chore(fe): preview modal mask is color-agnostic

.github/workflows/pr-playwright-tests.yml

@@ -12,9 +12,6 @@ on:
   push:
     tags:
       - "v*.*.*"
-    # TODO: Remove this if we enable merge-queues for release branches.
-    branches:
-      - "release/**"
 
 permissions:
   contents: read

.github/workflows/storybook-deploy.yml

@@ -48,7 +48,7 @@ jobs:
 
       - name: Deploy to Vercel (Production)
         working-directory: web
-        run: npx --yes "$VERCEL_CLI" deploy storybook-static/ --prod --yes --token="$VERCEL_TOKEN"
+        run: npx --yes "$VERCEL_CLI" deploy storybook-static/ --prod --yes
 
   notify-slack-on-failure:
     needs: Deploy-Storybook

.vscode/env_template.txt

@@ -7,9 +7,6 @@
 
 
 AUTH_TYPE=basic
-# Recommended for basic auth - used for signing password reset and verification tokens
-# Generate a secure value with: openssl rand -hex 32
-USER_AUTH_SECRET=""
 DEV_MODE=true
 
 

backend/alembic/versions/b5c4d7e8f9a1_add_hierarchy_node_cc_pair_table.py

@@ -1,51 +0,0 @@
-"""add hierarchy_node_by_connector_credential_pair table
-
-Revision ID: b5c4d7e8f9a1
-Revises: a3b8d9e2f1c4
-Create Date: 2026-03-04
-
-"""
-
-import sqlalchemy as sa
-from alembic import op
-
-revision = "b5c4d7e8f9a1"
-down_revision = "a3b8d9e2f1c4"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.create_table(
-        "hierarchy_node_by_connector_credential_pair",
-        sa.Column("hierarchy_node_id", sa.Integer(), nullable=False),
-        sa.Column("connector_id", sa.Integer(), nullable=False),
-        sa.Column("credential_id", sa.Integer(), nullable=False),
-        sa.ForeignKeyConstraint(
-            ["hierarchy_node_id"],
-            ["hierarchy_node.id"],
-            ondelete="CASCADE",
-        ),
-        sa.ForeignKeyConstraint(
-            ["connector_id", "credential_id"],
-            [
-                "connector_credential_pair.connector_id",
-                "connector_credential_pair.credential_id",
-            ],
-            ondelete="CASCADE",
-        ),
-        sa.PrimaryKeyConstraint("hierarchy_node_id", "connector_id", "credential_id"),
-    )
-    op.create_index(
-        "ix_hierarchy_node_cc_pair_connector_credential",
-        "hierarchy_node_by_connector_credential_pair",
-        ["connector_id", "credential_id"],
-    )
-
-
-def downgrade() -> None:
-    op.drop_index(
-        "ix_hierarchy_node_cc_pair_connector_credential",
-        table_name="hierarchy_node_by_connector_credential_pair",
-    )
-    op.drop_table("hierarchy_node_by_connector_credential_pair")

backend/ee/onyx/access/access.py

@@ -9,15 +9,12 @@ from onyx.access.access import (
     _get_access_for_documents as get_access_for_documents_without_groups,
 )
 from onyx.access.access import _get_acl_for_user as get_acl_for_user_without_groups
-from onyx.access.access import collect_user_file_access
 from onyx.access.models import DocumentAccess
 from onyx.access.utils import prefix_external_group
 from onyx.access.utils import prefix_user_group
 from onyx.db.document import get_document_sources
 from onyx.db.document import get_documents_by_ids
 from onyx.db.models import User
-from onyx.db.models import UserFile
-from onyx.db.user_file import fetch_user_files_with_access_relationships
 from onyx.utils.logger import setup_logger
 
 
@@ -119,68 +116,6 @@ def _get_access_for_documents(
     return access_map
 
 
-def _collect_user_file_group_names(user_file: UserFile) -> set[str]:
-    """Extract user-group names from the already-loaded Persona.groups
-    relationships on a UserFile (skipping deleted personas)."""
-    groups: set[str] = set()
-    for persona in user_file.assistants:
-        if persona.deleted:
-            continue
-        for group in persona.groups:
-            groups.add(group.name)
-    return groups
-
-
-def get_access_for_user_files_impl(
-    user_file_ids: list[str],
-    db_session: Session,
-) -> dict[str, DocumentAccess]:
-    """EE version: extends the MIT user file ACL with user group names
-    from personas shared via user groups.
-
-    Uses a single DB query (via fetch_user_files_with_access_relationships)
-    that eagerly loads both the MIT-needed and EE-needed relationships.
-
-    NOTE: is imported in onyx.access.access by `fetch_versioned_implementation`
-    DO NOT REMOVE."""
-    user_files = fetch_user_files_with_access_relationships(
-        user_file_ids, db_session, eager_load_groups=True
-    )
-    return build_access_for_user_files_impl(user_files)
-
-
-def build_access_for_user_files_impl(
-    user_files: list[UserFile],
-) -> dict[str, DocumentAccess]:
-    """EE version: works on pre-loaded UserFile objects.
-    Expects Persona.groups to be eagerly loaded.
-
-    NOTE: is imported in onyx.access.access by `fetch_versioned_implementation`
-    DO NOT REMOVE."""
-    result: dict[str, DocumentAccess] = {}
-    for user_file in user_files:
-        if user_file.user is None:
-            result[str(user_file.id)] = DocumentAccess.build(
-                user_emails=[],
-                user_groups=[],
-                is_public=True,
-                external_user_emails=[],
-                external_user_group_ids=[],
-            )
-            continue
-
-        emails, is_public = collect_user_file_access(user_file)
-        group_names = _collect_user_file_group_names(user_file)
-        result[str(user_file.id)] = DocumentAccess.build(
-            user_emails=list(emails),
-            user_groups=list(group_names),
-            is_public=is_public,
-            external_user_emails=[],
-            external_user_group_ids=[],
-        )
-    return result
-
-
 def _get_acl_for_user(user: User, db_session: Session) -> set[str]:
     """Returns a list of ACL entries that the user has access to. This is meant to be
     used downstream to filter out documents that the user does not have access to. The

backend/ee/onyx/db/persona.py

@@ -7,7 +7,6 @@ from onyx.db.models import Persona
 from onyx.db.models import Persona__User
 from onyx.db.models import Persona__UserGroup
 from onyx.db.notification import create_notification
-from onyx.db.persona import mark_persona_user_files_for_sync
 from onyx.server.features.persona.models import PersonaSharedNotificationData
 
 
@@ -27,9 +26,7 @@ def update_persona_access(
 
     NOTE: Callers are responsible for committing."""
 
-    needs_sync = False
     if is_public is not None:
-        needs_sync = True
         persona = db_session.query(Persona).filter(Persona.id == persona_id).first()
         if persona:
             persona.is_public = is_public
@@ -38,7 +35,6 @@ def update_persona_access(
     # and a non-empty list means "replace with these shares".
 
     if user_ids is not None:
-        needs_sync = True
         db_session.query(Persona__User).filter(
             Persona__User.persona_id == persona_id
         ).delete(synchronize_session="fetch")
@@ -58,7 +54,6 @@ def update_persona_access(
                 )
 
     if group_ids is not None:
-        needs_sync = True
         db_session.query(Persona__UserGroup).filter(
             Persona__UserGroup.persona_id == persona_id
         ).delete(synchronize_session="fetch")
@@ -68,7 +63,3 @@ def update_persona_access(
             db_session.add(
                 Persona__UserGroup(persona_id=persona_id, user_group_id=group_id)
             )
-
-    # When sharing changes, user file ACLs need to be updated in the vector DB
-    if needs_sync:
-        mark_persona_user_files_for_sync(persona_id, db_session)

backend/ee/onyx/external_permissions/jira/group_sync.py

@@ -1,8 +1,6 @@
 from collections.abc import Generator
-from typing import Any
 
 from jira import JIRA
-from jira.exceptions import JIRAError
 
 from ee.onyx.db.external_perm import ExternalUserGroup
 from onyx.connectors.jira.utils import build_jira_client
@@ -11,102 +9,107 @@ from onyx.utils.logger import setup_logger
 
 logger = setup_logger()
 
-_ATLASSIAN_ACCOUNT_TYPE = "atlassian"
-_GROUP_MEMBER_PAGE_SIZE = 50
 
-# The GET /group/member endpoint was introduced in Jira 6.0.
-# Jira versions older than 6.0 do not have group management REST APIs at all.
-_MIN_JIRA_VERSION_FOR_GROUP_MEMBER = "6.0"
-
-
-def _fetch_group_member_page(
+def _get_jira_group_members_email(
     jira_client: JIRA,
     group_name: str,
-    start_at: int,
-) -> dict[str, Any]:
-    """Fetch a single page from the non-deprecated GET /group/member endpoint.
+) -> list[str]:
+    """Get all member emails for a Jira group.
 
-    The old GET /group endpoint (used by jira_client.group_members()) is deprecated
-    and decommissioned in Jira Server 10.3+. This uses the replacement endpoint
-    directly via the library's internal _get_json helper, following the same pattern
-    as enhanced_search_ids / bulk_fetch_issues in connector.py.
-
-    There is an open PR to the library to switch to this endpoint since last year:
-    https://github.com/pycontribs/jira/pull/2356
-    so once it is merged and released, we can switch to using the library function.
+    Filters out app accounts (bots, integrations) and only returns real user emails.
     """
+    emails: list[str] = []
+
     try:
-        return jira_client._get_json(
-            "group/member",
-            params={
-                "groupname": group_name,
-                "includeInactiveUsers": "false",
-                "startAt": start_at,
-                "maxResults": _GROUP_MEMBER_PAGE_SIZE,
-            },
-        )
-    except JIRAError as e:
-        if e.status_code == 404:
-            raise RuntimeError(
-                f"GET /group/member returned 404 for group '{group_name}'. "
-                f"This endpoint requires Jira {_MIN_JIRA_VERSION_FOR_GROUP_MEMBER}+. "
-                f"If you are running a self-hosted Jira instance, please upgrade "
-                f"to at least Jira {_MIN_JIRA_VERSION_FOR_GROUP_MEMBER}."
-            ) from e
-        raise
+        # group_members returns an OrderedDict of account_id -> member_info
+        members = jira_client.group_members(group=group_name)
 
+        if not members:
+            logger.warning(f"No members found for group {group_name}")
+            return emails
 
-def _get_group_member_emails(
-    jira_client: JIRA,
-    group_name: str,
-) -> set[str]:
-    """Get all member emails for a single Jira group.
+        for account_id, member_info in members.items():
+            # member_info is a dict with keys like 'fullname', 'email', 'active'
+            email = member_info.get("email")
 
-    Uses the non-deprecated GET /group/member endpoint which returns full user
-    objects including accountType, so we can filter out app/customer accounts
-    without making separate user() calls.
-    """
-    emails: set[str] = set()
-    start_at = 0
-
-    while True:
-        try:
-            page = _fetch_group_member_page(jira_client, group_name, start_at)
-        except Exception as e:
-            logger.error(f"Error fetching members for group {group_name}: {e}")
-            raise
-
-        members: list[dict[str, Any]] = page.get("values", [])
-        for member in members:
-            account_type = member.get("accountType")
-            # On Jira DC < 9.0, accountType is absent; include those users.
-            # On Cloud / DC 9.0+, filter to real user accounts only.
-            if account_type is not None and account_type != _ATLASSIAN_ACCOUNT_TYPE:
-                continue
-
-            email = member.get("emailAddress")
-            if email:
-                emails.add(email)
+            # Skip "hidden" emails - these are typically app accounts
+            if email and email != "hidden":
+                emails.append(email)
             else:
-                logger.warning(
-                    f"Atlassian user {member.get('accountId', 'unknown')} "
-                    f"in group {group_name} has no visible email address"
-                )
+                # For cloud, we might need to fetch user details separately
+                try:
+                    user = jira_client.user(id=account_id)
 
-        if page.get("isLast", True) or not members:
-            break
-        start_at += len(members)
+                    # Skip app accounts (bots, integrations, etc.)
+                    if hasattr(user, "accountType") and user.accountType == "app":
+                        logger.info(
+                            f"Skipping app account {account_id} for group {group_name}"
+                        )
+                        continue
+
+                    if hasattr(user, "emailAddress") and user.emailAddress:
+                        emails.append(user.emailAddress)
+                    else:
+                        logger.warning(f"User {account_id} has no email address")
+                except Exception as e:
+                    logger.warning(
+                        f"Could not fetch email for user {account_id} in group {group_name}: {e}"
+                    )
+
+    except Exception as e:
+        logger.error(f"Error fetching members for group {group_name}: {e}")
 
     return emails
 
 
+def _build_group_member_email_map(
+    jira_client: JIRA,
+) -> dict[str, set[str]]:
+    """Build a map of group names to member emails."""
+    group_member_emails: dict[str, set[str]] = {}
+
+    try:
+        # Get all groups from Jira - returns a list of group name strings
+        group_names = jira_client.groups()
+
+        if not group_names:
+            logger.warning("No groups found in Jira")
+            return group_member_emails
+
+        logger.info(f"Found {len(group_names)} groups in Jira")
+
+        for group_name in group_names:
+            if not group_name:
+                continue
+
+            member_emails = _get_jira_group_members_email(
+                jira_client=jira_client,
+                group_name=group_name,
+            )
+
+            if member_emails:
+                group_member_emails[group_name] = set(member_emails)
+                logger.debug(
+                    f"Found {len(member_emails)} members for group {group_name}"
+                )
+            else:
+                logger.debug(f"No members found for group {group_name}")
+
+    except Exception as e:
+        logger.error(f"Error building group member email map: {e}")
+
+    return group_member_emails
+
+
 def jira_group_sync(
     tenant_id: str,  # noqa: ARG001
     cc_pair: ConnectorCredentialPair,
 ) -> Generator[ExternalUserGroup, None, None]:
-    """Sync Jira groups and their members, yielding one group at a time.
+    """
+    Sync Jira groups and their members.
 
-    Streams group-by-group rather than accumulating all groups in memory.
+    This function fetches all groups from Jira and yields ExternalUserGroup
+    objects containing the group ID and member emails.
     """
     jira_base_url = cc_pair.connector.connector_specific_config.get("jira_base_url", "")
     scoped_token = cc_pair.connector.connector_specific_config.get(
@@ -127,26 +130,12 @@ def jira_group_sync(
         scoped_token=scoped_token,
     )
 
-    group_names = jira_client.groups()
-    if not group_names:
-        raise ValueError(f"No groups found for cc_pair_id={cc_pair.id}")
+    group_member_email_map = _build_group_member_email_map(jira_client=jira_client)
+    if not group_member_email_map:
+        raise ValueError(f"No groups with members found for cc_pair_id={cc_pair.id}")
 
-    logger.info(f"Found {len(group_names)} groups in Jira")
-
-    for group_name in group_names:
-        if not group_name:
-            continue
-
-        member_emails = _get_group_member_emails(
-            jira_client=jira_client,
-            group_name=group_name,
-        )
-        if not member_emails:
-            logger.debug(f"No members found for group {group_name}")
-            continue
-
-        logger.debug(f"Found {len(member_emails)} members for group {group_name}")
+    for group_id, group_member_emails in group_member_email_map.items():
         yield ExternalUserGroup(
-            id=group_name,
-            user_emails=list(member_emails),
+            id=group_id,
+            user_emails=list(group_member_emails),
         )

backend/ee/onyx/server/seeding.py

@@ -26,7 +26,6 @@ from onyx.db.models import Tool
 from onyx.db.persona import upsert_persona
 from onyx.server.features.persona.models import PersonaUpsertRequest
 from onyx.server.manage.llm.models import LLMProviderUpsertRequest
-from onyx.server.manage.llm.models import LLMProviderView
 from onyx.server.settings.models import Settings
 from onyx.server.settings.store import store_settings as store_base_settings
 from onyx.utils.logger import setup_logger
@@ -126,16 +125,10 @@ def _seed_llms(
         existing = fetch_existing_llm_provider(name=request.name, db_session=db_session)
         if existing:
             request.id = existing.id
-    seeded_providers: list[LLMProviderView] = []
-    for llm_upsert_request in llm_upsert_requests:
-        try:
-            seeded_providers.append(upsert_llm_provider(llm_upsert_request, db_session))
-        except ValueError as e:
-            logger.warning(
-                "Failed to upsert LLM provider '%s' during seeding: %s",
-                llm_upsert_request.name,
-                e,
-            )
+    seeded_providers = [
+        upsert_llm_provider(llm_upsert_request, db_session)
+        for llm_upsert_request in llm_upsert_requests
+    ]
 
     default_provider = next(
         (p for p in seeded_providers if p.model_configurations), None

backend/onyx/access/access.py

@@ -1,6 +1,7 @@
 from collections.abc import Callable
 from typing import cast
 
+from sqlalchemy.orm import joinedload
 from sqlalchemy.orm import Session
 
 from onyx.access.models import DocumentAccess
@@ -11,7 +12,6 @@ from onyx.db.document import get_access_info_for_document
 from onyx.db.document import get_access_info_for_documents
 from onyx.db.models import User
 from onyx.db.models import UserFile
-from onyx.db.user_file import fetch_user_files_with_access_relationships
 from onyx.utils.variable_functionality import fetch_ee_implementation_or_noop
 from onyx.utils.variable_functionality import fetch_versioned_implementation
 
@@ -132,61 +132,19 @@ def get_access_for_user_files(
     user_file_ids: list[str],
     db_session: Session,
 ) -> dict[str, DocumentAccess]:
-    versioned_fn = fetch_versioned_implementation(
-        "onyx.access.access", "get_access_for_user_files_impl"
+    user_files = (
+        db_session.query(UserFile)
+        .options(joinedload(UserFile.user))  # Eager load the user relationship
+        .filter(UserFile.id.in_(user_file_ids))
+        .all()
     )
-    return versioned_fn(user_file_ids, db_session)
-
-
-def get_access_for_user_files_impl(
-    user_file_ids: list[str],
-    db_session: Session,
-) -> dict[str, DocumentAccess]:
-    user_files = fetch_user_files_with_access_relationships(user_file_ids, db_session)
-    return build_access_for_user_files_impl(user_files)
-
-
-def build_access_for_user_files(
-    user_files: list[UserFile],
-) -> dict[str, DocumentAccess]:
-    """Compute access from pre-loaded UserFile objects (with relationships).
-    Callers must ensure UserFile.user, Persona.users, and Persona.user are
-    eagerly loaded (and Persona.groups for the EE path)."""
-    versioned_fn = fetch_versioned_implementation(
-        "onyx.access.access", "build_access_for_user_files_impl"
-    )
-    return versioned_fn(user_files)
-
-
-def build_access_for_user_files_impl(
-    user_files: list[UserFile],
-) -> dict[str, DocumentAccess]:
-    result: dict[str, DocumentAccess] = {}
-    for user_file in user_files:
-        emails, is_public = collect_user_file_access(user_file)
-        result[str(user_file.id)] = DocumentAccess.build(
-            user_emails=list(emails),
+    return {
+        str(user_file.id): DocumentAccess.build(
+            user_emails=[user_file.user.email] if user_file.user else [],
             user_groups=[],
-            is_public=is_public,
+            is_public=True if user_file.user is None else False,
             external_user_emails=[],
             external_user_group_ids=[],
         )
-    return result
-
-
-def collect_user_file_access(user_file: UserFile) -> tuple[set[str], bool]:
-    """Collect all user emails that should have access to this user file.
-    Includes the owner plus any users who have access via shared personas.
-    Returns (emails, is_public)."""
-    emails: set[str] = {user_file.user.email}
-    is_public = False
-    for persona in user_file.assistants:
-        if persona.deleted:
-            continue
-        if persona.is_public:
-            is_public = True
-        if persona.user_id is not None and persona.user:
-            emails.add(persona.user.email)
-        for shared_user in persona.users:
-            emails.add(shared_user.email)
-    return emails, is_public
+        for user_file in user_files
+    }

backend/onyx/background/celery/celery_utils.py

@@ -115,6 +115,8 @@ def _extract_from_batch(
     for item in doc_list:
         if isinstance(item, HierarchyNode):
             hierarchy_nodes.append(item)
+            if item.raw_node_id not in ids:
+                ids[item.raw_node_id] = None
         elif isinstance(item, ConnectorFailure):
             failed_id = _get_failure_id(item)
             if failed_id:
@@ -123,7 +125,8 @@ def _extract_from_batch(
                 f"Failed to retrieve document {failed_id}: " f"{item.failure_message}"
             )
         else:
-            ids[item.id] = item.parent_hierarchy_raw_node_id
+            parent_raw = getattr(item, "parent_hierarchy_raw_node_id", None)
+            ids[item.id] = parent_raw
     return BatchResult(raw_id_to_parent=ids, hierarchy_nodes=hierarchy_nodes)
 
 
@@ -189,7 +192,9 @@ def extract_ids_from_runnable_connector(
         batch_ids = batch_result.raw_id_to_parent
         batch_nodes = batch_result.hierarchy_nodes
         doc_batch_processing_func(batch_ids)
-        all_raw_id_to_parent.update(batch_ids)
+        for k, v in batch_ids.items():
+            if v is not None or k not in all_raw_id_to_parent:
+                all_raw_id_to_parent[k] = v
         all_hierarchy_nodes.extend(batch_nodes)
 
         if callback:

backend/onyx/background/celery/tasks/hierarchyfetching/tasks.py

@@ -40,7 +40,6 @@ from onyx.db.connector_credential_pair import get_connector_credential_pair_from
 from onyx.db.engine.sql_engine import get_session_with_current_tenant
 from onyx.db.enums import AccessType
 from onyx.db.enums import ConnectorCredentialPairStatus
-from onyx.db.hierarchy import upsert_hierarchy_node_cc_pair_entries
 from onyx.db.hierarchy import upsert_hierarchy_nodes_batch
 from onyx.db.models import ConnectorCredentialPair
 from onyx.redis.redis_hierarchy import cache_hierarchy_nodes_batch
@@ -290,14 +289,6 @@ def _run_hierarchy_extraction(
             is_connector_public=is_connector_public,
         )
 
-        upsert_hierarchy_node_cc_pair_entries(
-            db_session=db_session,
-            hierarchy_node_ids=[n.id for n in upserted_nodes],
-            connector_id=cc_pair.connector_id,
-            credential_id=cc_pair.credential_id,
-            commit=True,
-        )
-
         # Cache in Redis for fast ancestor resolution
         cache_entries = [
             HierarchyNodeCacheEntry.from_db_model(node) for node in upserted_nodes

backend/onyx/background/celery/tasks/opensearch_migration/constants.py

@@ -11,9 +11,6 @@
 # lock after its cleanup which happens at most after its soft timeout.
 
 # Constants corresponding to migrate_documents_from_vespa_to_opensearch_task.
-from onyx.configs.app_configs import OPENSEARCH_MIGRATION_GET_VESPA_CHUNKS_PAGE_SIZE
-
-
 MIGRATION_TASK_SOFT_TIME_LIMIT_S = 60 * 5  # 5 minutes.
 MIGRATION_TASK_TIME_LIMIT_S = 60 * 6  # 6 minutes.
 # The maximum time the lock can be held for. Will automatically be released
@@ -47,7 +44,7 @@ TOTAL_ALLOWABLE_DOC_MIGRATION_ATTEMPTS_BEFORE_PERMANENT_FAILURE = 15
 
 # WARNING: Do not change these values without knowing what changes also need to
 # be made to OpenSearchTenantMigrationRecord.
-GET_VESPA_CHUNKS_PAGE_SIZE = OPENSEARCH_MIGRATION_GET_VESPA_CHUNKS_PAGE_SIZE
+GET_VESPA_CHUNKS_PAGE_SIZE = 500
 GET_VESPA_CHUNKS_SLICE_COUNT = 4
 
 # String used to indicate in the vespa_visit_continuation_token mapping that the

backend/onyx/background/celery/tasks/pruning/tasks.py

@@ -48,15 +48,10 @@ from onyx.db.enums import AccessType
 from onyx.db.enums import ConnectorCredentialPairStatus
 from onyx.db.enums import SyncStatus
 from onyx.db.enums import SyncType
-from onyx.db.hierarchy import delete_orphaned_hierarchy_nodes
 from onyx.db.hierarchy import link_hierarchy_nodes_to_documents
-from onyx.db.hierarchy import remove_stale_hierarchy_node_cc_pair_entries
-from onyx.db.hierarchy import reparent_orphaned_hierarchy_nodes
 from onyx.db.hierarchy import update_document_parent_hierarchy_nodes
-from onyx.db.hierarchy import upsert_hierarchy_node_cc_pair_entries
 from onyx.db.hierarchy import upsert_hierarchy_nodes_batch
 from onyx.db.models import ConnectorCredentialPair
-from onyx.db.models import HierarchyNode as DBHierarchyNode
 from onyx.db.sync_record import insert_sync_record
 from onyx.db.sync_record import update_sync_record_status
 from onyx.db.tag import delete_orphan_tags__no_commit
@@ -65,7 +60,6 @@ from onyx.redis.redis_connector_prune import RedisConnectorPrune
 from onyx.redis.redis_connector_prune import RedisConnectorPrunePayload
 from onyx.redis.redis_hierarchy import cache_hierarchy_nodes_batch
 from onyx.redis.redis_hierarchy import ensure_source_node_exists
-from onyx.redis.redis_hierarchy import evict_hierarchy_nodes_from_cache
 from onyx.redis.redis_hierarchy import get_node_id_from_raw_id
 from onyx.redis.redis_hierarchy import get_source_node_id_from_cache
 from onyx.redis.redis_hierarchy import HierarchyNodeCacheEntry
@@ -585,12 +579,11 @@ def connector_pruning_generator_task(
             source = cc_pair.connector.source
             redis_client = get_redis_client(tenant_id=tenant_id)
 
-            ensure_source_node_exists(redis_client, db_session, source)
-
-            upserted_nodes: list[DBHierarchyNode] = []
             if extraction_result.hierarchy_nodes:
                 is_connector_public = cc_pair.access_type == AccessType.PUBLIC
 
+                ensure_source_node_exists(redis_client, db_session, source)
+
                 upserted_nodes = upsert_hierarchy_nodes_batch(
                     db_session=db_session,
                     nodes=extraction_result.hierarchy_nodes,
@@ -599,14 +592,6 @@ def connector_pruning_generator_task(
                     is_connector_public=is_connector_public,
                 )
 
-                upsert_hierarchy_node_cc_pair_entries(
-                    db_session=db_session,
-                    hierarchy_node_ids=[n.id for n in upserted_nodes],
-                    connector_id=connector_id,
-                    credential_id=credential_id,
-                    commit=True,
-                )
-
                 cache_entries = [
                     HierarchyNodeCacheEntry.from_db_model(node)
                     for node in upserted_nodes
@@ -622,6 +607,7 @@ def connector_pruning_generator_task(
                     f"hierarchy nodes for cc_pair={cc_pair_id}"
                 )
 
+            ensure_source_node_exists(redis_client, db_session, source)
             # Resolve parent_hierarchy_raw_node_id → parent_hierarchy_node_id
             # and bulk-update documents, mirroring the docfetching resolution
             _resolve_and_update_document_parents(
@@ -678,43 +664,6 @@ def connector_pruning_generator_task(
             )
 
             redis_connector.prune.generator_complete = tasks_generated
-
-            # --- Hierarchy node pruning ---
-            live_node_ids = {n.id for n in upserted_nodes}
-            stale_removed = remove_stale_hierarchy_node_cc_pair_entries(
-                db_session=db_session,
-                connector_id=connector_id,
-                credential_id=credential_id,
-                live_hierarchy_node_ids=live_node_ids,
-                commit=True,
-            )
-            deleted_raw_ids = delete_orphaned_hierarchy_nodes(
-                db_session=db_session,
-                source=source,
-                commit=True,
-            )
-            reparented_nodes = reparent_orphaned_hierarchy_nodes(
-                db_session=db_session,
-                source=source,
-                commit=True,
-            )
-            if deleted_raw_ids:
-                evict_hierarchy_nodes_from_cache(redis_client, source, deleted_raw_ids)
-            if reparented_nodes:
-                reparented_cache_entries = [
-                    HierarchyNodeCacheEntry.from_db_model(node)
-                    for node in reparented_nodes
-                ]
-                cache_hierarchy_nodes_batch(
-                    redis_client, source, reparented_cache_entries
-                )
-            if stale_removed or deleted_raw_ids or reparented_nodes:
-                task_logger.info(
-                    f"Hierarchy node pruning: cc_pair={cc_pair_id} "
-                    f"stale_entries_removed={stale_removed} "
-                    f"nodes_deleted={len(deleted_raw_ids)} "
-                    f"nodes_reparented={len(reparented_nodes)}"
-                )
     except Exception as e:
         task_logger.exception(
             f"Pruning exceptioned: cc_pair={cc_pair_id} "

backend/onyx/background/celery/tasks/user_file_processing/tasks.py

@@ -12,9 +12,9 @@ from redis import Redis
 from redis.lock import Lock as RedisLock
 from retry import retry
 from sqlalchemy import select
+from sqlalchemy.orm import selectinload
 from sqlalchemy.orm import Session
 
-from onyx.access.access import build_access_for_user_files
 from onyx.background.celery.apps.app_base import task_logger
 from onyx.background.celery.celery_redis import celery_get_queue_length
 from onyx.background.celery.celery_utils import httpx_init_vespa_pool
@@ -43,9 +43,7 @@ from onyx.db.enums import UserFileStatus
 from onyx.db.models import UserFile
 from onyx.db.search_settings import get_active_search_settings
 from onyx.db.search_settings import get_active_search_settings_list
-from onyx.db.user_file import fetch_user_files_with_access_relationships
 from onyx.document_index.factory import get_all_document_indices
-from onyx.document_index.interfaces import VespaDocumentFields
 from onyx.document_index.interfaces import VespaDocumentUserFields
 from onyx.document_index.vespa_constants import DOCUMENT_ID_ENDPOINT
 from onyx.file_store.file_store import get_default_file_store
@@ -56,7 +54,6 @@ from onyx.indexing.adapters.user_file_indexing_adapter import UserFileIndexingAd
 from onyx.indexing.embedder import DefaultIndexingEmbedder
 from onyx.indexing.indexing_pipeline import run_indexing_pipeline
 from onyx.redis.redis_pool import get_redis_client
-from onyx.utils.variable_functionality import global_version
 
 
 def _as_uuid(value: str | UUID) -> UUID:
@@ -794,12 +791,11 @@ def project_sync_user_file_impl(
 
     try:
         with get_session_with_current_tenant() as db_session:
-            user_files = fetch_user_files_with_access_relationships(
-                [user_file_id],
-                db_session,
-                eager_load_groups=global_version.is_ee_version(),
-            )
-            user_file = user_files[0] if user_files else None
+            user_file = db_session.execute(
+                select(UserFile)
+                .where(UserFile.id == _as_uuid(user_file_id))
+                .options(selectinload(UserFile.assistants))
+            ).scalar_one_or_none()
             if not user_file:
                 task_logger.info(
                     f"project_sync_user_file_impl - User file not found id={user_file_id}"
@@ -827,21 +823,12 @@ def project_sync_user_file_impl(
 
                 project_ids = [project.id for project in user_file.projects]
                 persona_ids = [p.id for p in user_file.assistants if not p.deleted]
-
-                file_id_str = str(user_file.id)
-                access_map = build_access_for_user_files([user_file])
-                access = access_map.get(file_id_str)
-
                 for retry_document_index in retry_document_indices:
                     retry_document_index.update_single(
-                        doc_id=file_id_str,
+                        doc_id=str(user_file.id),
                         tenant_id=tenant_id,
                         chunk_count=user_file.chunk_count,
-                        fields=(
-                            VespaDocumentFields(access=access)
-                            if access is not None
-                            else None
-                        ),
+                        fields=None,
                         user_fields=VespaDocumentUserFields(
                             user_projects=project_ids,
                             personas=persona_ids,

backend/onyx/background/indexing/run_docfetching.py

@@ -45,7 +45,6 @@ from onyx.db.enums import ConnectorCredentialPairStatus
 from onyx.db.enums import IndexingStatus
 from onyx.db.enums import IndexModelStatus
 from onyx.db.enums import ProcessingMode
-from onyx.db.hierarchy import upsert_hierarchy_node_cc_pair_entries
 from onyx.db.hierarchy import upsert_hierarchy_nodes_batch
 from onyx.db.index_attempt import create_index_attempt_error
 from onyx.db.index_attempt import get_index_attempt
@@ -588,14 +587,6 @@ def connector_document_extraction(
                             is_connector_public=is_connector_public,
                         )
 
-                        upsert_hierarchy_node_cc_pair_entries(
-                            db_session=db_session,
-                            hierarchy_node_ids=[n.id for n in upserted_nodes],
-                            connector_id=db_connector.id,
-                            credential_id=db_credential.id,
-                            commit=True,
-                        )
-
                         # Cache in Redis for fast ancestor resolution during doc processing
                         redis_client = get_redis_client(tenant_id=tenant_id)
                         cache_entries = [

backend/onyx/chat/llm_loop.py

@@ -50,7 +50,6 @@ from onyx.tools.built_in_tools import CITEABLE_TOOLS_NAMES
 from onyx.tools.built_in_tools import STOPPING_TOOLS_NAMES
 from onyx.tools.interface import Tool
 from onyx.tools.models import ChatFile
-from onyx.tools.models import CustomToolCallSummary
 from onyx.tools.models import MemoryToolResponseSnapshot
 from onyx.tools.models import PythonToolRichResponse
 from onyx.tools.models import ToolCallInfo
@@ -981,10 +980,6 @@ def run_llm_loop(
 
                 if memory_snapshot:
                     saved_response = json.dumps(memory_snapshot.model_dump())
-                elif isinstance(tool_response.rich_response, CustomToolCallSummary):
-                    saved_response = json.dumps(
-                        tool_response.rich_response.model_dump()
-                    )
                 elif isinstance(tool_response.rich_response, str):
                     saved_response = tool_response.rich_response
                 else:

backend/onyx/configs/app_configs.py

@@ -204,12 +204,6 @@ JWT_PUBLIC_KEY_URL: str | None = os.getenv("JWT_PUBLIC_KEY_URL", None)
 
 USER_AUTH_SECRET = os.environ.get("USER_AUTH_SECRET", "")
 
-if AUTH_TYPE == AuthType.BASIC and not USER_AUTH_SECRET:
-    logger.warning(
-        "USER_AUTH_SECRET is not set. This is required for secure password reset "
-        "and email verification tokens. Please set USER_AUTH_SECRET in production."
-    )
-
 # Duration (in seconds) for which the FastAPI Users JWT token remains valid in the user's browser.
 # By default, this is set to match the Redis expiry time for consistency.
 AUTH_COOKIE_EXPIRE_TIME_SECONDS = int(
@@ -311,12 +305,6 @@ VERIFY_CREATE_OPENSEARCH_INDEX_ON_INIT_MT = (
     os.environ.get("VERIFY_CREATE_OPENSEARCH_INDEX_ON_INIT_MT", "true").lower()
     == "true"
 )
-OPENSEARCH_MIGRATION_GET_VESPA_CHUNKS_PAGE_SIZE = int(
-    os.environ.get("OPENSEARCH_MIGRATION_GET_VESPA_CHUNKS_PAGE_SIZE") or 500
-)
-OPENSEARCH_OVERRIDE_DEFAULT_NUM_HYBRID_SEARCH_CANDIDATES = int(
-    os.environ.get("OPENSEARCH_DEFAULT_NUM_HYBRID_SEARCH_CANDIDATES") or 0
-)
 
 VESPA_HOST = os.environ.get("VESPA_HOST") or "localhost"
 # NOTE: this is used if and only if the vespa config server is accessible via a

backend/onyx/connectors/sharepoint/connector.py

@@ -258,10 +258,6 @@ class SharepointConnectorCheckpoint(ConnectorCheckpoint):
     # Track yielded hierarchy nodes by their raw_node_id (URLs) to avoid duplicates
     seen_hierarchy_node_raw_ids: set[str] = Field(default_factory=set)
 
-    # Track yielded document IDs to avoid processing the same document twice.
-    # The Microsoft Graph delta API can return the same item on multiple pages.
-    seen_document_ids: set[str] = Field(default_factory=set)
-
 
 class SharepointAuthMethod(Enum):
     CLIENT_SECRET = "client_secret"
@@ -1561,7 +1557,6 @@ class SharepointConnector(
         checkpoint.current_drive_id = None
         checkpoint.current_drive_web_url = None
         checkpoint.current_drive_delta_next_link = None
-        checkpoint.seen_document_ids.clear()
 
     def _fetch_slim_documents_from_sharepoint(self) -> GenerateSlimDocumentOutput:
         site_descriptors = self.site_descriptors or self.fetch_sites()
@@ -2142,14 +2137,6 @@ class SharepointConnector(
             item_count = 0
             for driveitem in driveitems:
                 item_count += 1
-
-                if driveitem.id and driveitem.id in checkpoint.seen_document_ids:
-                    logger.debug(
-                        f"Skipping duplicate document {driveitem.id} "
-                        f"({driveitem.name})"
-                    )
-                    continue
-
                 driveitem_extension = get_file_ext(driveitem.name)
                 if driveitem_extension not in OnyxFileExtensions.ALL_ALLOWED_EXTENSIONS:
                     logger.warning(
@@ -2202,13 +2189,11 @@ class SharepointConnector(
 
                     if isinstance(doc_or_failure, Document):
                         if doc_or_failure.sections:
-                            checkpoint.seen_document_ids.add(doc_or_failure.id)
                             yield doc_or_failure
                         elif should_yield_if_empty:
                             doc_or_failure.sections = [
                                 TextSection(link=driveitem.web_url, text="")
                             ]
-                            checkpoint.seen_document_ids.add(doc_or_failure.id)
                             yield doc_or_failure
                         else:
                             logger.warning(

backend/onyx/db/hierarchy.py

@@ -2,10 +2,7 @@
 
 from collections import defaultdict
 
-from sqlalchemy import delete
 from sqlalchemy import select
-from sqlalchemy.dialects.postgresql import insert as pg_insert
-from sqlalchemy.engine import CursorResult
 from sqlalchemy.orm import Session
 
 from onyx.configs.constants import DocumentSource
@@ -13,7 +10,6 @@ from onyx.connectors.models import HierarchyNode as PydanticHierarchyNode
 from onyx.db.enums import HierarchyNodeType
 from onyx.db.models import Document
 from onyx.db.models import HierarchyNode
-from onyx.db.models import HierarchyNodeByConnectorCredentialPair
 from onyx.utils.logger import setup_logger
 from onyx.utils.variable_functionality import fetch_versioned_implementation
 
@@ -624,154 +620,3 @@ def update_hierarchy_node_permissions(
         db_session.flush()
 
     return True
-
-
-def upsert_hierarchy_node_cc_pair_entries(
-    db_session: Session,
-    hierarchy_node_ids: list[int],
-    connector_id: int,
-    credential_id: int,
-    commit: bool = True,
-) -> None:
-    """Insert rows into HierarchyNodeByConnectorCredentialPair, ignoring conflicts.
-
-    This records that the given cc_pair "owns" these hierarchy nodes. Used by
-    indexing, pruning, and hierarchy-fetching paths.
-    """
-    if not hierarchy_node_ids:
-        return
-
-    _M = HierarchyNodeByConnectorCredentialPair
-    stmt = pg_insert(_M).values(
-        [
-            {
-                _M.hierarchy_node_id: node_id,
-                _M.connector_id: connector_id,
-                _M.credential_id: credential_id,
-            }
-            for node_id in hierarchy_node_ids
-        ]
-    )
-    stmt = stmt.on_conflict_do_nothing()
-    db_session.execute(stmt)
-
-    if commit:
-        db_session.commit()
-    else:
-        db_session.flush()
-
-
-def remove_stale_hierarchy_node_cc_pair_entries(
-    db_session: Session,
-    connector_id: int,
-    credential_id: int,
-    live_hierarchy_node_ids: set[int],
-    commit: bool = True,
-) -> int:
-    """Delete join-table rows for this cc_pair that are NOT in the live set.
-
-    If ``live_hierarchy_node_ids`` is empty ALL rows for the cc_pair are deleted
-    (i.e. the connector no longer has any hierarchy nodes). Callers that want a
-    no-op when there are no live nodes must guard before calling.
-
-    Returns the number of deleted rows.
-    """
-    stmt = delete(HierarchyNodeByConnectorCredentialPair).where(
-        HierarchyNodeByConnectorCredentialPair.connector_id == connector_id,
-        HierarchyNodeByConnectorCredentialPair.credential_id == credential_id,
-    )
-    if live_hierarchy_node_ids:
-        stmt = stmt.where(
-            HierarchyNodeByConnectorCredentialPair.hierarchy_node_id.notin_(
-                live_hierarchy_node_ids
-            )
-        )
-
-    result: CursorResult = db_session.execute(stmt)  # type: ignore[assignment]
-    deleted = result.rowcount
-
-    if commit:
-        db_session.commit()
-    elif deleted:
-        db_session.flush()
-
-    return deleted
-
-
-def delete_orphaned_hierarchy_nodes(
-    db_session: Session,
-    source: DocumentSource,
-    commit: bool = True,
-) -> list[str]:
-    """Delete hierarchy nodes for a source that have zero cc_pair associations.
-
-    SOURCE-type nodes are excluded (they are synthetic roots).
-
-    Returns the list of raw_node_ids that were deleted (for cache eviction).
-    """
-    # Find orphaned nodes: no rows in the join table
-    orphan_stmt = (
-        select(HierarchyNode.id, HierarchyNode.raw_node_id)
-        .outerjoin(
-            HierarchyNodeByConnectorCredentialPair,
-            HierarchyNode.id
-            == HierarchyNodeByConnectorCredentialPair.hierarchy_node_id,
-        )
-        .where(
-            HierarchyNode.source == source,
-            HierarchyNode.node_type != HierarchyNodeType.SOURCE,
-            HierarchyNodeByConnectorCredentialPair.hierarchy_node_id.is_(None),
-        )
-    )
-    orphans = db_session.execute(orphan_stmt).all()
-    if not orphans:
-        return []
-
-    orphan_ids = [row[0] for row in orphans]
-    deleted_raw_ids = [row[1] for row in orphans]
-
-    db_session.execute(delete(HierarchyNode).where(HierarchyNode.id.in_(orphan_ids)))
-
-    if commit:
-        db_session.commit()
-    else:
-        db_session.flush()
-
-    return deleted_raw_ids
-
-
-def reparent_orphaned_hierarchy_nodes(
-    db_session: Session,
-    source: DocumentSource,
-    commit: bool = True,
-) -> list[HierarchyNode]:
-    """Re-parent hierarchy nodes whose parent_id is NULL to the SOURCE node.
-
-    After pruning deletes stale nodes, their former children get parent_id=NULL
-    via the SET NULL cascade. This function points them back to the SOURCE root.
-
-    Returns the reparented HierarchyNode objects (with updated parent_id)
-    so callers can refresh downstream caches.
-    """
-    source_node = get_source_hierarchy_node(db_session, source)
-    if not source_node:
-        return []
-
-    stmt = select(HierarchyNode).where(
-        HierarchyNode.source == source,
-        HierarchyNode.parent_id.is_(None),
-        HierarchyNode.node_type != HierarchyNodeType.SOURCE,
-    )
-    orphans = list(db_session.execute(stmt).scalars().all())
-    if not orphans:
-        return []
-
-    for node in orphans:
-        node.parent_id = source_node.id
-
-    if commit:
-        db_session.commit()
-    else:
-        db_session.flush()
-
-    return orphans

backend/onyx/db/llm.py

@@ -25,7 +25,6 @@ from onyx.server.manage.embedding.models import CloudEmbeddingProvider
 from onyx.server.manage.embedding.models import CloudEmbeddingProviderCreationRequest
 from onyx.server.manage.llm.models import LLMProviderUpsertRequest
 from onyx.server.manage.llm.models import LLMProviderView
-from onyx.server.manage.llm.models import SyncModelEntry
 from onyx.utils.logger import setup_logger
 from shared_configs.enums import EmbeddingProvider
 
@@ -271,35 +270,10 @@ def upsert_llm_provider(
         mc.name for mc in llm_provider_upsert_request.model_configurations
     }
 
-    # Build a lookup of requested visibility by model name
-    requested_visibility = {
-        mc.name: mc.is_visible
-        for mc in llm_provider_upsert_request.model_configurations
-    }
-
     # Delete removed models
     removed_ids = [
         mc.id for name, mc in existing_by_name.items() if name not in models_to_exist
     ]
-
-    default_model = fetch_default_llm_model(db_session)
-
-    # Prevent removing and hiding the default model
-    if default_model:
-        for name, mc in existing_by_name.items():
-            if mc.id == default_model.id:
-                if default_model.id in removed_ids:
-                    raise ValueError(
-                        f"Cannot remove the default model '{name}'. "
-                        "Please change the default model before removing."
-                    )
-                if not requested_visibility.get(name, True):
-                    raise ValueError(
-                        f"Cannot hide the default model '{name}'. "
-                        "Please change the default model before hiding."
-                    )
-                break
-
     if removed_ids:
         db_session.query(ModelConfiguration).filter(
             ModelConfiguration.id.in_(removed_ids)
@@ -370,9 +344,9 @@ def upsert_llm_provider(
 def sync_model_configurations(
     db_session: Session,
     provider_name: str,
-    models: list[SyncModelEntry],
+    models: list[dict],
 ) -> int:
-    """Sync model configurations for a dynamic provider (OpenRouter, Bedrock, Ollama, etc.).
+    """Sync model configurations for a dynamic provider (OpenRouter, Bedrock, Ollama).
 
     This inserts NEW models from the source API without overwriting existing ones.
     User preferences (is_visible, max_input_tokens) are preserved for existing models.
@@ -380,7 +354,7 @@ def sync_model_configurations(
     Args:
         db_session: Database session
         provider_name: Name of the LLM provider
-        models: List of SyncModelEntry objects describing the fetched models
+        models: List of model dicts with keys: name, display_name, max_input_tokens, supports_image_input
 
     Returns:
         Number of new models added
@@ -394,20 +368,21 @@ def sync_model_configurations(
 
     new_count = 0
     for model in models:
-        if model.name not in existing_names:
+        model_name = model["name"]
+        if model_name not in existing_names:
             # Insert new model with is_visible=False (user must explicitly enable)
             supported_flows = [LLMModelFlowType.CHAT]
-            if model.supports_image_input:
+            if model.get("supports_image_input", False):
                 supported_flows.append(LLMModelFlowType.VISION)
 
             insert_new_model_configuration__no_commit(
                 db_session=db_session,
                 llm_provider_id=provider.id,
-                model_name=model.name,
+                model_name=model_name,
                 supported_flows=supported_flows,
                 is_visible=False,
-                max_input_tokens=model.max_input_tokens,
-                display_name=model.display_name,
+                max_input_tokens=model.get("max_input_tokens"),
+                display_name=model.get("display_name"),
             )
             new_count += 1
 
@@ -563,6 +538,7 @@ def fetch_default_model(
         .options(selectinload(ModelConfiguration.llm_provider))
         .join(LLMModelFlow)
         .where(
+            ModelConfiguration.is_visible == True,  # noqa: E712
             LLMModelFlow.llm_model_flow_type == flow_type,
             LLMModelFlow.is_default == True,  # noqa: E712
         )
@@ -838,30 +814,44 @@ def sync_auto_mode_models(
             )
             changes += 1
 
-    # Update the default if this provider currently holds the global CHAT default.
-    # We flush (but don't commit) so that _update_default_model can see the new
-    # model rows, then commit everything atomically to avoid a window where the
-    # old default is invisible but still pointed-to.
-    db_session.flush()
+    db_session.commit()
 
+    # Update the default if this provider currently holds the global CHAT default
     recommended_default = llm_recommendations.get_default_model(provider.provider)
     if recommended_default:
-        current_default = fetch_default_llm_model(db_session)
+        current_default_name = db_session.scalar(
+            select(ModelConfiguration.name)
+            .join(
+                LLMModelFlow,
+                LLMModelFlow.model_configuration_id == ModelConfiguration.id,
+            )
+            .where(
+                ModelConfiguration.llm_provider_id == provider.id,
+                LLMModelFlow.llm_model_flow_type == LLMModelFlowType.CHAT,
+                LLMModelFlow.is_default == True,  # noqa: E712
+            )
+        )
 
         if (
-            current_default
-            and current_default.llm_provider_id == provider.id
-            and current_default.name != recommended_default.name
+            current_default_name is not None
+            and current_default_name != recommended_default.name
         ):
-            _update_default_model__no_commit(
-                db_session=db_session,
-                provider_id=provider.id,
-                model=recommended_default.name,
-                flow_type=LLMModelFlowType.CHAT,
-            )
-            changes += 1
+            try:
+                _update_default_model(
+                    db_session=db_session,
+                    provider_id=provider.id,
+                    model=recommended_default.name,
+                    flow_type=LLMModelFlowType.CHAT,
+                )
+                changes += 1
+            except ValueError:
+                logger.warning(
+                    "Recommended default model '%s' not found "
+                    "for provider_id=%s; skipping default update.",
+                    recommended_default.name,
+                    provider.id,
+                )
 
-    db_session.commit()
     return changes
 
 
@@ -992,7 +982,7 @@ def update_model_configuration__no_commit(
     db_session.flush()
 
 
-def _update_default_model__no_commit(
+def _update_default_model(
     db_session: Session,
     provider_id: int,
     model: str,
@@ -1030,14 +1020,6 @@ def _update_default_model__no_commit(
     new_default.is_default = True
     model_config.is_visible = True
 
-
-def _update_default_model(
-    db_session: Session,
-    provider_id: int,
-    model: str,
-    flow_type: LLMModelFlowType,
-) -> None:
-    _update_default_model__no_commit(db_session, provider_id, model, flow_type)
     db_session.commit()
 
 

backend/onyx/db/models.py

@@ -25,7 +25,6 @@ from sqlalchemy import desc
 from sqlalchemy import Enum
 from sqlalchemy import Float
 from sqlalchemy import ForeignKey
-from sqlalchemy import ForeignKeyConstraint
 from sqlalchemy import func
 from sqlalchemy import Index
 from sqlalchemy import Integer
@@ -163,8 +162,6 @@ class _EncryptedBase(TypeDecorator):
 
 
 class EncryptedString(_EncryptedBase):
-    # Must redeclare cache_ok in this child class since we explicitly redeclare _is_json
-    cache_ok = True
     _is_json: bool = False
 
     def process_bind_param(
@@ -191,7 +188,6 @@ class EncryptedString(_EncryptedBase):
 
 
 class EncryptedJson(_EncryptedBase):
-    cache_ok = True
     _is_json: bool = True
 
     def process_bind_param(
@@ -2429,38 +2425,6 @@ class SyncRecord(Base):
     )
 
 
-class HierarchyNodeByConnectorCredentialPair(Base):
-    """Tracks which cc_pairs reference each hierarchy node.
-
-    During pruning, stale entries are removed for the current cc_pair.
-    Hierarchy nodes with zero remaining entries are then deleted.
-    """
-
-    __tablename__ = "hierarchy_node_by_connector_credential_pair"
-
-    hierarchy_node_id: Mapped[int] = mapped_column(
-        ForeignKey("hierarchy_node.id", ondelete="CASCADE"), primary_key=True
-    )
-    connector_id: Mapped[int] = mapped_column(primary_key=True)
-    credential_id: Mapped[int] = mapped_column(primary_key=True)
-
-    __table_args__ = (
-        ForeignKeyConstraint(
-            ["connector_id", "credential_id"],
-            [
-                "connector_credential_pair.connector_id",
-                "connector_credential_pair.credential_id",
-            ],
-            ondelete="CASCADE",
-        ),
-        Index(
-            "ix_hierarchy_node_cc_pair_connector_credential",
-            "connector_id",
-            "credential_id",
-        ),
-    )
-
-
 class DocumentByConnectorCredentialPair(Base):
     """Represents an indexing of a document by a specific connector / credential pair"""
 

backend/onyx/db/persona.py

@@ -205,9 +205,7 @@ def update_persona_access(
 
     NOTE: Callers are responsible for committing."""
 
-    needs_sync = False
     if is_public is not None:
-        needs_sync = True
         persona = db_session.query(Persona).filter(Persona.id == persona_id).first()
         if persona:
             persona.is_public = is_public
@@ -215,7 +213,6 @@ def update_persona_access(
     # NOTE: For user-ids and group-ids, `None` means "leave unchanged", `[]` means "clear all shares",
     # and a non-empty list means "replace with these shares".
     if user_ids is not None:
-        needs_sync = True
         db_session.query(Persona__User).filter(
             Persona__User.persona_id == persona_id
         ).delete(synchronize_session="fetch")
@@ -236,7 +233,6 @@ def update_persona_access(
     # MIT doesn't support group-based sharing, so we allow clearing (no-op since
     # there shouldn't be any) but raise an error if trying to add actual groups.
     if group_ids is not None:
-        needs_sync = True
         db_session.query(Persona__UserGroup).filter(
             Persona__UserGroup.persona_id == persona_id
         ).delete(synchronize_session="fetch")
@@ -244,10 +240,6 @@ def update_persona_access(
         if group_ids:
             raise NotImplementedError("Onyx MIT does not support group-based sharing")
 
-    # When sharing changes, user file ACLs need to be updated in the vector DB
-    if needs_sync:
-        mark_persona_user_files_for_sync(persona_id, db_session)
-
 
 def create_update_persona(
     persona_id: int | None,
@@ -859,24 +851,6 @@ def update_personas_display_priority(
         db_session.commit()
 
 
-def mark_persona_user_files_for_sync(
-    persona_id: int,
-    db_session: Session,
-) -> None:
-    """When persona sharing changes, mark all of its user files for sync
-    so that their ACLs get updated in the vector DB."""
-    persona = (
-        db_session.query(Persona)
-        .options(selectinload(Persona.user_files))
-        .filter(Persona.id == persona_id)
-        .first()
-    )
-    if not persona:
-        return
-    file_ids = [uf.id for uf in persona.user_files]
-    _mark_files_need_persona_sync(db_session, file_ids)
-
-
 def _mark_files_need_persona_sync(
     db_session: Session,
     user_file_ids: list[UUID],

backend/onyx/db/user_file.py

@@ -3,11 +3,9 @@ from uuid import UUID
 
 from sqlalchemy import func
 from sqlalchemy import select
-from sqlalchemy.orm import joinedload
 from sqlalchemy.orm import selectinload
 from sqlalchemy.orm import Session
 
-from onyx.db.models import Persona
 from onyx.db.models import Project__UserFile
 from onyx.db.models import UserFile
 
@@ -120,31 +118,3 @@ def get_file_ids_by_user_file_ids(
 ) -> list[str]:
     user_files = db_session.query(UserFile).filter(UserFile.id.in_(user_file_ids)).all()
     return [user_file.file_id for user_file in user_files]
-
-
-def fetch_user_files_with_access_relationships(
-    user_file_ids: list[str],
-    db_session: Session,
-    eager_load_groups: bool = False,
-) -> list[UserFile]:
-    """Fetch user files with the owner and assistant relationships
-    eagerly loaded (needed for computing access control).
-
-    When eager_load_groups is True, Persona.groups is also loaded so that
-    callers can extract user-group names without a second DB round-trip."""
-    persona_sub_options = [
-        selectinload(Persona.users),
-        selectinload(Persona.user),
-    ]
-    if eager_load_groups:
-        persona_sub_options.append(selectinload(Persona.groups))
-
-    return (
-        db_session.query(UserFile)
-        .options(
-            joinedload(UserFile.user),
-            selectinload(UserFile.assistants).options(*persona_sub_options),
-        )
-        .filter(UserFile.id.in_(user_file_ids))
-        .all()
-    )

backend/onyx/document_index/opensearch/constants.py

@@ -1,10 +1,5 @@
 # Default value for the maximum number of tokens a chunk can hold, if none is
 # specified when creating an index.
-from onyx.configs.app_configs import (
-    OPENSEARCH_OVERRIDE_DEFAULT_NUM_HYBRID_SEARCH_CANDIDATES,
-)
-
-
 DEFAULT_MAX_CHUNK_SIZE = 512
 
 # Size of the dynamic list used to consider elements during kNN graph creation.
@@ -15,43 +10,27 @@ EF_CONSTRUCTION = 256
 # quality but increase memory footprint. Values typically range between 12 - 48.
 M = 32  # Set relatively high for better accuracy.
 
-# When performing hybrid search, we need to consider more candidates than the
-# number of results to be returned. This is because the scoring is hybrid and
-# the results are reordered due to the hybrid scoring. Higher = more candidates
-# for hybrid fusion = better retrieval accuracy, but results in more computation
-# per query. Imagine a simple case with a single keyword query and a single
-# vector query and we want 10 final docs. If we only fetch 10 candidates from
-# each of keyword and vector, they would have to have perfect overlap to get a
-# good hybrid ranking for the 10 results. If we fetch 1000 candidates from each,
-# we have a much higher chance of all 10 of the final desired docs showing up
-# and getting scored. In worse situations, the final 10 docs don't even show up
-# as the final 10 (worse than just a miss at the reranking step).
-DEFAULT_NUM_HYBRID_SEARCH_CANDIDATES = (
-    OPENSEARCH_OVERRIDE_DEFAULT_NUM_HYBRID_SEARCH_CANDIDATES
-    if OPENSEARCH_OVERRIDE_DEFAULT_NUM_HYBRID_SEARCH_CANDIDATES > 0
-    else 750
-)
+# When performing hybrid search, we need to consider more candidates than the number of results to be returned.
+# This is because the scoring is hybrid and the results are reordered due to the hybrid scoring.
+# Higher = more candidates for hybrid fusion = better retrieval accuracy, but results in more computation per query.
+# Imagine a simple case with a single keyword query and a single vector query and we want 10 final docs.
+# If we only fetch 10 candidates from each of keyword and vector, they would have to have perfect overlap to get a good hybrid
+# ranking for the 10 results. If we fetch 1000 candidates from each, we have a much higher chance of all 10 of the final desired
+# docs showing up and getting scored. In worse situations, the final 10 docs don't even show up as the final 10 (worse than just
+# a miss at the reranking step).
+DEFAULT_NUM_HYBRID_SEARCH_CANDIDATES = 750
 
-# Number of vectors to examine to decide the top k neighbors for the HNSW
-# method.
-# NOTE: "When creating a search query, you must specify k. If you provide both k
-# and ef_search, then the larger value is passed to the engine. If ef_search is
-# larger than k, you can provide the size parameter to limit the final number of
-# results to k." from
-# https://docs.opensearch.org/latest/query-dsl/specialized/k-nn/index/#ef_search
+# Number of vectors to examine for top k neighbors for the HNSW method.
 EF_SEARCH = DEFAULT_NUM_HYBRID_SEARCH_CANDIDATES
 
-# Since the titles are included in the contents, the embedding matches are
-# heavily downweighted as they act as a boost rather than an independent scoring
-# component.
+# Since the titles are included in the contents, they are heavily downweighted as they act as a boost
+# rather than an independent scoring component.
 SEARCH_TITLE_VECTOR_WEIGHT = 0.1
 SEARCH_CONTENT_VECTOR_WEIGHT = 0.45
-# Single keyword weight for both title and content (merged from former title
-# keyword + content keyword).
+# Single keyword weight for both title and content (merged from former title keyword + content keyword).
 SEARCH_KEYWORD_WEIGHT = 0.45
 
-# NOTE: It is critical that the order of these weights matches the order of the
-# sub-queries in the hybrid search.
+# NOTE: it is critical that the order of these weights matches the order of the sub-queries in the hybrid search.
 HYBRID_SEARCH_NORMALIZATION_WEIGHTS = [
     SEARCH_TITLE_VECTOR_WEIGHT,
     SEARCH_CONTENT_VECTOR_WEIGHT,

backend/onyx/document_index/opensearch/opensearch_document_index.py

@@ -433,16 +433,12 @@ class OpenSearchOldDocumentIndex(OldDocumentIndex):
             hidden=fields.hidden if fields else None,
             project_ids=(
                 set(user_fields.user_projects)
-                # NOTE: Empty user_projects is semantically different from None
-                # user_projects.
-                if user_fields and user_fields.user_projects is not None
+                if user_fields and user_fields.user_projects
                 else None
             ),
             persona_ids=(
                 set(user_fields.personas)
-                # NOTE: Empty personas is semantically different from None
-                # personas.
-                if user_fields and user_fields.personas is not None
+                if user_fields and user_fields.personas
                 else None
             ),
         )

backend/onyx/document_index/opensearch/search.py

@@ -255,12 +255,8 @@ class DocumentQuery:
                 f"result window ({DEFAULT_OPENSEARCH_MAX_RESULT_WINDOW})."
             )
 
-        # TODO(andrei, yuhong): We can tune this more dynamically based on
-        # num_hits.
-        max_results_per_subquery = DEFAULT_NUM_HYBRID_SEARCH_CANDIDATES
-
         hybrid_search_subqueries = DocumentQuery._get_hybrid_search_subqueries(
-            query_text, query_vector, vector_candidates=max_results_per_subquery
+            query_text, query_vector
         )
         hybrid_search_filters = DocumentQuery._get_search_filters(
             tenant_state=tenant_state,
@@ -289,16 +285,13 @@ class DocumentQuery:
         hybrid_search_query: dict[str, Any] = {
             "hybrid": {
                 "queries": hybrid_search_subqueries,
-                # Max results per subquery per shard before aggregation. Ensures
-                # keyword and vector subqueries contribute equally to the
-                # candidate pool for hybrid fusion.
+                # Max results per subquery per shard before aggregation. Ensures keyword and vector
+                # subqueries contribute equally to the candidate pool for hybrid fusion.
                 # Sources:
                 # https://docs.opensearch.org/latest/vector-search/ai-search/hybrid-search/pagination/
                 # https://opensearch.org/blog/navigating-pagination-in-hybrid-queries-with-the-pagination_depth-parameter/
-                "pagination_depth": max_results_per_subquery,
-                # Applied to all the sub-queries independently (this avoids
-                # subqueries having a lot of results thrown out during
-                # aggregation).
+                "pagination_depth": DEFAULT_NUM_HYBRID_SEARCH_CANDIDATES,
+                # Applied to all the sub-queries independently (this avoids having subqueries having a lot of results thrown out).
                 # Sources:
                 # https://docs.opensearch.org/latest/query-dsl/compound/hybrid/
                 # https://opensearch.org/blog/introducing-common-filter-support-for-hybrid-search-queries
@@ -381,10 +374,9 @@ class DocumentQuery:
     def _get_hybrid_search_subqueries(
         query_text: str,
         query_vector: list[float],
-        # The default number of neighbors to consider for knn vector similarity
-        # search. This is higher than the number of results because the scoring
-        # is hybrid. For a detailed breakdown, see where the default value is
-        # set.
+        # The default number of neighbors to consider for knn vector similarity search.
+        # This is higher than the number of results because the scoring is hybrid.
+        # for a detailed breakdown, see where the default value is set.
         vector_candidates: int = DEFAULT_NUM_HYBRID_SEARCH_CANDIDATES,
     ) -> list[dict[str, Any]]:
         """Returns subqueries for hybrid search.
@@ -408,27 +400,20 @@ class DocumentQuery:
         in a single hybrid query. Source:
         https://docs.opensearch.org/latest/query-dsl/compound/hybrid/
 
-        NOTE: Each query is independent during the search phase, there is no
-        backfilling of scores for missing query components. What this means is
-        that if a document was a good vector match but did not show up for
-        keyword, it gets a score of 0 for the keyword component of the hybrid
-        scoring. This is not as bad as just disregarding a score though as there
-        is normalization applied after. So really it is "increasing" the missing
-        score compared to if it was included and the range was renormalized.
-        This does however mean that between docs that have high scores for say
-        the vector field, the keyword scores between them are completely ignored
-        unless they also showed up in the keyword query as a reasonably high
-        match. TLDR, this is a bit of unique funky behavior but it seems ok.
+        NOTE: Each query is independent during the search phase, there is no backfilling of scores for missing query components.
+        What this means is that if a document was a good vector match but did not show up for keyword, it gets a score of 0 for
+        the keyword component of the hybrid scoring. This is not as bad as just disregarding a score though as there is
+        normalization applied after. So really it is "increasing" the missing score compared to if it was included and the range
+        was renormalized. This does however mean that between docs that have high scores for say the vector field, the keyword
+        scores between them are completely ignored unless they also showed up in the keyword query as a reasonably high match.
+        TLDR, this is a bit of unique funky behavior but it seems ok.
 
         NOTE: Options considered and rejected:
-        - minimum_should_match: Since it's hybrid search and users often provide
-          semantic queries, there is often a lot of terms, and very low number
-          of meaningful keywords (and a low ratio of keywords).
-        - fuzziness AUTO: Typo tolerance (0/1/2 edit distance by term length).
-          It's mostly for typos as the analyzer ("english" by default) already
-          does some stemming and tokenization. In testing datasets, this makes
-          recall slightly worse. It also is less performant so not really any
-          reason to do it.
+        - minimum_should_match: Since it's hybrid search and users often provide semantic queries, there is often a lot of terms,
+          and very low number of meaningful keywords (and a low ratio of keywords).
+        - fuzziness AUTO: typo tolerance (0/1/2 edit distance by term length). It's mostly for typos as the analyzer ("english by
+          default") already does some stemming and tokenization. In testing datasets, this makes recall slightly worse. It also is
+          less performant so not really any reason to do it.
 
         Args:
             query_text: The text of the query to search for.
@@ -738,13 +723,14 @@ class DocumentQuery:
             # document's metadata list.
             filter_clauses.append(_get_tag_filter(tags))
 
-        # Knowledge scope: explicit knowledge attachments restrict what an
-        # assistant can see. When none are set the assistant searches
-        # everything.
+        # Knowledge scope: explicit knowledge attachments restrict what
+        # an assistant can see.  When none are set the assistant
+        # searches everything.
         #
-        # project_id / persona_id are additive: they make overflowing user files
-        # findable but must NOT trigger the restriction on their own (an agent
-        # with no explicit knowledge should search everything).
+        # project_id / persona_id are additive: they make overflowing
+        # user files findable but must NOT trigger the restriction on
+        # their own (an agent with no explicit knowledge should search
+        # everything).
         has_knowledge_scope = (
             attached_document_ids
             or hierarchy_node_ids
@@ -772,8 +758,9 @@ class DocumentQuery:
                 knowledge_filter["bool"]["should"].append(
                     _get_document_set_filter(document_sets)
                 )
-            # Additive: widen scope to also cover overflowing user files, but
-            # only when an explicit restriction is already in effect.
+            # Additive: widen scope to also cover overflowing user
+            # files, but only when an explicit restriction is already
+            # in effect.
             if project_id is not None:
                 knowledge_filter["bool"]["should"].append(
                     _get_user_project_filter(project_id)

backend/onyx/document_index/vespa/index.py

@@ -690,12 +690,9 @@ class VespaIndex(DocumentIndex):
             )
 
         project_ids: set[int] | None = None
-        # NOTE: Empty user_projects is semantically different from None
-        # user_projects.
         if user_fields is not None and user_fields.user_projects is not None:
             project_ids = set(user_fields.user_projects)
         persona_ids: set[int] | None = None
-        # NOTE: Empty personas is semantically different from None personas.
         if user_fields is not None and user_fields.personas is not None:
             persona_ids = set(user_fields.personas)
         update_request = MetadataUpdateRequest(

backend/onyx/llm/constants.py

@@ -43,7 +43,6 @@ WELL_KNOWN_PROVIDER_NAMES = [
     LlmProviderNames.AZURE,
     LlmProviderNames.OLLAMA_CHAT,
     LlmProviderNames.LM_STUDIO,
-    LlmProviderNames.LITELLM_PROXY,
 ]
 
 
@@ -60,7 +59,6 @@ PROVIDER_DISPLAY_NAMES: dict[str, str] = {
     "ollama": "Ollama",
     LlmProviderNames.OLLAMA_CHAT: "Ollama",
     LlmProviderNames.LM_STUDIO: "LM Studio",
-    LlmProviderNames.LITELLM_PROXY: "LiteLLM Proxy",
     "groq": "Groq",
     "anyscale": "Anyscale",
     "deepseek": "DeepSeek",
@@ -111,7 +109,6 @@ AGGREGATOR_PROVIDERS: set[str] = {
     LlmProviderNames.LM_STUDIO,
     LlmProviderNames.VERTEX_AI,
     LlmProviderNames.AZURE,
-    LlmProviderNames.LITELLM_PROXY,
 }
 
 # Model family name mappings for display name generation

backend/onyx/llm/well_known_providers/constants.py

@@ -11,8 +11,6 @@ OLLAMA_API_KEY_CONFIG_KEY = "OLLAMA_API_KEY"
 LM_STUDIO_PROVIDER_NAME = "lm_studio"
 LM_STUDIO_API_KEY_CONFIG_KEY = "LM_STUDIO_API_KEY"
 
-LITELLM_PROXY_PROVIDER_NAME = "litellm_proxy"
-
 # Providers that use optional Bearer auth from custom_config
 PROVIDERS_WITH_SPECIAL_API_KEY_HANDLING: dict[str, str] = {
     LlmProviderNames.OLLAMA_CHAT: OLLAMA_API_KEY_CONFIG_KEY,

backend/onyx/llm/well_known_providers/llm_provider_options.py

@@ -15,7 +15,6 @@ from onyx.llm.well_known_providers.auto_update_service import (
 from onyx.llm.well_known_providers.constants import ANTHROPIC_PROVIDER_NAME
 from onyx.llm.well_known_providers.constants import AZURE_PROVIDER_NAME
 from onyx.llm.well_known_providers.constants import BEDROCK_PROVIDER_NAME
-from onyx.llm.well_known_providers.constants import LITELLM_PROXY_PROVIDER_NAME
 from onyx.llm.well_known_providers.constants import LM_STUDIO_PROVIDER_NAME
 from onyx.llm.well_known_providers.constants import OLLAMA_PROVIDER_NAME
 from onyx.llm.well_known_providers.constants import OPENAI_PROVIDER_NAME
@@ -48,7 +47,6 @@ def _get_provider_to_models_map() -> dict[str, list[str]]:
         OLLAMA_PROVIDER_NAME: [],  # Dynamic - fetched from Ollama API
         LM_STUDIO_PROVIDER_NAME: [],  # Dynamic - fetched from LM Studio API
         OPENROUTER_PROVIDER_NAME: [],  # Dynamic - fetched from OpenRouter API
-        LITELLM_PROXY_PROVIDER_NAME: [],  # Dynamic - fetched from LiteLLM proxy API
     }
 
 
@@ -333,7 +331,6 @@ def get_provider_display_name(provider_name: str) -> str:
         BEDROCK_PROVIDER_NAME: "Amazon Bedrock",
         VERTEXAI_PROVIDER_NAME: "Google Vertex AI",
         OPENROUTER_PROVIDER_NAME: "OpenRouter",
-        LITELLM_PROXY_PROVIDER_NAME: "LiteLLM Proxy",
     }
 
     if provider_name in _ONYX_PROVIDER_DISPLAY_NAMES:

backend/onyx/redis/redis_hierarchy.py

@@ -16,7 +16,6 @@ Cache Strategy:
   using only the SOURCE-type node as the ancestor
 """
 
-from typing import cast
 from typing import TYPE_CHECKING
 
 from pydantic import BaseModel
@@ -205,30 +204,6 @@ def cache_hierarchy_nodes_batch(
     redis_client.expire(raw_id_key, HIERARCHY_CACHE_TTL_SECONDS)
 
 
-def evict_hierarchy_nodes_from_cache(
-    redis_client: Redis,
-    source: DocumentSource,
-    raw_node_ids: list[str],
-) -> None:
-    """Remove specific hierarchy nodes from the Redis cache.
-
-    Deletes entries from both the parent-chain hash and the raw_id→node_id hash.
-    """
-    if not raw_node_ids:
-        return
-
-    cache_key = _cache_key(source)
-    raw_id_key = _raw_id_cache_key(source)
-
-    # Look up node_ids so we can remove them from the parent-chain hash
-    raw_values = cast(list[str | None], redis_client.hmget(raw_id_key, raw_node_ids))
-    node_id_strs = [v for v in raw_values if v is not None]
-
-    if node_id_strs:
-        redis_client.hdel(cache_key, *node_id_strs)
-    redis_client.hdel(raw_id_key, *raw_node_ids)
-
-
 def get_node_id_from_raw_id(
     redis_client: Redis,
     source: DocumentSource,

backend/onyx/server/features/build/sandbox/kubernetes/docker/templates/outputs/web/package-lock.json

@@ -7424,9 +7424,9 @@
       }
     },
     "node_modules/hono": {
-      "version": "4.12.7",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.7.tgz",
-      "integrity": "sha512-jq9l1DM0zVIvsm3lv9Nw9nlJnMNPOcAtsbsgiUhWcFzPE99Gvo6yRTlszSLLYacMeQ6quHD6hMfId8crVHvexw==",
+      "version": "4.12.5",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.5.tgz",
+      "integrity": "sha512-3qq+FUBtlTHhtYxbxheZgY8NIFnkkC/MR8u5TTsr7YZ3wixryQ3cCwn3iZbg8p8B88iDBBAYSfZDS75t8MN7Vg==",
       "license": "MIT",
       "engines": {
         "node": ">=16.9.0"

backend/onyx/server/manage/llm/api.py

@@ -58,9 +58,6 @@ from onyx.llm.well_known_providers.llm_provider_options import (
 from onyx.server.manage.llm.models import BedrockFinalModelResponse
 from onyx.server.manage.llm.models import BedrockModelsRequest
 from onyx.server.manage.llm.models import DefaultModel
-from onyx.server.manage.llm.models import LitellmFinalModelResponse
-from onyx.server.manage.llm.models import LitellmModelDetails
-from onyx.server.manage.llm.models import LitellmModelsRequest
 from onyx.server.manage.llm.models import LLMCost
 from onyx.server.manage.llm.models import LLMProviderDescriptor
 from onyx.server.manage.llm.models import LLMProviderResponse
@@ -68,14 +65,12 @@ from onyx.server.manage.llm.models import LLMProviderUpsertRequest
 from onyx.server.manage.llm.models import LLMProviderView
 from onyx.server.manage.llm.models import LMStudioFinalModelResponse
 from onyx.server.manage.llm.models import LMStudioModelsRequest
-from onyx.server.manage.llm.models import ModelConfigurationUpsertRequest
 from onyx.server.manage.llm.models import OllamaFinalModelResponse
 from onyx.server.manage.llm.models import OllamaModelDetails
 from onyx.server.manage.llm.models import OllamaModelsRequest
 from onyx.server.manage.llm.models import OpenRouterFinalModelResponse
 from onyx.server.manage.llm.models import OpenRouterModelDetails
 from onyx.server.manage.llm.models import OpenRouterModelsRequest
-from onyx.server.manage.llm.models import SyncModelEntry
 from onyx.server.manage.llm.models import TestLLMRequest
 from onyx.server.manage.llm.models import VisionProviderResponse
 from onyx.server.manage.llm.utils import generate_bedrock_display_name
@@ -102,34 +97,6 @@ def _mask_string(value: str) -> str:
     return value[:4] + "****" + value[-4:]
 
 
-def _sync_fetched_models(
-    db_session: Session,
-    provider_name: str,
-    models: list[SyncModelEntry],
-    source_label: str,
-) -> None:
-    """Sync fetched models to DB for the given provider.
-
-    Args:
-        db_session: Database session
-        provider_name: Name of the LLM provider
-        models: List of SyncModelEntry objects describing the fetched models
-        source_label: Human-readable label for log messages (e.g. "Bedrock", "LiteLLM")
-    """
-    try:
-        new_count = sync_model_configurations(
-            db_session=db_session,
-            provider_name=provider_name,
-            models=models,
-        )
-        if new_count > 0:
-            logger.info(
-                f"Added {new_count} new {source_label} models to provider '{provider_name}'"
-            )
-    except ValueError as e:
-        logger.warning(f"Failed to sync {source_label} models to DB: {e}")
-
-
 # Keys in custom_config that contain sensitive credentials
 _SENSITIVE_CONFIG_KEYS = {
     "vertex_credentials",
@@ -478,17 +445,16 @@ def put_llm_provider(
         not existing_provider or not existing_provider.is_auto_mode
     )
 
-    # When transitioning to auto mode, preserve existing model configurations
-    # so the upsert doesn't try to delete them (which would trip the default
-    # model protection guard). sync_auto_mode_models will handle the model
-    # lifecycle afterward — adding new models, hiding removed ones, and
-    # updating the default. This is safe even if sync fails: the provider
-    # keeps its old models and default rather than losing them.
-    if transitioning_to_auto_mode and existing_provider:
-        llm_provider_upsert_request.model_configurations = [
-            ModelConfigurationUpsertRequest.from_model(mc)
-            for mc in existing_provider.model_configurations
-        ]
+    # Before the upsert, check if this provider currently owns the global
+    # CHAT default. The upsert may cascade-delete model_configurations
+    # (and their flow mappings), so we need to remember this beforehand.
+    was_default_provider = False
+    if existing_provider and transitioning_to_auto_mode:
+        current_default = fetch_default_llm_model(db_session)
+        was_default_provider = (
+            current_default is not None
+            and current_default.llm_provider_id == existing_provider.id
+        )
 
     try:
         result = upsert_llm_provider(
@@ -502,6 +468,7 @@ def put_llm_provider(
 
             config = fetch_llm_recommendations_from_github()
             if config and llm_provider_upsert_request.provider in config.providers:
+                # Refetch the provider to get the updated model
                 updated_provider = fetch_existing_llm_provider_by_id(
                     id=result.id, db_session=db_session
                 )
@@ -511,6 +478,20 @@ def put_llm_provider(
                         updated_provider,
                         config,
                     )
+
+                    # If this provider was the default before the transition,
+                    # restore the default using the recommended model.
+                    if was_default_provider:
+                        recommended = config.get_default_model(
+                            llm_provider_upsert_request.provider
+                        )
+                        if recommended:
+                            update_default_provider(
+                                provider_id=updated_provider.id,
+                                model_name=recommended.name,
+                                db_session=db_session,
+                            )
+
                     # Refresh result with synced models
                     result = LLMProviderView.from_model(updated_provider)
 
@@ -995,20 +976,27 @@ def get_bedrock_available_models(
 
         # Sync new models to DB if provider_name is specified
         if request.provider_name:
-            _sync_fetched_models(
-                db_session=db_session,
-                provider_name=request.provider_name,
-                models=[
-                    SyncModelEntry(
-                        name=r.name,
-                        display_name=r.display_name,
-                        max_input_tokens=r.max_input_tokens,
-                        supports_image_input=r.supports_image_input,
-                    )
+            try:
+                models_to_sync = [
+                    {
+                        "name": r.name,
+                        "display_name": r.display_name,
+                        "max_input_tokens": r.max_input_tokens,
+                        "supports_image_input": r.supports_image_input,
+                    }
                     for r in results
-                ],
-                source_label="Bedrock",
-            )
+                ]
+                new_count = sync_model_configurations(
+                    db_session=db_session,
+                    provider_name=request.provider_name,
+                    models=models_to_sync,
+                )
+                if new_count > 0:
+                    logger.info(
+                        f"Added {new_count} new Bedrock models to provider '{request.provider_name}'"
+                    )
+            except ValueError as e:
+                logger.warning(f"Failed to sync Bedrock models to DB: {e}")
 
         return results
 
@@ -1126,20 +1114,27 @@ def get_ollama_available_models(
 
     # Sync new models to DB if provider_name is specified
     if request.provider_name:
-        _sync_fetched_models(
-            db_session=db_session,
-            provider_name=request.provider_name,
-            models=[
-                SyncModelEntry(
-                    name=r.name,
-                    display_name=r.display_name,
-                    max_input_tokens=r.max_input_tokens,
-                    supports_image_input=r.supports_image_input,
-                )
+        try:
+            models_to_sync = [
+                {
+                    "name": r.name,
+                    "display_name": r.display_name,
+                    "max_input_tokens": r.max_input_tokens,
+                    "supports_image_input": r.supports_image_input,
+                }
                 for r in sorted_results
-            ],
-            source_label="Ollama",
-        )
+            ]
+            new_count = sync_model_configurations(
+                db_session=db_session,
+                provider_name=request.provider_name,
+                models=models_to_sync,
+            )
+            if new_count > 0:
+                logger.info(
+                    f"Added {new_count} new Ollama models to provider '{request.provider_name}'"
+                )
+        except ValueError as e:
+            logger.warning(f"Failed to sync Ollama models to DB: {e}")
 
     return sorted_results
 
@@ -1228,20 +1223,27 @@ def get_openrouter_available_models(
 
     # Sync new models to DB if provider_name is specified
     if request.provider_name:
-        _sync_fetched_models(
-            db_session=db_session,
-            provider_name=request.provider_name,
-            models=[
-                SyncModelEntry(
-                    name=r.name,
-                    display_name=r.display_name,
-                    max_input_tokens=r.max_input_tokens,
-                    supports_image_input=r.supports_image_input,
-                )
+        try:
+            models_to_sync = [
+                {
+                    "name": r.name,
+                    "display_name": r.display_name,
+                    "max_input_tokens": r.max_input_tokens,
+                    "supports_image_input": r.supports_image_input,
+                }
                 for r in sorted_results
-            ],
-            source_label="OpenRouter",
-        )
+            ]
+            new_count = sync_model_configurations(
+                db_session=db_session,
+                provider_name=request.provider_name,
+                models=models_to_sync,
+            )
+            if new_count > 0:
+                logger.info(
+                    f"Added {new_count} new OpenRouter models to provider '{request.provider_name}'"
+                )
+        except ValueError as e:
+            logger.warning(f"Failed to sync OpenRouter models to DB: {e}")
 
     return sorted_results
 
@@ -1335,119 +1337,26 @@ def get_lm_studio_available_models(
 
     # Sync new models to DB if provider_name is specified
     if request.provider_name:
-        _sync_fetched_models(
-            db_session=db_session,
-            provider_name=request.provider_name,
-            models=[
-                SyncModelEntry(
-                    name=r.name,
-                    display_name=r.display_name,
-                    max_input_tokens=r.max_input_tokens,
-                    supports_image_input=r.supports_image_input,
-                )
-                for r in sorted_results
-            ],
-            source_label="LM Studio",
-        )
-
-    return sorted_results
-
-
-@admin_router.post("/litellm/available-models")
-def get_litellm_available_models(
-    request: LitellmModelsRequest,
-    _: User = Depends(current_admin_user),
-    db_session: Session = Depends(get_session),
-) -> list[LitellmFinalModelResponse]:
-    """Fetch available models from Litellm proxy /v1/models endpoint."""
-    response_json = _get_litellm_models_response(
-        api_key=request.api_key, api_base=request.api_base
-    )
-
-    models = response_json.get("data", [])
-    if not isinstance(models, list) or len(models) == 0:
-        raise OnyxError(
-            OnyxErrorCode.VALIDATION_ERROR,
-            "No models found from your Litellm endpoint",
-        )
-
-    results: list[LitellmFinalModelResponse] = []
-    for model in models:
         try:
-            model_details = LitellmModelDetails.model_validate(model)
-
-            results.append(
-                LitellmFinalModelResponse(
-                    provider_name=model_details.owned_by,
-                    model_name=model_details.id,
-                )
-            )
-        except Exception as e:
-            logger.warning(
-                "Failed to parse Litellm model entry",
-                extra={"error": str(e), "item": str(model)[:1000]},
-            )
-
-    if not results:
-        raise OnyxError(
-            OnyxErrorCode.VALIDATION_ERROR,
-            "No compatible models found from Litellm",
-        )
-
-    sorted_results = sorted(results, key=lambda m: m.model_name.lower())
-
-    # Sync new models to DB if provider_name is specified
-    if request.provider_name:
-        _sync_fetched_models(
-            db_session=db_session,
-            provider_name=request.provider_name,
-            models=[
-                SyncModelEntry(
-                    name=r.model_name,
-                    display_name=r.model_name,
-                )
+            models_to_sync = [
+                {
+                    "name": r.name,
+                    "display_name": r.display_name,
+                    "max_input_tokens": r.max_input_tokens,
+                    "supports_image_input": r.supports_image_input,
+                }
                 for r in sorted_results
-            ],
-            source_label="LiteLLM",
-        )
+            ]
+            new_count = sync_model_configurations(
+                db_session=db_session,
+                provider_name=request.provider_name,
+                models=models_to_sync,
+            )
+            if new_count > 0:
+                logger.info(
+                    f"Added {new_count} new LM Studio models to provider '{request.provider_name}'"
+                )
+        except ValueError as e:
+            logger.warning(f"Failed to sync LM Studio models to DB: {e}")
 
     return sorted_results
-
-
-def _get_litellm_models_response(api_key: str, api_base: str) -> dict:
-    """Perform GET to Litellm proxy /api/v1/models and return parsed JSON."""
-    cleaned_api_base = api_base.strip().rstrip("/")
-    url = f"{cleaned_api_base}/v1/models"
-
-    headers = {
-        "Authorization": f"Bearer {api_key}",
-        "HTTP-Referer": "https://onyx.app",
-        "X-Title": "Onyx",
-    }
-
-    try:
-        response = httpx.get(url, headers=headers, timeout=10.0)
-        response.raise_for_status()
-        return response.json()
-    except httpx.HTTPStatusError as e:
-        if e.response.status_code == 401:
-            raise OnyxError(
-                OnyxErrorCode.VALIDATION_ERROR,
-                "Authentication failed: invalid or missing API key for LiteLLM proxy.",
-            )
-        elif e.response.status_code == 404:
-            raise OnyxError(
-                OnyxErrorCode.VALIDATION_ERROR,
-                f"LiteLLM models endpoint not found at {url}. "
-                "Please verify the API base URL.",
-            )
-        else:
-            raise OnyxError(
-                OnyxErrorCode.BAD_GATEWAY,
-                f"Failed to fetch LiteLLM models: {e}",
-            )
-    except Exception as e:
-        raise OnyxError(
-            OnyxErrorCode.BAD_GATEWAY,
-            f"Failed to fetch LiteLLM models: {e}",
-        )

backend/onyx/server/manage/llm/models.py

@@ -420,32 +420,3 @@ class LLMProviderResponse(BaseModel, Generic[T]):
             default_text=default_text,
             default_vision=default_vision,
         )
-
-
-class SyncModelEntry(BaseModel):
-    """Typed model for syncing fetched models to the DB."""
-
-    name: str
-    display_name: str
-    max_input_tokens: int | None = None
-    supports_image_input: bool = False
-
-
-class LitellmModelsRequest(BaseModel):
-    api_key: str
-    api_base: str
-    provider_name: str | None = None  # Optional: to save models to existing provider
-
-
-class LitellmModelDetails(BaseModel):
-    """Response model for Litellm proxy /api/v1/models endpoint"""
-
-    id: str  # Model ID (e.g. "gpt-4o")
-    object: str  # "model"
-    created: int  # Unix timestamp in seconds
-    owned_by: str  # Provider name (e.g. "openai")
-
-
-class LitellmFinalModelResponse(BaseModel):
-    provider_name: str  # Provider name (e.g. "openai")
-    model_name: str  # Model ID (e.g. "gpt-4o")

backend/onyx/server/query_and_chat/session_loading.py

@@ -1,11 +1,9 @@
 from __future__ import annotations
 
 import json
-from typing import Any
 from typing import cast
 from typing import Literal
 
-from pydantic import ValidationError
 from sqlalchemy.orm import Session
 
 from onyx.chat.citation_utils import extract_citation_order_from_text
@@ -22,9 +20,7 @@ from onyx.server.query_and_chat.placement import Placement
 from onyx.server.query_and_chat.streaming_models import AgentResponseDelta
 from onyx.server.query_and_chat.streaming_models import AgentResponseStart
 from onyx.server.query_and_chat.streaming_models import CitationInfo
-from onyx.server.query_and_chat.streaming_models import CustomToolArgs
 from onyx.server.query_and_chat.streaming_models import CustomToolDelta
-from onyx.server.query_and_chat.streaming_models import CustomToolErrorInfo
 from onyx.server.query_and_chat.streaming_models import CustomToolStart
 from onyx.server.query_and_chat.streaming_models import FileReaderResult
 from onyx.server.query_and_chat.streaming_models import FileReaderStart
@@ -184,37 +180,24 @@ def create_custom_tool_packets(
     tab_index: int = 0,
     data: dict | list | str | int | float | bool | None = None,
     file_ids: list[str] | None = None,
-    error: CustomToolErrorInfo | None = None,
-    tool_args: dict[str, Any] | None = None,
-    tool_id: int | None = None,
 ) -> list[Packet]:
     packets: list[Packet] = []
 
     packets.append(
         Packet(
             placement=Placement(turn_index=turn_index, tab_index=tab_index),
-            obj=CustomToolStart(tool_name=tool_name, tool_id=tool_id),
+            obj=CustomToolStart(tool_name=tool_name),
         )
     )
 
-    if tool_args:
-        packets.append(
-            Packet(
-                placement=Placement(turn_index=turn_index, tab_index=tab_index),
-                obj=CustomToolArgs(tool_name=tool_name, tool_args=tool_args),
-            )
-        )
-
     packets.append(
         Packet(
             placement=Placement(turn_index=turn_index, tab_index=tab_index),
             obj=CustomToolDelta(
                 tool_name=tool_name,
-                tool_id=tool_id,
                 response_type=response_type,
                 data=data,
                 file_ids=file_ids,
-                error=error,
             ),
         ),
     )
@@ -674,55 +657,13 @@ def translate_assistant_message_to_packets(
 
                     else:
                         # Custom tool or unknown tool
-                        # Try to parse as structured CustomToolCallSummary JSON
-                        custom_data: dict | list | str | int | float | bool | None = (
-                            tool_call.tool_call_response
-                        )
-                        custom_error: CustomToolErrorInfo | None = None
-                        custom_response_type = "text"
-
-                        try:
-                            parsed = json.loads(tool_call.tool_call_response)
-                            if isinstance(parsed, dict) and "tool_name" in parsed:
-                                custom_data = parsed.get("tool_result")
-                                custom_response_type = parsed.get(
-                                    "response_type", "text"
-                                )
-                                if parsed.get("error"):
-                                    custom_error = CustomToolErrorInfo(
-                                        **parsed["error"]
-                                    )
-                        except (
-                            json.JSONDecodeError,
-                            KeyError,
-                            TypeError,
-                            ValidationError,
-                        ):
-                            pass
-
-                        custom_file_ids: list[str] | None = None
-                        if custom_response_type in ("image", "csv") and isinstance(
-                            custom_data, dict
-                        ):
-                            custom_file_ids = custom_data.get("file_ids")
-                            custom_data = None
-
-                        custom_args = {
-                            k: v
-                            for k, v in (tool_call.tool_call_arguments or {}).items()
-                            if k != "requestBody"
-                        }
                         turn_tool_packets.extend(
                             create_custom_tool_packets(
                                 tool_name=tool.display_name or tool.name,
-                                response_type=custom_response_type,
+                                response_type="text",
                                 turn_index=turn_num,
                                 tab_index=tool_call.tab_index,
-                                data=custom_data,
-                                file_ids=custom_file_ids,
-                                error=custom_error,
-                                tool_args=custom_args if custom_args else None,
-                                tool_id=tool_call.tool_id,
+                                data=tool_call.tool_call_response,
                             )
                         )
 

backend/onyx/server/query_and_chat/streaming_models.py

@@ -33,7 +33,6 @@ class StreamingType(Enum):
     PYTHON_TOOL_START = "python_tool_start"
     PYTHON_TOOL_DELTA = "python_tool_delta"
     CUSTOM_TOOL_START = "custom_tool_start"
-    CUSTOM_TOOL_ARGS = "custom_tool_args"
     CUSTOM_TOOL_DELTA = "custom_tool_delta"
     FILE_READER_START = "file_reader_start"
     FILE_READER_RESULT = "file_reader_result"
@@ -247,20 +246,6 @@ class CustomToolStart(BaseObj):
     type: Literal["custom_tool_start"] = StreamingType.CUSTOM_TOOL_START.value
 
     tool_name: str
-    tool_id: int | None = None
-
-
-class CustomToolArgs(BaseObj):
-    type: Literal["custom_tool_args"] = StreamingType.CUSTOM_TOOL_ARGS.value
-
-    tool_name: str
-    tool_args: dict[str, Any]
-
-
-class CustomToolErrorInfo(BaseModel):
-    is_auth_error: bool = False
-    status_code: int
-    message: str
 
 
 # The allowed streamed packets for a custom tool
@@ -268,13 +253,11 @@ class CustomToolDelta(BaseObj):
     type: Literal["custom_tool_delta"] = StreamingType.CUSTOM_TOOL_DELTA.value
 
     tool_name: str
-    tool_id: int | None = None
     response_type: str
     # For non-file responses
     data: dict | list | str | int | float | bool | None = None
     # For file-based responses like image/csv
     file_ids: list[str] | None = None
-    error: CustomToolErrorInfo | None = None
 
 
 class ToolCallArgumentDelta(BaseObj):
@@ -393,7 +376,6 @@ PacketObj = Union[
     PythonToolStart,
     PythonToolDelta,
     CustomToolStart,
-    CustomToolArgs,
     CustomToolDelta,
     FileReaderStart,
     FileReaderResult,

backend/onyx/server/query_and_chat/streaming_utils.py

@@ -8,6 +8,8 @@ from onyx.server.query_and_chat.placement import Placement
 from onyx.server.query_and_chat.streaming_models import AgentResponseDelta
 from onyx.server.query_and_chat.streaming_models import AgentResponseStart
 from onyx.server.query_and_chat.streaming_models import CitationInfo
+from onyx.server.query_and_chat.streaming_models import CustomToolDelta
+from onyx.server.query_and_chat.streaming_models import CustomToolStart
 from onyx.server.query_and_chat.streaming_models import GeneratedImage
 from onyx.server.query_and_chat.streaming_models import ImageGenerationFinal
 from onyx.server.query_and_chat.streaming_models import ImageGenerationToolStart
@@ -163,6 +165,39 @@ def create_image_generation_packets(
     return packets
 
 
+def create_custom_tool_packets(
+    tool_name: str,
+    response_type: str,
+    turn_index: int,
+    data: dict | list | str | int | float | bool | None = None,
+    file_ids: list[str] | None = None,
+) -> list[Packet]:
+    packets: list[Packet] = []
+
+    packets.append(
+        Packet(
+            placement=Placement(turn_index=turn_index),
+            obj=CustomToolStart(tool_name=tool_name),
+        )
+    )
+
+    packets.append(
+        Packet(
+            placement=Placement(turn_index=turn_index),
+            obj=CustomToolDelta(
+                tool_name=tool_name,
+                response_type=response_type,
+                data=data,
+                file_ids=file_ids,
+            ),
+        ),
+    )
+
+    packets.append(Packet(placement=Placement(turn_index=turn_index), obj=SectionEnd()))
+
+    return packets
+
+
 def create_fetch_packets(
     fetch_docs: list[SavedSearchDoc],
     urls: list[str],

backend/onyx/setup.py

@@ -275,13 +275,9 @@ def setup_postgres(db_session: Session) -> None:
             ],
             api_key_changed=True,
         )
-        try:
-            new_llm_provider = upsert_llm_provider(
-                llm_provider_upsert_request=model_req, db_session=db_session
-            )
-        except ValueError as e:
-            logger.warning("Failed to upsert LLM provider during setup: %s", e)
-            return
+        new_llm_provider = upsert_llm_provider(
+            llm_provider_upsert_request=model_req, db_session=db_session
+        )
         update_default_provider(
             provider_id=new_llm_provider.id, model_name=llm_model, db_session=db_session
         )

backend/onyx/tools/models.py

@@ -18,7 +18,6 @@ from onyx.context.search.models import SearchDoc
 from onyx.context.search.models import SearchDocsResponse
 from onyx.db.memory import UserMemoryContext
 from onyx.server.query_and_chat.placement import Placement
-from onyx.server.query_and_chat.streaming_models import CustomToolErrorInfo
 from onyx.server.query_and_chat.streaming_models import GeneratedImage
 from onyx.tools.tool_implementations.images.models import FinalImageGenerationResponse
 from onyx.tools.tool_implementations.memory.models import MemoryToolResponse
@@ -62,7 +61,6 @@ class CustomToolCallSummary(BaseModel):
     tool_name: str
     response_type: str  # e.g., 'json', 'image', 'csv', 'graph'
     tool_result: Any  # The response data
-    error: CustomToolErrorInfo | None = None
 
 
 class ToolCallKickoff(BaseModel):

backend/onyx/tools/tool_implementations/custom/custom_tool.py

@@ -15,9 +15,7 @@ from onyx.chat.emitter import get_default_emitter
 from onyx.configs.constants import FileOrigin
 from onyx.file_store.file_store import get_default_file_store
 from onyx.server.query_and_chat.placement import Placement
-from onyx.server.query_and_chat.streaming_models import CustomToolArgs
 from onyx.server.query_and_chat.streaming_models import CustomToolDelta
-from onyx.server.query_and_chat.streaming_models import CustomToolErrorInfo
 from onyx.server.query_and_chat.streaming_models import CustomToolStart
 from onyx.server.query_and_chat.streaming_models import Packet
 from onyx.tools.interface import Tool
@@ -141,7 +139,7 @@ class CustomTool(Tool[None]):
         self.emitter.emit(
             Packet(
                 placement=placement,
-                obj=CustomToolStart(tool_name=self._name, tool_id=self._id),
+                obj=CustomToolStart(tool_name=self._name),
             )
         )
 
@@ -151,8 +149,10 @@ class CustomTool(Tool[None]):
         override_kwargs: None = None,  # noqa: ARG002
         **llm_kwargs: Any,
     ) -> ToolResponse:
-        # Build path params
+        request_body = llm_kwargs.get(REQUEST_BODY)
+
         path_params = {}
+
         for path_param_schema in self._method_spec.get_path_param_schemas():
             param_name = path_param_schema["name"]
             if param_name not in llm_kwargs:
@@ -165,7 +165,6 @@ class CustomTool(Tool[None]):
                 )
             path_params[param_name] = llm_kwargs[param_name]
 
-        # Build query params
         query_params = {}
         for query_param_schema in self._method_spec.get_query_param_schemas():
             if query_param_schema["name"] in llm_kwargs:
@@ -173,20 +172,6 @@ class CustomTool(Tool[None]):
                     query_param_schema["name"]
                 ]
 
-        # Emit args packet (path + query params only, no request body)
-        tool_args = {**path_params, **query_params}
-        if tool_args:
-            self.emitter.emit(
-                Packet(
-                    placement=placement,
-                    obj=CustomToolArgs(
-                        tool_name=self._name,
-                        tool_args=tool_args,
-                    ),
-                )
-            )
-
-        request_body = llm_kwargs.get(REQUEST_BODY)
         url = self._method_spec.build_url(self._base_url, path_params, query_params)
         method = self._method_spec.method
 
@@ -195,18 +180,6 @@ class CustomTool(Tool[None]):
         )
         content_type = response.headers.get("Content-Type", "")
 
-        # Detect HTTP errors — only 401/403 are flagged as auth errors
-        error_info: CustomToolErrorInfo | None = None
-        if response.status_code in (401, 403):
-            error_info = CustomToolErrorInfo(
-                is_auth_error=True,
-                status_code=response.status_code,
-                message=f"{self._name} action failed because of authentication error",
-            )
-            logger.warning(
-                f"Auth error from custom tool '{self._name}': HTTP {response.status_code}"
-            )
-
         tool_result: Any
         response_type: str
         file_ids: List[str] | None = None
@@ -249,11 +222,9 @@ class CustomTool(Tool[None]):
                 placement=placement,
                 obj=CustomToolDelta(
                     tool_name=self._name,
-                    tool_id=self._id,
                     response_type=response_type,
                     data=data,
                     file_ids=file_ids,
-                    error=error_info,
                 ),
             )
         )
@@ -265,7 +236,6 @@ class CustomTool(Tool[None]):
                 tool_name=self._name,
                 response_type=response_type,
                 tool_result=tool_result,
-                error=error_info,
             ),
             llm_facing_response=llm_facing_response,
         )

backend/requirements/dev.txt

@@ -406,7 +406,7 @@ referencing==0.36.2
     #   jsonschema-specifications
 regex==2025.11.3
     # via tiktoken
-release-tag==0.5.2
+release-tag==0.4.3
     # via onyx
 reorder-python-imports-black==3.14.0
     # via onyx

backend/tests/daily/conftest.py

@@ -19,7 +19,7 @@ from fastapi.testclient import TestClient
 from onyx.auth.users import current_admin_user
 from onyx.db.engine.sql_engine import get_session
 from onyx.db.models import UserRole
-from onyx.main import get_application
+from onyx.main import fetch_versioned_implementation
 from onyx.utils.logger import setup_logger
 
 logger = setup_logger()
@@ -51,8 +51,11 @@ def client() -> Generator[TestClient, None, None]:
     # Patch out prometheus metrics setup to avoid "Duplicated timeseries in
     # CollectorRegistry" errors when multiple tests each create a new app
     # (prometheus registers metrics globally and rejects duplicate names).
+    get_app = fetch_versioned_implementation(
+        module="onyx.main", attribute="get_application"
+    )
     with patch("onyx.main.setup_prometheus_metrics"):
-        app: FastAPI = get_application(lifespan_override=test_lifespan)
+        app: FastAPI = get_app(lifespan_override=test_lifespan)
 
     # Override the database session dependency with a mock
     # (these tests don't actually need DB access)

backend/tests/daily/connectors/gitlab/test_gitlab_basic.py

@@ -48,7 +48,7 @@ def test_gitlab_connector_basic(gitlab_connector: GitlabConnector) -> None:
 
     # --- Specific Document Details to Validate ---
     target_mr_id = f"https://{gitlab_base_url}/{project_path}/-/merge_requests/1"
-    target_issue_id = f"https://{gitlab_base_url}/{project_path}/-/work_items/2"
+    target_issue_id = f"https://{gitlab_base_url}/{project_path}/-/issues/2"
     target_code_file_semantic_id = "README.md"
     # ---
 

backend/tests/external_dependency_unit/celery/test_pruning_hierarchy_nodes.py

@@ -7,8 +7,6 @@ Verifies that:
 3. Upserting is idempotent (running twice doesn't duplicate nodes)
 4. Document-to-hierarchy-node linkage is updated during pruning
 5. link_hierarchy_nodes_to_documents links nodes that are also documents
-6. HierarchyNodeByConnectorCredentialPair join table population and pruning
-7. Orphaned hierarchy node deletion and re-parenting
 
 Uses a mock SlimConnectorWithPermSync that yields known hierarchy nodes and slim documents,
 combined with a real PostgreSQL database for verifying persistence.
@@ -26,27 +24,16 @@ from onyx.connectors.interfaces import GenerateSlimDocumentOutput
 from onyx.connectors.interfaces import SecondsSinceUnixEpoch
 from onyx.connectors.interfaces import SlimConnectorWithPermSync
 from onyx.connectors.models import HierarchyNode as PydanticHierarchyNode
-from onyx.connectors.models import InputType
 from onyx.connectors.models import SlimDocument
-from onyx.db.enums import AccessType
-from onyx.db.enums import ConnectorCredentialPairStatus
 from onyx.db.enums import HierarchyNodeType
-from onyx.db.hierarchy import delete_orphaned_hierarchy_nodes
 from onyx.db.hierarchy import ensure_source_node_exists
 from onyx.db.hierarchy import get_all_hierarchy_nodes_for_source
 from onyx.db.hierarchy import get_hierarchy_node_by_raw_id
 from onyx.db.hierarchy import link_hierarchy_nodes_to_documents
-from onyx.db.hierarchy import remove_stale_hierarchy_node_cc_pair_entries
-from onyx.db.hierarchy import reparent_orphaned_hierarchy_nodes
 from onyx.db.hierarchy import update_document_parent_hierarchy_nodes
-from onyx.db.hierarchy import upsert_hierarchy_node_cc_pair_entries
 from onyx.db.hierarchy import upsert_hierarchy_nodes_batch
-from onyx.db.models import Connector
-from onyx.db.models import ConnectorCredentialPair
-from onyx.db.models import Credential
 from onyx.db.models import Document as DbDocument
 from onyx.db.models import HierarchyNode as DBHierarchyNode
-from onyx.db.models import HierarchyNodeByConnectorCredentialPair
 from onyx.indexing.indexing_heartbeat import IndexingHeartbeatInterface
 from onyx.kg.models import KGStage
 
@@ -155,80 +142,13 @@ class MockSlimConnectorWithPermSync(SlimConnectorWithPermSync):
 # ---------------------------------------------------------------------------
 
 
-def _create_cc_pair(
-    db_session: Session,
-    source: DocumentSource = TEST_SOURCE,
-) -> ConnectorCredentialPair:
-    """Create a real Connector + Credential + ConnectorCredentialPair for testing."""
-    connector = Connector(
-        name=f"Test {source.value} Connector",
-        source=source,
-        input_type=InputType.LOAD_STATE,
-        connector_specific_config={},
-    )
-    db_session.add(connector)
-    db_session.flush()
-
-    credential = Credential(
-        source=source,
-        credential_json={},
-        admin_public=True,
-    )
-    db_session.add(credential)
-    db_session.flush()
-    db_session.expire(credential)
-
-    cc_pair = ConnectorCredentialPair(
-        connector_id=connector.id,
-        credential_id=credential.id,
-        name=f"Test {source.value} CC Pair",
-        status=ConnectorCredentialPairStatus.ACTIVE,
-        access_type=AccessType.PUBLIC,
-    )
-    db_session.add(cc_pair)
-    db_session.commit()
-    db_session.refresh(cc_pair)
-    return cc_pair
-
-
 def _cleanup_test_data(db_session: Session) -> None:
     """Remove all test hierarchy nodes and documents to isolate tests."""
     for doc_id in SLIM_DOC_IDS:
         db_session.query(DbDocument).filter(DbDocument.id == doc_id).delete()
-
-    test_connector_ids_q = db_session.query(Connector.id).filter(
-        Connector.source == TEST_SOURCE,
-        Connector.name.like("Test %"),
-    )
-
-    db_session.query(HierarchyNodeByConnectorCredentialPair).filter(
-        HierarchyNodeByConnectorCredentialPair.connector_id.in_(test_connector_ids_q)
-    ).delete(synchronize_session="fetch")
     db_session.query(DBHierarchyNode).filter(
         DBHierarchyNode.source == TEST_SOURCE
     ).delete()
-    db_session.flush()
-
-    # Collect credential IDs before deleting cc_pairs (bulk query.delete()
-    # bypasses ORM-level cascade, so credentials won't be auto-removed).
-    credential_ids = [
-        row[0]
-        for row in db_session.query(ConnectorCredentialPair.credential_id)
-        .filter(ConnectorCredentialPair.connector_id.in_(test_connector_ids_q))
-        .all()
-    ]
-
-    db_session.query(ConnectorCredentialPair).filter(
-        ConnectorCredentialPair.connector_id.in_(test_connector_ids_q)
-    ).delete(synchronize_session="fetch")
-    db_session.query(Connector).filter(
-        Connector.source == TEST_SOURCE,
-        Connector.name.like("Test %"),
-    ).delete(synchronize_session="fetch")
-    if credential_ids:
-        db_session.query(Credential).filter(Credential.id.in_(credential_ids)).delete(
-            synchronize_session="fetch"
-        )
     db_session.commit()
 
 
@@ -259,8 +179,15 @@ def test_pruning_extracts_hierarchy_nodes(db_session: Session) -> None:  # noqa:
 
     result = extract_ids_from_runnable_connector(connector, callback=None)
 
-    # raw_id_to_parent should contain ONLY document IDs, not hierarchy node IDs
-    assert result.raw_id_to_parent.keys() == set(SLIM_DOC_IDS)
+    # Doc IDs should include both slim doc IDs and hierarchy node raw_node_ids
+    # (hierarchy node IDs are added to raw_id_to_parent so they aren't pruned)
+    expected_ids = {
+        CHANNEL_A_ID,
+        CHANNEL_B_ID,
+        CHANNEL_C_ID,
+        *SLIM_DOC_IDS,
+    }
+    assert result.raw_id_to_parent.keys() == expected_ids
 
     # Hierarchy nodes should be the 3 channels
     assert len(result.hierarchy_nodes) == 3
@@ -468,9 +395,9 @@ def test_extraction_preserves_parent_hierarchy_raw_node_id(
             result.raw_id_to_parent[doc_id] == expected_parent
         ), f"raw_id_to_parent[{doc_id}] should be {expected_parent}"
 
-    # Hierarchy node IDs should NOT be in raw_id_to_parent
+    # Hierarchy node entries have None parent (they aren't documents)
     for channel_id in [CHANNEL_A_ID, CHANNEL_B_ID, CHANNEL_C_ID]:
-        assert channel_id not in result.raw_id_to_parent
+        assert result.raw_id_to_parent[channel_id] is None
 
 
 def test_update_document_parent_hierarchy_nodes(db_session: Session) -> None:
@@ -638,241 +565,3 @@ def test_link_hierarchy_nodes_skips_non_hierarchy_sources(
         commit=False,
     )
     assert linked == 0
-
-
-# ---------------------------------------------------------------------------
-# Join table + pruning tests
-# ---------------------------------------------------------------------------
-
-
-def test_upsert_hierarchy_node_cc_pair_entries(db_session: Session) -> None:
-    """upsert_hierarchy_node_cc_pair_entries should insert rows and be idempotent."""
-    _cleanup_test_data(db_session)
-    ensure_source_node_exists(db_session, TEST_SOURCE, commit=True)
-    cc_pair = _create_cc_pair(db_session)
-
-    upserted = upsert_hierarchy_nodes_batch(
-        db_session=db_session,
-        nodes=_make_hierarchy_nodes(),
-        source=TEST_SOURCE,
-        commit=True,
-        is_connector_public=False,
-    )
-    node_ids = [n.id for n in upserted]
-
-    # First call — should insert rows
-    upsert_hierarchy_node_cc_pair_entries(
-        db_session=db_session,
-        hierarchy_node_ids=node_ids,
-        connector_id=cc_pair.connector_id,
-        credential_id=cc_pair.credential_id,
-        commit=True,
-    )
-
-    rows = (
-        db_session.query(HierarchyNodeByConnectorCredentialPair)
-        .filter(
-            HierarchyNodeByConnectorCredentialPair.connector_id == cc_pair.connector_id,
-            HierarchyNodeByConnectorCredentialPair.credential_id
-            == cc_pair.credential_id,
-        )
-        .all()
-    )
-    assert len(rows) == 3
-
-    # Second call — idempotent, same count
-    upsert_hierarchy_node_cc_pair_entries(
-        db_session=db_session,
-        hierarchy_node_ids=node_ids,
-        connector_id=cc_pair.connector_id,
-        credential_id=cc_pair.credential_id,
-        commit=True,
-    )
-    rows_after = (
-        db_session.query(HierarchyNodeByConnectorCredentialPair)
-        .filter(
-            HierarchyNodeByConnectorCredentialPair.connector_id == cc_pair.connector_id,
-            HierarchyNodeByConnectorCredentialPair.credential_id
-            == cc_pair.credential_id,
-        )
-        .all()
-    )
-    assert len(rows_after) == 3
-
-
-def test_remove_stale_entries_and_delete_orphans(db_session: Session) -> None:
-    """After removing stale join-table entries, orphaned hierarchy nodes should
-    be deleted and the SOURCE node should survive."""
-    _cleanup_test_data(db_session)
-    source_node = ensure_source_node_exists(db_session, TEST_SOURCE, commit=True)
-    cc_pair = _create_cc_pair(db_session)
-
-    upserted = upsert_hierarchy_nodes_batch(
-        db_session=db_session,
-        nodes=_make_hierarchy_nodes(),
-        source=TEST_SOURCE,
-        commit=True,
-        is_connector_public=False,
-    )
-    all_ids = [n.id for n in upserted]
-    upsert_hierarchy_node_cc_pair_entries(
-        db_session=db_session,
-        hierarchy_node_ids=all_ids,
-        connector_id=cc_pair.connector_id,
-        credential_id=cc_pair.credential_id,
-        commit=True,
-    )
-
-    # Now simulate a pruning run where only channel A survived
-    channel_a = get_hierarchy_node_by_raw_id(db_session, CHANNEL_A_ID, TEST_SOURCE)
-    assert channel_a is not None
-    live_ids = {channel_a.id}
-
-    stale_removed = remove_stale_hierarchy_node_cc_pair_entries(
-        db_session=db_session,
-        connector_id=cc_pair.connector_id,
-        credential_id=cc_pair.credential_id,
-        live_hierarchy_node_ids=live_ids,
-        commit=True,
-    )
-    assert stale_removed == 2
-
-    # Delete orphaned nodes
-    deleted_raw_ids = delete_orphaned_hierarchy_nodes(
-        db_session=db_session,
-        source=TEST_SOURCE,
-        commit=True,
-    )
-    assert set(deleted_raw_ids) == {CHANNEL_B_ID, CHANNEL_C_ID}
-
-    # Verify only channel A + SOURCE remain
-    remaining = get_all_hierarchy_nodes_for_source(db_session, TEST_SOURCE)
-    remaining_raw = {n.raw_node_id for n in remaining}
-    assert remaining_raw == {CHANNEL_A_ID, source_node.raw_node_id}
-
-
-def test_multi_cc_pair_prevents_premature_deletion(db_session: Session) -> None:
-    """A hierarchy node shared by two cc_pairs should NOT be deleted when only
-    one cc_pair removes its association."""
-    _cleanup_test_data(db_session)
-    ensure_source_node_exists(db_session, TEST_SOURCE, commit=True)
-    cc_pair_1 = _create_cc_pair(db_session)
-    cc_pair_2 = _create_cc_pair(db_session)
-
-    upserted = upsert_hierarchy_nodes_batch(
-        db_session=db_session,
-        nodes=_make_hierarchy_nodes(),
-        source=TEST_SOURCE,
-        commit=True,
-        is_connector_public=False,
-    )
-    all_ids = [n.id for n in upserted]
-
-    # cc_pair 1 owns all 3
-    upsert_hierarchy_node_cc_pair_entries(
-        db_session=db_session,
-        hierarchy_node_ids=all_ids,
-        connector_id=cc_pair_1.connector_id,
-        credential_id=cc_pair_1.credential_id,
-        commit=True,
-    )
-    # cc_pair 2 also owns all 3
-    upsert_hierarchy_node_cc_pair_entries(
-        db_session=db_session,
-        hierarchy_node_ids=all_ids,
-        connector_id=cc_pair_2.connector_id,
-        credential_id=cc_pair_2.credential_id,
-        commit=True,
-    )
-
-    # cc_pair 1 prunes — keeps none
-    remove_stale_hierarchy_node_cc_pair_entries(
-        db_session=db_session,
-        connector_id=cc_pair_1.connector_id,
-        credential_id=cc_pair_1.credential_id,
-        live_hierarchy_node_ids=set(),
-        commit=True,
-    )
-
-    # Orphan deletion should find nothing because cc_pair 2 still references them
-    deleted = delete_orphaned_hierarchy_nodes(
-        db_session=db_session,
-        source=TEST_SOURCE,
-        commit=True,
-    )
-    assert deleted == []
-
-    # All 3 nodes + SOURCE should still exist
-    remaining = get_all_hierarchy_nodes_for_source(db_session, TEST_SOURCE)
-    assert len(remaining) == 4
-
-
-def test_reparent_orphaned_children(db_session: Session) -> None:
-    """After deleting a parent hierarchy node, its children should be
-    re-parented to the SOURCE node."""
-    _cleanup_test_data(db_session)
-    source_node = ensure_source_node_exists(db_session, TEST_SOURCE, commit=True)
-    cc_pair = _create_cc_pair(db_session)
-
-    # Create a parent node and a child node
-    parent_node = PydanticHierarchyNode(
-        raw_node_id="PARENT",
-        raw_parent_id=None,
-        display_name="Parent",
-        node_type=HierarchyNodeType.CHANNEL,
-    )
-    child_node = PydanticHierarchyNode(
-        raw_node_id="CHILD",
-        raw_parent_id="PARENT",
-        display_name="Child",
-        node_type=HierarchyNodeType.CHANNEL,
-    )
-    upserted = upsert_hierarchy_nodes_batch(
-        db_session=db_session,
-        nodes=[parent_node, child_node],
-        source=TEST_SOURCE,
-        commit=True,
-        is_connector_public=False,
-    )
-    assert len(upserted) == 2
-
-    parent_db = get_hierarchy_node_by_raw_id(db_session, "PARENT", TEST_SOURCE)
-    child_db = get_hierarchy_node_by_raw_id(db_session, "CHILD", TEST_SOURCE)
-    assert parent_db is not None and child_db is not None
-    assert child_db.parent_id == parent_db.id
-
-    # Associate only the child with a cc_pair (parent is orphaned)
-    upsert_hierarchy_node_cc_pair_entries(
-        db_session=db_session,
-        hierarchy_node_ids=[child_db.id],
-        connector_id=cc_pair.connector_id,
-        credential_id=cc_pair.credential_id,
-        commit=True,
-    )
-
-    # Delete orphaned nodes (parent has no cc_pair entry)
-    deleted = delete_orphaned_hierarchy_nodes(
-        db_session=db_session,
-        source=TEST_SOURCE,
-        commit=True,
-    )
-    assert "PARENT" in deleted
-
-    # Child should now have parent_id=NULL (SET NULL cascade)
-    db_session.expire_all()
-    child_db = get_hierarchy_node_by_raw_id(db_session, "CHILD", TEST_SOURCE)
-    assert child_db is not None
-    assert child_db.parent_id is None
-
-    # Re-parent orphans to SOURCE
-    reparented = reparent_orphaned_hierarchy_nodes(
-        db_session=db_session,
-        source=TEST_SOURCE,
-        commit=True,
-    )
-    assert len(reparented) == 1
-
-    db_session.expire_all()
-    child_db = get_hierarchy_node_by_raw_id(db_session, "CHILD", TEST_SOURCE)
-    assert child_db is not None
-    assert child_db.parent_id == source_node.id

backend/tests/external_dependency_unit/document_index/test_document_index_old.py

@@ -1,398 +0,0 @@
-"""External dependency tests for the old DocumentIndex interface.
-
-These tests assume Vespa and OpenSearch are running.
-
-TODO(ENG-3764)(andrei): Consolidate some of these test fixtures.
-"""
-
-import os
-import time
-import uuid
-from collections.abc import Generator
-from unittest.mock import patch
-
-import httpx
-import pytest
-
-from onyx.access.models import DocumentAccess
-from onyx.configs.constants import DocumentSource
-from onyx.connectors.models import Document
-from onyx.context.search.models import IndexFilters
-from onyx.db.enums import EmbeddingPrecision
-from onyx.document_index.interfaces import DocumentIndex
-from onyx.document_index.interfaces import IndexBatchParams
-from onyx.document_index.interfaces import VespaChunkRequest
-from onyx.document_index.interfaces import VespaDocumentUserFields
-from onyx.document_index.opensearch.client import wait_for_opensearch_with_timeout
-from onyx.document_index.opensearch.opensearch_document_index import (
-    OpenSearchOldDocumentIndex,
-)
-from onyx.document_index.vespa.index import VespaIndex
-from onyx.document_index.vespa.shared_utils.utils import get_vespa_http_client
-from onyx.document_index.vespa.shared_utils.utils import wait_for_vespa_with_timeout
-from onyx.indexing.models import ChunkEmbedding
-from onyx.indexing.models import DocMetadataAwareIndexChunk
-from shared_configs.configs import MULTI_TENANT
-from shared_configs.contextvars import CURRENT_TENANT_ID_CONTEXTVAR
-from shared_configs.contextvars import get_current_tenant_id
-from tests.external_dependency_unit.constants import TEST_TENANT_ID
-
-
-@pytest.fixture(scope="module")
-def opensearch_available() -> Generator[None, None, None]:
-    """Verifies OpenSearch is running, fails the test if not."""
-    if not wait_for_opensearch_with_timeout():
-        pytest.fail("OpenSearch is not available.")
-    yield  # Test runs here.
-
-
-@pytest.fixture(scope="module")
-def test_index_name() -> Generator[str, None, None]:
-    yield f"test_index_{uuid.uuid4().hex[:8]}"  # Test runs here.
-
-
-@pytest.fixture(scope="module")
-def tenant_context() -> Generator[None, None, None]:
-    """Sets up tenant context for testing."""
-    token = CURRENT_TENANT_ID_CONTEXTVAR.set(TEST_TENANT_ID)
-    try:
-        yield  # Test runs here.
-    finally:
-        # Reset the tenant context after the test
-        CURRENT_TENANT_ID_CONTEXTVAR.reset(token)
-
-
-@pytest.fixture(scope="module")
-def httpx_client() -> Generator[httpx.Client, None, None]:
-    client = get_vespa_http_client()
-    try:
-        yield client
-    finally:
-        client.close()
-
-
-@pytest.fixture(scope="module")
-def vespa_document_index(
-    httpx_client: httpx.Client,
-    tenant_context: None,  # noqa: ARG001
-    test_index_name: str,
-) -> Generator[VespaIndex, None, None]:
-    vespa_index = VespaIndex(
-        index_name=test_index_name,
-        secondary_index_name=None,
-        large_chunks_enabled=False,
-        secondary_large_chunks_enabled=None,
-        multitenant=MULTI_TENANT,
-        httpx_client=httpx_client,
-    )
-    backend_dir = os.path.abspath(
-        os.path.join(os.path.dirname(__file__), "..", "..", "..")
-    )
-    with patch("os.getcwd", return_value=backend_dir):
-        vespa_index.ensure_indices_exist(
-            primary_embedding_dim=128,
-            primary_embedding_precision=EmbeddingPrecision.FLOAT,
-            secondary_index_embedding_dim=None,
-            secondary_index_embedding_precision=None,
-        )
-    # Verify Vespa is running, fails the test if not. Try 90 seconds for testing
-    # in CI. We have to do this here because this endpoint only becomes live
-    # once we create an index.
-    if not wait_for_vespa_with_timeout(wait_limit=90):
-        pytest.fail("Vespa is not available.")
-
-    # Wait until the schema is actually ready for writes on content nodes. We
-    # probe by attempting a PUT; 200 means the schema is live, 400 means not
-    # yet. This is so scuffed but running the test is really flakey otherwise;
-    # this is only temporary until we entirely move off of Vespa.
-    probe_doc = {
-        "fields": {
-            "document_id": "__probe__",
-            "chunk_id": 0,
-            "blurb": "",
-            "title": "",
-            "skip_title": True,
-            "content": "",
-            "content_summary": "",
-            "source_type": "file",
-            "source_links": "null",
-            "semantic_identifier": "",
-            "section_continuation": False,
-            "large_chunk_reference_ids": [],
-            "metadata": "{}",
-            "metadata_list": [],
-            "metadata_suffix": "",
-            "chunk_context": "",
-            "doc_summary": "",
-            "embeddings": {"full_chunk": [1.0] + [0.0] * 127},
-            "access_control_list": {},
-            "document_sets": {},
-            "image_file_name": None,
-            "user_project": [],
-            "personas": [],
-            "boost": 0.0,
-            "aggregated_chunk_boost_factor": 0.0,
-            "primary_owners": [],
-            "secondary_owners": [],
-        }
-    }
-    schema_ready = False
-    probe_url = (
-        f"http://localhost:8081/document/v1/default/{test_index_name}/docid/__probe__"
-    )
-    for _ in range(60):
-        resp = httpx_client.post(probe_url, json=probe_doc)
-        if resp.status_code == 200:
-            schema_ready = True
-            # Clean up the probe document.
-            httpx_client.delete(probe_url)
-            break
-        time.sleep(1)
-    if not schema_ready:
-        pytest.fail(f"Vespa schema '{test_index_name}' did not become ready in time.")
-
-    yield vespa_index  # Test runs here.
-
-    # TODO(ENG-3765)(andrei): Explicitly cleanup index. Not immediately
-    # pressing; in CI we should be using fresh instances of dependencies each
-    # time anyway.
-
-
-@pytest.fixture(scope="module")
-def opensearch_document_index(
-    opensearch_available: None,  # noqa: ARG001
-    tenant_context: None,  # noqa: ARG001
-    test_index_name: str,
-) -> Generator[OpenSearchOldDocumentIndex, None, None]:
-    opensearch_index = OpenSearchOldDocumentIndex(
-        index_name=test_index_name,
-        embedding_dim=128,
-        embedding_precision=EmbeddingPrecision.FLOAT,
-        secondary_index_name=None,
-        secondary_embedding_dim=None,
-        secondary_embedding_precision=None,
-        large_chunks_enabled=False,
-        secondary_large_chunks_enabled=None,
-        multitenant=MULTI_TENANT,
-    )
-    opensearch_index.ensure_indices_exist(
-        primary_embedding_dim=128,
-        primary_embedding_precision=EmbeddingPrecision.FLOAT,
-        secondary_index_embedding_dim=None,
-        secondary_index_embedding_precision=None,
-    )
-
-    yield opensearch_index  # Test runs here.
-
-    # TODO(ENG-3765)(andrei): Explicitly cleanup index. Not immediately
-    # pressing; in CI we should be using fresh instances of dependencies each
-    # time anyway.
-
-
-@pytest.fixture(scope="module")
-def document_indices(
-    vespa_document_index: VespaIndex,
-    opensearch_document_index: OpenSearchOldDocumentIndex,
-) -> Generator[list[DocumentIndex], None, None]:
-    # Ideally these are parametrized; doing so with pytest fixtures is tricky.
-    yield [opensearch_document_index, vespa_document_index]  # Test runs here.
-
-
-@pytest.fixture(scope="function")
-def chunks(
-    tenant_context: None,  # noqa: ARG001
-) -> Generator[list[DocMetadataAwareIndexChunk], None, None]:
-    result = []
-    chunk_count = 5
-    doc_id = "test_doc"
-    tenant_id = get_current_tenant_id()
-    access = DocumentAccess.build(
-        user_emails=[],
-        user_groups=[],
-        external_user_emails=[],
-        external_user_group_ids=[],
-        is_public=True,
-    )
-    document_sets: set[str] = set()
-    user_project: list[int] = list()
-    personas: list[int] = list()
-    boost = 0
-    blurb = "blurb"
-    content = "content"
-    title_prefix = ""
-    doc_summary = ""
-    chunk_context = ""
-    title_embedding = [1.0] + [0] * 127
-    # Full 0 vectors are not supported for cos similarity.
-    embeddings = ChunkEmbedding(
-        full_embedding=[1.0] + [0] * 127, mini_chunk_embeddings=[]
-    )
-    source_document = Document(
-        id=doc_id,
-        semantic_identifier="semantic identifier",
-        source=DocumentSource.FILE,
-        sections=[],
-        metadata={},
-        title="title",
-    )
-    metadata_suffix_keyword = ""
-    image_file_id = None
-    source_links: dict[int, str] = {0: ""}
-    ancestor_hierarchy_node_ids: list[int] = []
-    for i in range(chunk_count):
-        result.append(
-            DocMetadataAwareIndexChunk(
-                tenant_id=tenant_id,
-                access=access,
-                document_sets=document_sets,
-                user_project=user_project,
-                personas=personas,
-                boost=boost,
-                aggregated_chunk_boost_factor=0,
-                ancestor_hierarchy_node_ids=ancestor_hierarchy_node_ids,
-                embeddings=embeddings,
-                title_embedding=title_embedding,
-                source_document=source_document,
-                title_prefix=title_prefix,
-                metadata_suffix_keyword=metadata_suffix_keyword,
-                metadata_suffix_semantic="",
-                contextual_rag_reserved_tokens=0,
-                doc_summary=doc_summary,
-                chunk_context=chunk_context,
-                mini_chunk_texts=None,
-                large_chunk_id=None,
-                chunk_id=i,
-                blurb=blurb,
-                content=content,
-                source_links=source_links,
-                image_file_id=image_file_id,
-                section_continuation=False,
-            )
-        )
-    yield result  # Test runs here.
-
-
-@pytest.fixture(scope="function")
-def index_batch_params(
-    tenant_context: None,  # noqa: ARG001
-) -> Generator[IndexBatchParams, None, None]:
-    # WARNING: doc_id_to_previous_chunk_cnt={"test_doc": 0} is hardcoded to 0,
-    # which is only correct on the very first index call. The document_indices
-    # fixture is scope="module", meaning the same OpenSearch and Vespa backends
-    # persist across all test functions in this module. When a second test
-    # function uses this fixture and calls document_index.index(...), the
-    # backend already has 5 chunks for "test_doc" from the previous test run,
-    # but the batch params still claim 0 prior chunks exist. This can lead to
-    # orphaned/duplicate chunks that make subsequent assertions incorrect.
-    # TODO: Whenever adding a second test, either change this or cleanup the
-    # index between test cases.
-    yield IndexBatchParams(
-        doc_id_to_previous_chunk_cnt={"test_doc": 0},
-        doc_id_to_new_chunk_cnt={"test_doc": 5},
-        tenant_id=get_current_tenant_id(),
-        large_chunks_enabled=False,
-    )
-
-
-class TestDocumentIndexOld:
-    """Tests the old DocumentIndex interface."""
-
-    def test_update_single_can_clear_user_projects_and_personas(
-        self,
-        document_indices: list[DocumentIndex],
-        # This test case assumes all these chunks correspond to one document.
-        chunks: list[DocMetadataAwareIndexChunk],
-        index_batch_params: IndexBatchParams,
-    ) -> None:
-        """
-        Tests that update_single can clear user_projects and personas.
-        """
-        for document_index in document_indices:
-            # Precondition.
-            # Ensure there is some non-empty value for user project and
-            # personas.
-            for chunk in chunks:
-                chunk.user_project = [1]
-                chunk.personas = [2]
-            document_index.index(chunks, index_batch_params)
-
-            # Ensure that we can get chunks as expected with filters.
-            doc_id = chunks[0].source_document.id
-            chunk_count = len(chunks)
-            tenant_id = get_current_tenant_id()
-            # We need to specify the chunk index range and specify
-            # batch_retrieval=True below to trigger the codepath for Vespa's
-            # search API, which uses the expected additive filtering for
-            # project_id and persona_id. Otherwise we would use the codepath for
-            # the visit API, which does not have this kind of filtering
-            # implemented.
-            chunk_request = VespaChunkRequest(
-                document_id=doc_id, min_chunk_ind=0, max_chunk_ind=chunk_count - 1
-            )
-            project_persona_filters = IndexFilters(
-                access_control_list=None,
-                tenant_id=tenant_id,
-                project_id=1,
-                persona_id=2,
-                # We need this even though none of the chunks belong to a
-                # document set because project_id and persona_id are only
-                # additive filters in the event the agent has knowledge scope;
-                # if the agent does not, it is implied that it can see
-                # everything it is allowed to.
-                document_set=["1"],
-            )
-            # Not best practice here but the API for refreshing the index to
-            # ensure that the latest data is present is not exposed in this
-            # class and is not the same for Vespa and OpenSearch, so we just
-            # tolerate a sleep for now. As a consequence the number of tests in
-            # this suite should be small. We only need to tolerate this for as
-            # long as we continue to use Vespa, we can consider exposing
-            # something for OpenSearch later.
-            time.sleep(1)
-            inference_chunks = document_index.id_based_retrieval(
-                chunk_requests=[chunk_request],
-                filters=project_persona_filters,
-                batch_retrieval=True,
-            )
-            assert len(inference_chunks) == chunk_count
-            # Sort by chunk id to easily test if we have all chunks.
-            for i, inference_chunk in enumerate(
-                sorted(inference_chunks, key=lambda x: x.chunk_id)
-            ):
-                assert inference_chunk.chunk_id == i
-                assert inference_chunk.document_id == doc_id
-
-            # Under test.
-            # Explicitly set empty fields here.
-            user_fields = VespaDocumentUserFields(user_projects=[], personas=[])
-            document_index.update_single(
-                doc_id=doc_id,
-                chunk_count=chunk_count,
-                tenant_id=tenant_id,
-                fields=None,
-                user_fields=user_fields,
-            )
-
-            # Postcondition.
-            filters = IndexFilters(access_control_list=None, tenant_id=tenant_id)
-            # We should expect to get back all expected chunks with no filters.
-            # Again, not best practice here.
-            time.sleep(1)
-            inference_chunks = document_index.id_based_retrieval(
-                chunk_requests=[chunk_request], filters=filters, batch_retrieval=True
-            )
-            assert len(inference_chunks) == chunk_count
-            # Sort by chunk id to easily test if we have all chunks.
-            for i, inference_chunk in enumerate(
-                sorted(inference_chunks, key=lambda x: x.chunk_id)
-            ):
-                assert inference_chunk.chunk_id == i
-                assert inference_chunk.document_id == doc_id
-            # Now, we should expect to not get any chunks if we specify the user
-            # project and personas filters.
-            inference_chunks = document_index.id_based_retrieval(
-                chunk_requests=[chunk_request],
-                filters=project_persona_filters,
-                batch_retrieval=True,
-            )
-            assert len(inference_chunks) == 0

backend/tests/external_dependency_unit/llm/test_llm_provider_auto_mode.py

@@ -1152,179 +1152,3 @@ class TestAutoModeTransitionsAndResync:
         finally:
             db_session.rollback()
             _cleanup_provider(db_session, provider_name)
-
-    def test_sync_updates_default_when_recommended_default_changes(
-        self,
-        db_session: Session,
-        provider_name: str,
-    ) -> None:
-        """When the provider owns the CHAT default and a sync arrives with a
-        different recommended default model (both models still in config),
-        the global default should be updated to the new recommendation.
-
-        Steps:
-        1. Create auto-mode provider with config v1: default=gpt-4o.
-        2. Set gpt-4o as the global CHAT default.
-        3. Re-sync with config v2: default=gpt-4o-mini (gpt-4o still present).
-        4. Verify the CHAT default switched to gpt-4o-mini and both models
-           remain visible.
-        """
-        config_v1 = _create_mock_llm_recommendations(
-            provider=LlmProviderNames.OPENAI,
-            default_model_name="gpt-4o",
-            additional_models=["gpt-4o-mini"],
-        )
-        config_v2 = _create_mock_llm_recommendations(
-            provider=LlmProviderNames.OPENAI,
-            default_model_name="gpt-4o-mini",
-            additional_models=["gpt-4o"],
-        )
-
-        try:
-            with patch(
-                "onyx.server.manage.llm.api.fetch_llm_recommendations_from_github",
-                return_value=config_v1,
-            ):
-                put_llm_provider(
-                    llm_provider_upsert_request=LLMProviderUpsertRequest(
-                        name=provider_name,
-                        provider=LlmProviderNames.OPENAI,
-                        api_key="sk-test-key-00000000000000000000000000000000000",
-                        api_key_changed=True,
-                        is_auto_mode=True,
-                        model_configurations=[],
-                    ),
-                    is_creation=True,
-                    _=_create_mock_admin(),
-                    db_session=db_session,
-                )
-
-            # Set gpt-4o as the global CHAT default
-            db_session.expire_all()
-            provider = fetch_existing_llm_provider(
-                name=provider_name, db_session=db_session
-            )
-            assert provider is not None
-            update_default_provider(provider.id, "gpt-4o", db_session)
-
-            default_before = fetch_default_llm_model(db_session)
-            assert default_before is not None
-            assert default_before.name == "gpt-4o"
-
-            # Re-sync with config v2 (recommended default changed)
-            db_session.expire_all()
-            provider = fetch_existing_llm_provider(
-                name=provider_name, db_session=db_session
-            )
-            assert provider is not None
-
-            changes = sync_auto_mode_models(
-                db_session=db_session,
-                provider=provider,
-                llm_recommendations=config_v2,
-            )
-            assert changes > 0, "Sync should report changes when default switches"
-
-            # Both models should remain visible
-            db_session.expire_all()
-            provider = fetch_existing_llm_provider(
-                name=provider_name, db_session=db_session
-            )
-            assert provider is not None
-            visibility = {
-                mc.name: mc.is_visible for mc in provider.model_configurations
-            }
-            assert visibility["gpt-4o"] is True
-            assert visibility["gpt-4o-mini"] is True
-
-            # The CHAT default should now be gpt-4o-mini
-            default_after = fetch_default_llm_model(db_session)
-            assert default_after is not None
-            assert (
-                default_after.name == "gpt-4o-mini"
-            ), f"Default should be updated to 'gpt-4o-mini', got '{default_after.name}'"
-
-        finally:
-            db_session.rollback()
-            _cleanup_provider(db_session, provider_name)
-
-    def test_sync_idempotent_when_default_already_matches(
-        self,
-        db_session: Session,
-        provider_name: str,
-    ) -> None:
-        """When the provider owns the CHAT default and it already matches the
-        recommended default, re-syncing should report zero changes.
-
-        This is a regression test for the bug where changes was unconditionally
-        incremented even when the default was already correct.
-        """
-        config = _create_mock_llm_recommendations(
-            provider=LlmProviderNames.OPENAI,
-            default_model_name="gpt-4o",
-            additional_models=["gpt-4o-mini"],
-        )
-
-        try:
-            with patch(
-                "onyx.server.manage.llm.api.fetch_llm_recommendations_from_github",
-                return_value=config,
-            ):
-                put_llm_provider(
-                    llm_provider_upsert_request=LLMProviderUpsertRequest(
-                        name=provider_name,
-                        provider=LlmProviderNames.OPENAI,
-                        api_key="sk-test-key-00000000000000000000000000000000000",
-                        api_key_changed=True,
-                        is_auto_mode=True,
-                        model_configurations=[],
-                    ),
-                    is_creation=True,
-                    _=_create_mock_admin(),
-                    db_session=db_session,
-                )
-
-            # Set gpt-4o (the recommended default) as global CHAT default
-            db_session.expire_all()
-            provider = fetch_existing_llm_provider(
-                name=provider_name, db_session=db_session
-            )
-            assert provider is not None
-            update_default_provider(provider.id, "gpt-4o", db_session)
-
-            # First sync to stabilize state
-            db_session.expire_all()
-            provider = fetch_existing_llm_provider(
-                name=provider_name, db_session=db_session
-            )
-            assert provider is not None
-            sync_auto_mode_models(
-                db_session=db_session,
-                provider=provider,
-                llm_recommendations=config,
-            )
-
-            # Second sync — default already matches, should be a no-op
-            db_session.expire_all()
-            provider = fetch_existing_llm_provider(
-                name=provider_name, db_session=db_session
-            )
-            assert provider is not None
-            changes = sync_auto_mode_models(
-                db_session=db_session,
-                provider=provider,
-                llm_recommendations=config,
-            )
-            assert changes == 0, (
-                f"Expected 0 changes when default already matches recommended, "
-                f"got {changes}"
-            )
-
-            # Default should still be gpt-4o
-            default_model = fetch_default_llm_model(db_session)
-            assert default_model is not None
-            assert default_model.name == "gpt-4o"
-
-        finally:
-            db_session.rollback()
-            _cleanup_provider(db_session, provider_name)

backend/tests/external_dependency_unit/llm/test_llm_provider_default_model_protection.py

@@ -1,220 +0,0 @@
-"""
-This should act as the main point of reference for testing that default model
-logic is consisten.
-
- -
-"""
-
-from collections.abc import Generator
-from uuid import uuid4
-
-import pytest
-from sqlalchemy.orm import Session
-
-from onyx.db.llm import fetch_existing_llm_provider
-from onyx.db.llm import remove_llm_provider
-from onyx.db.llm import update_default_provider
-from onyx.db.llm import update_default_vision_provider
-from onyx.db.llm import upsert_llm_provider
-from onyx.llm.constants import LlmProviderNames
-from onyx.server.manage.llm.models import LLMProviderUpsertRequest
-from onyx.server.manage.llm.models import LLMProviderView
-from onyx.server.manage.llm.models import ModelConfigurationUpsertRequest
-
-
-def _create_test_provider(
-    db_session: Session,
-    name: str,
-    models: list[ModelConfigurationUpsertRequest] | None = None,
-) -> LLMProviderView:
-    """Helper to create a test LLM provider with multiple models."""
-    if models is None:
-        models = [
-            ModelConfigurationUpsertRequest(
-                name="gpt-4o", is_visible=True, supports_image_input=True
-            ),
-            ModelConfigurationUpsertRequest(
-                name="gpt-4o-mini", is_visible=True, supports_image_input=False
-            ),
-        ]
-    return upsert_llm_provider(
-        LLMProviderUpsertRequest(
-            name=name,
-            provider=LlmProviderNames.OPENAI,
-            api_key="sk-test-key-00000000000000000000000000000000000",
-            api_key_changed=True,
-            model_configurations=models,
-        ),
-        db_session=db_session,
-    )
-
-
-def _cleanup_provider(db_session: Session, name: str) -> None:
-    """Helper to clean up a test provider by name."""
-    provider = fetch_existing_llm_provider(name=name, db_session=db_session)
-    if provider:
-        remove_llm_provider(db_session, provider.id)
-
-
-@pytest.fixture
-def provider_name(db_session: Session) -> Generator[str, None, None]:
-    """Generate a unique provider name for each test, with automatic cleanup."""
-    name = f"test-provider-{uuid4().hex[:8]}"
-    yield name
-    db_session.rollback()
-    _cleanup_provider(db_session, name)
-
-
-class TestDefaultModelProtection:
-    """Tests that the default model cannot be removed or hidden."""
-
-    def test_cannot_remove_default_text_model(
-        self,
-        db_session: Session,
-        provider_name: str,
-    ) -> None:
-        """Removing the default text model from a provider should raise ValueError."""
-        provider = _create_test_provider(db_session, provider_name)
-        update_default_provider(provider.id, "gpt-4o", db_session)
-
-        # Try to update the provider without the default model
-        with pytest.raises(ValueError, match="Cannot remove the default model"):
-            upsert_llm_provider(
-                LLMProviderUpsertRequest(
-                    id=provider.id,
-                    name=provider_name,
-                    provider=LlmProviderNames.OPENAI,
-                    api_key="sk-test-key-00000000000000000000000000000000000",
-                    api_key_changed=True,
-                    model_configurations=[
-                        ModelConfigurationUpsertRequest(
-                            name="gpt-4o-mini", is_visible=True
-                        ),
-                    ],
-                ),
-                db_session=db_session,
-            )
-
-    def test_cannot_hide_default_text_model(
-        self,
-        db_session: Session,
-        provider_name: str,
-    ) -> None:
-        """Setting is_visible=False on the default text model should raise ValueError."""
-        provider = _create_test_provider(db_session, provider_name)
-        update_default_provider(provider.id, "gpt-4o", db_session)
-
-        # Try to hide the default model
-        with pytest.raises(ValueError, match="Cannot hide the default model"):
-            upsert_llm_provider(
-                LLMProviderUpsertRequest(
-                    id=provider.id,
-                    name=provider_name,
-                    provider=LlmProviderNames.OPENAI,
-                    api_key="sk-test-key-00000000000000000000000000000000000",
-                    api_key_changed=True,
-                    model_configurations=[
-                        ModelConfigurationUpsertRequest(
-                            name="gpt-4o", is_visible=False
-                        ),
-                        ModelConfigurationUpsertRequest(
-                            name="gpt-4o-mini", is_visible=True
-                        ),
-                    ],
-                ),
-                db_session=db_session,
-            )
-
-    def test_cannot_remove_default_vision_model(
-        self,
-        db_session: Session,
-        provider_name: str,
-    ) -> None:
-        """Removing the default vision model from a provider should raise ValueError."""
-        provider = _create_test_provider(db_session, provider_name)
-        # Set gpt-4o as both the text and vision default
-        update_default_provider(provider.id, "gpt-4o", db_session)
-        update_default_vision_provider(provider.id, "gpt-4o", db_session)
-
-        # Try to remove the default vision model
-        with pytest.raises(ValueError, match="Cannot remove the default model"):
-            upsert_llm_provider(
-                LLMProviderUpsertRequest(
-                    id=provider.id,
-                    name=provider_name,
-                    provider=LlmProviderNames.OPENAI,
-                    api_key="sk-test-key-00000000000000000000000000000000000",
-                    api_key_changed=True,
-                    model_configurations=[
-                        ModelConfigurationUpsertRequest(
-                            name="gpt-4o-mini", is_visible=True
-                        ),
-                    ],
-                ),
-                db_session=db_session,
-            )
-
-    def test_can_remove_non_default_model(
-        self,
-        db_session: Session,
-        provider_name: str,
-    ) -> None:
-        """Removing a non-default model should succeed."""
-        provider = _create_test_provider(db_session, provider_name)
-        update_default_provider(provider.id, "gpt-4o", db_session)
-
-        # Remove gpt-4o-mini (not default) — should succeed
-        updated = upsert_llm_provider(
-            LLMProviderUpsertRequest(
-                id=provider.id,
-                name=provider_name,
-                provider=LlmProviderNames.OPENAI,
-                api_key="sk-test-key-00000000000000000000000000000000000",
-                api_key_changed=True,
-                model_configurations=[
-                    ModelConfigurationUpsertRequest(
-                        name="gpt-4o", is_visible=True, supports_image_input=True
-                    ),
-                ],
-            ),
-            db_session=db_session,
-        )
-
-        model_names = {mc.name for mc in updated.model_configurations}
-        assert "gpt-4o" in model_names
-        assert "gpt-4o-mini" not in model_names
-
-    def test_can_hide_non_default_model(
-        self,
-        db_session: Session,
-        provider_name: str,
-    ) -> None:
-        """Hiding a non-default model should succeed."""
-        provider = _create_test_provider(db_session, provider_name)
-        update_default_provider(provider.id, "gpt-4o", db_session)
-
-        # Hide gpt-4o-mini (not default) — should succeed
-        updated = upsert_llm_provider(
-            LLMProviderUpsertRequest(
-                id=provider.id,
-                name=provider_name,
-                provider=LlmProviderNames.OPENAI,
-                api_key="sk-test-key-00000000000000000000000000000000000",
-                api_key_changed=True,
-                model_configurations=[
-                    ModelConfigurationUpsertRequest(
-                        name="gpt-4o", is_visible=True, supports_image_input=True
-                    ),
-                    ModelConfigurationUpsertRequest(
-                        name="gpt-4o-mini", is_visible=False
-                    ),
-                ],
-            ),
-            db_session=db_session,
-        )
-
-        model_visibility = {
-            mc.name: mc.is_visible for mc in updated.model_configurations
-        }
-        assert model_visibility["gpt-4o"] is True
-        assert model_visibility["gpt-4o-mini"] is False

backend/tests/external_dependency_unit/opensearch_migration/test_opensearch_migration_tasks.py

@@ -17,9 +17,6 @@ from unittest.mock import patch
 import pytest
 from sqlalchemy.orm import Session
 
-from onyx.background.celery.tasks.opensearch_migration.constants import (
-    GET_VESPA_CHUNKS_SLICE_COUNT,
-)
 from onyx.background.celery.tasks.opensearch_migration.tasks import (
     is_continuation_token_done_for_all_slices,
 )
@@ -239,8 +236,6 @@ def full_deployment_setup() -> Generator[None, None, None]:
     NOTE: We deliberately duplicate this logic from
     backend/tests/external_dependency_unit/conftest.py because we need to set
     opensearch_available just for this module, not the entire test session.
-
-    TODO(ENG-3764)(andrei): Consolidate some of these test fixtures.
     """
     # Patch ENABLE_OPENSEARCH_INDEXING_FOR_ONYX just for this test because we
     # don't yet want that enabled for all tests.
@@ -325,15 +320,9 @@ def test_embedding_dimension(db_session: Session) -> Generator[int, None, None]:
 @pytest.fixture(scope="function")
 def patch_get_vespa_chunks_page_size() -> Generator[int, None, None]:
     test_page_size = 5
-    with (
-        patch(
-            "onyx.background.celery.tasks.opensearch_migration.tasks.GET_VESPA_CHUNKS_PAGE_SIZE",
-            test_page_size,
-        ),
-        patch(
-            "onyx.background.celery.tasks.opensearch_migration.constants.GET_VESPA_CHUNKS_PAGE_SIZE",
-            test_page_size,
-        ),
+    with patch(
+        "onyx.background.celery.tasks.opensearch_migration.tasks.GET_VESPA_CHUNKS_PAGE_SIZE",
+        test_page_size,
     ):
         yield test_page_size  # Test runs here.
 
@@ -593,175 +582,6 @@ class TestMigrateChunksFromVespaToOpenSearchTask:
                     document_chunks[document.id][opensearch_chunk.chunk_index],
                 )
 
-    def test_chunk_migration_visits_all_chunks_even_when_batch_size_varies(
-        self,
-        db_session: Session,
-        test_documents: list[Document],
-        vespa_document_index: VespaDocumentIndex,
-        opensearch_client: OpenSearchIndexClient,
-        test_embedding_dimension: int,
-        clean_migration_tables: None,  # noqa: ARG002
-        enable_opensearch_indexing_for_onyx: None,  # noqa: ARG002
-    ) -> None:
-        """
-        Tests that chunk migration works correctly even when the batch size
-        changes halfway through a migration.
-
-        Simulates task time running out my mocking the locking behavior.
-        """
-        # Precondition.
-        # Index chunks into Vespa.
-        document_chunks: dict[str, list[dict[str, Any]]] = {
-            document.id: [
-                _create_raw_document_chunk(
-                    document_id=document.id,
-                    chunk_index=i,
-                    content=f"Test content {i} for {document.id}",
-                    embedding=_generate_test_vector(test_embedding_dimension),
-                    now=datetime.now(),
-                    title=f"Test title {document.id}",
-                    title_embedding=_generate_test_vector(test_embedding_dimension),
-                )
-                for i in range(CHUNK_COUNT)
-            ]
-            for document in test_documents
-        }
-        all_chunks: list[dict[str, Any]] = []
-        for chunks in document_chunks.values():
-            all_chunks.extend(chunks)
-        vespa_document_index.index_raw_chunks(all_chunks)
-
-        # Run the initial batch. To simulate partial progress we will mock the
-        # redis lock to return True for the first invocation of .owned() and
-        # False subsequently.
-        # NOTE: The batch size is currently set to 5 in
-        # patch_get_vespa_chunks_page_size.
-        mock_redis_client = Mock()
-        mock_lock = Mock()
-        mock_lock.owned.side_effect = [True, False, False]
-        mock_lock.acquire.return_value = True
-        mock_redis_client.lock.return_value = mock_lock
-        with patch(
-            "onyx.background.celery.tasks.opensearch_migration.tasks.get_redis_client",
-            return_value=mock_redis_client,
-        ):
-            result_1 = migrate_chunks_from_vespa_to_opensearch_task(
-                tenant_id=get_current_tenant_id()
-            )
-
-        assert result_1 is True
-        # Expire the session cache to see the committed changes from the task.
-        db_session.expire_all()
-
-        # Verify partial progress was saved.
-        tenant_record = db_session.query(OpenSearchTenantMigrationRecord).first()
-        assert tenant_record is not None
-        partial_chunks_migrated = tenant_record.total_chunks_migrated
-        assert partial_chunks_migrated > 0
-        # page_size applies per slice, so one iteration can fetch up to
-        # page_size * GET_VESPA_CHUNKS_SLICE_COUNT chunks total.
-        assert partial_chunks_migrated <= 5 * GET_VESPA_CHUNKS_SLICE_COUNT
-        assert tenant_record.vespa_visit_continuation_token is not None
-        # Slices are not necessarily evenly distributed across all document
-        # chunks so we can't test that every token is non-None, but certainly at
-        # least one must be.
-        assert any(json.loads(tenant_record.vespa_visit_continuation_token).values())
-        assert tenant_record.migration_completed_at is None
-        assert tenant_record.approx_chunk_count_in_vespa is not None
-
-        # Under test.
-        # Now patch the batch size to be some other number, like 2.
-        mock_redis_client = Mock()
-        mock_lock = Mock()
-        mock_lock.owned.side_effect = [True, False, False]
-        mock_lock.acquire.return_value = True
-        mock_redis_client.lock.return_value = mock_lock
-        with (
-            patch(
-                "onyx.background.celery.tasks.opensearch_migration.tasks.GET_VESPA_CHUNKS_PAGE_SIZE",
-                2,
-            ),
-            patch(
-                "onyx.background.celery.tasks.opensearch_migration.constants.GET_VESPA_CHUNKS_PAGE_SIZE",
-                2,
-            ),
-            patch(
-                "onyx.background.celery.tasks.opensearch_migration.tasks.get_redis_client",
-                return_value=mock_redis_client,
-            ),
-        ):
-            result_2 = migrate_chunks_from_vespa_to_opensearch_task(
-                tenant_id=get_current_tenant_id()
-            )
-
-        # Postcondition.
-        assert result_2 is True
-        # Expire the session cache to see the committed changes from the task.
-        db_session.expire_all()
-
-        # Verify next partial progress was saved.
-        tenant_record = db_session.query(OpenSearchTenantMigrationRecord).first()
-        assert tenant_record is not None
-        new_partial_chunks_migrated = tenant_record.total_chunks_migrated
-        assert new_partial_chunks_migrated > partial_chunks_migrated
-        # page_size applies per slice, so one iteration can fetch up to
-        # page_size * GET_VESPA_CHUNKS_SLICE_COUNT chunks total.
-        assert new_partial_chunks_migrated <= (5 + 2) * GET_VESPA_CHUNKS_SLICE_COUNT
-        assert tenant_record.vespa_visit_continuation_token is not None
-        # Slices are not necessarily evenly distributed across all document
-        # chunks so we can't test that every token is non-None, but certainly at
-        # least one must be.
-        assert any(json.loads(tenant_record.vespa_visit_continuation_token).values())
-        assert tenant_record.migration_completed_at is None
-        assert tenant_record.approx_chunk_count_in_vespa is not None
-
-        # Under test.
-        # Run the remainder of the migration.
-        with (
-            patch(
-                "onyx.background.celery.tasks.opensearch_migration.tasks.GET_VESPA_CHUNKS_PAGE_SIZE",
-                2,
-            ),
-            patch(
-                "onyx.background.celery.tasks.opensearch_migration.constants.GET_VESPA_CHUNKS_PAGE_SIZE",
-                2,
-            ),
-        ):
-            result_3 = migrate_chunks_from_vespa_to_opensearch_task(
-                tenant_id=get_current_tenant_id()
-            )
-
-        # Postcondition.
-        assert result_3 is True
-        # Expire the session cache to see the committed changes from the task.
-        db_session.expire_all()
-
-        # Verify completion.
-        tenant_record = db_session.query(OpenSearchTenantMigrationRecord).first()
-        assert tenant_record is not None
-        assert tenant_record.total_chunks_migrated > new_partial_chunks_migrated
-        assert tenant_record.total_chunks_migrated == len(all_chunks)
-        # Visit is complete so continuation token should be None.
-        assert tenant_record.vespa_visit_continuation_token is not None
-        assert is_continuation_token_done_for_all_slices(
-            json.loads(tenant_record.vespa_visit_continuation_token)
-        )
-        assert tenant_record.migration_completed_at is not None
-        assert tenant_record.approx_chunk_count_in_vespa == len(all_chunks)
-
-        # Verify chunks were indexed in OpenSearch.
-        for document in test_documents:
-            opensearch_chunks = _get_document_chunks_from_opensearch(
-                opensearch_client, document.id, get_current_tenant_id()
-            )
-            assert len(opensearch_chunks) == CHUNK_COUNT
-            opensearch_chunks.sort(key=lambda x: x.chunk_index)
-            for opensearch_chunk in opensearch_chunks:
-                _assert_chunk_matches_vespa_chunk(
-                    opensearch_chunk,
-                    document_chunks[document.id][opensearch_chunk.chunk_index],
-                )
-
     def test_chunk_migration_empty_vespa(
         self,
         db_session: Session,

backend/tests/unit/onyx/access/test_user_file_access.py

@@ -1,163 +0,0 @@
-"""Tests for user file ACL computation, including shared persona access."""
-
-from unittest.mock import MagicMock
-from unittest.mock import patch
-from uuid import uuid4
-
-from onyx.access.access import collect_user_file_access
-from onyx.access.access import get_access_for_user_files_impl
-from onyx.access.utils import prefix_user_email
-from onyx.configs.constants import PUBLIC_DOC_PAT
-
-
-def _make_user(email: str) -> MagicMock:
-    user = MagicMock()
-    user.email = email
-    user.id = uuid4()
-    return user
-
-
-def _make_persona(
-    *,
-    owner: MagicMock | None = None,
-    shared_users: list[MagicMock] | None = None,
-    is_public: bool = False,
-    deleted: bool = False,
-) -> MagicMock:
-    persona = MagicMock()
-    persona.deleted = deleted
-    persona.is_public = is_public
-    persona.user_id = owner.id if owner else None
-    persona.user = owner
-    persona.users = shared_users or []
-    return persona
-
-
-def _make_user_file(
-    *,
-    owner: MagicMock,
-    assistants: list[MagicMock] | None = None,
-) -> MagicMock:
-    uf = MagicMock()
-    uf.id = uuid4()
-    uf.user = owner
-    uf.user_id = owner.id
-    uf.assistants = assistants or []
-    return uf
-
-
-class TestCollectUserFileAccess:
-    def test_owner_only(self) -> None:
-        owner = _make_user("owner@test.com")
-        uf = _make_user_file(owner=owner)
-
-        emails, is_public = collect_user_file_access(uf)
-
-        assert emails == {"owner@test.com"}
-        assert is_public is False
-
-    def test_shared_persona_adds_users(self) -> None:
-        owner = _make_user("owner@test.com")
-        shared = _make_user("shared@test.com")
-        persona = _make_persona(owner=owner, shared_users=[shared])
-        uf = _make_user_file(owner=owner, assistants=[persona])
-
-        emails, is_public = collect_user_file_access(uf)
-
-        assert emails == {"owner@test.com", "shared@test.com"}
-        assert is_public is False
-
-    def test_persona_owner_added(self) -> None:
-        """Persona owner (different from file owner) gets access too."""
-        file_owner = _make_user("file-owner@test.com")
-        persona_owner = _make_user("persona-owner@test.com")
-        persona = _make_persona(owner=persona_owner)
-        uf = _make_user_file(owner=file_owner, assistants=[persona])
-
-        emails, is_public = collect_user_file_access(uf)
-
-        assert "file-owner@test.com" in emails
-        assert "persona-owner@test.com" in emails
-
-    def test_public_persona_makes_file_public(self) -> None:
-        owner = _make_user("owner@test.com")
-        persona = _make_persona(owner=owner, is_public=True)
-        uf = _make_user_file(owner=owner, assistants=[persona])
-
-        emails, is_public = collect_user_file_access(uf)
-
-        assert is_public is True
-        assert "owner@test.com" in emails
-
-    def test_deleted_persona_ignored(self) -> None:
-        owner = _make_user("owner@test.com")
-        shared = _make_user("shared@test.com")
-        persona = _make_persona(owner=owner, shared_users=[shared], deleted=True)
-        uf = _make_user_file(owner=owner, assistants=[persona])
-
-        emails, is_public = collect_user_file_access(uf)
-
-        assert emails == {"owner@test.com"}
-        assert is_public is False
-
-    def test_multiple_personas_combine(self) -> None:
-        owner = _make_user("owner@test.com")
-        user_a = _make_user("a@test.com")
-        user_b = _make_user("b@test.com")
-        p1 = _make_persona(owner=owner, shared_users=[user_a])
-        p2 = _make_persona(owner=owner, shared_users=[user_b])
-        uf = _make_user_file(owner=owner, assistants=[p1, p2])
-
-        emails, is_public = collect_user_file_access(uf)
-
-        assert emails == {"owner@test.com", "a@test.com", "b@test.com"}
-
-    def test_deduplication(self) -> None:
-        owner = _make_user("owner@test.com")
-        shared = _make_user("shared@test.com")
-        p1 = _make_persona(owner=owner, shared_users=[shared])
-        p2 = _make_persona(owner=owner, shared_users=[shared])
-        uf = _make_user_file(owner=owner, assistants=[p1, p2])
-
-        emails, _ = collect_user_file_access(uf)
-
-        assert emails == {"owner@test.com", "shared@test.com"}
-
-
-class TestGetAccessForUserFiles:
-    def test_shared_user_in_acl(self) -> None:
-        """Shared persona users should appear in the ACL."""
-        owner = _make_user("owner@test.com")
-        shared = _make_user("shared@test.com")
-        persona = _make_persona(owner=owner, shared_users=[shared])
-        uf = _make_user_file(owner=owner, assistants=[persona])
-
-        db_session = MagicMock()
-        with patch(
-            "onyx.access.access.fetch_user_files_with_access_relationships",
-            return_value=[uf],
-        ):
-            result = get_access_for_user_files_impl([str(uf.id)], db_session)
-
-        access = result[str(uf.id)]
-        acl = access.to_acl()
-        assert prefix_user_email("owner@test.com") in acl
-        assert prefix_user_email("shared@test.com") in acl
-        assert access.is_public is False
-
-    def test_public_persona_sets_public_acl(self) -> None:
-        owner = _make_user("owner@test.com")
-        persona = _make_persona(owner=owner, is_public=True)
-        uf = _make_user_file(owner=owner, assistants=[persona])
-
-        db_session = MagicMock()
-        with patch(
-            "onyx.access.access.fetch_user_files_with_access_relationships",
-            return_value=[uf],
-        ):
-            result = get_access_for_user_files_impl([str(uf.id)], db_session)
-
-        access = result[str(uf.id)]
-        assert access.is_public is True
-        acl = access.to_acl()
-        assert PUBLIC_DOC_PAT in acl

backend/tests/unit/onyx/background/celery/tasks/test_user_file_impl_redis_locking.py

@@ -27,6 +27,7 @@ def _mock_session_returning_none() -> MagicMock:
     """Return a mock session whose .get() returns None (file not found)."""
     session = MagicMock()
     session.get.return_value = None
+    session.execute.return_value.scalar_one_or_none.return_value = None
     return session
 
 
@@ -219,10 +220,6 @@ class TestDeleteUserFileImpl:
 # ------------------------------------------------------------------
 
 
-@patch(
-    f"{TASKS_MODULE}.fetch_user_files_with_access_relationships",
-    return_value=[],
-)
 class TestProjectSyncUserFileImpl:
     @patch(f"{TASKS_MODULE}.get_session_with_current_tenant")
     @patch(f"{TASKS_MODULE}.get_redis_client")
@@ -230,7 +227,6 @@ class TestProjectSyncUserFileImpl:
         self,
         mock_get_redis: MagicMock,
         mock_get_session: MagicMock,
-        _mock_fetch: MagicMock,
     ) -> None:
         redis_client = MagicMock()
         lock = MagicMock()
@@ -259,7 +255,6 @@ class TestProjectSyncUserFileImpl:
         self,
         mock_get_redis: MagicMock,
         mock_get_session: MagicMock,
-        _mock_fetch: MagicMock,
     ) -> None:
         redis_client = MagicMock()
         lock = MagicMock()
@@ -282,7 +277,6 @@ class TestProjectSyncUserFileImpl:
         self,
         mock_get_redis: MagicMock,
         mock_get_session: MagicMock,
-        _mock_fetch: MagicMock,
     ) -> None:
         session = _mock_session_returning_none()
         mock_get_session.return_value.__enter__.return_value = session

backend/tests/unit/onyx/background/celery/tasks/test_user_file_processing_no_vectordb.py

@@ -379,13 +379,10 @@ class TestProjectSyncImplNoVectorDb:
     ) -> None:
         uf = _make_user_file(status=UserFileStatus.COMPLETED)
         session = MagicMock()
+        session.execute.return_value.scalar_one_or_none.return_value = uf
         mock_get_session.return_value.__enter__.return_value = session
 
         with (
-            patch(
-                f"{TASKS_MODULE}.fetch_user_files_with_access_relationships",
-                return_value=[uf],
-            ),
             patch(f"{TASKS_MODULE}.get_all_document_indices") as mock_get_indices,
             patch(f"{TASKS_MODULE}.get_active_search_settings") as mock_get_ss,
             patch(f"{TASKS_MODULE}.httpx_init_vespa_pool") as mock_vespa_pool,
@@ -408,17 +405,14 @@ class TestProjectSyncImplNoVectorDb:
     ) -> None:
         uf = _make_user_file(status=UserFileStatus.COMPLETED)
         session = MagicMock()
+        session.execute.return_value.scalar_one_or_none.return_value = uf
         mock_get_session.return_value.__enter__.return_value = session
 
-        with patch(
-            f"{TASKS_MODULE}.fetch_user_files_with_access_relationships",
-            return_value=[uf],
-        ):
-            project_sync_user_file_impl(
-                user_file_id=str(uf.id),
-                tenant_id="test-tenant",
-                redis_locking=False,
-            )
+        project_sync_user_file_impl(
+            user_file_id=str(uf.id),
+            tenant_id="test-tenant",
+            redis_locking=False,
+        )
 
         assert uf.needs_project_sync is False
         assert uf.needs_persona_sync is False

backend/tests/unit/onyx/connectors/sharepoint/test_delta_checkpointing.py

@@ -6,7 +6,6 @@ Validates that:
 - Crash + resume skips already-processed pages
 - BFS (folder-scoped) drives process all items in one call
 - 410 Gone triggers a full-resync URL in the checkpoint
-- Duplicate document IDs across delta pages are deduplicated
 """
 
 from __future__ import annotations
@@ -458,228 +457,3 @@ class TestDeltaPageFetchFailure:
         assert final_cp.current_drive_name is None
         assert final_cp.current_drive_id is None
         assert final_cp.current_drive_delta_next_link is None
-
-
-class TestDeltaDuplicateDocumentDedup:
-    """The Microsoft Graph delta API can return the same item on multiple
-    pages.  Documents already yielded should be skipped via
-    checkpoint.seen_document_ids."""
-
-    def test_duplicate_across_pages_is_skipped(
-        self, monkeypatch: pytest.MonkeyPatch
-    ) -> None:
-        """Item 'dup' appears on both page 1 and page 2.  It should only be
-        yielded once."""
-        connector = _setup_connector(monkeypatch)
-        _mock_convert(monkeypatch)
-
-        call_count = 0
-
-        def fake_fetch_page(
-            self: SharepointConnector,  # noqa: ARG001
-            page_url: str,  # noqa: ARG001
-            drive_id: str,  # noqa: ARG001
-            start: datetime | None = None,  # noqa: ARG001
-            end: datetime | None = None,  # noqa: ARG001
-            page_size: int = 200,  # noqa: ARG001
-        ) -> tuple[list[DriveItemData], str | None]:
-            nonlocal call_count
-            call_count += 1
-            if call_count == 1:
-                return [_make_item("a"), _make_item("dup")], "https://next2"
-            return [_make_item("dup"), _make_item("b")], None
-
-        monkeypatch.setattr(
-            SharepointConnector, "_fetch_one_delta_page", fake_fetch_page
-        )
-
-        checkpoint = _build_ready_checkpoint()
-
-        # Page 1: yields a, dup
-        gen = connector._load_from_checkpoint(
-            _START_TS, _END_TS, checkpoint, include_permissions=False
-        )
-        yielded, checkpoint = _consume_generator(gen)
-        docs = _docs_from(yielded)
-        assert [d.id for d in docs] == ["a", "dup"]
-        assert "dup" in checkpoint.seen_document_ids
-
-        # Page 2: dup should be skipped, only b yielded
-        gen = connector._load_from_checkpoint(
-            _START_TS, _END_TS, checkpoint, include_permissions=False
-        )
-        yielded, checkpoint = _consume_generator(gen)
-        docs = _docs_from(yielded)
-        assert [d.id for d in docs] == ["b"]
-
-    def test_duplicate_within_same_page_is_skipped(
-        self, monkeypatch: pytest.MonkeyPatch
-    ) -> None:
-        """If the same item appears twice on a single delta page, only the
-        first occurrence should be yielded."""
-        connector = _setup_connector(monkeypatch)
-        _mock_convert(monkeypatch)
-
-        def fake_fetch_page(
-            self: SharepointConnector,  # noqa: ARG001
-            page_url: str,  # noqa: ARG001
-            drive_id: str,  # noqa: ARG001
-            start: datetime | None = None,  # noqa: ARG001
-            end: datetime | None = None,  # noqa: ARG001
-            page_size: int = 200,  # noqa: ARG001
-        ) -> tuple[list[DriveItemData], str | None]:
-            return [_make_item("x"), _make_item("x"), _make_item("y")], None
-
-        monkeypatch.setattr(
-            SharepointConnector, "_fetch_one_delta_page", fake_fetch_page
-        )
-
-        checkpoint = _build_ready_checkpoint()
-        gen = connector._load_from_checkpoint(
-            _START_TS, _END_TS, checkpoint, include_permissions=False
-        )
-        yielded, checkpoint = _consume_generator(gen)
-        docs = _docs_from(yielded)
-        assert [d.id for d in docs] == ["x", "y"]
-
-    def test_seen_ids_survive_checkpoint_serialization(
-        self, monkeypatch: pytest.MonkeyPatch
-    ) -> None:
-        """seen_document_ids must survive JSON serialization so that
-        dedup works across crash + resume."""
-        connector = _setup_connector(monkeypatch)
-        _mock_convert(monkeypatch)
-
-        call_count = 0
-
-        def fake_fetch_page(
-            self: SharepointConnector,  # noqa: ARG001
-            page_url: str,  # noqa: ARG001
-            drive_id: str,  # noqa: ARG001
-            start: datetime | None = None,  # noqa: ARG001
-            end: datetime | None = None,  # noqa: ARG001
-            page_size: int = 200,  # noqa: ARG001
-        ) -> tuple[list[DriveItemData], str | None]:
-            nonlocal call_count
-            call_count += 1
-            if call_count == 1:
-                return [_make_item("a")], "https://next2"
-            return [_make_item("a"), _make_item("b")], None
-
-        monkeypatch.setattr(
-            SharepointConnector, "_fetch_one_delta_page", fake_fetch_page
-        )
-
-        checkpoint = _build_ready_checkpoint()
-
-        # Page 1
-        gen = connector._load_from_checkpoint(
-            _START_TS, _END_TS, checkpoint, include_permissions=False
-        )
-        _, checkpoint = _consume_generator(gen)
-        assert "a" in checkpoint.seen_document_ids
-
-        # Simulate crash: round-trip through JSON
-        restored = SharepointConnectorCheckpoint.model_validate_json(
-            checkpoint.model_dump_json()
-        )
-        assert "a" in restored.seen_document_ids
-
-        # Page 2 with restored checkpoint: 'a' should be skipped
-        connector2 = _setup_connector(monkeypatch)
-        _mock_convert(monkeypatch)
-        monkeypatch.setattr(
-            SharepointConnector, "_fetch_one_delta_page", fake_fetch_page
-        )
-
-        gen = connector2._load_from_checkpoint(
-            _START_TS, _END_TS, restored, include_permissions=False
-        )
-        yielded, final_cp = _consume_generator(gen)
-        docs = _docs_from(yielded)
-        assert [d.id for d in docs] == ["b"]
-
-    def test_no_dedup_across_separate_indexing_runs(
-        self, monkeypatch: pytest.MonkeyPatch
-    ) -> None:
-        """A fresh checkpoint (new indexing run) should have an empty
-        seen_document_ids, so previously-indexed docs are re-processed."""
-        connector = _setup_connector(monkeypatch)
-        _mock_convert(monkeypatch)
-
-        def fake_fetch_page(
-            self: SharepointConnector,  # noqa: ARG001
-            page_url: str,  # noqa: ARG001
-            drive_id: str,  # noqa: ARG001
-            start: datetime | None = None,  # noqa: ARG001
-            end: datetime | None = None,  # noqa: ARG001
-            page_size: int = 200,  # noqa: ARG001
-        ) -> tuple[list[DriveItemData], str | None]:
-            return [_make_item("a")], None
-
-        monkeypatch.setattr(
-            SharepointConnector, "_fetch_one_delta_page", fake_fetch_page
-        )
-
-        # First run
-        cp1 = _build_ready_checkpoint()
-        gen = connector._load_from_checkpoint(
-            _START_TS, _END_TS, cp1, include_permissions=False
-        )
-        yielded, _ = _consume_generator(gen)
-        assert len(_docs_from(yielded)) == 1
-
-        # Second run with a fresh checkpoint — same doc should appear again
-        cp2 = _build_ready_checkpoint()
-        assert len(cp2.seen_document_ids) == 0
-        gen = connector._load_from_checkpoint(
-            _START_TS, _END_TS, cp2, include_permissions=False
-        )
-        yielded, _ = _consume_generator(gen)
-        assert len(_docs_from(yielded)) == 1
-
-    def test_same_id_across_drives_not_skipped(
-        self, monkeypatch: pytest.MonkeyPatch
-    ) -> None:
-        """Graph item IDs are only unique within a drive.  An item in drive B
-        that happens to share an ID with an item already seen in drive A must
-        NOT be skipped."""
-        connector = _setup_connector(monkeypatch)
-        _mock_convert(monkeypatch)
-
-        def fake_fetch_page(
-            self: SharepointConnector,  # noqa: ARG001
-            page_url: str,  # noqa: ARG001
-            drive_id: str,  # noqa: ARG001
-            start: datetime | None = None,  # noqa: ARG001
-            end: datetime | None = None,  # noqa: ARG001
-            page_size: int = 200,  # noqa: ARG001
-        ) -> tuple[list[DriveItemData], str | None]:
-            return [_make_item("shared-id")], None
-
-        monkeypatch.setattr(
-            SharepointConnector, "_fetch_one_delta_page", fake_fetch_page
-        )
-
-        checkpoint = _build_ready_checkpoint(drive_names=["DriveA", "DriveB"])
-
-        # Drive A: yields the item
-        gen = connector._load_from_checkpoint(
-            _START_TS, _END_TS, checkpoint, include_permissions=False
-        )
-        yielded, checkpoint = _consume_generator(gen)
-        docs = _docs_from(yielded)
-        assert len(docs) == 1
-        assert docs[0].id == "shared-id"
-
-        # seen_document_ids should have been cleared when drive A finished
-        assert len(checkpoint.seen_document_ids) == 0
-
-        # Drive B: same ID must be yielded again (different drive)
-        gen = connector._load_from_checkpoint(
-            _START_TS, _END_TS, checkpoint, include_permissions=False
-        )
-        yielded, checkpoint = _consume_generator(gen)
-        docs = _docs_from(yielded)
-        assert len(docs) == 1
-        assert docs[0].id == "shared-id"

backend/tests/unit/onyx/db/test_llm_sync.py

@@ -7,7 +7,6 @@ import pytest
 
 from onyx.db.llm import sync_model_configurations
 from onyx.llm.constants import LlmProviderNames
-from onyx.server.manage.llm.models import SyncModelEntry
 
 
 class TestSyncModelConfigurations:
@@ -26,18 +25,18 @@ class TestSyncModelConfigurations:
             "onyx.db.llm.fetch_existing_llm_provider", return_value=mock_provider
         ):
             models = [
-                SyncModelEntry(
-                    name="gpt-4",
-                    display_name="GPT-4",
-                    max_input_tokens=128000,
-                    supports_image_input=True,
-                ),
-                SyncModelEntry(
-                    name="gpt-4o",
-                    display_name="GPT-4o",
-                    max_input_tokens=128000,
-                    supports_image_input=True,
-                ),
+                {
+                    "name": "gpt-4",
+                    "display_name": "GPT-4",
+                    "max_input_tokens": 128000,
+                    "supports_image_input": True,
+                },
+                {
+                    "name": "gpt-4o",
+                    "display_name": "GPT-4o",
+                    "max_input_tokens": 128000,
+                    "supports_image_input": True,
+                },
             ]
 
             result = sync_model_configurations(
@@ -68,18 +67,18 @@ class TestSyncModelConfigurations:
             "onyx.db.llm.fetch_existing_llm_provider", return_value=mock_provider
         ):
             models = [
-                SyncModelEntry(
-                    name="gpt-4",  # Existing - should be skipped
-                    display_name="GPT-4",
-                    max_input_tokens=128000,
-                    supports_image_input=True,
-                ),
-                SyncModelEntry(
-                    name="gpt-4o",  # New - should be inserted
-                    display_name="GPT-4o",
-                    max_input_tokens=128000,
-                    supports_image_input=True,
-                ),
+                {
+                    "name": "gpt-4",  # Existing - should be skipped
+                    "display_name": "GPT-4",
+                    "max_input_tokens": 128000,
+                    "supports_image_input": True,
+                },
+                {
+                    "name": "gpt-4o",  # New - should be inserted
+                    "display_name": "GPT-4o",
+                    "max_input_tokens": 128000,
+                    "supports_image_input": True,
+                },
             ]
 
             result = sync_model_configurations(
@@ -106,12 +105,12 @@ class TestSyncModelConfigurations:
             "onyx.db.llm.fetch_existing_llm_provider", return_value=mock_provider
         ):
             models = [
-                SyncModelEntry(
-                    name="gpt-4",  # Already exists
-                    display_name="GPT-4",
-                    max_input_tokens=128000,
-                    supports_image_input=True,
-                ),
+                {
+                    "name": "gpt-4",  # Already exists
+                    "display_name": "GPT-4",
+                    "max_input_tokens": 128000,
+                    "supports_image_input": True,
+                },
             ]
 
             result = sync_model_configurations(
@@ -132,7 +131,7 @@ class TestSyncModelConfigurations:
                 sync_model_configurations(
                     db_session=mock_session,
                     provider_name="nonexistent",
-                    models=[SyncModelEntry(name="model", display_name="Model")],
+                    models=[{"name": "model", "display_name": "Model"}],
                 )
 
     def test_handles_missing_optional_fields(self) -> None:
@@ -146,12 +145,12 @@ class TestSyncModelConfigurations:
         with patch(
             "onyx.db.llm.fetch_existing_llm_provider", return_value=mock_provider
         ):
-            # Model with only required fields (max_input_tokens and supports_image_input default)
+            # Model with only required fields
             models = [
-                SyncModelEntry(
-                    name="model-1",
-                    display_name="Model 1",
-                ),
+                {
+                    "name": "model-1",
+                    # No display_name, max_input_tokens, or supports_image_input
+                },
             ]
 
             result = sync_model_configurations(

backend/tests/unit/onyx/server/manage/llm/test_fetch_models_api.py

@@ -1,19 +1,15 @@
 """Tests for LLM model fetch endpoints.
 
 These tests verify the full request/response flow for fetching models
-from dynamic providers (Ollama, OpenRouter, Litellm), including the
+from dynamic providers (Ollama, OpenRouter), including the
 sync-to-DB behavior when provider_name is specified.
 """
 
 from unittest.mock import MagicMock
 from unittest.mock import patch
 
-import httpx
 import pytest
 
-from onyx.error_handling.exceptions import OnyxError
-from onyx.server.manage.llm.models import LitellmFinalModelResponse
-from onyx.server.manage.llm.models import LitellmModelsRequest
 from onyx.server.manage.llm.models import LMStudioFinalModelResponse
 from onyx.server.manage.llm.models import LMStudioModelsRequest
 from onyx.server.manage.llm.models import OllamaFinalModelResponse
@@ -618,283 +614,3 @@ class TestGetLMStudioAvailableModels:
             request = LMStudioModelsRequest(api_base="http://localhost:1234")
             with pytest.raises(OnyxError):
                 get_lm_studio_available_models(request, MagicMock(), mock_session)
-
-
-class TestGetLitellmAvailableModels:
-    """Tests for the Litellm proxy model fetch endpoint."""
-
-    @pytest.fixture
-    def mock_litellm_response(self) -> dict:
-        """Mock response from Litellm /v1/models endpoint."""
-        return {
-            "data": [
-                {
-                    "id": "gpt-4o",
-                    "object": "model",
-                    "created": 1700000000,
-                    "owned_by": "openai",
-                },
-                {
-                    "id": "claude-3-5-sonnet",
-                    "object": "model",
-                    "created": 1700000001,
-                    "owned_by": "anthropic",
-                },
-                {
-                    "id": "gemini-pro",
-                    "object": "model",
-                    "created": 1700000002,
-                    "owned_by": "google",
-                },
-            ]
-        }
-
-    def test_returns_model_list(self, mock_litellm_response: dict) -> None:
-        """Test that endpoint returns properly formatted model list."""
-        from onyx.server.manage.llm.api import get_litellm_available_models
-
-        mock_session = MagicMock()
-
-        with patch("onyx.server.manage.llm.api.httpx.get") as mock_get:
-            mock_response = MagicMock()
-            mock_response.json.return_value = mock_litellm_response
-            mock_response.raise_for_status = MagicMock()
-            mock_get.return_value = mock_response
-
-            request = LitellmModelsRequest(
-                api_base="http://localhost:4000",
-                api_key="test-key",
-            )
-            results = get_litellm_available_models(request, MagicMock(), mock_session)
-
-            assert len(results) == 3
-            assert all(isinstance(r, LitellmFinalModelResponse) for r in results)
-
-    def test_model_fields_parsed_correctly(self, mock_litellm_response: dict) -> None:
-        """Test that provider_name and model_name are correctly extracted."""
-        from onyx.server.manage.llm.api import get_litellm_available_models
-
-        mock_session = MagicMock()
-
-        with patch("onyx.server.manage.llm.api.httpx.get") as mock_get:
-            mock_response = MagicMock()
-            mock_response.json.return_value = mock_litellm_response
-            mock_response.raise_for_status = MagicMock()
-            mock_get.return_value = mock_response
-
-            request = LitellmModelsRequest(
-                api_base="http://localhost:4000",
-                api_key="test-key",
-            )
-            results = get_litellm_available_models(request, MagicMock(), mock_session)
-
-            gpt = next(r for r in results if r.model_name == "gpt-4o")
-            assert gpt.provider_name == "openai"
-
-            claude = next(r for r in results if r.model_name == "claude-3-5-sonnet")
-            assert claude.provider_name == "anthropic"
-
-    def test_results_sorted_by_model_name(self, mock_litellm_response: dict) -> None:
-        """Test that results are alphabetically sorted by model_name."""
-        from onyx.server.manage.llm.api import get_litellm_available_models
-
-        mock_session = MagicMock()
-
-        with patch("onyx.server.manage.llm.api.httpx.get") as mock_get:
-            mock_response = MagicMock()
-            mock_response.json.return_value = mock_litellm_response
-            mock_response.raise_for_status = MagicMock()
-            mock_get.return_value = mock_response
-
-            request = LitellmModelsRequest(
-                api_base="http://localhost:4000",
-                api_key="test-key",
-            )
-            results = get_litellm_available_models(request, MagicMock(), mock_session)
-
-            model_names = [r.model_name for r in results]
-            assert model_names == sorted(model_names, key=str.lower)
-
-    def test_empty_data_raises_onyx_error(self) -> None:
-        """Test that empty model list raises OnyxError."""
-        from onyx.server.manage.llm.api import get_litellm_available_models
-
-        mock_session = MagicMock()
-
-        with patch("onyx.server.manage.llm.api.httpx.get") as mock_get:
-            mock_response = MagicMock()
-            mock_response.json.return_value = {"data": []}
-            mock_response.raise_for_status = MagicMock()
-            mock_get.return_value = mock_response
-
-            request = LitellmModelsRequest(
-                api_base="http://localhost:4000",
-                api_key="test-key",
-            )
-            with pytest.raises(OnyxError, match="No models found"):
-                get_litellm_available_models(request, MagicMock(), mock_session)
-
-    def test_missing_data_key_raises_onyx_error(self) -> None:
-        """Test that response without 'data' key raises OnyxError."""
-        from onyx.server.manage.llm.api import get_litellm_available_models
-
-        mock_session = MagicMock()
-
-        with patch("onyx.server.manage.llm.api.httpx.get") as mock_get:
-            mock_response = MagicMock()
-            mock_response.json.return_value = {}
-            mock_response.raise_for_status = MagicMock()
-            mock_get.return_value = mock_response
-
-            request = LitellmModelsRequest(
-                api_base="http://localhost:4000",
-                api_key="test-key",
-            )
-            with pytest.raises(OnyxError):
-                get_litellm_available_models(request, MagicMock(), mock_session)
-
-    def test_skips_unparseable_entries(self) -> None:
-        """Test that malformed model entries are skipped without failing."""
-        from onyx.server.manage.llm.api import get_litellm_available_models
-
-        mock_session = MagicMock()
-        response_with_bad_entry = {
-            "data": [
-                {
-                    "id": "gpt-4o",
-                    "object": "model",
-                    "created": 1700000000,
-                    "owned_by": "openai",
-                },
-                # Missing required fields
-                {"bad_field": "bad_value"},
-            ]
-        }
-
-        with patch("onyx.server.manage.llm.api.httpx.get") as mock_get:
-            mock_response = MagicMock()
-            mock_response.json.return_value = response_with_bad_entry
-            mock_response.raise_for_status = MagicMock()
-            mock_get.return_value = mock_response
-
-            request = LitellmModelsRequest(
-                api_base="http://localhost:4000",
-                api_key="test-key",
-            )
-            results = get_litellm_available_models(request, MagicMock(), mock_session)
-
-            assert len(results) == 1
-            assert results[0].model_name == "gpt-4o"
-
-    def test_all_entries_unparseable_raises_onyx_error(self) -> None:
-        """Test that OnyxError is raised when all entries fail to parse."""
-        from onyx.server.manage.llm.api import get_litellm_available_models
-
-        mock_session = MagicMock()
-        response_all_bad = {
-            "data": [
-                {"bad_field": "bad_value"},
-                {"another_bad": 123},
-            ]
-        }
-
-        with patch("onyx.server.manage.llm.api.httpx.get") as mock_get:
-            mock_response = MagicMock()
-            mock_response.json.return_value = response_all_bad
-            mock_response.raise_for_status = MagicMock()
-            mock_get.return_value = mock_response
-
-            request = LitellmModelsRequest(
-                api_base="http://localhost:4000",
-                api_key="test-key",
-            )
-            with pytest.raises(OnyxError, match="No compatible models"):
-                get_litellm_available_models(request, MagicMock(), mock_session)
-
-    def test_api_base_trailing_slash_handled(self) -> None:
-        """Test that trailing slashes in api_base are handled correctly."""
-        from onyx.server.manage.llm.api import get_litellm_available_models
-
-        mock_session = MagicMock()
-        mock_litellm_response = {
-            "data": [
-                {
-                    "id": "gpt-4o",
-                    "object": "model",
-                    "created": 1700000000,
-                    "owned_by": "openai",
-                },
-            ]
-        }
-
-        with patch("onyx.server.manage.llm.api.httpx.get") as mock_get:
-            mock_response = MagicMock()
-            mock_response.json.return_value = mock_litellm_response
-            mock_response.raise_for_status = MagicMock()
-            mock_get.return_value = mock_response
-
-            request = LitellmModelsRequest(
-                api_base="http://localhost:4000/",
-                api_key="test-key",
-            )
-            get_litellm_available_models(request, MagicMock(), mock_session)
-
-            # Should call /v1/models without double slashes
-            call_args = mock_get.call_args
-            assert call_args[0][0] == "http://localhost:4000/v1/models"
-
-    def test_connection_failure_raises_onyx_error(self) -> None:
-        """Test that connection failures are wrapped in OnyxError."""
-        from onyx.server.manage.llm.api import get_litellm_available_models
-
-        mock_session = MagicMock()
-
-        with patch("onyx.server.manage.llm.api.httpx.get") as mock_get:
-            mock_get.side_effect = Exception("Connection refused")
-
-            request = LitellmModelsRequest(
-                api_base="http://localhost:4000",
-                api_key="test-key",
-            )
-            with pytest.raises(OnyxError, match="Failed to fetch LiteLLM models"):
-                get_litellm_available_models(request, MagicMock(), mock_session)
-
-    def test_401_raises_authentication_error(self) -> None:
-        """Test that a 401 response raises OnyxError with authentication message."""
-        from onyx.server.manage.llm.api import get_litellm_available_models
-
-        mock_session = MagicMock()
-
-        with patch("onyx.server.manage.llm.api.httpx.get") as mock_get:
-            mock_response = MagicMock()
-            mock_response.status_code = 401
-            mock_get.side_effect = httpx.HTTPStatusError(
-                "Unauthorized", request=MagicMock(), response=mock_response
-            )
-
-            request = LitellmModelsRequest(
-                api_base="http://localhost:4000",
-                api_key="bad-key",
-            )
-            with pytest.raises(OnyxError, match="Authentication failed"):
-                get_litellm_available_models(request, MagicMock(), mock_session)
-
-    def test_404_raises_not_found_error(self) -> None:
-        """Test that a 404 response raises OnyxError with endpoint not found message."""
-        from onyx.server.manage.llm.api import get_litellm_available_models
-
-        mock_session = MagicMock()
-
-        with patch("onyx.server.manage.llm.api.httpx.get") as mock_get:
-            mock_response = MagicMock()
-            mock_response.status_code = 404
-            mock_get.side_effect = httpx.HTTPStatusError(
-                "Not Found", request=MagicMock(), response=mock_response
-            )
-
-            request = LitellmModelsRequest(
-                api_base="http://localhost:4000",
-                api_key="test-key",
-            )
-            with pytest.raises(OnyxError, match="endpoint not found"):
-                get_litellm_available_models(request, MagicMock(), mock_session)

contributing_guides/dev_setup.md

@@ -158,14 +158,14 @@ python ./scripts/dev_run_background_jobs.py
 To run the backend API server, navigate back to `onyx/backend` and run:
 
 ```bash
-AUTH_TYPE=basic uvicorn onyx.main:app --reload --port 8080
+AUTH_TYPE=disabled uvicorn onyx.main:app --reload --port 8080
 ```
 
 _For Windows (for compatibility with both PowerShell and Command Prompt):_
 
 ```bash
 powershell -Command "
-    $env:AUTH_TYPE='basic'
+    $env:AUTH_TYPE='disabled'
     uvicorn onyx.main:app --reload --port 8080
 "
 ```

deployment/docker_compose/docker-compose.search-testing.yml

@@ -21,7 +21,7 @@ services:
     env_file:
       - .env_eval
     environment:
-      - AUTH_TYPE=basic
+      - AUTH_TYPE=disabled
       - POSTGRES_HOST=relational_db
       - VESPA_HOST=index
       - REDIS_HOST=cache
@@ -58,7 +58,7 @@ services:
     env_file:
       - .env_eval
     environment:
-      - AUTH_TYPE=basic
+      - AUTH_TYPE=disabled
       - POSTGRES_HOST=relational_db
       - VESPA_HOST=index
       - REDIS_HOST=cache

deployment/docker_compose/env.template

@@ -20,12 +20,8 @@ IMAGE_TAG=latest
 
 ## Auth Settings
 ### https://docs.onyx.app/deployment/authentication
-AUTH_TYPE=basic
+AUTH_TYPE=disabled
 # SESSION_EXPIRE_TIME_SECONDS=
-### Recommended for basic auth - used for signing password reset and verification tokens
-### If using install.sh, this will be auto-generated
-### If setting manually, run: openssl rand -hex 32
-USER_AUTH_SECRET=""
 ### Recommend to set this for security
 # ENCRYPTION_KEY_SECRET=
 ### Optional

deployment/docker_compose/install.sh

@@ -654,20 +654,17 @@ else
     sed -i.bak "s/^IMAGE_TAG=.*/IMAGE_TAG=$VERSION/" "$ENV_FILE"
     print_success "IMAGE_TAG set to $VERSION"
 
-    # Configure basic authentication (default)
-    sed -i.bak 's/^AUTH_TYPE=.*/AUTH_TYPE=basic/' "$ENV_FILE" 2>/dev/null || true
-    print_success "Basic authentication enabled in configuration"
-
-    # Check if openssl is available
-    if ! command -v openssl &> /dev/null; then
-        print_error "openssl is required to generate secure secrets but was not found."
-        exit 1
+    # Configure authentication settings based on selection
+    if [ "$AUTH_SCHEMA" = "disabled" ]; then
+        # Disable authentication in .env file
+        sed -i.bak 's/^AUTH_TYPE=.*/AUTH_TYPE=disabled/' "$ENV_FILE" 2>/dev/null || true
+        print_success "Authentication disabled in configuration"
+    else
+        # Enable basic authentication
+        sed -i.bak 's/^AUTH_TYPE=.*/AUTH_TYPE=basic/' "$ENV_FILE" 2>/dev/null || true
+        print_success "Basic authentication enabled in configuration"
     fi
 
-    # Generate a secure USER_AUTH_SECRET
-    USER_AUTH_SECRET=$(openssl rand -hex 32)
-    sed -i.bak "s/^USER_AUTH_SECRET=.*/USER_AUTH_SECRET=\"$USER_AUTH_SECRET\"/" "$ENV_FILE" 2>/dev/null || true
-
     # Configure Craft based on flag or if using a craft-* image tag
     # By default, env.template has Craft commented out (disabled)
     if [ "$INCLUDE_CRAFT" = true ] || [[ "$VERSION" == craft-* ]]; then

pyproject.toml

@@ -153,7 +153,7 @@ dev = [
     "pytest-repeat==0.9.4",
     "pytest-xdist==3.8.0",
     "pytest==8.3.5",
-    "release-tag==0.5.2",
+    "release-tag==0.4.3",
     "reorder-python-imports-black==3.14.0",
     "ruff==0.12.0",
     "types-beautifulsoup4==4.12.0.3",

uv.lock

@@ -4485,7 +4485,7 @@ requires-dist = [
     { name = "pywikibot", marker = "extra == 'backend'", specifier = "==9.0.0" },
     { name = "rapidfuzz", marker = "extra == 'backend'", specifier = "==3.13.0" },
     { name = "redis", marker = "extra == 'backend'", specifier = "==5.0.8" },
-    { name = "release-tag", marker = "extra == 'dev'", specifier = "==0.5.2" },
+    { name = "release-tag", marker = "extra == 'dev'", specifier = "==0.4.3" },
     { name = "reorder-python-imports-black", marker = "extra == 'dev'", specifier = "==3.14.0" },
     { name = "requests", marker = "extra == 'backend'", specifier = "==2.32.5" },
     { name = "requests-oauthlib", marker = "extra == 'backend'", specifier = "==1.3.1" },
@@ -6338,16 +6338,16 @@ wheels = [
 
 [[package]]
 name = "release-tag"
-version = "0.5.2"
+version = "0.4.3"
 source = { registry = "https://pypi.org/simple" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/ab/92/01192a540b29cfadaa23850c8f6a2041d541b83a3fa1dc52a5f55212b3b6/release_tag-0.5.2-py3-none-any.whl", hash = "sha256:1e9ca7618bcfc63ad7a0728c84bbad52ef82d07586c4cc11365b44ea8f588069", size = 1264752, upload-time = "2026-03-11T00:27:18.674Z" },
-    { url = "https://files.pythonhosted.org/packages/4f/77/81fb42a23cd0de61caf84266f7aac1950b1c324883788b7c48e5344f61ae/release_tag-0.5.2-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:8fbc61ff7bac2b96fab09566ec45c6508c201efc3f081f57702e1761bbc178d5", size = 1255075, upload-time = "2026-03-11T00:27:24.442Z" },
-    { url = "https://files.pythonhosted.org/packages/98/e6/769f8be94304529c1a531e995f2f3ac83f3c54738ce488b0abde75b20851/release_tag-0.5.2-py3-none-macosx_11_0_arm64.whl", hash = "sha256:fa3d7e495a0c516858a81878d03803539712677a3d6e015503de21cce19bea5e", size = 1163627, upload-time = "2026-03-11T00:27:26.412Z" },
-    { url = "https://files.pythonhosted.org/packages/45/68/7543e9daa0dfd41c487bf140d91fd5879327bb7c001a96aa5264667c30a1/release_tag-0.5.2-py3-none-manylinux_2_17_aarch64.whl", hash = "sha256:e8b60453218d6926da1fdcb99c2e17c851be0d7ab1975e97951f0bff5f32b565", size = 1140133, upload-time = "2026-03-11T00:27:20.633Z" },
-    { url = "https://files.pythonhosted.org/packages/6a/30/9087825696271012d889d136310dbdf0811976ae2b2f5a490f4e437903e1/release_tag-0.5.2-py3-none-manylinux_2_17_x86_64.whl", hash = "sha256:0e302ed60c2bf8b7ba5634842be28a27d83cec995869e112b0348b3f01a84ff5", size = 1264767, upload-time = "2026-03-11T00:27:28.355Z" },
-    { url = "https://files.pythonhosted.org/packages/79/a3/5b51b0cbdbf2299f545124beab182cfdfe01bf5b615efbc94aee3a64ea67/release_tag-0.5.2-py3-none-win_amd64.whl", hash = "sha256:e3c0629d373a16b9a3da965e89fca893640ce9878ec548865df3609b70989a89", size = 1340816, upload-time = "2026-03-11T00:27:22.622Z" },
-    { url = "https://files.pythonhosted.org/packages/dd/6f/832c2023a8bd8414c93452bd8b43bf61cedfa5b9575f70c06fb911e51a29/release_tag-0.5.2-py3-none-win_arm64.whl", hash = "sha256:5f26b008e0be0c7a122acd8fcb1bb5c822f38e77fed0c0bf6c550cc226c6bf14", size = 1203191, upload-time = "2026-03-11T00:27:29.789Z" },
+    { url = "https://files.pythonhosted.org/packages/39/18/c1d17d973f73f0aa7e2c45f852839ab909756e1bd9727d03babe400fcef0/release_tag-0.4.3-py3-none-any.whl", hash = "sha256:4206f4fa97df930c8176bfee4d3976a7385150ed14b317bd6bae7101ac8b66dd", size = 1181112, upload-time = "2025-12-03T00:18:19.445Z" },
+    { url = "https://files.pythonhosted.org/packages/33/c7/ecc443953840ac313856b2181f55eb8d34fa2c733cdd1edd0bcceee0938d/release_tag-0.4.3-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:7a347a9ad3d2af16e5367e52b451fbc88a0b7b666850758e8f9a601554a8fb13", size = 1170517, upload-time = "2025-12-03T00:18:11.663Z" },
+    { url = "https://files.pythonhosted.org/packages/ce/81/2f6ffa0d87c792364ca9958433fe088c8acc3d096ac9734040049c6ad506/release_tag-0.4.3-py3-none-macosx_11_0_arm64.whl", hash = "sha256:2d1603aa37d8e4f5df63676bbfddc802fbc108a744ba28288ad25c997981c164", size = 1101663, upload-time = "2025-12-03T00:18:15.173Z" },
+    { url = "https://files.pythonhosted.org/packages/7c/ed/9e4ebe400fc52e38dda6e6a45d9da9decd4535ab15e170b8d9b229a66730/release_tag-0.4.3-py3-none-manylinux_2_17_aarch64.whl", hash = "sha256:6db7b81a198e3ba6a87496a554684912c13f9297ea8db8600a80f4f971709d37", size = 1079322, upload-time = "2025-12-03T00:18:16.094Z" },
+    { url = "https://files.pythonhosted.org/packages/2a/64/9e0ce6119e091ef9211fa82b9593f564eeec8bdd86eff6a97fe6e2fcb20f/release_tag-0.4.3-py3-none-manylinux_2_17_x86_64.whl", hash = "sha256:d79a9cf191dd2c29e1b3a35453fa364b08a7aadd15aeb2c556a7661c6cf4d5ad", size = 1181129, upload-time = "2025-12-03T00:18:15.82Z" },
+    { url = "https://files.pythonhosted.org/packages/b8/09/d96acf18f0773b6355080a568ba48931faa9dbe91ab1abefc6f8c4df04a8/release_tag-0.4.3-py3-none-win_amd64.whl", hash = "sha256:3958b880375f2241d0cc2b9882363bf54b1d4d7ca8ffc6eecc63ab92f23307f0", size = 1260773, upload-time = "2025-12-03T00:18:14.723Z" },
+    { url = "https://files.pythonhosted.org/packages/51/da/ecb6346df1ffb0752fe213e25062f802c10df2948717f0d5f9816c2df914/release_tag-0.4.3-py3-none-win_arm64.whl", hash = "sha256:7d5b08000e6e398d46f05a50139031046348fba6d47909f01e468bb7600c19df", size = 1142155, upload-time = "2025-12-03T00:18:20.647Z" },
 ]
 
 [[package]]

web/jest.config.js

@@ -144,7 +144,6 @@ module.exports = {
         "**/src/app/**/hooks/*.test.ts", // Pure packet processor tests
         "**/src/refresh-components/**/*.test.ts",
         "**/src/sections/**/*.test.ts",
-        "**/src/components/**/*.test.ts",
         // Add more patterns here as you add more unit tests
       ],
     },

web/lib/opal/src/components/buttons/OpenButton/OpenButton.stories.tsx

@@ -1,6 +1,5 @@
 import type { Meta, StoryObj } from "@storybook/react";
 import { OpenButton } from "@opal/components";
-import { Disabled as DisabledProvider } from "@opal/core";
 import { SvgSettings } from "@opal/icons";
 import * as TooltipPrimitive from "@radix-ui/react-tooltip";
 
@@ -33,9 +32,16 @@ export const WithIcon: Story = {
   },
 };
 
+export const Selected: Story = {
+  args: {
+    selected: true,
+    children: "Selected",
+  },
+};
+
 export const Open: Story = {
   args: {
-    interaction: "hover",
+    transient: true,
     children: "Open state",
   },
 };
@@ -47,27 +53,18 @@ export const Disabled: Story = {
   },
 };
 
-export const Foldable: Story = {
+export const LightProminence: Story = {
   args: {
-    foldable: true,
-    icon: SvgSettings,
-    children: "Settings",
+    prominence: "light",
+    children: "Light prominence",
   },
 };
 
-export const FoldableDisabled: Story = {
+export const HeavyProminence: Story = {
   args: {
-    foldable: true,
-    icon: SvgSettings,
-    children: "Settings",
+    prominence: "heavy",
+    children: "Heavy prominence",
   },
-  decorators: [
-    (Story) => (
-      <DisabledProvider disabled>
-        <Story />
-      </DisabledProvider>
-    ),
-  ],
 };
 
 export const Sizes: Story = {
@@ -81,12 +78,3 @@ export const Sizes: Story = {
     </div>
   ),
 };
-
-export const WithTooltip: Story = {
-  args: {
-    icon: SvgSettings,
-    children: "Settings",
-    tooltip: "Open settings",
-    tooltipSide: "bottom",
-  },
-};

web/lib/opal/src/components/buttons/open-button/README.md

@@ -17,9 +17,7 @@ OpenButton is a **tighter, specialized use-case** of SelectButton:
 - It hardcodes `variant="select-heavy"` (SelectButton exposes `variant`)
 - It adds a built-in chevron with CSS-driven rotation (SelectButton has no chevron)
 - It auto-detects Radix `data-state="open"` to derive `interaction` (SelectButton has no Radix awareness)
-- It does not support `rightIcon` (SelectButton does)
-
-Both components support `foldable` using the same pattern: `interactive-foldable-host` class + `Interactive.Foldable` wrapper around the label and trailing icon. When foldable, the left icon stays visible while the rest collapses. If you change the foldable implementation in one, update the other to match.
+- It does not support `foldable` or `rightIcon` (SelectButton does)
 
 If you need a general-purpose stateful toggle, use `SelectButton`. If you need a popover/dropdown trigger with a chevron, use `OpenButton`.
 
@@ -28,12 +26,10 @@ If you need a general-purpose stateful toggle, use `SelectButton`. If you need a
 ```
 Interactive.Stateful           <- variant="select-heavy", interaction, state, disabled, onClick
   └─ Interactive.Container     <- height, rounding, padding (from `size`)
-       └─ div.opal-button.interactive-foreground [.interactive-foldable-host]
+       └─ div.opal-button.interactive-foreground
             ├─ div > Icon?                 (interactive-foreground-icon)
-            ├─ [Foldable]?                 (wraps label + chevron when foldable)
-            │    ├─ <span>?                .opal-button-label
-            │    └─ div > ChevronIcon      .opal-open-button-chevron
-            └─ <span>? / ChevronIcon       (non-foldable)
+            ├─ <span>?                     .opal-button-label
+            └─ div > ChevronIcon           .opal-open-button-chevron (interactive-foreground-icon)
 ```
 
 - **`interaction` controls both the chevron and the hover visual state.** When `interaction` is `"hover"` (explicitly or via Radix `data-state="open"`), the chevron rotates 180° and the hover background activates.
@@ -48,7 +44,6 @@ Interactive.Stateful           <- variant="select-heavy", interaction, state, di
 | `interaction` | `"rest" \| "hover" \| "active"` | auto | JS-controlled interaction override. Falls back to Radix `data-state="open"` when omitted. |
 | `icon` | `IconFunctionComponent` | — | Left icon component |
 | `children` | `string` | — | Content between icon and chevron |
-| `foldable` | `boolean` | `false` | When `true`, requires both `icon` and `children`; the left icon stays visible while the label + chevron collapse when not hovered. If `tooltip` is omitted on a disabled foldable button, the label text is used as the tooltip. |
 | `size` | `SizeVariant` | `"lg"` | Size preset controlling height, rounding, and padding |
 | `width` | `WidthVariant` | — | Width preset |
 | `tooltip` | `string` | — | Tooltip text shown on hover |

web/lib/opal/src/components/buttons/open-button/components.tsx

@@ -2,7 +2,6 @@ import "@opal/components/buttons/open-button/styles.css";
 import "@opal/components/tooltip.css";
 import {
   Interactive,
-  useDisabled,
   type InteractiveStatefulProps,
   type InteractiveStatefulInteraction,
 } from "@opal/core";
@@ -31,46 +30,27 @@ function ChevronIcon({ className, ...props }: IconProps) {
 // Types
 // ---------------------------------------------------------------------------
 
-/**
- * Content props — a discriminated union on `foldable` that enforces:
- *
- * - `foldable: true`  → `icon` and `children` are required (icon stays visible,
- *                        label + chevron fold away)
- * - `foldable?: false` → at least one of `icon` or `children` must be provided
- */
-type OpenButtonContentProps =
-  | {
-      foldable: true;
-      icon: IconFunctionComponent;
-      children: string;
-    }
-  | {
-      foldable?: false;
-      icon?: IconFunctionComponent;
-      children: string;
-    }
-  | {
-      foldable?: false;
-      icon: IconFunctionComponent;
-      children?: string;
-    };
+type OpenButtonProps = Omit<InteractiveStatefulProps, "variant"> & {
+  /** Left icon. */
+  icon?: IconFunctionComponent;
 
-type OpenButtonProps = Omit<InteractiveStatefulProps, "variant"> &
-  OpenButtonContentProps & {
-    /**
-     * Size preset — controls gap, text size, and Container height/rounding.
-     */
-    size?: SizeVariant;
+  /** Button label text. */
+  children?: string;
 
-    /** Width preset. */
-    width?: WidthVariant;
+  /**
+   * Size preset — controls gap, text size, and Container height/rounding.
+   */
+  size?: SizeVariant;
 
-    /** Tooltip text shown on hover. */
-    tooltip?: string;
+  /** Width preset. */
+  width?: WidthVariant;
 
-    /** Which side the tooltip appears on. */
-    tooltipSide?: TooltipSide;
-  };
+  /** Tooltip text shown on hover. */
+  tooltip?: string;
+
+  /** Which side the tooltip appears on. */
+  tooltipSide?: TooltipSide;
+};
 
 // ---------------------------------------------------------------------------
 // OpenButton
@@ -80,15 +60,12 @@ function OpenButton({
   icon: Icon,
   children,
   size = "lg",
-  foldable,
   width,
   tooltip,
   tooltipSide = "top",
   interaction,
   ...statefulProps
 }: OpenButtonProps) {
-  const { isDisabled } = useDisabled();
-
   // Derive open state: explicit prop → Radix data-state (injected via Slot chain)
   const dataState = (statefulProps as Record<string, unknown>)["data-state"] as
     | string
@@ -98,17 +75,6 @@ function OpenButton({
 
   const isLarge = size === "lg";
 
-  const labelEl = children ? (
-    <span
-      className={cn(
-        "opal-button-label whitespace-nowrap",
-        isLarge ? "font-main-ui-body" : "font-secondary-body"
-      )}
-    >
-      {children}
-    </span>
-  ) : null;
-
   const button = (
     <Interactive.Stateful
       variant="select-heavy"
@@ -123,34 +89,25 @@ function OpenButton({
           isLarge ? "default" : size === "2xs" ? "mini" : "compact"
         }
       >
-        <div
-          className={cn(
-            "opal-button interactive-foreground flex flex-row items-center gap-1",
-            foldable && "interactive-foldable-host"
-          )}
-        >
-          {iconWrapper(Icon, size, !foldable && !!children)}
-
-          {foldable ? (
-            <Interactive.Foldable>
-              {labelEl}
-              {iconWrapper(ChevronIcon, size, !!children)}
-            </Interactive.Foldable>
-          ) : (
-            <>
-              {labelEl}
-              {iconWrapper(ChevronIcon, size, !!children)}
-            </>
+        <div className="opal-button interactive-foreground flex flex-row items-center gap-1">
+          {iconWrapper(Icon, size, false)}
+          {children && (
+            <span
+              className={cn(
+                "opal-button-label whitespace-nowrap",
+                isLarge ? "font-main-ui-body" : "font-secondary-body"
+              )}
+            >
+              {children}
+            </span>
           )}
+          {iconWrapper(ChevronIcon, size, false)}
         </div>
       </Interactive.Container>
     </Interactive.Stateful>
   );
 
-  const resolvedTooltip =
-    tooltip ?? (foldable && isDisabled && children ? children : undefined);
-
-  if (!resolvedTooltip) return button;
+  if (!tooltip) return button;
 
   return (
     <TooltipPrimitive.Root>
@@ -161,7 +118,7 @@ function OpenButton({
           side={tooltipSide}
           sideOffset={4}
         >
-          {resolvedTooltip}
+          {tooltip}
         </TooltipPrimitive.Content>
       </TooltipPrimitive.Portal>
     </TooltipPrimitive.Root>

web/lib/opal/src/components/buttons/select-button/README.md

@@ -17,9 +17,7 @@ Interactive.Stateful → Interactive.Container → content row (icon + label + t
 - OpenButton hardcodes `variant="select-heavy"` (SelectButton exposes `variant`)
 - OpenButton adds a built-in chevron with CSS-driven rotation (SelectButton has no chevron)
 - OpenButton auto-detects Radix `data-state="open"` to derive `interaction` (SelectButton has no Radix awareness)
-- OpenButton does not support `rightIcon` (SelectButton does)
-
-Both components support `foldable` using the same pattern: `interactive-foldable-host` class + `Interactive.Foldable` wrapper around the label and trailing icon. When foldable, the left icon stays visible while the rest collapses. If you change the foldable implementation in one, update the other to match.
+- OpenButton does not support `foldable` or `rightIcon` (SelectButton does)
 
 Use SelectButton for general-purpose stateful toggles. Use `OpenButton` for popover/dropdown triggers with a chevron.
 

web/lib/opal/src/core/interactive/Interactive.stories.tsx

@@ -1,5 +1,5 @@
 import type { Meta, StoryObj } from "@storybook/react";
-import { Interactive, Disabled } from "@opal/core";
+import { Interactive } from "@opal/core";
 
 // ---------------------------------------------------------------------------
 // Variant / Prominence mappings for the matrix story
@@ -9,6 +9,8 @@ const VARIANT_PROMINENCE_MAP: Record<string, string[]> = {
   default: ["primary", "secondary", "tertiary", "internal"],
   action: ["primary", "secondary", "tertiary", "internal"],
   danger: ["primary", "secondary", "tertiary", "internal"],
+  select: ["light", "heavy"],
+  sidebar: ["light"],
   none: [],
 };
 
@@ -33,39 +35,39 @@ export default meta;
 // Stories
 // ---------------------------------------------------------------------------
 
-/** Basic Interactive.Stateless + Container with text content. */
+/** Basic Interactive.Base + Container with text content. */
 export const Default: StoryObj = {
   render: () => (
     <div style={{ display: "flex", gap: "0.75rem", alignItems: "center" }}>
-      <Interactive.Stateless
+      <Interactive.Base
         variant="default"
         prominence="secondary"
         onClick={() => {}}
       >
         <Interactive.Container border>
-          <span className="interactive-foreground">Secondary</span>
+          <span>Secondary</span>
         </Interactive.Container>
-      </Interactive.Stateless>
+      </Interactive.Base>
 
-      <Interactive.Stateless
+      <Interactive.Base
         variant="default"
         prominence="primary"
         onClick={() => {}}
       >
         <Interactive.Container border>
-          <span className="interactive-foreground">Primary</span>
+          <span>Primary</span>
         </Interactive.Container>
-      </Interactive.Stateless>
+      </Interactive.Base>
 
-      <Interactive.Stateless
+      <Interactive.Base
         variant="default"
         prominence="tertiary"
         onClick={() => {}}
       >
         <Interactive.Container border>
-          <span className="interactive-foreground">Tertiary</span>
+          <span>Tertiary</span>
         </Interactive.Container>
-      </Interactive.Stateless>
+      </Interactive.Base>
     </div>
   ),
 };
@@ -89,13 +91,11 @@ export const VariantMatrix: StoryObj = {
           </div>
 
           {prominences.length === 0 ? (
-            <Interactive.Stateless variant="none" onClick={() => {}}>
+            <Interactive.Base variant="none" onClick={() => {}}>
               <Interactive.Container border>
-                <span style={{ color: "var(--text-01)" }}>
-                  none (no prominence)
-                </span>
+                <span>none (no prominence)</span>
               </Interactive.Container>
-            </Interactive.Stateless>
+            </Interactive.Base>
           ) : (
             <div style={{ display: "flex", gap: "0.5rem", flexWrap: "wrap" }}>
               {prominences.map((prominence) => (
@@ -108,18 +108,16 @@ export const VariantMatrix: StoryObj = {
                     gap: "0.25rem",
                   }}
                 >
-                  <Interactive.Stateless
+                  <Interactive.Base
                     // Cast required because the discriminated union can't be
                     // resolved from dynamic strings at the type level.
                     {...({ variant, prominence } as any)}
                     onClick={() => {}}
                   >
                     <Interactive.Container border>
-                      <span className="interactive-foreground">
-                        {prominence}
-                      </span>
+                      <span>{prominence}</span>
                     </Interactive.Container>
-                  </Interactive.Stateless>
+                  </Interactive.Base>
                   <span
                     style={{
                       fontSize: "0.625rem",
@@ -143,16 +141,16 @@ export const Sizes: StoryObj = {
   render: () => (
     <div style={{ display: "flex", alignItems: "center", gap: "0.75rem" }}>
       {SIZE_VARIANTS.map((size) => (
-        <Interactive.Stateless
+        <Interactive.Base
           key={size}
           variant="default"
           prominence="secondary"
           onClick={() => {}}
         >
           <Interactive.Container border heightVariant={size}>
-            <span className="interactive-foreground">{size}</span>
+            <span>{size}</span>
           </Interactive.Container>
-        </Interactive.Stateless>
+        </Interactive.Base>
       ))}
     </div>
   ),
@@ -162,15 +160,15 @@ export const Sizes: StoryObj = {
 export const WidthFull: StoryObj = {
   render: () => (
     <div style={{ width: 400 }}>
-      <Interactive.Stateless
+      <Interactive.Base
         variant="default"
         prominence="secondary"
         onClick={() => {}}
       >
         <Interactive.Container border widthVariant="full">
-          <span className="interactive-foreground">Full width container</span>
+          <span>Full width container</span>
         </Interactive.Container>
-      </Interactive.Stateless>
+      </Interactive.Base>
     </div>
   ),
 };
@@ -180,86 +178,73 @@ export const Rounding: StoryObj = {
   render: () => (
     <div style={{ display: "flex", gap: "0.75rem" }}>
       {ROUNDING_VARIANTS.map((rounding) => (
-        <Interactive.Stateless
+        <Interactive.Base
           key={rounding}
           variant="default"
           prominence="secondary"
           onClick={() => {}}
         >
           <Interactive.Container border roundingVariant={rounding}>
-            <span className="interactive-foreground">{rounding}</span>
+            <span>{rounding}</span>
           </Interactive.Container>
-        </Interactive.Stateless>
+        </Interactive.Base>
       ))}
     </div>
   ),
 };
 
 /** Disabled state prevents clicks and shows disabled styling. */
-export const DisabledStory: StoryObj = {
-  name: "Disabled",
+export const Disabled: StoryObj = {
   render: () => (
     <div style={{ display: "flex", gap: "0.75rem" }}>
-      <Disabled disabled>
-        <Interactive.Stateless
-          variant="default"
-          prominence="secondary"
-          onClick={() => {}}
-        >
-          <Interactive.Container border>
-            <span className="interactive-foreground">Disabled</span>
-          </Interactive.Container>
-        </Interactive.Stateless>
-      </Disabled>
+      <Interactive.Base
+        variant="default"
+        prominence="secondary"
+        onClick={() => {}}
+        disabled
+      >
+        <Interactive.Container border>
+          <span>Disabled</span>
+        </Interactive.Container>
+      </Interactive.Base>
 
-      <Interactive.Stateless
+      <Interactive.Base
         variant="default"
         prominence="secondary"
         onClick={() => {}}
       >
         <Interactive.Container border>
-          <span className="interactive-foreground">Enabled</span>
+          <span>Enabled</span>
         </Interactive.Container>
-      </Interactive.Stateless>
+      </Interactive.Base>
     </div>
   ),
 };
 
-/** Interaction override forces the hover/active visual state. */
-export const Interaction: StoryObj = {
+/** Transient prop forces the hover/active visual state. */
+export const Transient: StoryObj = {
   render: () => (
     <div style={{ display: "flex", gap: "0.75rem" }}>
-      <Interactive.Stateless
+      <Interactive.Base
         variant="default"
         prominence="secondary"
-        interaction="hover"
         onClick={() => {}}
+        transient
       >
         <Interactive.Container border>
-          <span className="interactive-foreground">Forced hover</span>
+          <span>Forced hover</span>
         </Interactive.Container>
-      </Interactive.Stateless>
+      </Interactive.Base>
 
-      <Interactive.Stateless
-        variant="default"
-        prominence="secondary"
-        interaction="active"
-        onClick={() => {}}
-      >
-        <Interactive.Container border>
-          <span className="interactive-foreground">Forced active</span>
-        </Interactive.Container>
-      </Interactive.Stateless>
-
-      <Interactive.Stateless
+      <Interactive.Base
         variant="default"
         prominence="secondary"
         onClick={() => {}}
       >
         <Interactive.Container border>
-          <span className="interactive-foreground">Normal (rest)</span>
+          <span>Normal</span>
         </Interactive.Container>
-      </Interactive.Stateless>
+      </Interactive.Base>
     </div>
   ),
 };
@@ -268,25 +253,25 @@ export const Interaction: StoryObj = {
 export const WithBorder: StoryObj = {
   render: () => (
     <div style={{ display: "flex", gap: "0.75rem" }}>
-      <Interactive.Stateless
+      <Interactive.Base
         variant="default"
         prominence="secondary"
         onClick={() => {}}
       >
         <Interactive.Container border>
-          <span className="interactive-foreground">With border</span>
+          <span>With border</span>
         </Interactive.Container>
-      </Interactive.Stateless>
+      </Interactive.Base>
 
-      <Interactive.Stateless
+      <Interactive.Base
         variant="default"
         prominence="secondary"
         onClick={() => {}}
       >
         <Interactive.Container>
-          <span className="interactive-foreground">Without border</span>
+          <span>Without border</span>
         </Interactive.Container>
-      </Interactive.Stateless>
+      </Interactive.Base>
     </div>
   ),
 };
@@ -294,57 +279,51 @@ export const WithBorder: StoryObj = {
 /** Using href to render as a link. */
 export const AsLink: StoryObj = {
   render: () => (
-    <Interactive.Stateless variant="action" href="/settings">
+    <Interactive.Base variant="action" href="/settings">
       <Interactive.Container border>
-        <span className="interactive-foreground">Go to Settings</span>
+        <span>Go to Settings</span>
       </Interactive.Container>
-    </Interactive.Stateless>
+    </Interactive.Base>
   ),
 };
 
-/** Stateful select variant with selected and unselected states. */
+/** Select variant with selected and unselected states. */
 export const SelectVariant: StoryObj = {
   render: () => (
     <div style={{ display: "flex", gap: "0.75rem" }}>
-      <Interactive.Stateful
-        variant="select-light"
-        state="selected"
+      <Interactive.Base
+        variant="select"
+        prominence="light"
+        selected
         onClick={() => {}}
       >
         <Interactive.Container border>
-          <span className="interactive-foreground">Selected (light)</span>
+          <span>Selected (light)</span>
         </Interactive.Container>
-      </Interactive.Stateful>
+      </Interactive.Base>
 
-      <Interactive.Stateful
-        variant="select-light"
-        state="empty"
-        onClick={() => {}}
-      >
+      <Interactive.Base variant="select" prominence="light" onClick={() => {}}>
         <Interactive.Container border>
-          <span className="interactive-foreground">Unselected (light)</span>
+          <span>Unselected (light)</span>
         </Interactive.Container>
-      </Interactive.Stateful>
+      </Interactive.Base>
 
-      <Interactive.Stateful
-        variant="select-heavy"
-        state="selected"
+      <Interactive.Base
+        variant="select"
+        prominence="heavy"
+        selected
         onClick={() => {}}
       >
         <Interactive.Container border>
-          <span className="interactive-foreground">Selected (heavy)</span>
+          <span>Selected (heavy)</span>
         </Interactive.Container>
-      </Interactive.Stateful>
+      </Interactive.Base>
 
-      <Interactive.Stateful
-        variant="select-heavy"
-        state="empty"
-        onClick={() => {}}
-      >
+      <Interactive.Base variant="select" prominence="heavy" onClick={() => {}}>
         <Interactive.Container border>
-          <span className="interactive-foreground">Unselected (heavy)</span>
+          <span>Unselected (heavy)</span>
         </Interactive.Container>
-      </Interactive.Stateful>
+      </Interactive.Base>
     </div>
   ),
 };

web/lib/opal/src/icons/index.ts

@@ -89,7 +89,7 @@ export { default as SvgHistory } from "@opal/icons/history";
 export { default as SvgHourglass } from "@opal/icons/hourglass";
 export { default as SvgImage } from "@opal/icons/image";
 export { default as SvgImageSmall } from "@opal/icons/image-small";
-export { default as SvgImport } from "@opal/icons/import-icon";
+export { default as SvgImport } from "@opal/icons/import";
 export { default as SvgInfo } from "@opal/icons/info";
 export { default as SvgInfoSmall } from "@opal/icons/info-small";
 export { default as SvgKey } from "@opal/icons/key";

web/src/app/admin/configuration/llm/utils.ts

@@ -14,7 +14,6 @@ import {
   QwenIcon,
   OllamaIcon,
   LMStudioIcon,
-  LiteLLMIcon,
   ZAIIcon,
 } from "@/components/icons/icons";
 import {
@@ -22,14 +21,12 @@ import {
   OpenRouterModelResponse,
   BedrockModelResponse,
   LMStudioModelResponse,
-  LiteLLMProxyModelResponse,
   ModelConfiguration,
   LLMProviderName,
   BedrockFetchParams,
   OllamaFetchParams,
   LMStudioFetchParams,
   OpenRouterFetchParams,
-  LiteLLMProxyFetchParams,
 } from "@/interfaces/llm";
 import { SvgAws, SvgOpenrouter } from "@opal/icons";
 
@@ -40,7 +37,6 @@ export const AGGREGATOR_PROVIDERS = new Set([
   "openrouter",
   "ollama_chat",
   "lm_studio",
-  "litellm_proxy",
   "vertex_ai",
 ]);
 
@@ -77,7 +73,6 @@ export const getProviderIcon = (
     bedrock: SvgAws,
     bedrock_converse: SvgAws,
     openrouter: SvgOpenrouter,
-    litellm_proxy: LiteLLMIcon,
     vertex_ai: GeminiIcon,
   };
 
@@ -343,65 +338,6 @@ export const fetchLMStudioModels = async (
   }
 };
 
-/**
- * Fetches LiteLLM Proxy models directly without any form state dependencies.
- * Uses snake_case params to match API structure.
- */
-export const fetchLiteLLMProxyModels = async (
-  params: LiteLLMProxyFetchParams
-): Promise<{ models: ModelConfiguration[]; error?: string }> => {
-  const apiBase = params.api_base;
-  const apiKey = params.api_key;
-  if (!apiBase) {
-    return { models: [], error: "API Base is required" };
-  }
-  if (!apiKey) {
-    return { models: [], error: "API Key is required" };
-  }
-
-  try {
-    const response = await fetch("/api/admin/llm/litellm/available-models", {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-      },
-      body: JSON.stringify({
-        api_base: apiBase,
-        api_key: apiKey,
-        provider_name: params.provider_name,
-      }),
-      signal: params.signal,
-    });
-
-    if (!response.ok) {
-      let errorMessage = "Failed to fetch models";
-      try {
-        const errorData = await response.json();
-        errorMessage = errorData.detail || errorData.message || errorMessage;
-      } catch {
-        // ignore JSON parsing errors
-      }
-      return { models: [], error: errorMessage };
-    }
-
-    const data: LiteLLMProxyModelResponse[] = await response.json();
-    const models: ModelConfiguration[] = data.map((modelData) => ({
-      name: modelData.model_name,
-      display_name: modelData.model_name,
-      is_visible: true,
-      max_input_tokens: null,
-      supports_image_input: false,
-      supports_reasoning: false,
-    }));
-
-    return { models };
-  } catch (error) {
-    const errorMessage =
-      error instanceof Error ? error.message : "Unknown error";
-    return { models: [], error: errorMessage };
-  }
-};
-
 /**
  * Fetches models for a provider. Accepts form values directly and maps them
  * to the expected fetch params format internally.
@@ -449,13 +385,6 @@ export const fetchModels = async (
         api_key: formValues.api_key,
         provider_name: formValues.name,
       });
-    case LLMProviderName.LITELLM_PROXY:
-      return fetchLiteLLMProxyModels({
-        api_base: formValues.api_base,
-        api_key: formValues.api_key,
-        provider_name: formValues.name,
-        signal,
-      });
     default:
       return { models: [], error: `Unknown provider: ${providerName}` };
   }
@@ -468,7 +397,6 @@ export function canProviderFetchModels(providerName?: string) {
     case LLMProviderName.OLLAMA_CHAT:
     case LLMProviderName.LM_STUDIO:
     case LLMProviderName.OPENROUTER:
-    case LLMProviderName.LITELLM_PROXY:
       return true;
     default:
       return false;

web/src/app/app/message/CodeBlock.tsx

@@ -8,7 +8,6 @@ interface CodeBlockProps {
   children?: ReactNode;
   codeText: string;
   showHeader?: boolean;
-  noPadding?: boolean;
 }
 
 const MemoizedCodeLine = memo(({ content }: { content: ReactNode }) => (
@@ -20,7 +19,6 @@ export const CodeBlock = memo(function CodeBlock({
   children,
   codeText,
   showHeader = true,
-  noPadding = false,
 }: CodeBlockProps) {
   const [copied, setCopied] = useState(false);
 
@@ -117,12 +115,7 @@ export const CodeBlock = memo(function CodeBlock({
   return (
     <>
       {showHeader ? (
-        <div
-          className={cn(
-            "bg-background-tint-00 rounded-12 max-w-full min-w-0",
-            !noPadding && "px-1 pb-1"
-          )}
-        >
+        <div className="bg-background-tint-00 px-1 pb-1 rounded-12 max-w-full min-w-0">
           {language && (
             <div className="flex items-center px-2 py-1 text-sm text-text-04 gap-x-2">
               <SvgCode

web/src/app/app/message/FileDisplay.tsx

@@ -1,7 +1,6 @@
 "use client";
 
-import { ReactNode, useState } from "react";
-import { cn } from "@/lib/utils";
+import { useState } from "react";
 import { ChatFileType, FileDescriptor } from "@/app/app/interfaces";
 import Attachment from "@/refresh-components/Attachment";
 import { InMessageImage } from "@/app/app/components/files/images/InMessageImage";
@@ -10,27 +9,10 @@ import PreviewModal from "@/sections/modals/PreviewModal";
 import { MinimalOnyxDocument } from "@/lib/search/interfaces";
 import ExpandableContentWrapper from "@/components/tools/ExpandableContentWrapper";
 
-interface FileContainerProps {
-  children: ReactNode;
-  className?: string;
-  id?: string;
-}
-
 interface FileDisplayProps {
   files: FileDescriptor[];
 }
 
-function FileContainer({ children, className, id }: FileContainerProps) {
-  return (
-    <div
-      id={id}
-      className={cn("flex w-full flex-col items-end gap-2 py-2", className)}
-    >
-      {children}
-    </div>
-  );
-}
-
 export default function FileDisplay({ files }: FileDisplayProps) {
   const [close, setClose] = useState(true);
   const [previewingFile, setPreviewingFile] = useState<FileDescriptor | null>(
@@ -59,7 +41,7 @@ export default function FileDisplay({ files }: FileDisplayProps) {
       )}
 
       {textFiles.length > 0 && (
-        <FileContainer id="onyx-file">
+        <div id="onyx-file" className="flex flex-col items-end gap-2 py-2">
           {textFiles.map((file) => (
             <Attachment
               key={file.id}
@@ -67,36 +49,40 @@ export default function FileDisplay({ files }: FileDisplayProps) {
               open={() => setPreviewingFile(file)}
             />
           ))}
-        </FileContainer>
+        </div>
       )}
 
       {imageFiles.length > 0 && (
-        <FileContainer id="onyx-image">
+        <div id="onyx-image" className="flex flex-col items-end gap-2 py-2">
           {imageFiles.map((file) => (
             <InMessageImage key={file.id} fileId={file.id} />
           ))}
-        </FileContainer>
+        </div>
       )}
 
       {csvFiles.length > 0 && (
-        <FileContainer className="overflow-auto">
-          {csvFiles.map((file) =>
-            close ? (
-              <ExpandableContentWrapper
-                key={file.id}
-                fileDescriptor={file}
-                close={() => setClose(false)}
-                ContentComponent={CsvContent}
-              />
-            ) : (
-              <Attachment
-                key={file.id}
-                open={() => setClose(true)}
-                fileName={file.name || file.id}
-              />
-            )
-          )}
-        </FileContainer>
+        <div className="flex flex-col items-end gap-2 py-2">
+          {csvFiles.map((file) => {
+            return (
+              <div key={file.id} className="w-fit">
+                {close ? (
+                  <>
+                    <ExpandableContentWrapper
+                      fileDescriptor={file}
+                      close={() => setClose(false)}
+                      ContentComponent={CsvContent}
+                    />
+                  </>
+                ) : (
+                  <Attachment
+                    open={() => setClose(true)}
+                    fileName={file.name || file.id}
+                  />
+                )}
+              </div>
+            );
+          })}
+        </div>
       )}
     </>
   );

web/src/app/app/message/custom-code-styles.css

@@ -1,7 +1,7 @@
 /* Light mode syntax highlighting (Atom One Light) */
 .hljs {
   color: #383a42 !important;
-  background: var(--background-code-01) !important;
+  background: #fafafa !important;
 }
 
 .hljs-comment,
@@ -77,7 +77,7 @@
 /* Dark mode syntax highlighting (Atom One Dark) */
 .dark .hljs {
   color: #e2e6eb !important;
-  background: var(--background-code-01) !important;
+  background: #151617 !important;
 }
 
 .dark .hljs-comment,

web/src/app/app/message/messageComponents/AgentMessage.tsx

@@ -2,11 +2,9 @@
 
 import React, { useRef, RefObject, useMemo } from "react";
 import { Packet, StopReason } from "@/app/app/services/streamingModels";
-import CustomToolAuthCard from "@/app/app/message/messageComponents/CustomToolAuthCard";
 import { FullChatState } from "@/app/app/message/messageComponents/interfaces";
 import { FeedbackType } from "@/app/app/interfaces";
 import { handleCopy } from "@/app/app/message/copyingUtils";
-import { useAuthErrors } from "@/app/app/message/messageComponents/hooks/useAuthErrors";
 import { useMessageSwitching } from "@/app/app/message/messageComponents/hooks/useMessageSwitching";
 import { RendererComponent } from "@/app/app/message/messageComponents/renderMessageComponent";
 import { usePacketProcessor } from "@/app/app/message/messageComponents/timeline/hooks/usePacketProcessor";
@@ -148,8 +146,6 @@ const AgentMessage = React.memo(function AgentMessage({
     ]
   );
 
-  const authErrors = useAuthErrors(rawPackets);
-
   // Message switching logic
   const {
     currentMessageInd,
@@ -193,16 +189,7 @@ const AgentMessage = React.memo(function AgentMessage({
         }}
       >
         {pacedDisplayGroups.length > 0 && (
-          <div ref={finalAnswerRef} className="flex flex-col gap-3">
-            {authErrors.map((authError, i) => (
-              <CustomToolAuthCard
-                key={`auth-error-${i}`}
-                toolName={authError.toolName}
-                toolId={authError.toolId}
-                tools={effectiveChatState.agent.tools}
-                agentId={effectiveChatState.agent.id}
-              />
-            ))}
+          <div ref={finalAnswerRef}>
             {pacedDisplayGroups.map((displayGroup, index) => (
               <RendererComponent
                 key={`${displayGroup.turn_index}-${displayGroup.tab_index}`}

web/src/app/app/message/messageComponents/CustomToolAuthCard.tsx

@@ -1,66 +0,0 @@
-"use client";
-
-import { useMemo } from "react";
-import Message from "@/refresh-components/messages/Message";
-import { ToolSnapshot } from "@/lib/tools/interfaces";
-import { initiateOAuthFlow } from "@/lib/oauth/api";
-import { useToolOAuthStatus } from "@/lib/hooks/useToolOAuthStatus";
-import { SvgArrowExchange } from "@opal/icons";
-
-interface CustomToolAuthCardProps {
-  toolName: string;
-  toolId: number | null;
-  tools: ToolSnapshot[];
-  agentId: number;
-}
-
-function CustomToolAuthCard({
-  toolName,
-  toolId,
-  tools,
-  agentId,
-}: CustomToolAuthCardProps) {
-  const { getToolAuthStatus } = useToolOAuthStatus(agentId);
-  const matchedTool = useMemo(() => {
-    if (toolId == null) return null;
-    return tools.find((t) => t.id === toolId) ?? null;
-  }, [toolId, tools]);
-
-  // Hide the card if the user already has a valid token
-  const authStatus = matchedTool ? getToolAuthStatus(matchedTool) : undefined;
-  if (authStatus?.hasToken && !authStatus.isTokenExpired) {
-    return null;
-  }
-
-  const oauthConfigId = matchedTool?.oauth_config_id ?? null;
-
-  // No OAuth config — nothing actionable to show
-  if (!oauthConfigId) {
-    return null;
-  }
-
-  const handleAuthenticate = () => {
-    initiateOAuthFlow(
-      oauthConfigId,
-      window.location.pathname + window.location.search
-    );
-  };
-
-  return (
-    <Message
-      static
-      large
-      icon
-      close={false}
-      text={`${toolName} not connected`}
-      description={`Connect to ${toolName} to enable this tool`}
-      actions="Connect"
-      actionPrimary
-      actionIcon={SvgArrowExchange}
-      onAction={handleAuthenticate}
-      className="w-full"
-    />
-  );
-}
-
-export default CustomToolAuthCard;

web/src/app/app/message/messageComponents/MessageToolbar.tsx

@@ -249,7 +249,6 @@ export default function MessageToolbar({
             <SelectButton
               icon={SvgThumbsUp}
               onClick={() => handleFeedbackClick("like")}
-              variant="select-light"
               state={isFeedbackTransient("like") ? "selected" : "empty"}
               tooltip={
                 currentFeedback === "like" ? "Remove Like" : "Good Response"
@@ -259,7 +258,6 @@ export default function MessageToolbar({
             <SelectButton
               icon={SvgThumbsDown}
               onClick={() => handleFeedbackClick("dislike")}
-              variant="select-light"
               state={isFeedbackTransient("dislike") ? "selected" : "empty"}
               tooltip={
                 currentFeedback === "dislike"
@@ -285,7 +283,7 @@ export default function MessageToolbar({
                       });
                       regenerator(llmDescriptor);
                     }}
-                    foldable
+                    folded
                   />
                 </div>
               )}

web/src/app/app/message/messageComponents/hooks/useAuthErrors.ts

@@ -1,53 +0,0 @@
-import { useRef } from "react";
-import {
-  CustomToolDelta,
-  Packet,
-  PacketType,
-} from "@/app/app/services/streamingModels";
-
-interface AuthError {
-  toolName: string;
-  toolId: number | null;
-}
-
-export function useAuthErrors(rawPackets: Packet[]): AuthError[] {
-  const stateRef = useRef<{ processedCount: number; errors: AuthError[] }>({
-    processedCount: 0,
-    errors: [],
-  });
-
-  // Reset if packets shrunk (e.g. new message)
-  if (rawPackets.length < stateRef.current.processedCount) {
-    stateRef.current = { processedCount: 0, errors: [] };
-  }
-
-  // Process only new packets (incremental, like usePacketProcessor)
-  if (rawPackets.length > stateRef.current.processedCount) {
-    let newErrors = stateRef.current.errors;
-    for (let i = stateRef.current.processedCount; i < rawPackets.length; i++) {
-      const packet = rawPackets[i]!;
-      if (packet.obj.type === PacketType.CUSTOM_TOOL_DELTA) {
-        const delta = packet.obj as CustomToolDelta;
-        if (delta.error?.is_auth_error) {
-          const alreadyPresent = newErrors.some(
-            (e) =>
-              (delta.tool_id != null && e.toolId === delta.tool_id) ||
-              (delta.tool_id == null && e.toolName === delta.tool_name)
-          );
-          if (!alreadyPresent) {
-            newErrors = [
-              ...newErrors,
-              { toolName: delta.tool_name, toolId: delta.tool_id ?? null },
-            ];
-          }
-        }
-      }
-    }
-    stateRef.current = {
-      processedCount: rawPackets.length,
-      errors: newErrors,
-    };
-  }
-
-  return stateRef.current.errors;
-}

web/src/app/app/message/messageComponents/interfaces.ts

@@ -7,7 +7,6 @@ import { LlmDescriptor } from "@/lib/hooks";
 import { IconType } from "react-icons";
 import { OnyxIconType } from "@/components/icons/icons";
 import { CitationMap } from "../../interfaces";
-import { TimelineSurfaceBackground } from "@/app/app/message/messageComponents/timeline/primitives/TimelineSurface";
 
 export enum RenderType {
   HIGHLIGHT = "highlight",
@@ -52,10 +51,6 @@ export interface RendererResult {
   alwaysCollapsible?: boolean;
   /** Whether the result should be wrapped by timeline UI or rendered as-is */
   timelineLayout?: TimelineLayout;
-  /** Remove right padding for long-form content (reasoning, deep research, memory). */
-  noPaddingRight?: boolean;
-  /** Override the surface background (e.g. "error" for auth failures). */
-  surfaceBackground?: TimelineSurfaceBackground;
 }
 
 // All renderers return an array of results (even single-step renderers return a 1-element array)

web/src/app/app/message/messageComponents/renderers/CustomToolRenderer.tsx

@@ -1,58 +1,14 @@
 import React, { useEffect, useMemo } from "react";
+import { FiExternalLink, FiDownload, FiTool } from "react-icons/fi";
 import {
   PacketType,
   CustomToolPacket,
   CustomToolStart,
-  CustomToolArgs,
   CustomToolDelta,
-  CustomToolErrorInfo,
   SectionEnd,
 } from "../../../services/streamingModels";
 import { MessageRenderer, RenderType } from "../interfaces";
 import { buildImgUrl } from "../../../components/files/images/utils";
-import Text from "@/refresh-components/texts/Text";
-import {
-  SvgActions,
-  SvgArrowExchange,
-  SvgDownload,
-  SvgExternalLink,
-} from "@opal/icons";
-import { CodeBlock } from "@/app/app/message/CodeBlock";
-import hljs from "highlight.js/lib/core";
-import json from "highlight.js/lib/languages/json";
-import FadingEdgeContainer from "@/refresh-components/FadingEdgeContainer";
-
-// Lazy registration for hljs JSON language
-function ensureHljsRegistered() {
-  if (!hljs.listLanguages().includes("json")) {
-    hljs.registerLanguage("json", json);
-  }
-}
-
-// Component to render syntax-highlighted JSON
-interface HighlightedJsonCodeProps {
-  code: string;
-}
-function HighlightedJsonCode({ code }: HighlightedJsonCodeProps) {
-  const highlightedHtml = useMemo(() => {
-    ensureHljsRegistered();
-    try {
-      return hljs.highlight(code, { language: "json" }).value;
-    } catch {
-      return code
-        .replace(/&/g, "&")
-        .replace(/</g, "&lt;")
-        .replace(/>/g, "&gt;");
-    }
-  }, [code]);
-
-  return (
-    <span
-      dangerouslySetInnerHTML={{ __html: highlightedHtml }}
-      className="hljs"
-    />
-  );
-}
 
 function constructCustomToolState(packets: CustomToolPacket[]) {
   const toolStart = packets.find(
@@ -67,26 +23,19 @@ function constructCustomToolState(packets: CustomToolPacket[]) {
   )?.obj as SectionEnd | null;
 
   const toolName = toolStart?.tool_name || toolDeltas[0]?.tool_name || "Tool";
-  const toolArgsPacket = packets.find(
-    (p) => p.obj.type === PacketType.CUSTOM_TOOL_ARGS
-  )?.obj as CustomToolArgs | null;
-  const toolArgs = toolArgsPacket?.tool_args ?? null;
   const latestDelta = toolDeltas[toolDeltas.length - 1] || null;
   const responseType = latestDelta?.response_type || null;
   const data = latestDelta?.data;
   const fileIds = latestDelta?.file_ids || null;
-  const error = latestDelta?.error || null;
 
   const isRunning = Boolean(toolStart && !toolEnd);
   const isComplete = Boolean(toolStart && toolEnd);
 
   return {
     toolName,
-    toolArgs,
     responseType,
     data,
     fileIds,
-    error,
     isRunning,
     isComplete,
   };
@@ -98,16 +47,8 @@ export const CustomToolRenderer: MessageRenderer<CustomToolPacket, {}> = ({
   renderType,
   children,
 }) => {
-  const {
-    toolName,
-    toolArgs,
-    responseType,
-    data,
-    fileIds,
-    error,
-    isRunning,
-    isComplete,
-  } = constructCustomToolState(packets);
+  const { toolName, responseType, data, fileIds, isRunning, isComplete } =
+    constructCustomToolState(packets);
 
   useEffect(() => {
     if (isComplete) {
@@ -117,192 +58,76 @@ export const CustomToolRenderer: MessageRenderer<CustomToolPacket, {}> = ({
 
   const status = useMemo(() => {
     if (isComplete) {
-      if (error) {
-        return error.is_auth_error
-          ? `${toolName} authentication failed (HTTP ${error.status_code})`
-          : `${toolName} failed (HTTP ${error.status_code})`;
-      }
       if (responseType === "image") return `${toolName} returned images`;
       if (responseType === "csv") return `${toolName} returned a file`;
       return `${toolName} completed`;
     }
     if (isRunning) return `${toolName} running...`;
     return null;
-  }, [toolName, responseType, error, isComplete, isRunning]);
+  }, [toolName, responseType, isComplete, isRunning]);
 
-  const icon = SvgActions;
+  const icon = FiTool;
 
-  const toolArgsJson = useMemo(
-    () => (toolArgs ? JSON.stringify(toolArgs, null, 2) : null),
-    [toolArgs]
-  );
-  const dataJson = useMemo(
-    () =>
-      data !== undefined && data !== null && typeof data === "object"
-        ? JSON.stringify(data, null, 2)
-        : null,
-    [data]
-  );
-
-  const content = useMemo(
-    () => (
-      <div className="flex flex-col gap-3">
-        {/* Loading indicator */}
-        {isRunning &&
-          !error &&
-          !fileIds &&
-          (data === undefined || data === null) && (
-            <div className="flex items-center gap-2 text-sm text-text-03">
-              <div className="flex gap-0.5">
-                <div className="w-1 h-1 bg-current rounded-full animate-pulse"></div>
-                <div
-                  className="w-1 h-1 bg-current rounded-full animate-pulse"
-                  style={{ animationDelay: "0.1s" }}
-                ></div>
-                <div
-                  className="w-1 h-1 bg-current rounded-full animate-pulse"
-                  style={{ animationDelay: "0.2s" }}
-                ></div>
-              </div>
-              <Text text03 secondaryBody>
-                Waiting for response...
-              </Text>
-            </div>
-          )}
-
-        {/* Tool arguments */}
-        {toolArgsJson && (
-          <div>
-            <div className="flex items-center gap-1">
-              <SvgArrowExchange className="w-3 h-3 text-text-02" />
-              <Text text04 secondaryBody>
-                Request
-              </Text>
-            </div>
-            <div className="prose max-w-full">
-              <CodeBlock
-                className="font-secondary-mono"
-                codeText={toolArgsJson}
-                noPadding
-              >
-                <HighlightedJsonCode code={toolArgsJson} />
-              </CodeBlock>
-            </div>
-          </div>
-        )}
-
-        {/* Error display */}
-        {error && (
-          <div className="pl-[var(--timeline-common-text-padding)]">
-            <Text text03 mainUiMuted>
-              {error.message}
-            </Text>
-          </div>
-        )}
-
-        {/* File responses */}
-        {!error && fileIds && fileIds.length > 0 && (
-          <div className="text-sm text-text-03 flex flex-col gap-2">
-            {fileIds.map((fid, idx) => (
-              <div key={fid} className="flex items-center gap-2 flex-wrap">
-                <Text text03 secondaryBody className="whitespace-nowrap">
-                  File {idx + 1}
-                </Text>
-                <a
-                  href={buildImgUrl(fid)}
-                  target="_blank"
-                  rel="noreferrer"
-                  className="inline-flex items-center gap-1 text-xs text-action-link-01 hover:underline whitespace-nowrap"
-                >
-                  <SvgExternalLink className="w-3 h-3" /> Open
-                </a>
-                <a
-                  href={buildImgUrl(fid)}
-                  download
-                  className="inline-flex items-center gap-1 text-xs text-action-link-01 hover:underline whitespace-nowrap"
-                >
-                  <SvgDownload className="w-3 h-3" /> Download
-                </a>
-              </div>
-            ))}
-          </div>
-        )}
-
-        {/* JSON/Text responses */}
-        {!error && data !== undefined && data !== null && (
-          <div>
-            <div className="flex items-center gap-1">
-              <SvgArrowExchange className="w-3 h-3 text-text-02" />
-              <Text text04 secondaryBody>
-                Response
-              </Text>
-            </div>
-            <div className="prose max-w-full">
-              {dataJson ? (
-                <CodeBlock
-                  className="font-secondary-mono"
-                  codeText={dataJson}
-                  noPadding
-                >
-                  <HighlightedJsonCode code={dataJson} />
-                </CodeBlock>
-              ) : (
-                <CodeBlock
-                  className="font-secondary-mono"
-                  codeText={String(data)}
-                  noPadding
-                >
-                  {String(data)}
-                </CodeBlock>
-              )}
-            </div>
-          </div>
-        )}
-      </div>
-    ),
-    [toolArgsJson, dataJson, data, fileIds, error, isRunning]
-  );
-
-  // Auth error: always render FULL with error surface
-  if (error?.is_auth_error) {
+  if (renderType === RenderType.COMPACT) {
     return children([
       {
         icon,
-        status,
-        supportsCollapsible: false,
-        noPaddingRight: true,
-        surfaceBackground: "error" as const,
-        content,
-      },
-    ]);
-  }
-
-  // FULL mode
-  if (renderType === RenderType.FULL) {
-    return children([
-      {
-        icon,
-        status,
+        status: status,
         supportsCollapsible: true,
-        noPaddingRight: true,
-        content,
+        // Status is already shown in the step header in compact mode.
+        // Avoid duplicating the same line in the content body.
+        content: <></>,
       },
     ]);
   }
 
-  // COMPACT mode: wrap in fading container
   return children([
     {
       icon,
       status,
       supportsCollapsible: true,
       content: (
-        <FadingEdgeContainer
-          direction="bottom"
-          className="max-h-24 overflow-hidden"
-        >
-          {content}
-        </FadingEdgeContainer>
+        <div className="flex flex-col gap-3">
+          {/* File responses */}
+          {fileIds && fileIds.length > 0 && (
+            <div className="text-sm text-muted-foreground flex flex-col gap-2">
+              {fileIds.map((fid, idx) => (
+                <div key={fid} className="flex items-center gap-2 flex-wrap">
+                  <span className="whitespace-nowrap">File {idx + 1}</span>
+                  <a
+                    href={buildImgUrl(fid)}
+                    target="_blank"
+                    rel="noreferrer"
+                    className="inline-flex items-center gap-1 text-xs text-blue-600 hover:underline whitespace-nowrap"
+                  >
+                    <FiExternalLink className="w-3 h-3" /> Open
+                  </a>
+                  <a
+                    href={buildImgUrl(fid)}
+                    download
+                    className="inline-flex items-center gap-1 text-xs text-blue-600 hover:underline whitespace-nowrap"
+                  >
+                    <FiDownload className="w-3 h-3" /> Download
+                  </a>
+                </div>
+              ))}
+            </div>
+          )}
+
+          {/* JSON/Text responses */}
+          {data !== undefined && data !== null && (
+            <div className="text-xs bg-gray-50 dark:bg-gray-800 p-3 rounded border max-h-96 overflow-y-auto font-mono whitespace-pre-wrap break-all">
+              {typeof data === "string" ? data : JSON.stringify(data, null, 2)}
+            </div>
+          )}
+
+          {/* Show placeholder if no response data yet */}
+          {!fileIds && (data === undefined || data === null) && isRunning && (
+            <div className="text-xs text-gray-500 italic">
+              Waiting for response...
+            </div>
+          )}
+        </div>
       ),
     },
   ]);

web/src/app/app/message/messageComponents/timeline/ExpandedTimelineContent.tsx

@@ -17,6 +17,9 @@ import { TimelineStepComposer } from "./TimelineStepComposer";
 import {
   isSearchToolPackets,
   isPythonToolPackets,
+  isReasoningPackets,
+  isDeepResearchPlanPackets,
+  isMemoryToolPackets,
 } from "@/app/app/message/messageComponents/timeline/packetHelpers";
 
 // =============================================================================
@@ -48,10 +51,24 @@ const TimelineStep = React.memo(function TimelineStep({
     () => isSearchToolPackets(step.packets),
     [step.packets]
   );
+  const isReasoning = useMemo(
+    () => isReasoningPackets(step.packets),
+    [step.packets]
+  );
   const isPythonTool = useMemo(
     () => isPythonToolPackets(step.packets),
     [step.packets]
   );
+  const isDeepResearchPlan = useMemo(
+    () => isDeepResearchPlanPackets(step.packets),
+    [step.packets]
+  );
+
+  const isMemoryTool = useMemo(
+    () => isMemoryToolPackets(step.packets),
+    [step.packets]
+  );
+
   const getCollapsedIcon = useCallback(
     (result: TimelineRendererResult) =>
       isSearchTool ? (result.icon as FunctionComponent<IconProps>) : undefined,
@@ -66,10 +83,19 @@ const TimelineStep = React.memo(function TimelineStep({
         isFirstStep={isFirstStep}
         isSingleStep={isSingleStep}
         collapsible={true}
+        noPaddingRight={isReasoning || isDeepResearchPlan || isMemoryTool}
         getCollapsedIcon={getCollapsedIcon}
       />
     ),
-    [isFirstStep, isLastStep, isSingleStep, getCollapsedIcon]
+    [
+      isFirstStep,
+      isLastStep,
+      isSingleStep,
+      isReasoning,
+      isDeepResearchPlan,
+      isMemoryTool,
+      getCollapsedIcon,
+    ]
   );
 
   return (

web/src/app/app/message/messageComponents/timeline/ParallelTimelineTabs.tsx

@@ -14,6 +14,11 @@ import {
   TimelineRendererComponent,
   TimelineRendererOutput,
 } from "./TimelineRendererComponent";
+import {
+  isReasoningPackets,
+  isDeepResearchPlanPackets,
+  isMemoryToolPackets,
+} from "./packetHelpers";
 import Tabs from "@/refresh-components/Tabs";
 import { SvgBranch, SvgFold, SvgExpand } from "@opal/icons";
 import { Button } from "@opal/components";
@@ -60,6 +65,13 @@ export function ParallelTimelineTabs({
     [turnGroup.steps, activeTab]
   );
 
+  // Determine if the active step needs full-width content (no right padding)
+  const noPaddingRight = activeStep
+    ? isReasoningPackets(activeStep.packets) ||
+      isDeepResearchPlanPackets(activeStep.packets) ||
+      isMemoryToolPackets(activeStep.packets)
+    : false;
+
   // Memoized loading states for each step
   const loadingStates = useMemo(
     () =>
@@ -82,9 +94,10 @@ export function ParallelTimelineTabs({
         isFirstStep={false}
         isSingleStep={false}
         collapsible={true}
+        noPaddingRight={noPaddingRight}
       />
     ),
-    [isLastTurnGroup]
+    [isLastTurnGroup, noPaddingRight]
   );
 
   const hasActivePackets = Boolean(activeStep && activeStep.packets.length > 0);

web/src/app/app/message/messageComponents/timeline/StepContainer.tsx

@@ -2,10 +2,7 @@ import React, { FunctionComponent } from "react";
 import { cn } from "@/lib/utils";
 import { IconProps } from "@opal/types";
 import { TimelineRow } from "@/app/app/message/messageComponents/timeline/primitives/TimelineRow";
-import {
-  TimelineSurface,
-  TimelineSurfaceBackground,
-} from "@/app/app/message/messageComponents/timeline/primitives/TimelineSurface";
+import { TimelineSurface } from "@/app/app/message/messageComponents/timeline/primitives/TimelineSurface";
 import { TimelineStepContent } from "@/app/app/message/messageComponents/timeline/primitives/TimelineStepContent";
 
 export interface StepContainerProps {
@@ -39,8 +36,6 @@ export interface StepContainerProps {
   noPaddingRight?: boolean;
   /** Render without rail (for nested/parallel content) */
   withRail?: boolean;
-  /** Override the surface background variant */
-  surfaceBackground?: TimelineSurfaceBackground;
 }
 
 /** Visual wrapper for timeline steps - icon, connector line, header, and content */
@@ -60,7 +55,6 @@ export function StepContainer({
   collapsedIcon: CollapsedIconComponent,
   noPaddingRight = false,
   withRail = true,
-  surfaceBackground,
 }: StepContainerProps) {
   const iconNode = StepIconComponent ? (
     <StepIconComponent
@@ -76,7 +70,6 @@ export function StepContainer({
       className="flex-1 flex flex-col"
       isHover={isHover}
       roundedBottom={isLastStep}
-      background={surfaceBackground}
     >
       <TimelineStepContent
         header={header}
@@ -88,7 +81,6 @@ export function StepContainer({
         hideHeader={hideHeader}
         collapsedIcon={CollapsedIconComponent}
         noPaddingRight={noPaddingRight}
-        surfaceBackground={surfaceBackground}
       >
         {children}
       </TimelineStepContent>

web/src/app/app/message/messageComponents/timeline/TimelineStepComposer.tsx

@@ -17,6 +17,8 @@ export interface TimelineStepComposerProps {
   isSingleStep?: boolean;
   /** Whether StepContainer should show collapse controls. */
   collapsible?: boolean;
+  /** Remove right padding for long-form content (reasoning, deep research). */
+  noPaddingRight?: boolean;
   /** Optional resolver for custom collapsed icon per result. */
   getCollapsedIcon?: (
     result: TimelineRendererResult
@@ -33,6 +35,7 @@ export function TimelineStepComposer({
   isFirstStep,
   isSingleStep = false,
   collapsible = true,
+  noPaddingRight = false,
   getCollapsedIcon,
 }: TimelineStepComposerProps) {
   return (
@@ -61,9 +64,8 @@ export function TimelineStepComposer({
             collapsedIcon={
               getCollapsedIcon ? getCollapsedIcon(result) : undefined
             }
-            noPaddingRight={result.noPaddingRight ?? false}
+            noPaddingRight={noPaddingRight}
             isHover={result.isHover}
-            surfaceBackground={result.surfaceBackground}
           >
             {result.content}
           </StepContainer>

web/src/app/app/message/messageComponents/timeline/primitives/TimelineStepContent.tsx

@@ -1,10 +1,9 @@
 import React, { FunctionComponent } from "react";
 import { cn } from "@/lib/utils";
-import { SvgFold, SvgExpand, SvgXOctagon } from "@opal/icons";
+import { SvgFold, SvgExpand } from "@opal/icons";
 import { IconProps } from "@opal/types";
 import { Button } from "@opal/components";
 import Text from "@/refresh-components/texts/Text";
-import { TimelineSurfaceBackground } from "@/app/app/message/messageComponents/timeline/primitives/TimelineSurface";
 
 export interface TimelineStepContentProps {
   children?: React.ReactNode;
@@ -17,7 +16,6 @@ export interface TimelineStepContentProps {
   hideHeader?: boolean;
   collapsedIcon?: FunctionComponent<IconProps>;
   noPaddingRight?: boolean;
-  surfaceBackground?: TimelineSurfaceBackground;
 }
 
 /**
@@ -35,7 +33,6 @@ export function TimelineStepContent({
   hideHeader = false,
   collapsedIcon: CollapsedIconComponent,
   noPaddingRight = false,
-  surfaceBackground,
 }: TimelineStepContentProps) {
   const showCollapseControls = collapsible && supportsCollapsible && onToggle;
 
@@ -50,8 +47,8 @@ export function TimelineStepContent({
           </div>
 
           <div className="h-full w-[var(--timeline-step-header-right-section-width)] flex items-center justify-end">
-            {showCollapseControls ? (
-              buttonTitle ? (
+            {showCollapseControls &&
+              (buttonTitle ? (
                 <Button
                   prominence="tertiary"
                   size="md"
@@ -71,12 +68,7 @@ export function TimelineStepContent({
                     isExpanded ? SvgFold : CollapsedIconComponent || SvgExpand
                   }
                 />
-              )
-            ) : surfaceBackground === "error" ? (
-              <div className="p-1.5">
-                <SvgXOctagon className="h-4 w-4 text-status-error-05" />
-              </div>
-            ) : null}
+              ))}
           </div>
         </div>
       )}

web/src/app/app/message/messageComponents/timeline/primitives/TimelineSurface.tsx

@@ -1,7 +1,7 @@
 import React from "react";
 import { cn } from "@/lib/utils";
 
-export type TimelineSurfaceBackground = "tint" | "transparent" | "error";
+export type TimelineSurfaceBackground = "tint" | "transparent";
 
 export interface TimelineSurfaceProps {
   children: React.ReactNode;
@@ -28,16 +28,9 @@ export function TimelineSurface({
     return null;
   }
 
-  const baseBackground =
-    background === "tint"
-      ? "bg-background-tint-00"
-      : background === "error"
-        ? "bg-status-error-00"
-        : "";
+  const baseBackground = background === "tint" ? "bg-background-tint-00" : "";
   const hoverBackground =
-    (background === "tint" || background === "error") && isHover
-      ? "bg-background-tint-02"
-      : "";
+    background === "tint" && isHover ? "bg-background-tint-02" : "";
 
   return (
     <div

web/src/app/app/message/messageComponents/timeline/renderers/deepresearch/DeepResearchPlanRenderer.tsx

@@ -69,7 +69,6 @@ export const DeepResearchPlanRenderer: MessageRenderer<
       icon: SvgCircle,
       status: statusText,
       content: planContent,
-      noPaddingRight: true,
     },
   ]);
 };

web/src/app/app/message/messageComponents/timeline/renderers/deepresearch/ResearchAgentRenderer.tsx

@@ -27,6 +27,7 @@ import {
   useMarkdownComponents,
   renderMarkdown,
 } from "@/app/app/message/messageComponents/markdownUtils";
+import { isReasoningPackets } from "../../packetHelpers";
 
 interface NestedToolGroup {
   sub_turn_index: number;
@@ -316,6 +317,8 @@ export const ResearchAgentRenderer: MessageRenderer<
             !fullReportContent &&
             !isComplete;
 
+          const isReasoning = isReasoningPackets(group.packets);
+
           return (
             <TimelineRendererComponent
               key={group.sub_turn_index}
@@ -334,6 +337,7 @@ export const ResearchAgentRenderer: MessageRenderer<
                   isFirstStep={!researchTask && index === 0}
                   isSingleStep={false}
                   collapsible={true}
+                  noPaddingRight={isReasoning}
                 />
               )}
             </TimelineRendererComponent>

web/src/app/app/message/messageComponents/timeline/renderers/memory/MemoryToolRenderer.tsx

@@ -50,7 +50,6 @@ export const MemoryToolRenderer: MessageRenderer<MemoryToolPacket, {}> = ({
         content: <div />,
         supportsCollapsible: false,
         timelineLayout: "timeline",
-        noPaddingRight: true,
       },
     ]);
   }
@@ -88,7 +87,6 @@ export const MemoryToolRenderer: MessageRenderer<MemoryToolPacket, {}> = ({
         status: "Memory",
         supportsCollapsible: false,
         timelineLayout: "timeline",
-        noPaddingRight: true,
         content,
       },
     ]);
@@ -158,7 +156,6 @@ export const MemoryToolRenderer: MessageRenderer<MemoryToolPacket, {}> = ({
       status: statusLabel,
       supportsCollapsible: false,
       timelineLayout: "timeline",
-      noPaddingRight: true,
       content: memoryContent,
     },
   ]);

web/src/app/app/message/messageComponents/timeline/renderers/reasoning/ReasoningRenderer.tsx

@@ -170,12 +170,7 @@ export const ReasoningRenderer: MessageRenderer<
 
   if (!hasStart && !hasEnd && content.length === 0) {
     return children([
-      {
-        icon: SvgCircle,
-        status: THINKING_STATUS,
-        content: <></>,
-        noPaddingRight: true,
-      },
+      { icon: SvgCircle, status: THINKING_STATUS, content: <></> },
     ]);
   }
 
@@ -197,7 +192,6 @@ export const ReasoningRenderer: MessageRenderer<
       status: displayStatus,
       content: reasoningContent,
       expandedText: reasoningContent,
-      noPaddingRight: true,
     },
   ]);
 };

web/src/app/app/services/packetUtils.ts

@@ -18,7 +18,6 @@ export function isToolPacket(
     PacketType.PYTHON_TOOL_DELTA,
     PacketType.TOOL_CALL_ARGUMENT_DELTA,
     PacketType.CUSTOM_TOOL_START,
-    PacketType.CUSTOM_TOOL_ARGS,
     PacketType.CUSTOM_TOOL_DELTA,
     PacketType.FILE_READER_START,
     PacketType.FILE_READER_RESULT,

web/src/app/app/services/streamingModels.ts

@@ -32,7 +32,6 @@ export enum PacketType {
 
   // Custom tool packets
   CUSTOM_TOOL_START = "custom_tool_start",
-  CUSTOM_TOOL_ARGS = "custom_tool_args",
   CUSTOM_TOOL_DELTA = "custom_tool_delta",
 
   // File reader tool packets
@@ -179,32 +178,17 @@ export interface FetchToolDocuments extends BaseObj {
 }
 
 // Custom Tool Packets
-export interface CustomToolErrorInfo {
-  is_auth_error: boolean;
-  status_code: number;
-  message: string;
-}
-
 export interface CustomToolStart extends BaseObj {
   type: "custom_tool_start";
   tool_name: string;
-  tool_id?: number | null;
-}
-
-export interface CustomToolArgs extends BaseObj {
-  type: "custom_tool_args";
-  tool_name: string;
-  tool_args: Record<string, any>;
 }
 
 export interface CustomToolDelta extends BaseObj {
   type: "custom_tool_delta";
   tool_name: string;
-  tool_id?: number | null;
   response_type: string;
   data?: any;
   file_ids?: string[] | null;
-  error?: CustomToolErrorInfo | null;
 }
 
 // File Reader Packets
@@ -335,7 +319,6 @@ export type FetchToolObj =
   | PacketError;
 export type CustomToolObj =
   | CustomToolStart
-  | CustomToolArgs
   | CustomToolDelta
   | SectionEnd
   | PacketError;

web/src/app/css/colors.css

@@ -438,9 +438,6 @@
   --action-text-link-05: var(--blue-50);
   --action-text-danger-05: var(--red-50);
 
-  /* Background / Code */
-  --background-code-01: var(--grey-02);
-
   /* Code */
   --code-code: var(--alpha-grey-100-85);
   --code-comment: var(--alpha-grey-100-35);
@@ -642,9 +639,6 @@
   --action-text-link-05: var(--blue-45);
   --action-text-danger-05: var(--red-45);
 
-  /* Background / Code */
-  --background-code-01: #151617;
-
   /* Code */
   --code-code: var(--alpha-grey-00-85);
   --code-comment: var(--alpha-grey-00-45);

web/src/app/nrf/NRFChrome.tsx

@@ -11,7 +11,7 @@ import { Button } from "@opal/components";
 import { SvgBubbleText, SvgSearchMenu, SvgSidebar } from "@opal/icons";
 import MinimalMarkdown from "@/components/chat/MinimalMarkdown";
 import { useSettingsContext } from "@/providers/SettingsProvider";
-import type { AppMode } from "@/providers/QueryControllerProvider";
+import { AppMode, useAppMode } from "@/providers/AppModeProvider";
 import useAppFocus from "@/hooks/useAppFocus";
 import { useQueryController } from "@/providers/QueryControllerProvider";
 import { usePaidEnterpriseFeaturesEnabled } from "@/components/settings/usePaidEnterpriseFeaturesEnabled";
@@ -58,15 +58,15 @@ const footerMarkdownComponents = {
  */
 export default function NRFChrome() {
   const isPaidEnterpriseFeaturesEnabled = usePaidEnterpriseFeaturesEnabled();
-  const { state, setAppMode } = useQueryController();
+  const { appMode, setAppMode } = useAppMode();
   const settings = useSettingsContext();
   const { isMobile } = useScreenSize();
   const { setFolded } = useAppSidebarContext();
   const appFocus = useAppFocus();
+  const { classification } = useQueryController();
   const [modePopoverOpen, setModePopoverOpen] = useState(false);
 
-  const effectiveMode: AppMode =
-    appFocus.isNewSession() && state.phase === "idle" ? state.appMode : "chat";
+  const effectiveMode: AppMode = appFocus.isNewSession() ? appMode : "chat";
 
   const customFooterContent =
     settings?.enterpriseSettings?.custom_lower_disclaimer_content ||
@@ -78,7 +78,7 @@ export default function NRFChrome() {
     isPaidEnterpriseFeaturesEnabled &&
     settings.isSearchModeAvailable &&
     appFocus.isNewSession() &&
-    state.phase === "idle";
+    !classification;
 
   const showHeader = isMobile || showModeToggle;
 

web/src/app/nrf/NRFPage.tsx

@@ -175,7 +175,7 @@ export default function NRFPage({ isSidePanel = false }: NRFPageProps) {
   const isStreaming = currentChatState === "streaming";
 
   // Query controller for search/chat classification (EE feature)
-  const { submit: submitQuery, state } = useQueryController();
+  const { submit: submitQuery, classification } = useQueryController();
 
   // Determine if retrieval (search) is enabled based on the agent
   const retrievalEnabled = useMemo(() => {
@@ -186,8 +186,7 @@ export default function NRFPage({ isSidePanel = false }: NRFPageProps) {
   }, [liveAgent]);
 
   // Check if we're in search mode
-  const isSearch =
-    state.phase === "searching" || state.phase === "search-results";
+  const isSearch = classification === "search";
 
   // Anchor for scroll positioning (matches ChatPage pattern)
   const anchorMessage = messageHistory.at(-2) ?? messageHistory[0];
@@ -318,7 +317,7 @@ export default function NRFPage({ isSidePanel = false }: NRFPageProps) {
       };
 
       // Use submitQuery which will classify the query and either:
-      // - Route to search (sets phase to "searching"/"search-results" and shows SearchUI)
+      // - Route to search (sets classification to "search" and shows SearchUI)
       // - Route to chat (calls onChat callback)
       await submitQuery(submittedMessage, onChat);
     },

web/src/components/oauth/OAuthCallbackPage.tsx

@@ -162,19 +162,12 @@ export default function OAuthCallbackPage({ config }: OAuthCallbackPageProps) {
 
         setServiceName(result.serviceName || "");
         // Respect backend-provided redirect path (from state.return_path)
-        // Sanitize to prevent open redirects (e.g. "//evil.com")
-        const rawPath =
+        setRedirectPath(
           responseData.redirect_url ||
-          searchParams?.get("return_path") ||
-          config.defaultRedirectPath ||
-          "/app";
-        const sanitizedPath =
-          rawPath.startsWith("http://") || rawPath.startsWith("https://")
-            ? "/app"
-            : "/" + rawPath.replace(/^\/+/, "");
-        const redirectUrl = new URL(sanitizedPath, window.location.origin);
-        redirectUrl.searchParams.set("message", "oauth_connected");
-        setRedirectPath(redirectUrl.pathname + redirectUrl.search);
+            searchParams?.get("return_path") ||
+            config.defaultRedirectPath ||
+            "/app"
+        );
         setStatusMessage(config.successMessage || "Success!");
 
         const successDetails = config.successDetailsTemplate