chore(hooks): Define Hook Point

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jamison Lahman <jamison@lahman.dev>

.github/actions/slack-notify/action.yml

@@ -10,6 +10,9 @@ inputs:
   failed-jobs:
     description: "Deprecated alias for details"
     required: false
+  mention:
+    description: "GitHub username to resolve to a Slack @-mention. Replaces {mention} in details."
+    required: false
   title:
     description: "Title for the notification"
     required: false
@@ -26,6 +29,7 @@ runs:
         SLACK_WEBHOOK_URL: ${{ inputs.webhook-url }}
         DETAILS: ${{ inputs.details }}
         FAILED_JOBS: ${{ inputs.failed-jobs }}
+        MENTION_USER: ${{ inputs.mention }}
         TITLE: ${{ inputs.title }}
         REF_NAME: ${{ inputs.ref-name }}
         REPO: ${{ github.repository }}
@@ -52,6 +56,27 @@ runs:
           DETAILS="$FAILED_JOBS"
         fi
 
+        # Resolve {mention} placeholder if a GitHub username was provided.
+        # Looks up the username in user-mappings.json (co-located with this action)
+        # and replaces {mention} with <@SLACK_ID> for a Slack @-mention.
+        # Falls back to the plain GitHub username if not found in the mapping.
+        if [ -n "$MENTION_USER" ]; then
+          MAPPINGS_FILE="${GITHUB_ACTION_PATH}/user-mappings.json"
+          slack_id="$(jq -r --arg gh "$MENTION_USER" 'to_entries[] | select(.value | ascii_downcase == ($gh | ascii_downcase)) | .key' "$MAPPINGS_FILE" 2>/dev/null | head -1)"
+
+          if [ -n "$slack_id" ]; then
+            mention_text="<@${slack_id}>"
+          else
+            mention_text="${MENTION_USER}"
+          fi
+
+          DETAILS="${DETAILS//\{mention\}/$mention_text}"
+          TITLE="${TITLE//\{mention\}/}"
+        else
+          DETAILS="${DETAILS//\{mention\}/}"
+          TITLE="${TITLE//\{mention\}/}"
+        fi
+
         normalize_multiline() {
           printf '%s' "$1" | awk 'BEGIN { ORS=""; first=1 } { if (!first) printf "\\n"; printf "%s", $0; first=0 }'
         }

.github/actions/slack-notify/user-mappings.json

@@ -0,0 +1,18 @@
+{
+  "U05SAGZPEA1": "yuhongsun96",
+  "U05SAH6UGUD": "Weves",
+  "U07PWEQB7A5": "evan-onyx",
+  "U07V1SM68KF": "joachim-danswer",
+  "U08JZ9N3QNN": "raunakab",
+  "U08L24NCLJE": "Subash-Mohan",
+  "U090B9M07B2": "wenxi-onyx",
+  "U094RASDP0Q": "duo-onyx",
+  "U096L8ZQ85B": "justin-tahara",
+  "U09AHV8UBQX": "jessicasingh7",
+  "U09KAL5T3C2": "nmgarza5",
+  "U09KPGVQ70R": "acaprau",
+  "U09QR8KTSJH": "rohoswagger",
+  "U09RB4NTXA4": "jmelahman",
+  "U0A6K9VCY6A": "Danelegend",
+  "U0AGC4KH71A": "Bo-Onyx"
+}

.github/workflows/post-merge-beta-cherry-pick.yml

@@ -207,7 +207,7 @@ jobs:
           CHERRY_PICK_PR_URL: ${{ needs.cherry-pick-to-latest-release.outputs.cherry_pick_pr_url }}
         run: |
           source_pr_url="https://github.com/${GITHUB_REPOSITORY}/pull/${SOURCE_PR_NUMBER}"
-          details="*Cherry-pick PR opened successfully.*\\n• source PR: ${source_pr_url}"
+          details="*Cherry-pick PR opened successfully.*\\n• author: {mention}\\n• source PR: ${source_pr_url}"
           if [ -n "${CHERRY_PICK_PR_URL}" ]; then
             details="${details}\\n• cherry-pick PR: ${CHERRY_PICK_PR_URL}"
           fi
@@ -221,6 +221,7 @@ jobs:
         uses: ./.github/actions/slack-notify
         with:
           webhook-url: ${{ secrets.CHERRY_PICK_PRS_WEBHOOK }}
+          mention: ${{ needs.resolve-cherry-pick-request.outputs.merged_by }}
           details: ${{ steps.success-summary.outputs.details }}
           title: "✅ Automated Cherry-Pick PR Opened"
           ref-name: ${{ github.event.pull_request.base.ref }}
@@ -275,20 +276,21 @@ jobs:
           else
             failed_job_label="cherry-pick-to-latest-release"
           fi
-          failed_jobs="• ${failed_job_label}\\n• source PR: ${source_pr_url}\\n• reason: ${reason_text}"
+          details="• author: {mention}\\n• ${failed_job_label}\\n• source PR: ${source_pr_url}\\n• reason: ${reason_text}"
           if [ -n "${MERGE_COMMIT_SHA}" ]; then
-            failed_jobs="${failed_jobs}\\n• merge SHA: ${MERGE_COMMIT_SHA}"
+            details="${details}\\n• merge SHA: ${MERGE_COMMIT_SHA}"
           fi
           if [ -n "${details_excerpt}" ]; then
-            failed_jobs="${failed_jobs}\\n• excerpt: ${details_excerpt}"
+            details="${details}\\n• excerpt: ${details_excerpt}"
           fi
 
-          echo "jobs=${failed_jobs}" >> "$GITHUB_OUTPUT"
+          echo "details=${details}" >> "$GITHUB_OUTPUT"
 
       - name: Notify #cherry-pick-prs about cherry-pick failure
         uses: ./.github/actions/slack-notify
         with:
           webhook-url: ${{ secrets.CHERRY_PICK_PRS_WEBHOOK }}
-          details: ${{ steps.failure-summary.outputs.jobs }}
+          mention: ${{ needs.resolve-cherry-pick-request.outputs.merged_by }}
+          details: ${{ steps.failure-summary.outputs.details }}
           title: "🚨 Automated Cherry-Pick Failed"
           ref-name: ${{ github.event.pull_request.base.ref }}

backend/ee/onyx/configs/app_configs.py

@@ -118,9 +118,7 @@ JWT_PUBLIC_KEY_URL: str | None = os.getenv("JWT_PUBLIC_KEY_URL", None)
 SUPER_USERS = json.loads(os.environ.get("SUPER_USERS", "[]"))
 SUPER_CLOUD_API_KEY = os.environ.get("SUPER_CLOUD_API_KEY", "api_key")
 
-# The posthog client does not accept empty API keys or hosts however it fails silently
-# when the capture is called. These defaults prevent Posthog issues from breaking the Onyx app
-POSTHOG_API_KEY = os.environ.get("POSTHOG_API_KEY") or "FooBar"
+POSTHOG_API_KEY = os.environ.get("POSTHOG_API_KEY")
 POSTHOG_HOST = os.environ.get("POSTHOG_HOST") or "https://us.i.posthog.com"
 POSTHOG_DEBUG_LOGS_ENABLED = (
     os.environ.get("POSTHOG_DEBUG_LOGS_ENABLED", "").lower() == "true"

backend/ee/onyx/feature_flags/posthog_provider.py

@@ -34,6 +34,9 @@ class PostHogFeatureFlagProvider(FeatureFlagProvider):
         Returns:
             True if the feature is enabled for the user, False otherwise.
         """
+        if not posthog:
+            return False
+
         try:
             posthog.set(
                 distinct_id=user_id,

backend/ee/onyx/utils/posthog_client.py

@@ -9,6 +9,7 @@ from ee.onyx.configs.app_configs import POSTHOG_API_KEY
 from ee.onyx.configs.app_configs import POSTHOG_DEBUG_LOGS_ENABLED
 from ee.onyx.configs.app_configs import POSTHOG_HOST
 from onyx.utils.logger import setup_logger
+from shared_configs.configs import MULTI_TENANT
 
 logger = setup_logger()
 
@@ -18,12 +19,19 @@ def posthog_on_error(error: Any, items: Any) -> None:
     logger.error(f"PostHog error: {error}, items: {items}")
 
 
-posthog = Posthog(
-    project_api_key=POSTHOG_API_KEY,
-    host=POSTHOG_HOST,
-    debug=POSTHOG_DEBUG_LOGS_ENABLED,
-    on_error=posthog_on_error,
-)
+posthog: Posthog | None = None
+if POSTHOG_API_KEY:
+    posthog = Posthog(
+        project_api_key=POSTHOG_API_KEY,
+        host=POSTHOG_HOST,
+        debug=POSTHOG_DEBUG_LOGS_ENABLED,
+        on_error=posthog_on_error,
+    )
+elif MULTI_TENANT:
+    logger.warning(
+        "POSTHOG_API_KEY is not set but MULTI_TENANT is enabled — "
+        "PostHog telemetry and feature flags will be disabled"
+    )
 
 # For cross referencing between cloud and www Onyx sites
 # NOTE: These clients are separate because they are separate posthog projects.
@@ -60,7 +68,7 @@ def capture_and_sync_with_alternate_posthog(
         logger.error(f"Error capturing marketing posthog event: {e}")
 
     try:
-        if cloud_user_id := props.get("onyx_cloud_user_id"):
+        if posthog and (cloud_user_id := props.get("onyx_cloud_user_id")):
             cloud_props = props.copy()
             cloud_props.pop("onyx_cloud_user_id", None)
 

backend/ee/onyx/utils/telemetry.py

@@ -8,6 +8,9 @@ def event_telemetry(
     distinct_id: str, event: str, properties: dict | None = None
 ) -> None:
     """Capture and send an event to PostHog, flushing immediately."""
+    if not posthog:
+        return
+
     logger.info(f"Capturing PostHog event: {distinct_id} {event} {properties}")
     try:
         posthog.capture(distinct_id, event, properties)

backend/onyx/hooks/models.py

@@ -0,0 +1,88 @@
+from datetime import datetime
+from enum import Enum
+from typing import Any
+
+from pydantic import BaseModel
+
+from onyx.db.enums import HookFailStrategy
+from onyx.db.enums import HookPoint
+
+
+# ---------------------------------------------------------------------------
+# Request models
+# ---------------------------------------------------------------------------
+
+
+class HookCreateRequest(BaseModel):
+    name: str
+    hook_point: HookPoint
+    endpoint_url: str
+    api_key: str | None = None
+    fail_strategy: HookFailStrategy = HookFailStrategy.HARD
+    timeout_seconds: float | None = None  # if None, uses HookPointSpec default
+
+
+class HookUpdateRequest(BaseModel):
+    name: str | None = None
+    endpoint_url: str | None = None
+    api_key: str | None = None
+    fail_strategy: HookFailStrategy | None = None
+    timeout_seconds: float | None = None
+
+
+# ---------------------------------------------------------------------------
+# Response models
+# ---------------------------------------------------------------------------
+
+
+class HookPointMetaResponse(BaseModel):
+    hook_point: HookPoint
+    display_name: str
+    description: str
+    docs_url: str | None
+    input_schema: dict[str, Any]
+    output_schema: dict[str, Any]
+    default_timeout_seconds: float
+    default_fail_strategy: HookFailStrategy
+    fail_hard_description: str
+
+
+class HookResponse(BaseModel):
+    id: int
+    name: str
+    hook_point: HookPoint
+    endpoint_url: str | None
+    fail_strategy: HookFailStrategy
+    timeout_seconds: float
+    is_active: bool
+    creator_email: str | None
+    created_at: datetime
+    updated_at: datetime
+
+
+class HookValidateResponse(BaseModel):
+    success: bool
+    error_message: str | None = None
+
+
+# ---------------------------------------------------------------------------
+# Health models
+# ---------------------------------------------------------------------------
+
+
+class HookHealthStatus(str, Enum):
+    healthy = "healthy"  # green — reachable, no failures in last 1h
+    degraded = "degraded"  # yellow — reachable, failures in last 1h
+    unreachable = "unreachable"  # red — is_reachable=false or null
+
+
+class HookFailureRecord(BaseModel):
+    error_message: str | None
+    status_code: int | None
+    duration_ms: int | None
+    created_at: datetime
+
+
+class HookHealthResponse(BaseModel):
+    status: HookHealthStatus
+    recent_failures: list[HookFailureRecord]  # last 10, newest first

backend/onyx/hooks/points/base.py

@@ -0,0 +1,38 @@
+from abc import ABC
+from abc import abstractmethod
+from dataclasses import dataclass
+from dataclasses import field
+from typing import Any
+
+from onyx.db.enums import HookFailStrategy
+from onyx.db.enums import HookPoint
+
+
+@dataclass
+class HookPointSpec(ABC):
+    """Static metadata and contract for a pipeline hook point.
+
+    Each hook point is a concrete subclass of this class. Onyx engineers
+    own these definitions — customers never touch this code.
+
+    Instances are registered in onyx.hooks.registry.REGISTRY and served
+    via GET /api/admin/hook-points.
+    """
+
+    hook_point: HookPoint
+    display_name: str
+    description: str
+    default_timeout_seconds: float
+    fail_hard_description: str
+    docs_url: str | None = None
+    default_fail_strategy: HookFailStrategy = field(default=HookFailStrategy.HARD)
+
+    @property
+    @abstractmethod
+    def input_schema(self) -> dict[str, Any]:
+        """JSON schema describing the request payload sent to the customer's endpoint."""
+
+    @property
+    @abstractmethod
+    def output_schema(self) -> dict[str, Any]:
+        """JSON schema describing the expected response from the customer's endpoint."""

backend/onyx/hooks/points/query_processing.py

@@ -0,0 +1,79 @@
+from dataclasses import dataclass
+from typing import Any
+
+from onyx.db.enums import HookPoint
+from onyx.hooks.points.base import HookPointSpec
+
+
+@dataclass
+class QueryProcessingSpec(HookPointSpec):
+    """Hook point that runs on every user query before it enters the pipeline.
+
+    Call site: inside handle_stream_message_objects() in
+    backend/onyx/chat/process_message.py, immediately after message_text is
+    assigned from the request and before create_new_chat_message() saves it.
+
+    This is the earliest possible point in the query pipeline:
+    - Raw query — unmodified, exactly as the user typed it
+    - No side effects yet — message has not been saved to DB
+    - User identity is available for user-specific logic
+
+    Supported use cases:
+    - Query rejection: block queries based on content or user context
+    - Query rewriting: normalize, expand, or modify the query
+    - PII removal: scrub sensitive data before the LLM sees it
+    - Access control: reject queries from certain users or groups
+    - Query auditing: log or track queries based on business rules
+    """
+
+    hook_point: HookPoint = HookPoint.QUERY_PROCESSING
+    display_name: str = "Query Processing"
+    description: str = (
+        "Runs on every user query before it enters the pipeline. "
+        "Allows rewriting, filtering, or rejecting queries."
+    )
+    default_timeout_seconds: float = 5.0  # user is actively waiting — keep tight
+    fail_hard_description: str = (
+        "The query will be blocked and the user will see an error message."
+    )
+    docs_url: str | None = None
+
+    @property
+    def input_schema(self) -> dict[str, Any]:
+        return {
+            "type": "object",
+            "properties": {
+                "query": {
+                    "type": "string",
+                    "description": "The raw query string exactly as the user typed it.",
+                },
+                "user_email": {
+                    "type": ["string", "null"],
+                    "description": "Email of the user submitting the query, or null if unauthenticated.",
+                },
+            },
+            "required": ["query", "user_email"],
+        }
+
+    @property
+    def output_schema(self) -> dict[str, Any]:
+        return {
+            "type": "object",
+            "properties": {
+                "query": {
+                    "type": ["string", "null"],
+                    "description": (
+                        "The (optionally modified) query to use. "
+                        "Set to null to reject the query."
+                    ),
+                },
+                "rejection_message": {
+                    "type": ["string", "null"],
+                    "description": (
+                        "Message shown to the user when query is null. "
+                        "Falls back to a generic message if not provided."
+                    ),
+                },
+            },
+            "required": ["query"],
+        }

backend/onyx/hooks/registry.py

@@ -0,0 +1,34 @@
+from onyx.db.enums import HookPoint
+from onyx.hooks.points.base import HookPointSpec
+from onyx.hooks.points.query_processing import QueryProcessingSpec
+
+REGISTRY: dict[HookPoint, HookPointSpec] = {
+    HookPoint.QUERY_PROCESSING: QueryProcessingSpec(),
+}
+
+_missing = set(HookPoint) - set(REGISTRY)
+if _missing:
+    raise RuntimeError(
+        f"Hook point(s) have no registered spec: {_missing}. "
+        "Add an entry to onyx.hooks.registry.REGISTRY."
+    )
+
+
+def get_hook_point_spec(hook_point: HookPoint) -> HookPointSpec:
+    """Returns the spec for a given hook point.
+
+    Raises ValueError if the hook point has no registered spec — this is a
+    programmer error; every HookPoint enum value must have a corresponding spec
+    in REGISTRY.
+    """
+    try:
+        return REGISTRY[hook_point]
+    except KeyError:
+        raise ValueError(
+            f"No spec registered for hook point {hook_point!r}. "
+            "Add an entry to onyx.hooks.registry.REGISTRY."
+        )
+
+
+def get_all_specs() -> list[HookPointSpec]:
+    return list(REGISTRY.values())

backend/onyx/server/manage/llm/api.py

@@ -81,6 +81,7 @@ from onyx.server.manage.llm.models import VisionProviderResponse
 from onyx.server.manage.llm.utils import generate_bedrock_display_name
 from onyx.server.manage.llm.utils import generate_ollama_display_name
 from onyx.server.manage.llm.utils import infer_vision_support
+from onyx.server.manage.llm.utils import is_embedding_model
 from onyx.server.manage.llm.utils import is_reasoning_model
 from onyx.server.manage.llm.utils import is_valid_bedrock_model
 from onyx.server.manage.llm.utils import ModelMetadata
@@ -1374,6 +1375,10 @@ def get_litellm_available_models(
         try:
             model_details = LitellmModelDetails.model_validate(model)
 
+            # Skip embedding models
+            if is_embedding_model(model_details.id):
+                continue
+
             results.append(
                 LitellmFinalModelResponse(
                     provider_name=model_details.owned_by,

backend/onyx/server/manage/llm/utils.py

@@ -366,3 +366,18 @@ def extract_vendor_from_model_name(model_name: str, provider: str) -> str | None
         return None
 
     return None
+
+
+def is_embedding_model(model_name: str) -> bool:
+    """Checks for if a model is an embedding model"""
+    from litellm import get_model_info
+
+    try:
+        # get_model_info raises on unknown models
+        # default to False
+        model_info = get_model_info(model_name)
+    except Exception:
+        return False
+    is_embedding_mode = model_info.get("mode") == "embedding"
+
+    return is_embedding_mode

backend/onyx/server/manage/voice/websocket_api.py

@@ -118,12 +118,6 @@ async def handle_streaming_transcription(
             if result is None:  # End of stream
                 logger.info("Streaming transcription: transcript stream ended")
                 break
-            if result.error:
-                logger.warning(
-                    f"Streaming transcription: provider error: {result.error}"
-                )
-                await websocket.send_json({"type": "error", "message": result.error})
-                continue
             # Send if text changed OR if VAD detected end of speech (for auto-send trigger)
             if result.text and (result.text != last_transcript or result.is_vad_end):
                 last_transcript = result.text

backend/onyx/voice/interface.py

@@ -15,9 +15,6 @@ class TranscriptResult(BaseModel):
     is_vad_end: bool = False
     """True if VAD detected end of speech (silence). Use for auto-send."""
 
-    error: str | None = None
-    """Provider error message to forward to the client, if any."""
-
 
 class StreamingTranscriberProtocol(Protocol):
     """Protocol for streaming transcription sessions."""

backend/onyx/voice/providers/openai.py

@@ -56,17 +56,6 @@ def _http_to_ws_url(http_url: str) -> str:
     return http_url
 
 
-_USER_FACING_ERROR_MESSAGES: dict[str, str] = {
-    "input_audio_buffer_commit_empty": (
-        "No audio was recorded. Please check your microphone and try again."
-    ),
-    "invalid_api_key": "Voice service authentication failed. Please contact support.",
-    "rate_limit_exceeded": "Voice service is temporarily busy. Please try again shortly.",
-}
-
-_DEFAULT_USER_ERROR = "A voice transcription error occurred. Please try again."
-
-
 class OpenAIStreamingTranscriber(StreamingTranscriberProtocol):
     """Streaming transcription using OpenAI Realtime API."""
 
@@ -153,17 +142,6 @@ class OpenAIStreamingTranscriber(StreamingTranscriberProtocol):
                     if msg_type == OpenAIRealtimeMessageType.ERROR:
                         error = data.get("error", {})
                         self._logger.error(f"OpenAI error: {error}")
-                        error_code = error.get("code", "")
-                        user_message = _USER_FACING_ERROR_MESSAGES.get(
-                            error_code, _DEFAULT_USER_ERROR
-                        )
-                        await self._transcript_queue.put(
-                            TranscriptResult(
-                                text="",
-                                is_vad_end=False,
-                                error=user_message,
-                            )
-                        )
                         continue
 
                     # Handle VAD events

backend/requirements/default.txt

@@ -65,7 +65,7 @@ attrs==25.4.0
     #   jsonschema
     #   referencing
     #   zeep
-authlib==1.6.7
+authlib==1.6.9
     # via fastmcp
 azure-cognitiveservices-speech==1.38.0
     # via onyx
@@ -737,7 +737,7 @@ pygithub==2.5.0
     # via onyx
 pygments==2.19.2
     # via rich
-pyjwt==2.11.0
+pyjwt==2.12.0
     # via
     #   fastapi-users
     #   mcp

backend/requirements/dev.txt

@@ -353,7 +353,7 @@ pygments==2.19.2
     # via
     #   ipython
     #   ipython-pygments-lexers
-pyjwt==2.11.0
+pyjwt==2.12.0
     # via mcp
 pyparsing==3.2.5
     # via matplotlib

backend/requirements/ee.txt

@@ -218,7 +218,7 @@ pydantic-core==2.33.2
     # via pydantic
 pydantic-settings==2.12.0
     # via mcp
-pyjwt==2.11.0
+pyjwt==2.12.0
     # via mcp
 python-dateutil==2.8.2
     # via

backend/requirements/model_server.txt

@@ -308,7 +308,7 @@ pydantic-core==2.33.2
     # via pydantic
 pydantic-settings==2.12.0
     # via mcp
-pyjwt==2.11.0
+pyjwt==2.12.0
     # via mcp
 python-dateutil==2.8.2
     # via

backend/tests/unit/onyx/hooks/test_query_processing_spec.py

@@ -0,0 +1,50 @@
+from onyx.db.enums import HookFailStrategy
+from onyx.db.enums import HookPoint
+from onyx.hooks.points.query_processing import QueryProcessingSpec
+
+
+def test_hook_point_is_query_processing() -> None:
+    assert QueryProcessingSpec().hook_point == HookPoint.QUERY_PROCESSING
+
+
+def test_default_fail_strategy_is_hard() -> None:
+    assert QueryProcessingSpec().default_fail_strategy == HookFailStrategy.HARD
+
+
+def test_default_timeout_seconds() -> None:
+    # User is actively waiting — 5s is the documented contract for this hook point
+    assert QueryProcessingSpec().default_timeout_seconds == 5.0
+
+
+def test_input_schema_required_fields() -> None:
+    schema = QueryProcessingSpec().input_schema
+    assert schema["type"] == "object"
+    required = schema["required"]
+    assert "query" in required
+    assert "user_email" in required
+
+
+def test_input_schema_query_is_string() -> None:
+    props = QueryProcessingSpec().input_schema["properties"]
+    assert props["query"]["type"] == "string"
+
+
+def test_input_schema_user_email_is_nullable() -> None:
+    props = QueryProcessingSpec().input_schema["properties"]
+    assert "null" in props["user_email"]["type"]
+
+
+def test_output_schema_query_is_required() -> None:
+    schema = QueryProcessingSpec().output_schema
+    assert "query" in schema["required"]
+
+
+def test_output_schema_query_is_nullable() -> None:
+    # null means "reject the query"
+    props = QueryProcessingSpec().output_schema["properties"]
+    assert "null" in props["query"]["type"]
+
+
+def test_output_schema_rejection_message_is_optional() -> None:
+    schema = QueryProcessingSpec().output_schema
+    assert "rejection_message" not in schema.get("required", [])

backend/tests/unit/onyx/hooks/test_registry.py

@@ -0,0 +1,35 @@
+import pytest
+
+from onyx.db.enums import HookPoint
+from onyx.hooks import registry as registry_module
+from onyx.hooks.registry import get_all_specs
+from onyx.hooks.registry import get_hook_point_spec
+from onyx.hooks.registry import REGISTRY
+
+
+def test_registry_covers_all_hook_points() -> None:
+    """Every HookPoint enum member must have a registered spec."""
+    assert set(REGISTRY.keys()) == set(
+        HookPoint
+    ), f"Missing specs for: {set(HookPoint) - set(REGISTRY.keys())}"
+
+
+def test_get_hook_point_spec_returns_correct_spec() -> None:
+    for hook_point in HookPoint:
+        spec = get_hook_point_spec(hook_point)
+        assert spec.hook_point == hook_point
+
+
+def test_get_all_specs_returns_all() -> None:
+    specs = get_all_specs()
+    assert len(specs) == len(HookPoint)
+    assert {s.hook_point for s in specs} == set(HookPoint)
+
+
+def test_get_hook_point_spec_raises_for_unregistered(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """get_hook_point_spec raises ValueError when a hook point has no spec."""
+    monkeypatch.setattr(registry_module, "REGISTRY", {})
+    with pytest.raises(ValueError, match="No spec registered for hook point"):
+        get_hook_point_spec(HookPoint.QUERY_PROCESSING)

backend/tests/unit/onyx/server/manage/llm/test_llm_provider_utils.py

@@ -3,6 +3,7 @@
 from onyx.server.manage.llm.utils import generate_bedrock_display_name
 from onyx.server.manage.llm.utils import generate_ollama_display_name
 from onyx.server.manage.llm.utils import infer_vision_support
+from onyx.server.manage.llm.utils import is_embedding_model
 from onyx.server.manage.llm.utils import is_reasoning_model
 from onyx.server.manage.llm.utils import is_valid_bedrock_model
 from onyx.server.manage.llm.utils import strip_openrouter_vendor_prefix
@@ -209,3 +210,35 @@ class TestIsReasoningModel:
             is_reasoning_model("anthropic/claude-3-5-sonnet", "Claude 3.5 Sonnet")
             is False
         )
+
+
+class TestIsEmbeddingModel:
+    """Tests for embedding model detection."""
+
+    def test_openai_embedding_ada(self) -> None:
+        assert is_embedding_model("text-embedding-ada-002") is True
+
+    def test_openai_embedding_3_small(self) -> None:
+        assert is_embedding_model("text-embedding-3-small") is True
+
+    def test_openai_embedding_3_large(self) -> None:
+        assert is_embedding_model("text-embedding-3-large") is True
+
+    def test_cohere_embed_model(self) -> None:
+        assert is_embedding_model("embed-english-v3.0") is True
+
+    def test_bedrock_titan_embed(self) -> None:
+        assert is_embedding_model("amazon.titan-embed-text-v1") is True
+
+    def test_gpt4o_not_embedding(self) -> None:
+        assert is_embedding_model("gpt-4o") is False
+
+    def test_gpt4_not_embedding(self) -> None:
+        assert is_embedding_model("gpt-4") is False
+
+    def test_dall_e_not_embedding(self) -> None:
+        assert is_embedding_model("dall-e-3") is False
+
+    def test_unknown_custom_model_not_embedding(self) -> None:
+        """Custom/local models not in litellm's model DB should default to False."""
+        assert is_embedding_model("my-custom-local-model-v1") is False

uv.lock

@@ -453,14 +453,14 @@ wheels = [
 
 [[package]]
 name = "authlib"
-version = "1.6.7"
+version = "1.6.9"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "cryptography" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/49/dc/ed1681bf1339dd6ea1ce56136bad4baabc6f7ad466e375810702b0237047/authlib-1.6.7.tar.gz", hash = "sha256:dbf10100011d1e1b34048c9d120e83f13b35d69a826ae762b93d2fb5aafc337b", size = 164950, upload-time = "2026-02-06T14:04:14.171Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/af/98/00d3dd826d46959ad8e32af2dbb2398868fd9fd0683c26e56d0789bd0e68/authlib-1.6.9.tar.gz", hash = "sha256:d8f2421e7e5980cc1ddb4e32d3f5fa659cfaf60d8eaf3281ebed192e4ab74f04", size = 165134, upload-time = "2026-03-02T07:44:01.998Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/f8/00/3ed12264094ec91f534fae429945efbaa9f8c666f3aa7061cc3b2a26a0cd/authlib-1.6.7-py2.py3-none-any.whl", hash = "sha256:c637340d9a02789d2efa1d003a7437d10d3e565237bcb5fcbc6c134c7b95bab0", size = 244115, upload-time = "2026-02-06T14:04:12.141Z" },
+    { url = "https://files.pythonhosted.org/packages/53/23/b65f568ed0c22f1efacb744d2db1a33c8068f384b8c9b482b52ebdbc3ef6/authlib-1.6.9-py2.py3-none-any.whl", hash = "sha256:f08b4c14e08f0861dc18a32357b33fbcfd2ea86cfe3fe149484b4d764c4a0ac3", size = 244197, upload-time = "2026-03-02T07:44:00.307Z" },
 ]
 
 [[package]]
@@ -5643,11 +5643,11 @@ wheels = [
 
 [[package]]
 name = "pyjwt"
-version = "2.11.0"
+version = "2.12.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/5c/5a/b46fa56bf322901eee5b0454a34343cdbdae202cd421775a8ee4e42fd519/pyjwt-2.11.0.tar.gz", hash = "sha256:35f95c1f0fbe5d5ba6e43f00271c275f7a1a4db1dab27bf708073b75318ea623", size = 98019, upload-time = "2026-01-30T19:59:55.694Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/a8/10/e8192be5f38f3e8e7e046716de4cae33d56fd5ae08927a823bb916be36c1/pyjwt-2.12.0.tar.gz", hash = "sha256:2f62390b667cd8257de560b850bb5a883102a388829274147f1d724453f8fb02", size = 102511, upload-time = "2026-03-12T17:15:30.831Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/6f/01/c26ce75ba460d5cd503da9e13b21a33804d38c2165dec7b716d06b13010c/pyjwt-2.11.0-py3-none-any.whl", hash = "sha256:94a6bde30eb5c8e04fee991062b534071fd1439ef58d2adc9ccb823e7bcd0469", size = 28224, upload-time = "2026-01-30T19:59:54.539Z" },
+    { url = "https://files.pythonhosted.org/packages/15/70/70f895f404d363d291dcf62c12c85fdd47619ad9674ac0f53364d035925a/pyjwt-2.12.0-py3-none-any.whl", hash = "sha256:9bb459d1bdd0387967d287f5656bf7ec2b9a26645d1961628cda1764e087fd6e", size = 29700, upload-time = "2026-03-12T17:15:29.257Z" },
 ]
 
 [package.optional-dependencies]

web/lib/opal/src/components/buttons/open-button/components.tsx

@@ -7,6 +7,7 @@ import {
   type InteractiveStatefulInteraction,
 } from "@opal/core";
 import type { SizeVariant, WidthVariant } from "@opal/shared";
+import type { InteractiveContainerRoundingVariant } from "@opal/core";
 import type { TooltipSide } from "@opal/components";
 import type { IconFunctionComponent, IconProps } from "@opal/types";
 import { SvgChevronDownSmall } from "@opal/icons";
@@ -80,6 +81,9 @@ type OpenButtonProps = Omit<InteractiveStatefulProps, "variant"> & {
 
     /** Which side the tooltip appears on. */
     tooltipSide?: TooltipSide;
+
+    /** Override the default rounding derived from `size`. */
+    roundingVariant?: InteractiveContainerRoundingVariant;
   };
 
 // ---------------------------------------------------------------------------
@@ -95,6 +99,7 @@ function OpenButton({
   justifyContent,
   tooltip,
   tooltipSide = "top",
+  roundingVariant: roundingVariantOverride,
   interaction,
   variant = "select-heavy",
   ...statefulProps
@@ -132,7 +137,8 @@ function OpenButton({
         heightVariant={size}
         widthVariant={width}
         roundingVariant={
-          isLarge ? "default" : size === "2xs" ? "mini" : "compact"
+          roundingVariantOverride ??
+          (isLarge ? "default" : size === "2xs" ? "mini" : "compact")
         }
       >
         <div

web/lib/opal/src/icons/curate.tsx

@@ -0,0 +1,20 @@
+import type { IconProps } from "@opal/types";
+const SvgCurate = ({ size, ...props }: IconProps) => (
+  <svg
+    width={size}
+    height={size}
+    viewBox="0 0 16 16"
+    fill="none"
+    xmlns="http://www.w3.org/2000/svg"
+    stroke="currentColor"
+    {...props}
+  >
+    <path
+      d="M8 9L8 14.5M8 9C7.35971 8.35971 6.9055 8 6 8H2.5L2.5 13.5H6C6.9055 13.5 7.35971 13.8597 8 14.5M8 9C8.64029 8.35971 9.09449 8 10 8H13.5L13.5 13.5H10C9.09449 13.5 8.64029 13.8597 8 14.5M10.25 3.75C10.25 4.99264 9.24264 6 8 6C6.75736 6 5.75 4.99264 5.75 3.75C5.75 2.50736 6.75736 1.5 8 1.5C9.24264 1.5 10.25 2.50736 10.25 3.75Z"
+      strokeWidth={1.5}
+      strokeLinecap="round"
+      strokeLinejoin="round"
+    />
+  </svg>
+);
+export default SvgCurate;

web/lib/opal/src/icons/index.ts

@@ -54,6 +54,7 @@ export { default as SvgColumn } from "@opal/icons/column";
 export { default as SvgCopy } from "@opal/icons/copy";
 export { default as SvgCornerRightUpDot } from "@opal/icons/corner-right-up-dot";
 export { default as SvgCpu } from "@opal/icons/cpu";
+export { default as SvgCurate } from "@opal/icons/curate";
 export { default as SvgCreditCard } from "@opal/icons/credit-card";
 export { default as SvgDashboard } from "@opal/icons/dashboard";
 export { default as SvgDevKit } from "@opal/icons/dev-kit";
@@ -135,6 +136,7 @@ export { default as SvgPlayCircle } from "@opal/icons/play-circle";
 export { default as SvgPlug } from "@opal/icons/plug";
 export { default as SvgPlus } from "@opal/icons/plus";
 export { default as SvgPlusCircle } from "@opal/icons/plus-circle";
+export { default as SvgProgressBars } from "@opal/icons/progress-bars";
 export { default as SvgProgressCircle } from "@opal/icons/progress-circle";
 export { default as SvgQuestionMarkSmall } from "@opal/icons/question-mark-small";
 export { default as SvgQuoteEnd } from "@opal/icons/quote-end";
@@ -176,9 +178,16 @@ export { default as SvgTwoLineSmall } from "@opal/icons/two-line-small";
 export { default as SvgUnplug } from "@opal/icons/unplug";
 export { default as SvgUploadCloud } from "@opal/icons/upload-cloud";
 export { default as SvgUser } from "@opal/icons/user";
+export { default as SvgUserCheck } from "@opal/icons/user-check";
+export { default as SvgUserEdit } from "@opal/icons/user-edit";
+export { default as SvgUserKey } from "@opal/icons/user-key";
 export { default as SvgUserManage } from "@opal/icons/user-manage";
+export { default as SvgUserMinus } from "@opal/icons/user-minus";
 export { default as SvgUserPlus } from "@opal/icons/user-plus";
+export { default as SvgUserShield } from "@opal/icons/user-shield";
+export { default as SvgUserSpeaker } from "@opal/icons/user-speaker";
 export { default as SvgUserSync } from "@opal/icons/user-sync";
+export { default as SvgUserX } from "@opal/icons/user-x";
 export { default as SvgUsers } from "@opal/icons/users";
 export { default as SvgVolume } from "@opal/icons/volume";
 export { default as SvgVolumeOff } from "@opal/icons/volume-off";

web/lib/opal/src/icons/progress-bars.tsx

@@ -0,0 +1,20 @@
+import type { IconProps } from "@opal/types";
+const SvgProgressBars = ({ size, ...props }: IconProps) => (
+  <svg
+    width={size}
+    height={size}
+    viewBox="0 0 16 16"
+    fill="none"
+    xmlns="http://www.w3.org/2000/svg"
+    stroke="currentColor"
+    {...props}
+  >
+    <path
+      d="M5.5 2.00003L13.25 2C13.9403 2 14.5 2.55964 14.5 3.25C14.5 3.94036 13.9403 4.5 13.25 4.5L5.5 4.50003M5.5 2.00003L2.74998 2C2.05963 2 1.49998 2.55964 1.49998 3.25C1.49998 3.94036 2.05963 4.5 2.74998 4.5L5.5 4.50003M5.5 2.00003V4.50003M10.5 11.5H13.25C13.9403 11.5 14.5 12.0596 14.5 12.75C14.5 13.4404 13.9403 14 13.25 14H10.5M10.5 11.5H2.74998C2.05963 11.5 1.49998 12.0596 1.49998 12.75C1.49998 13.4404 2.05963 14 2.74999 14H10.5M10.5 11.5V14M8 6.75H13.25C13.9403 6.75 14.5 7.30964 14.5 8C14.5 8.69036 13.9403 9.25 13.25 9.25H8M8 6.75H2.74998C2.05963 6.75 1.49998 7.30964 1.49998 8C1.49998 8.69036 2.05963 9.25 2.74998 9.25H8M8 6.75V9.25"
+      strokeWidth={1.5}
+      strokeLinecap="round"
+      strokeLinejoin="round"
+    />
+  </svg>
+);
+export default SvgProgressBars;

web/lib/opal/src/icons/user-check.tsx

@@ -0,0 +1,20 @@
+import type { IconProps } from "@opal/types";
+const SvgUserCheck = ({ size, ...props }: IconProps) => (
+  <svg
+    width={size}
+    height={size}
+    viewBox="0 0 16 16"
+    fill="none"
+    xmlns="http://www.w3.org/2000/svg"
+    stroke="currentColor"
+    {...props}
+  >
+    <path
+      d="M11 14C11 13.6667 11 13.3333 11 13C11 11.3431 9.65684 10 7.99998 10H4.00002C2.34316 10 1 11.3431 1 13C1 13.3333 1 13.6667 1 14M10.75 7.49999L12.25 9L15 6.24999M8.75 4.75C8.75 6.26878 7.51878 7.5 6 7.5C4.48122 7.5 3.25 6.26878 3.25 4.75C3.25 3.23122 4.48122 2 6 2C7.51878 2 8.75 3.23122 8.75 4.75Z"
+      strokeWidth={1.5}
+      strokeLinecap="round"
+      strokeLinejoin="round"
+    />
+  </svg>
+);
+export default SvgUserCheck;

web/lib/opal/src/icons/user-edit.tsx

@@ -0,0 +1,20 @@
+import type { IconProps } from "@opal/types";
+const SvgUserEdit = ({ size, ...props }: IconProps) => (
+  <svg
+    width={size}
+    height={size}
+    viewBox="0 0 16 16"
+    fill="none"
+    xmlns="http://www.w3.org/2000/svg"
+    stroke="currentColor"
+    {...props}
+  >
+    <path
+      d="M1 14C1 13.6667 1 13.3333 1 13C1 11.3431 2.34316 10 4.00002 10H7M8.75 4.75C8.75 6.26878 7.51878 7.5 6 7.5C4.48122 7.5 3.25 6.26878 3.25 4.75C3.25 3.23122 4.48122 2 6 2C7.51878 2 8.75 3.23122 8.75 4.75ZM12.09 8.41421C12.3552 8.149 12.7149 8 13.09 8C13.2757 8 13.4596 8.03658 13.6312 8.10765C13.8028 8.17872 13.9587 8.28289 14.09 8.41421C14.2213 8.54554 14.3255 8.70144 14.3966 8.87302C14.4676 9.0446 14.5042 9.2285 14.5042 9.41421C14.5042 9.59993 14.4676 9.78383 14.3966 9.95541C14.3255 10.127 14.2213 10.2829 14.09 10.4142L10.6667 13.8333L8 14.5L8.66667 11.8333L12.09 8.41421Z"
+      strokeWidth={1.5}
+      strokeLinecap="round"
+      strokeLinejoin="round"
+    />
+  </svg>
+);
+export default SvgUserEdit;

web/lib/opal/src/icons/user-key.tsx

@@ -0,0 +1,20 @@
+import type { IconProps } from "@opal/types";
+const SvgUserKey = ({ size, ...props }: IconProps) => (
+  <svg
+    width={size}
+    height={size}
+    viewBox="0 0 16 16"
+    fill="none"
+    xmlns="http://www.w3.org/2000/svg"
+    stroke="currentColor"
+    {...props}
+  >
+    <path
+      d="M1 14C1 13.6667 1 13.3333 1 13C1 11.3431 2.34316 10 4.00002 10H8.5M12.625 10C13.6605 10 14.5 9.16053 14.5 8.125C14.5 7.08947 13.6605 6.25 12.625 6.25C11.5895 6.25 10.75 7.08947 10.75 8.125C10.75 9.16053 11.5895 10 12.625 10ZM12.625 10V12.25M12.625 14.5V13.5M12.625 13.5H13.875V12.25H12.625M12.625 13.5V12.25M8.75 4.75C8.75 6.26878 7.51878 7.5 6 7.5C4.48122 7.5 3.25 6.26878 3.25 4.75C3.25 3.23122 4.48122 2 6 2C7.51878 2 8.75 3.23122 8.75 4.75Z"
+      strokeWidth={1.5}
+      strokeLinecap="round"
+      strokeLinejoin="round"
+    />
+  </svg>
+);
+export default SvgUserKey;

web/lib/opal/src/icons/user-minus.tsx

@@ -0,0 +1,20 @@
+import type { IconProps } from "@opal/types";
+const SvgUserMinus = ({ size, ...props }: IconProps) => (
+  <svg
+    width={size}
+    height={size}
+    viewBox="0 0 16 16"
+    fill="none"
+    xmlns="http://www.w3.org/2000/svg"
+    stroke="currentColor"
+    {...props}
+  >
+    <path
+      d="M11 14C11 13.6667 11 13.3333 11 13C11 11.3431 9.65684 10 7.99998 10H4.00002C2.34316 10 1 11.3431 1 13C1 13.3333 1 13.6667 1 14M10.75 7.49999L14.75 7.50007M8.75 4.75C8.75 6.26878 7.51878 7.5 6 7.5C4.48122 7.5 3.25 6.26878 3.25 4.75C3.25 3.23122 4.48122 2 6 2C7.51878 2 8.75 3.23122 8.75 4.75Z"
+      strokeWidth={1.5}
+      strokeLinecap="round"
+      strokeLinejoin="round"
+    />
+  </svg>
+);
+export default SvgUserMinus;

web/lib/opal/src/icons/user-shield.tsx

@@ -0,0 +1,20 @@
+import type { IconProps } from "@opal/types";
+const SvgUserShield = ({ size, ...props }: IconProps) => (
+  <svg
+    width={size}
+    height={size}
+    viewBox="0 0 16 16"
+    fill="none"
+    xmlns="http://www.w3.org/2000/svg"
+    stroke="currentColor"
+    {...props}
+  >
+    <path
+      d="M1 14C1 13.6667 1 13.3333 1 13C1 11.3431 2.34316 10 4.00002 10H7M8.75 4.75C8.75 6.26878 7.51878 7.5 6 7.5C4.48122 7.5 3.25 6.26878 3.25 4.75C3.25 3.23122 4.48122 2 6 2C7.51878 2 8.75 3.23122 8.75 4.75ZM12 14.5C12 14.5 14.5 13.25 14.5 11.375V9L12 8L9.5 9V11.375C9.5 13.25 12 14.5 12 14.5Z"
+      strokeWidth={1.5}
+      strokeLinecap="round"
+      strokeLinejoin="round"
+    />
+  </svg>
+);
+export default SvgUserShield;

web/lib/opal/src/icons/user-speaker.tsx

@@ -0,0 +1,20 @@
+import type { IconProps } from "@opal/types";
+const SvgUserSpeaker = ({ size, ...props }: IconProps) => (
+  <svg
+    width={size}
+    height={size}
+    viewBox="0 0 16 16"
+    fill="none"
+    xmlns="http://www.w3.org/2000/svg"
+    stroke="currentColor"
+    {...props}
+  >
+    <path
+      d="M1 14C1 13.6667 1 13.3333 1 13C1 11.3431 2.34316 10 4.00002 10H7.99998C9.65684 10 11 11.3431 11 13C11 13.3333 11 13.6667 11 14H14.5V10L12.7071 8.20711M12 7.5L12.7071 8.20711M12.7071 8.20711C13.0976 7.81658 13.0976 7.18342 12.7071 6.79289C12.3166 6.40237 11.6834 6.40237 11.2929 6.79289C10.9024 7.18342 10.9024 7.81658 11.2929 8.20711C11.6834 8.59763 12.3166 8.59763 12.7071 8.20711ZM8.75 4.75C8.75 6.26878 7.51878 7.5 6 7.5C4.48122 7.5 3.25 6.26878 3.25 4.75C3.25 3.23122 4.48122 2 6 2C7.51878 2 8.75 3.23122 8.75 4.75Z"
+      strokeWidth={1.5}
+      strokeLinecap="round"
+      strokeLinejoin="round"
+    />
+  </svg>
+);
+export default SvgUserSpeaker;

web/lib/opal/src/icons/user-x.tsx

@@ -0,0 +1,20 @@
+import type { IconProps } from "@opal/types";
+const SvgUserX = ({ size, ...props }: IconProps) => (
+  <svg
+    width={size}
+    height={size}
+    viewBox="0 0 16 16"
+    fill="none"
+    xmlns="http://www.w3.org/2000/svg"
+    stroke="currentColor"
+    {...props}
+  >
+    <path
+      d="M11 14C11 13.6667 11 13.3333 11 13C11 11.3431 9.65684 10 7.99998 10H4.00002C2.34316 10 1 11.3431 1 13C1 13.3333 1 13.6667 1 14M11.5 8.5L13.25 6.75M13.25 6.75L15 5M13.25 6.75L15 8.5M13.25 6.75L11.5 5M8.75 4.75C8.75 6.26878 7.51878 7.5 6 7.5C4.48122 7.5 3.25 6.26878 3.25 4.75C3.25 3.23122 4.48122 2 6 2C7.51878 2 8.75 3.23122 8.75 4.75Z"
+      strokeWidth={1.5}
+      strokeLinecap="round"
+      strokeLinejoin="round"
+    />
+  </svg>
+);
+export default SvgUserX;

web/package-lock.json

@@ -10309,7 +10309,9 @@
       }
     },
     "node_modules/flatted": {
-      "version": "3.3.3",
+      "version": "3.4.1",
+      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.4.1.tgz",
+      "integrity": "sha512-IxfVbRFVlV8V/yRaGzk0UVIcsKKHMSfYw66T/u4nTwlWteQePsxe//LjudR1AMX4tZW3WFCh3Zqa/sjlqpbURQ==",
       "dev": true,
       "license": "ISC"
     },

web/src/app/admin/actions/mcp/page.tsx

@@ -2,9 +2,9 @@
 
 import MCPPageContent from "@/sections/actions/MCPPageContent";
 import * as SettingsLayouts from "@/layouts/settings-layouts";
-import { ADMIN_ROUTE_CONFIG, ADMIN_PATHS } from "@/lib/admin-routes";
+import { ADMIN_ROUTES } from "@/lib/admin-routes";
 
-const route = ADMIN_ROUTE_CONFIG[ADMIN_PATHS.MCP_ACTIONS]!;
+const route = ADMIN_ROUTES.MCP_ACTIONS;
 
 export default function Main() {
   return (

web/src/app/admin/actions/open-api/page.tsx

@@ -2,9 +2,9 @@
 
 import * as SettingsLayouts from "@/layouts/settings-layouts";
 import OpenApiPageContent from "@/sections/actions/OpenApiPageContent";
-import { ADMIN_ROUTE_CONFIG, ADMIN_PATHS } from "@/lib/admin-routes";
+import { ADMIN_ROUTES } from "@/lib/admin-routes";
 
-const route = ADMIN_ROUTE_CONFIG[ADMIN_PATHS.OPENAPI_ACTIONS]!;
+const route = ADMIN_ROUTES.OPENAPI_ACTIONS;
 
 export default function Main() {
   return (

web/src/app/admin/add-connector/page.tsx

@@ -32,7 +32,10 @@ import { SettingsContext } from "@/providers/SettingsProvider";
 import SourceTile from "@/components/SourceTile";
 import InputTypeIn from "@/refresh-components/inputs/InputTypeIn";
 import Text from "@/refresh-components/texts/Text";
-import { ADMIN_ROUTE_CONFIG, ADMIN_PATHS } from "@/lib/admin-routes";
+import { ADMIN_ROUTES } from "@/lib/admin-routes";
+
+const route = ADMIN_ROUTES.ADD_CONNECTOR;
+
 function SourceTileTooltipWrapper({
   sourceMetadata,
   preSelect,
@@ -124,7 +127,6 @@ function SourceTileTooltipWrapper({
 }
 
 export default function Page() {
-  const route = ADMIN_ROUTE_CONFIG[ADMIN_PATHS.ADD_CONNECTOR]!;
   const sources = useMemo(() => listSourceMetadata(), []);
 
   const [rawSearchTerm, setSearchTerm] = useState("");

web/src/app/admin/agents/page.tsx

@@ -11,10 +11,11 @@ import { useAdminPersonas } from "@/hooks/useAdminPersonas";
 import { Persona } from "./interfaces";
 import { ThreeDotsLoader } from "@/components/Loading";
 import { ErrorCallout } from "@/components/ErrorCallout";
-import { ADMIN_ROUTE_CONFIG, ADMIN_PATHS } from "@/lib/admin-routes";
+import { ADMIN_ROUTES } from "@/lib/admin-routes";
 import { useState, useEffect } from "react";
 import Pagination from "@/refresh-components/Pagination";
 
+const route = ADMIN_ROUTES.AGENTS;
 const PAGE_SIZE = 20;
 
 function MainContent({
@@ -120,7 +121,6 @@ function MainContent({
 }
 
 export default function Page() {
-  const route = ADMIN_ROUTE_CONFIG[ADMIN_PATHS.AGENTS]!;
   const [currentPage, setCurrentPage] = useState(1);
   const { personas, totalItems, isLoading, error, refresh } = useAdminPersonas({
     pageNum: currentPage - 1, // Backend uses 0-indexed pages

web/src/app/admin/api-key/page.tsx

@@ -32,9 +32,9 @@ import CopyIconButton from "@/refresh-components/buttons/CopyIconButton";
 import Text from "@/refresh-components/texts/Text";
 import { SvgEdit, SvgKey, SvgRefreshCw } from "@opal/icons";
 import { useCloudSubscription } from "@/hooks/useCloudSubscription";
-import { ADMIN_ROUTE_CONFIG, ADMIN_PATHS } from "@/lib/admin-routes";
+import { ADMIN_ROUTES } from "@/lib/admin-routes";
 
-const route = ADMIN_ROUTE_CONFIG[ADMIN_PATHS.API_KEYS]!;
+const route = ADMIN_ROUTES.API_KEYS;
 
 function Main() {
   const {

web/src/app/admin/bots/page.tsx

@@ -6,10 +6,12 @@ import { InstantSSRAutoRefresh } from "@/components/SSRAutoRefresh";
 import { SlackBotTable } from "./SlackBotTable";
 import { useSlackBots } from "./[bot-id]/hooks";
 import * as SettingsLayouts from "@/layouts/settings-layouts";
-import { ADMIN_ROUTE_CONFIG, ADMIN_PATHS } from "@/lib/admin-routes";
+import { ADMIN_ROUTES } from "@/lib/admin-routes";
 import CreateButton from "@/refresh-components/buttons/CreateButton";
 import { DOCS_ADMINS_PATH } from "@/lib/constants";
 
+const route = ADMIN_ROUTES.SLACK_BOTS;
+
 function Main() {
   const {
     data: slackBots,
@@ -75,8 +77,6 @@ function Main() {
 }
 
 export default function Page() {
-  const route = ADMIN_ROUTE_CONFIG[ADMIN_PATHS.SLACK_BOTS]!;
-
   return (
     <SettingsLayouts.Root>
       <SettingsLayouts.Header icon={route.icon} title={route.title} separator />

web/src/app/admin/configuration/document-processing/page.tsx

@@ -10,9 +10,9 @@ import * as SettingsLayouts from "@/layouts/settings-layouts";
 import Text from "@/refresh-components/texts/Text";
 import { cn } from "@/lib/utils";
 import { SvgLock } from "@opal/icons";
-import { ADMIN_ROUTE_CONFIG, ADMIN_PATHS } from "@/lib/admin-routes";
+import { ADMIN_ROUTES } from "@/lib/admin-routes";
 
-const route = ADMIN_ROUTE_CONFIG[ADMIN_PATHS.DOCUMENT_PROCESSING]!;
+const route = ADMIN_ROUTES.DOCUMENT_PROCESSING;
 
 function Main() {
   const {

web/src/app/admin/configuration/image-generation/page.tsx

@@ -2,9 +2,9 @@
 
 import * as SettingsLayouts from "@/layouts/settings-layouts";
 import ImageGenerationContent from "./ImageGenerationContent";
-import { ADMIN_ROUTE_CONFIG, ADMIN_PATHS } from "@/lib/admin-routes";
+import { ADMIN_ROUTES } from "@/lib/admin-routes";
 
-const route = ADMIN_ROUTE_CONFIG[ADMIN_PATHS.IMAGE_GENERATION]!;
+const route = ADMIN_ROUTES.IMAGE_GENERATION;
 
 export default function Page() {
   return (

web/src/app/admin/configuration/search/page.tsx

@@ -19,9 +19,9 @@ import { SettingsContext } from "@/providers/SettingsProvider";
 import CardSection from "@/components/admin/CardSection";
 import { ErrorCallout } from "@/components/ErrorCallout";
 import { useToastFromQuery } from "@/hooks/useToast";
-import { ADMIN_ROUTE_CONFIG, ADMIN_PATHS } from "@/lib/admin-routes";
+import { ADMIN_ROUTES } from "@/lib/admin-routes";
 
-const route = ADMIN_ROUTE_CONFIG[ADMIN_PATHS.SEARCH_SETTINGS]!;
+const route = ADMIN_ROUTES.INDEX_SETTINGS;
 
 export interface EmbeddingDetails {
   api_key: string;
@@ -131,7 +131,7 @@ function Main() {
 
           <div className="mt-4">
             <Button variant="action" href="/admin/embeddings">
-              Update Search Settings
+              Update Index Settings
             </Button>
           </div>
         </>

web/src/app/admin/configuration/web-search/page.tsx

@@ -23,10 +23,10 @@ import {
   SvgOnyxLogo,
   SvgX,
 } from "@opal/icons";
-import { ADMIN_ROUTE_CONFIG, ADMIN_PATHS } from "@/lib/admin-routes";
+import { ADMIN_ROUTES } from "@/lib/admin-routes";
 import { WebProviderSetupModal } from "@/app/admin/configuration/web-search/WebProviderSetupModal";
 
-const route = ADMIN_ROUTE_CONFIG[ADMIN_PATHS.WEB_SEARCH]!;
+const route = ADMIN_ROUTES.WEB_SEARCH;
 import {
   SEARCH_PROVIDERS_URL,
   SEARCH_PROVIDER_DETAILS,

web/src/app/admin/debug/page.tsx

@@ -16,9 +16,9 @@ import { Card } from "@/components/ui/card";
 import Text from "@/components/ui/text";
 import { Spinner } from "@/components/Spinner";
 import { SvgDownloadCloud } from "@opal/icons";
-import { ADMIN_ROUTE_CONFIG, ADMIN_PATHS } from "@/lib/admin-routes";
+import { ADMIN_ROUTES } from "@/lib/admin-routes";
 
-const route = ADMIN_ROUTE_CONFIG[ADMIN_PATHS.DEBUG]!;
+const route = ADMIN_ROUTES.DEBUG;
 
 function Main() {
   const [categories, setCategories] = useState<string[]>([]);

web/src/app/admin/discord-bot/page.tsx

@@ -19,7 +19,9 @@ import {
 import { createGuildConfig } from "@/app/admin/discord-bot/lib";
 import { DiscordGuildsTable } from "@/app/admin/discord-bot/DiscordGuildsTable";
 import { BotConfigCard } from "@/app/admin/discord-bot/BotConfigCard";
-import { ADMIN_ROUTE_CONFIG, ADMIN_PATHS } from "@/lib/admin-routes";
+import { ADMIN_ROUTES } from "@/lib/admin-routes";
+
+const route = ADMIN_ROUTES.DISCORD_BOTS;
 
 function DiscordBotContent() {
   const { data: guilds, isLoading, error, refreshGuilds } = useDiscordGuilds();
@@ -118,8 +120,6 @@ function DiscordBotContent() {
 }
 
 export default function Page() {
-  const route = ADMIN_ROUTE_CONFIG[ADMIN_PATHS.DISCORD_BOTS]!;
-
   return (
     <SettingsLayouts.Root>
       <SettingsLayouts.Header

web/src/app/admin/document-index-migration/page.tsx

@@ -3,9 +3,9 @@
 import { useState } from "react";
 import useSWR from "swr";
 import * as SettingsLayouts from "@/layouts/settings-layouts";
-import { ADMIN_ROUTE_CONFIG, ADMIN_PATHS } from "@/lib/admin-routes";
+import { ADMIN_ROUTES } from "@/lib/admin-routes";
 
-const route = ADMIN_ROUTE_CONFIG[ADMIN_PATHS.INDEX_MIGRATION]!;
+const route = ADMIN_ROUTES.INDEX_MIGRATION;
 
 import Card from "@/refresh-components/cards/Card";
 import { Content, ContentAction } from "@opal/layouts";

web/src/app/admin/documents/explorer/DocumentExplorerPage.tsx

@@ -1,11 +1,13 @@
 "use client";
 
 import * as SettingsLayouts from "@/layouts/settings-layouts";
-import { ADMIN_ROUTE_CONFIG, ADMIN_PATHS } from "@/lib/admin-routes";
+import { ADMIN_ROUTES } from "@/lib/admin-routes";
 import { Explorer } from "./Explorer";
 import { Connector } from "@/lib/connectors/connectors";
 import { DocumentSetSummary } from "@/lib/types";
 
+const route = ADMIN_ROUTES.DOCUMENT_EXPLORER;
+
 interface DocumentExplorerPageProps {
   initialSearchValue: string | undefined;
   connectors: Connector<any>[];
@@ -17,8 +19,6 @@ export default function DocumentExplorerPage({
   connectors,
   documentSets,
 }: DocumentExplorerPageProps) {
-  const route = ADMIN_ROUTE_CONFIG[ADMIN_PATHS.DOCUMENT_EXPLORER]!;
-
   return (
     <SettingsLayouts.Root>
       <SettingsLayouts.Header icon={route.icon} title={route.title} separator />

web/src/app/admin/documents/feedback/page.tsx

@@ -6,7 +6,9 @@ import { DocumentFeedbackTable } from "./DocumentFeedbackTable";
 import { numPages, numToDisplay } from "./constants";
 import Title from "@/components/ui/title";
 import * as SettingsLayouts from "@/layouts/settings-layouts";
-import { ADMIN_ROUTE_CONFIG, ADMIN_PATHS } from "@/lib/admin-routes";
+import { ADMIN_ROUTES } from "@/lib/admin-routes";
+
+const route = ADMIN_ROUTES.DOCUMENT_FEEDBACK;
 
 function Main() {
   const {
@@ -61,8 +63,6 @@ function Main() {
 }
 
 export default function Page() {
-  const route = ADMIN_ROUTE_CONFIG[ADMIN_PATHS.DOCUMENT_FEEDBACK]!;
-
   return (
     <SettingsLayouts.Root>
       <SettingsLayouts.Header icon={route.icon} title={route.title} separator />

web/src/app/admin/documents/sets/[documentSetId]/page.tsx

@@ -6,12 +6,14 @@ import { refreshDocumentSets, useDocumentSets } from "../hooks";
 import { useConnectorStatus, useUserGroups } from "@/lib/hooks";
 import { ThreeDotsLoader } from "@/components/Loading";
 import * as SettingsLayouts from "@/layouts/settings-layouts";
-import { ADMIN_ROUTE_CONFIG, ADMIN_PATHS } from "@/lib/admin-routes";
+import { ADMIN_ROUTES } from "@/lib/admin-routes";
 import CardSection from "@/components/admin/CardSection";
 import { DocumentSetCreationForm } from "../DocumentSetCreationForm";
 import { useRouter } from "next/navigation";
 import { useVectorDbEnabled } from "@/providers/SettingsProvider";
 
+const route = ADMIN_ROUTES.DOCUMENT_SETS;
+
 function Main({ documentSetId }: { documentSetId: number }) {
   const router = useRouter();
   const vectorDbEnabled = useVectorDbEnabled();
@@ -93,7 +95,6 @@ export default function Page(props: {
 }) {
   const params = use(props.params);
   const documentSetId = parseInt(params.documentSetId);
-  const route = ADMIN_ROUTE_CONFIG[ADMIN_PATHS.DOCUMENT_SETS]!;
 
   return (
     <SettingsLayouts.Root>

web/src/app/admin/documents/sets/new/page.tsx

@@ -1,7 +1,7 @@
 "use client";
 
 import * as SettingsLayouts from "@/layouts/settings-layouts";
-import { ADMIN_ROUTE_CONFIG, ADMIN_PATHS } from "@/lib/admin-routes";
+import { ADMIN_ROUTES } from "@/lib/admin-routes";
 import { DocumentSetCreationForm } from "../DocumentSetCreationForm";
 import { useConnectorStatus, useUserGroups } from "@/lib/hooks";
 import { ThreeDotsLoader } from "@/components/Loading";
@@ -11,6 +11,8 @@ import { refreshDocumentSets } from "../hooks";
 import CardSection from "@/components/admin/CardSection";
 import { useVectorDbEnabled } from "@/providers/SettingsProvider";
 
+const route = ADMIN_ROUTES.DOCUMENT_SETS;
+
 function Main() {
   const router = useRouter();
   const vectorDbEnabled = useVectorDbEnabled();
@@ -58,8 +60,6 @@ function Main() {
 }
 
 export default function Page() {
-  const route = ADMIN_ROUTE_CONFIG[ADMIN_PATHS.DOCUMENT_SETS]!;
-
   return (
     <SettingsLayouts.Root>
       <SettingsLayouts.Header

web/src/app/admin/documents/sets/page.tsx

@@ -20,7 +20,7 @@ import { ConnectorTitle } from "@/components/admin/connectors/ConnectorTitle";
 import { deleteDocumentSet } from "./lib";
 import { toast } from "@/hooks/useToast";
 import * as SettingsLayouts from "@/layouts/settings-layouts";
-import { ADMIN_ROUTE_CONFIG, ADMIN_PATHS } from "@/lib/admin-routes";
+import { ADMIN_ROUTES } from "@/lib/admin-routes";
 import {
   FiAlertTriangle,
   FiCheckCircle,
@@ -43,6 +43,7 @@ import CreateButton from "@/refresh-components/buttons/CreateButton";
 import { SourceIcon } from "@/components/SourceIcon";
 import Link from "next/link";
 
+const route = ADMIN_ROUTES.DOCUMENT_SETS;
 const numToDisplay = 50;
 
 // Component to display federated connectors with consistent styling
@@ -422,8 +423,6 @@ function Main() {
 }
 
 export default function Page() {
-  const route = ADMIN_ROUTE_CONFIG[ADMIN_PATHS.DOCUMENT_SETS]!;
-
   return (
     <SettingsLayouts.Root>
       <SettingsLayouts.Header icon={route.icon} title={route.title} separator />

web/src/app/admin/indexing/status/page.tsx

@@ -4,7 +4,7 @@ import { CCPairIndexingStatusTable } from "./CCPairIndexingStatusTable";
 import { SearchAndFilterControls } from "./SearchAndFilterControls";
 import * as SettingsLayouts from "@/layouts/settings-layouts";
 import Link from "next/link";
-import { ADMIN_ROUTE_CONFIG, ADMIN_PATHS } from "@/lib/admin-routes";
+import { ADMIN_ROUTES } from "@/lib/admin-routes";
 import Text from "@/components/ui/text";
 import { useConnectorIndexingStatusWithPagination } from "@/lib/hooks";
 import { useToastFromQuery } from "@/hooks/useToast";
@@ -18,6 +18,8 @@ import { TOGGLED_CONNECTORS_COOKIE_NAME } from "@/lib/constants";
 import { ConnectorStaggeredSkeleton } from "./ConnectorRowSkeleton";
 import { IndexingStatusRequest } from "@/lib/types";
 
+const route = ADMIN_ROUTES.INDEXING_STATUS;
+
 function Main() {
   const vectorDbEnabled = useVectorDbEnabled();
 
@@ -204,8 +206,6 @@ function Main() {
 }
 
 export default function Status() {
-  const route = ADMIN_ROUTE_CONFIG[ADMIN_PATHS.INDEXING_STATUS]!;
-
   useToastFromQuery({
     "connector-created": {
       message: "Connector created successfully",

web/src/app/admin/kg/page.tsx

@@ -31,9 +31,9 @@ import KGEntityTypes from "@/app/admin/kg/KGEntityTypes";
 import Text from "@/refresh-components/texts/Text";
 import { cn } from "@/lib/utils";
 import { SvgSettings } from "@opal/icons";
-import { ADMIN_ROUTE_CONFIG, ADMIN_PATHS } from "@/lib/admin-routes";
+import { ADMIN_ROUTES } from "@/lib/admin-routes";
 
-const route = ADMIN_ROUTE_CONFIG[ADMIN_PATHS.KNOWLEDGE_GRAPH]!;
+const route = ADMIN_ROUTES.KNOWLEDGE_GRAPH;
 
 function createDomainField(
   name: string,

web/src/app/admin/token-rate-limits/page.tsx

@@ -18,9 +18,9 @@ import { usePaidEnterpriseFeaturesEnabled } from "@/components/settings/usePaidE
 import CreateButton from "@/refresh-components/buttons/CreateButton";
 import { SvgGlobe, SvgUser, SvgUsers } from "@opal/icons";
 import { Section } from "@/layouts/general-layouts";
-import { ADMIN_ROUTE_CONFIG, ADMIN_PATHS } from "@/lib/admin-routes";
+import { ADMIN_ROUTES } from "@/lib/admin-routes";
 
-const route = ADMIN_ROUTE_CONFIG[ADMIN_PATHS.TOKEN_RATE_LIMITS]!;
+const route = ADMIN_ROUTES.TOKEN_RATE_LIMITS;
 const BASE_URL = "/api/admin/token-rate-limits";
 const GLOBAL_TOKEN_FETCH_URL = `${BASE_URL}/global`;
 const USER_TOKEN_FETCH_URL = `${BASE_URL}/users`;

web/src/app/ee/admin/groups/[groupId]/page.tsx

@@ -6,11 +6,11 @@ import { useSpecificUserGroup } from "./hook";
 import { ThreeDotsLoader } from "@/components/Loading";
 import { useConnectorStatus } from "@/lib/hooks";
 import useUsers from "@/hooks/useUsers";
-import { ADMIN_ROUTE_CONFIG, ADMIN_PATHS } from "@/lib/admin-routes";
+import { ADMIN_ROUTES } from "@/lib/admin-routes";
 import * as SettingsLayouts from "@/layouts/settings-layouts";
 import { useVectorDbEnabled } from "@/providers/SettingsProvider";
 
-const route = ADMIN_ROUTE_CONFIG[ADMIN_PATHS.GROUPS]!;
+const route = ADMIN_ROUTES.GROUPS;
 
 function Main({ groupId }: { groupId: string }) {
   const vectorDbEnabled = useVectorDbEnabled();

web/src/app/ee/admin/groups/page.tsx

@@ -8,11 +8,11 @@ import { useConnectorStatus, useUserGroups } from "@/lib/hooks";
 import useUsers from "@/hooks/useUsers";
 import { useUser } from "@/providers/UserProvider";
 import CreateButton from "@/refresh-components/buttons/CreateButton";
-import { ADMIN_ROUTE_CONFIG, ADMIN_PATHS } from "@/lib/admin-routes";
+import { ADMIN_ROUTES } from "@/lib/admin-routes";
 import * as SettingsLayouts from "@/layouts/settings-layouts";
 import { useVectorDbEnabled } from "@/providers/SettingsProvider";
 
-const route = ADMIN_ROUTE_CONFIG[ADMIN_PATHS.GROUPS]!;
+const route = ADMIN_ROUTES.GROUPS;
 
 function Main() {
   const [showForm, setShowForm] = useState(false);

web/src/app/ee/admin/performance/custom-analytics/page.tsx

@@ -1,11 +1,11 @@
 import * as SettingsLayouts from "@/layouts/settings-layouts";
 import { CUSTOM_ANALYTICS_ENABLED } from "@/lib/constants";
 import { Callout } from "@/components/ui/callout";
-import { ADMIN_ROUTE_CONFIG, ADMIN_PATHS } from "@/lib/admin-routes";
+import { ADMIN_ROUTES } from "@/lib/admin-routes";
 import Text from "@/components/ui/text";
 import { CustomAnalyticsUpdateForm } from "./CustomAnalyticsUpdateForm";
 
-const route = ADMIN_ROUTE_CONFIG[ADMIN_PATHS.CUSTOM_ANALYTICS]!;
+const route = ADMIN_ROUTES.CUSTOM_ANALYTICS;
 
 function Main() {
   if (!CUSTOM_ANALYTICS_ENABLED) {

web/src/app/ee/admin/performance/query-history/page.tsx

@@ -2,9 +2,9 @@
 
 import * as SettingsLayouts from "@/layouts/settings-layouts";
 import { QueryHistoryTable } from "@/app/ee/admin/performance/query-history/QueryHistoryTable";
-import { ADMIN_ROUTE_CONFIG, ADMIN_PATHS } from "@/lib/admin-routes";
+import { ADMIN_ROUTES } from "@/lib/admin-routes";
 
-const route = ADMIN_ROUTE_CONFIG[ADMIN_PATHS.QUERY_HISTORY]!;
+const route = ADMIN_ROUTES.QUERY_HISTORY;
 
 export default function QueryHistoryPage() {
   return (

web/src/app/ee/admin/performance/usage/page.tsx

@@ -9,10 +9,10 @@ import { useTimeRange } from "@/app/ee/admin/performance/lib";
 import UsageReports from "@/app/ee/admin/performance/usage/UsageReports";
 import Separator from "@/refresh-components/Separator";
 import { useAdminPersonas } from "@/hooks/useAdminPersonas";
-import { ADMIN_ROUTE_CONFIG, ADMIN_PATHS } from "@/lib/admin-routes";
+import { ADMIN_ROUTES } from "@/lib/admin-routes";
 import * as SettingsLayouts from "@/layouts/settings-layouts";
 
-const route = ADMIN_ROUTE_CONFIG[ADMIN_PATHS.USAGE]!;
+const route = ADMIN_ROUTES.USAGE;
 
 export default function AnalyticsPage() {
   const [timeRange, setTimeRange] = useTimeRange();

web/src/app/ee/admin/standard-answer/[id]/page.tsx

@@ -2,10 +2,10 @@ import { StandardAnswerCreationForm } from "@/app/ee/admin/standard-answer/Stand
 import { fetchSS } from "@/lib/utilsSS";
 import { ErrorCallout } from "@/components/ErrorCallout";
 import * as SettingsLayouts from "@/layouts/settings-layouts";
-import { ADMIN_ROUTE_CONFIG, ADMIN_PATHS } from "@/lib/admin-routes";
+import { ADMIN_ROUTES } from "@/lib/admin-routes";
 import { StandardAnswer, StandardAnswerCategory } from "@/lib/types";
 
-const route = ADMIN_ROUTE_CONFIG[ADMIN_PATHS.STANDARD_ANSWERS]!;
+const route = ADMIN_ROUTES.STANDARD_ANSWERS;
 
 async function Main({ id }: { id: string }) {
   const tasks = [

web/src/app/ee/admin/standard-answer/new/page.tsx

@@ -2,10 +2,10 @@ import { StandardAnswerCreationForm } from "@/app/ee/admin/standard-answer/Stand
 import { fetchSS } from "@/lib/utilsSS";
 import { ErrorCallout } from "@/components/ErrorCallout";
 import * as SettingsLayouts from "@/layouts/settings-layouts";
-import { ADMIN_ROUTE_CONFIG, ADMIN_PATHS } from "@/lib/admin-routes";
+import { ADMIN_ROUTES } from "@/lib/admin-routes";
 import { StandardAnswerCategory } from "@/lib/types";
 
-const route = ADMIN_ROUTE_CONFIG[ADMIN_PATHS.STANDARD_ANSWERS]!;
+const route = ADMIN_ROUTES.STANDARD_ANSWERS;
 
 async function Page() {
   const standardAnswerCategoriesResponse = await fetchSS(

web/src/app/ee/admin/standard-answer/page.tsx

@@ -30,10 +30,10 @@ import { TableHeader } from "@/components/ui/table";
 import CreateButton from "@/refresh-components/buttons/CreateButton";
 import { SvgEdit, SvgTrash } from "@opal/icons";
 import { Button } from "@opal/components";
-import { ADMIN_ROUTE_CONFIG, ADMIN_PATHS } from "@/lib/admin-routes";
+import { ADMIN_ROUTES } from "@/lib/admin-routes";
 const NUM_RESULTS_PER_PAGE = 10;
 
-const route = ADMIN_ROUTE_CONFIG[ADMIN_PATHS.STANDARD_ANSWERS]!;
+const route = ADMIN_ROUTES.STANDARD_ANSWERS;
 
 type Displayable = JSX.Element | string;
 

web/src/app/ee/admin/theme/page.tsx

@@ -1,7 +1,7 @@
 "use client";
 
 import * as SettingsLayouts from "@/layouts/settings-layouts";
-import { ADMIN_ROUTE_CONFIG, ADMIN_PATHS } from "@/lib/admin-routes";
+import { ADMIN_ROUTES } from "@/lib/admin-routes";
 import { Button } from "@opal/components";
 import { Disabled } from "@opal/core";
 import {
@@ -16,7 +16,7 @@ import * as Yup from "yup";
 import { EnterpriseSettings } from "@/interfaces/settings";
 import { useRouter } from "next/navigation";
 
-const route = ADMIN_ROUTE_CONFIG[ADMIN_PATHS.THEME]!;
+const route = ADMIN_ROUTES.THEME;
 
 const CHAR_LIMITS = {
   application_name: 50,

web/src/components/admin/ClientLayout.tsx

@@ -6,11 +6,10 @@ import { useSettingsContext } from "@/providers/SettingsProvider";
 import { ApplicationStatus } from "@/interfaces/settings";
 import { Button } from "@opal/components";
 import { cn } from "@/lib/utils";
-import { ADMIN_PATHS } from "@/lib/admin-routes";
+import { ADMIN_ROUTES } from "@/lib/admin-routes";
 
 export interface ClientLayoutProps {
   children: React.ReactNode;
-  enableEnterprise: boolean;
   enableCloud: boolean;
 }
 
@@ -19,40 +18,36 @@ export interface ClientLayoutProps {
 // the `py-10 px-4 md:px-12` padding below can be removed entirely and
 // this prefix list can be deleted.
 const SETTINGS_LAYOUT_PREFIXES = [
-  ADMIN_PATHS.CHAT_PREFERENCES,
-  ADMIN_PATHS.IMAGE_GENERATION,
-  ADMIN_PATHS.WEB_SEARCH,
-  ADMIN_PATHS.MCP_ACTIONS,
-  ADMIN_PATHS.OPENAPI_ACTIONS,
-  ADMIN_PATHS.BILLING,
-  ADMIN_PATHS.INDEX_MIGRATION,
-  ADMIN_PATHS.DISCORD_BOTS,
-  ADMIN_PATHS.THEME,
-  ADMIN_PATHS.LLM_MODELS,
-  ADMIN_PATHS.AGENTS,
-  ADMIN_PATHS.USERS,
-  ADMIN_PATHS.TOKEN_RATE_LIMITS,
-  ADMIN_PATHS.SEARCH_SETTINGS,
-  ADMIN_PATHS.DOCUMENT_PROCESSING,
-  ADMIN_PATHS.CODE_INTERPRETER,
-  ADMIN_PATHS.API_KEYS,
-  ADMIN_PATHS.ADD_CONNECTOR,
-  ADMIN_PATHS.INDEXING_STATUS,
-  ADMIN_PATHS.DOCUMENTS,
-  ADMIN_PATHS.DEBUG,
-  ADMIN_PATHS.KNOWLEDGE_GRAPH,
-  ADMIN_PATHS.SLACK_BOTS,
-  ADMIN_PATHS.STANDARD_ANSWERS,
-  ADMIN_PATHS.GROUPS,
-  ADMIN_PATHS.PERFORMANCE,
-  ADMIN_PATHS.SCIM,
+  ADMIN_ROUTES.CHAT_PREFERENCES.path,
+  ADMIN_ROUTES.IMAGE_GENERATION.path,
+  ADMIN_ROUTES.WEB_SEARCH.path,
+  ADMIN_ROUTES.MCP_ACTIONS.path,
+  ADMIN_ROUTES.OPENAPI_ACTIONS.path,
+  ADMIN_ROUTES.BILLING.path,
+  ADMIN_ROUTES.INDEX_MIGRATION.path,
+  ADMIN_ROUTES.DISCORD_BOTS.path,
+  ADMIN_ROUTES.THEME.path,
+  ADMIN_ROUTES.LLM_MODELS.path,
+  ADMIN_ROUTES.AGENTS.path,
+  ADMIN_ROUTES.USERS.path,
+  ADMIN_ROUTES.TOKEN_RATE_LIMITS.path,
+  ADMIN_ROUTES.INDEX_SETTINGS.path,
+  ADMIN_ROUTES.DOCUMENT_PROCESSING.path,
+  ADMIN_ROUTES.CODE_INTERPRETER.path,
+  ADMIN_ROUTES.API_KEYS.path,
+  ADMIN_ROUTES.ADD_CONNECTOR.path,
+  ADMIN_ROUTES.INDEXING_STATUS.path,
+  ADMIN_ROUTES.DOCUMENTS.path,
+  ADMIN_ROUTES.DEBUG.path,
+  ADMIN_ROUTES.KNOWLEDGE_GRAPH.path,
+  ADMIN_ROUTES.SLACK_BOTS.path,
+  ADMIN_ROUTES.STANDARD_ANSWERS.path,
+  ADMIN_ROUTES.GROUPS.path,
+  ADMIN_ROUTES.PERFORMANCE.path,
+  ADMIN_ROUTES.SCIM.path,
 ];
 
-export function ClientLayout({
-  children,
-  enableEnterprise,
-  enableCloud,
-}: ClientLayoutProps) {
+export function ClientLayout({ children, enableCloud }: ClientLayoutProps) {
   const pathname = usePathname();
   const settings = useSettingsContext();
 
@@ -86,10 +81,7 @@ export function ClientLayout({
         <div className="flex-1 min-w-0 min-h-0 overflow-y-auto">{children}</div>
       ) : (
         <>
-          <AdminSidebar
-            enableCloudSS={enableCloud}
-            enableEnterpriseSS={enableEnterprise}
-          />
+          <AdminSidebar enableCloudSS={enableCloud} />
           <div
             data-main-container
             className={cn(

web/src/components/admin/Layout.tsx

@@ -2,10 +2,7 @@ import { redirect } from "next/navigation";
 import type { Route } from "next";
 import { requireAdminAuth } from "@/lib/auth/requireAuth";
 import { ClientLayout } from "./ClientLayout";
-import {
-  NEXT_PUBLIC_CLOUD_ENABLED,
-  SERVER_SIDE_ONLY__PAID_ENTERPRISE_FEATURES_ENABLED,
-} from "@/lib/constants";
+import { NEXT_PUBLIC_CLOUD_ENABLED } from "@/lib/constants";
 import { AnnouncementBanner } from "../header/AnnouncementBanner";
 
 export interface LayoutProps {
@@ -22,10 +19,7 @@ export default async function Layout({ children }: LayoutProps) {
   }
 
   return (
-    <ClientLayout
-      enableEnterprise={SERVER_SIDE_ONLY__PAID_ENTERPRISE_FEATURES_ENABLED}
-      enableCloud={NEXT_PUBLIC_CLOUD_ENABLED}
-    >
+    <ClientLayout enableCloud={NEXT_PUBLIC_CLOUD_ENABLED}>
       <AnnouncementBanner />
       {children}
     </ClientLayout>

web/src/hooks/useVoiceRecorder.ts

@@ -1,7 +1,5 @@
 import { useState, useRef, useCallback, useEffect } from "react";
 
-import { IS_DEV } from "@/lib/constants";
-
 // Target format for OpenAI Realtime API
 const TARGET_SAMPLE_RATE = 24000;
 const CHUNK_INTERVAL_MS = 250;
@@ -247,8 +245,9 @@ class VoiceRecorderSession {
     const { token } = await tokenResponse.json();
 
     const protocol = window.location.protocol === "https:" ? "wss:" : "ws:";
-    const host = IS_DEV ? "localhost:8080" : window.location.host;
-    const path = IS_DEV
+    const isDev = window.location.port === "3000";
+    const host = isDev ? "localhost:8080" : window.location.host;
+    const path = isDev
       ? "/voice/transcribe/stream"
       : "/api/voice/transcribe/stream";
     return `${protocol}//${host}${path}?token=${encodeURIComponent(token)}`;

web/src/layouts/app-layouts.tsx

@@ -65,6 +65,7 @@ import useAppFocus from "@/hooks/useAppFocus";
 import { useQueryController } from "@/providers/QueryControllerProvider";
 import { usePaidEnterpriseFeaturesEnabled } from "@/components/settings/usePaidEnterpriseFeaturesEnabled";
 import useBrowserInfo from "@/hooks/useBrowserInfo";
+import { APP_SLOGAN } from "@/lib/constants";
 
 /**
  * App Header Component
@@ -461,7 +462,7 @@ function Footer() {
     settings?.enterpriseSettings?.custom_lower_disclaimer_content ||
     `[Onyx ${
       settings?.webVersion || "dev"
-    }](https://www.onyx.app/) - Open Source AI Platform`;
+    }](https://www.onyx.app/) - ${APP_SLOGAN}`;
 
   return (
     <footer

web/src/layouts/general-layouts.tsx

@@ -9,7 +9,7 @@ import React from "react";
 export type FlexDirection = "row" | "column";
 export type JustifyContent = "start" | "center" | "end" | "between";
 export type AlignItems = "start" | "center" | "end" | "stretch";
-export type Length = "auto" | "fit" | "full";
+export type Length = "auto" | "fit" | "full" | number;
 
 const flexDirectionClassMap: Record<FlexDirection, string> = {
   row: "flex-row",
@@ -90,11 +90,12 @@ export const heightClassmap: Record<Length, string> = {
  * @remarks
  * - The component defaults to column layout when no direction is specified
  * - Full width and height by default
- * - Prevents style overrides (className and style props are not available)
+ * - Accepts className for additional styling; style prop is not available
  * - Import using namespace import for consistent usage: `import * as GeneralLayouts from "@/layouts/general-layouts"`
  */
 export interface SectionProps
   extends WithoutStyles<React.HtmlHTMLAttributes<HTMLDivElement>> {
+  className?: string;
   flexDirection?: FlexDirection;
   justifyContent?: JustifyContent;
   alignItems?: AlignItems;
@@ -116,6 +117,7 @@ export interface SectionProps
  * wrap a `Section` without affecting layout.
  */
 function Section({
+  className,
   flexDirection = "column",
   justifyContent = "center",
   alignItems = "center",
@@ -137,13 +139,20 @@ function Section({
         flexDirectionClassMap[flexDirection],
         justifyClassMap[justifyContent],
         alignClassMap[alignItems],
-        widthClassmap[width],
-        heightClassmap[height],
+        typeof width === "string" && widthClassmap[width],
+        typeof height === "string" && heightClassmap[height],
+        typeof height === "number" && "overflow-hidden",
 
         wrap && "flex-wrap",
-        dbg && "dbg-red"
+        dbg && "dbg-red",
+        className
       )}
-      style={{ gap: `${gap}rem`, padding: `${padding}rem` }}
+      style={{
+        gap: `${gap}rem`,
+        padding: `${padding}rem`,
+        ...(typeof width === "number" && { width: `${width}rem` }),
+        ...(typeof height === "number" && { height: `${height}rem` }),
+      }}
       {...rest}
     />
   );

web/src/lib/admin-routes.ts

@@ -3,6 +3,7 @@ import {
   SvgActions,
   SvgActivity,
   SvgArrowExchange,
+  SvgAudio,
   SvgBarChart,
   SvgBookOpen,
   SvgBubbleText,
@@ -10,243 +11,254 @@ import {
   SvgCpu,
   SvgDiscordMono,
   SvgDownload,
+  SvgEmpty,
   SvgFileText,
-  SvgFolder,
+  SvgFiles,
   SvgGlobe,
+  SvgHistory,
   SvgImage,
-  SvgKey,
   SvgMcp,
   SvgNetworkGraph,
   SvgOnyxOctagon,
   SvgPaintBrush,
-  SvgSearch,
-  SvgServer,
-  SvgShield,
+  SvgProgressBars,
+  SvgSearchMenu,
   SvgSlack,
   SvgTerminal,
   SvgThumbsUp,
   SvgUploadCloud,
   SvgUser,
+  SvgUserKey,
   SvgUserSync,
   SvgUsers,
   SvgWallet,
   SvgZoomIn,
 } from "@opal/icons";
 
-/**
- * Canonical path constants for every admin route.
- */
-export const ADMIN_PATHS = {
-  INDEXING_STATUS: "/admin/indexing/status",
-  ADD_CONNECTOR: "/admin/add-connector",
-  DOCUMENT_SETS: "/admin/documents/sets",
-  DOCUMENT_EXPLORER: "/admin/documents/explorer",
-  DOCUMENT_FEEDBACK: "/admin/documents/feedback",
-  AGENTS: "/admin/agents",
-  SLACK_BOTS: "/admin/bots",
-  DISCORD_BOTS: "/admin/discord-bot",
-  MCP_ACTIONS: "/admin/actions/mcp",
-  OPENAPI_ACTIONS: "/admin/actions/open-api",
-  STANDARD_ANSWERS: "/admin/standard-answer",
-  GROUPS: "/admin/groups",
-  CHAT_PREFERENCES: "/admin/configuration/chat-preferences",
-  LLM_MODELS: "/admin/configuration/llm",
-  WEB_SEARCH: "/admin/configuration/web-search",
-  IMAGE_GENERATION: "/admin/configuration/image-generation",
-  CODE_INTERPRETER: "/admin/configuration/code-interpreter",
-  SEARCH_SETTINGS: "/admin/configuration/search",
-  DOCUMENT_PROCESSING: "/admin/configuration/document-processing",
-  KNOWLEDGE_GRAPH: "/admin/kg",
-  USERS: "/admin/users",
-  API_KEYS: "/admin/api-key",
-  TOKEN_RATE_LIMITS: "/admin/token-rate-limits",
-  USAGE: "/admin/performance/usage",
-  QUERY_HISTORY: "/admin/performance/query-history",
-  CUSTOM_ANALYTICS: "/admin/performance/custom-analytics",
-  THEME: "/admin/theme",
-  BILLING: "/admin/billing",
-  INDEX_MIGRATION: "/admin/document-index-migration",
-  SCIM: "/admin/scim",
-  DEBUG: "/admin/debug",
-  // Prefix-only entries (used in SETTINGS_LAYOUT_PREFIXES but have no
-  // single page header of their own)
-  DOCUMENTS: "/admin/documents",
-  PERFORMANCE: "/admin/performance",
-} as const;
-
-interface AdminRouteConfig {
+export interface AdminRouteEntry {
+  path: string;
   icon: IconFunctionComponent;
   title: string;
   sidebarLabel: string;
 }
 
 /**
- * Single source of truth for icon, page-header title, and sidebar label
- * for every admin route. Keyed by path from `ADMIN_PATHS`.
+ * Single source of truth for every admin route: path, icon, page-header
+ * title, and sidebar label.
  */
-export const ADMIN_ROUTE_CONFIG: Record<string, AdminRouteConfig> = {
-  [ADMIN_PATHS.INDEXING_STATUS]: {
+export const ADMIN_ROUTES = {
+  INDEXING_STATUS: {
+    path: "/admin/indexing/status",
     icon: SvgBookOpen,
     title: "Existing Connectors",
     sidebarLabel: "Existing Connectors",
   },
-  [ADMIN_PATHS.ADD_CONNECTOR]: {
+  ADD_CONNECTOR: {
+    path: "/admin/add-connector",
     icon: SvgUploadCloud,
     title: "Add Connector",
     sidebarLabel: "Add Connector",
   },
-  [ADMIN_PATHS.DOCUMENT_SETS]: {
-    icon: SvgFolder,
+  DOCUMENT_SETS: {
+    path: "/admin/documents/sets",
+    icon: SvgFiles,
     title: "Document Sets",
     sidebarLabel: "Document Sets",
   },
-  [ADMIN_PATHS.DOCUMENT_EXPLORER]: {
+  DOCUMENT_EXPLORER: {
+    path: "/admin/documents/explorer",
     icon: SvgZoomIn,
     title: "Document Explorer",
     sidebarLabel: "Explorer",
   },
-  [ADMIN_PATHS.DOCUMENT_FEEDBACK]: {
+  DOCUMENT_FEEDBACK: {
+    path: "/admin/documents/feedback",
     icon: SvgThumbsUp,
     title: "Document Feedback",
     sidebarLabel: "Feedback",
   },
-  [ADMIN_PATHS.AGENTS]: {
+  AGENTS: {
+    path: "/admin/agents",
     icon: SvgOnyxOctagon,
     title: "Agents",
     sidebarLabel: "Agents",
   },
-  [ADMIN_PATHS.SLACK_BOTS]: {
+  SLACK_BOTS: {
+    path: "/admin/bots",
     icon: SvgSlack,
-    title: "Slack Bots",
-    sidebarLabel: "Slack Bots",
+    title: "Slack Integration",
+    sidebarLabel: "Slack Integration",
   },
-  [ADMIN_PATHS.DISCORD_BOTS]: {
+  DISCORD_BOTS: {
+    path: "/admin/discord-bot",
     icon: SvgDiscordMono,
-    title: "Discord Bots",
-    sidebarLabel: "Discord Bots",
+    title: "Discord Integration",
+    sidebarLabel: "Discord Integration",
   },
-  [ADMIN_PATHS.MCP_ACTIONS]: {
+  MCP_ACTIONS: {
+    path: "/admin/actions/mcp",
     icon: SvgMcp,
     title: "MCP Actions",
     sidebarLabel: "MCP Actions",
   },
-  [ADMIN_PATHS.OPENAPI_ACTIONS]: {
+  OPENAPI_ACTIONS: {
+    path: "/admin/actions/open-api",
     icon: SvgActions,
     title: "OpenAPI Actions",
     sidebarLabel: "OpenAPI Actions",
   },
-  [ADMIN_PATHS.STANDARD_ANSWERS]: {
+  STANDARD_ANSWERS: {
+    path: "/admin/standard-answer",
     icon: SvgClipboard,
     title: "Standard Answers",
     sidebarLabel: "Standard Answers",
   },
-  [ADMIN_PATHS.GROUPS]: {
+  GROUPS: {
+    path: "/admin/groups",
     icon: SvgUsers,
     title: "Manage User Groups",
     sidebarLabel: "Groups",
   },
-  [ADMIN_PATHS.CHAT_PREFERENCES]: {
+  CHAT_PREFERENCES: {
+    path: "/admin/configuration/chat-preferences",
     icon: SvgBubbleText,
     title: "Chat Preferences",
     sidebarLabel: "Chat Preferences",
   },
-  [ADMIN_PATHS.LLM_MODELS]: {
+  LLM_MODELS: {
+    path: "/admin/configuration/llm",
     icon: SvgCpu,
     title: "Language Models",
     sidebarLabel: "Language Models",
   },
-  [ADMIN_PATHS.WEB_SEARCH]: {
+  WEB_SEARCH: {
+    path: "/admin/configuration/web-search",
     icon: SvgGlobe,
     title: "Web Search",
     sidebarLabel: "Web Search",
   },
-  [ADMIN_PATHS.IMAGE_GENERATION]: {
+  IMAGE_GENERATION: {
+    path: "/admin/configuration/image-generation",
     icon: SvgImage,
     title: "Image Generation",
     sidebarLabel: "Image Generation",
   },
-  [ADMIN_PATHS.CODE_INTERPRETER]: {
+  VOICE: {
+    path: "/admin/configuration/voice",
+    icon: SvgAudio,
+    title: "Voice",
+    sidebarLabel: "Voice",
+  },
+  CODE_INTERPRETER: {
+    path: "/admin/configuration/code-interpreter",
     icon: SvgTerminal,
     title: "Code Interpreter",
     sidebarLabel: "Code Interpreter",
   },
-  [ADMIN_PATHS.SEARCH_SETTINGS]: {
-    icon: SvgSearch,
-    title: "Search Settings",
-    sidebarLabel: "Search Settings",
+  INDEX_SETTINGS: {
+    path: "/admin/configuration/search",
+    icon: SvgSearchMenu,
+    title: "Index Settings",
+    sidebarLabel: "Index Settings",
   },
-  [ADMIN_PATHS.DOCUMENT_PROCESSING]: {
+  DOCUMENT_PROCESSING: {
+    path: "/admin/configuration/document-processing",
     icon: SvgFileText,
     title: "Document Processing",
     sidebarLabel: "Document Processing",
   },
-  [ADMIN_PATHS.KNOWLEDGE_GRAPH]: {
+  KNOWLEDGE_GRAPH: {
+    path: "/admin/kg",
     icon: SvgNetworkGraph,
     title: "Knowledge Graph",
     sidebarLabel: "Knowledge Graph",
   },
-  [ADMIN_PATHS.USERS]: {
+  USERS: {
+    path: "/admin/users",
     icon: SvgUser,
     title: "Users & Requests",
     sidebarLabel: "Users",
   },
-  [ADMIN_PATHS.API_KEYS]: {
-    icon: SvgKey,
-    title: "API Keys",
-    sidebarLabel: "API Keys",
+  API_KEYS: {
+    path: "/admin/api-key",
+    icon: SvgUserKey,
+    title: "Service Accounts",
+    sidebarLabel: "Service Accounts",
   },
-  [ADMIN_PATHS.TOKEN_RATE_LIMITS]: {
-    icon: SvgShield,
-    title: "Token Rate Limits",
-    sidebarLabel: "Token Rate Limits",
+  TOKEN_RATE_LIMITS: {
+    path: "/admin/token-rate-limits",
+    icon: SvgProgressBars,
+    title: "Spending Limits",
+    sidebarLabel: "Spending Limits",
   },
-  [ADMIN_PATHS.USAGE]: {
+  USAGE: {
+    path: "/admin/performance/usage",
     icon: SvgActivity,
     title: "Usage Statistics",
     sidebarLabel: "Usage Statistics",
   },
-  [ADMIN_PATHS.QUERY_HISTORY]: {
-    icon: SvgServer,
+  QUERY_HISTORY: {
+    path: "/admin/performance/query-history",
+    icon: SvgHistory,
     title: "Query History",
     sidebarLabel: "Query History",
   },
-  [ADMIN_PATHS.CUSTOM_ANALYTICS]: {
+  CUSTOM_ANALYTICS: {
+    path: "/admin/performance/custom-analytics",
     icon: SvgBarChart,
     title: "Custom Analytics",
     sidebarLabel: "Custom Analytics",
   },
-  [ADMIN_PATHS.THEME]: {
+  THEME: {
+    path: "/admin/theme",
     icon: SvgPaintBrush,
     title: "Appearance & Theming",
     sidebarLabel: "Appearance & Theming",
   },
-  [ADMIN_PATHS.BILLING]: {
+  BILLING: {
+    path: "/admin/billing",
     icon: SvgWallet,
     title: "Plans & Billing",
     sidebarLabel: "Plans & Billing",
   },
-  [ADMIN_PATHS.INDEX_MIGRATION]: {
+  INDEX_MIGRATION: {
+    path: "/admin/document-index-migration",
     icon: SvgArrowExchange,
     title: "Document Index Migration",
     sidebarLabel: "Document Index Migration",
   },
-  [ADMIN_PATHS.SCIM]: {
+  SCIM: {
+    path: "/admin/scim",
     icon: SvgUserSync,
     title: "SCIM",
     sidebarLabel: "SCIM",
   },
-  [ADMIN_PATHS.DEBUG]: {
+  DEBUG: {
+    path: "/admin/debug",
     icon: SvgDownload,
     title: "Debug Logs",
     sidebarLabel: "Debug Logs",
   },
-};
+  // Prefix-only entries used for layout matching — not rendered as sidebar
+  // items or page headers.
+  DOCUMENTS: {
+    path: "/admin/documents",
+    icon: SvgEmpty,
+    title: "",
+    sidebarLabel: "",
+  },
+  PERFORMANCE: {
+    path: "/admin/performance",
+    icon: SvgEmpty,
+    title: "",
+    sidebarLabel: "",
+  },
+} as const satisfies Record<string, AdminRouteEntry>;
 
 /**
- * Helper that converts a route config entry into the `{ name, icon, link }`
- * shape expected by the sidebar. Extra fields (e.g. `error`) can be spread in.
+ * Helper that converts a route entry into the `{ name, icon, link }`
+ * shape expected by the sidebar.
  */
-export function sidebarItem(path: string) {
-  const config = ADMIN_ROUTE_CONFIG[path]!;
-  return { name: config.sidebarLabel, icon: config.icon, link: path };
+export function sidebarItem(route: AdminRouteEntry) {
+  return { name: route.sidebarLabel, icon: route.icon, link: route.path };
 }

web/src/lib/constants.ts

@@ -1,5 +1,3 @@
-export const IS_DEV = process.env.NODE_ENV === "development";
-
 export enum AuthType {
   BASIC = "basic",
   GOOGLE_OAUTH = "google_oauth",
@@ -110,7 +108,6 @@ export const CREDENTIAL_JSON = "credential_json";
 
 export const MODAL_ROOT_ID = "modal-root";
 
-export const ANONYMOUS_USER_NAME = "Anonymous";
 export const UNNAMED_CHAT = "New Chat";
 
 export const DEFAULT_AGENT_ID = 0;
@@ -133,3 +130,5 @@ export const LOGO_UNFOLDED_SIZE_PX = 88;
 
 export const DEFAULT_CONTEXT_TOKENS = 120_000;
 export const MAX_CHUNKS_FED_TO_CHAT = 25;
+
+export const APP_SLOGAN = "Open Source AI Platform";

web/src/lib/streamingTTS.ts

@@ -3,8 +3,6 @@
  * Plays audio chunks as they arrive for smooth, low-latency playback.
  */
 
-import { IS_DEV } from "@/lib/constants";
-
 /**
  * HTTPStreamingTTSPlayer - Uses HTTP streaming with MediaSource Extensions
  * for smooth, gapless audio playback. This is the recommended approach for
@@ -384,8 +382,9 @@ export class WebSocketStreamingTTSPlayer {
     const { token } = await tokenResponse.json();
 
     const protocol = window.location.protocol === "https:" ? "wss:" : "ws:";
-    const host = IS_DEV ? "localhost:8080" : window.location.host;
-    const path = IS_DEV
+    const isDev = window.location.port === "3000";
+    const host = isDev ? "localhost:8080" : window.location.host;
+    const path = isDev
       ? "/voice/synthesize/stream"
       : "/api/voice/synthesize/stream";
     return `${protocol}//${host}${path}?token=${encodeURIComponent(token)}`;

web/src/lib/user.ts

@@ -1,4 +1,4 @@
-import { User } from "./types";
+import { User } from "@/lib/types";
 
 export const checkUserIsNoAuthUser = (userId: string) => {
   return userId === "__no_auth_user__";
@@ -113,3 +113,18 @@ export async function refreshToken(
     throw error;
   }
 }
+
+export function getUserDisplayName(user: User | null): string {
+  // Prioritize custom personal name if set
+  if (!!user?.personalization?.name) return user.personalization.name;
+  // Then, prioritize personal email
+  if (!!user?.email) {
+    const atIndex = user.email.indexOf("@");
+    if (atIndex > 0) {
+      return user.email.substring(0, atIndex);
+    }
+  }
+
+  // If nothing works, then fall back to anonymous user name
+  return "Anonymous";
+}

web/src/refresh-components/Chip.tsx

@@ -1,3 +1,4 @@
+import { cn } from "@/lib/utils";
 import Text from "@/refresh-components/texts/Text";
 import { SvgX } from "@opal/icons";
 import { Button } from "@opal/components";
@@ -10,6 +11,8 @@ export interface ChipProps {
   rightIcon?: React.FunctionComponent<IconProps>;
   onRemove?: () => void;
   smallLabel?: boolean;
+  /** When true, applies warning-coloured styling to the right icon. */
+  error?: boolean;
 }
 
 /**
@@ -29,16 +32,27 @@ export default function Chip({
   rightIcon: RightIcon,
   onRemove,
   smallLabel = true,
+  error = false,
 }: ChipProps) {
   return (
-    <div className="flex items-center gap-1 px-1.5 py-0.5 rounded-08 bg-background-tint-02">
+    <div
+      className={cn(
+        "flex items-center gap-1 px-1.5 py-0.5 rounded-08",
+        "bg-background-tint-02"
+      )}
+    >
       {Icon && <Icon size={12} className="text-text-03" />}
       {children && (
         <Text figureSmallLabel={smallLabel} text03>
           {children}
         </Text>
       )}
-      {RightIcon && <RightIcon size={14} className="text-text-03" />}
+      {RightIcon && (
+        <RightIcon
+          size={14}
+          className={cn(error ? "text-status-warning-05" : "text-text-03")}
+        />
+      )}
       {onRemove && (
         <Button
           onClick={(e) => {

web/src/refresh-components/Popover.tsx

@@ -107,9 +107,10 @@ const PopoverClose = PopoverPrimitive.Close;
  * </Popover.Content>
  * ```
  */
-type PopoverWidths = "fit" | "md" | "lg" | "xl" | "trigger";
+type PopoverWidths = "fit" | "sm" | "md" | "lg" | "xl" | "trigger";
 const widthClasses: Record<PopoverWidths, string> = {
   fit: "w-fit",
+  sm: "w-[10rem]",
   md: "w-[12rem]",
   lg: "w-[15rem]",
   xl: "w-[18rem]",
@@ -120,25 +121,29 @@ interface PopoverContentProps
     React.ComponentPropsWithoutRef<typeof PopoverPrimitive.Content>
   > {
   width?: PopoverWidths;
+  /** Portal container. Set to a DOM element to render inside it (e.g. inside a modal). */
+  container?: HTMLElement | null;
   ref?: React.Ref<React.ComponentRef<typeof PopoverPrimitive.Content>>;
 }
 function PopoverContent({
   width = "fit",
+  container,
   align = "center",
   sideOffset = 4,
   ref,
   ...props
 }: PopoverContentProps) {
   return (
-    <PopoverPrimitive.Portal>
+    <PopoverPrimitive.Portal container={container}>
       <PopoverPrimitive.Content
         ref={ref}
         align={align}
         sideOffset={sideOffset}
         collisionPadding={8}
         className={cn(
-          "bg-background-neutral-00 p-1 z-popover rounded-12 overflow-hidden border shadow-md data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2",
+          "bg-background-neutral-00 p-1 z-popover rounded-12 border shadow-md data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2",
           "max-h-[var(--radix-popover-content-available-height)]",
+          "overflow-hidden",
           widthClasses[width]
         )}
         {...props}

web/src/refresh-components/Separator.tsx

@@ -7,6 +7,8 @@ import { cn } from "@/lib/utils";
 export interface SeparatorProps
   extends React.ComponentPropsWithoutRef<typeof SeparatorPrimitive.Root> {
   noPadding?: boolean;
+  /** Custom horizontal padding in rem. Overrides the default padding. */
+  paddingXRem?: number;
 }
 
 /**
@@ -34,6 +36,7 @@ const Separator = React.forwardRef(
   (
     {
       noPadding,
+      paddingXRem,
 
       className,
       orientation = "horizontal",
@@ -46,9 +49,17 @@ const Separator = React.forwardRef(
 
     return (
       <div
+        style={{
+          ...(paddingXRem != null
+            ? {
+                paddingLeft: `${paddingXRem}rem`,
+                paddingRight: `${paddingXRem}rem`,
+              }
+            : {}),
+        }}
         className={cn(
           isHorizontal ? "w-full" : "h-full",
-          !noPadding && (isHorizontal ? "py-4" : "px-4"),
+          paddingXRem == null && !noPadding && (isHorizontal ? "py-4" : "px-4"),
           className
         )}
       >

web/src/refresh-components/ShadowDiv.tsx

@@ -105,7 +105,7 @@ export default function ShadowDiv({
   }, [containerRef, checkScroll]);
 
   return (
-    <div className="relative">
+    <div className="relative min-h-0">
       <div
         ref={containerRef}
         className={cn("overflow-y-auto", className)}
@@ -118,7 +118,7 @@ export default function ShadowDiv({
       {!bottomOnly && (
         <div
           className={cn(
-            "absolute top-0 left-0 right-0 pointer-events-none",
+            "absolute top-0 left-0 right-0 pointer-events-none transition-opacity duration-150",
             showTopShadow ? "opacity-100" : "opacity-0"
           )}
           style={{
@@ -132,7 +132,7 @@ export default function ShadowDiv({
       {!topOnly && (
         <div
           className={cn(
-            "absolute bottom-0 left-0 right-0 pointer-events-none",
+            "absolute bottom-0 left-0 right-0 pointer-events-none transition-opacity duration-150",
             showBottomShadow ? "opacity-100" : "opacity-0"
           )}
           style={{

web/src/refresh-components/inputs/InputChipField.tsx

@@ -97,16 +97,8 @@ function InputChipField({
           <Chip
             key={chip.id}
             onRemove={disabled ? undefined : () => onRemoveChip(chip.id)}
-            rightIcon={
-              chip.error
-                ? (props) => (
-                    <SvgAlertTriangle
-                      {...props}
-                      className="text-status-warning-text"
-                    />
-                  )
-                : undefined
-            }
+            rightIcon={chip.error ? SvgAlertTriangle : undefined}
+            error={chip.error}
             smallLabel={layout === "stacked"}
           >
             {chip.label}
@@ -124,7 +116,7 @@ function InputChipField({
         value={value}
         onChange={(e) => onChange(e.target.value)}
         onKeyDown={handleKeyDown}
-        placeholder={chips.length === 0 ? placeholder : undefined}
+        placeholder={placeholder}
         className={cn(
           "flex-1 min-w-[80px] h-[1.5rem] bg-transparent p-0.5 focus:outline-none",
           innerClasses[variant],

web/src/refresh-pages/admin/ChatPreferencesPage.tsx

@@ -24,7 +24,7 @@ import {
   SvgFold,
   SvgExternalLink,
 } from "@opal/icons";
-import { ADMIN_ROUTE_CONFIG, ADMIN_PATHS } from "@/lib/admin-routes";
+import { ADMIN_ROUTES } from "@/lib/admin-routes";
 import { Content } from "@opal/layouts";
 import {
   useSettingsContext,
@@ -58,7 +58,7 @@ import useFilter from "@/hooks/useFilter";
 import { MCPServer } from "@/lib/tools/interfaces";
 import type { IconProps } from "@opal/types";
 
-const route = ADMIN_ROUTE_CONFIG[ADMIN_PATHS.CHAT_PREFERENCES]!;
+const route = ADMIN_ROUTES.CHAT_PREFERENCES;
 
 interface DefaultAgentConfiguration {
   tool_ids: number[];

web/src/refresh-pages/admin/CodeInterpreterPage.tsx

@@ -11,7 +11,7 @@ import {
   SvgUnplug,
   SvgXOctagon,
 } from "@opal/icons";
-import { ADMIN_ROUTE_CONFIG, ADMIN_PATHS } from "@/lib/admin-routes";
+import { ADMIN_ROUTES } from "@/lib/admin-routes";
 import { Section } from "@/layouts/general-layouts";
 import { Button } from "@opal/components";
 import { Disabled } from "@opal/core";
@@ -23,7 +23,7 @@ import { updateCodeInterpreter } from "@/lib/admin/code-interpreter/svc";
 import { ContentAction } from "@opal/layouts";
 import { toast } from "@/hooks/useToast";
 
-const route = ADMIN_ROUTE_CONFIG[ADMIN_PATHS.CODE_INTERPRETER]!;
+const route = ADMIN_ROUTES.CODE_INTERPRETER;
 
 interface CodeInterpreterCardProps {
   variant?: CardProps["variant"];

web/src/refresh-pages/admin/LLMConfigurationPage.tsx

@@ -13,7 +13,7 @@ import { Button } from "@opal/components";
 import { Hoverable } from "@opal/core";
 import { SvgArrowExchange, SvgSettings, SvgTrash } from "@opal/icons";
 import * as SettingsLayouts from "@/layouts/settings-layouts";
-import { ADMIN_ROUTE_CONFIG, ADMIN_PATHS } from "@/lib/admin-routes";
+import { ADMIN_ROUTES } from "@/lib/admin-routes";
 import * as GeneralLayouts from "@/layouts/general-layouts";
 import {
   getProviderDisplayName,
@@ -47,7 +47,7 @@ import { LMStudioForm } from "@/sections/modals/llmConfig/LMStudioForm";
 import { LiteLLMProxyModal } from "@/sections/modals/llmConfig/LiteLLMProxyModal";
 import { Section } from "@/layouts/general-layouts";
 
-const route = ADMIN_ROUTE_CONFIG[ADMIN_PATHS.LLM_MODELS]!;
+const route = ADMIN_ROUTES.LLM_MODELS;
 
 // ============================================================================
 // Provider form mapping (keyed by provider name from the API)

web/src/refresh-pages/admin/UsersPage/EditUserModal.tsx

@@ -1,23 +1,26 @@
 "use client";
 
-import { useState, useMemo, useRef, useCallback } from "react";
+import { useState, useMemo, useCallback } from "react";
 import { Button } from "@opal/components";
 import { SvgUsers, SvgUser, SvgLogOut, SvgCheck } from "@opal/icons";
 import { Disabled } from "@opal/core";
 import { ContentAction } from "@opal/layouts";
 import Modal from "@/refresh-components/Modal";
-import Text from "@/refresh-components/texts/Text";
 import InputTypeIn from "@/refresh-components/inputs/InputTypeIn";
 import InputSelect from "@/refresh-components/inputs/InputSelect";
+import Popover from "@/refresh-components/Popover";
 import LineItem from "@/refresh-components/buttons/LineItem";
 import Separator from "@/refresh-components/Separator";
 import ShadowDiv from "@/refresh-components/ShadowDiv";
+import SimpleTooltip from "@/refresh-components/SimpleTooltip";
 import { Section } from "@/layouts/general-layouts";
 import { toast } from "@/hooks/useToast";
 import { UserRole, USER_ROLE_LABELS } from "@/lib/types";
+import { usePaidEnterpriseFeaturesEnabled } from "@/components/settings/usePaidEnterpriseFeaturesEnabled";
 import useGroups from "@/hooks/useGroups";
 import { addUserToGroup, removeUserFromGroup, setUserRole } from "./svc";
 import type { UserRow } from "./interfaces";
+import { cn } from "../../../lib/utils";
 
 // ---------------------------------------------------------------------------
 // Constants
@@ -33,7 +36,7 @@ const ASSIGNABLE_ROLES: UserRole[] = [
 // Types
 // ---------------------------------------------------------------------------
 
-interface EditGroupsModalProps {
+interface EditUserModalProps {
   user: UserRow & { id: string };
   onClose: () => void;
   onMutate: () => void;
@@ -43,25 +46,16 @@ interface EditGroupsModalProps {
 // Component
 // ---------------------------------------------------------------------------
 
-export default function EditGroupsModal({
+export default function EditUserModal({
   user,
   onClose,
   onMutate,
-}: EditGroupsModalProps) {
+}: EditUserModalProps) {
+  const isPaidEnterpriseFeaturesEnabled = usePaidEnterpriseFeaturesEnabled();
   const { data: allGroups, isLoading: groupsLoading } = useGroups();
   const [searchTerm, setSearchTerm] = useState("");
-  const [dropdownOpen, setDropdownOpen] = useState(false);
   const [isSubmitting, setIsSubmitting] = useState(false);
-  const containerRef = useRef<HTMLDivElement>(null);
-
-  const closeDropdown = useCallback(() => {
-    // Delay to allow click events on dropdown items to fire before closing
-    setTimeout(() => {
-      if (!containerRef.current?.contains(document.activeElement)) {
-        setDropdownOpen(false);
-      }
-    }, 0);
-  }, []);
+  const [popoverOpen, setPopoverOpen] = useState(false);
   const [selectedRole, setSelectedRole] = useState<UserRole | "">(
     user.role ?? ""
   );
@@ -95,6 +89,10 @@ export default function EditGroupsModal({
     );
   }, [memberGroupIds, initialMemberGroupIds]);
 
+  const visibleRoles = isPaidEnterpriseFeaturesEnabled
+    ? ASSIGNABLE_ROLES
+    : ASSIGNABLE_ROLES.filter((r) => r !== UserRole.GLOBAL_CURATOR);
+
   const hasRoleChange =
     user.role !== null && selectedRole !== "" && selectedRole !== user.role;
   const hasChanges = hasGroupChanges || hasRoleChange;
@@ -160,10 +158,17 @@ export default function EditGroupsModal({
   };
 
   const displayName = user.personal_name ?? user.email;
+  const [contentEl, setContentEl] = useState<HTMLDivElement | null>(null);
+  const contentRef = useCallback((node: HTMLDivElement | null) => {
+    setContentEl(node);
+  }, []);
 
   return (
-    <Modal open onOpenChange={(isOpen) => !isOpen && onClose()}>
-      <Modal.Content width="sm">
+    <Modal
+      open
+      onOpenChange={(isOpen) => !isOpen && !isSubmitting && onClose()}
+    >
+      <Modal.Content width="sm" ref={contentRef}>
         <Modal.Header
           icon={SvgUsers}
           title="Edit User's Groups & Roles"
@@ -172,108 +177,119 @@ export default function EditGroupsModal({
               ? `${user.personal_name} (${user.email})`
               : user.email
           }
-          onClose={onClose}
+          onClose={isSubmitting ? undefined : onClose}
         />
         <Modal.Body twoTone>
-          <Section
-            gap={1}
-            height="auto"
-            alignItems="stretch"
-            justifyContent="start"
-          >
-            {/* Subsection: white card behind search + groups */}
-            <div className="relative">
-              <div className="absolute -inset-2 bg-background-neutral-00 rounded-12" />
-              <Section
-                gap={0.5}
-                height="auto"
-                alignItems="stretch"
-                justifyContent="start"
-              >
-                <div ref={containerRef} className="relative">
-                  <InputTypeIn
-                    value={searchTerm}
-                    onChange={(e) => {
-                      setSearchTerm(e.target.value);
-                      if (!dropdownOpen) setDropdownOpen(true);
-                    }}
-                    onFocus={() => setDropdownOpen(true)}
-                    onBlur={closeDropdown}
-                    placeholder="Search groups to join..."
-                    leftSearchIcon
-                  />
-                  {dropdownOpen && (
-                    <div className="absolute top-full left-0 right-0 z-50 mt-1 bg-background-neutral-00 border border-border-02 rounded-12 shadow-md p-1">
-                      {groupsLoading ? (
-                        <Text as="p" text03 secondaryBody className="px-3 py-2">
-                          Loading groups...
-                        </Text>
-                      ) : dropdownGroups.length === 0 ? (
-                        <Text as="p" text03 secondaryBody className="px-3 py-2">
-                          No groups found
-                        </Text>
-                      ) : (
-                        <ShadowDiv className="max-h-[200px] flex flex-col gap-1">
-                          {dropdownGroups.map((group) => {
-                            const isMember = memberGroupIds.has(group.id);
-                            return (
-                              <LineItem
-                                key={group.id}
-                                icon={isMember ? SvgCheck : SvgUsers}
-                                description={`${group.users.length} ${
-                                  group.users.length === 1 ? "user" : "users"
-                                }`}
-                                selected={isMember}
-                                emphasized={isMember}
-                                onMouseDown={(e: React.MouseEvent) =>
-                                  e.preventDefault()
-                                }
-                                onClick={() => toggleGroup(group.id)}
-                              >
-                                {group.name}
-                              </LineItem>
-                            );
-                          })}
-                        </ShadowDiv>
+          <Section padding={0} height="auto" alignItems="stretch">
+            <Section
+              gap={0.5}
+              padding={0.25}
+              height={joinedGroups.length === 0 && !popoverOpen ? "auto" : 14.5}
+              alignItems="stretch"
+              justifyContent="start"
+              className="bg-background-tint-02 rounded-08"
+            >
+              <Popover open={popoverOpen} onOpenChange={setPopoverOpen}>
+                <Popover.Trigger asChild>
+                  {/* asChild merges trigger props onto this div instead of rendering a <button>.
+                     Without it, the trigger <button> would nest around InputTypeIn's
+                     internal IconButton <button>, causing a hydration error. */}
+                  <div>
+                    <InputTypeIn
+                      value={searchTerm}
+                      onChange={(e) => setSearchTerm(e.target.value)}
+                      placeholder="Search groups to join..."
+                      leftSearchIcon
+                    />
+                  </div>
+                </Popover.Trigger>
+                <Popover.Content
+                  width="trigger"
+                  align="start"
+                  container={contentEl}
+                >
+                  {groupsLoading ? (
+                    <LineItem skeleton description="Loading groups...">
+                      Loading...
+                    </LineItem>
+                  ) : dropdownGroups.length === 0 ? (
+                    <LineItem
+                      skeleton
+                      description="Try a different search term."
+                    >
+                      No groups found
+                    </LineItem>
+                  ) : (
+                    <ShadowDiv
+                      shadowHeight="0.75rem"
+                      className={cn(
+                        "flex flex-col gap-1 max-h-[15rem] rounded-08"
                       )}
-                    </div>
+                    >
+                      {dropdownGroups.map((group) => {
+                        const isMember = memberGroupIds.has(group.id);
+                        return (
+                          <LineItem
+                            key={group.id}
+                            icon={isMember ? SvgCheck : SvgUsers}
+                            description={`${group.users.length} ${
+                              group.users.length === 1 ? "user" : "users"
+                            }`}
+                            selected={isMember}
+                            emphasized={isMember}
+                            onClick={() => toggleGroup(group.id)}
+                          >
+                            {group.name}
+                          </LineItem>
+                        );
+                      })}
+                    </ShadowDiv>
                   )}
-                </div>
+                </Popover.Content>
+              </Popover>
 
+              <ShadowDiv
+                className={cn(" max-h-[11rem] flex flex-col gap-1 rounded-08")}
+                shadowHeight="0.75rem"
+              >
                 {joinedGroups.length === 0 ? (
                   <LineItem
                     icon={SvgUsers}
+                    skeleton
+                    interactive={false}
                     description={`${displayName} is not in any groups.`}
-                    muted
                   >
-                    No groups joined
+                    No groups found
                   </LineItem>
                 ) : (
-                  <ShadowDiv className="flex flex-col gap-1 max-h-[200px]">
-                    {joinedGroups.map((group) => (
-                      <div
+                  joinedGroups.map((group) => (
+                    <div
+                      key={group.id}
+                      className="bg-background-tint-01 rounded-08"
+                    >
+                      <LineItem
                         key={group.id}
-                        className="bg-background-tint-01 rounded-08"
+                        icon={SvgUsers}
+                        description={`${group.users.length} ${
+                          group.users.length === 1 ? "user" : "users"
+                        }`}
+                        rightChildren={
+                          <SimpleTooltip
+                            tooltip="Remove from group"
+                            side="left"
+                          >
+                            <SvgLogOut height={16} width={16} />
+                          </SimpleTooltip>
+                        }
+                        onClick={() => toggleGroup(group.id)}
                       >
-                        <LineItem
-                          icon={SvgUsers}
-                          description={`${group.users.length} ${
-                            group.users.length === 1 ? "user" : "users"
-                          }`}
-                          rightChildren={
-                            <SvgLogOut className="w-4 h-4 text-text-03" />
-                          }
-                          onClick={() => toggleGroup(group.id)}
-                        >
-                          {group.name}
-                        </LineItem>
-                      </div>
-                    ))}
-                  </ShadowDiv>
+                        {group.name}
+                      </LineItem>
+                    </div>
+                  ))
                 )}
-              </Section>
-            </div>
-
+              </ShadowDiv>
+            </Section>
             {user.role && (
               <>
                 <Separator noPadding />
@@ -291,7 +307,7 @@ export default function EditGroupsModal({
                     >
                       <InputSelect.Trigger />
                       <InputSelect.Content>
-                        {user.role && !ASSIGNABLE_ROLES.includes(user.role) && (
+                        {user.role && !visibleRoles.includes(user.role) && (
                           <InputSelect.Item
                             key={user.role}
                             value={user.role}
@@ -300,7 +316,7 @@ export default function EditGroupsModal({
                             {USER_ROLE_LABELS[user.role]}
                           </InputSelect.Item>
                         )}
-                        {ASSIGNABLE_ROLES.map((role) => (
+                        {visibleRoles.map((role) => (
                           <InputSelect.Item
                             key={role}
                             value={role}
@@ -319,7 +335,10 @@ export default function EditGroupsModal({
         </Modal.Body>
 
         <Modal.Footer>
-          <Button prominence="secondary" onClick={onClose}>
+          <Button
+            prominence="secondary"
+            onClick={isSubmitting ? undefined : onClose}
+          >
             Cancel
           </Button>
           <Disabled disabled={isSubmitting || !hasChanges}>

web/src/refresh-pages/admin/UsersPage/GroupsCell.tsx

@@ -12,7 +12,7 @@ import { Tag } from "@opal/components";
 import IconButton from "@/refresh-components/buttons/IconButton";
 import Text from "@/refresh-components/texts/Text";
 import SimpleTooltip from "@/refresh-components/SimpleTooltip";
-import EditGroupsModal from "./EditGroupsModal";
+import EditUserModal from "./EditUserModal";
 import type { UserRow, UserGroupInfo } from "./interfaces";
 
 interface GroupsCellProps {
@@ -184,7 +184,7 @@ export default function GroupsCell({
         )}
       </div>
       {showModal && user.id != null && (
-        <EditGroupsModal
+        <EditUserModal
           user={{ ...user, id: user.id }}
           onClose={() => setShowModal(false)}
           onMutate={onMutate}

web/src/refresh-pages/admin/UsersPage/InviteUsersModal.tsx

@@ -2,11 +2,12 @@
 
 import { useState, useCallback } from "react";
 import { Button } from "@opal/components";
-import { SvgUsers } from "@opal/icons";
+import { SvgUsers, SvgAlertTriangle } from "@opal/icons";
 import { Disabled } from "@opal/core";
 import Modal, { BasicModalFooter } from "@/refresh-components/Modal";
 import InputChipField from "@/refresh-components/inputs/InputChipField";
 import type { ChipItem } from "@/refresh-components/inputs/InputChipField";
+import Text from "@/refresh-components/texts/Text";
 import { toast } from "@/hooks/useToast";
 import { inviteUsers } from "./svc";
 
@@ -145,9 +146,20 @@ export default function InviteUsersModal({
             onAdd={addEmail}
             value={inputValue}
             onChange={setInputValue}
-            placeholder="Add emails to invite, comma separated"
+            placeholder="Add an email and press enter"
             layout="stacked"
           />
+          {chips.some((c) => c.error) && (
+            <div className="flex items-center gap-1 pt-1">
+              <SvgAlertTriangle
+                size={14}
+                className="text-status-warning-05 shrink-0"
+              />
+              <Text secondaryBody text03>
+                Some email addresses are invalid and will be skipped.
+              </Text>
+            </div>
+          )}
         </Modal.Body>
 
         <Modal.Footer>

web/src/refresh-pages/admin/UsersPage/UserFilters.tsx

@@ -166,6 +166,7 @@ export default function UserFilters({
       <Popover>
         <Popover.Trigger asChild>
           <FilterButton
+            data-testid="filter-role"
             leftIcon={SvgUsers}
             active={hasRoleFilter}
             onClear={() => onRolesChange([])}
@@ -213,6 +214,7 @@ export default function UserFilters({
       >
         <Popover.Trigger asChild>
           <FilterButton
+            data-testid="filter-group"
             leftIcon={SvgUsers}
             active={hasGroupFilter}
             onClear={() => onGroupsChange([])}
@@ -267,6 +269,7 @@ export default function UserFilters({
       <Popover>
         <Popover.Trigger asChild>
           <FilterButton
+            data-testid="filter-status"
             leftIcon={SvgUsers}
             active={hasStatusFilter}
             onClear={() => onStatusesChange([])}

web/src/refresh-pages/admin/UsersPage/UserRoleCell.tsx

@@ -51,16 +51,6 @@ export default function UserRoleCell({ user, onMutate }: UserRoleCellProps) {
     );
   }
 
-  if (user.is_scim_synced) {
-    return (
-      <div className="flex items-center gap-1.5">
-        <Text as="span" mainUiBody text03>
-          {USER_ROLE_LABELS[user.role] ?? user.role}
-        </Text>
-      </div>
-    );
-  }
-
   const applyRole = async (newRole: UserRole) => {
     if (isUpdatingRef.current) return;
     isUpdatingRef.current = true;
@@ -89,47 +79,46 @@ export default function UserRoleCell({ user, onMutate }: UserRoleCellProps) {
 
   const currentIcon = ROLE_ICONS[user.role] ?? SvgUser;
 
+  const visibleRoles = isPaidEnterpriseFeaturesEnabled
+    ? SELECTABLE_ROLES
+    : SELECTABLE_ROLES.filter((r) => r !== UserRole.GLOBAL_CURATOR);
+
+  const roleItems = visibleRoles.map((role) => {
+    const isSelected = user.role === role;
+    const icon = ROLE_ICONS[role] ?? SvgUser;
+    return (
+      <LineItem
+        key={role}
+        icon={isSelected ? SvgCheck : icon}
+        selected={isSelected}
+        emphasized={isSelected}
+        onClick={() => handleSelect(role)}
+      >
+        {USER_ROLE_LABELS[role]}
+      </LineItem>
+    );
+  });
+
   return (
-    <div className="[&_button]:rounded-08">
-      <Disabled disabled={isUpdating}>
-        <Popover open={open} onOpenChange={setOpen}>
-          <Popover.Trigger asChild>
-            <OpenButton
-              icon={currentIcon}
-              variant="select-tinted"
-              width="full"
-              justifyContent="between"
-            >
-              {USER_ROLE_LABELS[user.role]}
-            </OpenButton>
-          </Popover.Trigger>
-          <Popover.Content align="start">
-            <div className="flex flex-col gap-1 p-1 min-w-[160px]">
-              {SELECTABLE_ROLES.map((role) => {
-                if (
-                  role === UserRole.GLOBAL_CURATOR &&
-                  !isPaidEnterpriseFeaturesEnabled
-                ) {
-                  return null;
-                }
-                const isSelected = user.role === role;
-                const icon = ROLE_ICONS[role] ?? SvgUser;
-                return (
-                  <LineItem
-                    key={role}
-                    icon={isSelected ? SvgCheck : icon}
-                    selected={isSelected}
-                    emphasized={isSelected}
-                    onClick={() => handleSelect(role)}
-                  >
-                    {USER_ROLE_LABELS[role]}
-                  </LineItem>
-                );
-              })}
-            </div>
-          </Popover.Content>
-        </Popover>
-      </Disabled>
-    </div>
+    <Disabled disabled={isUpdating}>
+      <Popover open={open} onOpenChange={setOpen}>
+        <Popover.Trigger asChild>
+          <OpenButton
+            icon={currentIcon}
+            variant="select-tinted"
+            width="full"
+            justifyContent="between"
+            roundingVariant="compact"
+          >
+            {USER_ROLE_LABELS[user.role]}
+          </OpenButton>
+        </Popover.Trigger>
+        <Popover.Content align="start">
+          <div className="flex flex-col gap-1 p-1 min-w-[160px]">
+            {roleItems}
+          </div>
+        </Popover.Content>
+      </Popover>
+    </Disabled>
   );
 }

web/src/refresh-pages/admin/UsersPage/UserRowActions.tsx

@@ -6,12 +6,16 @@ import {
   SvgMoreHorizontal,
   SvgUsers,
   SvgXCircle,
-  SvgTrash,
-  SvgCheck,
+  SvgUserCheck,
+  SvgUserPlus,
+  SvgUserX,
+  SvgKey,
 } from "@opal/icons";
 import { Disabled } from "@opal/core";
 import Popover from "@/refresh-components/Popover";
+import Separator from "@/refresh-components/Separator";
 import ConfirmationModalLayout from "@/refresh-components/layouts/ConfirmationModalLayout";
+import { Section } from "@/layouts/general-layouts";
 import Text from "@/refresh-components/texts/Text";
 import { UserStatus } from "@/lib/types";
 import { toast } from "@/hooks/useToast";
@@ -21,21 +25,23 @@ import {
   deleteUser,
   cancelInvite,
   approveRequest,
+  resetPassword,
 } from "./svc";
-import EditGroupsModal from "./EditGroupsModal";
+import EditUserModal from "./EditUserModal";
 import type { UserRow } from "./interfaces";
 
 // ---------------------------------------------------------------------------
 // Types
 // ---------------------------------------------------------------------------
 
-type ModalType =
-  | "deactivate"
-  | "activate"
-  | "delete"
-  | "cancelInvite"
-  | "editGroups"
-  | null;
+enum Modal {
+  DEACTIVATE = "deactivate",
+  ACTIVATE = "activate",
+  DELETE = "delete",
+  CANCEL_INVITE = "cancelInvite",
+  EDIT_GROUPS = "editGroups",
+  RESET_PASSWORD = "resetPassword",
+}
 
 interface UserRowActionsProps {
   user: UserRow;
@@ -50,9 +56,10 @@ export default function UserRowActions({
   user,
   onMutate,
 }: UserRowActionsProps) {
-  const [modal, setModal] = useState<ModalType>(null);
+  const [modal, setModal] = useState<Modal | null>(null);
   const [popoverOpen, setPopoverOpen] = useState(false);
   const [isSubmitting, setIsSubmitting] = useState(false);
+  const [newPassword, setNewPassword] = useState<string | null>(null);
 
   async function handleAction(
     action: () => Promise<void>,
@@ -71,13 +78,40 @@ export default function UserRowActions({
     }
   }
 
-  const openModal = (type: ModalType) => {
+  const openModal = (type: Modal) => {
     setPopoverOpen(false);
     setModal(type);
   };
 
   // Status-aware action menus
   const actionButtons = (() => {
+    // SCIM-managed users get limited actions — most changes would be
+    // overwritten on the next IdP sync.
+    if (user.is_scim_synced) {
+      return (
+        <>
+          {user.id && (
+            <Button
+              prominence="tertiary"
+              icon={SvgUsers}
+              onClick={() => openModal(Modal.EDIT_GROUPS)}
+            >
+              Groups &amp; Roles
+            </Button>
+          )}
+          <Disabled disabled>
+            <Button prominence="tertiary" variant="danger" icon={SvgUserX}>
+              Deactivate User
+            </Button>
+          </Disabled>
+          <Separator paddingXRem={0.5} />
+          <Text as="p" secondaryBody text03 className="px-3 py-1">
+            This is a synced SCIM user managed by your identity provider.
+          </Text>
+        </>
+      );
+    }
+
     switch (user.status) {
       case UserStatus.INVITED:
         return (
@@ -85,7 +119,7 @@ export default function UserRowActions({
             prominence="tertiary"
             variant="danger"
             icon={SvgXCircle}
-            onClick={() => openModal("cancelInvite")}
+            onClick={() => openModal(Modal.CANCEL_INVITE)}
           >
             Cancel Invite
           </Button>
@@ -95,7 +129,7 @@ export default function UserRowActions({
         return (
           <Button
             prominence="tertiary"
-            icon={SvgCheck}
+            icon={SvgUserCheck}
             onClick={() => {
               setPopoverOpen(false);
               handleAction(
@@ -115,15 +149,24 @@ export default function UserRowActions({
               <Button
                 prominence="tertiary"
                 icon={SvgUsers}
-                onClick={() => openModal("editGroups")}
+                onClick={() => openModal(Modal.EDIT_GROUPS)}
               >
-                Groups
+                Groups &amp; Roles
               </Button>
             )}
             <Button
               prominence="tertiary"
-              icon={SvgXCircle}
-              onClick={() => openModal("deactivate")}
+              icon={SvgKey}
+              onClick={() => openModal(Modal.RESET_PASSWORD)}
+            >
+              Reset Password
+            </Button>
+            <Separator paddingXRem={0.5} />
+            <Button
+              prominence="tertiary"
+              variant="danger"
+              icon={SvgUserX}
+              onClick={() => openModal(Modal.DEACTIVATE)}
             >
               Deactivate User
             </Button>
@@ -133,27 +176,19 @@ export default function UserRowActions({
       case UserStatus.INACTIVE:
         return (
           <>
-            {user.id && (
-              <Button
-                prominence="tertiary"
-                icon={SvgUsers}
-                onClick={() => openModal("editGroups")}
-              >
-                Groups
-              </Button>
-            )}
             <Button
               prominence="tertiary"
-              icon={SvgCheck}
-              onClick={() => openModal("activate")}
+              icon={SvgUserPlus}
+              onClick={() => openModal(Modal.ACTIVATE)}
             >
               Activate User
             </Button>
+            <Separator paddingXRem={0.5} />
             <Button
               prominence="tertiary"
               variant="danger"
-              icon={SvgTrash}
-              onClick={() => openModal("delete")}
+              icon={SvgUserX}
+              onClick={() => openModal(Modal.DELETE)}
             >
               Delete User
             </Button>
@@ -167,36 +202,39 @@ export default function UserRowActions({
     }
   })();
 
-  // SCIM-managed users cannot be modified from the UI — changes would be
-  // overwritten on the next IdP sync.
-  if (user.is_scim_synced) {
-    return null;
-  }
-
   return (
     <>
       <Popover open={popoverOpen} onOpenChange={setPopoverOpen}>
         <Popover.Trigger asChild>
           <Button prominence="tertiary" icon={SvgMoreHorizontal} />
         </Popover.Trigger>
-        <Popover.Content align="end">
-          <div className="flex flex-col gap-0.5 p-1">{actionButtons}</div>
+        <Popover.Content align="end" width="sm">
+          <Section
+            gap={0.5}
+            height="auto"
+            alignItems="stretch"
+            justifyContent="start"
+          >
+            {actionButtons}
+          </Section>
         </Popover.Content>
       </Popover>
 
-      {modal === "editGroups" && user.id && (
-        <EditGroupsModal
+      {modal === Modal.EDIT_GROUPS && user.id && (
+        <EditUserModal
           user={user as UserRow & { id: string }}
           onClose={() => setModal(null)}
           onMutate={onMutate}
         />
       )}
 
-      {modal === "cancelInvite" && (
+      {modal === Modal.CANCEL_INVITE && (
         <ConfirmationModalLayout
-          icon={SvgXCircle}
+          icon={(props) => (
+            <SvgUserX {...props} className="text-action-danger-05" />
+          )}
           title="Cancel Invite"
-          onClose={() => setModal(null)}
+          onClose={isSubmitting ? undefined : () => setModal(null)}
           submit={
             <Disabled disabled={isSubmitting}>
               <Button
@@ -208,7 +246,7 @@ export default function UserRowActions({
                   );
                 }}
               >
-                Cancel
+                Cancel Invite
               </Button>
             </Disabled>
           }
@@ -222,9 +260,11 @@ export default function UserRowActions({
         </ConfirmationModalLayout>
       )}
 
-      {modal === "deactivate" && (
+      {modal === Modal.DEACTIVATE && (
         <ConfirmationModalLayout
-          icon={SvgXCircle}
+          icon={(props) => (
+            <SvgUserX {...props} className="text-action-danger-05" />
+          )}
           title="Deactivate User"
           onClose={isSubmitting ? undefined : () => setModal(null)}
           submit={
@@ -254,9 +294,9 @@ export default function UserRowActions({
         </ConfirmationModalLayout>
       )}
 
-      {modal === "activate" && (
+      {modal === Modal.ACTIVATE && (
         <ConfirmationModalLayout
-          icon={SvgCheck}
+          icon={SvgUserPlus}
           title="Activate User"
           onClose={isSubmitting ? undefined : () => setModal(null)}
           submit={
@@ -283,9 +323,11 @@ export default function UserRowActions({
         </ConfirmationModalLayout>
       )}
 
-      {modal === "delete" && (
+      {modal === Modal.DELETE && (
         <ConfirmationModalLayout
-          icon={SvgTrash}
+          icon={(props) => (
+            <SvgUserX {...props} className="text-action-danger-05" />
+          )}
           title="Delete User"
           onClose={isSubmitting ? undefined : () => setModal(null)}
           submit={
@@ -313,6 +355,80 @@ export default function UserRowActions({
           </Text>
         </ConfirmationModalLayout>
       )}
+
+      {modal === Modal.RESET_PASSWORD && (
+        <ConfirmationModalLayout
+          icon={SvgKey}
+          title={newPassword ? "Password Reset" : "Reset Password"}
+          onClose={
+            isSubmitting
+              ? undefined
+              : () => {
+                  setModal(null);
+                  setNewPassword(null);
+                }
+          }
+          submit={
+            newPassword ? (
+              <Button
+                onClick={() => {
+                  setModal(null);
+                  setNewPassword(null);
+                }}
+              >
+                Done
+              </Button>
+            ) : (
+              <Disabled disabled={isSubmitting}>
+                <Button
+                  variant="danger"
+                  onClick={async () => {
+                    setIsSubmitting(true);
+                    try {
+                      const result = await resetPassword(user.email);
+                      setNewPassword(result.new_password);
+                    } catch (err) {
+                      toast.error(
+                        err instanceof Error
+                          ? err.message
+                          : "Failed to reset password"
+                      );
+                    } finally {
+                      setIsSubmitting(false);
+                    }
+                  }}
+                >
+                  Reset Password
+                </Button>
+              </Disabled>
+            )
+          }
+        >
+          {newPassword ? (
+            <div className="flex flex-col gap-2">
+              <Text as="p" text03>
+                The password for{" "}
+                <Text as="span" text05>
+                  {user.email}
+                </Text>{" "}
+                has been reset. Copy the new password below — it will not be
+                shown again.
+              </Text>
+              <code className="rounded-sm bg-background-neutral-02 px-3 py-2 text-sm select-all">
+                {newPassword}
+              </code>
+            </div>
+          ) : (
+            <Text as="p" text03>
+              This will generate a new random password for{" "}
+              <Text as="span" text05>
+                {user.email}
+              </Text>
+              . Their current password will stop working immediately.
+            </Text>
+          )}
+        </ConfirmationModalLayout>
+      )}
     </>
   );
 }

web/src/refresh-pages/admin/UsersPage/UsersSummary.tsx

@@ -6,7 +6,7 @@ import Card from "@/refresh-components/cards/Card";
 import IconButton from "@/refresh-components/buttons/IconButton";
 import Text from "@/refresh-components/texts/Text";
 import Link from "next/link";
-import { ADMIN_PATHS } from "@/lib/admin-routes";
+import { ADMIN_ROUTES } from "@/lib/admin-routes";
 
 // ---------------------------------------------------------------------------
 // Stats cell — number + label + hover filter icon
@@ -67,7 +67,7 @@ function ScimCard() {
         variant="section"
         paddingVariant="fit"
         rightChildren={
-          <Link href={ADMIN_PATHS.SCIM}>
+          <Link href={ADMIN_ROUTES.SCIM.path}>
             <Button prominence="tertiary" rightIcon={SvgArrowUpRight} size="sm">
               Manage
             </Button>

web/src/refresh-pages/admin/UsersPage/UsersTable.tsx

@@ -237,6 +237,7 @@ export default function UsersTable({
               prominence="tertiary"
               size="sm"
               tooltip="Download CSV"
+              aria-label="Download CSV"
               onClick={() => {
                 downloadUsersCsv().catch((err) => {
                   toast.error(

web/src/refresh-pages/admin/UsersPage/svc.ts

@@ -127,6 +127,20 @@ export async function inviteUsers(emails: string[]): Promise<void> {
   }
 }
 
+export async function resetPassword(
+  email: string
+): Promise<{ user_id: string; new_password: string }> {
+  const res = await fetch("/api/password/reset_password", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ user_email: email }),
+  });
+  if (!res.ok) {
+    throw new Error(await parseErrorDetail(res, "Failed to reset password"));
+  }
+  return res.json();
+}
+
 export async function downloadUsersCsv(): Promise<void> {
   const res = await fetch("/api/manage/users/download");
   if (!res.ok) {

web/src/sections/sidebar/AdminSidebar.tsx

@@ -1,90 +1,55 @@
 "use client";
 
+import { useCallback } from "react";
 import { usePathname } from "next/navigation";
 import { useSettingsContext } from "@/providers/SettingsProvider";
-import { CgArrowsExpandUpLeft } from "react-icons/cg";
-import Text from "@/refresh-components/texts/Text";
 import SidebarSection from "@/sections/sidebar/SidebarSection";
 import SidebarWrapper from "@/sections/sidebar/SidebarWrapper";
 import { useIsKGExposed } from "@/app/admin/kg/utils";
 import { useCustomAnalyticsEnabled } from "@/lib/hooks/useCustomAnalyticsEnabled";
 import { useUser } from "@/providers/UserProvider";
 import { UserRole } from "@/lib/types";
+import { usePaidEnterpriseFeaturesEnabled } from "@/components/settings/usePaidEnterpriseFeaturesEnabled";
+import { CombinedSettings } from "@/interfaces/settings";
+import SidebarTab from "@/refresh-components/buttons/SidebarTab";
+import SidebarBody from "@/sections/sidebar/SidebarBody";
+import InputTypeIn from "@/refresh-components/inputs/InputTypeIn";
+import { Disabled } from "@opal/core";
+import { SvgArrowUpCircle, SvgUserManage, SvgX } from "@opal/icons";
 import {
   useBillingInformation,
   useLicense,
   hasActiveSubscription,
 } from "@/lib/billing";
-import { usePaidEnterpriseFeaturesEnabled } from "@/components/settings/usePaidEnterpriseFeaturesEnabled";
-import { CombinedSettings } from "@/interfaces/settings";
-import SidebarTab from "@/refresh-components/buttons/SidebarTab";
-import SidebarBody from "@/sections/sidebar/SidebarBody";
-import {
-  SvgActions,
-  SvgActivity,
-  SvgArrowUpCircle,
-  SvgBarChart,
-  SvgCpu,
-  SvgFileText,
-  SvgFolder,
-  SvgGlobe,
-  SvgArrowExchange,
-  SvgImage,
-  SvgKey,
-  SvgOnyxLogo,
-  SvgOnyxOctagon,
-  SvgSearch,
-  SvgServer,
-  SvgSettings,
-  SvgShield,
-  SvgThumbsUp,
-  SvgUploadCloud,
-  SvgUser,
-  SvgUsers,
-  SvgZoomIn,
-  SvgPaintBrush,
-  SvgDiscordMono,
-  SvgWallet,
-  SvgAudio,
-} from "@opal/icons";
-import SvgMcp from "@opal/icons/mcp";
-import { ADMIN_PATHS, sidebarItem } from "@/lib/admin-routes";
-import UserAvatarPopover from "@/sections/sidebar/UserAvatarPopover";
+import { Content } from "@opal/layouts";
+import { ADMIN_ROUTES, sidebarItem } from "@/lib/admin-routes";
+import useFilter from "@/hooks/useFilter";
+import { IconFunctionComponent } from "@opal/types";
+import { Section } from "@/layouts/general-layouts";
+import Text from "@/refresh-components/texts/Text";
+import { getUserDisplayName } from "@/lib/user";
+import { APP_SLOGAN } from "@/lib/constants";
 
-const connectors_items = () => [
-  sidebarItem(ADMIN_PATHS.INDEXING_STATUS),
-  sidebarItem(ADMIN_PATHS.ADD_CONNECTOR),
-];
+const SECTIONS = {
+  UNLABELED: "",
+  AGENTS_AND_ACTIONS: "Agents & Actions",
+  DOCUMENTS_AND_KNOWLEDGE: "Documents & Knowledge",
+  INTEGRATIONS: "Integrations",
+  PERMISSIONS: "Permissions",
+  ORGANIZATION: "Organization",
+  USAGE: "Usage",
+} as const;
 
-const document_management_items = () => [
-  sidebarItem(ADMIN_PATHS.DOCUMENT_SETS),
-  sidebarItem(ADMIN_PATHS.DOCUMENT_EXPLORER),
-  sidebarItem(ADMIN_PATHS.DOCUMENT_FEEDBACK),
-];
+interface SidebarItemEntry {
+  section: string;
+  name: string;
+  icon: IconFunctionComponent;
+  link: string;
+  error?: boolean;
+  disabled?: boolean;
+}
 
-const custom_agents_items = (isCurator: boolean, enableEnterprise: boolean) => {
-  const items = [sidebarItem(ADMIN_PATHS.AGENTS)];
-
-  if (!isCurator) {
-    items.push(
-      sidebarItem(ADMIN_PATHS.SLACK_BOTS),
-      sidebarItem(ADMIN_PATHS.DISCORD_BOTS)
-    );
-  }
-
-  items.push(
-    sidebarItem(ADMIN_PATHS.MCP_ACTIONS),
-    sidebarItem(ADMIN_PATHS.OPENAPI_ACTIONS)
-  );
-
-  if (enableEnterprise) {
-    items.push(sidebarItem(ADMIN_PATHS.STANDARD_ANSWERS));
-  }
-
-  return items;
-};
-
-const collections = (
+function buildItems(
   isCurator: boolean,
   enableCloud: boolean,
   enableEnterprise: boolean,
@@ -92,204 +57,260 @@ const collections = (
   kgExposed: boolean,
   customAnalyticsEnabled: boolean,
   hasSubscription: boolean
-) => {
+): SidebarItemEntry[] {
   const vectorDbEnabled = settings?.settings.vector_db_enabled !== false;
+  const items: SidebarItemEntry[] = [];
 
-  return [
-    ...(vectorDbEnabled
-      ? [
-          {
-            name: "Connectors",
-            items: connectors_items(),
-          },
-        ]
-      : []),
-    ...(vectorDbEnabled
-      ? [
-          {
-            name: "Document Management",
-            items: document_management_items(),
-          },
-        ]
-      : []),
-    {
-      name: "Custom Agents",
-      items: custom_agents_items(isCurator, enableEnterprise),
-    },
-    ...(isCurator && enableEnterprise
-      ? [
-          {
-            name: "User Management",
-            items: [sidebarItem(ADMIN_PATHS.GROUPS)],
-          },
-        ]
-      : []),
-    ...(!isCurator
-      ? [
-          {
-            name: "Configuration",
-            items: [
-              sidebarItem(ADMIN_PATHS.CHAT_PREFERENCES),
-              sidebarItem(ADMIN_PATHS.LLM_MODELS),
-              sidebarItem(ADMIN_PATHS.WEB_SEARCH),
-              sidebarItem(ADMIN_PATHS.IMAGE_GENERATION),
-              {
-                name: "Voice",
-                icon: SvgAudio,
-                link: "/admin/configuration/voice",
-              },
-              sidebarItem(ADMIN_PATHS.CODE_INTERPRETER),
-              ...(!enableCloud && vectorDbEnabled
-                ? [
-                    {
-                      ...sidebarItem(ADMIN_PATHS.SEARCH_SETTINGS),
-                      error: settings?.settings.needs_reindexing,
-                    },
-                  ]
-                : []),
-              sidebarItem(ADMIN_PATHS.DOCUMENT_PROCESSING),
-              ...(kgExposed ? [sidebarItem(ADMIN_PATHS.KNOWLEDGE_GRAPH)] : []),
-            ],
-          },
-          {
-            name: "User Management",
-            items: [
-              ...(enableEnterprise ? [sidebarItem(ADMIN_PATHS.GROUPS)] : []),
-              sidebarItem(ADMIN_PATHS.API_KEYS),
-              sidebarItem(ADMIN_PATHS.TOKEN_RATE_LIMITS),
-            ],
-          },
-          {
-            name: "Permissions",
-            items: [
-              sidebarItem(ADMIN_PATHS.USERS),
-              ...(enableEnterprise ? [sidebarItem(ADMIN_PATHS.SCIM)] : []),
-            ],
-          },
-          ...(enableEnterprise
-            ? [
-                {
-                  name: "Performance",
-                  items: [
-                    sidebarItem(ADMIN_PATHS.USAGE),
-                    ...(settings?.settings.query_history_type !== "disabled"
-                      ? [sidebarItem(ADMIN_PATHS.QUERY_HISTORY)]
-                      : []),
-                    ...(!enableCloud && customAnalyticsEnabled
-                      ? [sidebarItem(ADMIN_PATHS.CUSTOM_ANALYTICS)]
-                      : []),
-                  ],
-                },
-              ]
-            : []),
-          {
-            name: "Settings",
-            items: [
-              ...(enableEnterprise ? [sidebarItem(ADMIN_PATHS.THEME)] : []),
-              // Always show billing/upgrade - community users need access to upgrade
-              {
-                ...sidebarItem(ADMIN_PATHS.BILLING),
-                ...(hasSubscription
-                  ? {}
-                  : { name: "Upgrade Plan", icon: SvgArrowUpCircle }),
-              },
-              ...(settings?.settings.opensearch_indexing_enabled
-                ? [sidebarItem(ADMIN_PATHS.INDEX_MIGRATION)]
-                : []),
-            ],
-          },
-        ]
-      : []),
-  ];
-};
+  const add = (section: string, route: Parameters<typeof sidebarItem>[0]) => {
+    items.push({ ...sidebarItem(route), section });
+  };
 
-interface AdminSidebarProps {
-  // Cloud flag is passed from server component (Layout.tsx) since it's a build-time constant
-  enableCloudSS: boolean;
-  // Enterprise flag is also passed but we override it with runtime license check below
-  enableEnterpriseSS: boolean;
+  const addDisabled = (
+    section: string,
+    route: Parameters<typeof sidebarItem>[0],
+    isDisabled: boolean
+  ) => {
+    items.push({ ...sidebarItem(route), section, disabled: isDisabled });
+  };
+
+  // 1. No header — core configuration (admin only)
+  if (!isCurator) {
+    add(SECTIONS.UNLABELED, ADMIN_ROUTES.LLM_MODELS);
+    add(SECTIONS.UNLABELED, ADMIN_ROUTES.WEB_SEARCH);
+    add(SECTIONS.UNLABELED, ADMIN_ROUTES.IMAGE_GENERATION);
+    add(SECTIONS.UNLABELED, ADMIN_ROUTES.VOICE);
+    add(SECTIONS.UNLABELED, ADMIN_ROUTES.CODE_INTERPRETER);
+    add(SECTIONS.UNLABELED, ADMIN_ROUTES.CHAT_PREFERENCES);
+
+    if (vectorDbEnabled && kgExposed) {
+      add(SECTIONS.UNLABELED, ADMIN_ROUTES.KNOWLEDGE_GRAPH);
+    }
+
+    if (!enableCloud && customAnalyticsEnabled) {
+      addDisabled(
+        SECTIONS.UNLABELED,
+        ADMIN_ROUTES.CUSTOM_ANALYTICS,
+        !enableEnterprise
+      );
+    }
+  }
+
+  // 2. Agents & Actions
+  add(SECTIONS.AGENTS_AND_ACTIONS, ADMIN_ROUTES.AGENTS);
+  add(SECTIONS.AGENTS_AND_ACTIONS, ADMIN_ROUTES.MCP_ACTIONS);
+  add(SECTIONS.AGENTS_AND_ACTIONS, ADMIN_ROUTES.OPENAPI_ACTIONS);
+
+  // 3. Documents & Knowledge
+  if (vectorDbEnabled) {
+    add(SECTIONS.DOCUMENTS_AND_KNOWLEDGE, ADMIN_ROUTES.INDEXING_STATUS);
+    add(SECTIONS.DOCUMENTS_AND_KNOWLEDGE, ADMIN_ROUTES.ADD_CONNECTOR);
+    add(SECTIONS.DOCUMENTS_AND_KNOWLEDGE, ADMIN_ROUTES.DOCUMENT_SETS);
+    if (!isCurator && !enableCloud) {
+      items.push({
+        ...sidebarItem(ADMIN_ROUTES.INDEX_SETTINGS),
+        section: SECTIONS.DOCUMENTS_AND_KNOWLEDGE,
+        error: settings?.settings.needs_reindexing,
+      });
+    }
+    if (!isCurator && settings?.settings.opensearch_indexing_enabled) {
+      add(SECTIONS.DOCUMENTS_AND_KNOWLEDGE, ADMIN_ROUTES.INDEX_MIGRATION);
+    }
+  }
+
+  // 4. Integrations (admin only)
+  if (!isCurator) {
+    add(SECTIONS.INTEGRATIONS, ADMIN_ROUTES.API_KEYS);
+    add(SECTIONS.INTEGRATIONS, ADMIN_ROUTES.SLACK_BOTS);
+    add(SECTIONS.INTEGRATIONS, ADMIN_ROUTES.DISCORD_BOTS);
+  }
+
+  // 5. Permissions
+  if (!isCurator) {
+    add(SECTIONS.PERMISSIONS, ADMIN_ROUTES.USERS);
+    addDisabled(SECTIONS.PERMISSIONS, ADMIN_ROUTES.GROUPS, !enableEnterprise);
+    addDisabled(SECTIONS.PERMISSIONS, ADMIN_ROUTES.SCIM, !enableEnterprise);
+  } else if (enableEnterprise) {
+    add(SECTIONS.PERMISSIONS, ADMIN_ROUTES.GROUPS);
+  }
+
+  // 6. Organization (admin only)
+  if (!isCurator) {
+    if (hasSubscription) {
+      add(SECTIONS.ORGANIZATION, ADMIN_ROUTES.BILLING);
+    } else {
+      items.push({
+        section: SECTIONS.ORGANIZATION,
+        name: "Upgrade Plan",
+        icon: SvgArrowUpCircle,
+        link: ADMIN_ROUTES.BILLING.path,
+      });
+    }
+    add(SECTIONS.ORGANIZATION, ADMIN_ROUTES.TOKEN_RATE_LIMITS);
+    addDisabled(SECTIONS.ORGANIZATION, ADMIN_ROUTES.THEME, !enableEnterprise);
+  }
+
+  // 7. Usage (admin only)
+  if (!isCurator) {
+    addDisabled(SECTIONS.USAGE, ADMIN_ROUTES.USAGE, !enableEnterprise);
+    if (settings?.settings.query_history_type !== "disabled") {
+      addDisabled(
+        SECTIONS.USAGE,
+        ADMIN_ROUTES.QUERY_HISTORY,
+        !enableEnterprise
+      );
+    }
+  }
+
+  return items;
 }
 
-export default function AdminSidebar({
-  enableCloudSS,
-  enableEnterpriseSS,
-}: AdminSidebarProps) {
+/** Preserve section ordering while grouping consecutive items by section. */
+function groupBySection(items: SidebarItemEntry[]) {
+  const groups: { section: string; items: SidebarItemEntry[] }[] = [];
+  for (const item of items) {
+    const last = groups[groups.length - 1];
+    if (last && last.section === item.section) {
+      last.items.push(item);
+    } else {
+      groups.push({ section: item.section, items: [item] });
+    }
+  }
+  return groups;
+}
+
+interface AdminSidebarProps {
+  enableCloudSS: boolean;
+}
+
+export default function AdminSidebar({ enableCloudSS }: AdminSidebarProps) {
   const { kgExposed } = useIsKGExposed();
   const pathname = usePathname();
   const { customAnalyticsEnabled } = useCustomAnalyticsEnabled();
   const { user } = useUser();
   const settings = useSettingsContext();
-  const { data: billingData } = useBillingInformation();
-  const { data: licenseData } = useLicense();
-
-  // Use runtime license check for enterprise features
-  // This checks settings.ee_features_enabled (set by backend based on license status)
-  // Falls back to build-time check if LICENSE_ENFORCEMENT_ENABLED=false
   const enableEnterprise = usePaidEnterpriseFeaturesEnabled();
-
+  const { data: billingData, isLoading: billingLoading } =
+    useBillingInformation();
+  const { data: licenseData, isLoading: licenseLoading } = useLicense();
   const isCurator =
     user?.role === UserRole.CURATOR || user?.role === UserRole.GLOBAL_CURATOR;
+  // Default to true while loading to avoid flashing "Upgrade Plan"
+  const hasSubscriptionOrLicense =
+    billingLoading || licenseLoading
+      ? true
+      : Boolean(
+          (billingData && hasActiveSubscription(billingData)) ||
+            licenseData?.has_license
+        );
 
-  // Check if user has an active subscription or license for billing link text
-  // Show "Plans & Billing" if they have either (even if Stripe connection fails)
-  const hasSubscription = Boolean(
-    (billingData && hasActiveSubscription(billingData)) ||
-      licenseData?.has_license
-  );
-
-  const items = collections(
+  const allItems = buildItems(
     isCurator,
     enableCloudSS,
     enableEnterprise,
     settings,
     kgExposed,
     customAnalyticsEnabled,
-    hasSubscription
+    hasSubscriptionOrLicense
   );
 
+  const itemExtractor = useCallback((item: SidebarItemEntry) => item.name, []);
+
+  const { query, setQuery, filtered } = useFilter(allItems, itemExtractor);
+
+  const groups = groupBySection(filtered);
+
   return (
     <SidebarWrapper>
       <SidebarBody
         scrollKey="admin-sidebar"
         actionButtons={
-          <SidebarTab
-            icon={({ className }) => (
-              <CgArrowsExpandUpLeft className={className} size={16} />
-            )}
-            href="/app"
-          >
-            Exit Admin
-          </SidebarTab>
-        }
-        footer={
-          <div className="flex flex-col gap-2">
-            {settings.webVersion && (
-              <Text as="p" text02 secondaryBody className="px-2">
-                {`Onyx version: ${settings.webVersion}`}
-              </Text>
-            )}
-            <UserAvatarPopover />
+          <div className="flex flex-col w-full">
+            <SidebarTab
+              icon={({ className }) => <SvgX className={className} size={16} />}
+              href="/app"
+              lowlight
+            >
+              Exit Admin Panel
+            </SidebarTab>
+            <InputTypeIn
+              variant="internal"
+              leftSearchIcon
+              placeholder="Search..."
+              value={query}
+              onChange={(e) => setQuery(e.target.value)}
+            />
           </div>
         }
+        footer={
+          <Section gap={0} height="fit" alignItems="start">
+            <div className="p-[0.38rem] w-full">
+              <Content
+                icon={SvgUserManage}
+                title={getUserDisplayName(user)}
+                sizePreset="main-ui"
+                variant="body"
+                prominence="muted"
+                widthVariant="full"
+              />
+            </div>
+            <div className="flex flex-row gap-1 p-[0.38rem] w-full">
+              <Text text03 secondaryAction>
+                <a
+                  className="underline"
+                  href="https://onyx.app"
+                  target="_blank"
+                >
+                  Onyx
+                </a>
+              </Text>
+              <Text text03 secondaryBody>
+                |
+              </Text>
+              {settings.webVersion ? (
+                <Text text03 secondaryBody>
+                  {settings.webVersion}
+                </Text>
+              ) : (
+                <Text text03 secondaryBody>
+                  {APP_SLOGAN}
+                </Text>
+              )}
+            </div>
+          </Section>
+        }
       >
-        {items.map((collection, index) => (
-          <SidebarSection key={index} title={collection.name}>
-            <div className="flex flex-col w-full">
-              {collection.items.map(({ link, icon: Icon, name }, index) => (
+        {groups.map((group, groupIndex) => {
+          const tabs = group.items.map(({ link, icon, name, disabled }) => (
+            <Disabled key={link} disabled={disabled}>
+              {/*
+                # NOTE (@raunakab)
+                We intentionally add a `div` intermediary here.
+                Without it, the disabled styling that is default provided by the `Disabled` component (which we want here) would be overridden by the custom disabled styling provided by the `SidebarTab`.
+                Therefore, in order to avoid that overriding, we add a layer of indirection.
+              */}
+              <div>
                 <SidebarTab
-                  key={index}
-                  href={link}
-                  selected={pathname.startsWith(link)}
-                  icon={({ className }) => (
-                    <Icon className={className} size={16} />
-                  )}
+                  lowlight={disabled}
+                  icon={icon}
+                  href={disabled ? undefined : link}
+                  selected={!disabled && pathname.startsWith(link)}
                 >
                   {name}
                 </SidebarTab>
-              ))}
-            </div>
-          </SidebarSection>
-        ))}
+              </div>
+            </Disabled>
+          ));
+
+          if (!group.section) {
+            return <div key={groupIndex}>{tabs}</div>;
+          }
+
+          return (
+            <SidebarSection key={groupIndex} title={group.section}>
+              {tabs}
+            </SidebarSection>
+          );
+        })}
       </SidebarBody>
     </SidebarWrapper>
   );

web/src/sections/sidebar/UpsertEmbeddingSidebar.tsx

@@ -9,7 +9,7 @@ export default function EmbeddingSidebar() {
 
   return (
     <StepSidebar
-      buttonName="Search Settings"
+      buttonName="Index Settings"
       buttonIcon={SvgSettings}
       buttonHref="/admin/configuration/search"
     >

web/src/sections/sidebar/UserAvatarPopover.tsx

@@ -1,11 +1,11 @@
 "use client";
 
 import { useState } from "react";
-import { ANONYMOUS_USER_NAME, LOGOUT_DISABLED } from "@/lib/constants";
+import { LOGOUT_DISABLED } from "@/lib/constants";
 import { Notification } from "@/interfaces/settings";
 import useSWR, { preload } from "swr";
 import { errorHandlingFetcher } from "@/lib/fetcher";
-import { checkUserIsNoAuthUser, logout } from "@/lib/user";
+import { checkUserIsNoAuthUser, getUserDisplayName, logout } from "@/lib/user";
 import { useUser } from "@/providers/UserProvider";
 import InputAvatar from "@/refresh-components/inputs/InputAvatar";
 import Text from "@/refresh-components/texts/Text";
@@ -27,20 +27,6 @@ import { toast } from "@/hooks/useToast";
 import useAppFocus from "@/hooks/useAppFocus";
 import { useVectorDbEnabled } from "@/providers/SettingsProvider";
 
-function getDisplayName(email?: string, personalName?: string): string {
-  // Prioritize custom personal name if set
-  if (personalName && personalName.trim()) {
-    return personalName.trim();
-  }
-
-  // Fallback to email-derived username
-  if (!email) return ANONYMOUS_USER_NAME;
-  const atIndex = email.indexOf("@");
-  if (atIndex <= 0) return ANONYMOUS_USER_NAME;
-
-  return email.substring(0, atIndex);
-}
-
 interface SettingsPopoverProps {
   onUserSettingsClick: () => void;
   onOpenNotifications: () => void;
@@ -175,7 +161,7 @@ export default function UserAvatarPopover({
     errorHandlingFetcher
   );
 
-  const displayName = getDisplayName(user?.email, user?.personalization?.name);
+  const userDisplayName = getUserDisplayName(user);
   const undismissedCount =
     notifications?.filter((n) => !n.dismissed).length ?? 0;
   const hasNotifications = undismissedCount > 0;
@@ -209,7 +195,7 @@ export default function UserAvatarPopover({
                 )}
               >
                 <Text as="p" inverted secondaryBody>
-                  {displayName[0]?.toUpperCase()}
+                  {userDisplayName[0]?.toUpperCase()}
                 </Text>
               </InputAvatar>
             )}
@@ -231,7 +217,7 @@ export default function UserAvatarPopover({
             // Specifying a dummy `onClick` handler solves that.
             onClick={() => undefined}
           >
-            {displayName}
+            {userDisplayName}
           </SidebarTab>
         </div>
       </Popover.Trigger>

web/tests/e2e/admin/admin_pages.spec.ts

@@ -52,9 +52,9 @@ const ADMIN_PAGES: AdminPageSnapshot[] = [
     },
   },
   {
-    name: "Custom Agents - Slack Bots",
+    name: "Integrations - Slack Integration",
     path: "bots",
-    pageTitle: "Slack Bots",
+    pageTitle: "Slack Integration",
     options: {
       paragraphText:
         "Setup Slack bots that connect to Onyx. Once setup, you will be able to ask questions to Onyx directly from Slack. Additionally, you can:",
@@ -96,9 +96,9 @@ const ADMIN_PAGES: AdminPageSnapshot[] = [
     pageTitle: "Appearance & Theming",
   },
   {
-    name: "Configuration - Search Settings",
+    name: "Documents & Knowledge - Index Settings",
     path: "configuration/search",
-    pageTitle: "Search Settings",
+    pageTitle: "Index Settings",
   },
   {
     name: "Custom Agents - MCP Actions",
@@ -111,9 +111,9 @@ const ADMIN_PAGES: AdminPageSnapshot[] = [
     pageTitle: "OpenAPI Actions",
   },
   {
-    name: "User Management - Token Rate Limits",
+    name: "Organization - Spending Limits",
     path: "token-rate-limits",
-    pageTitle: "Token Rate Limits",
+    pageTitle: "Spending Limits",
     options: {
       paragraphText:
         "Token rate limits enable you control how many tokens can be spent in a given time period. With token rate limits, you can:",

web/tests/e2e/admin/discord-bot/admin-workflows.spec.ts

@@ -28,7 +28,7 @@ test.describe("Admin Workflow E2E Flows", () => {
     await expect(
       adminPage
         .locator('[aria-label="admin-page-title"]')
-        .getByText("Discord Bots")
+        .getByText("Discord Integration")
     ).toBeVisible();
     await expect(
       adminPage.locator("text=Server Configurations").first()