row.uuid: row for row in rows}
+
+            desired_ids: dict[type, set[str]] = {table: set() for table in _MODEL_TABLES}
+            for item in snapshot.models:
+                table, values = self._model_values(workspace_uuid, provider_uuid, item)
+                model_uuid = system_model_uuid(workspace_uuid, item.category, item.uuid)
+                desired_ids[table].add(model_uuid)
+                existing = existing_by_table[table].get(model_uuid)
+                if existing is None:
+                    uow.session.add(table(uuid=model_uuid, **values))
+                    counts['created'] += 1
+                elif self._update_entity(existing, values):
+                    counts['updated'] += 1
+
+            for table, entities in existing_by_table.items():
+                for model_uuid, entity in entities.items():
+                    if model_uuid not in desired_ids[table]:
+                        await uow.session.delete(entity)
+                        counts['deleted'] += 1
+
+        return counts
+
+    @staticmethod
+    def _update_entity(entity: Any, values: dict[str, Any]) -> bool:
+        changed = False
+        for key, value in values.items():
+            if getattr(entity, key) != value:
+                setattr(entity, key, value)
+                changed = True
+        return changed
+
+    @staticmethod
+    def _model_values(
+        workspace_uuid: str,
+        provider_uuid: str,
+        item: CloudModelCatalogItem,
+    ) -> tuple[type, dict[str, Any]]:
+        ranking = 100 - item.featured_order if item.is_featured else 0
+        common = {
+            'workspace_uuid': workspace_uuid,
+            'name': item.model_id,
+            'provider_uuid': provider_uuid,
+            'extra_args': {},
+            'prefered_ranking': ranking,
+        }
+        if item.category == 'chat':
+            return persistence_model.LLMModel, {
+                **common,
+                'abilities': list(item.llm_abilities),
+                'context_length': None,
+            }
+        if item.category == 'embedding':
+            return persistence_model.EmbeddingModel, common
+        if item.category == 'rerank':
+            return persistence_model.RerankModel, common
+        raise ValueError(f'Unsupported model category: {item.category}')

src/langbot/pkg/core/app.py

@@ -54,6 +54,7 @@ from ..cloud import launch as cloud_launch_module
 from ..cloud import support_admin as cloud_support_admin_module
 from ..cloud import directory_projection as cloud_directory_projection_module
 from ..cloud import entitlements as cloud_entitlements_module
+from ..cloud import model_catalog as cloud_model_catalog_module
 from ..api.http.context import ExecutionContext, PrincipalContext, PrincipalType
 
 
@@ -142,13 +143,12 @@ class Application:
     deployment: cloud_bootstrap_module.OpenSourceDeployment | cloud_bootstrap_module.VerifiedCloudDeployment = None
 
     deployment_admission: cloud_bootstrap_module.DeploymentAdmissionGuard = None
-
+    directory_projection_service: cloud_directory_projection_module.DirectoryProjectionService | None = None
+    cloud_model_catalog_service: cloud_model_catalog_module.CloudModelCatalogSyncService | None = None
     manifest_refresh_service: cloud_bootstrap_module.CloudManifestRefreshService | None = None
 
     entitlement_resolver: cloud_entitlements_module.EntitlementResolver | None = None
 
-    directory_projection_service: cloud_directory_projection_module.DirectoryProjectionService | None = None
-
     vector_db_mgr: vectordb_mgr.VectorDBManager = None
 
     http_ctrl: http_controller.HTTPController = None
@@ -306,6 +306,12 @@ class Application:
                     name='cloud-directory-projection',
                     scopes=[core_entities.LifecycleControlScope.APPLICATION],
                 )
+            if self.cloud_model_catalog_service is not None:
+                self.task_mgr.create_task(
+                    self.cloud_model_catalog_service.run(),
+                    name='cloud-model-catalog-sync',
+                    scopes=[core_entities.LifecycleControlScope.APPLICATION],
+                )
             if self.manifest_refresh_service is not None:
                 self.task_mgr.create_task(
                     self.manifest_refresh_service.run(),

src/langbot/pkg/core/stages/build_app.py

@@ -46,6 +46,7 @@ from ...cloud import support_admin as cloud_support_admin_module
 from ...cloud.directory import directory_projection_limits_from_config
 from ...cloud.directory_projection import DirectoryProjectionService
 from ...cloud.entitlements import EntitlementResolver
+from ...cloud.model_catalog import CloudModelCatalogSyncService
 from ...api.http.context import ExecutionContext, PrincipalContext, PrincipalType
 from ...api.http.authz import WorkspaceRequiredError
 
@@ -176,6 +177,16 @@ class BuildAppStage(stage.BootingStage):
             # of repeating tenant validation for every manager.
             await workspace_service_inst.prime_startup_execution_bindings()
 
+            if not isinstance(deployment, cloud_bootstrap.VerifiedCloudDeployment):
+                raise RuntimeError('Multi-Workspace runtime requires a verified Cloud deployment')
+            cloud_model_catalog_service = CloudModelCatalogSyncService(
+                ap,
+                deployment.model_catalog_provider,
+                constants.instance_id,
+            )
+            await cloud_model_catalog_service.initialize()
+            ap.cloud_model_catalog_service = cloud_model_catalog_service
+
         ap.workspace_collaboration_service = workspace_collaboration_module.WorkspaceCollaborationService(
             ap,
             workspace_service_inst,

src/langbot/pkg/entity/persistence/model.py

@@ -48,12 +48,6 @@ class LLMModel(Base):
     provider_uuid = sqlalchemy.Column(sqlalchemy.String(255), nullable=False)
     abilities = sqlalchemy.Column(sqlalchemy.JSON, nullable=False, default=[])
     context_length = sqlalchemy.Column(sqlalchemy.Integer, nullable=True)
-    reasoning_config = sqlalchemy.Column(
-        sqlalchemy.JSON,
-        nullable=False,
-        default=lambda: {'level': 'provider_default'},
-        server_default=sqlalchemy.text('\'{"level":"provider_default"}\''),
-    )
     extra_args = sqlalchemy.Column(sqlalchemy.JSON, nullable=False, default={})
     prefered_ranking = sqlalchemy.Column(sqlalchemy.Integer, nullable=False, default=0)
     created_at = sqlalchemy.Column(sqlalchemy.DateTime, nullable=False, server_default=sqlalchemy.func.now())

src/langbot/pkg/entity/persistence/workspace.py

@@ -163,6 +163,13 @@ class WorkspaceMembership(Base):
     __table_args__ = (
         sqlalchemy.UniqueConstraint('workspace_uuid', 'account_uuid', name='uq_workspace_membership_account'),
         sqlalchemy.Index('ix_workspace_memberships_account_status', 'account_uuid', 'status'),
+        sqlalchemy.Index(
+            'uq_workspace_memberships_one_active_owner',
+            'workspace_uuid',
+            unique=True,
+            sqlite_where=sqlalchemy.text("role = 'owner' AND status = 'active'"),
+            postgresql_where=sqlalchemy.text("role = 'owner' AND status = 'active'"),
+        ),
         sqlalchemy.CheckConstraint(
             "role IN ('owner', 'admin', 'developer', 'operator', 'viewer')",
             name='ck_workspace_memberships_role',

src/langbot/pkg/persistence/alembic/versions/0016_space_launch_replay.py

@@ -0,0 +1,57 @@
+"""add durable replay protection for signed Space launch assertions
+
+Revision ID: 0016_space_launch_replay
+Revises: 0015_cloud_core_collab
+Create Date: 2026-07-31
+"""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+
+revision = '0016_space_launch_replay'
+down_revision = '0015_cloud_core_collab'
+branch_labels = None
+depends_on = None
+
+_TABLE = 'space_launch_assertion_consumptions'
+_POLICY = 'langbot_directory_projection'
+_SETTING = "NULLIF(current_setting('langbot.directory_instance_uuid', true), '')"
+
+
+def upgrade() -> None:
+    conn = op.get_bind()
+    if _TABLE not in set(sa.inspect(conn).get_table_names()):
+        op.create_table(
+            _TABLE,
+            sa.Column('instance_uuid', sa.String(255), nullable=False),
+            sa.Column('jti', sa.String(255), nullable=False),
+            sa.Column('expires_at', sa.DateTime(timezone=True), nullable=False),
+            sa.Column('consumed_at', sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+            sa.PrimaryKeyConstraint('instance_uuid', 'jti'),
+        )
+        op.create_index(
+            'ix_space_launch_assertion_consumptions_expiry',
+            _TABLE,
+            ['instance_uuid', 'expires_at'],
+            unique=False,
+        )
+    if conn.dialect.name == 'postgresql':
+        table = conn.dialect.identifier_preparer.quote(_TABLE)
+        policy = conn.dialect.identifier_preparer.quote(_POLICY)
+        expression = f'instance_uuid::text = {_SETTING}'
+        op.execute(sa.text(f'ALTER TABLE {table} ENABLE ROW LEVEL SECURITY'))
+        op.execute(sa.text(f'ALTER TABLE {table} FORCE ROW LEVEL SECURITY'))
+        op.execute(sa.text(f'DROP POLICY IF EXISTS {policy} ON {table}'))
+        op.execute(
+            sa.text(
+                f'CREATE POLICY {policy} ON {table} AS PERMISSIVE FOR ALL TO PUBLIC '
+                f'USING ({expression}) WITH CHECK ({expression})'
+            )
+        )
+
+
+def downgrade() -> None:
+    if _TABLE in set(sa.inspect(op.get_bind()).get_table_names()):
+        op.drop_table(_TABLE)

src/langbot/pkg/persistence/alembic/versions/0018_add_llm_reasoning_config.py

@@ -1,57 +0,0 @@
-"""add llm reasoning config
-
-Revision ID: 0018_llm_reasoning_config
-Revises: 0017_oss_workspace_identity
-Create Date: 2026-07-27
-"""
-
-from __future__ import annotations
-
-import sqlalchemy as sa
-from alembic import op
-
-revision = '0018_llm_reasoning_config'
-down_revision = '0017_oss_workspace_identity'
-branch_labels = None
-depends_on = None
-
-
-_LLM_MODELS = sa.table(
-    'llm_models',
-    sa.column('reasoning_config', sa.JSON()),
-)
-
-
-def upgrade() -> None:
-    conn = op.get_bind()
-    inspector = sa.inspect(conn)
-    if 'llm_models' not in inspector.get_table_names():
-        return
-
-    columns = {column['name'] for column in inspector.get_columns('llm_models')}
-    if 'reasoning_config' in columns:
-        return
-
-    op.add_column(
-        'llm_models',
-        sa.Column(
-            'reasoning_config',
-            sa.JSON(),
-            nullable=True,
-            server_default=sa.text('\'{"level":"provider_default"}\''),
-        ),
-    )
-    conn.execute(_LLM_MODELS.update().values(reasoning_config={'level': 'provider_default'}))
-    with op.batch_alter_table('llm_models') as batch_op:
-        batch_op.alter_column('reasoning_config', existing_type=sa.JSON(), nullable=False)
-
-
-def downgrade() -> None:
-    conn = op.get_bind()
-    inspector = sa.inspect(conn)
-    if 'llm_models' not in inspector.get_table_names():
-        return
-    columns = {column['name'] for column in inspector.get_columns('llm_models')}
-    if 'reasoning_config' in columns:
-        with op.batch_alter_table('llm_models') as batch_op:
-            batch_op.drop_column('reasoning_config')

src/langbot/pkg/persistence/alembic/versions/0018_merge_launch_replay.py

@@ -0,0 +1,21 @@
+"""merge the published Space launch replay and main migration branches
+
+Revision ID: 0018_merge_launch_replay
+Revises: 0016_space_launch_replay, 0017_oss_workspace_identity
+Create Date: 2026-08-01
+"""
+
+from __future__ import annotations
+
+revision = '0018_merge_launch_replay'
+down_revision = ('0016_space_launch_replay', '0017_oss_workspace_identity')
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    pass
+
+
+def downgrade() -> None:
+    pass

src/langbot/pkg/persistence/alembic/versions/0019_single_workspace_owner.py

@@ -0,0 +1,80 @@
+"""enforce one active owner per Workspace
+
+Revision ID: 0019_single_workspace_owner
+Revises: 0018_merge_launch_replay
+Create Date: 2026-08-02
+"""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+
+revision = '0019_single_workspace_owner'
+down_revision = '0018_merge_launch_replay'
+branch_labels = None
+depends_on = None
+
+_INDEX_NAME = 'uq_workspace_memberships_one_active_owner'
+
+
+def upgrade() -> None:
+    conn = op.get_bind()
+    inspector = sa.inspect(conn)
+    if 'workspace_memberships' not in inspector.get_table_names():
+        return
+
+    # Ownership transfer used to promote a second member without demoting the
+    # original owner. Preserve the Workspace creator where possible and demote
+    # every historical extra owner before installing the database invariant.
+    op.execute(
+        sa.text(
+            """
+            WITH ranked_owners AS (
+                SELECT membership.uuid,
+                       ROW_NUMBER() OVER (
+                           PARTITION BY membership.workspace_uuid
+                           ORDER BY
+                               CASE
+                                   WHEN membership.account_uuid = workspace.created_by_account_uuid THEN 0
+                                   ELSE 1
+                               END,
+                               COALESCE(membership.joined_at, membership.created_at),
+                               membership.uuid
+                       ) AS owner_rank
+                FROM workspace_memberships AS membership
+                JOIN workspaces AS workspace
+                  ON workspace.uuid = membership.workspace_uuid
+                WHERE membership.role = 'owner'
+                  AND membership.status = 'active'
+            )
+            UPDATE workspace_memberships
+               SET role = 'admin'
+             WHERE uuid IN (
+                 SELECT uuid
+                   FROM ranked_owners
+                  WHERE owner_rank > 1
+             )
+            """
+        )
+    )
+    # Fresh installations may already have this index because SQLAlchemy
+    # metadata is created before Alembic advances the revision marker.
+    op.execute(
+        sa.text(
+            'CREATE UNIQUE INDEX IF NOT EXISTS '
+            'uq_workspace_memberships_one_active_owner '
+            'ON workspace_memberships (workspace_uuid) '
+            "WHERE role = 'owner' AND status = 'active'"
+        )
+    )
+
+
+def downgrade() -> None:
+    conn = op.get_bind()
+    inspector = sa.inspect(conn)
+    if 'workspace_memberships' not in inspector.get_table_names():
+        return
+    index_names = {index['name'] for index in inspector.get_indexes('workspace_memberships')}
+    if _INDEX_NAME in index_names:
+        op.drop_index(_INDEX_NAME, table_name='workspace_memberships')

src/langbot/pkg/persistence/tenant_uow.py

@@ -209,7 +209,7 @@ _ALLOWED_SCOPED_BUILTIN_FUNCTION_TYPES = {
     'now': sqlalchemy.sql.functions.now,
     'sum': sqlalchemy.sql.functions.sum,
 }
-_ALLOWED_SCOPED_GENERIC_FUNCTIONS = frozenset({'length', 'nullif'})
+_ALLOWED_SCOPED_GENERIC_FUNCTIONS = frozenset({'date_trunc', 'length', 'nullif'})
 _ALLOWED_SCOPED_CUSTOM_OPERATORS = frozenset({'<=>'})
 _ALLOWED_SCOPED_STATEMENT_TYPES = (
     sqlalchemy.sql.dml.UpdateBase,

src/langbot/pkg/pipeline/controller.py

@@ -132,7 +132,7 @@ class Controller:
 
                             break
 
-                    if not selected_query:  # 没有请求，或所有 query 对应的 session 都已达到并发上限
+                    if not selected_query:  # 没找到 说明：没有请求 或者 所有query对应的session都已达到并发上限
                         await self.ap.query_pool.condition.wait()
                         continue
 

src/langbot/pkg/platform/sources/websocket_adapter.py

@@ -5,7 +5,6 @@ import contextvars
 import logging
 import time
 import typing
-from dataclasses import dataclass
 from datetime import datetime
 
 import pydantic
@@ -26,15 +25,6 @@ _current_pipeline_uuid: contextvars.ContextVar[str | None] = contextvars.Context
 )
 
 
-@dataclass(frozen=True)
-class WebSocketReplyContext:
-    """Trusted routing context retained when the originating socket reconnects."""
-
-    scope: WebSocketScope
-    pipeline_uuid: str
-    session_id: str | None
-
-
 class WebSocketMessage(pydantic.BaseModel):
     """WebSocket消息格式"""
 
@@ -275,11 +265,6 @@ class WebSocketAdapter(abstract_platform_adapter.AbstractMessagePlatformAdapter)
         embed_target = self._parse_embed_target(sender_id)
         if embed_target is not None:
             return embed_target
-        reply_context = getattr(message_source, '_websocket_reply_context', None)
-        if isinstance(reply_context, WebSocketReplyContext):
-            if reply_context.scope != self._scope():
-                raise ValueError('WebSocket reply context does not match this adapter scope')
-            return reply_context.pipeline_uuid, reply_context.session_id
         raise ValueError('WebSocket reply target is not bound to this adapter scope')
 
     async def send_message(
@@ -700,16 +685,6 @@ class WebSocketAdapter(abstract_platform_adapter.AbstractMessagePlatformAdapter)
 
         # 异步触发事件处理
         # Use owner_bot's listeners if available, otherwise fall back to proxy bot
-        object.__setattr__(
-            event,
-            '_websocket_reply_context',
-            WebSocketReplyContext(
-                scope=connection.scope,
-                pipeline_uuid=pipeline_uuid,
-                session_id=connection.session_id,
-            ),
-        )
-
         listeners = (
             owner_bot.adapter.listeners
             if (owner_bot and hasattr(owner_bot.adapter, 'listeners') and owner_bot.adapter.listeners)
@@ -732,19 +707,25 @@ class WebSocketAdapter(abstract_platform_adapter.AbstractMessagePlatformAdapter)
             if len(listener_tasks) >= 100:
                 await self.logger.warning('WebSocket inbound listener capacity reached; dropping message')
                 return
-            async def run_listener() -> None:
+            listener = typing.cast(
+                typing.Callable[[typing.Any, typing.Any], typing.Awaitable[None]],
+                listeners[event.__class__],
+            )
+
+            async def run_listener():
                 token = _current_pipeline_uuid.set(pipeline_uuid)
                 try:
-                    await listeners[event.__class__](event, callback_adapter)
+                    await listener(event, callback_adapter)
                 finally:
                     _current_pipeline_uuid.reset(token)
 
+            listener_coro = run_listener()
             task_manager = getattr(self.ap, 'task_mgr', None)
             if task_manager is None or not isinstance(getattr(task_manager, 'tasks', None), list):
-                listener_task = asyncio.create_task(run_listener())
+                listener_task = asyncio.create_task(listener_coro)
             else:
                 listener_task = task_manager.create_task(
-                    run_listener(),
+                    listener_coro,
                     kind='websocket-message',
                     name=f'websocket-message-{connection.connection_id}',
                     scopes=[

src/langbot/pkg/provider/modelmgr/modelmgr.py

@@ -649,7 +649,6 @@ class ModelManager:
             provider_uuid=runtime_provider.provider_entity.uuid,
             abilities=model_info.get('abilities', []),
             context_length=model_info.get('context_length'),
-            reasoning_config=model_info.get('reasoning_config', {'level': 'provider_default'}),
             extra_args=model_info.get('extra_args', {}),
         )
         return self._build_llm_model(execution_context, model_entity, runtime_provider)
@@ -718,10 +717,7 @@ class ModelManager:
         provider_entity = self._coerce_provider(provider_info, context)
         requester_manifest = self.get_available_requester_manifest_by_name(provider_entity.requester)
         litellm_provider = self._get_litellm_provider_from_manifest(requester_manifest)
-        config = {
-            'base_url': provider_entity.base_url,
-            'requester_name': provider_entity.requester,
-        }
+        config = {'base_url': provider_entity.base_url}
 
         if litellm_provider:
             from .requesters import litellmchat

src/langbot/pkg/provider/modelmgr/reasoning.py

@@ -1,122 +0,0 @@
-from __future__ import annotations
-
-import typing
-
-
-ReasoningLevel = typing.Literal[
-    'provider_default',
-    'disabled',
-    'enabled',
-    'minimal',
-    'low',
-    'medium',
-    'high',
-    'xhigh',
-    'max',
-]
-
-REASONING_LEVELS: tuple[str, ...] = (
-    'provider_default',
-    'disabled',
-    'enabled',
-    'minimal',
-    'low',
-    'medium',
-    'high',
-    'xhigh',
-    'max',
-)
-DEFAULT_REASONING_CONFIG: dict[str, str] = {'level': 'provider_default'}
-
-_CONFLICTING_TOP_LEVEL_ARGS = {
-    'reasoning_effort',
-    'thinking',
-    'enable_thinking',
-    'thinking_budget',
-    'reasoning',
-}
-_CONFLICTING_EXTRA_BODY_ARGS = {
-    'reasoning_effort',
-    'thinking',
-    'enable_thinking',
-    'thinking_budget',
-    'reasoning',
-}
-
-
-def normalize_reasoning_config(value: typing.Any) -> dict[str, str]:
-    """Return the canonical model reasoning configuration."""
-    if value is None:
-        return dict(DEFAULT_REASONING_CONFIG)
-    if not isinstance(value, dict):
-        raise ValueError('reasoning_config must be an object')
-
-    unknown_fields = set(value) - {'level'}
-    if unknown_fields:
-        raise ValueError(f'Unsupported reasoning_config fields: {", ".join(sorted(unknown_fields))}')
-
-    level = value.get('level', 'provider_default')
-    if level not in REASONING_LEVELS:
-        raise ValueError(f'Unsupported reasoning level: {level}')
-    return {'level': typing.cast(str, level)}
-
-
-def validate_reasoning_config(
-    value: typing.Any,
-    abilities: typing.Iterable[str] | None,
-    extra_args: typing.Any,
-) -> dict[str, str]:
-    """Validate a model-facing reasoning config and conflicting raw arguments."""
-    config = normalize_reasoning_config(value)
-    if config['level'] == 'provider_default':
-        return config
-
-    if 'reasoning' not in set(abilities or []):
-        raise ValueError('The reasoning ability must be enabled before selecting a reasoning level')
-
-    conflicts = find_reasoning_arg_conflicts(extra_args)
-    if conflicts:
-        raise ValueError('reasoning_config conflicts with advanced parameters: ' + ', '.join(conflicts))
-    return config
-
-
-def find_reasoning_arg_conflicts(extra_args: typing.Any) -> list[str]:
-    if not isinstance(extra_args, dict):
-        return []
-
-    conflicts = [key for key in sorted(_CONFLICTING_TOP_LEVEL_ARGS) if key in extra_args]
-    extra_body = extra_args.get('extra_body')
-    if isinstance(extra_body, dict):
-        conflicts.extend(f'extra_body.{key}' for key in sorted(_CONFLICTING_EXTRA_BODY_ARGS) if key in extra_body)
-    return conflicts
-
-
-def validate_reasoning_capabilities(
-    config: typing.Any,
-    capabilities: typing.Mapping[str, typing.Any],
-    model_name: str,
-) -> None:
-    """Ensure an explicit reasoning level can be honored by the requester."""
-    level = normalize_reasoning_config(config)['level']
-    if level == 'provider_default':
-        return
-
-    available_levels = capabilities.get('levels')
-    if not isinstance(available_levels, list):
-        available_levels = []
-    if capabilities.get('supported') is not True or level not in available_levels:
-        available_text = ', '.join(str(item) for item in available_levels) or 'provider_default'
-        raise ValueError(
-            f'Reasoning level "{level}" is not supported by model {model_name}. Available levels: {available_text}'
-        )
-
-
-def default_reasoning_capabilities(
-    supported: bool = False,
-    source: str = 'unknown',
-) -> dict[str, typing.Any]:
-    return {
-        'supported': supported,
-        'levels': ['provider_default'],
-        'source': source,
-    }

src/langbot/pkg/provider/modelmgr/requester.py

@@ -10,7 +10,6 @@ from ...entity.persistence import model as persistence_model
 from ...workspace.errors import WorkspaceInvariantError
 import langbot_plugin.api.entities.builtin.resource.tool as resource_tool
 from . import token
-from . import reasoning
 import langbot_plugin.api.entities.builtin.pipeline.query as pipeline_query
 import langbot_plugin.api.entities.builtin.provider.message as provider_message
 
@@ -378,15 +377,11 @@ class RuntimeLLMModel:
     provider: RuntimeProvider
     """提供商实例"""
 
-    reasoning_config_override: dict[str, str] | None
-    """Request-scoped reasoning policy supplied by the active pipeline."""
-
     def __init__(
         self,
         execution_context: ExecutionContext,
         model_entity: persistence_model.LLMModel,
         provider: RuntimeProvider,
-        reasoning_config_override: dict[str, str] | None = None,
     ):
         _ensure_same_execution_scope(provider.execution_context, execution_context, resource='LLM model')
         if model_entity.workspace_uuid != execution_context.workspace_uuid:
@@ -396,7 +391,6 @@ class RuntimeLLMModel:
         self.execution_context = execution_context
         self.model_entity = model_entity
         self.provider = provider
-        self.reasoning_config_override = reasoning_config_override
 
 
 class RuntimeEmbeddingModel:
@@ -488,13 +482,6 @@ class ProviderAPIRequester(metaclass=abc.ABCMeta):
         """
         raise NotImplementedError('This provider does not support model scanning')
 
-    def get_reasoning_capabilities(self, model: RuntimeLLMModel) -> dict[str, typing.Any]:
-        """Return normalized reasoning controls supported by a model."""
-        return reasoning.default_reasoning_capabilities(
-            supported='reasoning' in (model.model_entity.abilities or []),
-            source='manual' if 'reasoning' in (model.model_entity.abilities or []) else 'unknown',
-        )
-
     @abc.abstractmethod
     async def invoke_llm(
         self,

src/langbot/pkg/provider/modelmgr/requesters/litellmchat.py

@@ -7,7 +7,7 @@ import typing
 import litellm
 from litellm import acompletion, aembedding, arerank
 
-from .. import errors, reasoning, requester
+from .. import errors, requester
 from ....utils import httpclient
 import langbot_plugin.api.entities.builtin.resource.tool as resource_tool
 import langbot_plugin.api.entities.builtin.pipeline.query as pipeline_query
@@ -164,28 +164,6 @@ class LiteLLMRequester(requester.ProviderAPIRequester):
 
     _EMBEDDING_MODEL_HINTS = ('embedding', 'embed', 'bge-', 'e5-', 'm3e', 'gte-', 'text-embedding')
     _RERANK_MODEL_HINTS = ('rerank', 're-rank', 're_rank')
-    _INFERRED_EFFORT_PROVIDERS = frozenset(
-        {
-            'anthropic',
-            'gemini',
-            'groq',
-            'mistral',
-            'openai',
-            'openrouter',
-            'together_ai',
-            'xai',
-        }
-    )
-    _REQUESTER_REASONING_FAMILIES = {
-        'openai-chat-completions': 'openai',
-        'anthropic-messages': 'anthropic',
-        'deepseek-chat-completions': 'deepseek',
-        'moonshot-chat-completions': 'kimi',
-        'moonshot-cn-chat-completions': 'kimi',
-        'bailian-chat-completions': 'qwen',
-        'doubao-chat-completions': 'doubao',
-        'mimo-chat-completions': 'mimo',
-    }
 
     default_config: dict[str, typing.Any] = {
         'base_url': '',
@@ -194,7 +172,6 @@ class LiteLLMRequester(requester.ProviderAPIRequester):
         'drop_params': False,
         'num_retries': 0,
         'api_version': '',
-        'requester_name': '',
     }
 
     async def initialize(self):
@@ -224,10 +201,7 @@ class LiteLLMRequester(requester.ProviderAPIRequester):
             return False
 
         provider = self._get_custom_llm_provider()
-        candidates: list[tuple[str, str | None]] = [
-            (candidate, None) for candidate in self._metadata_model_candidates(model_name)
-        ]
-        candidates.append((model_name, provider))
+        candidates: list[tuple[str, str | None]] = [(model_name, provider)]
         litellm_model_name = self._build_litellm_model_name(model_name)
         if litellm_model_name != model_name:
             candidates.append((litellm_model_name, None))
@@ -294,14 +268,6 @@ class LiteLLMRequester(requester.ProviderAPIRequester):
                 deduped_candidates.append(candidate)
         return deduped_candidates
 
-    @staticmethod
-    def _metadata_model_candidates(model_name: str) -> list[str]:
-        """Return known equivalent model IDs used only for LiteLLM metadata lookup."""
-        normalized_model_name = (model_name or '').lower()
-        if normalized_model_name.startswith('mimo-v2.5'):
-            return [f'openrouter/xiaomi/{normalized_model_name}']
-        return []
-
     def _known_context_length_fallback(self, model_name: str) -> int | None:
         normalized_model_name = (model_name or '').lower()
         if normalized_model_name.startswith('deepseek-v4-'):
@@ -321,8 +287,7 @@ class LiteLLMRequester(requester.ProviderAPIRequester):
         if not callable(helper):
             return self._known_context_length_fallback(model_name)
 
-        candidates = self._metadata_model_candidates(model_name)
-        candidates.append(model_name)
+        candidates = [model_name]
         litellm_model_name = self._build_litellm_model_name(model_name)
         if litellm_model_name != model_name:
             candidates.append(litellm_model_name)
@@ -349,265 +314,6 @@ class LiteLLMRequester(requester.ProviderAPIRequester):
     def _supports_vision(self, model_name: str) -> bool:
         return self._safe_litellm_bool_helper('supports_vision', model_name)
 
-    def _supports_reasoning(self, model_name: str) -> bool:
-        return self._safe_litellm_bool_helper('supports_reasoning', model_name)
-
-    def _requester_name(self, model: requester.RuntimeLLMModel | None = None) -> str:
-        if model is not None:
-            provider_entity = getattr(getattr(model, 'provider', None), 'provider_entity', None)
-            name = getattr(provider_entity, 'requester', None)
-            if isinstance(name, str) and name:
-                return name.lower()
-        return str(self.requester_cfg.get('requester_name') or '').lower()
-
-    @staticmethod
-    def _infer_reasoning_family_from_model_name(model_name: str) -> str:
-        normalized_name = (model_name or '').lower()
-        basename = normalized_name.rsplit('/', 1)[-1]
-        if basename.startswith(('gpt-', 'chatgpt-', 'o1', 'o3', 'o4')):
-            return 'openai'
-        if basename.startswith('claude-'):
-            return 'anthropic'
-        if basename.startswith('deepseek-'):
-            return 'deepseek'
-        if basename.startswith(('kimi-', 'moonshot-')):
-            return 'kimi'
-        if basename.startswith(('qwen-', 'qwen3', 'qwq')):
-            return 'qwen'
-        if basename.startswith(('doubao-', 'seed-')):
-            return 'doubao'
-        if basename.startswith('mimo-'):
-            return 'mimo'
-        return ''
-
-    def _reasoning_family(
-        self,
-        model_name: str,
-        model: requester.RuntimeLLMModel | None = None,
-    ) -> str:
-        requester_name = self._requester_name(model)
-        if requester_name in {'new-api-chat-completions', 'volcark-chat-completions'}:
-            inferred_family = self._infer_reasoning_family_from_model_name(model_name)
-            if inferred_family:
-                return inferred_family
-            return 'volcengine' if requester_name == 'volcark-chat-completions' else ''
-
-        requester_family = self._REQUESTER_REASONING_FAMILIES.get(requester_name)
-        if requester_family:
-            return requester_family
-
-        inferred_family = self._infer_reasoning_family_from_model_name(model_name)
-        provider = (self._get_custom_llm_provider() or '').lower()
-        if provider == 'openai':
-            return inferred_family or ('openai' if requester_name in {'', 'openai'} else '')
-        if provider:
-            return provider
-        return inferred_family
-
-    @staticmethod
-    def _is_anthropic_adaptive_model(model_name: str) -> bool:
-        basename = model_name.lower().rsplit('/', 1)[-1]
-        if 'mythos-preview' in basename:
-            return True
-
-        parts = basename.split('-')
-        if len(parts) < 3 or parts[0] != 'claude':
-            return False
-        model_families = {'opus', 'sonnet', 'fable', 'mythos'}
-        if parts[1] in model_families:
-            if parts[2] == '5':
-                return True
-            return len(parts) >= 4 and parts[2] == '4' and parts[3] in {'6', '7', '8'}
-        return parts[1] == '5' and parts[2] in model_families
-
-    @staticmethod
-    def _is_anthropic_always_thinking_model(model_name: str) -> bool:
-        normalized_name = model_name.lower()
-        return any(marker in normalized_name for marker in ('fable-5', 'mythos-5', 'mythos-preview'))
-
-    @staticmethod
-    def _is_dedicated_qwen_thinking_model(model_name: str) -> bool:
-        normalized_name = model_name.lower().rsplit('/', 1)[-1]
-        return normalized_name.startswith('qwq') or '-thinking' in normalized_name
-
-    def _known_reasoning_levels(self, model_name: str, family: str) -> list[str] | None:
-        normalized_name = model_name.lower().rsplit('/', 1)[-1]
-
-        if family == 'deepseek' and normalized_name.startswith('deepseek-'):
-            if normalized_name.startswith('deepseek-v4-'):
-                return ['provider_default', 'disabled', 'low', 'high', 'xhigh', 'max']
-            if 'reasoner' in normalized_name or '-r1' in normalized_name:
-                return ['provider_default']
-            return ['provider_default', 'disabled', 'enabled']
-
-        if family == 'kimi':
-            if normalized_name.startswith('kimi-k3'):
-                return ['provider_default', 'low', 'high', 'max']
-            if normalized_name.startswith('kimi-k2.7-code'):
-                return ['provider_default']
-            if normalized_name.startswith(('kimi-k2.5', 'kimi-k2.6')):
-                return ['provider_default', 'disabled', 'enabled']
-            if 'thinking' in normalized_name:
-                return ['provider_default']
-
-        if family == 'qwen' and normalized_name.startswith(('qwen-', 'qwen3', 'qwq')):
-            if self._is_dedicated_qwen_thinking_model(normalized_name):
-                return ['provider_default']
-            return ['provider_default', 'disabled', 'enabled']
-
-        if family == 'doubao' and normalized_name.startswith(('doubao-', 'seed-')):
-            return ['provider_default', 'disabled', 'low', 'medium', 'high']
-
-        if family == 'mimo' and normalized_name.startswith(('mimo-v2.5',)):
-            return ['provider_default', 'disabled', 'enabled']
-
-        if family == 'anthropic' and normalized_name.startswith('claude-'):
-            levels = ['provider_default']
-            adaptive = self._is_anthropic_adaptive_model(normalized_name)
-            if adaptive and not self._is_anthropic_always_thinking_model(normalized_name):
-                levels.append('disabled')
-            levels.extend(['low', 'medium', 'high'])
-            if adaptive:
-                levels.extend(['xhigh', 'max'])
-            return levels
-
-        if family == 'openai' and normalized_name.startswith(('gpt-5', 'o1', 'o3', 'o4')):
-            return ['provider_default', 'low', 'medium', 'high']
-
-        return None
-
-    def _openai_reasoning_levels(self, model_name: str) -> list[str]:
-        model_info = self._safe_model_info(model_name)
-        levels = ['provider_default']
-        if model_info.get('supports_none_reasoning_effort') is True:
-            levels.append('disabled')
-        if model_info.get('supports_minimal_reasoning_effort') is True:
-            levels.append('minimal')
-        for level in ('low', 'medium', 'high'):
-            if model_info.get(f'supports_{level}_reasoning_effort') is not False:
-                levels.append(level)
-        for level in ('xhigh', 'max'):
-            if model_info.get(f'supports_{level}_reasoning_effort') is True:
-                levels.append(level)
-        return levels
-
-    def _safe_model_info(self, model_name: str) -> dict[str, typing.Any]:
-        helper = getattr(litellm, 'get_model_info', None)
-        if not callable(helper):
-            return {}
-
-        candidates = [
-            *self._metadata_model_candidates(model_name),
-            model_name,
-            self._build_litellm_model_name(model_name),
-        ]
-        for candidate in candidates:
-            try:
-                info = helper(candidate)
-            except Exception:
-                continue
-            if isinstance(info, dict):
-                return info
-            model_dump = getattr(info, 'model_dump', None)
-            if callable(model_dump):
-                try:
-                    dumped = model_dump()
-                    if isinstance(dumped, dict):
-                        return dumped
-                except Exception:
-                    continue
-        return {}
-
-    def get_reasoning_capabilities(self, model: requester.RuntimeLLMModel) -> dict[str, typing.Any]:
-        model_name = model.model_entity.name
-        abilities = model.model_entity.abilities or []
-        detected = self._supports_reasoning(model_name)
-        declared = 'reasoning' in abilities
-        family = self._reasoning_family(model_name, model)
-        known_levels = self._known_reasoning_levels(model_name, family)
-        supported = detected or declared or known_levels is not None
-        if not supported:
-            return reasoning.default_reasoning_capabilities()
-
-        normalized_name = model_name.lower()
-        if family == 'openai':
-            levels = self._openai_reasoning_levels(model_name)
-        elif known_levels is not None:
-            levels = known_levels
-        elif family == 'anthropic':
-            levels = ['provider_default', 'low', 'medium', 'high']
-        elif family in {'deepseek', 'qwen', 'mimo', 'volcengine'}:
-            levels = ['provider_default', 'disabled', 'enabled']
-        elif family == 'doubao':
-            levels = ['provider_default', 'disabled', 'low', 'medium', 'high']
-        elif family == 'ollama':
-            levels = ['provider_default']
-            levels.append('disabled')
-            if normalized_name.startswith('gpt-oss') or '/gpt-oss' in normalized_name:
-                levels.extend(['low', 'medium', 'high'])
-            else:
-                levels.append('enabled')
-        elif family in self._INFERRED_EFFORT_PROVIDERS:
-            levels = ['provider_default', 'low', 'medium', 'high']
-        else:
-            levels = ['provider_default']
-
-        return {
-            'supported': True,
-            'levels': list(dict.fromkeys(levels)),
-            'source': 'litellm' if detected else ('provider' if known_levels is not None else 'manual'),
-        }
-
-    def _build_reasoning_args(self, model: requester.RuntimeLLMModel) -> dict[str, typing.Any]:
-        level = self._reasoning_level(model)
-        if level == 'provider_default':
-            return {}
-
-        config = {'level': level}
-        capabilities = self.get_reasoning_capabilities(model)
-        try:
-            reasoning.validate_reasoning_capabilities(config, capabilities, model.model_entity.name)
-        except ValueError as exc:
-            raise errors.RequesterError(str(exc)) from exc
-
-        family = self._reasoning_family(model.model_entity.name, model)
-        if level == 'disabled':
-            if family in {'deepseek', 'kimi', 'mimo', 'doubao'}:
-                return {'extra_body': {'thinking': {'type': 'disabled'}}}
-            if family == 'qwen':
-                return {'extra_body': {'enable_thinking': False}}
-            if family == 'volcengine':
-                return {'extra_body': {'thinking': {'type': 'disabled'}}}
-            if family == 'anthropic':
-                return {'thinking': {'type': 'disabled'}}
-            return {'reasoning_effort': 'none'}
-        if level == 'enabled':
-            if family in {'deepseek', 'kimi', 'mimo', 'volcengine'}:
-                return {'extra_body': {'thinking': {'type': 'enabled'}}}
-            if family == 'qwen':
-                return {'extra_body': {'enable_thinking': True}}
-            return {'reasoning_effort': 'low'}
-        if family == 'deepseek':
-            return {
-                'extra_body': {
-                    'thinking': {'type': 'enabled'},
-                    'reasoning_effort': level,
-                }
-            }
-        return {'reasoning_effort': level}
-
-    @staticmethod
-    def _reasoning_config_value(model: requester.RuntimeLLMModel) -> typing.Any:
-        raw_config = getattr(model, 'reasoning_config_override', None)
-        if raw_config is None:
-            raw_config = getattr(model.model_entity, 'reasoning_config', None)
-        if not isinstance(raw_config, dict):
-            return None
-        return raw_config
-
-    def _reasoning_level(self, model: requester.RuntimeLLMModel) -> str:
-        return reasoning.normalize_reasoning_config(self._reasoning_config_value(model))['level']
-
     def _infer_model_type(self, model_id: str) -> str:
         normalized_id = (model_id or '').lower()
         if any(kw in normalized_id for kw in self._RERANK_MODEL_HINTS):
@@ -638,13 +344,6 @@ class LiteLLMRequester(requester.ProviderAPIRequester):
             )
             if supports_provider_reported_vision or self._supports_vision(model_id):
                 abilities.append('vision')
-            supports_provider_reported_reasoning = bool(
-                model_payload and model_payload.get('supports_reasoning') is True
-            )
-            family = self._reasoning_family(model_id)
-            supports_known_reasoning = self._known_reasoning_levels(model_id, family) is not None
-            if supports_provider_reported_reasoning or supports_known_reasoning or self._supports_reasoning(model_id):
-                abilities.append('reasoning')
             scanned_model['abilities'] = abilities
 
             context_length = self._context_length_from_scan_payload(model_payload)
@@ -655,43 +354,13 @@ class LiteLLMRequester(requester.ProviderAPIRequester):
 
         return scanned_model
 
-    def _convert_messages(
-        self,
-        messages: typing.List[provider_message.Message],
-        reasoning_family: str = '',
-        include_reasoning_context: bool = True,
-    ) -> list[dict]:
+    def _convert_messages(self, messages: typing.List[provider_message.Message]) -> list[dict]:
         """Convert LangBot messages to LiteLLM/OpenAI format."""
         req_messages = []
         for m in messages:
             msg_dict = m.dict(exclude_none=True)
             content = msg_dict.get('content')
 
-            if msg_dict.get('role') == 'assistant' and reasoning_family:
-                provider_fields = msg_dict.get('provider_specific_fields')
-                if isinstance(provider_fields, dict):
-                    cleaned_provider_fields = dict(provider_fields)
-                    reasoning_content = cleaned_provider_fields.pop('reasoning_content', None)
-                    thinking_blocks = cleaned_provider_fields.pop('thinking_blocks', None)
-
-                    if include_reasoning_context:
-                        if reasoning_family == 'anthropic' and thinking_blocks:
-                            msg_dict['thinking_blocks'] = thinking_blocks
-                        elif reasoning_family in {
-                            'deepseek',
-                            'kimi',
-                            'qwen',
-                            'doubao',
-                            'mimo',
-                            'volcengine',
-                        } and isinstance(reasoning_content, str):
-                            msg_dict['reasoning_content'] = reasoning_content
-
-                    if cleaned_provider_fields:
-                        msg_dict['provider_specific_fields'] = cleaned_provider_fields
-                    else:
-                        msg_dict.pop('provider_specific_fields', None)
-
             if isinstance(content, list):
                 converted_parts = []
                 for part in content:
@@ -982,13 +651,7 @@ class LiteLLMRequester(requester.ProviderAPIRequester):
         stream: bool = False,
     ) -> dict:
         """Build common completion arguments for invoke_llm and invoke_llm_stream."""
-        reasoning_family = self._reasoning_family(model.model_entity.name, model)
-        reasoning_level = self._reasoning_level(model)
-        req_messages = self._convert_messages(
-            messages,
-            reasoning_family=reasoning_family,
-            include_reasoning_context=reasoning_level != 'disabled',
-        )
+        req_messages = self._convert_messages(messages)
         model_name = self._build_litellm_model_name(model.model_entity.name)
         api_key = model.provider.token_mgr.get_token()
 
@@ -1007,29 +670,6 @@ class LiteLLMRequester(requester.ProviderAPIRequester):
             args.update(model.model_entity.extra_args)
         args.update(extra_args)
 
-        reasoning_args = self._build_reasoning_args(model)
-        if reasoning_args:
-            conflicts = reasoning.find_reasoning_arg_conflicts(model.model_entity.extra_args)
-            conflicts.extend(reasoning.find_reasoning_arg_conflicts(extra_args))
-            if conflicts:
-                raise errors.RequesterError(
-                    'reasoning_config conflicts with advanced parameters: ' + ', '.join(dict.fromkeys(conflicts))
-                )
-            reasoning_extra_body = reasoning_args.get('extra_body')
-            if isinstance(reasoning_extra_body, dict):
-                existing_extra_body = args.get('extra_body') or {}
-                if not isinstance(existing_extra_body, dict):
-                    raise errors.RequesterError('extra_body must be an object')
-                args.update({key: value for key, value in reasoning_args.items() if key != 'extra_body'})
-                args['extra_body'] = {**existing_extra_body, **reasoning_extra_body}
-            else:
-                args.update(reasoning_args)
-            if 'reasoning_effort' in reasoning_args and self._get_custom_llm_provider() == 'openai':
-                allowed_openai_params = args.get('allowed_openai_params') or []
-                if not isinstance(allowed_openai_params, (list, tuple, set)):
-                    raise errors.RequesterError('allowed_openai_params must be an array')
-                args['allowed_openai_params'] = list(dict.fromkeys([*allowed_openai_params, 'reasoning_effort']))
-
         if funcs:
             tools = await self.ap.tool_mgr.generate_tools_for_openai(funcs)
             if tools:
@@ -1059,10 +699,6 @@ class LiteLLMRequester(requester.ProviderAPIRequester):
 
             content = message_data.get('content', '')
             reasoning_content = message_data.get('reasoning_content', None)
-            if reasoning_content:
-                provider_fields = dict(message_data.get('provider_specific_fields') or {})
-                provider_fields['reasoning_content'] = reasoning_content
-                message_data['provider_specific_fields'] = provider_fields
             message_data['content'] = self._process_thinking_content(content, reasoning_content, remove_think)
 
             if 'reasoning_content' in message_data:
@@ -1124,13 +760,13 @@ class LiteLLMRequester(requester.ProviderAPIRequester):
 
                 delta_content = delta.get('content', '')
                 reasoning_content = delta.get('reasoning_content', '')
-                provider_fields = dict(delta.get('provider_specific_fields') or {})
 
                 # Handle reasoning_content based on remove_think flag
                 if reasoning_content:
-                    provider_fields['reasoning_content'] = reasoning_content
                     if remove_think:
-                        delta_content = None
+                        # Skip reasoning content when remove_think is True
+                        chunk_idx += 1
+                        continue
                     else:
                         # Use reasoning_content as the displayed content
                         delta_content = reasoning_content
@@ -1143,7 +779,7 @@ class LiteLLMRequester(requester.ProviderAPIRequester):
 
                 tool_calls = self._normalize_stream_tool_calls(delta.get('tool_calls'), tool_call_state)
 
-                if chunk_idx == 0 and not delta_content and not tool_calls and not provider_fields:
+                if chunk_idx == 0 and not delta_content and not tool_calls:
                     chunk_idx += 1
                     continue
 
@@ -1155,8 +791,8 @@ class LiteLLMRequester(requester.ProviderAPIRequester):
                 }
 
                 # Preserve provider_specific_fields from delta (e.g., Gemini thought_signatures)
-                if provider_fields:
-                    chunk_data['provider_specific_fields'] = provider_fields
+                if delta.get('provider_specific_fields'):
+                    chunk_data['provider_specific_fields'] = delta['provider_specific_fields']
 
                 chunk_data = {k: v for k, v in chunk_data.items() if v is not None}
                 yield provider_message.MessageChunk(**chunk_data)

src/langbot/pkg/provider/runners/localagent.py

@@ -6,7 +6,6 @@ import typing
 from .. import runner
 from ...telemetry import features as telemetry_features
 from ..modelmgr import requester as modelmgr_requester
-from ..modelmgr import reasoning as modelmgr_reasoning
 from ..tools.loaders.native import EXEC_TOOL_NAME
 import langbot_plugin.api.entities.builtin.pipeline.query as pipeline_query
 import langbot_plugin.api.entities.builtin.provider.message as provider_message
@@ -61,7 +60,6 @@ class _StreamAccumulator:
         self.msg_idx = 0
         self.accumulated_content = initial_content or ''
         self.last_role = 'assistant'
-        self.provider_specific_fields: dict[str, typing.Any] = {}
         self.msg_sequence = msg_sequence
         self.remove_think = remove_think
         self._think_state = None
@@ -96,14 +94,6 @@ class _StreamAccumulator:
                 if tool_call.function and tool_call.function.arguments:
                     self.tool_calls_map[tool_call.id].function.arguments += tool_call.function.arguments
 
-        if msg.provider_specific_fields:
-            for key, value in msg.provider_specific_fields.items():
-                if key == 'reasoning_content' and isinstance(value, str):
-                    previous = self.provider_specific_fields.get(key, '')
-                    self.provider_specific_fields[key] = f'{previous}{value}'
-                else:
-                    self.provider_specific_fields[key] = value
-
         if msg.is_final:
             self._flush_think_state()
 
@@ -113,7 +103,6 @@ class _StreamAccumulator:
                 role=self.last_role,
                 content=self._maybe_strip_think(self.accumulated_content),
                 tool_calls=list(self.tool_calls_map.values()) if (self.tool_calls_map and msg.is_final) else None,
-                provider_specific_fields=(self.provider_specific_fields or None) if msg.is_final else None,
                 is_final=msg.is_final,
                 msg_sequence=self.msg_sequence,
             )
@@ -126,7 +115,6 @@ class _StreamAccumulator:
             role=self.last_role,
             content=self._maybe_strip_think(self.accumulated_content),
             tool_calls=list(self.tool_calls_map.values()) if self.tool_calls_map else None,
-            provider_specific_fields=self.provider_specific_fields or None,
             msg_sequence=self.msg_sequence,
         )
 
@@ -245,10 +233,9 @@ class LocalAgentRunner(runner.RequestRunner):
                     execution_context,
                     query.use_llm_model_uuid,
                 )
+                candidates.append(primary)
             except ValueError:
                 self.ap.logger.warning(f'Primary model {query.use_llm_model_uuid} not found')
-            else:
-                candidates.append(LocalAgentRunner._apply_pipeline_reasoning_config(query, primary))
 
         # Fallback models
         fallback_uuids = (query.variables or {}).get('_fallback_model_uuids', [])
@@ -258,31 +245,12 @@ class LocalAgentRunner(runner.RequestRunner):
                     execution_context,
                     fb_uuid,
                 )
+                candidates.append(fb_model)
             except ValueError:
                 self.ap.logger.warning(f'Fallback model {fb_uuid} not found, skipping')
-            else:
-                candidates.append(LocalAgentRunner._apply_pipeline_reasoning_config(query, fb_model))
 
         return candidates
 
-    @staticmethod
-    def _apply_pipeline_reasoning_config(
-        query: pipeline_query.Query,
-        model: modelmgr_requester.RuntimeLLMModel,
-    ) -> modelmgr_requester.RuntimeLLMModel:
-        local_agent_config = query.pipeline_config.get('ai', {}).get('local-agent', {})
-        model_config = local_agent_config.get('model', {})
-        reasoning_by_model = model_config.get('reasoning', {}) if isinstance(model_config, dict) else {}
-        level = (
-            reasoning_by_model.get(model.model_entity.uuid, 'provider_default')
-            if isinstance(reasoning_by_model, dict)
-            else 'provider_default'
-        )
-        reasoning_config = modelmgr_reasoning.normalize_reasoning_config({'level': level})
-        configured_model = copy.copy(model)
-        configured_model.reasoning_config_override = reasoning_config
-        return configured_model
-
     async def _invoke_with_fallback(
         self,
         query: pipeline_query.Query,

src/langbot/pkg/telemetry/heartbeat.py

@@ -37,6 +37,7 @@ class WorkspaceResourceSnapshot(typing.TypedDict):
     extension_count: int
     skill_count: int
     adapters: list[str]
+    execution_generation: int
 
 
 async def _count(
@@ -81,6 +82,7 @@ async def _cloud_workspace_resource_counts(ap: core_app.Application, bindings) -
             'extension_count': 0,
             'skill_count': 0,
             'adapters': [],
+            'execution_generation': binding.placement_generation,
         }
         for binding in bindings
     }

src/langbot/pkg/workspace/collaboration.py

@@ -606,6 +606,8 @@ class WorkspaceCollaborationService:
     ) -> WorkspaceMembership:
         if role not in {item.value for item in MembershipRole}:
             raise MembershipPermissionError('Unknown Workspace role')
+        if role == MembershipRole.OWNER.value:
+            raise MembershipPermissionError('Workspace ownership cannot be transferred')
 
         async def operation(active_session: AsyncSession) -> WorkspaceMembership:
             await self._require_active_workspace(active_session, workspace_uuid)
@@ -617,8 +619,8 @@ class WorkspaceCollaborationService:
                 target_account_uuid,
             )
             self._require_can_manage_target(persisted_actor, target, new_role=role)
-            if target.role == MembershipRole.OWNER.value and role != MembershipRole.OWNER.value:
-                await self._require_another_owner(active_session, workspace_uuid, target.account_uuid)
+            if target.role == MembershipRole.OWNER.value:
+                raise LastOwnerError('The Workspace owner cannot be removed or demoted')
             target.role = role
             await active_session.flush()
             return target
@@ -644,7 +646,7 @@ class WorkspaceCollaborationService:
             )
             self._require_can_manage_target(persisted_actor, target)
             if target.role == MembershipRole.OWNER.value:
-                await self._require_another_owner(active_session, workspace_uuid, target.account_uuid)
+                raise LastOwnerError('The Workspace owner cannot be removed or demoted')
             target.status = MembershipStatus.REMOVED.value
             await active_session.flush()
             return target
@@ -751,26 +753,6 @@ class WorkspaceCollaborationService:
             raise WorkspaceNotFoundError('Workspace not found')
         return persisted_actor
 
-    async def _require_another_owner(
-        self,
-        session: AsyncSession,
-        workspace_uuid: str,
-        excluded_account_uuid: str,
-    ) -> None:
-        owners = (
-            await session.scalars(
-                sqlalchemy.select(WorkspaceMembership)
-                .where(
-                    WorkspaceMembership.workspace_uuid == workspace_uuid,
-                    WorkspaceMembership.status == MembershipStatus.ACTIVE.value,
-                    WorkspaceMembership.role == MembershipRole.OWNER.value,
-                )
-                .with_for_update()
-            )
-        ).all()
-        if not any(owner.account_uuid != excluded_account_uuid for owner in owners):
-            raise LastOwnerError('The last Workspace owner cannot be removed or demoted')
-
     def _require_actor_workspace(self, actor: WorkspaceMembership, workspace_uuid: str) -> None:
         if actor.workspace_uuid != workspace_uuid or actor.status != MembershipStatus.ACTIVE.value:
             raise WorkspaceNotFoundError('Workspace not found')

src/langbot/templates/metadata/pipeline/ai.yaml

@@ -92,7 +92,6 @@ stages:
         default:
           primary: ''
           fallbacks: []
-          reasoning: {}
       - name: max-round
         label:
           en_US: Max Round

tests/integration/api/test_smoke.py

@@ -9,6 +9,8 @@ Run: uv run pytest tests/integration/api/test_smoke.py -q
 
 from __future__ import annotations
 
+from types import SimpleNamespace
+
 import pytest
 from unittest.mock import MagicMock, AsyncMock, Mock
 
@@ -304,12 +306,34 @@ class TestUserInitEndpoint:
         data = await response.get_json()
         assert data['data'] == {
             'initialized': True,
+            'authenticated_invitation_acceptance_enabled': False,
             'password_login_enabled': True,
             'space_login_enabled': False,
         }
         fake_api_app.user_service.get_login_capabilities.assert_awaited_once_with()
         fake_api_app.user_service.get_first_user.assert_not_awaited()
 
+    @pytest.mark.asyncio
+    async def test_account_info_enables_authenticated_invitation_acceptance_in_cloud(
+        self, quart_test_client, fake_api_app
+    ):
+        fake_api_app.deployment = SimpleNamespace(mode='cloud')
+        fake_api_app.user_service.is_initialized.return_value = True
+        fake_api_app.user_service.get_login_capabilities = AsyncMock(
+            return_value={'password_login_enabled': True, 'space_login_enabled': True}
+        )
+
+        response = await quart_test_client.get('/api/v1/user/account-info')
+
+        assert response.status_code == 200
+        data = await response.get_json()
+        assert data['data'] == {
+            'initialized': True,
+            'authenticated_invitation_acceptance_enabled': True,
+            'password_login_enabled': False,
+            'space_login_enabled': True,
+        }
+
     @pytest.mark.asyncio
     async def test_recovery_key_resets_any_existing_account(self, quart_test_client, fake_api_app, monkeypatch):
         fake_api_app.user_service.is_initialized.return_value = True

tests/integration/api/test_support_admin_launch.py

@@ -333,7 +333,6 @@ async def test_support_admin_request_context_has_actor_owner_and_no_membership(s
     assert Permission.RESOURCE_MANAGE.value in permissions
     assert not permissions.intersection(
         {
-            Permission.OWNER_TRANSFER.value,
             Permission.MEMBER_VIEW.value,
             Permission.MEMBER_INVITE.value,
             Permission.MEMBER_UPDATE_ROLE.value,

tests/integration/api/test_user_space_oauth.py

@@ -272,9 +272,10 @@ async def test_space_credits_are_resolved_from_workspace_owner(space_oauth_api):
         '/api/v1/user/space-credits',
         headers={'Authorization': 'Bearer account-token', 'X-Workspace-Id': WORKSPACE_UUID},
     )
+    payload = await response.get_json()
 
     assert response.status_code == 200
-    assert (await response.get_json())['data'] == {
+    assert payload['data'] == {
         'credits': 25000,
         'owner_space_bound': True,
         'is_workspace_owner': True,
@@ -282,6 +283,31 @@ async def test_space_credits_are_resolved_from_workspace_owner(space_oauth_api):
     application.space_service.get_credits.assert_awaited_once_with('owner@example.com')
 
 
+@pytest.mark.asyncio
+async def test_cloud_workspace_owner_is_always_space_bound_after_login(space_oauth_api):
+    application, client = space_oauth_api
+    application.deployment.mode = 'cloud'
+    application.user_service.get_workspace_owner = AsyncMock(return_value=None)
+    application.space_service.get_credits = AsyncMock()
+    application.cloud_model_catalog_service = SimpleNamespace(
+        get_workspace_credits=lambda workspace_uuid: 25000 if workspace_uuid == WORKSPACE_UUID else None
+    )
+
+    response = await client.get(
+        '/api/v1/user/space-credits',
+        headers={'Authorization': 'Bearer account-token', 'X-Workspace-Id': WORKSPACE_UUID},
+    )
+    payload = await response.get_json()
+
+    assert response.status_code == 200
+    assert payload['data'] == {
+        'credits': 25000,
+        'owner_space_bound': True,
+        'is_workspace_owner': True,
+    }
+    application.space_service.get_credits.assert_not_awaited()
+
+
 @pytest.mark.asyncio
 async def test_bind_callback_uses_opaque_state_and_never_treats_it_as_jwt(space_oauth_api):
     application, client = space_oauth_api

tests/integration/api/test_workspaces.py

@@ -188,6 +188,7 @@ async def test_owner_invites_second_account_and_secret_is_not_persisted(workspac
     workspace_uuid = current['workspace']['uuid']
     assert current['membership']['role'] == 'owner'
     assert 'member.invite' in current['permissions']
+    assert 'owner.transfer' not in current['permissions']
 
     invite_response = await client.post(
         f'/api/v1/workspaces/{workspace_uuid}/invitations',
@@ -263,6 +264,14 @@ async def test_owner_invites_second_account_and_secret_is_not_persisted(workspac
     assert member_current['membership']['role'] == 'viewer'
     assert 'member.invite' not in member_current['permissions']
 
+    transfer_response = await client.patch(
+        f'/api/v1/workspaces/{workspace_uuid}/members/{member_current["membership"]["account_uuid"]}',
+        headers=_auth(owner_token, workspace_uuid),
+        json={'role': 'owner'},
+    )
+    assert transfer_response.status_code == 403
+    assert (await transfer_response.get_json())['code'] == 'permission_denied'
+
     forbidden_invite = await client.post(
         f'/api/v1/workspaces/{workspace_uuid}/invitations',
         headers=_auth(member_token, workspace_uuid),

tests/integration/persistence/test_migrations.py

@@ -9,11 +9,8 @@ Run: uv run pytest tests/integration/persistence/test_migrations.py -q
 
 from __future__ import annotations
 
-import json
-
 import pytest
 import sqlalchemy
-from sqlalchemy import text
 from sqlalchemy.ext.asyncio import create_async_engine
 
 from langbot.pkg.entity.persistence.base import Base
@@ -98,6 +95,18 @@ class TestSQLiteMigrationBaseline:
 class TestSQLiteMigrationUpgrade:
     """Tests for upgrade to head workflow."""
 
+    @pytest.mark.asyncio
+    async def test_upgrade_from_published_space_launch_head_to_merged_head(self, sqlite_engine):
+        """A database released at the production-only 0016 head must remain upgradable."""
+        async with sqlite_engine.begin() as conn:
+            await conn.run_sync(Base.metadata.create_all)
+
+        await run_alembic_stamp(sqlite_engine, '0016_space_launch_replay')
+        await run_alembic_upgrade(sqlite_engine, 'head')
+
+        assert await get_alembic_current(sqlite_engine) == _get_script_head()
+        assert _get_script_head() == '0019_single_workspace_owner'
+
     @pytest.mark.asyncio
     async def test_upgrade_from_baseline_to_head(self, sqlite_engine):
         """
@@ -193,66 +202,6 @@ class TestSQLiteMigrationUpgrade:
         await run_alembic_upgrade(sqlite_engine, 'head')
         assert await get_alembic_current(sqlite_engine) == _get_script_head()
 
-    @pytest.mark.asyncio
-    async def test_reasoning_config_migrates_existing_models(self, sqlite_engine):
-        """Upgrade from 0017 backfills reasoning config and keeps a database default."""
-        async with sqlite_engine.begin() as conn:
-            await conn.execute(
-                text(
-                    """
-                    CREATE TABLE llm_models (
-                        uuid VARCHAR(255) PRIMARY KEY,
-                        name VARCHAR(255) NOT NULL,
-                        provider_uuid VARCHAR(255) NOT NULL,
-                        abilities JSON NOT NULL,
-                        context_length INTEGER,
-                        extra_args JSON NOT NULL,
-                        prefered_ranking INTEGER NOT NULL DEFAULT 0
-                    )
-                    """
-                )
-            )
-            await conn.execute(
-                text(
-                    """
-                    INSERT INTO llm_models (
-                        uuid, name, provider_uuid, abilities, extra_args, prefered_ranking
-                    ) VALUES (
-                        'existing-model', 'Existing Model', 'provider', '[]', '{}', 0
-                    )
-                    """
-                )
-            )
-
-        await run_alembic_stamp(sqlite_engine, '0017_oss_workspace_identity')
-        await run_alembic_upgrade(sqlite_engine, 'head')
-
-        async with sqlite_engine.begin() as conn:
-            columns = await conn.run_sync(lambda sync_conn: sqlalchemy.inspect(sync_conn).get_columns('llm_models'))
-            reasoning_column = next(column for column in columns if column['name'] == 'reasoning_config')
-            assert reasoning_column['nullable'] is False
-
-            existing_value = (
-                await conn.execute(text("SELECT reasoning_config FROM llm_models WHERE uuid = 'existing-model'"))
-            ).scalar_one()
-            assert json.loads(existing_value) == {'level': 'provider_default'}
-
-            await conn.execute(
-                text(
-                    """
-                    INSERT INTO llm_models (
-                        uuid, name, provider_uuid, abilities, extra_args, prefered_ranking
-                    ) VALUES (
-                        'new-model', 'New Model', 'provider', '[]', '{}', 0
-                    )
-                    """
-                )
-            )
-            new_value = (
-                await conn.execute(text("SELECT reasoning_config FROM llm_models WHERE uuid = 'new-model'"))
-            ).scalar_one()
-            assert json.loads(new_value) == {'level': 'provider_default'}
-
 
 class TestSQLiteMigrationFreshDatabase:
     """Tests for fresh database workflow."""

tests/integration/persistence/test_single_owner_migration.py

@@ -0,0 +1,100 @@
+from __future__ import annotations
+
+import pytest
+import sqlalchemy as sa
+from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
+
+from langbot.pkg.entity.persistence.base import Base
+from langbot.pkg.entity.persistence.user import User
+from langbot.pkg.entity.persistence.workspace import Workspace, WorkspaceMembership
+from langbot.pkg.persistence.alembic_runner import run_alembic_stamp, run_alembic_upgrade
+
+
+@pytest.mark.asyncio
+async def test_single_owner_migration_demotes_historical_extra_owner_and_installs_unique_index(tmp_path):
+    engine = create_async_engine(f'sqlite+aiosqlite:///{tmp_path / "single-owner.db"}')
+    try:
+        async with engine.begin() as connection:
+            await connection.run_sync(Base.metadata.create_all)
+            await connection.execute(sa.text('DROP INDEX uq_workspace_memberships_one_active_owner'))
+
+        session_factory = async_sessionmaker(engine, expire_on_commit=False)
+        workspace_uuid = '00000000-0000-4000-8000-000000000001'
+        creator_uuid = '00000000-0000-4000-8000-000000000010'
+        promoted_uuid = '00000000-0000-4000-8000-000000000020'
+        async with session_factory() as session:
+            session.add_all(
+                [
+                    User(
+                        uuid=creator_uuid,
+                        user='creator@example.test',
+                        normalized_email='creator@example.test',
+                        password='hash',
+                        account_type='local',
+                    ),
+                    User(
+                        uuid=promoted_uuid,
+                        user='promoted@example.test',
+                        normalized_email='promoted@example.test',
+                        password='hash',
+                        account_type='local',
+                    ),
+                    Workspace(
+                        uuid=workspace_uuid,
+                        instance_uuid='instance-test',
+                        name='Workspace',
+                        slug='workspace',
+                        type='team',
+                        status='active',
+                        source='local',
+                        created_by_account_uuid=creator_uuid,
+                    ),
+                    WorkspaceMembership(
+                        uuid='00000000-0000-4000-8000-000000000100',
+                        workspace_uuid=workspace_uuid,
+                        account_uuid=creator_uuid,
+                        role='owner',
+                        status='active',
+                    ),
+                    WorkspaceMembership(
+                        uuid='00000000-0000-4000-8000-000000000200',
+                        workspace_uuid=workspace_uuid,
+                        account_uuid=promoted_uuid,
+                        role='owner',
+                        status='active',
+                    ),
+                ]
+            )
+            await session.commit()
+
+        await run_alembic_stamp(engine, '0018_merge_launch_replay')
+        await run_alembic_upgrade(engine, 'head')
+
+        async with engine.connect() as connection:
+            roles = dict(
+                (
+                    await connection.execute(
+                        sa.text(
+                            'SELECT account_uuid, role FROM workspace_memberships '
+                            'WHERE workspace_uuid = :workspace_uuid ORDER BY account_uuid'
+                        ),
+                        {'workspace_uuid': workspace_uuid},
+                    )
+                ).all()
+            )
+            assert roles == {creator_uuid: 'owner', promoted_uuid: 'admin'}
+            indexes = await connection.run_sync(
+                lambda sync_connection: {
+                    index['name'] for index in sa.inspect(sync_connection).get_indexes('workspace_memberships')
+                }
+            )
+            assert 'uq_workspace_memberships_one_active_owner' in indexes
+
+        with pytest.raises(sa.exc.IntegrityError):
+            async with engine.begin() as connection:
+                await connection.execute(
+                    sa.text("UPDATE workspace_memberships SET role = 'owner' WHERE account_uuid = :account_uuid"),
+                    {'account_uuid': promoted_uuid},
+                )
+    finally:
+        await engine.dispose()

tests/unit_tests/api/http/test_authz.py

@@ -27,10 +27,9 @@ def test_owner_has_every_fixed_permission():
     assert ctx.workspace.permissions == frozenset(permission.value for permission in authz.Permission)
 
 
-def test_admin_cannot_transfer_owner_delete_workspace_or_link_billing():
+def test_admin_cannot_delete_workspace_or_link_billing():
     ctx = _context(authz.WorkspaceRole.ADMIN)
 
-    assert not authz.has_permission(ctx, authz.Permission.OWNER_TRANSFER)
     assert not authz.has_permission(ctx, authz.Permission.WORKSPACE_DELETE)
     assert not authz.has_permission(ctx, authz.Permission.BILLING_LINK_MANAGE)
     assert authz.has_permission(ctx, authz.Permission.MEMBER_INVITE)

tests/unit_tests/api/service/test_cloud_managed_model_protection.py

@@ -0,0 +1,112 @@
+"""Cloud Runtime write protection for the managed LangBot Models catalog."""
+
+from types import SimpleNamespace
+from unittest.mock import AsyncMock
+
+import pytest
+
+from langbot.pkg.api.http.service import model as model_service_module
+from langbot.pkg.api.http.service.model import (
+    EmbeddingModelsService,
+    LLMModelsService,
+    RerankModelsService,
+    _assert_cloud_managed_provider_mutable,
+)
+from langbot.pkg.cloud.model_catalog import LANGBOT_MODELS_PROVIDER_REQUESTER
+
+
+WORKSPACE = 'workspace-a'
+PROVIDER = 'managed-provider'
+MODEL = 'managed-model'
+
+
+@pytest.mark.asyncio
+async def test_managed_provider_guard_is_cloud_only(monkeypatch) -> None:
+    async def managed_provider(_ap, _context, provider_uuid):
+        assert provider_uuid == PROVIDER
+        return {'uuid': PROVIDER, 'requester': LANGBOT_MODELS_PROVIDER_REQUESTER}
+
+    monkeypatch.setattr(model_service_module, '_require_workspace_provider', managed_provider)
+    application = SimpleNamespace(persistence_mgr=SimpleNamespace(mode=SimpleNamespace(value='cloud_runtime')))
+
+    with pytest.raises(ValueError, match='managed by Cloud'):
+        await _assert_cloud_managed_provider_mutable(
+            application,
+            WORKSPACE,
+            PROVIDER,
+        )
+
+    application.persistence_mgr.mode.value = 'normal'
+    await _assert_cloud_managed_provider_mutable(
+        application,
+        WORKSPACE,
+        PROVIDER,
+    )
+
+
+@pytest.mark.parametrize(
+    ('service_type', 'create_method', 'model_data'),
+    [
+        (LLMModelsService, 'create_llm_model', {'provider_uuid': PROVIDER, 'name': 'chat', 'abilities': []}),
+        (EmbeddingModelsService, 'create_embedding_model', {'provider_uuid': PROVIDER, 'name': 'embedding'}),
+        (RerankModelsService, 'create_rerank_model', {'provider_uuid': PROVIDER, 'name': 'rerank'}),
+    ],
+)
+@pytest.mark.asyncio
+async def test_all_model_types_reject_creation_under_managed_provider(
+    monkeypatch,
+    service_type,
+    create_method: str,
+    model_data: dict,
+) -> None:
+    guard = AsyncMock(side_effect=ValueError('LangBot Models is managed by Cloud and cannot be modified'))
+    monkeypatch.setattr(model_service_module, '_assert_cloud_managed_provider_mutable', guard)
+    application = SimpleNamespace(
+        persistence_mgr=SimpleNamespace(),
+        provider_service=SimpleNamespace(
+            get_provider=AsyncMock(return_value={'uuid': PROVIDER, 'requester': LANGBOT_MODELS_PROVIDER_REQUESTER})
+        ),
+        model_mgr=None,
+    )
+    service = service_type(application)
+
+    with pytest.raises(ValueError, match='managed by Cloud'):
+        await getattr(service, create_method)(WORKSPACE, model_data)
+
+    guard.assert_awaited_once()
+
+
+@pytest.mark.parametrize(
+    ('service_type', 'get_method', 'write_method', 'payload'),
+    [
+        (LLMModelsService, 'get_llm_model', 'update_llm_model', {'name': 'changed'}),
+        (LLMModelsService, 'get_llm_model', 'delete_llm_model', None),
+        (EmbeddingModelsService, 'get_embedding_model', 'update_embedding_model', {'name': 'changed'}),
+        (EmbeddingModelsService, 'get_embedding_model', 'delete_embedding_model', None),
+        (RerankModelsService, 'get_rerank_model', 'update_rerank_model', {'name': 'changed'}),
+        (RerankModelsService, 'get_rerank_model', 'delete_rerank_model', None),
+    ],
+)
+@pytest.mark.asyncio
+async def test_all_model_types_reject_update_and_delete_for_managed_provider(
+    monkeypatch,
+    service_type,
+    get_method: str,
+    write_method: str,
+    payload: dict | None,
+) -> None:
+    guard = AsyncMock(side_effect=ValueError('LangBot Models is managed by Cloud and cannot be modified'))
+    monkeypatch.setattr(model_service_module, '_assert_cloud_managed_provider_mutable', guard)
+    application = SimpleNamespace(persistence_mgr=SimpleNamespace(mode=SimpleNamespace(value='cloud_runtime')))
+    service = service_type(application)
+    monkeypatch.setattr(
+        service,
+        get_method,
+        AsyncMock(return_value={'uuid': MODEL, 'provider_uuid': PROVIDER, 'extra_args': {}}),
+    )
+
+    args = (WORKSPACE, MODEL) if payload is None else (WORKSPACE, MODEL, payload)
+    with pytest.raises(ValueError, match='managed by Cloud'):
+        await getattr(service, write_method)(*args)
+
+    guard.assert_awaited_once()

tests/unit_tests/api/service/test_model_service.py

@@ -17,14 +17,12 @@ import pytest
 from unittest.mock import AsyncMock, Mock
 from types import SimpleNamespace
 
-from langbot.pkg.api.http.context import ExecutionContext
 from langbot.pkg.api.http.service.model import (
     LLMModelsService,
     EmbeddingModelsService,
     RerankModelsService,
     _parse_provider_api_keys,
     _runtime_model_data,
-    _serialize_llm_model,
     _validate_provider_supports,
 )
 from langbot.pkg.api.http.service import model as model_service_module
@@ -66,19 +64,15 @@ def _create_mock_llm_model(
     abilities: list = None,
     context_length: int | None = None,
     extra_args: dict = None,
-    reasoning_config: dict = None,
 ) -> Mock:
     """Helper to create mock LLMModel entity."""
     model = Mock(spec=LLMModel)
-    model.workspace_uuid = WORKSPACE_UUID
     model.uuid = model_uuid
     model.name = name
     model.provider_uuid = provider_uuid
     model.abilities = abilities or []
     model.context_length = context_length
     model.extra_args = extra_args or {}
-    model.reasoning_config = reasoning_config or {'level': 'provider_default'}
-    model.prefered_ranking = 0
     return model
 
 
@@ -162,26 +156,6 @@ def _create_runtime_model_mgr() -> SimpleNamespace:
     return manager
 
 
-def _create_reasoning_runtime_provider(capabilities: dict) -> SimpleNamespace:
-    execution_context = ExecutionContext(
-        instance_uuid='instance-test',
-        workspace_uuid=WORKSPACE_UUID,
-        placement_generation=1,
-    )
-    return SimpleNamespace(
-        execution_context=execution_context,
-        provider_entity=ModelProvider(
-            workspace_uuid=WORKSPACE_UUID,
-            uuid='provider-uuid',
-            name='Reasoning Provider',
-            requester='openai',
-            base_url='https://api.openai.com',
-            api_keys=[],
-        ),
-        requester=SimpleNamespace(get_reasoning_capabilities=Mock(return_value=capabilities)),
-    )
-
-
 class TestParseProviderApiKeys:
     """Tests for _parse_provider_api_keys helper function."""
 
@@ -235,42 +209,6 @@ class TestRuntimeModelData:
         assert result['extra_args'] == {'temp': 0.7}
 
 
-class TestSerializeLLMModel:
-    def test_includes_runtime_reasoning_capabilities(self):
-        model = _create_mock_llm_model(
-            abilities=['reasoning'],
-            reasoning_config={'level': 'high'},
-        )
-        capabilities = {
-            'supported': True,
-            'levels': ['provider_default', 'low', 'high'],
-            'source': 'litellm',
-        }
-        runtime_model = SimpleNamespace(
-            model_entity=model,
-            provider=SimpleNamespace(
-                requester=SimpleNamespace(get_reasoning_capabilities=Mock(return_value=capabilities))
-            ),
-        )
-        ap = SimpleNamespace(
-            persistence_mgr=SimpleNamespace(
-                serialize_model=Mock(
-                    return_value={
-                        'uuid': model.uuid,
-                        'name': model.name,
-                        'reasoning_config': {'level': 'high'},
-                    }
-                )
-            ),
-            model_mgr=SimpleNamespace(llm_model_dict={('workspace', model.uuid): runtime_model}),
-        )
-
-        serialized = _serialize_llm_model(ap, model)
-
-        assert serialized['reasoning_config'] == {'level': 'high'}
-        assert serialized['reasoning_capabilities'] == capabilities
-
-
 class TestLLMModelsServiceGetLLMModels:
     """Tests for LLMModelsService.get_llm_models method."""
 
@@ -642,66 +580,6 @@ class TestLLMModelsServiceCreateLLMModel:
         ap.provider_service.find_or_create_provider.assert_called_once()
         assert result_uuid is not None
 
-    async def test_create_llm_model_validates_explicit_reasoning_level(self):
-        ap = SimpleNamespace()
-        ap.persistence_mgr = SimpleNamespace(execute_async=AsyncMock(return_value=_create_mock_result([])))
-        runtime_provider = _create_reasoning_runtime_provider(
-            {
-                'supported': True,
-                'levels': ['provider_default', 'low', 'high'],
-                'source': 'litellm',
-            }
-        )
-        ap.model_mgr = _create_runtime_model_mgr()
-        ap.model_mgr.provider_dict = {'provider-uuid': runtime_provider}
-
-        service = LLMModelsService(ap)
-        await service.create_llm_model(
-            WORKSPACE_UUID,
-            {
-                'uuid': 'reasoning-model',
-                'name': 'Reasoning Model',
-                'provider_uuid': 'provider-uuid',
-                'abilities': ['reasoning'],
-                'reasoning_config': {'level': 'high'},
-                'extra_args': {},
-            },
-            preserve_uuid=True,
-            auto_set_to_default_pipeline=False,
-        )
-
-        runtime_entity = ap.model_mgr.load_llm_model_with_provider.await_args.args[1]
-        assert runtime_entity.reasoning_config == {'level': 'high'}
-
-    async def test_create_llm_model_rejects_unsupported_reasoning_before_insert(self):
-        ap = SimpleNamespace()
-        ap.persistence_mgr = SimpleNamespace(execute_async=AsyncMock())
-        runtime_provider = _create_reasoning_runtime_provider(
-            {
-                'supported': True,
-                'levels': ['provider_default'],
-                'source': 'manual',
-            }
-        )
-        ap.model_mgr = _create_runtime_model_mgr()
-        ap.model_mgr.provider_dict = {'provider-uuid': runtime_provider}
-
-        service = LLMModelsService(ap)
-        with pytest.raises(ValueError, match='Available levels: provider_default'):
-            await service.create_llm_model(
-                WORKSPACE_UUID,
-                {
-                    'name': 'Unknown Reasoning Model',
-                    'provider_uuid': 'provider-uuid',
-                    'abilities': ['reasoning'],
-                    'reasoning_config': {'level': 'high'},
-                    'extra_args': {},
-                },
-                auto_set_to_default_pipeline=False,
-            )
-
-        ap.persistence_mgr.execute_async.assert_not_awaited()
-
 
 class TestLLMModelsServiceUpdateLLMModel:
     """Tests for LLMModelsService.update_llm_model method."""
@@ -717,10 +595,7 @@ class TestLLMModelsServiceUpdateLLMModel:
         ap.model_mgr.remove_llm_model = AsyncMock()
         ap.model_mgr.load_llm_model_with_provider = AsyncMock(return_value=Mock())
 
-        existing_model = _create_mock_llm_model()
-        ap.persistence_mgr.execute_async = AsyncMock(
-            side_effect=[_create_mock_result(first_item=existing_model), _create_mock_result()]
-        )
+        ap.persistence_mgr.execute_async = AsyncMock()
 
         service = LLMModelsService(ap)
         service.get_llm_model = AsyncMock(return_value=_existing_llm_data())
@@ -748,8 +623,7 @@ class TestLLMModelsServiceUpdateLLMModel:
         ap.model_mgr.provider_dict = {}  # Empty
         ap.model_mgr.remove_llm_model = AsyncMock()
 
-        existing_model = _create_mock_llm_model()
-        ap.persistence_mgr.execute_async = AsyncMock(return_value=_create_mock_result(first_item=existing_model))
+        ap.persistence_mgr.execute_async = AsyncMock()
 
         service = LLMModelsService(ap)
         service.get_llm_model = AsyncMock(return_value=_existing_llm_data('nonexistent-provider'))

tests/unit_tests/api/service/test_provider_service.py

@@ -25,6 +25,7 @@ from langbot.pkg.workspace.errors import WorkspaceNotFoundError
 pytestmark = pytest.mark.asyncio
 
 WORKSPACE_UUID = 'workspace-a'
+SYSTEM_REQUESTER = 'space-chat-completions'
 
 
 def _create_mock_provider(
@@ -1005,3 +1006,56 @@ class TestProviderSecretRoundtrip:
             )
 
         ap.persistence_mgr.execute_async.assert_not_awaited()
+
+
+class TestCloudManagedProviderProtection:
+    @staticmethod
+    def _service() -> ModelProviderService:
+        ap = SimpleNamespace(
+            persistence_mgr=SimpleNamespace(
+                mode=SimpleNamespace(value='cloud_runtime'),
+                execute_async=AsyncMock(),
+            ),
+            model_mgr=SimpleNamespace(),
+        )
+        return ModelProviderService(ap)
+
+    async def test_cloud_rejects_user_created_system_requester(self):
+        service = self._service()
+
+        with pytest.raises(ValueError, match='reserved'):
+            await service.create_provider(
+                WORKSPACE_UUID,
+                {
+                    'name': 'Fake LangBot Models',
+                    'requester': SYSTEM_REQUESTER,
+                    'base_url': 'https://example.invalid/v1',
+                    'api_keys': ['fake'],
+                },
+            )
+
+        with pytest.raises(ValueError, match='reserved'):
+            await service.find_or_create_provider(
+                WORKSPACE_UUID,
+                SYSTEM_REQUESTER,
+                'https://api.langbot.cloud/v1',
+                ['fake'],
+            )
+        service.ap.persistence_mgr.execute_async.assert_not_awaited()
+
+    async def test_cloud_rejects_update_and_delete_of_managed_provider(self):
+        service = self._service()
+        service.get_provider = AsyncMock(
+            return_value={'uuid': 'system-provider', 'requester': SYSTEM_REQUESTER}
+        )
+
+        with pytest.raises(ValueError, match='managed by Cloud'):
+            await service.update_provider(WORKSPACE_UUID, 'system-provider', {'name': 'Renamed'})
+        with pytest.raises(ValueError, match='managed by Cloud'):
+            await service.delete_provider(WORKSPACE_UUID, 'system-provider')
+        service.ap.persistence_mgr.execute_async.assert_not_awaited()
+
+    async def test_oss_does_not_reserve_space_requester(self):
+        ap = SimpleNamespace(persistence_mgr=SimpleNamespace(mode=SimpleNamespace(value='oss_compat')))
+        service = ModelProviderService(ap)
+        assert service._system_requester_is_reserved(SYSTEM_REQUESTER) is False

tests/unit_tests/cloud/test_bootstrap.py

@@ -66,6 +66,10 @@ class _Provider:
     def __init__(self):
         self.manifest_provider = _Manifest()
 
+    async def fetch_model_catalog(self, instance_uuid: str):
+        del instance_uuid
+        raise AssertionError('not used by bootstrap contract tests')
+
     def bootstrap(self, *, instance_uuid: str, instance_config: dict):
         del instance_config
         return VerifiedCloudDeployment(
@@ -79,6 +83,7 @@ class _Provider:
             entitlement_provider=_Entitlements(),
             directory_provider=_Directory(),
             manifest_provider=self.manifest_provider,
+            model_catalog_provider=self,
             verification_key_id='root-2026',
         )
 
@@ -228,10 +233,23 @@ async def test_cloud_pgvector_contract_is_fail_closed(pgvector_config, message):
         )
 
 
+async def test_cloud_runtime_allows_explicitly_disabled_box():
+    config = _cloud_config()
+    config['box']['enabled'] = False
+
+    deployment = await resolve_deployment(
+        instance_uuid='instance-a',
+        instance_config=config,
+        entry_points=lambda: _EntryPoints([_EntryPoint(_Provider())]),
+        now=1_000,
+    )
+
+    assert isinstance(deployment, VerifiedCloudDeployment)
+
+
 @pytest.mark.parametrize(
     ('mutate', 'message'),
     [
-        (lambda config: config['box'].update(enabled=False), 'box.enabled=true'),
         (lambda config: config['box'].update(backend='docker'), 'box.backend=nsjail'),
         (lambda config: config['box']['runtime'].update(endpoint=''), 'box.runtime.endpoint'),
         (

tests/unit_tests/cloud/test_model_catalog.py

@@ -0,0 +1,378 @@
+from __future__ import annotations
+
+import asyncio
+import logging
+from datetime import UTC, datetime
+from types import SimpleNamespace
+
+import pytest
+import sqlalchemy
+from sqlalchemy.ext.asyncio import create_async_engine
+
+from langbot.pkg.cloud.model_catalog import (
+    CloudModelCatalogSnapshot,
+    CloudModelCatalogSyncService,
+    system_model_uuid,
+    system_provider_uuid,
+)
+from langbot.pkg.entity.persistence.base import Base
+from langbot.pkg.entity.persistence.model import EmbeddingModel, LLMModel, ModelProvider
+from langbot.pkg.entity.persistence.workspace import Workspace
+from langbot.pkg.persistence.mgr import PersistenceManager, PersistenceMode
+
+
+pytestmark = pytest.mark.asyncio
+INSTANCE_UUID = 'instance-model-catalog'
+WORKSPACE_A = '00000000-0000-4000-8000-000000000001'
+WORKSPACE_B = '00000000-0000-4000-8000-000000000002'
+OWNER_A = '10000000-0000-4000-8000-000000000001'
+OWNER_B = '10000000-0000-4000-8000-000000000002'
+
+
+class _CatalogProvider:
+    def __init__(self, snapshot: CloudModelCatalogSnapshot) -> None:
+        self.snapshot = snapshot
+
+    async def fetch_model_catalog(self, instance_uuid: str) -> CloudModelCatalogSnapshot:
+        assert instance_uuid == INSTANCE_UUID
+        return self.snapshot
+
+
+def _snapshot(
+    *,
+    key_a: str | None = 'owner-a-key',
+    model_id: str = 'gpt-test',
+    include_embedding: bool = True,
+) -> CloudModelCatalogSnapshot:
+    models = [
+        {
+            'uuid': 'upstream-chat',
+            'model_id': model_id,
+            'category': 'chat',
+            'llm_abilities': ['chat', 'vision'],
+            'is_featured': True,
+            'featured_order': 7,
+        }
+    ]
+    if include_embedding:
+        models.append(
+            {
+                'uuid': 'upstream-embedding',
+                'model_id': 'embedding-test',
+                'category': 'embedding',
+            }
+        )
+    return CloudModelCatalogSnapshot.model_validate(
+        {
+            'instance_uuid': INSTANCE_UUID,
+            'generated_at': datetime.now(UTC),
+            'base_url': 'https://api.langbot.cloud/v1/',
+            'models': models,
+            'workspaces': [
+                {
+                    'workspace_uuid': WORKSPACE_A,
+                    'owner_account_uuid': OWNER_A,
+                    'api_key': key_a,
+                    'credits': 25000,
+                },
+                {
+                    'workspace_uuid': WORKSPACE_B,
+                    'owner_account_uuid': OWNER_B,
+                    'api_key': 'owner-b-key',
+                    'credits': 5000,
+                },
+            ],
+        }
+    )
+
+
+async def test_catalog_snapshot_treats_null_model_abilities_as_empty() -> None:
+    payload = _snapshot().model_dump(mode='json')
+    payload['models'][0]['llm_abilities'] = None
+
+    snapshot = CloudModelCatalogSnapshot.model_validate(payload)
+
+    assert snapshot.models[0].llm_abilities == ()
+
+
+async def test_catalog_reconciles_every_workspace_idempotently_and_tracks_owner_and_downlisting(tmp_path) -> None:
+    engine = create_async_engine(f'sqlite+aiosqlite:///{tmp_path / "model-catalog.db"}')
+    manager = PersistenceManager(object(), mode=PersistenceMode.CLOUD_RUNTIME)
+    manager.db = SimpleNamespace(get_engine=lambda: engine)
+    bindings = [
+        SimpleNamespace(instance_uuid=INSTANCE_UUID, workspace_uuid=WORKSPACE_A, placement_generation=1),
+        SimpleNamespace(instance_uuid=INSTANCE_UUID, workspace_uuid=WORKSPACE_B, placement_generation=1),
+    ]
+    workspace_service = SimpleNamespace(list_active_execution_bindings=lambda: _async_value(bindings))
+    reload_counter = _AsyncCounter()
+    runtime_reload = SimpleNamespace(load_models_from_db=reload_counter)
+    app = SimpleNamespace(
+        persistence_mgr=manager,
+        workspace_service=workspace_service,
+        model_mgr=runtime_reload,
+        logger=logging.getLogger(__name__),
+    )
+    provider = _CatalogProvider(_snapshot())
+    service = CloudModelCatalogSyncService(app, provider, INSTANCE_UUID)
+
+    try:
+        async with engine.begin() as connection:
+            await connection.run_sync(Base.metadata.create_all)
+            await connection.execute(
+                sqlalchemy.insert(Workspace),
+                [
+                    {
+                        'uuid': WORKSPACE_A,
+                        'instance_uuid': INSTANCE_UUID,
+                        'name': 'A',
+                        'slug': 'a',
+                        'source': 'cloud_projection',
+                    },
+                    {
+                        'uuid': WORKSPACE_B,
+                        'instance_uuid': INSTANCE_UUID,
+                        'name': 'B',
+                        'slug': 'b',
+                        'source': 'cloud_projection',
+                    },
+                ],
+            )
+            await connection.execute(
+                sqlalchemy.insert(ModelProvider).values(
+                    uuid='custom-provider',
+                    workspace_uuid=WORKSPACE_A,
+                    name='Custom',
+                    requester='openai-chat-completions',
+                    base_url='https://custom.example/v1',
+                    api_keys=['custom-key'],
+                )
+            )
+            await connection.execute(
+                sqlalchemy.insert(LLMModel).values(
+                    uuid='custom-model',
+                    workspace_uuid=WORKSPACE_A,
+                    name='custom-model',
+                    provider_uuid='custom-provider',
+                    abilities=['chat'],
+                    extra_args={},
+                    prefered_ranking=0,
+                )
+            )
+
+        first = await service.sync_once()
+        assert first == {'workspaces': 2, 'created': 6, 'updated': 0, 'deleted': 0}
+        assert reload_counter.calls == 1
+        assert service.get_workspace_credits(WORKSPACE_A) == 25000
+        assert service.get_workspace_credits(WORKSPACE_B) == 5000
+
+        async with engine.connect() as connection:
+            providers = (
+                await connection.execute(
+                    sqlalchemy.select(
+                        ModelProvider.uuid,
+                        ModelProvider.workspace_uuid,
+                        ModelProvider.api_keys,
+                    ).where(ModelProvider.requester == 'space-chat-completions')
+                )
+            ).all()
+            assert {item.workspace_uuid for item in providers} == {WORKSPACE_A, WORKSPACE_B}
+            assert {item.uuid for item in providers} == {
+                system_provider_uuid(WORKSPACE_A),
+                system_provider_uuid(WORKSPACE_B),
+            }
+            assert {item.workspace_uuid: item.api_keys for item in providers} == {
+                WORKSPACE_A: ['owner-a-key'],
+                WORKSPACE_B: ['owner-b-key'],
+            }
+            assert await connection.scalar(sqlalchemy.select(sqlalchemy.func.count()).select_from(LLMModel)) == 3
+            assert await connection.scalar(sqlalchemy.select(sqlalchemy.func.count()).select_from(EmbeddingModel)) == 2
+
+        second = await service.sync_once()
+        assert second == {'workspaces': 2, 'created': 0, 'updated': 0, 'deleted': 0}
+        assert reload_counter.calls == 1
+
+        provider.snapshot = _snapshot(
+            key_a='new-owner-key',
+            model_id='gpt-renamed',
+            include_embedding=False,
+        )
+        third = await service.sync_once()
+        assert third == {'workspaces': 2, 'created': 0, 'updated': 3, 'deleted': 2}
+        assert reload_counter.calls == 2
+
+        async with engine.connect() as connection:
+            provider_a_keys = await connection.scalar(
+                sqlalchemy.select(ModelProvider.api_keys).where(ModelProvider.uuid == system_provider_uuid(WORKSPACE_A))
+            )
+            assert provider_a_keys == ['new-owner-key']
+            system_model_names = (
+                (
+                    await connection.execute(
+                        sqlalchemy.select(LLMModel.name).where(
+                            LLMModel.provider_uuid.in_(
+                                [system_provider_uuid(WORKSPACE_A), system_provider_uuid(WORKSPACE_B)]
+                            )
+                        )
+                    )
+                )
+                .scalars()
+                .all()
+            )
+            assert set(system_model_names) == {'gpt-renamed'}
+            assert await connection.scalar(sqlalchemy.select(sqlalchemy.func.count()).select_from(EmbeddingModel)) == 0
+            assert (
+                await connection.scalar(
+                    sqlalchemy.select(sqlalchemy.func.count())
+                    .select_from(ModelProvider)
+                    .where(ModelProvider.uuid == 'custom-provider')
+                )
+                == 1
+            )
+            assert (
+                await connection.scalar(
+                    sqlalchemy.select(sqlalchemy.func.count())
+                    .select_from(LLMModel)
+                    .where(LLMModel.uuid == 'custom-model')
+                )
+                == 1
+            )
+
+        provider.snapshot = _snapshot(key_a=None, model_id='gpt-renamed', include_embedding=False)
+        fourth = await service.sync_once()
+        assert fourth == {'workspaces': 2, 'created': 0, 'updated': 1, 'deleted': 0}
+        assert reload_counter.calls == 3
+        async with engine.connect() as connection:
+            provider_a_keys = await connection.scalar(
+                sqlalchemy.select(ModelProvider.api_keys).where(ModelProvider.uuid == system_provider_uuid(WORKSPACE_A))
+            )
+            assert provider_a_keys == []
+    finally:
+        await engine.dispose()
+
+
+def test_workspace_scoped_ids_are_stable_and_secrets_are_redacted() -> None:
+    assert system_provider_uuid(WORKSPACE_A) == system_provider_uuid(WORKSPACE_A)
+    assert system_provider_uuid(WORKSPACE_A) != system_provider_uuid(WORKSPACE_B)
+    assert system_model_uuid(WORKSPACE_A, 'chat', 'upstream') != system_model_uuid(WORKSPACE_B, 'chat', 'upstream')
+    snapshot = _snapshot()
+    assert 'owner-a-key' not in repr(snapshot)
+
+
+async def test_snapshot_must_cover_every_active_workspace() -> None:
+    snapshot = _snapshot().model_copy(update={'workspaces': _snapshot().workspaces[:1]})
+    app = SimpleNamespace(
+        workspace_service=SimpleNamespace(
+            list_active_execution_bindings=lambda: _async_value(
+                [SimpleNamespace(workspace_uuid=WORKSPACE_A), SimpleNamespace(workspace_uuid=WORKSPACE_B)]
+            )
+        ),
+        logger=logging.getLogger(__name__),
+    )
+    service = CloudModelCatalogSyncService(app, _CatalogProvider(snapshot), INSTANCE_UUID)
+    with pytest.raises(ValueError, match='missing billing projections for 1 active Workspaces'):
+        await service.sync_once()
+
+
+async def _async_value(value):
+    return value
+
+
+class _AsyncCounter:
+    def __init__(self) -> None:
+        self.calls = 0
+
+    async def __call__(self) -> None:
+        self.calls += 1
+
+
+async def test_partial_workspace_failure_reloads_already_committed_changes() -> None:
+    bindings = [
+        SimpleNamespace(workspace_uuid=WORKSPACE_A),
+        SimpleNamespace(workspace_uuid=WORKSPACE_B),
+    ]
+    reload_counter = _AsyncCounter()
+    app = SimpleNamespace(
+        workspace_service=SimpleNamespace(list_active_execution_bindings=lambda: _async_value(bindings)),
+        model_mgr=SimpleNamespace(load_models_from_db=reload_counter),
+        logger=logging.getLogger(__name__),
+    )
+    service = CloudModelCatalogSyncService(app, _CatalogProvider(_snapshot()), INSTANCE_UUID)
+    calls = 0
+
+    async def sync_workspace(*_args):
+        nonlocal calls
+        calls += 1
+        if calls == 1:
+            return {'created': 1, 'updated': 0, 'deleted': 0}
+        raise RuntimeError('second Workspace failed')
+
+    service._sync_workspace = sync_workspace  # type: ignore[method-assign]
+
+    with pytest.raises(RuntimeError, match='second Workspace failed'):
+        await service.sync_once()
+    assert service.get_workspace_credits(WORKSPACE_A) == 25000
+    assert service.get_workspace_credits(WORKSPACE_B) is None
+    assert reload_counter.calls == 1
+
+
+async def test_failed_runtime_reload_is_retried_after_noop_sync() -> None:
+    bindings = [SimpleNamespace(workspace_uuid=WORKSPACE_A)]
+
+    class _FlakyReload:
+        def __init__(self) -> None:
+            self.calls = 0
+
+        async def __call__(self) -> None:
+            self.calls += 1
+            if self.calls == 1:
+                raise RuntimeError('reload failed')
+
+    runtime_reload = _FlakyReload()
+    app = SimpleNamespace(
+        workspace_service=SimpleNamespace(list_active_execution_bindings=lambda: _async_value(bindings)),
+        model_mgr=SimpleNamespace(load_models_from_db=runtime_reload),
+        logger=logging.getLogger(__name__),
+    )
+    service = CloudModelCatalogSyncService(app, _CatalogProvider(_snapshot()), INSTANCE_UUID)
+    calls = 0
+
+    async def sync_workspace(*_args):
+        nonlocal calls
+        calls += 1
+        if calls == 1:
+            return {'created': 1, 'updated': 0, 'deleted': 0}
+        return {'created': 0, 'updated': 0, 'deleted': 0}
+
+    service._sync_workspace = sync_workspace  # type: ignore[method-assign]
+
+    with pytest.raises(RuntimeError, match='reload failed'):
+        await service.sync_once()
+    summary = await service.sync_once()
+    assert summary == {'workspaces': 1, 'created': 0, 'updated': 0, 'deleted': 0}
+    assert runtime_reload.calls == 2
+
+
+async def test_background_sync_log_redacts_exception_message(caplog) -> None:
+    secret = 'owner-secret-api-key'
+    attempted = asyncio.Event()
+
+    class _FailingProvider:
+        async def fetch_model_catalog(self, instance_uuid: str) -> CloudModelCatalogSnapshot:
+            del instance_uuid
+            attempted.set()
+            raise RuntimeError(f'database parameters include {secret}')
+
+    app = SimpleNamespace(logger=logging.getLogger(__name__))
+    service = CloudModelCatalogSyncService(app, _FailingProvider(), INSTANCE_UUID)
+    service.sync_interval_seconds = 0.001
+    task = asyncio.create_task(service.run())
+    try:
+        await asyncio.wait_for(attempted.wait(), timeout=1)
+        await asyncio.sleep(0.01)
+    finally:
+        task.cancel()
+        with pytest.raises(asyncio.CancelledError):
+            await task
+
+    assert secret not in caplog.text
+    assert 'Cloud model catalog synchronization failed (RuntimeError)' in caplog.text

tests/unit_tests/persistence/test_tenant_uow.py

@@ -961,6 +961,7 @@ async def test_scoped_session_rejects_raw_or_unapproved_sql(
         sa.select(sa.func.coalesce(sa.func.sum(sa.literal(1)), sa.literal(0))),
         sa.select(
             sa.func.now(),
+            sa.func.date_trunc('hour', sa.column('timestamp')),
             sa.func.length(sa.literal('value')),
             sa.func.nullif(sa.literal('value'), sa.literal('')),
         ),

tests/unit_tests/pipeline/test_controller_tenancy.py

@@ -11,6 +11,7 @@ from sqlalchemy.ext.asyncio import create_async_engine
 from langbot.pkg.persistence.mgr import PersistenceManager, PersistenceMode
 from langbot.pkg.persistence.tenant_uow import PersistenceScopeKind
 from langbot.pkg.pipeline.controller import Controller
+from langbot.pkg.pipeline.pool import QueryPool
 from langbot.pkg.workspace.errors import WorkspaceGenerationMismatchError
 
 
@@ -28,57 +29,6 @@ def _prepare_scheduler(mock_app):
     return query_pool, session
 
 
-@pytest.mark.asyncio
-async def test_consumer_schedules_query_after_running_transition(
-    mock_app,
-    sample_query,
-):
-    query_pool = MagicMock()
-    query_pool.queries = [sample_query]
-    query_pool.__aenter__ = AsyncMock(return_value=query_pool)
-    query_pool.__aexit__ = AsyncMock(return_value=None)
-    query_pool.remove_query = AsyncMock(return_value=True)
-    wait_for_query = asyncio.Event()
-    query_pool.condition = SimpleNamespace(
-        wait=AsyncMock(side_effect=wait_for_query.wait),
-        notify_all=Mock(),
-    )
-    query_pool.mark_query_running_locked = Mock(side_effect=query_pool.queries.remove)
-    mock_app.query_pool = query_pool
-
-    session = SimpleNamespace(_semaphore=asyncio.Semaphore(1))
-    mock_app.sess_mgr.get_session = AsyncMock(return_value=session)
-    runtime_pipeline = SimpleNamespace(run=AsyncMock())
-    mock_app.pipeline_mgr = SimpleNamespace(get_pipeline_by_uuid=AsyncMock(return_value=runtime_pipeline))
-
-    task_created = asyncio.Event()
-    process_tasks = []
-
-    def create_process_task(coro, **_kwargs):
-        process_tasks.append(asyncio.create_task(coro))
-        task_created.set()
-
-    mock_app.task_mgr.create_task = Mock(side_effect=create_process_task)
-    controller = Controller(mock_app)
-    initial_slots = controller.semaphore._value
-    consumer_task = asyncio.create_task(controller.consumer())
-
-    try:
-        await asyncio.wait_for(task_created.wait(), timeout=2)
-    finally:
-        consumer_task.cancel()
-        with pytest.raises(asyncio.CancelledError):
-            await consumer_task
-        await asyncio.gather(*process_tasks)
-
-    query_pool.mark_query_running_locked.assert_called_once_with(sample_query)
-    runtime_pipeline.run.assert_awaited_once_with(sample_query)
-    query_pool.remove_query.assert_awaited_once_with(sample_query)
-    assert query_pool.queries == []
-    assert session._semaphore._value == 1
-    assert controller.semaphore._value == initial_slots
-
-
 @pytest.mark.asyncio
 async def test_controller_drops_stale_query_before_pipeline_lookup(
     mock_app,
@@ -194,3 +144,31 @@ async def test_controller_revalidates_generation_before_running_pipeline(
     runtime_pipeline.run.assert_awaited_once_with(sample_query)
     query_pool.remove_query.assert_awaited_once_with(sample_query)
     session._semaphore.release.assert_called_once_with()
+
+
+@pytest.mark.asyncio
+async def test_controller_schedules_query_without_removing_it_twice(mock_app, sample_query):
+    query_pool = QueryPool()
+    query_pool.queries.append(sample_query)
+    mock_app.query_pool = query_pool
+    mock_app.sess_mgr.get_session = AsyncMock(return_value=SimpleNamespace(_semaphore=asyncio.Semaphore(1)))
+
+    scheduler_errors: list[str] = []
+
+    def stop_on_scheduler_error(message):
+        scheduler_errors.append(str(message))
+        raise asyncio.CancelledError
+
+    def stop_after_scheduling(process_coro, **_kwargs):
+        process_coro.close()
+        raise asyncio.CancelledError
+
+    mock_app.logger.error.side_effect = stop_on_scheduler_error
+    mock_app.task_mgr.create_task.side_effect = stop_after_scheduling
+    controller = Controller(mock_app)
+
+    with pytest.raises(asyncio.CancelledError):
+        await controller.consumer()
+
+    assert scheduler_errors == []
+    assert query_pool.queries == []

tests/unit_tests/platform/test_websocket_session_isolation.py

@@ -3,13 +3,11 @@
 import asyncio
 import contextvars
 from pathlib import Path
-from types import SimpleNamespace
 from unittest.mock import AsyncMock, Mock
 
 import pytest
 
 import langbot_plugin.api.entities.builtin.platform.events as platform_events
-import langbot_plugin.api.entities.builtin.platform.message as platform_message
 from langbot.pkg.platform.sources import websocket_adapter as websocket_adapter_module
 from langbot.pkg.platform.sources.websocket_adapter import WebSocketAdapter, WebSocketMessage, WebSocketSession
 from langbot.pkg.platform.sources.websocket_manager import (
@@ -208,7 +206,7 @@ async def test_embed_event_uses_stable_session_launcher(monkeypatch):
 
 
 @pytest.mark.asyncio
-async def test_pipeline_override_is_set_inside_detached_listener_task(monkeypatch):
+async def test_pipeline_override_survives_detached_listener_task(monkeypatch):
     manager = WebSocketConnectionManager()
     connection = await manager.add_connection(
         websocket=Mock(),
@@ -223,21 +221,21 @@ async def test_pipeline_override_is_set_inside_detached_listener_task(monkeypatc
             self.tasks = []
 
         def create_task(self, coro, **_kwargs):
-            task = asyncio.get_running_loop().create_task(coro, context=contextvars.Context())
+            task = asyncio.create_task(coro, context=contextvars.Context())
             self.tasks.append(task)
-            return SimpleNamespace(task=task)
+            return Mock(task=task)
 
     task_manager = DetachedTaskManager()
     adapter = WebSocketAdapter.model_construct(
-        ap=SimpleNamespace(task_mgr=task_manager),
+        ap=Mock(task_mgr=task_manager),
         logger=_adapter_logger(),
     )
     adapter.websocket_person_session = WebSocketSession(id='person')
     adapter.websocket_group_session = WebSocketSession(id='group')
-    received_pipeline_uuids = []
+    pipeline_overrides = []
 
     async def listener(_event, callback_adapter):
-        received_pipeline_uuids.append(callback_adapter.get_pipeline_uuid_override())
+        pipeline_overrides.append(callback_adapter.get_pipeline_uuid_override())
 
     adapter.listeners = {platform_events.FriendMessage: listener}
     await adapter.handle_websocket_message(
@@ -246,7 +244,7 @@ async def test_pipeline_override_is_set_inside_detached_listener_task(monkeypatc
     )
     await asyncio.gather(*task_manager.tasks)
 
-    assert received_pipeline_uuids == ['pipeline-1']
+    assert pipeline_overrides == ['pipeline-1']
 
 
 @pytest.mark.asyncio
@@ -345,49 +343,6 @@ async def test_stable_session_launcher_resolves_to_active_connection(monkeypatch
     )
 
 
-@pytest.mark.asyncio
-async def test_dashboard_reply_survives_connection_replacement(monkeypatch):
-    manager = WebSocketConnectionManager()
-    original = await manager.add_connection(
-        websocket=Mock(),
-        scope=SCOPE_A,
-        pipeline_uuid='pipeline-1',
-        session_type='person',
-    )
-    monkeypatch.setattr(websocket_adapter_module, 'ws_connection_manager', manager)
-
-    adapter = WebSocketAdapter.model_construct(ap=Mock(), logger=_adapter_logger())
-    adapter.websocket_person_session = WebSocketSession(id='person')
-    adapter.websocket_group_session = WebSocketSession(id='group')
-    received = []
-
-    async def listener(event, _callback_adapter):
-        received.append(event)
-
-    adapter.listeners = {platform_events.FriendMessage: listener}
-    await adapter.handle_websocket_message(
-        original,
-        {'message': [{'type': 'Plain', 'text': 'hello'}], 'stream': False},
-    )
-    await asyncio.sleep(0)
-    await manager.remove_connection(original.connection_id)
-    replacement = await manager.add_connection(
-        websocket=Mock(),
-        scope=SCOPE_A,
-        pipeline_uuid='pipeline-1',
-        session_type='person',
-    )
-
-    await adapter.reply_message(
-        received[0],
-        platform_message.MessageChain([platform_message.Plain(text='done')]),
-    )
-
-    response = await replacement.send_queue.get()
-    assert response['type'] == 'response'
-    assert response['data']['content'] == 'done'
-
-
 def test_session_ids_must_be_canonical_random_uuids():
     assert is_valid_session_id('31c0f2e9-b115-4ee6-8f15-3e624d6456b1')
     assert not is_valid_session_id('session-a')

tests/unit_tests/provider/test_litellmchat.py

@@ -1304,7 +1304,6 @@ class TestScanModels:
         )
         requester._supports_function_calling = Mock(side_effect=lambda model_id: model_id == 'gpt-4o')
         requester._supports_vision = Mock(side_effect=lambda model_id: model_id == 'gpt-4o')
-        requester._supports_reasoning = Mock(side_effect=lambda model_id: model_id == 'o3')
         requester._safe_context_length = Mock(side_effect=lambda model_id: 128000 if model_id == 'gpt-4o' else None)
 
         mock_response = Mock()
@@ -1312,7 +1311,6 @@ class TestScanModels:
             return_value={
                 'data': [
                     {'id': 'gpt-4o'},
-                    {'id': 'o3'},
                     {'id': 'text-embedding-3-small'},
                     {'id': 'bge-reranker-v2'},
                 ]
@@ -1329,7 +1327,6 @@ class TestScanModels:
         by_id = {model['id']: model for model in result['models']}
         assert by_id['gpt-4o']['abilities'] == ['func_call', 'vision']
         assert by_id['gpt-4o']['context_length'] == 128000
-        assert by_id['o3']['abilities'] == ['reasoning']
         assert by_id['text-embedding-3-small']['type'] == 'embedding'
         assert by_id['bge-reranker-v2']['type'] == 'rerank'
 
@@ -1377,8 +1374,8 @@ class TestScanModels:
         )
 
         with patch.object(litellmchat.litellm, 'get_model_info') as mock_get_model_info:
-            mock_get_model_info.side_effect = lambda model: (
-                {'max_input_tokens': 131072} if model == 'moonshot/moonshot-v1-128k' else {}
+            mock_get_model_info.side_effect = (
+                lambda model: {'max_input_tokens': 131072} if model == 'moonshot/moonshot-v1-128k' else {}
             )
 
             assert requester._safe_context_length('moonshot-v1-128k') == 131072
@@ -1407,8 +1404,8 @@ class TestScanModels:
         )
 
         with patch.object(litellmchat.litellm, 'supports_function_calling') as mock_supports_function_calling:
-            mock_supports_function_calling.side_effect = lambda model, custom_llm_provider=None: (
-                model == 'moonshot/kimi-k2.6' and custom_llm_provider is None
+            mock_supports_function_calling.side_effect = (
+                lambda model, custom_llm_provider=None: model == 'moonshot/kimi-k2.6' and custom_llm_provider is None
             )
 
             assert requester._supports_function_calling('kimi-k2.6') is True

tests/unit_tests/provider/test_model_service.py

@@ -249,11 +249,7 @@ async def test_updated_llm_model_is_immediately_usable_by_local_agent_pipeline()
         'ai': {
             'runner': {'runner': 'local-agent'},
             'local-agent': {
-                'model': {
-                    'primary': model_uuid,
-                    'fallbacks': [],
-                    'reasoning': {model_uuid: 'high'},
-                },
+                'model': {'primary': model_uuid, 'fallbacks': []},
                 'prompt': [],
                 'knowledge-bases': [],
             },
@@ -297,134 +293,3 @@ async def test_updated_llm_model_is_immediately_usable_by_local_agent_pipeline()
     candidates = await LocalAgentRunner._get_model_candidates(runner, processed_query)
 
     assert [model.model_entity.uuid for model in candidates] == [model_uuid]
-    assert candidates[0].reasoning_config_override == {'level': 'high'}
-
-
-@pytest.mark.asyncio
-async def test_local_agent_applies_reasoning_per_fallback_model():
-    execution_context = ExecutionContext(
-        instance_uuid='instance-test',
-        workspace_uuid='workspace-test',
-        placement_generation=1,
-    )
-    provider = Mock(
-        execution_context=execution_context,
-        provider_entity=persistence_model.ModelProvider(
-            workspace_uuid='workspace-test',
-            uuid='provider',
-            name='provider',
-            requester='openai',
-            base_url='https://example.com',
-            api_keys=[],
-        ),
-    )
-    primary = requester.RuntimeLLMModel(
-        execution_context,
-        persistence_model.LLMModel(
-            workspace_uuid='workspace-test',
-            uuid='primary-model',
-            name='primary',
-            provider_uuid='provider',
-            abilities=['reasoning'],
-            extra_args={},
-        ),
-        provider,
-    )
-    fallback = requester.RuntimeLLMModel(
-        execution_context,
-        persistence_model.LLMModel(
-            workspace_uuid='workspace-test',
-            uuid='fallback-model',
-            name='fallback',
-            provider_uuid='provider',
-            abilities=['reasoning'],
-            extra_args={},
-        ),
-        provider,
-    )
-    models = {'primary-model': primary, 'fallback-model': fallback}
-    runner = SimpleNamespace(
-        ap=SimpleNamespace(
-            model_mgr=SimpleNamespace(
-                get_model_by_uuid=AsyncMock(side_effect=lambda _context, model_uuid: models[model_uuid]),
-            ),
-            logger=Mock(),
-        )
-    )
-    query = SimpleNamespace(
-        use_llm_model_uuid='primary-model',
-        variables={'_fallback_model_uuids': ['fallback-model']},
-        pipeline_config={
-            'ai': {
-                'local-agent': {
-                    'model': {
-                        'primary': 'primary-model',
-                        'fallbacks': ['fallback-model'],
-                        'reasoning': {
-                            'primary-model': 'low',
-                            'fallback-model': 'high',
-                        },
-                    }
-                }
-            }
-        },
-        _execution_context=execution_context,
-    )
-
-    candidates = await LocalAgentRunner._get_model_candidates(runner, query)
-
-    assert [candidate.reasoning_config_override for candidate in candidates] == [
-        {'level': 'low'},
-        {'level': 'high'},
-    ]
-    assert candidates[0] is not primary
-    assert candidates[1] is not fallback
-    assert primary.reasoning_config_override is None
-    assert fallback.reasoning_config_override is None
-
-
-def test_local_agent_rejects_invalid_pipeline_reasoning_level():
-    execution_context = ExecutionContext(
-        instance_uuid='instance-test',
-        workspace_uuid='workspace-test',
-        placement_generation=1,
-    )
-    provider = Mock(
-        execution_context=execution_context,
-        provider_entity=persistence_model.ModelProvider(
-            workspace_uuid='workspace-test',
-            uuid='provider',
-            name='provider',
-            requester='openai',
-            base_url='https://example.com',
-            api_keys=[],
-        ),
-    )
-    model = requester.RuntimeLLMModel(
-        execution_context,
-        persistence_model.LLMModel(
-            workspace_uuid='workspace-test',
-            uuid='primary-model',
-            name='primary',
-            provider_uuid='provider',
-            abilities=['reasoning'],
-            extra_args={},
-        ),
-        provider,
-    )
-    query = SimpleNamespace(
-        pipeline_config={
-            'ai': {
-                'local-agent': {
-                    'model': {
-                        'primary': 'primary-model',
-                        'fallbacks': [],
-                        'reasoning': {'primary-model': 'turbo'},
-                    }
-                }
-            }
-        }
-    )
-
-    with pytest.raises(ValueError, match='Unsupported reasoning level'):
-        LocalAgentRunner._apply_pipeline_reasoning_config(query, model)

tests/unit_tests/provider/test_reasoning_control.py

@@ -1,640 +0,0 @@
-from __future__ import annotations
-
-from types import SimpleNamespace
-from unittest.mock import AsyncMock
-
-import pytest
-
-import langbot_plugin.api.entities.builtin.provider.message as provider_message
-from langbot.pkg.api.http.context import ExecutionContext
-from langbot.pkg.entity.persistence import model as persistence_model
-from langbot.pkg.provider.modelmgr import errors, reasoning, requester
-from langbot.pkg.provider.modelmgr.requesters import litellmchat
-from langbot.pkg.provider.modelmgr.requesters.litellmchat import LiteLLMRequester
-from langbot.pkg.provider.runners.localagent import _StreamAccumulator
-
-
-def _runtime_model(
-    request: LiteLLMRequester,
-    level: str = 'provider_default',
-    name: str = 'reasoning-model',
-    abilities: list[str] | None = None,
-    requester_name: str | None = None,
-) -> requester.RuntimeLLMModel:
-    execution_context = ExecutionContext(
-        instance_uuid='instance-test',
-        workspace_uuid='workspace-test',
-        placement_generation=1,
-    )
-    entity = persistence_model.LLMModel(
-        workspace_uuid='workspace-test',
-        uuid='reasoning-model',
-        name=name,
-        provider_uuid='provider-test',
-        abilities=abilities if abilities is not None else ['reasoning'],
-        reasoning_config={'level': level},
-        extra_args={},
-    )
-    provider = SimpleNamespace(
-        execution_context=execution_context,
-        provider_entity=persistence_model.ModelProvider(
-            workspace_uuid='workspace-test',
-            uuid='provider-test',
-            name='provider',
-            requester=requester_name or request.requester_cfg.get('requester_name') or 'custom-requester',
-            base_url='https://example.com',
-            api_keys=[],
-        ),
-        requester=request,
-        token_mgr=SimpleNamespace(),
-    )
-    return requester.RuntimeLLMModel(execution_context, entity, provider)
-
-
-def _requester(provider: str = '', requester_name: str = '') -> LiteLLMRequester:
-    return LiteLLMRequester(
-        SimpleNamespace(),
-        {
-            'custom_llm_provider': provider,
-            'requester_name': requester_name,
-        },
-    )
-
-
-def test_reasoning_config_normalization_and_conflicts():
-    assert reasoning.normalize_reasoning_config(None) == {'level': 'provider_default'}
-    assert reasoning.normalize_reasoning_config({}) == {'level': 'provider_default'}
-    assert reasoning.validate_reasoning_config(
-        {'level': 'high'},
-        ['reasoning'],
-        {},
-    ) == {'level': 'high'}
-
-    with pytest.raises(ValueError, match='Unsupported reasoning level'):
-        reasoning.normalize_reasoning_config({'level': 'turbo'})
-    with pytest.raises(ValueError, match='reasoning ability'):
-        reasoning.validate_reasoning_config({'level': 'low'}, [], {})
-    with pytest.raises(ValueError, match='extra_body.thinking_budget'):
-        reasoning.validate_reasoning_config(
-            {'level': 'low'},
-            ['reasoning'],
-            {'extra_body': {'thinking_budget': 1024}},
-        )
-    assert reasoning.find_reasoning_arg_conflicts(
-        {
-            'enable_thinking': True,
-            'extra_body': {'reasoning_effort': 'high'},
-        }
-    ) == ['enable_thinking', 'extra_body.reasoning_effort']
-
-
-def test_manual_reasoning_model_without_known_protocol_stays_conservative(monkeypatch):
-    request = _requester()
-    monkeypatch.setattr(request, '_supports_reasoning', lambda _: False)
-
-    capabilities = request.get_reasoning_capabilities(_runtime_model(request))
-
-    assert capabilities == {
-        'supported': True,
-        'levels': ['provider_default'],
-        'source': 'manual',
-    }
-
-
-def test_openai_protocol_does_not_mark_unknown_models_as_reasoning(monkeypatch):
-    request = _requester('openai', 'openai-chat-completions')
-    monkeypatch.setattr(request, '_supports_reasoning', lambda _: False)
-
-    capabilities = request.get_reasoning_capabilities(
-        _runtime_model(request, name='future-reasoning-model', abilities=[])
-    )
-
-    assert capabilities == {
-        'supported': False,
-        'levels': ['provider_default'],
-        'source': 'unknown',
-    }
-
-
-def test_unknown_unmarked_model_without_provider_stays_safe(monkeypatch):
-    request = _requester()
-    monkeypatch.setattr(request, '_supports_reasoning', lambda _: False)
-
-    capabilities = request.get_reasoning_capabilities(_runtime_model(request, name='unknown-model', abilities=[]))
-
-    assert capabilities == {
-        'supported': False,
-        'levels': ['provider_default'],
-        'source': 'unknown',
-    }
-
-
-def test_mimo_exposes_off_on_without_fake_effort_levels(monkeypatch):
-    request = _requester('openai', 'mimo-chat-completions')
-    monkeypatch.setattr(request, '_supports_reasoning', lambda _: False)
-
-    capabilities = request.get_reasoning_capabilities(_runtime_model(request, name='mimo-v2.5', abilities=[]))
-
-    assert capabilities == {
-        'supported': True,
-        'levels': ['provider_default', 'disabled', 'enabled'],
-        'source': 'provider',
-    }
-
-
-def test_openai_reasoning_levels_follow_litellm_metadata(monkeypatch):
-    request = _requester('openai', 'openai-chat-completions')
-    monkeypatch.setattr(request, '_supports_reasoning', lambda _: True)
-    monkeypatch.setattr(
-        request,
-        '_safe_model_info',
-        lambda _: {
-            'supports_none_reasoning_effort': True,
-            'supports_minimal_reasoning_effort': False,
-            'supports_low_reasoning_effort': True,
-            'supports_xhigh_reasoning_effort': True,
-        },
-    )
-
-    capabilities = request.get_reasoning_capabilities(_runtime_model(request, name='gpt-5'))
-
-    assert capabilities['source'] == 'litellm'
-    assert capabilities['levels'] == [
-        'provider_default',
-        'disabled',
-        'low',
-        'medium',
-        'high',
-        'xhigh',
-    ]
-
-
-def test_anthropic_adaptive_and_always_on_profiles(monkeypatch):
-    request = _requester('anthropic', 'anthropic-messages')
-    monkeypatch.setattr(request, '_supports_reasoning', lambda _: False)
-
-    adaptive = request.get_reasoning_capabilities(_runtime_model(request, name='claude-sonnet-4-6', abilities=[]))
-    assert adaptive['levels'] == [
-        'provider_default',
-        'disabled',
-        'low',
-        'medium',
-        'high',
-        'xhigh',
-        'max',
-    ]
-
-    always_on = request.get_reasoning_capabilities(_runtime_model(request, name='claude-fable-5', abilities=[]))
-    assert 'disabled' not in always_on['levels']
-
-    legacy = request.get_reasoning_capabilities(_runtime_model(request, name='claude-3-5-sonnet', abilities=[]))
-    assert legacy['levels'] == ['provider_default', 'low', 'medium', 'high']
-
-
-def test_deepseek_profiles_match_model_generation(monkeypatch):
-    request = _requester('deepseek', 'deepseek-chat-completions')
-    monkeypatch.setattr(request, '_supports_reasoning', lambda _: False)
-
-    assert request.get_reasoning_capabilities(_runtime_model(request, name='deepseek-v4-flash', abilities=[]))[
-        'levels'
-    ] == ['provider_default', 'disabled', 'low', 'high', 'xhigh', 'max']
-    assert request.get_reasoning_capabilities(_runtime_model(request, name='deepseek-chat', abilities=[]))[
-        'levels'
-    ] == ['provider_default', 'disabled', 'enabled']
-    assert request.get_reasoning_capabilities(_runtime_model(request, name='deepseek-r1', abilities=[]))['levels'] == [
-        'provider_default'
-    ]
-
-
-@pytest.mark.parametrize(
-    ('model_name', 'expected_levels'),
-    [
-        ('kimi-k3', ['provider_default', 'low', 'high', 'max']),
-        ('kimi-k2.7-code', ['provider_default']),
-        ('kimi-k2.6', ['provider_default', 'disabled', 'enabled']),
-        ('kimi-k2.5', ['provider_default', 'disabled', 'enabled']),
-    ],
-)
-def test_kimi_profiles(model_name, expected_levels, monkeypatch):
-    request = _requester('openai', 'moonshot-chat-completions')
-    monkeypatch.setattr(request, '_supports_reasoning', lambda _: False)
-
-    capabilities = request.get_reasoning_capabilities(_runtime_model(request, name=model_name, abilities=[]))
-
-    assert capabilities['levels'] == expected_levels
-
-
-def test_qwen_mixed_and_dedicated_thinking_profiles(monkeypatch):
-    request = _requester('openai', 'bailian-chat-completions')
-    monkeypatch.setattr(request, '_supports_reasoning', lambda _: False)
-
-    mixed = request.get_reasoning_capabilities(_runtime_model(request, name='qwen-plus', abilities=[]))
-    dedicated = request.get_reasoning_capabilities(
-        _runtime_model(request, name='qwen3-235b-a22b-thinking-2507', abilities=[])
-    )
-
-    assert mixed['levels'] == ['provider_default', 'disabled', 'enabled']
-    assert dedicated['levels'] == ['provider_default']
-
-
-def test_doubao_exposes_documented_effort_range(monkeypatch):
-    request = _requester('openai', 'doubao-chat-completions')
-    monkeypatch.setattr(request, '_supports_reasoning', lambda _: False)
-
-    capabilities = request.get_reasoning_capabilities(
-        _runtime_model(request, name='doubao-seed-2-1-pro-260628', abilities=[])
-    )
-
-    assert capabilities['levels'] == ['provider_default', 'disabled', 'low', 'medium', 'high']
-
-
-@pytest.mark.parametrize(
-    ('model_name', 'expected_levels'),
-    [
-        ('gpt-5', ['provider_default', 'low', 'medium', 'high']),
-        (
-            'claude-sonnet-4-6',
-            ['provider_default', 'disabled', 'low', 'medium', 'high', 'xhigh', 'max'],
-        ),
-        ('deepseek-v4-flash', ['provider_default', 'disabled', 'low', 'high', 'xhigh', 'max']),
-        ('kimi-k2.6', ['provider_default', 'disabled', 'enabled']),
-        ('qwen-plus', ['provider_default', 'disabled', 'enabled']),
-        ('doubao-seed-2-1-pro-260628', ['provider_default', 'disabled', 'low', 'medium', 'high']),
-        ('mimo-v2.5', ['provider_default', 'disabled', 'enabled']),
-    ],
-)
-def test_new_api_infers_upstream_protocol_from_model_name(model_name, expected_levels, monkeypatch):
-    request = _requester('openai', 'new-api-chat-completions')
-    monkeypatch.setattr(request, '_supports_reasoning', lambda _: False)
-    monkeypatch.setattr(request, '_safe_model_info', lambda _: {})
-
-    capabilities = request.get_reasoning_capabilities(_runtime_model(request, name=model_name, abilities=[]))
-
-    assert capabilities['levels'] == expected_levels
-
-
-@pytest.mark.parametrize(
-    ('provider', 'requester_name', 'model_name'),
-    [
-        ('openai', 'openai-chat-completions', 'gpt-5'),
-        ('anthropic', 'anthropic-messages', 'claude-sonnet-4-6'),
-        ('deepseek', 'deepseek-chat-completions', 'deepseek-v4-flash'),
-        ('openai', 'mimo-chat-completions', 'mimo-v2.5'),
-        ('openai', 'moonshot-chat-completions', 'kimi-k2.6'),
-        ('openai', 'bailian-chat-completions', 'qwen-plus'),
-        ('openai', 'doubao-chat-completions', 'doubao-seed-2-1-pro-260628'),
-        ('openai', 'new-api-chat-completions', 'deepseek-v4-flash'),
-    ],
-)
-def test_scanned_known_models_gain_reasoning_ability(provider, requester_name, model_name, monkeypatch):
-    request = _requester(provider, requester_name)
-    monkeypatch.setattr(request, '_supports_reasoning', lambda _: False)
-    monkeypatch.setattr(request, '_supports_function_calling', lambda _: False)
-    monkeypatch.setattr(request, '_supports_vision', lambda _: False)
-    monkeypatch.setattr(request, '_safe_context_length', lambda _: None)
-
-    scanned = request._enrich_scanned_model(model_name)
-
-    assert scanned['abilities'] == ['reasoning']
-
-
-def test_new_api_unknown_alias_stays_conservative(monkeypatch):
-    request = _requester('openai', 'new-api-chat-completions')
-    monkeypatch.setattr(request, '_supports_reasoning', lambda _: False)
-
-    capabilities = request.get_reasoning_capabilities(
-        _runtime_model(request, name='company-internal-alias', abilities=[])
-    )
-
-    assert capabilities == {
-        'supported': False,
-        'levels': ['provider_default'],
-        'source': 'unknown',
-    }
-
-
-def test_reasoning_argument_translation(monkeypatch):
-    openai_request = _requester('openai', 'openai-chat-completions')
-    monkeypatch.setattr(openai_request, '_supports_reasoning', lambda _: True)
-    monkeypatch.setattr(openai_request, '_safe_model_info', lambda _: {'supports_none_reasoning_effort': True})
-    assert openai_request._build_reasoning_args(_runtime_model(openai_request, 'disabled', name='gpt-5')) == {
-        'reasoning_effort': 'none'
-    }
-
-    anthropic_request = _requester('anthropic', 'anthropic-messages')
-    assert anthropic_request._build_reasoning_args(
-        _runtime_model(anthropic_request, 'disabled', name='claude-sonnet-4-6')
-    ) == {'thinking': {'type': 'disabled'}}
-
-    deepseek_request = _requester('deepseek', 'deepseek-chat-completions')
-    assert deepseek_request._build_reasoning_args(
-        _runtime_model(deepseek_request, 'high', name='deepseek-v4-flash')
-    ) == {
-        'extra_body': {
-            'thinking': {'type': 'enabled'},
-            'reasoning_effort': 'high',
-        }
-    }
-
-    kimi_request = _requester('openai', 'moonshot-chat-completions')
-    assert kimi_request._build_reasoning_args(_runtime_model(kimi_request, 'enabled', name='kimi-k2.6')) == {
-        'extra_body': {'thinking': {'type': 'enabled'}}
-    }
-    assert kimi_request._build_reasoning_args(_runtime_model(kimi_request, 'high', name='kimi-k3')) == {
-        'reasoning_effort': 'high'
-    }
-
-    qwen_request = _requester('openai', 'bailian-chat-completions')
-    assert qwen_request._build_reasoning_args(_runtime_model(qwen_request, 'disabled', name='qwen-plus')) == {
-        'extra_body': {'enable_thinking': False}
-    }
-
-    doubao_request = _requester('openai', 'doubao-chat-completions')
-    assert doubao_request._build_reasoning_args(
-        _runtime_model(doubao_request, 'high', name='doubao-seed-2-1-pro-260628')
-    ) == {'reasoning_effort': 'high'}
-
-    mimo_request = _requester('openai', 'mimo-chat-completions')
-    assert mimo_request._build_reasoning_args(_runtime_model(mimo_request, 'disabled', name='mimo-v2.5')) == {
-        'extra_body': {'thinking': {'type': 'disabled'}}
-    }
-
-
-def test_pipeline_reasoning_override_takes_precedence(monkeypatch):
-    request = _requester('openai', 'openai-chat-completions')
-    monkeypatch.setattr(request, '_supports_reasoning', lambda _: True)
-    monkeypatch.setattr(request, '_safe_model_info', lambda _: {})
-    model = _runtime_model(request, 'high', name='gpt-5')
-
-    model.reasoning_config_override = {'level': 'provider_default'}
-    assert request._build_reasoning_args(model) == {}
-
-    model.reasoning_config_override = {'level': 'low'}
-    assert request._build_reasoning_args(model) == {'reasoning_effort': 'low'}
-
-
-def test_always_on_reasoning_models_do_not_offer_disabled(monkeypatch):
-    deepseek_request = _requester('deepseek', 'deepseek-chat-completions')
-    monkeypatch.setattr(deepseek_request, '_supports_reasoning', lambda _: True)
-    monkeypatch.setattr(deepseek_request, '_safe_model_info', lambda _: {})
-    deepseek_capabilities = deepseek_request.get_reasoning_capabilities(
-        _runtime_model(deepseek_request, name='deepseek-r1')
-    )
-    assert deepseek_capabilities['levels'] == ['provider_default']
-
-    gemini_request = _requester('gemini')
-    monkeypatch.setattr(gemini_request, '_supports_reasoning', lambda _: True)
-    monkeypatch.setattr(
-        gemini_request,
-        '_safe_model_info',
-        lambda _: {'supports_none_reasoning_effort': True},
-    )
-    gemini_capabilities = gemini_request.get_reasoning_capabilities(_runtime_model(gemini_request, name='gemini-3-pro'))
-    assert 'disabled' not in gemini_capabilities['levels']
-    with pytest.raises(errors.RequesterError, match='not supported'):
-        gemini_request._build_reasoning_args(_runtime_model(gemini_request, 'disabled', name='gemini-3-pro'))
-
-
-def test_non_target_provider_capabilities_remain_supported(monkeypatch):
-    ollama_request = _requester('ollama', 'ollama')
-    monkeypatch.setattr(ollama_request, '_supports_reasoning', lambda _: False)
-    monkeypatch.setattr(ollama_request, '_safe_model_info', lambda _: {})
-
-    toggle_capabilities = ollama_request.get_reasoning_capabilities(_runtime_model(ollama_request, name='qwen3'))
-    assert toggle_capabilities['levels'] == [
-        'provider_default',
-        'disabled',
-        'enabled',
-    ]
-    assert ollama_request._build_reasoning_args(_runtime_model(ollama_request, 'enabled', name='qwen3')) == {
-        'reasoning_effort': 'low'
-    }
-
-    effort_capabilities = ollama_request.get_reasoning_capabilities(_runtime_model(ollama_request, name='gpt-oss:20b'))
-    assert effort_capabilities['levels'] == [
-        'provider_default',
-        'disabled',
-        'low',
-        'medium',
-        'high',
-    ]
-    assert ollama_request._build_reasoning_args(_runtime_model(ollama_request, 'high', name='gpt-oss:20b')) == {
-        'reasoning_effort': 'high'
-    }
-
-    volcengine_request = _requester('volcengine', 'volcark-chat-completions')
-    monkeypatch.setattr(volcengine_request, '_supports_reasoning', lambda _: False)
-    monkeypatch.setattr(volcengine_request, '_safe_model_info', lambda _: {})
-    assert volcengine_request._build_reasoning_args(
-        _runtime_model(volcengine_request, 'disabled', name='doubao-seed')
-    ) == {'extra_body': {'thinking': {'type': 'disabled'}}}
-
-
-def test_explicit_unsupported_level_raises(monkeypatch):
-    request = _requester()
-    monkeypatch.setattr(request, '_supports_reasoning', lambda _: False)
-    monkeypatch.setattr(request, '_safe_model_info', lambda _: {})
-
-    with pytest.raises(errors.RequesterError, match='Available levels: provider_default'):
-        request._build_reasoning_args(_runtime_model(request, 'high', abilities=[]))
-
-
-def test_provider_inference_rejects_levels_outside_conservative_profile(monkeypatch):
-    request = _requester('openai', 'openai-chat-completions')
-    monkeypatch.setattr(request, '_supports_reasoning', lambda _: False)
-    monkeypatch.setattr(request, '_safe_model_info', lambda _: {})
-
-    with pytest.raises(errors.RequesterError, match='Available levels: provider_default, low, medium, high'):
-        request._build_reasoning_args(_runtime_model(request, 'xhigh', name='gpt-5', abilities=[]))
-
-
-@pytest.mark.asyncio
-async def test_completion_args_reject_reasoning_extra_arg_conflicts(monkeypatch):
-    request = _requester('openai', 'openai-chat-completions')
-    monkeypatch.setattr(request, '_supports_reasoning', lambda _: True)
-    monkeypatch.setattr(request, '_safe_model_info', lambda _: {})
-    model = _runtime_model(request, 'high', name='gpt-5')
-    model.model_entity.extra_args = {'reasoning_effort': 'low'}
-    model.provider.token_mgr.get_token = lambda: 'test-token'
-
-    with pytest.raises(errors.RequesterError, match='conflicts with advanced parameters'):
-        await request._build_completion_args(model, [])
-
-
-@pytest.mark.asyncio
-async def test_openai_compatible_reasoning_effort_is_explicitly_allowed(monkeypatch):
-    request = _requester('openai', 'moonshot-chat-completions')
-    model = _runtime_model(request, 'high', name='kimi-k3')
-    model.model_entity.extra_args = {'allowed_openai_params': ['custom_extension']}
-    model.provider.token_mgr.get_token = lambda: 'test-token'
-
-    args = await request._build_completion_args(model, [])
-
-    assert args['reasoning_effort'] == 'high'
-    assert args['allowed_openai_params'] == ['custom_extension', 'reasoning_effort']
-
-
-@pytest.mark.asyncio
-async def test_provider_default_does_not_allow_or_send_reasoning_effort():
-    request = _requester('openai', 'new-api-chat-completions')
-    model = _runtime_model(request, 'provider_default', name='deepseek-v4-flash')
-    model.provider.token_mgr.get_token = lambda: 'test-token'
-
-    args = await request._build_completion_args(model, [])
-
-    assert 'reasoning_effort' not in args
-    assert 'allowed_openai_params' not in args
-
-
-@pytest.mark.asyncio
-async def test_deepseek_disabled_thinking_is_merged_into_extra_body(monkeypatch):
-    request = _requester('deepseek', 'deepseek-chat-completions')
-    monkeypatch.setattr(request, '_supports_reasoning', lambda _: False)
-    model = _runtime_model(request, 'disabled', name='deepseek-chat')
-    model.model_entity.extra_args = {'extra_body': {'custom_extension': True}}
-    model.provider.token_mgr.get_token = lambda: 'test-token'
-
-    args = await request._build_completion_args(model, [])
-
-    assert args['extra_body'] == {
-        'custom_extension': True,
-        'thinking': {'type': 'disabled'},
-    }
-
-
-@pytest.mark.asyncio
-async def test_openai_compatible_reasoning_history_is_promoted_for_tool_continuity():
-    request = _requester('openai', 'mimo-chat-completions')
-    model = _runtime_model(request, 'enabled', name='mimo-v2.5')
-    model.provider.token_mgr.get_token = lambda: 'test-token'
-    history = [
-        provider_message.Message(
-            role='assistant',
-            content='',
-            provider_specific_fields={'reasoning_content': 'prior reasoning'},
-        )
-    ]
-
-    args = await request._build_completion_args(model, history)
-
-    assert args['messages'][0]['reasoning_content'] == 'prior reasoning'
-    assert 'provider_specific_fields' not in args['messages'][0]
-
-
-@pytest.mark.asyncio
-async def test_disabling_reasoning_removes_previous_reasoning_context():
-    request = _requester('openai', 'mimo-chat-completions')
-    model = _runtime_model(request, 'disabled', name='mimo-v2.5')
-    model.provider.token_mgr.get_token = lambda: 'test-token'
-    history = [
-        provider_message.Message(
-            role='assistant',
-            content='answer',
-            provider_specific_fields={'reasoning_content': 'prior reasoning'},
-        )
-    ]
-
-    args = await request._build_completion_args(model, history)
-
-    assert 'reasoning_content' not in args['messages'][0]
-    assert 'provider_specific_fields' not in args['messages'][0]
-
-
-@pytest.mark.asyncio
-async def test_anthropic_history_promotes_thinking_blocks_instead_of_reasoning_content():
-    request = _requester('anthropic', 'anthropic-messages')
-    model = _runtime_model(request, 'high', name='claude-sonnet-4-6')
-    model.provider.token_mgr.get_token = lambda: 'test-token'
-    thinking_blocks = [{'type': 'thinking', 'thinking': 'prior reasoning', 'signature': 'sig'}]
-    history = [
-        provider_message.Message(
-            role='assistant',
-            content='',
-            provider_specific_fields={
-                'reasoning_content': 'prior reasoning',
-                'thinking_blocks': thinking_blocks,
-            },
-        )
-    ]
-
-    args = await request._build_completion_args(model, history)
-
-    assert args['messages'][0]['thinking_blocks'] == thinking_blocks
-    assert 'reasoning_content' not in args['messages'][0]
-    assert 'provider_specific_fields' not in args['messages'][0]
-
-
-class _Dumpable:
-    def __init__(self, data: dict):
-        self.data = data
-
-    def model_dump(self) -> dict:
-        return dict(self.data)
-
-
-@pytest.mark.asyncio
-async def test_non_stream_reasoning_content_is_preserved(monkeypatch):
-    request = _requester('deepseek')
-    request._build_completion_args = AsyncMock(return_value={})
-    response = SimpleNamespace(
-        choices=[
-            SimpleNamespace(
-                message=_Dumpable(
-                    {
-                        'role': 'assistant',
-                        'content': 'answer',
-                        'reasoning_content': 'private reasoning',
-                    }
-                )
-            )
-        ],
-        usage=None,
-    )
-    monkeypatch.setattr(litellmchat, 'acompletion', AsyncMock(return_value=response))
-
-    message, _ = await request.invoke_llm(None, _runtime_model(request), [], remove_think=True)
-
-    assert message.content == 'answer'
-    assert message.provider_specific_fields == {'reasoning_content': 'private reasoning'}
-
-
-@pytest.mark.asyncio
-async def test_stream_reasoning_round_trip_with_hidden_display(monkeypatch):
-    request = _requester('deepseek')
-    request._build_completion_args = AsyncMock(return_value={})
-
-    async def chunks():
-        yield SimpleNamespace(
-            choices=[
-                SimpleNamespace(
-                    delta=_Dumpable({'role': 'assistant', 'reasoning_content': 'private '}),
-                    finish_reason=None,
-                )
-            ],
-            usage=None,
-        )
-        yield SimpleNamespace(
-            choices=[
-                SimpleNamespace(
-                    delta=_Dumpable({'content': 'answer'}),
-                    finish_reason='stop',
-                )
-            ],
-            usage=None,
-        )
-
-    monkeypatch.setattr(litellmchat, 'acompletion', AsyncMock(return_value=chunks()))
-    accumulator = _StreamAccumulator(remove_think=True)
-    emitted: provider_message.MessageChunk | None = None
-
-    async for chunk in request.invoke_llm_stream(
-        None,
-        _runtime_model(request),
-        [],
-        remove_think=True,
-    ):
-        emitted = accumulator.add(chunk) or emitted
-
-    assert emitted is not None
-    assert emitted.content == 'answer'
-    assert emitted.provider_specific_fields == {'reasoning_content': 'private '}

tests/unit_tests/provider/test_requester_base.py

@@ -400,7 +400,6 @@ def test_runtime_llm_model_initialization(runtime_llm_model, fake_persistence_da
     assert model.model_entity.abilities == model_entity.abilities
     assert model.model_entity.extra_args == model_entity.extra_args
     assert model.provider is not None
-    assert model.reasoning_config_override is None
 
 
 def test_runtime_llm_model_provider_ref(runtime_llm_model):

tests/unit_tests/telemetry/test_heartbeat.py

@@ -139,8 +139,8 @@ class TestBuildHeartbeatPayload:
         }
         ap.workspace_service.list_active_execution_bindings = AsyncMock(
             return_value=[
-                SimpleNamespace(workspace_uuid='workspace-a'),
-                SimpleNamespace(workspace_uuid='workspace-b'),
+                SimpleNamespace(workspace_uuid='workspace-a', placement_generation=7),
+                SimpleNamespace(workspace_uuid='workspace-b', placement_generation=9),
             ],
         )
         ap.platform_mgr._bots_by_key[('instance-a', 'workspace-b', 'bot-b')] = SimpleNamespace(
@@ -159,10 +159,12 @@ class TestBuildHeartbeatPayload:
         assert by_workspace['workspace-a']['plugin_count'] == 2
         assert by_workspace['workspace-a']['extension_count'] == 5
         assert by_workspace['workspace-a']['skill_count'] == 2
+        assert by_workspace['workspace-a']['execution_generation'] == 7
         assert by_workspace['workspace-a']['adapters'] == ['WorkspaceAAdapter']
         assert by_workspace['workspace-b']['bot_count'] == 1
         assert by_workspace['workspace-b']['pipeline_count'] == 0
         assert by_workspace['workspace-b']['skill_count'] == 1
+        assert by_workspace['workspace-b']['execution_generation'] == 9
         assert by_workspace['workspace-b']['adapters'] == ['WorkspaceBAdapter']
         assert 'workspace_resources' not in by_workspace['workspace-a']
         ap.persistence_mgr.execute_async.assert_not_awaited()

tests/unit_tests/workspace/test_workspace_collaboration.py

@@ -203,20 +203,21 @@ async def test_last_owner_cannot_be_demoted(collaboration_context):
             second_membership,
         )
 
-    promoted = await service.update_member_role(
-        workspace.uuid,
-        second.uuid,
-        'owner',
-        owner_membership,
-    )
-    assert promoted.role == 'owner'
-    demoted = await service.update_member_role(
-        workspace.uuid,
-        owner_membership.account_uuid,
-        'admin',
-        owner_membership,
-    )
-    assert demoted.role == 'admin'
+    with pytest.raises(MembershipPermissionError, match='cannot be transferred'):
+        await service.update_member_role(
+            workspace.uuid,
+            second.uuid,
+            'owner',
+            owner_membership,
+        )
+
+    with pytest.raises(LastOwnerError):
+        await service.update_member_role(
+            workspace.uuid,
+            owner_membership.account_uuid,
+            'admin',
+            owner_membership,
+        )
 
 
 async def test_workspace_selector_requires_membership(collaboration_context):

uv.lock

@@ -1999,7 +1999,7 @@ wheels = [
 
 [[package]]
 name = "langbot"
-version = "4.10.6"
+version = "4.10.7"
 source = { editable = "." }
 dependencies = [
     { name = "aiocqhttp" },
@@ -2116,7 +2116,7 @@ requires-dist = [
     { name = "ebooklib", specifier = ">=0.18" },
     { name = "gewechat-client", specifier = ">=0.1.5" },
     { name = "html2text", specifier = ">=2024.2.26" },
-    { name = "langbot-plugin", git = "https://github.com/langbot-app/langbot-plugin-sdk.git?rev=1d65ed301a6afc52150a998043f73cd6032c8162" },
+    { name = "langbot-plugin", git = "https://github.com/langbot-app/langbot-plugin-sdk.git?rev=101e453e916b39465a6294d6471c9eaae8725d5c" },
     { name = "langchain", specifier = ">=1.3.9" },
     { name = "langchain-core", specifier = ">=1.3.3" },
     { name = "langchain-text-splitters", specifier = ">=1.1.2" },
@@ -2182,8 +2182,8 @@ dev = [
 
 [[package]]
 name = "langbot-plugin"
-version = "0.4.18"
-source = { git = "https://github.com/langbot-app/langbot-plugin-sdk.git?rev=1d65ed301a6afc52150a998043f73cd6032c8162#1d65ed301a6afc52150a998043f73cd6032c8162" }
+version = "0.5.0"
+source = { git = "https://github.com/langbot-app/langbot-plugin-sdk.git?rev=101e453e916b39465a6294d6471c9eaae8725d5c#101e453e916b39465a6294d6471c9eaae8725d5c" }
 dependencies = [
     { name = "aiofiles" },
     { name = "aiohttp" },

web/package.json

@@ -48,7 +48,6 @@
     "@radix-ui/react-scroll-area": "^1.2.9",
     "@radix-ui/react-select": "^2.2.4",
     "@radix-ui/react-separator": "^1.1.8",
-    "@radix-ui/react-slider": "^1.4.7",
     "@radix-ui/react-slot": "^1.2.3",
     "@radix-ui/react-switch": "^1.2.4",
     "@radix-ui/react-tabs": "^1.1.11",

web/pnpm-lock.yaml

@@ -72,9 +72,6 @@ dependencies:
   '@radix-ui/react-separator':
     specifier: ^1.1.8
     version: 1.1.8(@types/react-dom@19.2.3)(@types/react@19.2.10)(react-dom@19.2.1)(react@19.2.1)
-  '@radix-ui/react-slider':
-    specifier: ^1.4.7
-    version: 1.4.7(@types/react-dom@19.2.3)(@types/react@19.2.10)(react-dom@19.2.1)(react@19.2.1)
   '@radix-ui/react-slot':
     specifier: ^1.2.3
     version: 1.2.4(@types/react@19.2.10)(react@19.2.1)
@@ -558,18 +555,10 @@ packages:
     resolution: {integrity: sha512-MkKCwxlXTgz6CFoJx3pCwn07GKp36+aZyu/u2Ln2VrA5DcdyCZkASEDBTd8x5whTQQL5CiYf4prXKLcgQdv29g==}
     dev: false
 
-  /@radix-ui/number@1.1.3:
-    resolution: {integrity: sha512-Road2bidD0uu/1BGDOWNdPI06g0lIRy6IF9GZcIrDK2KGItfor8IQwQa+yM2ERgHM1MmHxaxpTzk0/Jp42lNfA==}
-    dev: false
-
   /@radix-ui/primitive@1.1.3:
     resolution: {integrity: sha512-JTF99U/6XIjCBo0wqkU5sK10glYe27MRRsfwoiq5zzOEZLHU3A3KCMa5X/azekYRCJ0HlwI0crAXS/5dEHTzDg==}
     dev: false
 
-  /@radix-ui/primitive@1.1.7:
-    resolution: {integrity: sha512-rqWnm76nYT8HoNNqEjpgJ7Pw/DrBj5iBTrmEPo6HTX5+VJyBNOqTdv4g89G63HuR5g0AaENoAcH7Is5fF2kZ8Q==}
-    dev: false
-
   /@radix-ui/react-alert-dialog@1.1.15(@types/react-dom@19.2.3)(@types/react@19.2.10)(react-dom@19.2.1)(react@19.2.1):
     resolution: {integrity: sha512-oTVLkEw5GpdRe29BqJ0LSDFWI3qu0vR1M0mUkOQWDIUnY/QIkLpgDMWuKxP94c2NAC2LGcgVhG1ImF3jkZ5wXw==}
     peerDependencies:
@@ -693,29 +682,6 @@ packages:
       react-dom: 19.2.1(react@19.2.1)
     dev: false
 
-  /@radix-ui/react-collection@1.1.15(@types/react-dom@19.2.3)(@types/react@19.2.10)(react-dom@19.2.1)(react@19.2.1):
-    resolution: {integrity: sha512-9W+B9NPF0NaaPh/1NJd3+KqsnlLqU9H7T2rvww+fp+T/evVXdNAyYcnfRQZFOjkR1ajQp3yORlqnI8soawLvNA==}
-    peerDependencies:
-      '@types/react': '*'
-      '@types/react-dom': '*'
-      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
-      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
-    peerDependenciesMeta:
-      '@types/react':
-        optional: true
-      '@types/react-dom':
-        optional: true
-    dependencies:
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.10)(react@19.2.1)
-      '@radix-ui/react-context': 1.2.2(@types/react@19.2.10)(react@19.2.1)
-      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.3)(@types/react@19.2.10)(react-dom@19.2.1)(react@19.2.1)
-      '@radix-ui/react-slot': 1.3.3(@types/react@19.2.10)(react@19.2.1)
-      '@types/react': 19.2.10
-      '@types/react-dom': 19.2.3(@types/react@19.2.10)
-      react: 19.2.1
-      react-dom: 19.2.1(react@19.2.1)
-    dev: false
-
   /@radix-ui/react-collection@1.1.7(@types/react-dom@19.2.3)(@types/react@19.2.10)(react-dom@19.2.1)(react@19.2.1):
     resolution: {integrity: sha512-Fh9rGN0MoI4ZFUNyfFVNU4y9LUz93u9/0K+yLgA2bwRojxM8JU1DyvvMBabnZPBgMWREAJvU2jjVzq+LrFUglw==}
     peerDependencies:
@@ -752,19 +718,6 @@ packages:
       react: 19.2.1
     dev: false
 
-  /@radix-ui/react-compose-refs@1.1.5(@types/react@19.2.10)(react@19.2.1):
-    resolution: {integrity: sha512-+48PbAAbq3didjJxa+OaWY2ZwgAKsNiRGyeHKszblZMQ+kcpd9pAaT11cMkGEie0vsOi3QdeTE6d5Fe3Gn61kA==}
-    peerDependencies:
-      '@types/react': '*'
-      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
-    peerDependenciesMeta:
-      '@types/react':
-        optional: true
-    dependencies:
-      '@types/react': 19.2.10
-      react: 19.2.1
-    dev: false
-
   /@radix-ui/react-context-menu@2.2.16(@types/react-dom@19.2.3)(@types/react@19.2.10)(react-dom@19.2.1)(react@19.2.1):
     resolution: {integrity: sha512-O8morBEW+HsVG28gYDZPTrT9UUovQUlJue5YO836tiTJhuIWBm/zQHc7j388sHWtdH/xUZurK9olD2+pcqx5ww==}
     peerDependencies:
@@ -816,19 +769,6 @@ packages:
       react: 19.2.1
     dev: false
 
-  /@radix-ui/react-context@1.2.2(@types/react@19.2.10)(react@19.2.1):
-    resolution: {integrity: sha512-RHCUGwKHDr0hDGg4X7ma4JG4/+12qxw8rkh5QKdDldlCvtja6nUx1Ef/8HVrJze81lEsgLQlqjzjGNHantgnQA==}
-    peerDependencies:
-      '@types/react': '*'
-      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
-    peerDependenciesMeta:
-      '@types/react':
-        optional: true
-    dependencies:
-      '@types/react': 19.2.10
-      react: 19.2.1
-    dev: false
-
   /@radix-ui/react-dialog@1.1.15(@types/react-dom@19.2.3)(@types/react@19.2.10)(react-dom@19.2.1)(react@19.2.1):
     resolution: {integrity: sha512-TCglVRtzlffRNxRMEyR36DGBLJpeusFcgMVD9PZEzAKnUs1lKCgX5u9BmC2Yg+LL9MgZDugFFs1Vl+Jp4t/PGw==}
     peerDependencies:
@@ -875,19 +815,6 @@ packages:
       react: 19.2.1
     dev: false
 
-  /@radix-ui/react-direction@1.1.4(@types/react@19.2.10)(react@19.2.1):
-    resolution: {integrity: sha512-5pzg4FGQNpExhnhT2zlrP1wZFaYCd1K0nYWoFAdcYoYK868IEigqMX3B3f8yIoRlAhAeDWciLI6ZdCKHF9P4Vg==}
-    peerDependencies:
-      '@types/react': '*'
-      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
-    peerDependenciesMeta:
-      '@types/react':
-        optional: true
-    dependencies:
-      '@types/react': 19.2.10
-      react: 19.2.1
-    dev: false
-
   /@radix-ui/react-dismissable-layer@1.1.11(@types/react-dom@19.2.3)(@types/react@19.2.10)(react-dom@19.2.1)(react@19.2.1):
     resolution: {integrity: sha512-Nqcp+t5cTB8BinFkZgXiMJniQH0PsUt2k51FUhbdfeKvc4ACcG2uQniY/8+h1Yv6Kza4Q7lD7PQV0z0oicE0Mg==}
     peerDependencies:
@@ -1177,26 +1104,6 @@ packages:
       react-dom: 19.2.1(react@19.2.1)
     dev: false
 
-  /@radix-ui/react-primitive@2.1.10(@types/react-dom@19.2.3)(@types/react@19.2.10)(react-dom@19.2.1)(react@19.2.1):
-    resolution: {integrity: sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg==}
-    peerDependencies:
-      '@types/react': '*'
-      '@types/react-dom': '*'
-      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
-      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
-    peerDependenciesMeta:
-      '@types/react':
-        optional: true
-      '@types/react-dom':
-        optional: true
-    dependencies:
-      '@radix-ui/react-slot': 1.3.3(@types/react@19.2.10)(react@19.2.1)
-      '@types/react': 19.2.10
-      '@types/react-dom': 19.2.3(@types/react@19.2.10)
-      react: 19.2.1
-      react-dom: 19.2.1(react@19.2.1)
-    dev: false
-
   /@radix-ui/react-primitive@2.1.3(@types/react-dom@19.2.3)(@types/react@19.2.10)(react-dom@19.2.1)(react@19.2.1):
     resolution: {integrity: sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ==}
     peerDependencies:
@@ -1374,36 +1281,6 @@ packages:
       react-dom: 19.2.1(react@19.2.1)
     dev: false
 
-  /@radix-ui/react-slider@1.4.7(@types/react-dom@19.2.3)(@types/react@19.2.10)(react-dom@19.2.1)(react@19.2.1):
-    resolution: {integrity: sha512-mTSLf1GC/C0moWjTbvCM6Qn/gBjvlFt1azuWF2v7MN5C3Zq2U2J2lN3ZEYkpujuOU5Ro7A28wkviSxaKnG0BYg==}
-    peerDependencies:
-      '@types/react': '*'
-      '@types/react-dom': '*'
-      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
-      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
-    peerDependenciesMeta:
-      '@types/react':
-        optional: true
-      '@types/react-dom':
-        optional: true
-    dependencies:
-      '@radix-ui/number': 1.1.3
-      '@radix-ui/primitive': 1.1.7
-      '@radix-ui/react-collection': 1.1.15(@types/react-dom@19.2.3)(@types/react@19.2.10)(react-dom@19.2.1)(react@19.2.1)
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.10)(react@19.2.1)
-      '@radix-ui/react-context': 1.2.2(@types/react@19.2.10)(react@19.2.1)
-      '@radix-ui/react-direction': 1.1.4(@types/react@19.2.10)(react@19.2.1)
-      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.3)(@types/react@19.2.10)(react-dom@19.2.1)(react@19.2.1)
-      '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.2.10)(react@19.2.1)
-      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.2.10)(react@19.2.1)
-      '@radix-ui/react-use-previous': 1.1.4(@types/react@19.2.10)(react@19.2.1)
-      '@radix-ui/react-use-size': 1.1.4(@types/react@19.2.10)(react@19.2.1)
-      '@types/react': 19.2.10
-      '@types/react-dom': 19.2.3(@types/react@19.2.10)
-      react: 19.2.1
-      react-dom: 19.2.1(react@19.2.1)
-    dev: false
-
   /@radix-ui/react-slot@1.2.3(@types/react@19.2.10)(react@19.2.1):
     resolution: {integrity: sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A==}
     peerDependencies:
@@ -1432,20 +1309,6 @@ packages:
       react: 19.2.1
     dev: false
 
-  /@radix-ui/react-slot@1.3.3(@types/react@19.2.10)(react@19.2.1):
-    resolution: {integrity: sha512-qx7oqnYbxnK9kYI9m317qmFmEgo6ywqWvbTogdj7cL9p3/yx4M48p7Rnw5z3H890cL/ow/EeWJsuTykeZVXP5Q==}
-    peerDependencies:
-      '@types/react': '*'
-      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
-    peerDependenciesMeta:
-      '@types/react':
-        optional: true
-    dependencies:
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.10)(react@19.2.1)
-      '@types/react': 19.2.10
-      react: 19.2.1
-    dev: false
-
   /@radix-ui/react-switch@1.2.6(@types/react-dom@19.2.3)(@types/react@19.2.10)(react-dom@19.2.1)(react@19.2.1):
     resolution: {integrity: sha512-bByzr1+ep1zk4VubeEVViV592vu2lHE2BZY5OnzehZqOOgogN80+mNtCqPkhn2gklJqOpxWgPoYTSnhBCqpOXQ==}
     peerDependencies:
@@ -1606,22 +1469,6 @@ packages:
       react: 19.2.1
     dev: false
 
-  /@radix-ui/react-use-controllable-state@1.2.6(@types/react@19.2.10)(react@19.2.1):
-    resolution: {integrity: sha512-uEQJGT97ZA/TgP/Hydw47lHu+/vQj6z/0jA+WeTbK1o9Rx45GImjpD0tc3W5ad3D6XTSR6e1yEO0FvGq6WQfVQ==}
-    peerDependencies:
-      '@types/react': '*'
-      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
-    peerDependenciesMeta:
-      '@types/react':
-        optional: true
-    dependencies:
-      '@radix-ui/primitive': 1.1.7
-      '@radix-ui/react-use-effect-event': 0.0.5(@types/react@19.2.10)(react@19.2.1)
-      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.2.10)(react@19.2.1)
-      '@types/react': 19.2.10
-      react: 19.2.1
-    dev: false
-
   /@radix-ui/react-use-effect-event@0.0.2(@types/react@19.2.10)(react@19.2.1):
     resolution: {integrity: sha512-Qp8WbZOBe+blgpuUT+lw2xheLP8q0oatc9UpmiemEICxGvFLYmHm9QowVZGHtJlGbS6A6yJ3iViad/2cVjnOiA==}
     peerDependencies:
@@ -1636,20 +1483,6 @@ packages:
       react: 19.2.1
     dev: false
 
-  /@radix-ui/react-use-effect-event@0.0.5(@types/react@19.2.10)(react@19.2.1):
-    resolution: {integrity: sha512-7cshFL8HGS/7HEiHH+9kL9HBwp2sa9yX18Knwek6KYWmXwM7pegMgta2AXMQKI+rq3JnfSj9x8wYqFMTdG1Jgg==}
-    peerDependencies:
-      '@types/react': '*'
-      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
-    peerDependenciesMeta:
-      '@types/react':
-        optional: true
-    dependencies:
-      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.2.10)(react@19.2.1)
-      '@types/react': 19.2.10
-      react: 19.2.1
-    dev: false
-
   /@radix-ui/react-use-escape-keydown@1.1.1(@types/react@19.2.10)(react@19.2.1):
     resolution: {integrity: sha512-Il0+boE7w/XebUHyBjroE+DbByORGR9KKmITzbR7MyQ4akpORYP/ZmbhAr0DG7RmmBqoOnZdy2QlvajJ2QA59g==}
     peerDependencies:
@@ -1691,19 +1524,6 @@ packages:
       react: 19.2.1
     dev: false
 
-  /@radix-ui/react-use-layout-effect@1.1.4(@types/react@19.2.10)(react@19.2.1):
-    resolution: {integrity: sha512-K20DkRkUwDnxEYMBPcg3Y6voLkEy5p5QQmszZgLngKKiC7dzBR/aEuK3w1qlx2JWDUNH6FluahYdgR3BP+QbYw==}
-    peerDependencies:
-      '@types/react': '*'
-      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
-    peerDependenciesMeta:
-      '@types/react':
-        optional: true
-    dependencies:
-      '@types/react': 19.2.10
-      react: 19.2.1
-    dev: false
-
   /@radix-ui/react-use-previous@1.1.1(@types/react@19.2.10)(react@19.2.1):
     resolution: {integrity: sha512-2dHfToCj/pzca2Ck724OZ5L0EVrr3eHRNsG/b3xQJLA2hZpVCS99bLAX+hm1IHXDEnzU6by5z/5MIY794/a8NQ==}
     peerDependencies:
@@ -1717,19 +1537,6 @@ packages:
       react: 19.2.1
     dev: false
 
-  /@radix-ui/react-use-previous@1.1.4(@types/react@19.2.10)(react@19.2.1):
-    resolution: {integrity: sha512-XoSLhbRbqxFtgJoi2fNHA3C6pDlY34x508vUpUGoFZfvePfHXHbE1lC4FYFMnJWgiCRroSTw6fOsXQoVS9RwZg==}
-    peerDependencies:
-      '@types/react': '*'
-      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
-    peerDependenciesMeta:
-      '@types/react':
-        optional: true
-    dependencies:
-      '@types/react': 19.2.10
-      react: 19.2.1
-    dev: false
-
   /@radix-ui/react-use-rect@1.1.1(@types/react@19.2.10)(react@19.2.1):
     resolution: {integrity: sha512-QTYuDesS0VtuHNNvMh+CjlKJ4LJickCMUAqjlE3+j8w+RlRpwyX3apEQKGFzbZGdo7XNG1tXa+bQqIE7HIXT2w==}
     peerDependencies:
@@ -1758,20 +1565,6 @@ packages:
       react: 19.2.1
     dev: false
 
-  /@radix-ui/react-use-size@1.1.4(@types/react@19.2.10)(react@19.2.1):
-    resolution: {integrity: sha512-D3anSY15EJoxrihpsXI6SMrmmonnQtR2ni7arO+Lfdg3O95b9hNXxONk8jA5C8ANdF/h5HMAxejgs8PWJ6rlhw==}
-    peerDependencies:
-      '@types/react': '*'
-      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
-    peerDependenciesMeta:
-      '@types/react':
-        optional: true
-    dependencies:
-      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.2.10)(react@19.2.1)
-      '@types/react': 19.2.10
-      react: 19.2.1
-    dev: false
-
   /@radix-ui/react-visually-hidden@1.2.3(@types/react-dom@19.2.3)(@types/react@19.2.10)(react-dom@19.2.1)(react@19.2.1):
     resolution: {integrity: sha512-pzJq12tEaaIhqjbzpCuv/OypJY/BPavOofm+dbab+MHLajy277+1lLm6JFcGgF5eskJ6mquGirhXY2GD/8u8Ug==}
     peerDependencies:

web/src/app/auth/space/callback/page.tsx

@@ -5,6 +5,7 @@ import {
   beginAuthenticatedSession,
   beginSupportAdminSession,
   bootstrapWorkspaceSession,
+  clearPendingInvitationToken,
   getPendingInvitationToken,
 } from '@/app/infra/http';
 import { toast } from 'sonner';
@@ -66,6 +67,10 @@ function SpaceOAuthCallbackContent() {
   const [searchParams] = useSearchParams();
   const { t } = useTranslation();
   const isMountedRef = useRef(true);
+  const directLaunchFragmentRef = useRef<{
+    workspaceUuid: string | null;
+    launchAssertion: string | null;
+  } | null>(null);
 
   const [status, setStatus] = useState<
     'loading' | 'confirm' | 'success' | 'error'
@@ -108,8 +113,31 @@ function SpaceOAuthCallbackContent() {
         }
 
         beginAuthenticatedSession(response.token, response.user);
-        if (getPendingInvitationToken()) {
-          navigate('/invitations/accept', { replace: true });
+        const invitationToken = getPendingInvitationToken();
+        if (invitationToken) {
+          let invitation;
+          try {
+            invitation =
+              await httpClient.acceptWorkspaceInvitation(invitationToken);
+          } catch (error) {
+            const code = (error as { code?: string }).code;
+            const path = code
+              ? `/invitations/accept?error=${encodeURIComponent(code)}`
+              : '/invitations/accept';
+            navigate(path, { replace: true });
+            return;
+          }
+
+          beginAuthenticatedSession(invitation.token, response.user);
+          clearPendingInvitationToken();
+          const workspaceResult = await bootstrapWorkspaceSession({
+            preferredWorkspaceUuid: invitation.workspace_uuid,
+          });
+          if (workspaceResult.status === 'unavailable') {
+            navigate('/workspace-unavailable', { replace: true });
+            return;
+          }
+          navigate('/home', { replace: true });
           return;
         }
         const workspaceResult = await bootstrapWorkspaceSession({
@@ -220,8 +248,28 @@ function SpaceOAuthCallbackContent() {
     const errorDescription = searchParams.get('error_description');
     const mode = searchParams.get('mode');
     const state = searchParams.get('state');
-    const workspaceUuid = searchParams.get('workspace_uuid');
-    const launchAssertion = searchParams.get('launch_assertion');
+    if (directLaunchFragmentRef.current === null) {
+      const fragmentParams = new URLSearchParams(
+        window.location.hash.startsWith('#')
+          ? window.location.hash.slice(1)
+          : window.location.hash,
+      );
+      directLaunchFragmentRef.current = {
+        workspaceUuid: fragmentParams.get('workspace_uuid'),
+        launchAssertion: fragmentParams.get('launch_assertion'),
+      };
+      if (window.location.hash) {
+        window.history.replaceState(
+          null,
+          '',
+          `${window.location.pathname}${window.location.search}`,
+        );
+      }
+    }
+    const workspaceUuid =
+      directLaunchFragmentRef.current.workspaceUuid ??
+      searchParams.get('workspace_uuid');
+    const launchAssertion = directLaunchFragmentRef.current.launchAssertion;
 
     if (error) {
       setStatus('error');

web/src/app/home/add-extension/page.tsx

@@ -49,6 +49,8 @@ import type {
 } from '@/app/home/mcp/components/mcp-form/MCPForm';
 import SkillZipPreviewPanel from '@/app/home/skills/components/SkillZipPreviewPanel';
 import PluginLocalPreviewPanel from '@/app/home/plugins/components/PluginLocalPreviewPanel';
+import { useWorkspaceQuotaStatus } from '@/app/home/components/workspace-quota/useWorkspaceQuotaStatus';
+import { WorkspaceQuotaTooltip } from '@/app/home/components/workspace-quota/WorkspaceQuotaTooltip';
 
 type PopoverView = 'menu' | 'mcp' | 'github';
 
@@ -154,6 +156,12 @@ function AddExtensionContent() {
   const navigate = useNavigate();
   const [searchParams, setSearchParams] = useSearchParams();
   const { refreshPlugins, refreshMCPServers, refreshSkills } = useSidebarData();
+  const { extensions: extensionQuota, extensionsReached } =
+    useWorkspaceQuotaStatus();
+  const extensionQuotaTooltip = t('limitation.createDisabledTooltip', {
+    resource: t('sidebar.extensions'),
+    max: extensionQuota.max,
+  });
 
   // Localized label for an extension type, used in the install dialog.
   const extensionTypeLabel = (type: string) =>
@@ -344,23 +352,28 @@ function AddExtensionContent() {
     t,
   ]);
 
-  const handleInstallPlugin = useCallback(async (plugin: PluginV4) => {
-    setInstallInfo({
-      plugin_author: plugin.author,
-      plugin_name: plugin.name,
-      plugin_version: plugin.latest_version,
-      plugin_label: extractI18nObject(plugin.label) || plugin.name,
-      plugin_description: extractI18nObject(plugin.description) || '',
-      plugin_icon: plugin.icon || '',
-    });
-    setInstallExtensionType(plugin.type || 'plugin');
-    setPluginInstallStatus(PluginInstallStatus.ASK_CONFIRM);
-    setInstallError(null);
-    setInstallIconFailed(false);
-    setModalOpen(true);
-  }, []);
+  const handleInstallPlugin = useCallback(
+    async (plugin: PluginV4) => {
+      if (extensionsReached) return;
+      setInstallInfo({
+        plugin_author: plugin.author,
+        plugin_name: plugin.name,
+        plugin_version: plugin.latest_version,
+        plugin_label: extractI18nObject(plugin.label) || plugin.name,
+        plugin_description: extractI18nObject(plugin.description) || '',
+        plugin_icon: plugin.icon || '',
+      });
+      setInstallExtensionType(plugin.type || 'plugin');
+      setPluginInstallStatus(PluginInstallStatus.ASK_CONFIRM);
+      setInstallError(null);
+      setInstallIconFailed(false);
+      setModalOpen(true);
+    },
+    [extensionsReached],
+  );
 
   function handleModalConfirm() {
+    if (extensionsReached) return;
     setPluginInstallStatus(PluginInstallStatus.INSTALLING);
     const pluginDisplayName = `${installInfo.plugin_author}/${installInfo.plugin_name}`;
     httpClient
@@ -402,6 +415,7 @@ function AddExtensionContent() {
 
   const uploadFile = useCallback(
     async (file: File) => {
+      if (extensionsReached) return;
       if (!validateFileType(file)) {
         toast.error(t('addExtension.unsupportedFileType'));
         return;
@@ -421,14 +435,15 @@ function AddExtensionContent() {
         setSkillUploadPreviewOpen(true);
       }
     },
-    [t, setSelectedTaskId],
+    [extensionsReached, t, setSelectedTaskId],
   );
 
   const handleFileSelect = useCallback(() => {
+    if (extensionsReached) return;
     if (fileInputRef.current) {
       fileInputRef.current.click();
     }
-  }, []);
+  }, [extensionsReached]);
 
   const handleFileChange = useCallback(
     (event: React.ChangeEvent<HTMLInputElement>) => {
@@ -455,12 +470,13 @@ function AddExtensionContent() {
     (event: React.DragEvent) => {
       event.preventDefault();
       setIsDragOver(false);
+      if (extensionsReached) return;
       const files = Array.from(event.dataTransfer.files);
       if (files.length > 0) {
         uploadFile(files[0]);
       }
     },
-    [uploadFile],
+    [extensionsReached, uploadFile],
   );
 
   function handleMCPCreated(_serverName: string) {
@@ -490,7 +506,8 @@ function AddExtensionContent() {
         return false;
       }
     } catch {
-      // If we can't check, let backend handle it
+      toast.error(t('limitation.quotaCheckFailed'));
+      return false;
     }
     return true;
   }
@@ -630,9 +647,11 @@ function AddExtensionContent() {
 
   async function handleGithubConfirm() {
     if (!selectedAsset || !selectedRelease) return;
-    if (!(await checkExtensionsLimit())) return;
-
     setGithubInstallStatus(GithubInstallStatus.INSTALLING);
+    if (!(await checkExtensionsLimit())) {
+      setGithubInstallStatus(GithubInstallStatus.ASK_CONFIRM);
+      return;
+    }
     const pluginDisplayName = `${githubOwner}/${githubRepo}`;
     httpClient
       .installPluginFromGithub(
@@ -664,9 +683,11 @@ function AddExtensionContent() {
 
   async function handleGithubSkillConfirm() {
     if (!githubSkillInfo) return;
-    if (!(await checkExtensionsLimit())) return;
-
     setGithubInstallStatus(GithubInstallStatus.SKILL_INSTALLING);
+    if (!(await checkExtensionsLimit())) {
+      setGithubInstallStatus(GithubInstallStatus.SKILL_PREVIEW);
+      return;
+    }
     try {
       await httpClient.installSkillFromGithub(
         githubURL.trim(),
@@ -726,17 +747,24 @@ function AddExtensionContent() {
           setPopoverOpen(open);
         }}
       >
-        <PopoverTrigger asChild>
-          <Button
-            variant="default"
-            className="px-3 sm:px-4 py-2 cursor-pointer flex-shrink-0"
-          >
-            <PlusIcon className="w-4 h-4" />
-            <span className="whitespace-nowrap">
-              {t('addExtension.manualAdd')}
-            </span>
-          </Button>
-        </PopoverTrigger>
+        <WorkspaceQuotaTooltip
+          quota={extensionQuota}
+          resource={t('sidebar.extensions')}
+        >
+          <PopoverTrigger asChild>
+            <Button
+              variant="default"
+              disabled={extensionsReached}
+              aria-disabled={extensionsReached}
+              className="px-3 sm:px-4 py-2 cursor-pointer flex-shrink-0 disabled:cursor-not-allowed disabled:bg-muted disabled:text-muted-foreground disabled:opacity-100"
+            >
+              <PlusIcon className="w-4 h-4" />
+              <span className="whitespace-nowrap">
+                {t('addExtension.manualAdd')}
+              </span>
+            </Button>
+          </PopoverTrigger>
+        </WorkspaceQuotaTooltip>
         <PopoverContent
           forceMount
           className={`${getPopoverWidth()} max-h-[min(720px,80vh)] overflow-hidden p-0`}
@@ -745,9 +773,19 @@ function AddExtensionContent() {
           {/* ===== Menu View ===== */}
           {popoverView === 'menu' && (
             <div className="space-y-4 p-4">
+              {extensionsReached && (
+                <div className="rounded-md border border-amber-500/30 bg-amber-500/10 px-3 py-2 text-xs text-amber-800 dark:text-amber-200">
+                  {extensionQuotaTooltip}
+                </div>
+              )}
               {/* File upload area */}
               <div
-                className={`border-2 border-dashed rounded-lg p-6 text-center cursor-pointer transition-colors ${
+                aria-disabled={extensionsReached}
+                className={`border-2 border-dashed rounded-lg p-6 text-center transition-colors ${
+                  extensionsReached
+                    ? 'cursor-not-allowed opacity-50'
+                    : 'cursor-pointer'
+                } ${
                   isDragOver
                     ? 'border-primary bg-primary/5'
                     : 'border-muted-foreground/25 hover:border-primary/50'
@@ -777,7 +815,8 @@ function AddExtensionContent() {
               <div className="space-y-2">
                 <button
                   type="button"
-                  className="group flex w-full items-center gap-3 rounded-md bg-muted/30 p-3 text-left transition-colors outline-none hover:bg-accent hover:text-accent-foreground focus-visible:ring-[3px] focus-visible:ring-ring/50"
+                  disabled={extensionsReached}
+                  className="group flex w-full items-center gap-3 rounded-md bg-muted/30 p-3 text-left transition-colors outline-none hover:bg-accent hover:text-accent-foreground focus-visible:ring-[3px] focus-visible:ring-ring/50 disabled:cursor-not-allowed disabled:opacity-50"
                   onClick={() => setPopoverView('mcp')}
                 >
                   <span className="flex size-8 shrink-0 items-center justify-center rounded-md bg-background text-muted-foreground transition-colors group-hover:text-foreground">
@@ -796,7 +835,8 @@ function AddExtensionContent() {
 
                 <button
                   type="button"
-                  className="group flex w-full items-center gap-3 rounded-md bg-muted/30 p-3 text-left transition-colors outline-none hover:bg-accent hover:text-accent-foreground focus-visible:ring-[3px] focus-visible:ring-ring/50"
+                  disabled={extensionsReached}
+                  className="group flex w-full items-center gap-3 rounded-md bg-muted/30 p-3 text-left transition-colors outline-none hover:bg-accent hover:text-accent-foreground focus-visible:ring-[3px] focus-visible:ring-ring/50 disabled:cursor-not-allowed disabled:opacity-50"
                   onClick={() => setPopoverView('github')}
                 >
                   <span className="flex size-8 shrink-0 items-center justify-center rounded-md bg-background text-muted-foreground transition-colors group-hover:text-foreground">
@@ -815,7 +855,8 @@ function AddExtensionContent() {
 
                 <button
                   type="button"
-                  className="group flex w-full items-center gap-3 rounded-md bg-muted/30 p-3 text-left transition-colors outline-none hover:bg-accent hover:text-accent-foreground focus-visible:ring-[3px] focus-visible:ring-ring/50"
+                  disabled={extensionsReached}
+                  className="group flex w-full items-center gap-3 rounded-md bg-muted/30 p-3 text-left transition-colors outline-none hover:bg-accent hover:text-accent-foreground focus-visible:ring-[3px] focus-visible:ring-ring/50 disabled:cursor-not-allowed disabled:opacity-50"
                   onClick={async () => {
                     if (!(await checkExtensionsLimit())) return;
                     setPopoverOpen(false);
@@ -882,6 +923,7 @@ function AddExtensionContent() {
                   type="submit"
                   form="mcp-form"
                   size="sm"
+                  disabled={extensionsReached}
                   onClick={async (e) => {
                     if (!(await checkExtensionsLimit())) {
                       e.preventDefault();
@@ -946,6 +988,7 @@ function AddExtensionContent() {
                       className="w-full"
                       onClick={handleGithubAddressSubmit}
                       disabled={
+                        extensionsReached ||
                         !githubURL.trim() ||
                         fetchingReleases ||
                         fetchingSkillPreview
@@ -1102,7 +1145,11 @@ function AddExtensionContent() {
                         </div>
                       </div>
                     )}
-                    <Button className="w-full" onClick={handleGithubConfirm}>
+                    <Button
+                      className="w-full"
+                      onClick={handleGithubConfirm}
+                      disabled={extensionsReached}
+                    >
                       {t('common.confirm')}
                     </Button>
                   </div>
@@ -1184,6 +1231,7 @@ function AddExtensionContent() {
                     <Button
                       className="w-full"
                       onClick={handleGithubSkillConfirm}
+                      disabled={extensionsReached}
                     >
                       {t('common.confirm')}
                     </Button>
@@ -1240,6 +1288,8 @@ function AddExtensionContent() {
           <MarketPage
             installPlugin={handleInstallPlugin}
             headerActions={extensionActions}
+            installDisabled={extensionsReached}
+            installDisabledTooltip={extensionQuotaTooltip}
           />
         </div>
       </div>
@@ -1325,9 +1375,17 @@ function AddExtensionContent() {
                 <Button variant="outline" onClick={() => setModalOpen(false)}>
                   {t('common.cancel')}
                 </Button>
-                <Button onClick={handleModalConfirm}>
-                  {t('common.confirm')}
-                </Button>
+                <WorkspaceQuotaTooltip
+                  quota={extensionQuota}
+                  resource={t('sidebar.extensions')}
+                >
+                  <Button
+                    onClick={handleModalConfirm}
+                    disabled={extensionsReached}
+                  >
+                    {t('common.confirm')}
+                  </Button>
+                </WorkspaceQuotaTooltip>
               </>
             )}
             {pluginInstallStatus === PluginInstallStatus.ERROR && (
@@ -1359,6 +1417,8 @@ function AddExtensionContent() {
           {pluginUploadPreviewFile && (
             <PluginLocalPreviewPanel
               file={pluginUploadPreviewFile}
+              quota={extensionQuota}
+              quotaResource={t('sidebar.extensions')}
               onCancel={() => {
                 setPluginUploadPreviewOpen(false);
                 setPluginUploadPreviewFile(null);
@@ -1392,6 +1452,8 @@ function AddExtensionContent() {
           {skillUploadPreviewFile && (
             <SkillZipPreviewPanel
               file={skillUploadPreviewFile}
+              quota={extensionQuota}
+              quotaResource={t('sidebar.extensions')}
               onCancel={() => {
                 setSkillUploadPreviewOpen(false);
                 setSkillUploadPreviewFile(null);

web/src/app/home/bots/components/bot-form/BotForm.tsx

@@ -396,10 +396,9 @@ export default function BotForm({
       <form
         id="bot-form"
         onSubmit={form.handleSubmit(onDynamicFormSubmit)}
-        className="space-y-6"
         aria-busy={isLoading}
       >
-        <fieldset className="contents" disabled={isLoading}>
+        <fieldset className="space-y-6" disabled={isLoading}>
           {/* Card 1: Basic Information */}
           <Card>
             <CardHeader>

web/src/app/home/components/dynamic-form/DynamicFormComponent.tsx

@@ -144,7 +144,6 @@ function getValueSchema(spec: DynamicFormValueSpec) {
       return z.object({
         primary: z.string(),
         fallbacks: z.array(z.string()),
-        reasoning: z.record(z.string()),
       });
     case DynamicFormItemType.PROMPT_EDITOR:
       return z.array(
@@ -489,24 +488,12 @@ export default function DynamicFormComponent({
                 (v): v is string => typeof v === 'string',
               )
             : [],
-          reasoning:
-            obj.reasoning != null &&
-            typeof obj.reasoning === 'object' &&
-            !Array.isArray(obj.reasoning)
-              ? Object.fromEntries(
-                  Object.entries(obj.reasoning).filter(
-                    (entry): entry is [string, string] =>
-                      typeof entry[1] === 'string',
-                  ),
-                )
-              : {},
         };
       }
       // Legacy string format or any other unexpected type
       return {
         primary: typeof value === 'string' ? value : '',
         fallbacks: [],
-        reasoning: {},
       };
     }
     if (item.type === 'prompt-editor') {

web/src/app/home/components/dynamic-form/DynamicFormItemComponent.tsx

@@ -25,7 +25,6 @@ import {
   EmbeddingModel,
   RerankModel,
   PluginTool,
-  ReasoningLevel,
 } from '@/app/infra/entities/api';
 import { toast } from 'sonner';
 import { useTranslation } from 'react-i18next';
@@ -67,9 +66,6 @@ import SettingsDialog, {
 } from '@/app/home/components/settings-dialog/SettingsDialog';
 import ToolResourceSelectors from '@/app/home/components/dynamic-form/ToolResourceSelectors';
 import { LANGBOT_MODELS_PROVIDER_REQUESTER } from '@/app/home/components/models-dialog/types';
-import ReasoningLevelPicker, {
-  REASONING_LEVELS,
-} from '@/app/home/components/reasoning/ReasoningLevelPicker';
 
 function hasUsableUuid<T extends { uuid?: string | null }>(
   item: T,
@@ -878,11 +874,7 @@ export default function DynamicFormItemComponent({
       ];
 
       const rawModelValue = field.value;
-      const modelValue: {
-        primary: string;
-        fallbacks: string[];
-        reasoning: Record<string, ReasoningLevel>;
-      } =
+      const modelValue: { primary: string; fallbacks: string[] } =
         rawModelValue != null &&
         typeof rawModelValue === 'object' &&
         !Array.isArray(rawModelValue)
@@ -901,29 +893,10 @@ export default function DynamicFormItemComponent({
                       .fallbacks as unknown[]
                   ).filter((v): v is string => typeof v === 'string')
                 : [],
-              reasoning:
-                (rawModelValue as Record<string, unknown>).reasoning != null &&
-                typeof (rawModelValue as Record<string, unknown>).reasoning ===
-                  'object' &&
-                !Array.isArray(
-                  (rawModelValue as Record<string, unknown>).reasoning,
-                )
-                  ? (Object.fromEntries(
-                      Object.entries(
-                        (rawModelValue as Record<string, unknown>)
-                          .reasoning as Record<string, unknown>,
-                      ).filter(
-                        (entry): entry is [string, ReasoningLevel] =>
-                          typeof entry[1] === 'string' &&
-                          REASONING_LEVELS.includes(entry[1] as ReasoningLevel),
-                      ),
-                    ) as Record<string, ReasoningLevel>)
-                  : {},
             }
           : {
               primary: typeof rawModelValue === 'string' ? rawModelValue : '',
               fallbacks: [],
-              reasoning: {},
             };
 
       const renderModelSelect = (
@@ -1070,79 +1043,20 @@ export default function DynamicFormItemComponent({
         field.onChange({ ...modelValue, ...patch });
       };
 
-      const updateModelReasoning = (
-        modelUuid: string,
-        level: ReasoningLevel,
-      ) => {
-        if (!modelUuid) return;
-        const updated = { ...modelValue.reasoning };
-        if (level === 'provider_default') {
-          delete updated[modelUuid];
-        } else {
-          updated[modelUuid] = level;
-        }
-        updateValue({ reasoning: updated });
-      };
-
-      const replaceModel = (
-        currentUuid: string,
-        nextUuid: string,
-        patch: Partial<typeof modelValue>,
-      ) => {
-        const nextValue = { ...modelValue, ...patch };
-        const updatedReasoning = { ...modelValue.reasoning };
-        const currentModelStillSelected =
-          nextValue.primary === currentUuid ||
-          nextValue.fallbacks.includes(currentUuid);
-        if (
-          currentUuid &&
-          currentUuid !== nextUuid &&
-          !currentModelStillSelected
-        ) {
-          delete updatedReasoning[currentUuid];
-        }
-        updateValue({ ...nextValue, reasoning: updatedReasoning });
-      };
-
-      const renderReasoningPicker = (modelUuid: string) => {
-        if (!modelUuid) return null;
-        const model = llmModels.find(
-          (candidate) => candidate.uuid === modelUuid,
-        );
-        const currentLevel =
-          modelValue.reasoning[modelUuid] || 'provider_default';
-        const availableLevels = model?.reasoning_capabilities?.levels || [
-          'provider_default',
-        ];
-        const levels = REASONING_LEVELS.filter(
-          (level) => availableLevels.includes(level) || level === currentLevel,
-        );
-
-        return (
-          <ReasoningLevelPicker
-            value={currentLevel}
-            levels={levels}
-            onChange={(level) => updateModelReasoning(modelUuid, level)}
-          />
-        );
-      };
-
       const addFallbackModel = () => {
         updateValue({ fallbacks: [...modelValue.fallbacks, ''] });
       };
 
       const updateFallbackModel = (index: number, value: string) => {
         const updated = [...modelValue.fallbacks];
-        const currentUuid = updated[index];
         updated[index] = value;
-        replaceModel(currentUuid, value, { fallbacks: updated });
+        updateValue({ fallbacks: updated });
       };
 
       const removeFallbackModel = (index: number) => {
         const updated = [...modelValue.fallbacks];
-        const removedUuid = updated[index];
         updated.splice(index, 1);
-        replaceModel(removedUuid, '', { fallbacks: updated });
+        updateValue({ fallbacks: updated });
       };
 
       const moveFallbackModel = (index: number, direction: 'up' | 'down') => {
@@ -1167,12 +1081,10 @@ export default function DynamicFormItemComponent({
               <div className="min-w-0 flex-1">
                 {renderModelSelect(
                   modelValue.primary,
-                  (val) =>
-                    replaceModel(modelValue.primary, val, { primary: val }),
+                  (val) => updateValue({ primary: val }),
                   t('models.selectModel'),
                 )}
               </div>
-              {renderReasoningPicker(modelValue.primary)}
               <Tooltip>
                 <TooltipTrigger asChild>
                   <Button
@@ -1206,18 +1118,15 @@ export default function DynamicFormItemComponent({
               </p>
               {modelValue.fallbacks.map((fbUuid: string, index: number) => (
                 <div key={index} className="flex min-w-0 items-center gap-2">
-                  <span className="w-4 shrink-0 text-xs text-muted-foreground">
+                  <span className="text-xs text-muted-foreground w-4 shrink-0">
                     {index + 1}.
                   </span>
-                  <div className="flex min-w-0 flex-1 items-center gap-1.5">
-                    <div className="min-w-0 flex-1">
-                      {renderModelSelect(
-                        fbUuid,
-                        (val) => updateFallbackModel(index, val),
-                        t('models.selectModel'),
-                      )}
-                    </div>
-                    {renderReasoningPicker(fbUuid)}
+                  <div className="min-w-0 flex-1">
+                    {renderModelSelect(
+                      fbUuid,
+                      (val) => updateFallbackModel(index, val),
+                      t('models.selectModel'),
+                    )}
                   </div>
                   <div className="flex gap-1 shrink-0">
                     <Button

web/src/app/home/components/dynamic-form/DynamicFormSaveValues.ts

@@ -5,56 +5,6 @@ export type DynamicFormSaveValueSpec = Pick<
   'default' | 'name' | 'type'
 >;
 
-const reasoningLevels = new Set([
-  'disabled',
-  'enabled',
-  'minimal',
-  'low',
-  'medium',
-  'high',
-  'xhigh',
-  'max',
-]);
-
-function normalizeModelFallbackValue(value: unknown): {
-  primary: string;
-  fallbacks: string[];
-  reasoning: Record<string, string>;
-} {
-  const raw =
-    value != null && typeof value === 'object' && !Array.isArray(value)
-      ? (value as Record<string, unknown>)
-      : {};
-  const primary =
-    typeof raw.primary === 'string'
-      ? raw.primary
-      : typeof value === 'string'
-        ? value
-        : '';
-  const fallbacks = Array.isArray(raw.fallbacks)
-    ? raw.fallbacks.filter(
-        (fallback): fallback is string => typeof fallback === 'string',
-      )
-    : [];
-  const selectedModels = new Set([primary, ...fallbacks].filter(Boolean));
-  const rawReasoning =
-    raw.reasoning != null &&
-    typeof raw.reasoning === 'object' &&
-    !Array.isArray(raw.reasoning)
-      ? (raw.reasoning as Record<string, unknown>)
-      : {};
-  const reasoning = Object.fromEntries(
-    Object.entries(rawReasoning).filter(
-      ([modelUuid, level]) =>
-        selectedModels.has(modelUuid) &&
-        typeof level === 'string' &&
-        reasoningLevels.has(level),
-    ),
-  ) as Record<string, string>;
-
-  return { primary, fallbacks, reasoning };
-}
-
 /**
  * Build the value snapshot emitted to parent forms for persistence.
  * Only single-line string fields trim surrounding whitespace; multiline text
@@ -66,14 +16,10 @@ export function normalizeDynamicFormValuesForSave(
 ): Record<string, unknown> {
   return specs.reduce<Record<string, unknown>>((values, spec) => {
     const value = formValues[spec.name] ?? spec.default;
-    if (spec.type === 'model-fallback-selector') {
-      values[spec.name] = normalizeModelFallbackValue(value);
-    } else {
-      values[spec.name] =
-        spec.type === 'string' && typeof value === 'string'
-          ? value.trim()
-          : value;
-    }
+    values[spec.name] =
+      spec.type === 'string' && typeof value === 'string'
+        ? value.trim()
+        : value;
     return values;
   }, {});
 }

web/src/app/home/components/home-sidebar/HomeSidebar.tsx

@@ -8,6 +8,7 @@ import {
   clearUserInfo,
   getCloudServiceClientSync,
   useCurrentWorkspace,
+  useWorkspaceBootstrap,
 } from '@/app/infra/http';
 import { useTranslation } from 'react-i18next';
 import {
@@ -32,7 +33,6 @@ import {
   Zap,
   FilePlus2,
   Sparkles,
-  HardDrive,
   Server,
   Puzzle,
   RefreshCcw,
@@ -109,6 +109,11 @@ import {
 import { cn } from '@/lib/utils';
 import { useSidebarData, SidebarEntityItem } from './SidebarDataContext';
 import { FeedbackPopoverContent } from './FeedbackPopover';
+import {
+  type WorkspaceQuotaItem,
+  useWorkspaceQuotaStatus,
+} from '@/app/home/components/workspace-quota/useWorkspaceQuotaStatus';
+import { WorkspaceQuotaTooltip } from '@/app/home/components/workspace-quota/WorkspaceQuotaTooltip';
 
 // Compare two version strings, returns true if v1 > v2
 function compareVersions(v1: string, v2: string): boolean {
@@ -279,6 +284,14 @@ function sleep(ms: number) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
+const UNLIMITED_QUOTA: WorkspaceQuotaItem = {
+  count: 0,
+  max: -1,
+  reached: false,
+  loading: false,
+  disabled: false,
+};
+
 async function waitForMCPRefreshTask(taskId: number) {
   const deadline = Date.now() + MCP_REFRESH_TIMEOUT_MS;
 
@@ -386,6 +399,7 @@ function NavItems({
   const pathname = location.pathname;
   const [searchParams] = useSearchParams();
   const sidebarData = useSidebarData();
+  const quotaStatus = useWorkspaceQuotaStatus();
   const { state: sidebarState, isMobile } = useSidebar();
   const { t } = useTranslation();
   const currentWorkspace = useCurrentWorkspace();
@@ -529,7 +543,7 @@ function NavItems({
           if (config.id === 'add-extension' && !canManageResources) {
             return null;
           }
-          // Non-entity entries (e.g. monitoring, market, mcp) render as plain links
+          // Non-entity entries (e.g. monitoring and the extension market) render as plain links.
           return (
             <SidebarMenuItem key={config.id}>
               <SidebarMenuButton
@@ -575,6 +589,18 @@ function NavItems({
         const isSkill = categoryId === 'skills';
         const isBot = categoryId === 'bots';
         const isMCP = categoryId === 'mcp';
+        const quota =
+          categoryId === 'bots'
+            ? quotaStatus.bots
+            : categoryId === 'pipelines'
+              ? quotaStatus.pipelines
+              : categoryId === 'knowledge'
+                ? quotaStatus.knowledgeBases
+                : categoryId === 'plugins' ||
+                    categoryId === 'mcp' ||
+                    categoryId === 'skills'
+                  ? quotaStatus.extensions
+                  : UNLIMITED_QUOTA;
 
         const resolveItemRoute = (item: SidebarEntityItem): string => {
           if (item.extensionType === 'mcp') {
@@ -907,128 +933,144 @@ function NavItems({
                 >
                   <div className="flex items-center justify-between mb-1 px-2">
                     <span className="text-sm font-medium">{config.name}</span>
-                    {canCreate &&
-                      (isPlugin ? (
-                        <DropdownMenu>
-                          <DropdownMenuTrigger asChild>
-                            <button
-                              type="button"
-                              className="p-1 rounded-sm text-muted-foreground hover:bg-accent hover:text-accent-foreground transition-colors"
-                            >
-                              <Plus className="size-3.5" />
-                            </button>
-                          </DropdownMenuTrigger>
-                          <DropdownMenuContent align="end">
-                            {systemInfo.enable_marketplace && (
+                    {canCreate && (
+                      <WorkspaceQuotaTooltip
+                        quota={quota}
+                        resource={config.name}
+                        side="right"
+                      >
+                        {isPlugin ? (
+                          <DropdownMenu>
+                            <DropdownMenuTrigger asChild>
+                              <button
+                                type="button"
+                                disabled={quota.disabled}
+                                aria-disabled={quota.disabled}
+                                aria-label={`${t('common.create')} ${config.name}`}
+                                className="p-1 rounded-sm text-muted-foreground hover:bg-accent hover:text-accent-foreground transition-colors disabled:pointer-events-none disabled:opacity-40"
+                              >
+                                <Plus className="size-3.5" />
+                              </button>
+                            </DropdownMenuTrigger>
+                            <DropdownMenuContent align="end">
+                              {systemInfo.enable_marketplace && (
+                                <DropdownMenuItem
+                                  onClick={(e) => {
+                                    e.stopPropagation();
+                                    navigate('/home/add-extension');
+                                    setPopoverOpen((prev) => ({
+                                      ...prev,
+                                      [config.id]: false,
+                                    }));
+                                  }}
+                                >
+                                  <Store className="size-4" />
+                                  {t('plugins.goToMarketplace')}
+                                </DropdownMenuItem>
+                              )}
                               <DropdownMenuItem
                                 onClick={(e) => {
                                   e.stopPropagation();
-                                  navigate('/home/add-extension');
+                                  navigate('/home/add-extension?manual=1');
                                   setPopoverOpen((prev) => ({
                                     ...prev,
                                     [config.id]: false,
                                   }));
                                 }}
                               >
-                                <Store className="size-4" />
-                                {t('plugins.goToMarketplace')}
+                                <Upload className="size-4" />
+                                {t('plugins.uploadLocal')}
                               </DropdownMenuItem>
-                            )}
-                            <DropdownMenuItem
-                              onClick={(e) => {
-                                e.stopPropagation();
-                                navigate('/home/add-extension?manual=1');
-                                setPopoverOpen((prev) => ({
-                                  ...prev,
-                                  [config.id]: false,
-                                }));
-                              }}
-                            >
-                              <Upload className="size-4" />
-                              {t('plugins.uploadLocal')}
-                            </DropdownMenuItem>
-                            <DropdownMenuItem
-                              onClick={(e) => {
-                                e.stopPropagation();
-                                navigate('/home/add-extension?manual=1');
-                                setPopoverOpen((prev) => ({
-                                  ...prev,
-                                  [config.id]: false,
-                                }));
-                              }}
-                            >
-                              <Github className="size-4" />
-                              {t('plugins.installFromGithub')}
-                            </DropdownMenuItem>
-                          </DropdownMenuContent>
-                        </DropdownMenu>
-                      ) : isSkill ? (
-                        <DropdownMenu>
-                          <DropdownMenuTrigger asChild>
-                            <button
-                              type="button"
-                              className="p-1 rounded-sm text-muted-foreground hover:bg-accent hover:text-accent-foreground transition-colors"
-                            >
-                              <Plus className="size-3.5" />
-                            </button>
-                          </DropdownMenuTrigger>
-                          <DropdownMenuContent align="end">
-                            <DropdownMenuItem
-                              onClick={(e) => {
-                                e.stopPropagation();
-                                navigate('/home/skills?action=create');
-                                setPopoverOpen((prev) => ({
-                                  ...prev,
-                                  [config.id]: false,
-                                }));
-                              }}
-                            >
-                              <FilePlus2 className="size-4" />
-                              {t('skills.createManually')}
-                            </DropdownMenuItem>
-                            <DropdownMenuItem
-                              onClick={(e) => {
-                                e.stopPropagation();
-                                navigate('/home/add-extension?manual=1');
-                                setPopoverOpen((prev) => ({
-                                  ...prev,
-                                  [config.id]: false,
-                                }));
-                              }}
-                            >
-                              <Upload className="size-4" />
-                              {t('skills.uploadZip')}
-                            </DropdownMenuItem>
-                            <DropdownMenuItem
-                              onClick={(e) => {
-                                e.stopPropagation();
-                                navigate('/home/add-extension?manual=1');
-                                setPopoverOpen((prev) => ({
-                                  ...prev,
-                                  [config.id]: false,
-                                }));
-                              }}
-                            >
-                              <Github className="size-4" />
-                              {t('skills.importFromGithub')}
-                            </DropdownMenuItem>
-                          </DropdownMenuContent>
-                        </DropdownMenu>
-                      ) : (
-                        <button
-                          type="button"
-                          className="p-1 rounded-sm text-muted-foreground hover:bg-accent hover:text-accent-foreground transition-colors"
-                          onClick={() => {
-                            navigate(`${routePrefix}?id=new`);
-                            setPopoverOpen((prev) => ({
-                              ...prev,
-                              [config.id]: false,
-                            }));
-                          }}
-                        >
-                          <Plus className="size-3.5" />
-                        </button>
-                      ))}
+                              <DropdownMenuItem
+                                onClick={(e) => {
+                                  e.stopPropagation();
+                                  navigate('/home/add-extension?manual=1');
+                                  setPopoverOpen((prev) => ({
+                                    ...prev,
+                                    [config.id]: false,
+                                  }));
+                                }}
+                              >
+                                <Github className="size-4" />
+                                {t('plugins.installFromGithub')}
+                              </DropdownMenuItem>
+                            </DropdownMenuContent>
+                          </DropdownMenu>
+                        ) : isSkill ? (
+                          <DropdownMenu>
+                            <DropdownMenuTrigger asChild>
+                              <button
+                                type="button"
+                                disabled={quota.disabled}
+                                aria-disabled={quota.disabled}
+                                aria-label={`${t('common.create')} ${config.name}`}
+                                className="p-1 rounded-sm text-muted-foreground hover:bg-accent hover:text-accent-foreground transition-colors disabled:pointer-events-none disabled:opacity-40"
+                              >
+                                <Plus className="size-3.5" />
+                              </button>
+                            </DropdownMenuTrigger>
+                            <DropdownMenuContent align="end">
+                              <DropdownMenuItem
+                                onClick={(e) => {
+                                  e.stopPropagation();
+                                  navigate('/home/skills?action=create');
+                                  setPopoverOpen((prev) => ({
+                                    ...prev,
+                                    [config.id]: false,
+                                  }));
+                                }}
+                              >
+                                <FilePlus2 className="size-4" />
+                                {t('skills.createManually')}
+                              </DropdownMenuItem>
+                              <DropdownMenuItem
+                                onClick={(e) => {
+                                  e.stopPropagation();
+                                  navigate('/home/add-extension?manual=1');
+                                  setPopoverOpen((prev) => ({
+                                    ...prev,
+                                    [config.id]: false,
+                                  }));
+                                }}
+                              >
+                                <Upload className="size-4" />
+                                {t('skills.uploadZip')}
+                              </DropdownMenuItem>
+                              <DropdownMenuItem
+                                onClick={(e) => {
+                                  e.stopPropagation();
+                                  navigate('/home/add-extension?manual=1');
+                                  setPopoverOpen((prev) => ({
+                                    ...prev,
+                                    [config.id]: false,
+                                  }));
+                                }}
+                              >
+                                <Github className="size-4" />
+                                {t('skills.importFromGithub')}
+                              </DropdownMenuItem>
+                            </DropdownMenuContent>
+                          </DropdownMenu>
+                        ) : (
+                          <button
+                            type="button"
+                            disabled={quota.disabled}
+                            aria-disabled={quota.disabled}
+                            aria-label={`${t('common.create')} ${config.name}`}
+                            className="p-1 rounded-sm text-muted-foreground hover:bg-accent hover:text-accent-foreground transition-colors disabled:pointer-events-none disabled:opacity-40"
+                            onClick={() => {
+                              navigate(`${routePrefix}?id=new`);
+                              setPopoverOpen((prev) => ({
+                                ...prev,
+                                [config.id]: false,
+                              }));
+                            }}
+                          >
+                            <Plus className="size-3.5" />
+                          </button>
+                        )}
+                      </WorkspaceQuotaTooltip>
+                    )}
                   </div>
                   <div className="flex flex-col gap-0.5 max-h-80 overflow-y-auto">
                     {renderEntityList(true)}
@@ -1096,103 +1138,119 @@ function NavItems({
                         />
                       </button>
                     )}
-                    {canCreate &&
-                      (isPlugin ? (
-                        <DropdownMenu>
-                          <DropdownMenuTrigger asChild>
-                            <button
-                              type="button"
-                              className="p-1 rounded-sm text-sidebar-foreground/70 hover:bg-sidebar-accent hover:text-sidebar-accent-foreground [@media(hover:hover)]:opacity-0 group-hover/category-header:opacity-100 transition-all"
-                              onClick={(e) => e.stopPropagation()}
-                            >
-                              <Plus className="size-3.5" />
-                            </button>
-                          </DropdownMenuTrigger>
-                          <DropdownMenuContent align="end">
-                            {systemInfo.enable_marketplace && (
+                    {canCreate && (
+                      <WorkspaceQuotaTooltip
+                        quota={quota}
+                        resource={config.name}
+                        side="right"
+                      >
+                        {isPlugin ? (
+                          <DropdownMenu>
+                            <DropdownMenuTrigger asChild>
+                              <button
+                                type="button"
+                                disabled={quota.disabled}
+                                aria-disabled={quota.disabled}
+                                aria-label={`${t('common.create')} ${config.name}`}
+                                className="p-1 rounded-sm text-sidebar-foreground/70 hover:bg-sidebar-accent hover:text-sidebar-accent-foreground [@media(hover:hover)]:opacity-0 group-hover/category-header:opacity-100 transition-all disabled:pointer-events-none disabled:opacity-40"
+                                onClick={(e) => e.stopPropagation()}
+                              >
+                                <Plus className="size-3.5" />
+                              </button>
+                            </DropdownMenuTrigger>
+                            <DropdownMenuContent align="end">
+                              {systemInfo.enable_marketplace && (
+                                <DropdownMenuItem
+                                  onClick={(e) => {
+                                    e.stopPropagation();
+                                    navigate('/home/add-extension');
+                                  }}
+                                >
+                                  <Store className="size-4" />
+                                  {t('plugins.goToMarketplace')}
+                                </DropdownMenuItem>
+                              )}
                               <DropdownMenuItem
                                 onClick={(e) => {
                                   e.stopPropagation();
-                                  navigate('/home/add-extension');
+                                  navigate('/home/add-extension?manual=1');
                                 }}
                               >
-                                <Store className="size-4" />
-                                {t('plugins.goToMarketplace')}
+                                <Upload className="size-4" />
+                                {t('plugins.uploadLocal')}
                               </DropdownMenuItem>
-                            )}
-                            <DropdownMenuItem
-                              onClick={(e) => {
-                                e.stopPropagation();
-                                navigate('/home/add-extension?manual=1');
-                              }}
-                            >
-                              <Upload className="size-4" />
-                              {t('plugins.uploadLocal')}
-                            </DropdownMenuItem>
-                            <DropdownMenuItem
-                              onClick={(e) => {
-                                e.stopPropagation();
-                                navigate('/home/add-extension?manual=1');
-                              }}
-                            >
-                              <Github className="size-4" />
-                              {t('plugins.installFromGithub')}
-                            </DropdownMenuItem>
-                          </DropdownMenuContent>
-                        </DropdownMenu>
-                      ) : isSkill ? (
-                        <DropdownMenu>
-                          <DropdownMenuTrigger asChild>
-                            <button
-                              type="button"
-                              className="p-1 rounded-sm text-sidebar-foreground/70 hover:bg-sidebar-accent hover:text-sidebar-accent-foreground [@media(hover:hover)]:opacity-0 group-hover/category-header:opacity-100 transition-all"
-                              onClick={(e) => e.stopPropagation()}
-                            >
-                              <Plus className="size-3.5" />
-                            </button>
-                          </DropdownMenuTrigger>
-                          <DropdownMenuContent align="end">
-                            <DropdownMenuItem
-                              onClick={(e) => {
-                                e.stopPropagation();
-                                navigate('/home/skills?action=create');
-                              }}
-                            >
-                              <FilePlus2 className="size-4" />
-                              {t('skills.createManually')}
-                            </DropdownMenuItem>
-                            <DropdownMenuItem
-                              onClick={(e) => {
-                                e.stopPropagation();
-                                navigate('/home/add-extension?manual=1');
-                              }}
-                            >
-                              <Upload className="size-4" />
-                              {t('skills.uploadZip')}
-                            </DropdownMenuItem>
-                            <DropdownMenuItem
-                              onClick={(e) => {
-                                e.stopPropagation();
-                                navigate('/home/add-extension?manual=1');
-                              }}
-                            >
-                              <Github className="size-4" />
-                              {t('skills.importFromGithub')}
-                            </DropdownMenuItem>
-                          </DropdownMenuContent>
-                        </DropdownMenu>
-                      ) : (
-                        <button
-                          type="button"
-                          className="p-1 rounded-sm text-sidebar-foreground/70 hover:bg-sidebar-accent hover:text-sidebar-accent-foreground [@media(hover:hover)]:opacity-0 group-hover/category-header:opacity-100 transition-all"
-                          onClick={(e) => {
-                            e.stopPropagation();
-                            navigate(`${routePrefix}?id=new`);
-                          }}
-                        >
-                          <Plus className="size-3.5" />
-                        </button>
-                      ))}
+                              <DropdownMenuItem
+                                onClick={(e) => {
+                                  e.stopPropagation();
+                                  navigate('/home/add-extension?manual=1');
+                                }}
+                              >
+                                <Github className="size-4" />
+                                {t('plugins.installFromGithub')}
+                              </DropdownMenuItem>
+                            </DropdownMenuContent>
+                          </DropdownMenu>
+                        ) : isSkill ? (
+                          <DropdownMenu>
+                            <DropdownMenuTrigger asChild>
+                              <button
+                                type="button"
+                                disabled={quota.disabled}
+                                aria-disabled={quota.disabled}
+                                aria-label={`${t('common.create')} ${config.name}`}
+                                className="p-1 rounded-sm text-sidebar-foreground/70 hover:bg-sidebar-accent hover:text-sidebar-accent-foreground [@media(hover:hover)]:opacity-0 group-hover/category-header:opacity-100 transition-all disabled:pointer-events-none disabled:opacity-40"
+                                onClick={(e) => e.stopPropagation()}
+                              >
+                                <Plus className="size-3.5" />
+                              </button>
+                            </DropdownMenuTrigger>
+                            <DropdownMenuContent align="end">
+                              <DropdownMenuItem
+                                onClick={(e) => {
+                                  e.stopPropagation();
+                                  navigate('/home/skills?action=create');
+                                }}
+                              >
+                                <FilePlus2 className="size-4" />
+                                {t('skills.createManually')}
+                              </DropdownMenuItem>
+                              <DropdownMenuItem
+                                onClick={(e) => {
+                                  e.stopPropagation();
+                                  navigate('/home/add-extension?manual=1');
+                                }}
+                              >
+                                <Upload className="size-4" />
+                                {t('skills.uploadZip')}
+                              </DropdownMenuItem>
+                              <DropdownMenuItem
+                                onClick={(e) => {
+                                  e.stopPropagation();
+                                  navigate('/home/add-extension?manual=1');
+                                }}
+                              >
+                                <Github className="size-4" />
+                                {t('skills.importFromGithub')}
+                              </DropdownMenuItem>
+                            </DropdownMenuContent>
+                          </DropdownMenu>
+                        ) : (
+                          <button
+                            type="button"
+                            disabled={quota.disabled}
+                            aria-disabled={quota.disabled}
+                            aria-label={`${t('common.create')} ${config.name}`}
+                            className="p-1 rounded-sm text-sidebar-foreground/70 hover:bg-sidebar-accent hover:text-sidebar-accent-foreground [@media(hover:hover)]:opacity-0 group-hover/category-header:opacity-100 transition-all disabled:pointer-events-none disabled:opacity-40"
+                            onClick={(e) => {
+                              e.stopPropagation();
+                              navigate(`${routePrefix}?id=new`);
+                            }}
+                          >
+                            <Plus className="size-3.5" />
+                          </button>
+                        )}
+                      </WorkspaceQuotaTooltip>
+                    )}
                     <CollapsibleTrigger asChild>
                       <button
                         type="button"
@@ -1637,6 +1695,13 @@ export default function HomeSidebar({
   const { theme, setTheme } = useTheme();
   const { t } = useTranslation();
   const currentWorkspace = useCurrentWorkspace();
+  const workspaces = useWorkspaceBootstrap();
+  const showWorkspaceSwitcher =
+    workspaces.length > 1 ||
+    currentWorkspace?.workspace.source === 'cloud_projection';
+  const canViewStorageAnalysis =
+    currentWorkspace?.workspace.source !== 'cloud_projection' &&
+    currentWorkspace?.permissions.includes('audit.view');
   const [settingsOpen, setSettingsOpen] = useState(false);
   const [settingsSection, setSettingsSection] =
     useState<SettingsSection>('models');
@@ -1915,9 +1980,11 @@ export default function HomeSidebar({
           </SidebarMenu>
         </SidebarHeader>
 
-        <div className="px-2 group-data-[collapsible=icon]:px-0">
-          <WorkspaceSwitcher className="w-full group-data-[collapsible=icon]:min-w-0 group-data-[collapsible=icon]:px-2" />
-        </div>
+        {showWorkspaceSwitcher && (
+          <div className="px-2 group-data-[collapsible=icon]:px-0">
+            <WorkspaceSwitcher className="w-full group-data-[collapsible=icon]:min-w-0 group-data-[collapsible=icon]:px-2" />
+          </div>
+        )}
 
         {/* Navigation items grouped by section */}
         <div className="relative flex min-h-0 flex-1 flex-col overflow-hidden">
@@ -2098,15 +2165,16 @@ export default function HomeSidebar({
                       <UsersRound />
                       {t('workspace.settings')}
                     </DropdownMenuItem>
-                    <DropdownMenuItem
-                      onClick={() => {
-                        setUserMenuOpen(false);
-                        openSettings('storageAnalysis');
-                      }}
-                    >
-                      <HardDrive />
-                      {t('storageAnalysis.title')}
-                    </DropdownMenuItem>
+                    {canViewStorageAnalysis && (
+                      <DropdownMenuItem
+                        onClick={() => {
+                          setUserMenuOpen(false);
+                          openSettings('storageAnalysis');
+                        }}
+                      >
+                        {t('storageAnalysis.title')}
+                      </DropdownMenuItem>
+                    )}
                     <DropdownMenuItem
                       onClick={() => {
                         setUserMenuOpen(false);

web/src/app/home/components/home-sidebar/SidebarDataContext.tsx

@@ -4,6 +4,7 @@ import React, {
   useState,
   useEffect,
   useCallback,
+  useRef,
 } from 'react';
 import { httpClient, getCloudServiceClientSync } from '@/app/infra/http';
 import { extractI18nObject } from '@/i18n/I18nProvider';
@@ -48,9 +49,11 @@ export interface SidebarDataContextValue {
   pipelines: SidebarEntityItem[];
   knowledgeBases: SidebarEntityItem[];
   plugins: SidebarEntityItem[];
+  pluginCount: number;
   mcpServers: SidebarEntityItem[];
   skills: SidebarEntityItem[];
   pluginPages: PluginPageItem[];
+  quotaDataLoaded: boolean;
   refreshBots: () => Promise<void>;
   refreshPipelines: () => Promise<void>;
   refreshKnowledgeBases: () => Promise<void>;
@@ -77,9 +80,36 @@ export function SidebarDataProvider({
   const [pipelines, setPipelines] = useState<SidebarEntityItem[]>([]);
   const [knowledgeBases, setKnowledgeBases] = useState<SidebarEntityItem[]>([]);
   const [plugins, setPlugins] = useState<SidebarEntityItem[]>([]);
+  const [pluginCount, setPluginCount] = useState(0);
   const [mcpServers, setMCPServers] = useState<SidebarEntityItem[]>([]);
   const [skills, setSkills] = useState<SidebarEntityItem[]>([]);
   const [pluginPages, setPluginPages] = useState<PluginPageItem[]>([]);
+  const [quotaDataLoaded, setQuotaDataLoaded] = useState(false);
+  const refreshRequestIds = useRef({
+    bots: 0,
+    pipelines: 0,
+    knowledgeBases: 0,
+    plugins: 0,
+    mcpServers: 0,
+    skills: 0,
+  });
+  const quotaResourceLoaded = useRef({
+    bots: false,
+    pipelines: false,
+    knowledgeBases: false,
+    plugins: false,
+    mcpServers: false,
+    skills: false,
+  });
+  const setQuotaResourceLoaded = useCallback(
+    (resource: keyof typeof quotaResourceLoaded.current, loaded: boolean) => {
+      quotaResourceLoaded.current[resource] = loaded;
+      setQuotaDataLoaded(
+        Object.values(quotaResourceLoaded.current).every(Boolean),
+      );
+    },
+    [],
+  );
   const [detailEntityName, setDetailEntityName] = useState<string | null>(null);
   const [extensionsGroupByType, setExtensionsGroupByTypeState] =
     useState<boolean>(() => {
@@ -96,8 +126,11 @@ export function SidebarDataProvider({
   }, []);
 
   const refreshBots = useCallback(async () => {
+    const requestId = ++refreshRequestIds.current.bots;
     try {
       const resp = await httpClient.getBots();
+      if (requestId !== refreshRequestIds.current.bots) return;
+      setQuotaResourceLoaded('bots', true);
       setBots(
         resp.bots.map((bot) => ({
           id: bot.uuid || '',
@@ -109,13 +142,18 @@ export function SidebarDataProvider({
         })),
       );
     } catch (error) {
+      if (requestId !== refreshRequestIds.current.bots) return;
+      setQuotaResourceLoaded('bots', false);
       console.error('Failed to fetch bots for sidebar:', error);
     }
-  }, []);
+  }, [setQuotaResourceLoaded]);
 
   const refreshPipelines = useCallback(async () => {
+    const requestId = ++refreshRequestIds.current.pipelines;
     try {
       const resp = await httpClient.getPipelines();
+      if (requestId !== refreshRequestIds.current.pipelines) return;
+      setQuotaResourceLoaded('pipelines', true);
       setPipelines(
         resp.pipelines.map((p) => ({
           id: p.uuid || '',
@@ -126,13 +164,18 @@ export function SidebarDataProvider({
         })),
       );
     } catch (error) {
+      if (requestId !== refreshRequestIds.current.pipelines) return;
+      setQuotaResourceLoaded('pipelines', false);
       console.error('Failed to fetch pipelines for sidebar:', error);
     }
-  }, []);
+  }, [setQuotaResourceLoaded]);
 
   const refreshKnowledgeBases = useCallback(async () => {
+    const requestId = ++refreshRequestIds.current.knowledgeBases;
     try {
       const resp = await httpClient.getKnowledgeBases();
+      if (requestId !== refreshRequestIds.current.knowledgeBases) return;
+      setQuotaResourceLoaded('knowledgeBases', true);
       setKnowledgeBases(
         resp.bases.map((kb) => ({
           id: kb.uuid || '',
@@ -143,11 +186,14 @@ export function SidebarDataProvider({
         })),
       );
     } catch (error) {
+      if (requestId !== refreshRequestIds.current.knowledgeBases) return;
+      setQuotaResourceLoaded('knowledgeBases', false);
       console.error('Failed to fetch knowledge bases for sidebar:', error);
     }
-  }, []);
+  }, [setQuotaResourceLoaded]);
 
   const refreshPlugins = useCallback(async () => {
+    const requestId = ++refreshRequestIds.current.plugins;
     try {
       const [pluginsResp, marketplaceResp] = await Promise.all([
         httpClient.getPlugins(),
@@ -155,6 +201,9 @@ export function SidebarDataProvider({
           .getMarketplacePlugins(1, 100)
           .catch(() => ({ plugins: [] })),
       ]);
+      if (requestId !== refreshRequestIds.current.plugins) return;
+      setQuotaResourceLoaded('plugins', true);
+      setPluginCount(pluginsResp.plugins?.length ?? 0);
 
       // Build marketplace version lookup: "author/name" -> latest_version
       const marketplaceVersions = new Map<string, string>();
@@ -241,13 +290,18 @@ export function SidebarDataProvider({
       }
       setPluginPages(pages);
     } catch (error) {
+      if (requestId !== refreshRequestIds.current.plugins) return;
+      setQuotaResourceLoaded('plugins', false);
       console.error('Failed to fetch plugins for sidebar:', error);
     }
-  }, []);
+  }, [setQuotaResourceLoaded]);
 
   const refreshMCPServers = useCallback(async () => {
+    const requestId = ++refreshRequestIds.current.mcpServers;
     try {
       const resp = await httpClient.getMCPServers();
+      if (requestId !== refreshRequestIds.current.mcpServers) return;
+      setQuotaResourceLoaded('mcpServers', true);
       setMCPServers(
         resp.servers.map((server) => ({
           id: server.name, // Keep __ for API calls
@@ -257,13 +311,18 @@ export function SidebarDataProvider({
         })),
       );
     } catch (error) {
+      if (requestId !== refreshRequestIds.current.mcpServers) return;
+      setQuotaResourceLoaded('mcpServers', false);
       console.error('Failed to fetch MCP servers for sidebar:', error);
     }
-  }, []);
+  }, [setQuotaResourceLoaded]);
 
   const refreshSkills = useCallback(async () => {
+    const requestId = ++refreshRequestIds.current.skills;
     try {
       const resp = await httpClient.getSkills();
+      if (requestId !== refreshRequestIds.current.skills) return;
+      setQuotaResourceLoaded('skills', true);
       setSkills(
         resp.skills.map((skill) => ({
           id: skill.name,
@@ -273,11 +332,22 @@ export function SidebarDataProvider({
         })),
       );
     } catch (error) {
+      if (requestId !== refreshRequestIds.current.skills) return;
+      setQuotaResourceLoaded('skills', false);
       console.error('Failed to fetch skills for sidebar:', error);
     }
-  }, []);
+  }, [setQuotaResourceLoaded]);
 
   const refreshAll = useCallback(async () => {
+    quotaResourceLoaded.current = {
+      bots: false,
+      pipelines: false,
+      knowledgeBases: false,
+      plugins: false,
+      mcpServers: false,
+      skills: false,
+    };
+    setQuotaDataLoaded(false);
     await Promise.all([
       refreshBots(),
       refreshPipelines(),
@@ -307,9 +377,11 @@ export function SidebarDataProvider({
         pipelines,
         knowledgeBases,
         plugins,
+        pluginCount,
         mcpServers,
         skills,
         pluginPages,
+        quotaDataLoaded,
         refreshBots,
         refreshPipelines,
         refreshKnowledgeBases,

web/src/app/home/components/models-dialog/ModelsPanel.tsx

@@ -1,7 +1,7 @@
 import { useState, useEffect } from 'react';
 import { Plus, Boxes } from 'lucide-react';
 import { httpClient, systemInfo } from '@/app/infra/http/HttpClient';
-import { ModelProvider, ReasoningConfig } from '@/app/infra/entities/api';
+import { ModelProvider } from '@/app/infra/entities/api';
 import {
   Dialog,
   DialogContent,
@@ -15,7 +15,6 @@ import ProviderForm from './component/provider-form/ProviderForm';
 import { ProviderCard } from './components';
 import {
   ExtraArg,
-  DEFAULT_REASONING_CONFIG,
   ModelType,
   ScanModelsResult,
   SelectedScannedModel,
@@ -286,7 +285,6 @@ export default function ModelsPanel({
     name: string,
     abilities: string[],
     extraArgs: ExtraArg[],
-    reasoningConfig: ReasoningConfig,
     contextLength?: number | null,
   ) {
     if (!name.trim()) {
@@ -302,7 +300,6 @@ export default function ModelsPanel({
           name,
           provider_uuid: providerUuid,
           abilities,
-          reasoning_config: reasoningConfig,
           context_length: parseContextLength(
             contextLength,
             t('models.contextLengthInvalid'),
@@ -364,7 +361,6 @@ export default function ModelsPanel({
             name: item.model.name,
             provider_uuid: providerUuid,
             abilities: item.abilities,
-            reasoning_config: DEFAULT_REASONING_CONFIG,
             context_length: item.model.context_length ?? null,
             extra_args: {},
           } as never);
@@ -402,7 +398,6 @@ export default function ModelsPanel({
     name: string,
     abilities: string[],
     extraArgs: ExtraArg[],
-    reasoningConfig: ReasoningConfig,
     contextLength?: number | null,
   ) {
     if (!name.trim()) {
@@ -418,7 +413,6 @@ export default function ModelsPanel({
           name,
           provider_uuid: providerUuid,
           abilities,
-          reasoning_config: reasoningConfig,
           context_length: parseContextLength(
             contextLength,
             t('models.contextLengthInvalid'),
@@ -475,7 +469,6 @@ export default function ModelsPanel({
     modelType: ModelType,
     abilities: string[],
     extraArgs: ExtraArg[],
-    reasoningConfig: ReasoningConfig,
   ) {
     setIsTesting(true);
     setTestResult(null);
@@ -498,7 +491,6 @@ export default function ModelsPanel({
           provider_uuid: '',
           provider: providerData,
           abilities,
-          reasoning_config: reasoningConfig,
           extra_args: extraArgsObj,
         } as never);
       } else if (modelType === 'embedding') {
@@ -562,21 +554,13 @@ export default function ModelsPanel({
         onSpaceLogin={handleSpaceLogin}
         onOpenAddModel={() => setAddModelPopoverOpen(provider.uuid)}
         onCloseAddModel={() => setAddModelPopoverOpen(null)}
-        onAddModel={(
-          modelType,
-          name,
-          abilities,
-          extraArgs,
-          reasoningConfig,
-          contextLength,
-        ) =>
+        onAddModel={(modelType, name, abilities, extraArgs, contextLength) =>
           handleAddModel(
             provider.uuid,
             modelType,
             name,
             abilities,
             extraArgs,
-            reasoningConfig,
             contextLength,
           )
         }
@@ -592,7 +576,6 @@ export default function ModelsPanel({
           name,
           abilities,
           extraArgs,
-          reasoningConfig,
           contextLength,
         ) =>
           handleUpdateModel(
@@ -602,7 +585,6 @@ export default function ModelsPanel({
             name,
             abilities,
             extraArgs,
-            reasoningConfig,
             contextLength,
           )
         }
@@ -611,15 +593,8 @@ export default function ModelsPanel({
         onDeleteModel={(modelId, modelType) =>
           handleDeleteModel(provider.uuid, modelId, modelType)
         }
-        onTestModel={(name, modelType, abilities, extraArgs, reasoningConfig) =>
-          handleTestModel(
-            provider.uuid,
-            name,
-            modelType,
-            abilities,
-            extraArgs,
-            reasoningConfig,
-          )
+        onTestModel={(name, modelType, abilities, extraArgs) =>
+          handleTestModel(provider.uuid, name, modelType, abilities, extraArgs)
         }
         isSubmitting={isSubmitting}
         isTesting={isTesting}

web/src/app/home/components/models-dialog/components/AddModelPopover.tsx

@@ -6,7 +6,6 @@ import {
   ArrowUpDown,
   Eye,
   Wrench,
-  BrainCircuit,
   Check,
   RefreshCw,
 } from 'lucide-react';
@@ -21,12 +20,8 @@ import {
 } from '@/components/ui/popover';
 import { Tabs, TabsList, TabsTrigger } from '@/components/ui/tabs';
 import { useTranslation } from 'react-i18next';
+import { ScannedProviderModel } from '@/app/infra/entities/api';
 import {
-  ReasoningConfig,
-  ScannedProviderModel,
-} from '@/app/infra/entities/api';
-import {
-  DEFAULT_REASONING_CONFIG,
   ExtraArg,
   ModelType,
   ScanModelsResult,
@@ -47,7 +42,6 @@ interface AddModelPopoverProps {
     name: string,
     abilities: string[],
     extraArgs: ExtraArg[],
-    reasoningConfig: ReasoningConfig,
     contextLength?: number | null,
   ) => Promise<void>;
   onScanModels: (modelType?: ModelType) => Promise<ScanModelsResult>;
@@ -60,7 +54,6 @@ interface AddModelPopoverProps {
     modelType: ModelType,
     abilities: string[],
     extraArgs: ExtraArg[],
-    reasoningConfig: ReasoningConfig,
   ) => Promise<void>;
   isSubmitting: boolean;
   isTesting: boolean;
@@ -150,24 +143,11 @@ export default function AddModelPopover({
       tab === 'llm' && contextLength.trim()
         ? Number(contextLength.trim())
         : null;
-    await onAddModel(
-      tab,
-      name,
-      abilities,
-      extraArgs,
-      DEFAULT_REASONING_CONFIG,
-      parsedContextLength,
-    );
+    await onAddModel(tab, name, abilities, extraArgs, parsedContextLength);
   };
 
   const handleTest = async () => {
-    await onTestModel(
-      name,
-      tab,
-      tab === 'llm' ? abilities : [],
-      extraArgs,
-      DEFAULT_REASONING_CONFIG,
-    );
+    await onTestModel(name, tab, tab === 'llm' ? abilities : [], extraArgs);
   };
 
   const handleScan = async () => {
@@ -342,7 +322,7 @@ export default function AddModelPopover({
                   {tab === 'llm' && (
                     <div className="space-y-2">
                       <Label>{t('models.abilities')}</Label>
-                      <div className="flex flex-wrap gap-4">
+                      <div className="flex gap-4">
                         <div className="flex items-center gap-2">
                           <Checkbox
                             id="add-vision"
@@ -369,19 +349,6 @@ export default function AddModelPopover({
                             {t('models.functionCallAbility')}
                           </Label>
                         </div>
-                        <div className="flex items-center gap-2">
-                          <Checkbox
-                            id="add-reasoning"
-                            checked={abilities.includes('reasoning')}
-                            onCheckedChange={(checked) =>
-                              toggleAbility('reasoning', checked as boolean)
-                            }
-                          />
-                          <Label htmlFor="add-reasoning" className="text-sm">
-                            <BrainCircuit className="h-3 w-3 inline mr-1" />
-                            {t('models.reasoningAbility')}
-                          </Label>
-                        </div>
                       </div>
                     </div>
                   )}

web/src/app/home/components/models-dialog/components/ModelItem.tsx

@@ -1,5 +1,5 @@
 import { useState, useEffect } from 'react';
-import { Trash2, Eye, Wrench, Check, BrainCircuit } from 'lucide-react';
+import { Trash2, Eye, Wrench, Check } from 'lucide-react';
 import { Button } from '@/components/ui/button';
 import { Input } from '@/components/ui/input';
 import { Label } from '@/components/ui/label';
@@ -11,17 +11,8 @@ import {
   PopoverTrigger,
 } from '@/components/ui/popover';
 import { useTranslation } from 'react-i18next';
-import {
-  LLMModel,
-  EmbeddingModel,
-  ReasoningConfig,
-} from '@/app/infra/entities/api';
-import {
-  DEFAULT_REASONING_CONFIG,
-  ExtraArg,
-  ModelType,
-  TestResult,
-} from '../types';
+import { LLMModel, EmbeddingModel } from '@/app/infra/entities/api';
+import { ExtraArg, ModelType, TestResult } from '../types';
 import ExtraArgsEditor from './ExtraArgsEditor';
 import { userInfo } from '@/app/infra/http';
 
@@ -41,14 +32,12 @@ interface ModelItemProps {
     name: string,
     abilities: string[],
     extraArgs: ExtraArg[],
-    reasoningConfig: ReasoningConfig,
     contextLength?: number | null,
   ) => Promise<void>;
   onTestModel: (
     name: string,
     abilities: string[],
     extraArgs: ExtraArg[],
-    reasoningConfig: ReasoningConfig,
   ) => Promise<void>;
   isSubmitting: boolean;
   isTesting: boolean;
@@ -114,6 +103,7 @@ export default function ModelItem({
   const [editExtraArgs, setEditExtraArgs] = useState<ExtraArg[]>(
     convertExtraArgsToArray(model.extra_args),
   );
+
   const isEditOpen = editModelPopoverOpen === model.uuid;
   const isDeleteOpen = deleteConfirmOpen === model.uuid;
 
@@ -143,20 +133,12 @@ export default function ModelItem({
       editName,
       editAbilities,
       editExtraArgs,
-      modelType === 'llm'
-        ? (model as LLMModel).reasoning_config || DEFAULT_REASONING_CONFIG
-        : DEFAULT_REASONING_CONFIG,
       parsedContextLength,
     );
   };
 
   const handleTest = async () => {
-    await onTestModel(
-      editName,
-      editAbilities,
-      editExtraArgs,
-      DEFAULT_REASONING_CONFIG,
-    );
+    await onTestModel(editName, editAbilities, editExtraArgs);
   };
 
   const toggleAbility = (ability: string, checked: boolean) => {
@@ -167,12 +149,6 @@ export default function ModelItem({
     }
   };
 
-  const supportsReasoning =
-    modelType === 'llm' &&
-    ((model as LLMModel).reasoning_capabilities?.supported === true ||
-      (model as LLMModel).abilities?.includes('reasoning'));
-  const canSaveModel = !isLangBotModels;
-
   // Check if popover should be disabled (space models when not logged in)
   const isPopoverDisabled =
     !canManage || (isLangBotModels && userInfo?.account_type !== 'space');
@@ -218,12 +194,6 @@ export default function ModelItem({
                   <Wrench className="h-3 w-3" />
                 </Badge>
               )}
-            {supportsReasoning && (
-              <Badge variant="outline" className="text-xs gap-1">
-                <BrainCircuit className="h-3 w-3" />
-                {t('models.reasoningAbility')}
-              </Badge>
-            )}
           </div>
           {canManage && !isLangBotModels && (
             <Popover
@@ -300,7 +270,7 @@ export default function ModelItem({
           {modelType === 'llm' && (
             <div className="space-y-2">
               <Label>{t('models.abilities')}</Label>
-              <div className="flex flex-wrap gap-4">
+              <div className="flex gap-4">
                 <div className="flex items-center gap-2">
                   <Checkbox
                     id={`edit-vision-${model.uuid}`}
@@ -335,23 +305,6 @@ export default function ModelItem({
                     {t('models.functionCallAbility')}
                   </Label>
                 </div>
-                <div className="flex items-center gap-2">
-                  <Checkbox
-                    id={`edit-reasoning-${model.uuid}`}
-                    checked={editAbilities.includes('reasoning')}
-                    disabled={isLangBotModels}
-                    onCheckedChange={(checked) =>
-                      toggleAbility('reasoning', checked as boolean)
-                    }
-                  />
-                  <Label
-                    htmlFor={`edit-reasoning-${model.uuid}`}
-                    className="text-sm"
-                  >
-                    <BrainCircuit className="h-3 w-3 inline mr-1" />
-                    {t('models.reasoningAbility')}
-                  </Label>
-                </div>
               </div>
             </div>
           )}
@@ -383,7 +336,7 @@ export default function ModelItem({
           />
 
           <div className="flex gap-2">
-            {canSaveModel && (
+            {!isLangBotModels && (
               <Button
                 className="flex-1"
                 size="sm"
@@ -394,7 +347,7 @@ export default function ModelItem({
               </Button>
             )}
             <Button
-              className={canSaveModel ? 'flex-1' : 'w-full'}
+              className={isLangBotModels ? 'w-full' : 'flex-1'}
               size="sm"
               variant="outline"
               onClick={handleTest}

web/src/app/home/components/models-dialog/components/ProviderCard.tsx

@@ -9,7 +9,7 @@ import {
   Radar,
 } from 'lucide-react';
 import { httpClient, systemInfo } from '@/app/infra/http/HttpClient';
-import { ModelProvider, ReasoningConfig } from '@/app/infra/entities/api';
+import { ModelProvider } from '@/app/infra/entities/api';
 import { Button } from '@/components/ui/button';
 import {
   Collapsible,
@@ -63,7 +63,6 @@ interface ProviderCardProps {
     name: string,
     abilities: string[],
     extraArgs: ExtraArg[],
-    reasoningConfig: ReasoningConfig,
     contextLength?: number | null,
   ) => Promise<void>;
   onScanModels: (modelType?: ModelType) => Promise<ScanModelsResult>;
@@ -79,7 +78,6 @@ interface ProviderCardProps {
     name: string,
     abilities: string[],
     extraArgs: ExtraArg[],
-    reasoningConfig: ReasoningConfig,
     contextLength?: number | null,
   ) => Promise<void>;
   onOpenDeleteConfirm: (modelId: string) => void;
@@ -90,7 +88,6 @@ interface ProviderCardProps {
     modelType: ModelType,
     abilities: string[],
     extraArgs: ExtraArg[],
-    reasoningConfig: ReasoningConfig,
   ) => Promise<void>;
   isSubmitting: boolean;
   isTesting: boolean;
@@ -221,20 +218,22 @@ export default function ProviderCard({
                   <span>
                     {(spaceCredits / 5000).toFixed(2)} {t('models.credits')}
                   </span>
-                  <Button
-                    variant="ghost"
-                    size="icon"
-                    className="h-5 w-5"
-                    onClick={(e) => {
-                      e.stopPropagation();
-                      window.open(
-                        `${systemInfo.cloud_service_url}/profile?tab=billing`,
-                        '_blank',
-                      );
-                    }}
-                  >
-                    <Plus className="h-3 w-3" />
-                  </Button>
+                  {isWorkspaceOwner && (
+                    <Button
+                      variant="ghost"
+                      size="icon"
+                      className="h-5 w-5"
+                      onClick={(e) => {
+                        e.stopPropagation();
+                        window.open(
+                          `${systemInfo.cloud_service_url}/profile?tab=billing`,
+                          '_blank',
+                        );
+                      }}
+                    >
+                      <Plus className="h-3 w-3" />
+                    </Button>
+                  )}
                 </div>
               )}
               {isLangBotModels && !isWorkspaceOwner && ownerSpaceBound && (
@@ -433,7 +432,6 @@ export default function ProviderCard({
                       name,
                       abilities,
                       extraArgs,
-                      reasoningConfig,
                       contextLength,
                     ) =>
                       onUpdateModel(
@@ -442,23 +440,11 @@ export default function ProviderCard({
                         name,
                         abilities,
                         extraArgs,
-                        reasoningConfig,
                         contextLength,
                       )
                     }
-                    onTestModel={(
-                      name,
-                      abilities,
-                      extraArgs,
-                      reasoningConfig,
-                    ) =>
-                      onTestModel(
-                        name,
-                        'llm',
-                        abilities,
-                        extraArgs,
-                        reasoningConfig,
-                      )
+                    onTestModel={(name, abilities, extraArgs) =>
+                      onTestModel(name, 'llm', abilities, extraArgs)
                     }
                     isSubmitting={isSubmitting}
                     isTesting={isTesting}
@@ -480,34 +466,17 @@ export default function ProviderCard({
                     onOpenDeleteConfirm={onOpenDeleteConfirm}
                     onCloseDeleteConfirm={onCloseDeleteConfirm}
                     onDeleteModel={() => onDeleteModel(model.uuid, 'embedding')}
-                    onUpdateModel={(
-                      name,
-                      abilities,
-                      extraArgs,
-                      reasoningConfig,
-                    ) =>
+                    onUpdateModel={(name, abilities, extraArgs) =>
                       onUpdateModel(
                         model.uuid,
                         'embedding',
                         name,
                         abilities,
                         extraArgs,
-                        reasoningConfig,
                       )
                     }
-                    onTestModel={(
-                      name,
-                      abilities,
-                      extraArgs,
-                      reasoningConfig,
-                    ) =>
-                      onTestModel(
-                        name,
-                        'embedding',
-                        abilities,
-                        extraArgs,
-                        reasoningConfig,
-                      )
+                    onTestModel={(name, abilities, extraArgs) =>
+                      onTestModel(name, 'embedding', abilities, extraArgs)
                     }
                     isSubmitting={isSubmitting}
                     isTesting={isTesting}
@@ -529,34 +498,17 @@ export default function ProviderCard({
                     onOpenDeleteConfirm={onOpenDeleteConfirm}
                     onCloseDeleteConfirm={onCloseDeleteConfirm}
                     onDeleteModel={() => onDeleteModel(model.uuid, 'rerank')}
-                    onUpdateModel={(
-                      name,
-                      abilities,
-                      extraArgs,
-                      reasoningConfig,
-                    ) =>
+                    onUpdateModel={(name, abilities, extraArgs) =>
                       onUpdateModel(
                         model.uuid,
                         'rerank',
                         name,
                         abilities,
                         extraArgs,
-                        reasoningConfig,
                       )
                     }
-                    onTestModel={(
-                      name,
-                      abilities,
-                      extraArgs,
-                      reasoningConfig,
-                    ) =>
-                      onTestModel(
-                        name,
-                        'rerank',
-                        abilities,
-                        extraArgs,
-                        reasoningConfig,
-                      )
+                    onTestModel={(name, abilities, extraArgs) =>
+                      onTestModel(name, 'rerank', abilities, extraArgs)
                     }
                     isSubmitting={isSubmitting}
                     isTesting={isTesting}

web/src/app/home/components/models-dialog/types.ts

@@ -5,7 +5,6 @@ import {
   ModelProvider,
   ProviderScanDebugInfo,
   ScannedProviderModel,
-  ReasoningConfig,
 } from '@/app/infra/entities/api';
 
 export type ExtraArg = {
@@ -17,10 +16,6 @@ export type ExtraArg = {
 
 export type ModelType = 'llm' | 'embedding' | 'rerank';
 
-export const DEFAULT_REASONING_CONFIG: ReasoningConfig = {
-  level: 'provider_default',
-};
-
 export interface ProviderModels {
   llm: LLMModel[];
   embedding: EmbeddingModel[];
@@ -58,14 +53,12 @@ export interface ModelItemProps {
     name: string,
     abilities: string[],
     extraArgs: ExtraArg[],
-    reasoningConfig: ReasoningConfig,
     contextLength?: number | null,
   ) => Promise<void>;
   onTest: (
     name: string,
     abilities: string[],
     extraArgs: ExtraArg[],
-    reasoningConfig: ReasoningConfig,
   ) => Promise<void>;
   isSubmitting: boolean;
   isTesting: boolean;
@@ -97,7 +90,6 @@ export interface ProviderCardProps {
     name: string,
     abilities: string[],
     extraArgs: ExtraArg[],
-    reasoningConfig: ReasoningConfig,
     contextLength?: number | null,
   ) => Promise<void>;
   onScanModels: (modelType?: ModelType) => Promise<ScanModelsResult>;
@@ -113,7 +105,6 @@ export interface ProviderCardProps {
     name: string,
     abilities: string[],
     extraArgs: ExtraArg[],
-    reasoningConfig: ReasoningConfig,
     contextLength?: number | null,
   ) => Promise<void>;
   onOpenDeleteConfirm: (modelId: string) => void;
@@ -124,7 +115,6 @@ export interface ProviderCardProps {
     modelType: ModelType,
     abilities: string[],
     extraArgs: ExtraArg[],
-    reasoningConfig: ReasoningConfig,
   ) => Promise<void>;
   isSubmitting: boolean;
   isTesting: boolean;

web/src/app/home/components/reasoning/ReasoningLevelPicker.tsx

@@ -1,97 +0,0 @@
-import { BrainCircuit, ChevronDown, ChevronRight } from 'lucide-react';
-import { useTranslation } from 'react-i18next';
-import { ReasoningLevel } from '@/app/infra/entities/api';
-import { Button } from '@/components/ui/button';
-import {
-  Popover,
-  PopoverContent,
-  PopoverTrigger,
-} from '@/components/ui/popover';
-import { Slider } from '@/components/ui/slider';
-
-export const REASONING_LEVELS: ReasoningLevel[] = [
-  'provider_default',
-  'disabled',
-  'enabled',
-  'minimal',
-  'low',
-  'medium',
-  'high',
-  'xhigh',
-  'max',
-];
-
-export const REASONING_LEVEL_LABEL_KEYS: Record<ReasoningLevel, string> = {
-  provider_default: 'models.reasoningLevels.providerDefault',
-  disabled: 'models.reasoningLevels.disabled',
-  enabled: 'models.reasoningLevels.enabled',
-  minimal: 'models.reasoningLevels.minimal',
-  low: 'models.reasoningLevels.low',
-  medium: 'models.reasoningLevels.medium',
-  high: 'models.reasoningLevels.high',
-  xhigh: 'models.reasoningLevels.xhigh',
-  max: 'models.reasoningLevels.max',
-};
-
-interface ReasoningLevelPickerProps {
-  value: ReasoningLevel;
-  levels: ReasoningLevel[];
-  disabled?: boolean;
-  onChange: (value: ReasoningLevel) => void;
-}
-
-export default function ReasoningLevelPicker({
-  value,
-  levels,
-  disabled = false,
-  onChange,
-}: ReasoningLevelPickerProps) {
-  const { t } = useTranslation();
-  const safeLevels: ReasoningLevel[] =
-    levels.length > 0 ? levels : ['provider_default'];
-  const safeValue: ReasoningLevel = safeLevels.includes(value)
-    ? value
-    : safeLevels[0];
-  const currentLabel = t(REASONING_LEVEL_LABEL_KEYS[safeValue]);
-  const isExplicit = safeValue !== 'provider_default';
-  const currentIndex = Math.max(0, safeLevels.indexOf(safeValue));
-
-  return (
-    <Popover>
-      <PopoverTrigger asChild>
-        <Button
-          type="button"
-          variant="outline"
-          size="sm"
-          disabled={disabled || safeLevels.length <= 1}
-          aria-label={`${t('models.reasoningLevel')}: ${currentLabel}`}
-          className="h-9 w-9 shrink-0 gap-1.5 px-2.5 text-xs font-normal sm:w-auto sm:max-w-36"
-        >
-          <BrainCircuit
-            className={`size-4 shrink-0 ${isExplicit ? 'text-primary' : 'text-muted-foreground'}`}
-          />
-          <span className="hidden min-w-0 truncate sm:block">
-            {currentLabel}
-          </span>
-          <ChevronDown className="hidden size-3.5 shrink-0 text-muted-foreground sm:block" />
-        </Button>
-      </PopoverTrigger>
-      <PopoverContent align="end" className="w-[272px] p-4">
-        <div className="flex h-5 items-center gap-0.5 text-sm text-muted-foreground">
-          <span>{currentLabel}</span>
-          <ChevronRight className="size-3.5" />
-        </div>
-        <Slider
-          className="mt-5"
-          min={0}
-          max={Math.max(0, safeLevels.length - 1)}
-          step={1}
-          value={[currentIndex]}
-          aria-label={t('models.reasoningLevel')}
-          aria-valuetext={currentLabel}
-          onValueChange={([index]) => onChange(safeLevels[index])}
-        />
-      </PopoverContent>
-    </Popover>
-  );
-}

web/src/app/home/components/settings-dialog/SettingsDialog.tsx

@@ -133,12 +133,14 @@ export default function SettingsDialog({
   const permissions = currentWorkspace?.permissions ?? [];
   const canManageApiKeys = permissions.includes('api_key.manage');
   const canViewAudit = permissions.includes('audit.view');
+  const canViewStorageAnalysis =
+    currentWorkspace?.workspace.source !== 'cloud_projection' && canViewAudit;
   const navItems = allNavItems.filter((item) => {
     if (item.id === 'apiIntegration') {
       return canManageApiKeys;
     }
     if (item.id === 'storageAnalysis') {
-      return canViewAudit;
+      return canViewStorageAnalysis;
     }
     return true;
   });
@@ -146,11 +148,17 @@ export default function SettingsDialog({
   useEffect(() => {
     const forbiddenSection =
       (section === 'apiIntegration' && !canManageApiKeys) ||
-      (section === 'storageAnalysis' && !canViewAudit);
+      (section === 'storageAnalysis' && !canViewStorageAnalysis);
     if (open && forbiddenSection) {
       onSectionChange('workspace');
     }
-  }, [canManageApiKeys, canViewAudit, open, section, onSectionChange]);
+  }, [
+    canManageApiKeys,
+    canViewStorageAnalysis,
+    open,
+    section,
+    onSectionChange,
+  ]);
 
   const activeItem = navItems.find((item) => item.id === section);
   const activeLabel = activeItem?.title ?? t('settingsDialog.title');
@@ -256,7 +264,7 @@ export default function SettingsDialog({
                   active={open && section === 'apiIntegration'}
                 />
               )}
-              {section === 'storageAnalysis' && (
+              {section === 'storageAnalysis' && canViewStorageAnalysis && (
                 <StorageAnalysisPanel
                   active={open && section === 'storageAnalysis'}
                 />

web/src/app/home/components/workspace-quota/WorkspaceQuotaTooltip.tsx

@@ -0,0 +1,47 @@
+import type { ReactNode } from 'react';
+import { useTranslation } from 'react-i18next';
+import {
+  Tooltip,
+  TooltipContent,
+  TooltipTrigger,
+} from '@/components/ui/tooltip';
+import type { WorkspaceQuotaItem } from './useWorkspaceQuotaStatus';
+
+export function WorkspaceQuotaTooltip({
+  quota,
+  resource,
+  children,
+  side = 'top',
+}: {
+  quota: WorkspaceQuotaItem;
+  resource: string;
+  children: ReactNode;
+  side?: 'top' | 'right' | 'bottom' | 'left';
+}) {
+  const { t } = useTranslation();
+  if (!quota.disabled) return children;
+  const message = quota.loading
+    ? t('limitation.quotaLoadingTooltip')
+    : t('limitation.createDisabledTooltip', {
+        resource,
+        max: quota.max,
+      });
+
+  return (
+    <Tooltip>
+      <TooltipTrigger asChild>
+        <span
+          tabIndex={0}
+          aria-disabled="true"
+          aria-label={message}
+          className="inline-flex cursor-not-allowed rounded-sm focus-visible:outline-none focus-visible:ring-[3px] focus-visible:ring-ring/50"
+        >
+          {children}
+        </span>
+      </TooltipTrigger>
+      <TooltipContent side={side} className="max-w-72 text-left">
+        {message}
+      </TooltipContent>
+    </Tooltip>
+  );
+}

web/src/app/home/components/workspace-quota/useWorkspaceQuotaStatus.ts

@@ -0,0 +1,82 @@
+import { systemInfo } from '@/app/infra/http/HttpClient';
+import { useSidebarData } from '@/app/home/components/home-sidebar/SidebarDataContext';
+
+export interface WorkspaceQuotaItem {
+  count: number;
+  max: number;
+  reached: boolean;
+  loading: boolean;
+  disabled: boolean;
+}
+
+export interface WorkspaceQuotaStatus {
+  bots: WorkspaceQuotaItem;
+  pipelines: WorkspaceQuotaItem;
+  knowledgeBases: WorkspaceQuotaItem;
+  extensions: WorkspaceQuotaItem;
+  botsReached: boolean;
+  pipelinesReached: boolean;
+  knowledgeBasesReached: boolean;
+  extensionsReached: boolean;
+}
+
+function quotaItem(
+  count: number,
+  max: number | undefined,
+  loaded: boolean,
+): WorkspaceQuotaItem {
+  const normalizedMax = typeof max === 'number' ? max : -1;
+  const reached = loaded && normalizedMax >= 0 && count >= normalizedMax;
+  return {
+    count,
+    max: normalizedMax,
+    reached,
+    loading: !loaded,
+    disabled: !loaded || reached,
+  };
+}
+
+export function useWorkspaceQuotaStatus(): WorkspaceQuotaStatus {
+  const {
+    bots,
+    pipelines,
+    knowledgeBases,
+    pluginCount,
+    mcpServers,
+    skills,
+    quotaDataLoaded,
+  } = useSidebarData();
+  const limitation = systemInfo.limitation;
+
+  const botQuota = quotaItem(
+    bots.length,
+    limitation?.max_bots,
+    quotaDataLoaded,
+  );
+  const pipelineQuota = quotaItem(
+    pipelines.length,
+    limitation?.max_pipelines,
+    quotaDataLoaded,
+  );
+  const knowledgeBaseQuota = quotaItem(
+    knowledgeBases.length,
+    limitation?.max_knowledge_bases,
+    quotaDataLoaded,
+  );
+  const extensionQuota = quotaItem(
+    pluginCount + mcpServers.length + skills.length,
+    limitation?.max_extensions,
+    quotaDataLoaded,
+  );
+
+  return {
+    bots: botQuota,
+    pipelines: pipelineQuota,
+    knowledgeBases: knowledgeBaseQuota,
+    extensions: extensionQuota,
+    botsReached: botQuota.disabled,
+    pipelinesReached: pipelineQuota.disabled,
+    knowledgeBasesReached: knowledgeBaseQuota.disabled,
+    extensionsReached: extensionQuota.disabled,
+  };
+}

web/src/app/home/components/workspace-settings/WorkspaceSettingsPanel.tsx

@@ -79,7 +79,6 @@ export default function WorkspaceSettingsPanel({
   const canInvite = permissions.has('member.invite');
   const canUpdateMembers = permissions.has('member.update_role');
   const canRemoveMembers = permissions.has('member.remove');
-  const canTransferOwner = permissions.has('owner.transfer');
   const cloudPortalURL = workspaceInfo
     ? `${systemInfo.cloud_service_url.replace(/\/$/, '')}/cloud?workspace=${encodeURIComponent(workspaceInfo.workspace.uuid)}&step=plan`
     : '';
@@ -342,11 +341,6 @@ export default function WorkspaceSettingsPanel({
                                 {t(`workspace.roles.${role}`)}
                               </SelectItem>
                             ))}
-                            {canTransferOwner && (
-                              <SelectItem value="owner">
-                                {t('workspace.transferOwnership')}
-                              </SelectItem>
-                            )}
                           </SelectContent>
                         </Select>
                       )}

web/src/app/home/plugin-pages/page.tsx

@@ -4,6 +4,7 @@ import { useEffect, useRef, useState, useCallback } from 'react';
 import { useSidebarData } from '@/app/home/components/home-sidebar/SidebarDataContext';
 import { useTranslation } from 'react-i18next';
 import { useTheme } from '@/components/providers/theme-provider';
+import { useAuthenticatedPluginAsset } from '@/hooks/useAuthenticatedPluginResource';
 
 /**
  * Plugin page that renders a plugin-provided HTML page in an iframe.
@@ -80,11 +81,15 @@ function PluginPageIframe({
   pageId: string;
 }) {
   const iframeRef = useRef<HTMLIFrameElement>(null);
-  const [loading, setLoading] = useState(true);
+  const [loadedAssetUrl, setLoadedAssetUrl] = useState('');
   const { resolvedTheme } = useTheme();
-  const { i18n } = useTranslation();
-
-  const assetUrl = httpClient.getPluginAssetURL(author, pluginName, pagePath);
+  const { t, i18n } = useTranslation();
+  const { url: assetUrl, error: assetError } = useAuthenticatedPluginAsset(
+    author,
+    pluginName,
+    pagePath,
+  );
+  const loading = !assetUrl || loadedAssetUrl !== assetUrl;
 
   // Send context (theme + language) to iframe
   // Use '*' as targetOrigin because sandboxed iframe has opaque (null) origin
@@ -170,23 +175,29 @@ function PluginPageIframe({
 
   return (
     <div className="flex flex-col h-full w-full">
-      {loading && (
+      {assetError ? (
+        <div className="flex items-center justify-center h-full text-muted-foreground">
+          {t('plugins.loadFailed')}
+        </div>
+      ) : loading || !assetUrl ? (
         <div className="flex items-center justify-center h-full text-muted-foreground">
           Loading...
         </div>
+      ) : null}
+      {!assetError && assetUrl && (
+        <iframe
+          ref={iframeRef}
+          src={assetUrl}
+          className="flex-1 w-full border-0 rounded-md"
+          style={{ display: loading ? 'none' : 'block' }}
+          onLoad={() => {
+            setLoadedAssetUrl(assetUrl);
+            sendContext();
+          }}
+          sandbox="allow-scripts allow-forms"
+          title={`${author}/${pluginName} - ${pagePath}`}
+        />
       )}
-      <iframe
-        ref={iframeRef}
-        src={assetUrl}
-        className="flex-1 w-full border-0 rounded-md"
-        style={{ display: loading ? 'none' : 'block' }}
-        onLoad={() => {
-          setLoading(false);
-          sendContext();
-        }}
-        sandbox="allow-scripts allow-forms"
-        title={`${author}/${pluginName} - ${pagePath}`}
-      />
     </div>
   );
 }

web/src/app/home/plugins/components/PluginLocalPreviewPanel.tsx

@@ -7,6 +7,8 @@ import { httpClient } from '@/app/infra/http/HttpClient';
 import { extractI18nObject } from '@/i18n/I18nProvider';
 import { usePluginInstallTasks } from '@/app/home/plugins/components/plugin-install-task';
 import PluginComponentList from '@/app/home/plugins/components/plugin-installed/PluginComponentList';
+import { WorkspaceQuotaTooltip } from '@/app/home/components/workspace-quota/WorkspaceQuotaTooltip';
+import type { WorkspaceQuotaItem } from '@/app/home/components/workspace-quota/useWorkspaceQuotaStatus';
 
 type PluginLocalPreview = Awaited<
   ReturnType<typeof httpClient.previewPluginInstallFromLocal>
@@ -16,6 +18,8 @@ interface PluginLocalPreviewPanelProps {
   file: File;
   onInstallStarted?: () => void;
   onCancel?: () => void;
+  quota?: WorkspaceQuotaItem;
+  quotaResource?: string;
 }
 
 function formatFileSize(bytes: number): string {
@@ -30,6 +34,8 @@ export default function PluginLocalPreviewPanel({
   file,
   onInstallStarted,
   onCancel,
+  quota,
+  quotaResource = '',
 }: PluginLocalPreviewPanelProps) {
   const { t } = useTranslation();
   const { addTask, setSelectedTaskId } = usePluginInstallTasks();
@@ -63,6 +69,7 @@ export default function PluginLocalPreviewPanel({
   }, [loadPreview]);
 
   async function handleInstall() {
+    if (quota?.disabled) return;
     setInstalling(true);
     setErrorMessage(null);
     try {
@@ -190,13 +197,27 @@ export default function PluginLocalPreviewPanel({
             {t('common.cancel')}
           </Button>
         )}
-        <Button
-          type="button"
-          onClick={handleInstall}
-          disabled={!preview || previewing || installing}
-        >
-          {installing ? t('plugins.installing') : t('plugins.confirmInstall')}
-        </Button>
+        {quota ? (
+          <WorkspaceQuotaTooltip quota={quota} resource={quotaResource}>
+            <Button
+              type="button"
+              onClick={handleInstall}
+              disabled={quota.disabled || !preview || previewing || installing}
+            >
+              {installing
+                ? t('plugins.installing')
+                : t('plugins.confirmInstall')}
+            </Button>
+          </WorkspaceQuotaTooltip>
+        ) : (
+          <Button
+            type="button"
+            onClick={handleInstall}
+            disabled={!preview || previewing || installing}
+          >
+            {installing ? t('plugins.installing') : t('plugins.confirmInstall')}
+          </Button>
+        )}
       </div>
     </div>
   );

web/src/app/home/plugins/components/plugin-market/PluginMarketComponent.tsx

@@ -80,9 +80,13 @@ function loadMarketFilters(): MarketFilters {
 function MarketPageContent({
   installPlugin,
   headerActions,
+  installDisabled,
+  installDisabledTooltip,
 }: {
   installPlugin: (plugin: PluginV4) => void;
   headerActions?: React.ReactNode;
+  installDisabled?: boolean;
+  installDisabledTooltip?: string;
 }) {
   const { t } = useTranslation();
   const [searchParams] = useSearchParams();
@@ -847,6 +851,8 @@ function MarketPageContent({
               lists={recommendationLists}
               tagNames={tagNames}
               onInstall={handleInstallPlugin}
+              installDisabled={installDisabled}
+              installDisabledTooltip={installDisabledTooltip}
             />
           )}
 
@@ -876,6 +882,8 @@ function MarketPageContent({
                   cardVO={plugin}
                   onInstall={handleInstallPlugin}
                   tagNames={tagNames}
+                  installDisabled={installDisabled}
+                  installDisabledTooltip={installDisabledTooltip}
                 />
               ))}
             </div>
@@ -915,9 +923,13 @@ function MarketPageContent({
 export default function MarketPage({
   installPlugin,
   headerActions,
+  installDisabled,
+  installDisabledTooltip,
 }: {
   installPlugin: (plugin: PluginV4) => void;
   headerActions?: React.ReactNode;
+  installDisabled?: boolean;
+  installDisabledTooltip?: string;
 }) {
   return (
     <Suspense
@@ -932,6 +944,8 @@ export default function MarketPage({
       <MarketPageContent
         installPlugin={installPlugin}
         headerActions={headerActions}
+        installDisabled={installDisabled}
+        installDisabledTooltip={installDisabledTooltip}
       />
     </Suspense>
   );

web/src/app/home/plugins/components/plugin-market/RecommendationLists.tsx

@@ -54,11 +54,15 @@ function RecommendationListRow({
   list,
   tagNames,
   onInstall,
+  installDisabled,
+  installDisabledTooltip,
   isLast,
 }: {
   list: RecommendationList;
   tagNames: Record<string, string>;
   onInstall: (cardVO: PluginMarketCardVO) => void;
+  installDisabled?: boolean;
+  installDisabledTooltip?: string;
   isLast: boolean;
 }) {
   const { t } = useTranslation();
@@ -263,6 +267,8 @@ function RecommendationListRow({
             cardVO={pluginToVO(plugin, t)}
             tagNames={tagNames}
             onInstall={onInstall}
+            installDisabled={installDisabled}
+            installDisabledTooltip={installDisabledTooltip}
           />
         ))}
       </div>
@@ -277,10 +283,14 @@ export function RecommendationLists({
   lists,
   tagNames,
   onInstall,
+  installDisabled,
+  installDisabledTooltip,
 }: {
   lists: RecommendationList[];
   tagNames: Record<string, string>;
   onInstall: (cardVO: PluginMarketCardVO) => void;
+  installDisabled?: boolean;
+  installDisabledTooltip?: string;
 }) {
   if (!lists || lists.length === 0) return null;
 
@@ -292,6 +302,8 @@ export function RecommendationLists({
           list={list}
           tagNames={tagNames}
           onInstall={onInstall}
+          installDisabled={installDisabled}
+          installDisabledTooltip={installDisabledTooltip}
           isLast={index === lists.length - 1}
         />
       ))}

web/src/app/home/plugins/components/plugin-market/plugin-market-card/PluginMarketCardComponent.tsx

@@ -23,10 +23,14 @@ export default function PluginMarketCardComponent({
   cardVO,
   onInstall,
   tagNames = {},
+  installDisabled = false,
+  installDisabledTooltip,
 }: {
   cardVO: PluginMarketCardVO;
   onInstall?: (cardVO: PluginMarketCardVO) => void;
   tagNames?: Record<string, string>;
+  installDisabled?: boolean;
+  installDisabledTooltip?: string;
 }) {
   const { t } = useTranslation();
   const bottomRef = useRef<HTMLDivElement>(null);
@@ -127,6 +131,7 @@ export default function PluginMarketCardComponent({
 
   const remainingTags = cardVO.tags ? cardVO.tags.length - visibleTags : 0;
   const handleInstallClick = () => {
+    if (installDisabled) return;
     onInstall?.(cardVO);
   };
 
@@ -153,12 +158,17 @@ export default function PluginMarketCardComponent({
     }
   };
 
-  return (
+  const cardContent = (
     <div
-      role="button"
+      role={installDisabled ? 'group' : 'button'}
       tabIndex={0}
+      aria-disabled={installDisabled}
       aria-label={t('market.installCard', { name: cardVO.label })}
-      className="w-[100%] h-[10rem] cursor-pointer bg-white rounded-[10px] border border-border shadow-[0px_1px_2px_0_rgba(0,0,0,0.06)] p-3 sm:p-[1rem] hover:shadow-[0px_2px_5px_0_rgba(0,0,0,0.08)] transition-shadow duration-200 outline-none focus-visible:ring-[3px] focus-visible:ring-ring/50 dark:bg-[#1f1f22] dark:shadow-[0px_1px_2px_0_rgba(255,255,255,0.04)] dark:hover:shadow-[0px_2px_5px_0_rgba(255,255,255,0.07)] relative"
+      className={`w-[100%] h-[10rem] bg-white rounded-[10px] border border-border shadow-[0px_1px_2px_0_rgba(0,0,0,0.06)] p-3 sm:p-[1rem] transition-shadow duration-200 outline-none dark:bg-[#1f1f22] dark:shadow-[0px_1px_2px_0_rgba(255,255,255,0.04)] relative ${
+        installDisabled
+          ? 'cursor-not-allowed opacity-60'
+          : 'cursor-pointer hover:shadow-[0px_2px_5px_0_rgba(0,0,0,0.08)] focus-visible:ring-[3px] focus-visible:ring-ring/50 dark:hover:shadow-[0px_2px_5px_0_rgba(255,255,255,0.07)]'
+      }`}
       onClick={handleInstallClick}
       onKeyDown={(event) => {
         if (
@@ -382,4 +392,17 @@ export default function PluginMarketCardComponent({
       </div>
     </div>
   );
+
+  if (!installDisabled || !installDisabledTooltip) return cardContent;
+
+  return (
+    <TooltipProvider delayDuration={200}>
+      <Tooltip>
+        <TooltipTrigger asChild>{cardContent}</TooltipTrigger>
+        <TooltipContent side="top" className="max-w-72 text-left">
+          {installDisabledTooltip}
+        </TooltipContent>
+      </Tooltip>
+    </TooltipProvider>
+  );
 }

web/src/app/home/skills/components/SkillZipPreviewPanel.tsx

@@ -7,6 +7,8 @@ import { Checkbox } from '@/components/ui/checkbox';
 import { httpClient } from '@/app/infra/http/HttpClient';
 import type { Skill } from '@/app/infra/entities/api';
 import { cn } from '@/lib/utils';
+import { WorkspaceQuotaTooltip } from '@/app/home/components/workspace-quota/WorkspaceQuotaTooltip';
+import type { WorkspaceQuotaItem } from '@/app/home/components/workspace-quota/useWorkspaceQuotaStatus';
 
 interface PreviewSkill extends Skill {
   source_path?: string;
@@ -16,6 +18,8 @@ interface SkillZipPreviewPanelProps {
   file: File;
   onImported: (skillNames: string[]) => void;
   onCancel?: () => void;
+  quota?: WorkspaceQuotaItem;
+  quotaResource?: string;
 }
 
 function formatFileSize(bytes: number): string {
@@ -45,6 +49,8 @@ export default function SkillZipPreviewPanel({
   file,
   onImported,
   onCancel,
+  quota,
+  quotaResource = '',
 }: SkillZipPreviewPanelProps) {
   const { t } = useTranslation();
   const [previewSkills, setPreviewSkills] = useState<PreviewSkill[]>([]);
@@ -117,6 +123,7 @@ export default function SkillZipPreviewPanel({
   }
 
   async function handleInstall() {
+    if (quota?.disabled) return;
     if (selectedPaths.length === 0) return;
 
     setInstalling(true);
@@ -249,28 +256,56 @@ export default function SkillZipPreviewPanel({
             {t('common.cancel')}
           </Button>
         )}
-        <Button
-          type="button"
-          onClick={handleInstall}
-          disabled={
-            previewing ||
-            installing ||
-            previewSkills.length === 0 ||
-            selectedPaths.length === 0
-          }
-        >
-          {installing ? (
-            <>
-              <Loader2 className="size-4 animate-spin" />
-              {t('skills.installing')}
-            </>
-          ) : (
-            <>
-              <PackageOpen className="size-4" />
-              {t('skills.confirmInstall')}
-            </>
-          )}
-        </Button>
+        {quota ? (
+          <WorkspaceQuotaTooltip quota={quota} resource={quotaResource}>
+            <Button
+              type="button"
+              onClick={handleInstall}
+              disabled={
+                quota.disabled ||
+                previewing ||
+                installing ||
+                previewSkills.length === 0 ||
+                selectedPaths.length === 0
+              }
+            >
+              {installing ? (
+                <>
+                  <Loader2 className="size-4 animate-spin" />
+                  {t('skills.installing')}
+                </>
+              ) : (
+                <>
+                  <PackageOpen className="size-4" />
+                  {t('skills.confirmInstall')}
+                </>
+              )}
+            </Button>
+          </WorkspaceQuotaTooltip>
+        ) : (
+          <Button
+            type="button"
+            onClick={handleInstall}
+            disabled={
+              previewing ||
+              installing ||
+              previewSkills.length === 0 ||
+              selectedPaths.length === 0
+            }
+          >
+            {installing ? (
+              <>
+                <Loader2 className="size-4 animate-spin" />
+                {t('skills.installing')}
+              </>
+            ) : (
+              <>
+                <PackageOpen className="size-4" />
+                {t('skills.confirmInstall')}
+              </>
+            )}
+          </Button>
+        )}
       </div>
     </div>
   );

web/src/app/infra/entities/api/index.ts

@@ -99,32 +99,9 @@ export interface LLMModel {
   provider?: ModelProvider;
   abilities?: string[];
   context_length?: number | null;
-  reasoning_config?: ReasoningConfig;
-  reasoning_capabilities?: ReasoningCapabilities;
   extra_args?: object;
 }
 
-export type ReasoningLevel =
-  | 'provider_default'
-  | 'disabled'
-  | 'enabled'
-  | 'minimal'
-  | 'low'
-  | 'medium'
-  | 'high'
-  | 'xhigh'
-  | 'max';
-
-export interface ReasoningConfig {
-  level: ReasoningLevel;
-}
-
-export interface ReasoningCapabilities {
-  supported: boolean;
-  levels: ReasoningLevel[];
-  source: 'litellm' | 'provider' | 'manual' | 'unknown';
-}
-
 export interface ApiRespProviderEmbeddingModels {
   models: EmbeddingModel[];
 }
@@ -351,6 +328,7 @@ export interface SystemLimitation {
   max_bots: number;
   max_pipelines: number;
   max_extensions: number;
+  max_knowledge_bases?: number;
   /** When non-empty, every pipeline is forced to this Box sandbox-scope
    *  template (e.g. ``{global}``) and the per-pipeline "Sandbox Scope"
    *  selector is locked. Used by SaaS deployments. Empty = no restriction. */

web/src/app/infra/http/BackendClient.ts

@@ -1179,6 +1179,7 @@ export class BackendClient extends BaseHttpClient {
 
   public getAccountInfo(): Promise<{
     initialized: boolean;
+    authenticated_invitation_acceptance_enabled?: boolean;
     password_login_enabled?: boolean;
     space_login_enabled?: boolean;
   }> {

web/src/app/invitations/accept/page.tsx

@@ -93,6 +93,10 @@ export default function AcceptInvitationPage() {
   const [confirmPassword, setConfirmPassword] = useState('');
   const [passwordRegistrationEnabled, setPasswordRegistrationEnabled] =
     useState(false);
+  const [
+    authenticatedInvitationAcceptanceEnabled,
+    setAuthenticatedInvitationAcceptanceEnabled,
+  ] = useState(false);
 
   useEffect(() => {
     const handleHashChange = () => setInvitationHash(window.location.hash);
@@ -113,6 +117,9 @@ export default function AcceptInvitationPage() {
       .getAccountInfo()
       .then((info) => {
         setPasswordRegistrationEnabled(info.password_login_enabled !== false);
+        setAuthenticatedInvitationAcceptanceEnabled(
+          info.authenticated_invitation_acceptance_enabled === true,
+        );
       })
       .catch(() => setPasswordRegistrationEnabled(false));
     if (!invitationToken) {
@@ -304,7 +311,18 @@ export default function AcceptInvitationPage() {
                 </div>
               )}
 
-              {hasLoginToken ? (
+              {hasLoginToken && authenticatedInvitationAcceptanceEnabled ? (
+                <Button
+                  className="w-full"
+                  disabled={status === 'submitting'}
+                  onClick={() => void finishAcceptance()}
+                >
+                  {status === 'submitting' ? (
+                    <Loader2 className="mr-2 size-4 animate-spin" />
+                  ) : null}
+                  {t('workspace.acceptInvitation')}
+                </Button>
+              ) : hasLoginToken ? (
                 <div className="space-y-3">
                   <div className="rounded-lg border border-amber-300 bg-amber-50 p-3 text-sm text-amber-900 dark:bg-amber-950/30 dark:text-amber-100">
                     {t('workspace.authenticatedInvitationNotice')}

web/src/components/ui/slider.tsx

@@ -1,36 +0,0 @@
-import * as React from 'react';
-import * as SliderPrimitive from '@radix-ui/react-slider';
-
-import { cn } from '@/lib/utils';
-
-const Slider = React.forwardRef<
-  React.ComponentRef<typeof SliderPrimitive.Root>,
-  React.ComponentPropsWithoutRef<typeof SliderPrimitive.Root>
->(({ className, ...props }, ref) => (
-  <SliderPrimitive.Root
-    ref={ref}
-    data-slot="slider"
-    className={cn(
-      'relative flex w-full touch-none select-none items-center data-[disabled]:opacity-50',
-      className,
-    )}
-    {...props}
-  >
-    <SliderPrimitive.Track
-      data-slot="slider-track"
-      className="relative h-1.5 w-full grow overflow-hidden rounded-full bg-primary/20"
-    >
-      <SliderPrimitive.Range
-        data-slot="slider-range"
-        className="absolute h-full bg-primary"
-      />
-    </SliderPrimitive.Track>
-    <SliderPrimitive.Thumb
-      data-slot="slider-thumb"
-      className="block size-4 shrink-0 rounded-full border border-primary/50 bg-background shadow transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:pointer-events-none disabled:opacity-50"
-    />
-  </SliderPrimitive.Root>
-));
-Slider.displayName = SliderPrimitive.Root.displayName;
-
-export { Slider };

web/src/components/ui/tooltip.tsx

@@ -119,7 +119,7 @@ function TooltipContent({
         data-slot="tooltip-content"
         sideOffset={sideOffset}
         className={cn(
-          'bg-primary text-primary-foreground animate-in fade-in-0 zoom-in-95 data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=closed]:zoom-out-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 z-50 w-fit origin-(--radix-tooltip-content-transform-origin) rounded-md px-3 py-1.5 text-xs text-balance',
+          'bg-primary text-primary-foreground animate-in fade-in-0 zoom-in-95 data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=closed]:zoom-out-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 z-50 w-fit origin-(--radix-tooltip-content-transform-origin) rounded-md px-3 py-1.5 text-xs',
           className,
         )}
         {...props}

web/src/hooks/useAuthenticatedPluginResource.ts

@@ -1,41 +1,63 @@
 import { useEffect, useState } from 'react';
 import { httpClient } from '@/app/infra/http/HttpClient';
+import { useCurrentWorkspace } from '@/app/infra/http';
+
+type AuthenticatedResourceState = {
+  key: string;
+  url: string;
+  error: boolean;
+};
+
+const EMPTY_RESOURCE: AuthenticatedResourceState = {
+  key: '',
+  url: '',
+  error: false,
+};
 
 export function useAuthenticatedPluginIcon(
   author: string,
   name: string,
   enabled = true,
 ): { url: string; error: boolean } {
-  const [url, setURL] = useState('');
-  const [error, setError] = useState(false);
+  const [resource, setResource] =
+    useState<AuthenticatedResourceState>(EMPTY_RESOURCE);
+  const currentWorkspace = useCurrentWorkspace();
+  const workspaceUuid = currentWorkspace?.workspace.uuid;
+  const resourceKey = `${workspaceUuid ?? ''}:${author}/${name}`;
 
   useEffect(() => {
     if (!enabled) {
-      setURL('');
-      setError(false);
+      setResource({ key: resourceKey, url: '', error: false });
       return;
     }
     let active = true;
     let objectURL = '';
-    setURL('');
-    setError(false);
+    setResource({ key: resourceKey, url: '', error: false });
     httpClient
       .getAuthenticatedPluginIconURL(author, name)
       .then((nextURL) => {
         objectURL = nextURL;
-        if (active) setURL(nextURL);
-        else URL.revokeObjectURL(nextURL);
+        if (active) {
+          setResource({ key: resourceKey, url: nextURL, error: false });
+        } else {
+          URL.revokeObjectURL(nextURL);
+        }
       })
       .catch(() => {
-        if (active) setError(true);
+        if (active) {
+          setResource({ key: resourceKey, url: '', error: true });
+        }
       });
     return () => {
       active = false;
       if (objectURL) URL.revokeObjectURL(objectURL);
     };
-  }, [author, enabled, name]);
+  }, [author, enabled, name, resourceKey]);
 
-  return { url, error };
+  return {
+    url: resource.key === resourceKey ? resource.url : '',
+    error: resource.key === resourceKey && resource.error,
+  };
 }
 
 export function useAuthenticatedPluginAsset(
@@ -43,29 +65,39 @@ export function useAuthenticatedPluginAsset(
   name: string,
   filepath: string,
 ): { url: string; error: boolean } {
-  const [url, setURL] = useState('');
-  const [error, setError] = useState(false);
+  const [resource, setResource] =
+    useState<AuthenticatedResourceState>(EMPTY_RESOURCE);
+  const currentWorkspace = useCurrentWorkspace();
+  const workspaceUuid = currentWorkspace?.workspace.uuid;
+  const resourceKey = `${workspaceUuid ?? ''}:${author}/${name}/${filepath}`;
 
   useEffect(() => {
     let active = true;
     let objectURL = '';
-    setURL('');
-    setError(false);
+    setResource({ key: resourceKey, url: '', error: false });
     httpClient
       .getAuthenticatedPluginAssetURL(author, name, filepath)
       .then((nextURL) => {
         objectURL = nextURL;
-        if (active) setURL(nextURL);
-        else URL.revokeObjectURL(nextURL);
+        if (active) {
+          setResource({ key: resourceKey, url: nextURL, error: false });
+        } else {
+          URL.revokeObjectURL(nextURL);
+        }
       })
       .catch(() => {
-        if (active) setError(true);
+        if (active) {
+          setResource({ key: resourceKey, url: '', error: true });
+        }
       });
     return () => {
       active = false;
       if (objectURL) URL.revokeObjectURL(objectURL);
     };
-  }, [author, name, filepath]);
+  }, [author, name, filepath, resourceKey]);
 
-  return { url, error };
+  return {
+    url: resource.key === resourceKey ? resource.url : '',
+    error: resource.key === resourceKey && resource.error,
+  };
 }

web/src/i18n/locales/en-US.ts

@@ -214,19 +214,6 @@ const enUS = {
     selectModelAbilities: 'Select model abilities',
     visionAbility: 'Vision Ability',
     functionCallAbility: 'Function Call',
-    reasoningAbility: 'Reasoning',
-    reasoningLevel: 'Reasoning level',
-    reasoningLevels: {
-      providerDefault: 'Provider default',
-      disabled: 'Off',
-      enabled: 'On',
-      minimal: 'Minimal',
-      low: 'Low',
-      medium: 'Medium',
-      high: 'High',
-      xhigh: 'Extra high',
-      max: 'Maximum',
-    },
     contextLength: 'Context Window',
     contextLengthPlaceholder: 'Unknown',
     contextLengthInvalid: 'Context window must be a positive integer',
@@ -1691,6 +1678,12 @@ const enUS = {
       'Maximum number of pipelines ({{max}}) reached. Please remove an existing pipeline before creating a new one.',
     maxExtensionsReached:
       'Maximum number of extensions ({{max}}) reached. Please remove an existing extension before adding a new one.',
+    quotaLoadingTooltip:
+      'Workspace usage is still loading. Please wait before creating a resource.',
+    quotaCheckFailed:
+      'Unable to verify the current workspace quota. Please try again.',
+    createDisabledTooltip:
+      'The {{resource}} limit ({{max}}) for this workspace has been reached. Delete one existing item before creating another.',
   },
   skills: {
     title: 'Skills',

web/src/i18n/locales/es-ES.ts

@@ -1634,6 +1634,12 @@ const esES = {
       'Se ha alcanzado el número máximo de Pipelines ({{max}}). Por favor, elimina un Pipeline existente antes de crear uno nuevo.',
     maxExtensionsReached:
       'Se ha alcanzado el número máximo de extensiones ({{max}}). Por favor, elimina un servidor MCP o plugin existente antes de añadir uno nuevo.',
+    quotaLoadingTooltip:
+      'El uso del espacio de trabajo aún se está cargando. Espera antes de crear un recurso.',
+    quotaCheckFailed:
+      'No se pudo verificar la cuota actual del espacio de trabajo. Inténtalo de nuevo.',
+    createDisabledTooltip:
+      'Se alcanzó el límite de {{resource}} ({{max}}) de este espacio de trabajo. Elimina uno existente antes de crear otro.',
   },
   wizard: {
     sidebarDescription: 'Crea un Bot con pasos guiados',

web/src/i18n/locales/ja-JP.ts

@@ -217,19 +217,6 @@ const jaJP = {
     selectModelAbilities: 'モデル機能を選択',
     visionAbility: '視覚機能',
     functionCallAbility: '関数呼び出し',
-    reasoningAbility: '推論',
-    reasoningLevel: '推論レベル',
-    reasoningLevels: {
-      providerDefault: 'Provider デフォルト',
-      disabled: 'オフ',
-      enabled: 'オン',
-      minimal: '最小',
-      low: '低',
-      medium: '中',
-      high: '高',
-      xhigh: '最高',
-      max: '最大',
-    },
     contextLength: 'コンテキストウィンドウ',
     contextLengthPlaceholder: '不明',
     contextLengthInvalid:
@@ -1698,6 +1685,12 @@ const jaJP = {
       'パイプライン数が上限（{{max}}個）に達しました。新しいパイプラインを作成するには、既存のパイプラインを削除してください。',
     maxExtensionsReached:
       '拡張機能数が上限（{{max}}個）に達しました。新しい MCP サーバーやプラグインを追加するには、既存のものを削除してください。',
+    quotaLoadingTooltip:
+      'ワークスペースの使用状況を読み込んでいます。リソースを作成する前にお待ちください。',
+    quotaCheckFailed:
+      '現在のワークスペース上限を確認できません。もう一度お試しください。',
+    createDisabledTooltip:
+      'このワークスペースの{{resource}}数が上限（{{max}}個）に達しました。新しく作成する前に既存の{{resource}}を削除してください。',
   },
   wizard: {
     sidebarDescription: 'ガイド付きステップでボットを作成',

web/src/i18n/locales/ru-RU.ts

@@ -1609,6 +1609,12 @@ const ruRU = {
       'Достигнуто максимальное количество конвейеров ({{max}}). Удалите существующий конвейер перед созданием нового.',
     maxExtensionsReached:
       'Достигнуто максимальное количество расширений ({{max}}). Удалите существующий MCP-сервер или плагин перед добавлением нового.',
+    quotaLoadingTooltip:
+      'Данные об использовании рабочего пространства загружаются. Подождите перед созданием ресурса.',
+    quotaCheckFailed:
+      'Не удалось проверить текущую квоту рабочего пространства. Повторите попытку.',
+    createDisabledTooltip:
+      'Достигнут лимит {{resource}} ({{max}}) для этого рабочего пространства. Удалите существующий ресурс перед созданием нового.',
   },
   wizard: {
     sidebarDescription: 'Создать бота с пошаговым руководством',

web/src/i18n/locales/th-TH.ts

@@ -1576,6 +1576,12 @@ const thTH = {
       'จำนวน Pipeline สูงสุด ({{max}}) ถึงขีดจำกัดแล้ว กรุณาลบ Pipeline ที่มีอยู่ก่อนสร้างใหม่',
     maxExtensionsReached:
       'จำนวนส่วนขยายสูงสุด ({{max}}) ถึงขีดจำกัดแล้ว กรุณาลบเซิร์ฟเวอร์ MCP หรือปลั๊กอินที่มีอยู่ก่อนเพิ่มใหม่',
+    quotaLoadingTooltip:
+      'กำลังโหลดการใช้งานพื้นที่ทำงาน โปรดรอก่อนสร้างทรัพยากร',
+    quotaCheckFailed:
+      'ไม่สามารถตรวจสอบโควตาปัจจุบันของพื้นที่ทำงานได้ โปรดลองอีกครั้ง',
+    createDisabledTooltip:
+      'ถึงขีดจำกัด {{resource}} ({{max}}) ของเวิร์กสเปซนี้แล้ว โปรดลบรายการเดิมก่อนสร้างรายการใหม่',
   },
   wizard: {
     sidebarDescription: 'สร้าง Bot ด้วยขั้นตอนที่แนะนำ',

web/src/i18n/locales/vi-VN.ts

@@ -1602,6 +1602,12 @@ const viVN = {
       'Đã đạt số lượng Pipeline tối đa ({{max}}). Vui lòng xóa một Pipeline hiện có trước khi tạo mới.',
     maxExtensionsReached:
       'Đã đạt số lượng tiện ích mở rộng tối đa ({{max}}). Vui lòng xóa một máy chủ MCP hoặc plugin hiện có trước khi thêm mới.',
+    quotaLoadingTooltip:
+      'Dữ liệu sử dụng không gian làm việc đang tải. Vui lòng chờ trước khi tạo tài nguyên.',
+    quotaCheckFailed:
+      'Không thể kiểm tra hạn mức hiện tại của không gian làm việc. Vui lòng thử lại.',
+    createDisabledTooltip:
+      'Đã đạt giới hạn {{resource}} ({{max}}) của workspace này. Hãy xóa một mục hiện có trước khi tạo mới.',
   },
   wizard: {
     sidebarDescription: 'Tạo Bot với các bước hướng dẫn',

web/src/i18n/locales/zh-Hans.ts

@@ -204,19 +204,6 @@ const zhHans = {
     selectModelAbilities: '选择模型能力',
     visionAbility: '视觉能力',
     functionCallAbility: '函数调用',
-    reasoningAbility: '思考能力',
-    reasoningLevel: '思考档位',
-    reasoningLevels: {
-      providerDefault: 'Provider 默认',
-      disabled: '关闭',
-      enabled: '开启',
-      minimal: '最低',
-      low: '低',
-      medium: '中',
-      high: '高',
-      xhigh: '极高',
-      max: '最大',
-    },
     contextLength: '上下文窗口',
     contextLengthPlaceholder: '未知',
     contextLengthInvalid: '上下文窗口必须是正整数',
@@ -1619,6 +1606,10 @@ const zhHans = {
       '已达到流水线数量上限（{{max}}个）。请先删除已有流水线后再创建新的。',
     maxExtensionsReached:
       '已达到扩展数量上限（{{max}}个）。请先删除已有扩展后再添加新的。',
+    quotaLoadingTooltip: '正在加载工作空间用量，请稍后再创建资源。',
+    quotaCheckFailed: '无法确认当前工作空间额度，请重试。',
+    createDisabledTooltip:
+      '当前工作区的{{resource}}数量已达到上限（{{max}}个）。请先删除一个已有{{resource}}后再创建。',
   },
   skills: {
     title: '技能',

web/src/i18n/locales/zh-Hant.ts

@@ -1531,6 +1531,10 @@ const zhHant = {
       '已達到流水線數量上限（{{max}}個）。請先刪除已有流水線後再建立新的。',
     maxExtensionsReached:
       '已達到擴充功能數量上限（{{max}}個）。請先刪除已有擴充功能後再新增。',
+    quotaLoadingTooltip: '正在載入工作空間用量，請稍後再建立資源。',
+    quotaCheckFailed: '無法確認目前工作空間額度，請重試。',
+    createDisabledTooltip:
+      '目前工作區的{{resource}}數量已達上限（{{max}}個）。請先刪除一個現有{{resource}}後再建立。',
   },
   wizard: {
     sidebarDescription: '透過引導步驟建立機器人',

web/tests/e2e/cloud-storage-privacy.spec.ts

@@ -0,0 +1,63 @@
+import { expect, test } from '@playwright/test';
+import {
+  installLangBotApiMocks,
+  makeWorkspaceEntry,
+} from './fixtures/langbot-api';
+
+function wrapped(data: unknown) {
+  return JSON.stringify({
+    code: 0,
+    message: 'ok',
+    data,
+    timestamp: Date.now(),
+  });
+}
+
+test('Cloud never exposes or requests storage analysis', async ({ page }) => {
+  const workspace = makeWorkspaceEntry(
+    'workspace-cloud',
+    'Cloud Workspace',
+    'cloud_projection',
+  );
+  await installLangBotApiMocks(page, {
+    authenticated: true,
+    workspaces: [workspace],
+  });
+  await page.route(
+    /\/api\/v1\/workspaces\/workspace-cloud\/(members|invitations)$/,
+    async (route) => {
+      const collection = route.request().url().endsWith('/members')
+        ? 'members'
+        : 'invitations';
+      await route.fulfill({
+        status: 200,
+        contentType: 'application/json',
+        body: wrapped({ [collection]: [] }),
+      });
+    },
+  );
+
+  let storageAnalysisRequests = 0;
+  await page.route('**/api/v1/system/storage-analysis', async (route) => {
+    storageAnalysisRequests += 1;
+    await route.fulfill({
+      status: 200,
+      contentType: 'application/json',
+      body: wrapped({}),
+    });
+  });
+
+  await page.goto('/home/bots');
+  await page.getByRole('button', { name: /admin@example\.com/i }).click();
+  await expect(page.getByText('Storage Analysis', { exact: true })).toHaveCount(
+    0,
+  );
+
+  await page.goto('/home/bots?action=showStorageAnalysis');
+  await expect(page.getByRole('dialog')).toBeVisible();
+  await expect(page.getByRole('heading', { name: 'Workspace' })).toBeVisible();
+  await expect(page.getByText('Storage Analysis', { exact: true })).toHaveCount(
+    0,
+  );
+  expect(storageAnalysisRequests).toBe(0);
+});

web/tests/e2e/fixtures/langbot-api.ts

@@ -169,7 +169,6 @@ export function makeWorkspaceEntry(
       'member.remove',
       'member.update_role',
       'member.view',
-      'owner.transfer',
       'provider_secret.manage',
       'resource.manage',
       'resource.view',

web/tests/e2e/invitations.spec.ts

@@ -165,3 +165,164 @@ test('an authenticated OSS invitation requires logout before registration', asyn
     invitation: 'logout-invitation',
   });
 });
+
+test('an authenticated Cloud Account can accept its invitation directly', async ({
+  page,
+}) => {
+  await installLangBotApiMocks(page, {
+    authenticated: true,
+    storage: {
+      token: 'invited-account-token',
+      userEmail: 'invited@example.com',
+    },
+  });
+  await page.route('**/api/v1/user/account-info', async (route) => {
+    await route.fulfill({
+      status: 200,
+      contentType: 'application/json',
+      body: JSON.stringify({
+        code: 0,
+        data: {
+          initialized: true,
+          authenticated_invitation_acceptance_enabled: true,
+          password_login_enabled: false,
+          space_login_enabled: true,
+        },
+        msg: 'ok',
+      }),
+    });
+  });
+  await page.route('**/api/v1/invitations/inspect', async (route) => {
+    await route.fulfill({
+      status: 200,
+      contentType: 'application/json',
+      body: JSON.stringify({
+        code: 0,
+        data: {
+          invitation: {
+            uuid: 'cloud-invitation',
+            workspace_uuid: 'workspace-playwright',
+            normalized_email: 'invited@example.com',
+            role: 'viewer',
+            status: 'pending',
+          },
+          workspace: {
+            uuid: 'workspace-playwright',
+            name: 'Playwright Workspace',
+          },
+        },
+        msg: 'ok',
+      }),
+    });
+  });
+
+  let acceptanceAuthorization = '';
+  await page.route('**/api/v1/invitations/accept', async (route) => {
+    acceptanceAuthorization = route.request().headers().authorization ?? '';
+    await route.fulfill({
+      status: 200,
+      contentType: 'application/json',
+      body: JSON.stringify({
+        code: 0,
+        data: {
+          token: 'accepted-cloud-account-token',
+          workspace_uuid: 'workspace-playwright',
+        },
+        msg: 'ok',
+      }),
+    });
+  });
+
+  await page.goto('/invitations/accept#token=cloud-invitation');
+
+  await expect(
+    page.getByRole('button', { name: 'Accept Invitation' }),
+  ).toBeVisible();
+  await page.getByRole('button', { name: 'Accept Invitation' }).click();
+  await expect(page).toHaveURL(/\/home(?:\/monitoring)?$/);
+  expect(acceptanceAuthorization).toBe('Bearer invited-account-token');
+});
+
+test('Space OAuth accepts a pending invitation with the freshly authenticated account', async ({
+  page,
+}) => {
+  await installLangBotApiMocks(page, {
+    authenticated: false,
+    storage: {
+      token: 'stale-other-account-token',
+      userEmail: 'other@example.com',
+    },
+  });
+  await page.addInitScript(() => {
+    sessionStorage.setItem(
+      'langbot_pending_invitation_token',
+      'matching-invitation',
+    );
+  });
+
+  await page.route('**/api/v1/user/space/callback', async (route) => {
+    await route.fulfill({
+      status: 200,
+      contentType: 'application/json',
+      body: JSON.stringify({
+        code: 0,
+        data: {
+          token: 'fresh-invited-account-token',
+          user: 'invited@example.com',
+        },
+        msg: 'ok',
+      }),
+    });
+  });
+  await page.route('**/api/v1/user/info', async (route) => {
+    await route.fulfill({
+      status: 200,
+      contentType: 'application/json',
+      body: JSON.stringify({
+        code: 0,
+        data: {
+          account_uuid: 'invited-account',
+          user: 'invited@example.com',
+          account_type: 'space',
+          has_password: false,
+        },
+        msg: 'ok',
+      }),
+    });
+  });
+
+  let acceptanceAuthorization = '';
+  await page.route('**/api/v1/invitations/accept', async (route) => {
+    acceptanceAuthorization = route.request().headers().authorization ?? '';
+    await route.fulfill({
+      status: 200,
+      contentType: 'application/json',
+      body: JSON.stringify({
+        code: 0,
+        data: {
+          token: 'accepted-invited-account-token',
+          workspace_uuid: 'workspace-playwright',
+        },
+        msg: 'ok',
+      }),
+    });
+  });
+
+  await page.goto('/auth/space/callback?code=oauth-code&state=oauth-state');
+
+  await expect(page).toHaveURL(/\/home(?:\/monitoring)?$/, {
+    timeout: 5_000,
+  });
+  expect(acceptanceAuthorization).toBe('Bearer fresh-invited-account-token');
+  expect(
+    await page.evaluate(() => ({
+      token: localStorage.getItem('token'),
+      userEmail: localStorage.getItem('userEmail'),
+      invitation: sessionStorage.getItem('langbot_pending_invitation_token'),
+    })),
+  ).toEqual({
+    token: 'accepted-invited-account-token',
+    userEmail: 'invited@example.com',
+    invitation: null,
+  });
+});

web/tests/e2e/plugin-page-auth.spec.ts

@@ -0,0 +1,88 @@
+import { expect, test } from '@playwright/test';
+import {
+  installLangBotApiMocks,
+  makeWorkspaceEntry,
+} from './fixtures/langbot-api';
+
+function wrapped(data: unknown) {
+  return JSON.stringify({
+    code: 0,
+    message: 'ok',
+    data,
+    timestamp: Date.now(),
+  });
+}
+
+test('loads a Cloud plugin page through the authenticated asset route', async ({
+  page,
+}) => {
+  const workspace = makeWorkspaceEntry(
+    'workspace-cloud',
+    'Cloud Workspace',
+    'cloud_projection',
+  );
+  await installLangBotApiMocks(page, {
+    authenticated: true,
+    workspaces: [workspace],
+  });
+
+  await page.route('**/api/v1/plugins', async (route) => {
+    await route.fulfill({
+      status: 200,
+      contentType: 'application/json',
+      body: wrapped({
+        plugins: [
+          {
+            install_source: 'marketplace',
+            install_info: {},
+            debug: false,
+            manifest: {
+              manifest: {
+                metadata: {
+                  author: 'langbot-team',
+                  name: 'LangRAG',
+                  version: '0.1.9',
+                  label: { en_US: 'LangRAG', zh_Hans: 'LangRAG' },
+                },
+                spec: {
+                  pages: [
+                    {
+                      id: 'observability',
+                      path: 'components/pages/observability.html',
+                      label: { en_US: 'Observability', zh_Hans: '观测面板' },
+                    },
+                  ],
+                },
+              },
+            },
+          },
+        ],
+      }),
+    });
+  });
+
+  let authenticatedAssetRequests = 0;
+  await page.route(
+    '**/api/v1/plugins/langbot-team/LangRAG/authenticated-assets/**',
+    async (route) => {
+      authenticatedAssetRequests += 1;
+      await route.fulfill({
+        status: 200,
+        contentType: 'text/html',
+        body: '<!doctype html><html><body><h1>LangRAG Observability</h1></body></html>',
+      });
+    },
+  );
+
+  await page.goto(
+    '/home/plugin-pages?id=langbot-team%2FLangRAG%2Fobservability',
+  );
+
+  await expect(
+    page
+      .frameLocator('iframe')
+      .getByRole('heading', { name: 'LangRAG Observability' }),
+  ).toBeVisible();
+  expect(authenticatedAssetRequests).toBeGreaterThan(0);
+  await expect(page.getByText('Loading...')).toHaveCount(0);
+});

web/tests/e2e/quota-create-actions.spec.ts

@@ -0,0 +1,149 @@
+import { expect, test } from '@playwright/test';
+import { installLangBotApiMocks } from './fixtures/langbot-api';
+
+function wrapped(data: unknown) {
+  return JSON.stringify({
+    code: 0,
+    message: 'ok',
+    data,
+    timestamp: Date.now(),
+  });
+}
+
+async function fulfill(
+  route: Parameters<Parameters<import('@playwright/test').Page['route']>[1]>[0],
+  data: unknown,
+) {
+  await route.fulfill({
+    status: 200,
+    contentType: 'application/json',
+    body: wrapped(data),
+  });
+}
+
+test('quota-reached create actions are disabled and explain the current limit', async ({
+  page,
+}) => {
+  await installLangBotApiMocks(page, { authenticated: true });
+
+  await page.route('**/api/v1/system/info', (route) =>
+    fulfill(route, {
+      debug: false,
+      version: 'quota-e2e',
+      edition: 'community',
+      cloud_service_url: 'https://space.langbot.app',
+      enable_marketplace: true,
+      allow_modify_login_info: true,
+      disable_models_service: false,
+      limitation: {
+        max_bots: 2,
+        max_pipelines: 3,
+        max_extensions: 3,
+        max_knowledge_bases: 2,
+      },
+      outbound_ips: [],
+      wizard_status: 'completed',
+      wizard_progress: null,
+    }),
+  );
+  await page.route('**/api/v1/platform/bots**', (route) =>
+    fulfill(route, {
+      bots: Array.from({ length: 2 }, (_, index) => ({
+        uuid: `bot-${index}`,
+        name: `Bot ${index + 1}`,
+        description: '',
+        adapter: 'aiocqhttp',
+        enable: true,
+        updated_at: new Date().toISOString(),
+      })),
+    }),
+  );
+  await page.route('**/api/v1/pipelines**', (route) =>
+    fulfill(route, {
+      pipelines: Array.from({ length: 3 }, (_, index) => ({
+        uuid: `pipeline-${index}`,
+        name: `Pipeline ${index + 1}`,
+        description: '',
+        emoji: '⚙️',
+        updated_at: new Date().toISOString(),
+      })),
+    }),
+  );
+  await page.route('**/api/v1/knowledge/bases**', (route) =>
+    fulfill(route, {
+      bases: Array.from({ length: 2 }, (_, index) => ({
+        uuid: `kb-${index}`,
+        name: `Knowledge ${index + 1}`,
+        description: '',
+        emoji: '📚',
+        updated_at: new Date().toISOString(),
+      })),
+    }),
+  );
+  await page.route('**/api/v1/plugins**', (route) =>
+    fulfill(route, { plugins: [] }),
+  );
+  await page.route('**/api/v1/mcp/servers**', (route) =>
+    fulfill(route, {
+      servers: Array.from({ length: 3 }, (_, index) => ({
+        name: `mcp-${index}`,
+        mode: 'http',
+        enable: true,
+        runtime_info: { status: 'connected' },
+      })),
+    }),
+  );
+  await page.route('**/api/v1/skills**', (route) =>
+    fulfill(route, { skills: [] }),
+  );
+
+  await page.goto('/home/bots');
+
+  const botCreate = page.getByRole('button', {
+    name: 'Create Bots',
+    exact: true,
+  });
+  const pipelineCreate = page.getByRole('button', {
+    name: 'Create Pipelines',
+    exact: true,
+  });
+  const knowledgeCreate = page.getByRole('button', {
+    name: 'Create Knowledge',
+    exact: true,
+  });
+  const addExtension = page.getByRole('button', {
+    name: 'Add Extension',
+    exact: true,
+  });
+
+  await expect(botCreate).toBeDisabled();
+  await expect(pipelineCreate).toBeDisabled();
+  await expect(knowledgeCreate).toBeDisabled();
+  await expect(addExtension).toBeEnabled();
+
+  const botQuotaTrigger = botCreate.locator('..');
+  await botQuotaTrigger.hover();
+  await expect(
+    page.getByText(
+      'The Bots limit (2) for this workspace has been reached. Delete one existing item before creating another.',
+    ),
+  ).toBeVisible();
+  await botQuotaTrigger.focus();
+  await expect(botQuotaTrigger).toBeFocused();
+  await expect(
+    page.getByText(
+      'The Bots limit (2) for this workspace has been reached. Delete one existing item before creating another.',
+    ),
+  ).toBeVisible();
+
+  await addExtension.click();
+  await expect(page).toHaveURL(/\/home\/add-extension$/);
+  const manualAdd = page.getByRole('button', { name: 'Manual Add' });
+  await expect(manualAdd).toBeDisabled();
+  await manualAdd.locator('..').hover();
+  await expect(
+    page.getByText(
+      'The Extensions limit (3) for this workspace has been reached. Delete one existing item before creating another.',
+    ),
+  ).toBeVisible();
+});

web/tests/unit/dynamic-form-save-values.test.mjs

@@ -34,26 +34,12 @@ test('normalizes only single-line text fields in a dynamic form save snapshot',
     { name: 'multiline', type: 'text', default: '' },
     { name: 'string-list', type: 'array[string]', default: [] },
     { name: 'count', type: 'integer', default: 0 },
-    {
-      name: 'model',
-      type: 'model-fallback-selector',
-      default: { primary: '', fallbacks: [], reasoning: {} },
-    },
   ];
   const values = {
     'single-line': '\t  hello  world \n',
     multiline: '  keep multiline whitespace  \n',
     'string-list': ['  first  ', ' second '],
     count: 3,
-    model: {
-      primary: 'primary-model',
-      fallbacks: ['fallback-model'],
-      reasoning: {
-        'primary-model': 'high',
-        'fallback-model': 'provider_default',
-        'removed-model': 'medium',
-      },
-    },
   };
 
   assert.deepEqual(normalizeDynamicFormValuesForSave(specs, values), {
@@ -61,12 +47,5 @@ test('normalizes only single-line text fields in a dynamic form save snapshot',
     multiline: '  keep multiline whitespace  \n',
     'string-list': ['  first  ', ' second '],
     count: 3,
-    model: {
-      primary: 'primary-model',
-      fallbacks: ['fallback-model'],
-      reasoning: {
-        'primary-model': 'high',
-      },
-    },
   });
 });

web/tests/unit/oss-account-space-billing.test.mjs

@@ -46,4 +46,14 @@ test('provider card represents owner and member owner-bound states explicitly',
   assert.match(source, /ownerSpaceBound/);
   assert.match(source, /models\.ownerMustBindSpace/);
   assert.match(source, /models\.usesOwnerSpaceBilling/);
+  assert.match(source, /isWorkspaceOwner && \(\s*<Button/);
+});
+
+test('workspace member controls never offer ownership transfer', () => {
+  const source = read(
+    'src/app/home/components/workspace-settings/WorkspaceSettingsPanel.tsx',
+  );
+  assert.doesNotMatch(source, /canTransferOwner/);
+  assert.doesNotMatch(source, /workspace\.transferOwnership/);
+  assert.doesNotMatch(source, /<SelectItem value="owner">/);
 });